1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 MGMT_OP_SET_MESH_RECEIVER, 133 MGMT_OP_MESH_READ_FEATURES, 134 MGMT_OP_MESH_SEND, 135 MGMT_OP_MESH_SEND_CANCEL, 136 }; 137 138 static const u16 mgmt_events[] = { 139 MGMT_EV_CONTROLLER_ERROR, 140 MGMT_EV_INDEX_ADDED, 141 MGMT_EV_INDEX_REMOVED, 142 MGMT_EV_NEW_SETTINGS, 143 MGMT_EV_CLASS_OF_DEV_CHANGED, 144 MGMT_EV_LOCAL_NAME_CHANGED, 145 MGMT_EV_NEW_LINK_KEY, 146 MGMT_EV_NEW_LONG_TERM_KEY, 147 MGMT_EV_DEVICE_CONNECTED, 148 MGMT_EV_DEVICE_DISCONNECTED, 149 MGMT_EV_CONNECT_FAILED, 150 MGMT_EV_PIN_CODE_REQUEST, 151 MGMT_EV_USER_CONFIRM_REQUEST, 152 MGMT_EV_USER_PASSKEY_REQUEST, 153 MGMT_EV_AUTH_FAILED, 154 MGMT_EV_DEVICE_FOUND, 155 MGMT_EV_DISCOVERING, 156 MGMT_EV_DEVICE_BLOCKED, 157 MGMT_EV_DEVICE_UNBLOCKED, 158 MGMT_EV_DEVICE_UNPAIRED, 159 MGMT_EV_PASSKEY_NOTIFY, 160 MGMT_EV_NEW_IRK, 161 MGMT_EV_NEW_CSRK, 162 MGMT_EV_DEVICE_ADDED, 163 MGMT_EV_DEVICE_REMOVED, 164 MGMT_EV_NEW_CONN_PARAM, 165 MGMT_EV_UNCONF_INDEX_ADDED, 166 MGMT_EV_UNCONF_INDEX_REMOVED, 167 MGMT_EV_NEW_CONFIG_OPTIONS, 168 MGMT_EV_EXT_INDEX_ADDED, 169 MGMT_EV_EXT_INDEX_REMOVED, 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 171 MGMT_EV_ADVERTISING_ADDED, 172 MGMT_EV_ADVERTISING_REMOVED, 173 MGMT_EV_EXT_INFO_CHANGED, 174 MGMT_EV_PHY_CONFIGURATION_CHANGED, 175 MGMT_EV_EXP_FEATURE_CHANGED, 176 MGMT_EV_DEVICE_FLAGS_CHANGED, 177 MGMT_EV_ADV_MONITOR_ADDED, 178 MGMT_EV_ADV_MONITOR_REMOVED, 179 MGMT_EV_CONTROLLER_SUSPEND, 180 MGMT_EV_CONTROLLER_RESUME, 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 182 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 183 }; 184 185 static const u16 mgmt_untrusted_commands[] = { 186 MGMT_OP_READ_INDEX_LIST, 187 MGMT_OP_READ_INFO, 188 MGMT_OP_READ_UNCONF_INDEX_LIST, 189 MGMT_OP_READ_CONFIG_INFO, 190 MGMT_OP_READ_EXT_INDEX_LIST, 191 MGMT_OP_READ_EXT_INFO, 192 MGMT_OP_READ_CONTROLLER_CAP, 193 MGMT_OP_READ_EXP_FEATURES_INFO, 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 196 }; 197 198 static const u16 mgmt_untrusted_events[] = { 199 MGMT_EV_INDEX_ADDED, 200 MGMT_EV_INDEX_REMOVED, 201 MGMT_EV_NEW_SETTINGS, 202 MGMT_EV_CLASS_OF_DEV_CHANGED, 203 MGMT_EV_LOCAL_NAME_CHANGED, 204 MGMT_EV_UNCONF_INDEX_ADDED, 205 MGMT_EV_UNCONF_INDEX_REMOVED, 206 MGMT_EV_NEW_CONFIG_OPTIONS, 207 MGMT_EV_EXT_INDEX_ADDED, 208 MGMT_EV_EXT_INDEX_REMOVED, 209 MGMT_EV_EXT_INFO_CHANGED, 210 MGMT_EV_EXP_FEATURE_CHANGED, 211 }; 212 213 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 214 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 216 "\x00\x00\x00\x00\x00\x00\x00\x00" 217 218 /* HCI to MGMT error code conversion table */ 219 static const u8 mgmt_status_table[] = { 220 MGMT_STATUS_SUCCESS, 221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 223 MGMT_STATUS_FAILED, /* Hardware Failure */ 224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 232 MGMT_STATUS_BUSY, /* Command Disallowed */ 233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 234 MGMT_STATUS_REJECTED, /* Rejected Security */ 235 MGMT_STATUS_REJECTED, /* Rejected Personal */ 236 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 243 MGMT_STATUS_BUSY, /* Repeated Attempts */ 244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 251 MGMT_STATUS_FAILED, /* Unspecified Error */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 258 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 260 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 262 MGMT_STATUS_FAILED, /* Transaction Collision */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 265 MGMT_STATUS_REJECTED, /* QoS Rejected */ 266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 267 MGMT_STATUS_REJECTED, /* Insufficient Security */ 268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_BUSY, /* Role Switch Pending */ 271 MGMT_STATUS_FAILED, /* Reserved for future use */ 272 MGMT_STATUS_FAILED, /* Slot Violation */ 273 MGMT_STATUS_FAILED, /* Role Switch Failed */ 274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 276 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 278 MGMT_STATUS_BUSY, /* Controller Busy */ 279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 284 }; 285 286 static u8 mgmt_errno_status(int err) 287 { 288 switch (err) { 289 case 0: 290 return MGMT_STATUS_SUCCESS; 291 case -EPERM: 292 return MGMT_STATUS_REJECTED; 293 case -EINVAL: 294 return MGMT_STATUS_INVALID_PARAMS; 295 case -EOPNOTSUPP: 296 return MGMT_STATUS_NOT_SUPPORTED; 297 case -EBUSY: 298 return MGMT_STATUS_BUSY; 299 case -ETIMEDOUT: 300 return MGMT_STATUS_AUTH_FAILED; 301 case -ENOMEM: 302 return MGMT_STATUS_NO_RESOURCES; 303 case -EISCONN: 304 return MGMT_STATUS_ALREADY_CONNECTED; 305 case -ENOTCONN: 306 return MGMT_STATUS_DISCONNECTED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (d->dev_type == HCI_PRIMARY && 447 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 448 count++; 449 } 450 451 rp_len = sizeof(*rp) + (2 * count); 452 rp = kmalloc(rp_len, GFP_ATOMIC); 453 if (!rp) { 454 read_unlock(&hci_dev_list_lock); 455 return -ENOMEM; 456 } 457 458 count = 0; 459 list_for_each_entry(d, &hci_dev_list, list) { 460 if (hci_dev_test_flag(d, HCI_SETUP) || 461 hci_dev_test_flag(d, HCI_CONFIG) || 462 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 463 continue; 464 465 /* Devices marked as raw-only are neither configured 466 * nor unconfigured controllers. 467 */ 468 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 469 continue; 470 471 if (d->dev_type == HCI_PRIMARY && 472 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 473 rp->index[count++] = cpu_to_le16(d->id); 474 bt_dev_dbg(hdev, "Added hci%u", d->id); 475 } 476 } 477 478 rp->num_controllers = cpu_to_le16(count); 479 rp_len = sizeof(*rp) + (2 * count); 480 481 read_unlock(&hci_dev_list_lock); 482 483 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 484 0, rp, rp_len); 485 486 kfree(rp); 487 488 return err; 489 } 490 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 492 void *data, u16 data_len) 493 { 494 struct mgmt_rp_read_unconf_index_list *rp; 495 struct hci_dev *d; 496 size_t rp_len; 497 u16 count; 498 int err; 499 500 bt_dev_dbg(hdev, "sock %p", sk); 501 502 read_lock(&hci_dev_list_lock); 503 504 count = 0; 505 list_for_each_entry(d, &hci_dev_list, list) { 506 if (d->dev_type == HCI_PRIMARY && 507 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 508 count++; 509 } 510 511 rp_len = sizeof(*rp) + (2 * count); 512 rp = kmalloc(rp_len, GFP_ATOMIC); 513 if (!rp) { 514 read_unlock(&hci_dev_list_lock); 515 return -ENOMEM; 516 } 517 518 count = 0; 519 list_for_each_entry(d, &hci_dev_list, list) { 520 if (hci_dev_test_flag(d, HCI_SETUP) || 521 hci_dev_test_flag(d, HCI_CONFIG) || 522 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 523 continue; 524 525 /* Devices marked as raw-only are neither configured 526 * nor unconfigured controllers. 527 */ 528 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 529 continue; 530 531 if (d->dev_type == HCI_PRIMARY && 532 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 533 rp->index[count++] = cpu_to_le16(d->id); 534 bt_dev_dbg(hdev, "Added hci%u", d->id); 535 } 536 } 537 538 rp->num_controllers = cpu_to_le16(count); 539 rp_len = sizeof(*rp) + (2 * count); 540 541 read_unlock(&hci_dev_list_lock); 542 543 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 544 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 545 546 kfree(rp); 547 548 return err; 549 } 550 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 552 void *data, u16 data_len) 553 { 554 struct mgmt_rp_read_ext_index_list *rp; 555 struct hci_dev *d; 556 u16 count; 557 int err; 558 559 bt_dev_dbg(hdev, "sock %p", sk); 560 561 read_lock(&hci_dev_list_lock); 562 563 count = 0; 564 list_for_each_entry(d, &hci_dev_list, list) { 565 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 566 count++; 567 } 568 569 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 570 if (!rp) { 571 read_unlock(&hci_dev_list_lock); 572 return -ENOMEM; 573 } 574 575 count = 0; 576 list_for_each_entry(d, &hci_dev_list, list) { 577 if (hci_dev_test_flag(d, HCI_SETUP) || 578 hci_dev_test_flag(d, HCI_CONFIG) || 579 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 580 continue; 581 582 /* Devices marked as raw-only are neither configured 583 * nor unconfigured controllers. 584 */ 585 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 586 continue; 587 588 if (d->dev_type == HCI_PRIMARY) { 589 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 590 rp->entry[count].type = 0x01; 591 else 592 rp->entry[count].type = 0x00; 593 } else if (d->dev_type == HCI_AMP) { 594 rp->entry[count].type = 0x02; 595 } else { 596 continue; 597 } 598 599 rp->entry[count].bus = d->bus; 600 rp->entry[count++].index = cpu_to_le16(d->id); 601 bt_dev_dbg(hdev, "Added hci%u", d->id); 602 } 603 604 rp->num_controllers = cpu_to_le16(count); 605 606 read_unlock(&hci_dev_list_lock); 607 608 /* If this command is called at least once, then all the 609 * default index and unconfigured index events are disabled 610 * and from now on only extended index events are used. 611 */ 612 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 613 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 614 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 615 616 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 617 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 618 struct_size(rp, entry, count)); 619 620 kfree(rp); 621 622 return err; 623 } 624 625 static bool is_configured(struct hci_dev *hdev) 626 { 627 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 628 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 629 return false; 630 631 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 632 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 633 !bacmp(&hdev->public_addr, BDADDR_ANY)) 634 return false; 635 636 return true; 637 } 638 639 static __le32 get_missing_options(struct hci_dev *hdev) 640 { 641 u32 options = 0; 642 643 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 644 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 645 options |= MGMT_OPTION_EXTERNAL_CONFIG; 646 647 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 648 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 649 !bacmp(&hdev->public_addr, BDADDR_ANY)) 650 options |= MGMT_OPTION_PUBLIC_ADDRESS; 651 652 return cpu_to_le32(options); 653 } 654 655 static int new_options(struct hci_dev *hdev, struct sock *skip) 656 { 657 __le32 options = get_missing_options(hdev); 658 659 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 660 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 661 } 662 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 664 { 665 __le32 options = get_missing_options(hdev); 666 667 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 668 sizeof(options)); 669 } 670 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 672 void *data, u16 data_len) 673 { 674 struct mgmt_rp_read_config_info rp; 675 u32 options = 0; 676 677 bt_dev_dbg(hdev, "sock %p", sk); 678 679 hci_dev_lock(hdev); 680 681 memset(&rp, 0, sizeof(rp)); 682 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 683 684 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 685 options |= MGMT_OPTION_EXTERNAL_CONFIG; 686 687 if (hdev->set_bdaddr) 688 options |= MGMT_OPTION_PUBLIC_ADDRESS; 689 690 rp.supported_options = cpu_to_le32(options); 691 rp.missing_options = get_missing_options(hdev); 692 693 hci_dev_unlock(hdev); 694 695 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 696 &rp, sizeof(rp)); 697 } 698 699 static u32 get_supported_phys(struct hci_dev *hdev) 700 { 701 u32 supported_phys = 0; 702 703 if (lmp_bredr_capable(hdev)) { 704 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 705 706 if (hdev->features[0][0] & LMP_3SLOT) 707 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 708 709 if (hdev->features[0][0] & LMP_5SLOT) 710 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 711 712 if (lmp_edr_2m_capable(hdev)) { 713 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 714 715 if (lmp_edr_3slot_capable(hdev)) 716 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 717 718 if (lmp_edr_5slot_capable(hdev)) 719 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 720 721 if (lmp_edr_3m_capable(hdev)) { 722 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 723 724 if (lmp_edr_3slot_capable(hdev)) 725 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 726 727 if (lmp_edr_5slot_capable(hdev)) 728 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 729 } 730 } 731 } 732 733 if (lmp_le_capable(hdev)) { 734 supported_phys |= MGMT_PHY_LE_1M_TX; 735 supported_phys |= MGMT_PHY_LE_1M_RX; 736 737 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 738 supported_phys |= MGMT_PHY_LE_2M_TX; 739 supported_phys |= MGMT_PHY_LE_2M_RX; 740 } 741 742 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 743 supported_phys |= MGMT_PHY_LE_CODED_TX; 744 supported_phys |= MGMT_PHY_LE_CODED_RX; 745 } 746 } 747 748 return supported_phys; 749 } 750 751 static u32 get_selected_phys(struct hci_dev *hdev) 752 { 753 u32 selected_phys = 0; 754 755 if (lmp_bredr_capable(hdev)) { 756 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 757 758 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 759 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 760 761 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 762 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 763 764 if (lmp_edr_2m_capable(hdev)) { 765 if (!(hdev->pkt_type & HCI_2DH1)) 766 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 767 768 if (lmp_edr_3slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH3)) 770 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 771 772 if (lmp_edr_5slot_capable(hdev) && 773 !(hdev->pkt_type & HCI_2DH5)) 774 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 775 776 if (lmp_edr_3m_capable(hdev)) { 777 if (!(hdev->pkt_type & HCI_3DH1)) 778 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 779 780 if (lmp_edr_3slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH3)) 782 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 783 784 if (lmp_edr_5slot_capable(hdev) && 785 !(hdev->pkt_type & HCI_3DH5)) 786 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 787 } 788 } 789 } 790 791 if (lmp_le_capable(hdev)) { 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 793 selected_phys |= MGMT_PHY_LE_1M_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 796 selected_phys |= MGMT_PHY_LE_1M_RX; 797 798 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 799 selected_phys |= MGMT_PHY_LE_2M_TX; 800 801 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 802 selected_phys |= MGMT_PHY_LE_2M_RX; 803 804 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 805 selected_phys |= MGMT_PHY_LE_CODED_TX; 806 807 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 808 selected_phys |= MGMT_PHY_LE_CODED_RX; 809 } 810 811 return selected_phys; 812 } 813 814 static u32 get_configurable_phys(struct hci_dev *hdev) 815 { 816 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 817 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 818 } 819 820 static u32 get_supported_settings(struct hci_dev *hdev) 821 { 822 u32 settings = 0; 823 824 settings |= MGMT_SETTING_POWERED; 825 settings |= MGMT_SETTING_BONDABLE; 826 settings |= MGMT_SETTING_DEBUG_KEYS; 827 settings |= MGMT_SETTING_CONNECTABLE; 828 settings |= MGMT_SETTING_DISCOVERABLE; 829 830 if (lmp_bredr_capable(hdev)) { 831 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 832 settings |= MGMT_SETTING_FAST_CONNECTABLE; 833 settings |= MGMT_SETTING_BREDR; 834 settings |= MGMT_SETTING_LINK_SECURITY; 835 836 if (lmp_ssp_capable(hdev)) { 837 settings |= MGMT_SETTING_SSP; 838 } 839 840 if (lmp_sc_capable(hdev)) 841 settings |= MGMT_SETTING_SECURE_CONN; 842 843 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 844 &hdev->quirks)) 845 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 846 } 847 848 if (lmp_le_capable(hdev)) { 849 settings |= MGMT_SETTING_LE; 850 settings |= MGMT_SETTING_SECURE_CONN; 851 settings |= MGMT_SETTING_PRIVACY; 852 settings |= MGMT_SETTING_STATIC_ADDRESS; 853 settings |= MGMT_SETTING_ADVERTISING; 854 } 855 856 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 857 hdev->set_bdaddr) 858 settings |= MGMT_SETTING_CONFIGURATION; 859 860 if (cis_central_capable(hdev)) 861 settings |= MGMT_SETTING_CIS_CENTRAL; 862 863 if (cis_peripheral_capable(hdev)) 864 settings |= MGMT_SETTING_CIS_PERIPHERAL; 865 866 settings |= MGMT_SETTING_PHY_CONFIGURATION; 867 868 return settings; 869 } 870 871 static u32 get_current_settings(struct hci_dev *hdev) 872 { 873 u32 settings = 0; 874 875 if (hdev_is_powered(hdev)) 876 settings |= MGMT_SETTING_POWERED; 877 878 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 879 settings |= MGMT_SETTING_CONNECTABLE; 880 881 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 882 settings |= MGMT_SETTING_FAST_CONNECTABLE; 883 884 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 885 settings |= MGMT_SETTING_DISCOVERABLE; 886 887 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 888 settings |= MGMT_SETTING_BONDABLE; 889 890 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 891 settings |= MGMT_SETTING_BREDR; 892 893 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 894 settings |= MGMT_SETTING_LE; 895 896 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 897 settings |= MGMT_SETTING_LINK_SECURITY; 898 899 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 900 settings |= MGMT_SETTING_SSP; 901 902 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 903 settings |= MGMT_SETTING_ADVERTISING; 904 905 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 906 settings |= MGMT_SETTING_SECURE_CONN; 907 908 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 909 settings |= MGMT_SETTING_DEBUG_KEYS; 910 911 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 912 settings |= MGMT_SETTING_PRIVACY; 913 914 /* The current setting for static address has two purposes. The 915 * first is to indicate if the static address will be used and 916 * the second is to indicate if it is actually set. 917 * 918 * This means if the static address is not configured, this flag 919 * will never be set. If the address is configured, then if the 920 * address is actually used decides if the flag is set or not. 921 * 922 * For single mode LE only controllers and dual-mode controllers 923 * with BR/EDR disabled, the existence of the static address will 924 * be evaluated. 925 */ 926 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 927 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 928 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 929 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 930 settings |= MGMT_SETTING_STATIC_ADDRESS; 931 } 932 933 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 934 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 935 936 if (cis_central_capable(hdev)) 937 settings |= MGMT_SETTING_CIS_CENTRAL; 938 939 if (cis_peripheral_capable(hdev)) 940 settings |= MGMT_SETTING_CIS_PERIPHERAL; 941 942 if (bis_capable(hdev)) 943 settings |= MGMT_SETTING_ISO_BROADCASTER; 944 945 if (sync_recv_capable(hdev)) 946 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 947 948 return settings; 949 } 950 951 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 952 { 953 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 954 } 955 956 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 957 { 958 struct mgmt_pending_cmd *cmd; 959 960 /* If there's a pending mgmt command the flags will not yet have 961 * their final values, so check for this first. 962 */ 963 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 964 if (cmd) { 965 struct mgmt_mode *cp = cmd->param; 966 if (cp->val == 0x01) 967 return LE_AD_GENERAL; 968 else if (cp->val == 0x02) 969 return LE_AD_LIMITED; 970 } else { 971 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 972 return LE_AD_LIMITED; 973 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 974 return LE_AD_GENERAL; 975 } 976 977 return 0; 978 } 979 980 bool mgmt_get_connectable(struct hci_dev *hdev) 981 { 982 struct mgmt_pending_cmd *cmd; 983 984 /* If there's a pending mgmt command the flag will not yet have 985 * it's final value, so check for this first. 986 */ 987 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 988 if (cmd) { 989 struct mgmt_mode *cp = cmd->param; 990 991 return cp->val; 992 } 993 994 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 995 } 996 997 static int service_cache_sync(struct hci_dev *hdev, void *data) 998 { 999 hci_update_eir_sync(hdev); 1000 hci_update_class_sync(hdev); 1001 1002 return 0; 1003 } 1004 1005 static void service_cache_off(struct work_struct *work) 1006 { 1007 struct hci_dev *hdev = container_of(work, struct hci_dev, 1008 service_cache.work); 1009 1010 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1011 return; 1012 1013 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1014 } 1015 1016 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1017 { 1018 /* The generation of a new RPA and programming it into the 1019 * controller happens in the hci_req_enable_advertising() 1020 * function. 1021 */ 1022 if (ext_adv_capable(hdev)) 1023 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1024 else 1025 return hci_enable_advertising_sync(hdev); 1026 } 1027 1028 static void rpa_expired(struct work_struct *work) 1029 { 1030 struct hci_dev *hdev = container_of(work, struct hci_dev, 1031 rpa_expired.work); 1032 1033 bt_dev_dbg(hdev, ""); 1034 1035 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1036 1037 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1038 return; 1039 1040 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1041 } 1042 1043 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1044 1045 static void discov_off(struct work_struct *work) 1046 { 1047 struct hci_dev *hdev = container_of(work, struct hci_dev, 1048 discov_off.work); 1049 1050 bt_dev_dbg(hdev, ""); 1051 1052 hci_dev_lock(hdev); 1053 1054 /* When discoverable timeout triggers, then just make sure 1055 * the limited discoverable flag is cleared. Even in the case 1056 * of a timeout triggered from general discoverable, it is 1057 * safe to unconditionally clear the flag. 1058 */ 1059 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1060 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1061 hdev->discov_timeout = 0; 1062 1063 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1064 1065 mgmt_new_settings(hdev); 1066 1067 hci_dev_unlock(hdev); 1068 } 1069 1070 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1071 1072 static void mesh_send_complete(struct hci_dev *hdev, 1073 struct mgmt_mesh_tx *mesh_tx, bool silent) 1074 { 1075 u8 handle = mesh_tx->handle; 1076 1077 if (!silent) 1078 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1079 sizeof(handle), NULL); 1080 1081 mgmt_mesh_remove(mesh_tx); 1082 } 1083 1084 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1085 { 1086 struct mgmt_mesh_tx *mesh_tx; 1087 1088 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1089 hci_disable_advertising_sync(hdev); 1090 mesh_tx = mgmt_mesh_next(hdev, NULL); 1091 1092 if (mesh_tx) 1093 mesh_send_complete(hdev, mesh_tx, false); 1094 1095 return 0; 1096 } 1097 1098 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1099 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1100 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1101 { 1102 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1103 1104 if (!mesh_tx) 1105 return; 1106 1107 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1108 mesh_send_start_complete); 1109 1110 if (err < 0) 1111 mesh_send_complete(hdev, mesh_tx, false); 1112 else 1113 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1114 } 1115 1116 static void mesh_send_done(struct work_struct *work) 1117 { 1118 struct hci_dev *hdev = container_of(work, struct hci_dev, 1119 mesh_send_done.work); 1120 1121 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1122 return; 1123 1124 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1125 } 1126 1127 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1128 { 1129 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1130 return; 1131 1132 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1133 1134 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1135 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1136 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1137 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1138 1139 /* Non-mgmt controlled devices get this bit set 1140 * implicitly so that pairing works for them, however 1141 * for mgmt we require user-space to explicitly enable 1142 * it 1143 */ 1144 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1145 1146 hci_dev_set_flag(hdev, HCI_MGMT); 1147 } 1148 1149 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1150 void *data, u16 data_len) 1151 { 1152 struct mgmt_rp_read_info rp; 1153 1154 bt_dev_dbg(hdev, "sock %p", sk); 1155 1156 hci_dev_lock(hdev); 1157 1158 memset(&rp, 0, sizeof(rp)); 1159 1160 bacpy(&rp.bdaddr, &hdev->bdaddr); 1161 1162 rp.version = hdev->hci_ver; 1163 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1164 1165 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1166 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1167 1168 memcpy(rp.dev_class, hdev->dev_class, 3); 1169 1170 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1171 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1172 1173 hci_dev_unlock(hdev); 1174 1175 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1176 sizeof(rp)); 1177 } 1178 1179 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1180 { 1181 u16 eir_len = 0; 1182 size_t name_len; 1183 1184 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1185 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1186 hdev->dev_class, 3); 1187 1188 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1189 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1190 hdev->appearance); 1191 1192 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1193 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1194 hdev->dev_name, name_len); 1195 1196 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1197 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1198 hdev->short_name, name_len); 1199 1200 return eir_len; 1201 } 1202 1203 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1204 void *data, u16 data_len) 1205 { 1206 char buf[512]; 1207 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1208 u16 eir_len; 1209 1210 bt_dev_dbg(hdev, "sock %p", sk); 1211 1212 memset(&buf, 0, sizeof(buf)); 1213 1214 hci_dev_lock(hdev); 1215 1216 bacpy(&rp->bdaddr, &hdev->bdaddr); 1217 1218 rp->version = hdev->hci_ver; 1219 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1220 1221 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1222 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1223 1224 1225 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1226 rp->eir_len = cpu_to_le16(eir_len); 1227 1228 hci_dev_unlock(hdev); 1229 1230 /* If this command is called at least once, then the events 1231 * for class of device and local name changes are disabled 1232 * and only the new extended controller information event 1233 * is used. 1234 */ 1235 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1236 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1237 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1238 1239 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1240 sizeof(*rp) + eir_len); 1241 } 1242 1243 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1244 { 1245 char buf[512]; 1246 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1247 u16 eir_len; 1248 1249 memset(buf, 0, sizeof(buf)); 1250 1251 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1252 ev->eir_len = cpu_to_le16(eir_len); 1253 1254 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1255 sizeof(*ev) + eir_len, 1256 HCI_MGMT_EXT_INFO_EVENTS, skip); 1257 } 1258 1259 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1260 { 1261 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1262 1263 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1264 sizeof(settings)); 1265 } 1266 1267 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1268 { 1269 struct mgmt_ev_advertising_added ev; 1270 1271 ev.instance = instance; 1272 1273 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1274 } 1275 1276 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1277 u8 instance) 1278 { 1279 struct mgmt_ev_advertising_removed ev; 1280 1281 ev.instance = instance; 1282 1283 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1284 } 1285 1286 static void cancel_adv_timeout(struct hci_dev *hdev) 1287 { 1288 if (hdev->adv_instance_timeout) { 1289 hdev->adv_instance_timeout = 0; 1290 cancel_delayed_work(&hdev->adv_instance_expire); 1291 } 1292 } 1293 1294 /* This function requires the caller holds hdev->lock */ 1295 static void restart_le_actions(struct hci_dev *hdev) 1296 { 1297 struct hci_conn_params *p; 1298 1299 list_for_each_entry(p, &hdev->le_conn_params, list) { 1300 /* Needed for AUTO_OFF case where might not "really" 1301 * have been powered off. 1302 */ 1303 hci_pend_le_list_del_init(p); 1304 1305 switch (p->auto_connect) { 1306 case HCI_AUTO_CONN_DIRECT: 1307 case HCI_AUTO_CONN_ALWAYS: 1308 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1309 break; 1310 case HCI_AUTO_CONN_REPORT: 1311 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1312 break; 1313 default: 1314 break; 1315 } 1316 } 1317 } 1318 1319 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1320 { 1321 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1322 1323 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1324 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1325 } 1326 1327 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1328 { 1329 struct mgmt_pending_cmd *cmd = data; 1330 struct mgmt_mode *cp; 1331 1332 /* Make sure cmd still outstanding. */ 1333 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1334 return; 1335 1336 cp = cmd->param; 1337 1338 bt_dev_dbg(hdev, "err %d", err); 1339 1340 if (!err) { 1341 if (cp->val) { 1342 hci_dev_lock(hdev); 1343 restart_le_actions(hdev); 1344 hci_update_passive_scan(hdev); 1345 hci_dev_unlock(hdev); 1346 } 1347 1348 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1349 1350 /* Only call new_setting for power on as power off is deferred 1351 * to hdev->power_off work which does call hci_dev_do_close. 1352 */ 1353 if (cp->val) 1354 new_settings(hdev, cmd->sk); 1355 } else { 1356 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1357 mgmt_status(err)); 1358 } 1359 1360 mgmt_pending_remove(cmd); 1361 } 1362 1363 static int set_powered_sync(struct hci_dev *hdev, void *data) 1364 { 1365 struct mgmt_pending_cmd *cmd = data; 1366 struct mgmt_mode *cp = cmd->param; 1367 1368 BT_DBG("%s", hdev->name); 1369 1370 return hci_set_powered_sync(hdev, cp->val); 1371 } 1372 1373 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1374 u16 len) 1375 { 1376 struct mgmt_mode *cp = data; 1377 struct mgmt_pending_cmd *cmd; 1378 int err; 1379 1380 bt_dev_dbg(hdev, "sock %p", sk); 1381 1382 if (cp->val != 0x00 && cp->val != 0x01) 1383 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1384 MGMT_STATUS_INVALID_PARAMS); 1385 1386 hci_dev_lock(hdev); 1387 1388 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1389 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1390 MGMT_STATUS_BUSY); 1391 goto failed; 1392 } 1393 1394 if (!!cp->val == hdev_is_powered(hdev)) { 1395 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1396 goto failed; 1397 } 1398 1399 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1400 if (!cmd) { 1401 err = -ENOMEM; 1402 goto failed; 1403 } 1404 1405 /* Cancel potentially blocking sync operation before power off */ 1406 if (cp->val == 0x00) { 1407 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1408 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1409 mgmt_set_powered_complete); 1410 } else { 1411 /* Use hci_cmd_sync_submit since hdev might not be running */ 1412 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1413 mgmt_set_powered_complete); 1414 } 1415 1416 if (err < 0) 1417 mgmt_pending_remove(cmd); 1418 1419 failed: 1420 hci_dev_unlock(hdev); 1421 return err; 1422 } 1423 1424 int mgmt_new_settings(struct hci_dev *hdev) 1425 { 1426 return new_settings(hdev, NULL); 1427 } 1428 1429 struct cmd_lookup { 1430 struct sock *sk; 1431 struct hci_dev *hdev; 1432 u8 mgmt_status; 1433 }; 1434 1435 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1436 { 1437 struct cmd_lookup *match = data; 1438 1439 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1440 1441 list_del(&cmd->list); 1442 1443 if (match->sk == NULL) { 1444 match->sk = cmd->sk; 1445 sock_hold(match->sk); 1446 } 1447 1448 mgmt_pending_free(cmd); 1449 } 1450 1451 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1452 { 1453 u8 *status = data; 1454 1455 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1456 mgmt_pending_remove(cmd); 1457 } 1458 1459 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1460 { 1461 if (cmd->cmd_complete) { 1462 u8 *status = data; 1463 1464 cmd->cmd_complete(cmd, *status); 1465 mgmt_pending_remove(cmd); 1466 1467 return; 1468 } 1469 1470 cmd_status_rsp(cmd, data); 1471 } 1472 1473 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1474 { 1475 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1476 cmd->param, cmd->param_len); 1477 } 1478 1479 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1480 { 1481 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1482 cmd->param, sizeof(struct mgmt_addr_info)); 1483 } 1484 1485 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1486 { 1487 if (!lmp_bredr_capable(hdev)) 1488 return MGMT_STATUS_NOT_SUPPORTED; 1489 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1490 return MGMT_STATUS_REJECTED; 1491 else 1492 return MGMT_STATUS_SUCCESS; 1493 } 1494 1495 static u8 mgmt_le_support(struct hci_dev *hdev) 1496 { 1497 if (!lmp_le_capable(hdev)) 1498 return MGMT_STATUS_NOT_SUPPORTED; 1499 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1500 return MGMT_STATUS_REJECTED; 1501 else 1502 return MGMT_STATUS_SUCCESS; 1503 } 1504 1505 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1506 int err) 1507 { 1508 struct mgmt_pending_cmd *cmd = data; 1509 1510 bt_dev_dbg(hdev, "err %d", err); 1511 1512 /* Make sure cmd still outstanding. */ 1513 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1514 return; 1515 1516 hci_dev_lock(hdev); 1517 1518 if (err) { 1519 u8 mgmt_err = mgmt_status(err); 1520 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1521 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1522 goto done; 1523 } 1524 1525 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1526 hdev->discov_timeout > 0) { 1527 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1528 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1529 } 1530 1531 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1532 new_settings(hdev, cmd->sk); 1533 1534 done: 1535 mgmt_pending_remove(cmd); 1536 hci_dev_unlock(hdev); 1537 } 1538 1539 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1540 { 1541 BT_DBG("%s", hdev->name); 1542 1543 return hci_update_discoverable_sync(hdev); 1544 } 1545 1546 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1547 u16 len) 1548 { 1549 struct mgmt_cp_set_discoverable *cp = data; 1550 struct mgmt_pending_cmd *cmd; 1551 u16 timeout; 1552 int err; 1553 1554 bt_dev_dbg(hdev, "sock %p", sk); 1555 1556 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1557 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1558 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1559 MGMT_STATUS_REJECTED); 1560 1561 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1562 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1563 MGMT_STATUS_INVALID_PARAMS); 1564 1565 timeout = __le16_to_cpu(cp->timeout); 1566 1567 /* Disabling discoverable requires that no timeout is set, 1568 * and enabling limited discoverable requires a timeout. 1569 */ 1570 if ((cp->val == 0x00 && timeout > 0) || 1571 (cp->val == 0x02 && timeout == 0)) 1572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1573 MGMT_STATUS_INVALID_PARAMS); 1574 1575 hci_dev_lock(hdev); 1576 1577 if (!hdev_is_powered(hdev) && timeout > 0) { 1578 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1579 MGMT_STATUS_NOT_POWERED); 1580 goto failed; 1581 } 1582 1583 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1584 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1585 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1586 MGMT_STATUS_BUSY); 1587 goto failed; 1588 } 1589 1590 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1591 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1592 MGMT_STATUS_REJECTED); 1593 goto failed; 1594 } 1595 1596 if (hdev->advertising_paused) { 1597 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1598 MGMT_STATUS_BUSY); 1599 goto failed; 1600 } 1601 1602 if (!hdev_is_powered(hdev)) { 1603 bool changed = false; 1604 1605 /* Setting limited discoverable when powered off is 1606 * not a valid operation since it requires a timeout 1607 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1608 */ 1609 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1610 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1611 changed = true; 1612 } 1613 1614 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1615 if (err < 0) 1616 goto failed; 1617 1618 if (changed) 1619 err = new_settings(hdev, sk); 1620 1621 goto failed; 1622 } 1623 1624 /* If the current mode is the same, then just update the timeout 1625 * value with the new value. And if only the timeout gets updated, 1626 * then no need for any HCI transactions. 1627 */ 1628 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1629 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1630 HCI_LIMITED_DISCOVERABLE)) { 1631 cancel_delayed_work(&hdev->discov_off); 1632 hdev->discov_timeout = timeout; 1633 1634 if (cp->val && hdev->discov_timeout > 0) { 1635 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1636 queue_delayed_work(hdev->req_workqueue, 1637 &hdev->discov_off, to); 1638 } 1639 1640 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1641 goto failed; 1642 } 1643 1644 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1645 if (!cmd) { 1646 err = -ENOMEM; 1647 goto failed; 1648 } 1649 1650 /* Cancel any potential discoverable timeout that might be 1651 * still active and store new timeout value. The arming of 1652 * the timeout happens in the complete handler. 1653 */ 1654 cancel_delayed_work(&hdev->discov_off); 1655 hdev->discov_timeout = timeout; 1656 1657 if (cp->val) 1658 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1659 else 1660 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1661 1662 /* Limited discoverable mode */ 1663 if (cp->val == 0x02) 1664 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1665 else 1666 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1667 1668 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1669 mgmt_set_discoverable_complete); 1670 1671 if (err < 0) 1672 mgmt_pending_remove(cmd); 1673 1674 failed: 1675 hci_dev_unlock(hdev); 1676 return err; 1677 } 1678 1679 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1680 int err) 1681 { 1682 struct mgmt_pending_cmd *cmd = data; 1683 1684 bt_dev_dbg(hdev, "err %d", err); 1685 1686 /* Make sure cmd still outstanding. */ 1687 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1688 return; 1689 1690 hci_dev_lock(hdev); 1691 1692 if (err) { 1693 u8 mgmt_err = mgmt_status(err); 1694 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1695 goto done; 1696 } 1697 1698 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1699 new_settings(hdev, cmd->sk); 1700 1701 done: 1702 if (cmd) 1703 mgmt_pending_remove(cmd); 1704 1705 hci_dev_unlock(hdev); 1706 } 1707 1708 static int set_connectable_update_settings(struct hci_dev *hdev, 1709 struct sock *sk, u8 val) 1710 { 1711 bool changed = false; 1712 int err; 1713 1714 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1715 changed = true; 1716 1717 if (val) { 1718 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1719 } else { 1720 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1721 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1722 } 1723 1724 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1725 if (err < 0) 1726 return err; 1727 1728 if (changed) { 1729 hci_update_scan(hdev); 1730 hci_update_passive_scan(hdev); 1731 return new_settings(hdev, sk); 1732 } 1733 1734 return 0; 1735 } 1736 1737 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1738 { 1739 BT_DBG("%s", hdev->name); 1740 1741 return hci_update_connectable_sync(hdev); 1742 } 1743 1744 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1745 u16 len) 1746 { 1747 struct mgmt_mode *cp = data; 1748 struct mgmt_pending_cmd *cmd; 1749 int err; 1750 1751 bt_dev_dbg(hdev, "sock %p", sk); 1752 1753 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1754 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1755 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1756 MGMT_STATUS_REJECTED); 1757 1758 if (cp->val != 0x00 && cp->val != 0x01) 1759 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1760 MGMT_STATUS_INVALID_PARAMS); 1761 1762 hci_dev_lock(hdev); 1763 1764 if (!hdev_is_powered(hdev)) { 1765 err = set_connectable_update_settings(hdev, sk, cp->val); 1766 goto failed; 1767 } 1768 1769 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1770 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1771 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1772 MGMT_STATUS_BUSY); 1773 goto failed; 1774 } 1775 1776 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1777 if (!cmd) { 1778 err = -ENOMEM; 1779 goto failed; 1780 } 1781 1782 if (cp->val) { 1783 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1784 } else { 1785 if (hdev->discov_timeout > 0) 1786 cancel_delayed_work(&hdev->discov_off); 1787 1788 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1789 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1790 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1791 } 1792 1793 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1794 mgmt_set_connectable_complete); 1795 1796 if (err < 0) 1797 mgmt_pending_remove(cmd); 1798 1799 failed: 1800 hci_dev_unlock(hdev); 1801 return err; 1802 } 1803 1804 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1805 u16 len) 1806 { 1807 struct mgmt_mode *cp = data; 1808 bool changed; 1809 int err; 1810 1811 bt_dev_dbg(hdev, "sock %p", sk); 1812 1813 if (cp->val != 0x00 && cp->val != 0x01) 1814 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1815 MGMT_STATUS_INVALID_PARAMS); 1816 1817 hci_dev_lock(hdev); 1818 1819 if (cp->val) 1820 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1821 else 1822 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1823 1824 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1825 if (err < 0) 1826 goto unlock; 1827 1828 if (changed) { 1829 /* In limited privacy mode the change of bondable mode 1830 * may affect the local advertising address. 1831 */ 1832 hci_update_discoverable(hdev); 1833 1834 err = new_settings(hdev, sk); 1835 } 1836 1837 unlock: 1838 hci_dev_unlock(hdev); 1839 return err; 1840 } 1841 1842 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1843 u16 len) 1844 { 1845 struct mgmt_mode *cp = data; 1846 struct mgmt_pending_cmd *cmd; 1847 u8 val, status; 1848 int err; 1849 1850 bt_dev_dbg(hdev, "sock %p", sk); 1851 1852 status = mgmt_bredr_support(hdev); 1853 if (status) 1854 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1855 status); 1856 1857 if (cp->val != 0x00 && cp->val != 0x01) 1858 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1859 MGMT_STATUS_INVALID_PARAMS); 1860 1861 hci_dev_lock(hdev); 1862 1863 if (!hdev_is_powered(hdev)) { 1864 bool changed = false; 1865 1866 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1867 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1868 changed = true; 1869 } 1870 1871 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1872 if (err < 0) 1873 goto failed; 1874 1875 if (changed) 1876 err = new_settings(hdev, sk); 1877 1878 goto failed; 1879 } 1880 1881 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1882 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1883 MGMT_STATUS_BUSY); 1884 goto failed; 1885 } 1886 1887 val = !!cp->val; 1888 1889 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1890 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1891 goto failed; 1892 } 1893 1894 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1895 if (!cmd) { 1896 err = -ENOMEM; 1897 goto failed; 1898 } 1899 1900 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1901 if (err < 0) { 1902 mgmt_pending_remove(cmd); 1903 goto failed; 1904 } 1905 1906 failed: 1907 hci_dev_unlock(hdev); 1908 return err; 1909 } 1910 1911 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1912 { 1913 struct cmd_lookup match = { NULL, hdev }; 1914 struct mgmt_pending_cmd *cmd = data; 1915 struct mgmt_mode *cp = cmd->param; 1916 u8 enable = cp->val; 1917 bool changed; 1918 1919 /* Make sure cmd still outstanding. */ 1920 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1921 return; 1922 1923 if (err) { 1924 u8 mgmt_err = mgmt_status(err); 1925 1926 if (enable && hci_dev_test_and_clear_flag(hdev, 1927 HCI_SSP_ENABLED)) { 1928 new_settings(hdev, NULL); 1929 } 1930 1931 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1932 &mgmt_err); 1933 return; 1934 } 1935 1936 if (enable) { 1937 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1938 } else { 1939 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1940 } 1941 1942 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1943 1944 if (changed) 1945 new_settings(hdev, match.sk); 1946 1947 if (match.sk) 1948 sock_put(match.sk); 1949 1950 hci_update_eir_sync(hdev); 1951 } 1952 1953 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1954 { 1955 struct mgmt_pending_cmd *cmd = data; 1956 struct mgmt_mode *cp = cmd->param; 1957 bool changed = false; 1958 int err; 1959 1960 if (cp->val) 1961 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1962 1963 err = hci_write_ssp_mode_sync(hdev, cp->val); 1964 1965 if (!err && changed) 1966 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1967 1968 return err; 1969 } 1970 1971 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1972 { 1973 struct mgmt_mode *cp = data; 1974 struct mgmt_pending_cmd *cmd; 1975 u8 status; 1976 int err; 1977 1978 bt_dev_dbg(hdev, "sock %p", sk); 1979 1980 status = mgmt_bredr_support(hdev); 1981 if (status) 1982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1983 1984 if (!lmp_ssp_capable(hdev)) 1985 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1986 MGMT_STATUS_NOT_SUPPORTED); 1987 1988 if (cp->val != 0x00 && cp->val != 0x01) 1989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1990 MGMT_STATUS_INVALID_PARAMS); 1991 1992 hci_dev_lock(hdev); 1993 1994 if (!hdev_is_powered(hdev)) { 1995 bool changed; 1996 1997 if (cp->val) { 1998 changed = !hci_dev_test_and_set_flag(hdev, 1999 HCI_SSP_ENABLED); 2000 } else { 2001 changed = hci_dev_test_and_clear_flag(hdev, 2002 HCI_SSP_ENABLED); 2003 } 2004 2005 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2006 if (err < 0) 2007 goto failed; 2008 2009 if (changed) 2010 err = new_settings(hdev, sk); 2011 2012 goto failed; 2013 } 2014 2015 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2016 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2017 MGMT_STATUS_BUSY); 2018 goto failed; 2019 } 2020 2021 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2022 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2023 goto failed; 2024 } 2025 2026 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2027 if (!cmd) 2028 err = -ENOMEM; 2029 else 2030 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2031 set_ssp_complete); 2032 2033 if (err < 0) { 2034 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2035 MGMT_STATUS_FAILED); 2036 2037 if (cmd) 2038 mgmt_pending_remove(cmd); 2039 } 2040 2041 failed: 2042 hci_dev_unlock(hdev); 2043 return err; 2044 } 2045 2046 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2047 { 2048 bt_dev_dbg(hdev, "sock %p", sk); 2049 2050 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2051 MGMT_STATUS_NOT_SUPPORTED); 2052 } 2053 2054 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2055 { 2056 struct cmd_lookup match = { NULL, hdev }; 2057 u8 status = mgmt_status(err); 2058 2059 bt_dev_dbg(hdev, "err %d", err); 2060 2061 if (status) { 2062 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2063 &status); 2064 return; 2065 } 2066 2067 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2068 2069 new_settings(hdev, match.sk); 2070 2071 if (match.sk) 2072 sock_put(match.sk); 2073 } 2074 2075 static int set_le_sync(struct hci_dev *hdev, void *data) 2076 { 2077 struct mgmt_pending_cmd *cmd = data; 2078 struct mgmt_mode *cp = cmd->param; 2079 u8 val = !!cp->val; 2080 int err; 2081 2082 if (!val) { 2083 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2084 2085 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2086 hci_disable_advertising_sync(hdev); 2087 2088 if (ext_adv_capable(hdev)) 2089 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2090 } else { 2091 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2092 } 2093 2094 err = hci_write_le_host_supported_sync(hdev, val, 0); 2095 2096 /* Make sure the controller has a good default for 2097 * advertising data. Restrict the update to when LE 2098 * has actually been enabled. During power on, the 2099 * update in powered_update_hci will take care of it. 2100 */ 2101 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2102 if (ext_adv_capable(hdev)) { 2103 int status; 2104 2105 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2106 if (!status) 2107 hci_update_scan_rsp_data_sync(hdev, 0x00); 2108 } else { 2109 hci_update_adv_data_sync(hdev, 0x00); 2110 hci_update_scan_rsp_data_sync(hdev, 0x00); 2111 } 2112 2113 hci_update_passive_scan(hdev); 2114 } 2115 2116 return err; 2117 } 2118 2119 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2120 { 2121 struct mgmt_pending_cmd *cmd = data; 2122 u8 status = mgmt_status(err); 2123 struct sock *sk = cmd->sk; 2124 2125 if (status) { 2126 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, 2127 cmd_status_rsp, &status); 2128 return; 2129 } 2130 2131 mgmt_pending_remove(cmd); 2132 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2133 } 2134 2135 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2136 { 2137 struct mgmt_pending_cmd *cmd = data; 2138 struct mgmt_cp_set_mesh *cp = cmd->param; 2139 size_t len = cmd->param_len; 2140 2141 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2142 2143 if (cp->enable) 2144 hci_dev_set_flag(hdev, HCI_MESH); 2145 else 2146 hci_dev_clear_flag(hdev, HCI_MESH); 2147 2148 len -= sizeof(*cp); 2149 2150 /* If filters don't fit, forward all adv pkts */ 2151 if (len <= sizeof(hdev->mesh_ad_types)) 2152 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2153 2154 hci_update_passive_scan_sync(hdev); 2155 return 0; 2156 } 2157 2158 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2159 { 2160 struct mgmt_cp_set_mesh *cp = data; 2161 struct mgmt_pending_cmd *cmd; 2162 int err = 0; 2163 2164 bt_dev_dbg(hdev, "sock %p", sk); 2165 2166 if (!lmp_le_capable(hdev) || 2167 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2168 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2169 MGMT_STATUS_NOT_SUPPORTED); 2170 2171 if (cp->enable != 0x00 && cp->enable != 0x01) 2172 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2173 MGMT_STATUS_INVALID_PARAMS); 2174 2175 hci_dev_lock(hdev); 2176 2177 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2178 if (!cmd) 2179 err = -ENOMEM; 2180 else 2181 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2182 set_mesh_complete); 2183 2184 if (err < 0) { 2185 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2186 MGMT_STATUS_FAILED); 2187 2188 if (cmd) 2189 mgmt_pending_remove(cmd); 2190 } 2191 2192 hci_dev_unlock(hdev); 2193 return err; 2194 } 2195 2196 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2197 { 2198 struct mgmt_mesh_tx *mesh_tx = data; 2199 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2200 unsigned long mesh_send_interval; 2201 u8 mgmt_err = mgmt_status(err); 2202 2203 /* Report any errors here, but don't report completion */ 2204 2205 if (mgmt_err) { 2206 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2207 /* Send Complete Error Code for handle */ 2208 mesh_send_complete(hdev, mesh_tx, false); 2209 return; 2210 } 2211 2212 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2213 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2214 mesh_send_interval); 2215 } 2216 2217 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2218 { 2219 struct mgmt_mesh_tx *mesh_tx = data; 2220 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2221 struct adv_info *adv, *next_instance; 2222 u8 instance = hdev->le_num_of_adv_sets + 1; 2223 u16 timeout, duration; 2224 int err = 0; 2225 2226 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2227 return MGMT_STATUS_BUSY; 2228 2229 timeout = 1000; 2230 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2231 adv = hci_add_adv_instance(hdev, instance, 0, 2232 send->adv_data_len, send->adv_data, 2233 0, NULL, 2234 timeout, duration, 2235 HCI_ADV_TX_POWER_NO_PREFERENCE, 2236 hdev->le_adv_min_interval, 2237 hdev->le_adv_max_interval, 2238 mesh_tx->handle); 2239 2240 if (!IS_ERR(adv)) 2241 mesh_tx->instance = instance; 2242 else 2243 err = PTR_ERR(adv); 2244 2245 if (hdev->cur_adv_instance == instance) { 2246 /* If the currently advertised instance is being changed then 2247 * cancel the current advertising and schedule the next 2248 * instance. If there is only one instance then the overridden 2249 * advertising data will be visible right away. 2250 */ 2251 cancel_adv_timeout(hdev); 2252 2253 next_instance = hci_get_next_instance(hdev, instance); 2254 if (next_instance) 2255 instance = next_instance->instance; 2256 else 2257 instance = 0; 2258 } else if (hdev->adv_instance_timeout) { 2259 /* Immediately advertise the new instance if no other, or 2260 * let it go naturally from queue if ADV is already happening 2261 */ 2262 instance = 0; 2263 } 2264 2265 if (instance) 2266 return hci_schedule_adv_instance_sync(hdev, instance, true); 2267 2268 return err; 2269 } 2270 2271 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2272 { 2273 struct mgmt_rp_mesh_read_features *rp = data; 2274 2275 if (rp->used_handles >= rp->max_handles) 2276 return; 2277 2278 rp->handles[rp->used_handles++] = mesh_tx->handle; 2279 } 2280 2281 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2282 void *data, u16 len) 2283 { 2284 struct mgmt_rp_mesh_read_features rp; 2285 2286 if (!lmp_le_capable(hdev) || 2287 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2288 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2289 MGMT_STATUS_NOT_SUPPORTED); 2290 2291 memset(&rp, 0, sizeof(rp)); 2292 rp.index = cpu_to_le16(hdev->id); 2293 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2294 rp.max_handles = MESH_HANDLES_MAX; 2295 2296 hci_dev_lock(hdev); 2297 2298 if (rp.max_handles) 2299 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2300 2301 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2302 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2303 2304 hci_dev_unlock(hdev); 2305 return 0; 2306 } 2307 2308 static int send_cancel(struct hci_dev *hdev, void *data) 2309 { 2310 struct mgmt_pending_cmd *cmd = data; 2311 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2312 struct mgmt_mesh_tx *mesh_tx; 2313 2314 if (!cancel->handle) { 2315 do { 2316 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2317 2318 if (mesh_tx) 2319 mesh_send_complete(hdev, mesh_tx, false); 2320 } while (mesh_tx); 2321 } else { 2322 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2323 2324 if (mesh_tx && mesh_tx->sk == cmd->sk) 2325 mesh_send_complete(hdev, mesh_tx, false); 2326 } 2327 2328 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2329 0, NULL, 0); 2330 mgmt_pending_free(cmd); 2331 2332 return 0; 2333 } 2334 2335 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2336 void *data, u16 len) 2337 { 2338 struct mgmt_pending_cmd *cmd; 2339 int err; 2340 2341 if (!lmp_le_capable(hdev) || 2342 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2343 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2344 MGMT_STATUS_NOT_SUPPORTED); 2345 2346 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2347 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2348 MGMT_STATUS_REJECTED); 2349 2350 hci_dev_lock(hdev); 2351 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2352 if (!cmd) 2353 err = -ENOMEM; 2354 else 2355 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2356 2357 if (err < 0) { 2358 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2359 MGMT_STATUS_FAILED); 2360 2361 if (cmd) 2362 mgmt_pending_free(cmd); 2363 } 2364 2365 hci_dev_unlock(hdev); 2366 return err; 2367 } 2368 2369 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2370 { 2371 struct mgmt_mesh_tx *mesh_tx; 2372 struct mgmt_cp_mesh_send *send = data; 2373 struct mgmt_rp_mesh_read_features rp; 2374 bool sending; 2375 int err = 0; 2376 2377 if (!lmp_le_capable(hdev) || 2378 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2380 MGMT_STATUS_NOT_SUPPORTED); 2381 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 2382 len <= MGMT_MESH_SEND_SIZE || 2383 len > (MGMT_MESH_SEND_SIZE + 31)) 2384 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2385 MGMT_STATUS_REJECTED); 2386 2387 hci_dev_lock(hdev); 2388 2389 memset(&rp, 0, sizeof(rp)); 2390 rp.max_handles = MESH_HANDLES_MAX; 2391 2392 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2393 2394 if (rp.max_handles <= rp.used_handles) { 2395 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2396 MGMT_STATUS_BUSY); 2397 goto done; 2398 } 2399 2400 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2401 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2402 2403 if (!mesh_tx) 2404 err = -ENOMEM; 2405 else if (!sending) 2406 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2407 mesh_send_start_complete); 2408 2409 if (err < 0) { 2410 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2411 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2412 MGMT_STATUS_FAILED); 2413 2414 if (mesh_tx) { 2415 if (sending) 2416 mgmt_mesh_remove(mesh_tx); 2417 } 2418 } else { 2419 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2420 2421 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2422 &mesh_tx->handle, 1); 2423 } 2424 2425 done: 2426 hci_dev_unlock(hdev); 2427 return err; 2428 } 2429 2430 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2431 { 2432 struct mgmt_mode *cp = data; 2433 struct mgmt_pending_cmd *cmd; 2434 int err; 2435 u8 val, enabled; 2436 2437 bt_dev_dbg(hdev, "sock %p", sk); 2438 2439 if (!lmp_le_capable(hdev)) 2440 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2441 MGMT_STATUS_NOT_SUPPORTED); 2442 2443 if (cp->val != 0x00 && cp->val != 0x01) 2444 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2445 MGMT_STATUS_INVALID_PARAMS); 2446 2447 /* Bluetooth single mode LE only controllers or dual-mode 2448 * controllers configured as LE only devices, do not allow 2449 * switching LE off. These have either LE enabled explicitly 2450 * or BR/EDR has been previously switched off. 2451 * 2452 * When trying to enable an already enabled LE, then gracefully 2453 * send a positive response. Trying to disable it however will 2454 * result into rejection. 2455 */ 2456 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2457 if (cp->val == 0x01) 2458 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2459 2460 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2461 MGMT_STATUS_REJECTED); 2462 } 2463 2464 hci_dev_lock(hdev); 2465 2466 val = !!cp->val; 2467 enabled = lmp_host_le_capable(hdev); 2468 2469 if (!hdev_is_powered(hdev) || val == enabled) { 2470 bool changed = false; 2471 2472 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2473 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2474 changed = true; 2475 } 2476 2477 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2478 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2479 changed = true; 2480 } 2481 2482 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2483 if (err < 0) 2484 goto unlock; 2485 2486 if (changed) 2487 err = new_settings(hdev, sk); 2488 2489 goto unlock; 2490 } 2491 2492 if (pending_find(MGMT_OP_SET_LE, hdev) || 2493 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2494 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2495 MGMT_STATUS_BUSY); 2496 goto unlock; 2497 } 2498 2499 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2500 if (!cmd) 2501 err = -ENOMEM; 2502 else 2503 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2504 set_le_complete); 2505 2506 if (err < 0) { 2507 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2508 MGMT_STATUS_FAILED); 2509 2510 if (cmd) 2511 mgmt_pending_remove(cmd); 2512 } 2513 2514 unlock: 2515 hci_dev_unlock(hdev); 2516 return err; 2517 } 2518 2519 /* This is a helper function to test for pending mgmt commands that can 2520 * cause CoD or EIR HCI commands. We can only allow one such pending 2521 * mgmt command at a time since otherwise we cannot easily track what 2522 * the current values are, will be, and based on that calculate if a new 2523 * HCI command needs to be sent and if yes with what value. 2524 */ 2525 static bool pending_eir_or_class(struct hci_dev *hdev) 2526 { 2527 struct mgmt_pending_cmd *cmd; 2528 2529 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2530 switch (cmd->opcode) { 2531 case MGMT_OP_ADD_UUID: 2532 case MGMT_OP_REMOVE_UUID: 2533 case MGMT_OP_SET_DEV_CLASS: 2534 case MGMT_OP_SET_POWERED: 2535 return true; 2536 } 2537 } 2538 2539 return false; 2540 } 2541 2542 static const u8 bluetooth_base_uuid[] = { 2543 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2544 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2545 }; 2546 2547 static u8 get_uuid_size(const u8 *uuid) 2548 { 2549 u32 val; 2550 2551 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2552 return 128; 2553 2554 val = get_unaligned_le32(&uuid[12]); 2555 if (val > 0xffff) 2556 return 32; 2557 2558 return 16; 2559 } 2560 2561 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2562 { 2563 struct mgmt_pending_cmd *cmd = data; 2564 2565 bt_dev_dbg(hdev, "err %d", err); 2566 2567 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2568 mgmt_status(err), hdev->dev_class, 3); 2569 2570 mgmt_pending_free(cmd); 2571 } 2572 2573 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2574 { 2575 int err; 2576 2577 err = hci_update_class_sync(hdev); 2578 if (err) 2579 return err; 2580 2581 return hci_update_eir_sync(hdev); 2582 } 2583 2584 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2585 { 2586 struct mgmt_cp_add_uuid *cp = data; 2587 struct mgmt_pending_cmd *cmd; 2588 struct bt_uuid *uuid; 2589 int err; 2590 2591 bt_dev_dbg(hdev, "sock %p", sk); 2592 2593 hci_dev_lock(hdev); 2594 2595 if (pending_eir_or_class(hdev)) { 2596 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2597 MGMT_STATUS_BUSY); 2598 goto failed; 2599 } 2600 2601 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2602 if (!uuid) { 2603 err = -ENOMEM; 2604 goto failed; 2605 } 2606 2607 memcpy(uuid->uuid, cp->uuid, 16); 2608 uuid->svc_hint = cp->svc_hint; 2609 uuid->size = get_uuid_size(cp->uuid); 2610 2611 list_add_tail(&uuid->list, &hdev->uuids); 2612 2613 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2614 if (!cmd) { 2615 err = -ENOMEM; 2616 goto failed; 2617 } 2618 2619 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2620 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2621 */ 2622 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2623 mgmt_class_complete); 2624 if (err < 0) { 2625 mgmt_pending_free(cmd); 2626 goto failed; 2627 } 2628 2629 failed: 2630 hci_dev_unlock(hdev); 2631 return err; 2632 } 2633 2634 static bool enable_service_cache(struct hci_dev *hdev) 2635 { 2636 if (!hdev_is_powered(hdev)) 2637 return false; 2638 2639 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2640 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2641 CACHE_TIMEOUT); 2642 return true; 2643 } 2644 2645 return false; 2646 } 2647 2648 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2649 { 2650 int err; 2651 2652 err = hci_update_class_sync(hdev); 2653 if (err) 2654 return err; 2655 2656 return hci_update_eir_sync(hdev); 2657 } 2658 2659 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2660 u16 len) 2661 { 2662 struct mgmt_cp_remove_uuid *cp = data; 2663 struct mgmt_pending_cmd *cmd; 2664 struct bt_uuid *match, *tmp; 2665 static const u8 bt_uuid_any[] = { 2666 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2667 }; 2668 int err, found; 2669 2670 bt_dev_dbg(hdev, "sock %p", sk); 2671 2672 hci_dev_lock(hdev); 2673 2674 if (pending_eir_or_class(hdev)) { 2675 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2676 MGMT_STATUS_BUSY); 2677 goto unlock; 2678 } 2679 2680 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2681 hci_uuids_clear(hdev); 2682 2683 if (enable_service_cache(hdev)) { 2684 err = mgmt_cmd_complete(sk, hdev->id, 2685 MGMT_OP_REMOVE_UUID, 2686 0, hdev->dev_class, 3); 2687 goto unlock; 2688 } 2689 2690 goto update_class; 2691 } 2692 2693 found = 0; 2694 2695 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2696 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2697 continue; 2698 2699 list_del(&match->list); 2700 kfree(match); 2701 found++; 2702 } 2703 2704 if (found == 0) { 2705 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2706 MGMT_STATUS_INVALID_PARAMS); 2707 goto unlock; 2708 } 2709 2710 update_class: 2711 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2712 if (!cmd) { 2713 err = -ENOMEM; 2714 goto unlock; 2715 } 2716 2717 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2718 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2719 */ 2720 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2721 mgmt_class_complete); 2722 if (err < 0) 2723 mgmt_pending_free(cmd); 2724 2725 unlock: 2726 hci_dev_unlock(hdev); 2727 return err; 2728 } 2729 2730 static int set_class_sync(struct hci_dev *hdev, void *data) 2731 { 2732 int err = 0; 2733 2734 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2735 cancel_delayed_work_sync(&hdev->service_cache); 2736 err = hci_update_eir_sync(hdev); 2737 } 2738 2739 if (err) 2740 return err; 2741 2742 return hci_update_class_sync(hdev); 2743 } 2744 2745 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2746 u16 len) 2747 { 2748 struct mgmt_cp_set_dev_class *cp = data; 2749 struct mgmt_pending_cmd *cmd; 2750 int err; 2751 2752 bt_dev_dbg(hdev, "sock %p", sk); 2753 2754 if (!lmp_bredr_capable(hdev)) 2755 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2756 MGMT_STATUS_NOT_SUPPORTED); 2757 2758 hci_dev_lock(hdev); 2759 2760 if (pending_eir_or_class(hdev)) { 2761 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2762 MGMT_STATUS_BUSY); 2763 goto unlock; 2764 } 2765 2766 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2768 MGMT_STATUS_INVALID_PARAMS); 2769 goto unlock; 2770 } 2771 2772 hdev->major_class = cp->major; 2773 hdev->minor_class = cp->minor; 2774 2775 if (!hdev_is_powered(hdev)) { 2776 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2777 hdev->dev_class, 3); 2778 goto unlock; 2779 } 2780 2781 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2782 if (!cmd) { 2783 err = -ENOMEM; 2784 goto unlock; 2785 } 2786 2787 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2788 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2789 */ 2790 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2791 mgmt_class_complete); 2792 if (err < 0) 2793 mgmt_pending_free(cmd); 2794 2795 unlock: 2796 hci_dev_unlock(hdev); 2797 return err; 2798 } 2799 2800 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2801 u16 len) 2802 { 2803 struct mgmt_cp_load_link_keys *cp = data; 2804 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2805 sizeof(struct mgmt_link_key_info)); 2806 u16 key_count, expected_len; 2807 bool changed; 2808 int i; 2809 2810 bt_dev_dbg(hdev, "sock %p", sk); 2811 2812 if (!lmp_bredr_capable(hdev)) 2813 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2814 MGMT_STATUS_NOT_SUPPORTED); 2815 2816 key_count = __le16_to_cpu(cp->key_count); 2817 if (key_count > max_key_count) { 2818 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2819 key_count); 2820 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2821 MGMT_STATUS_INVALID_PARAMS); 2822 } 2823 2824 expected_len = struct_size(cp, keys, key_count); 2825 if (expected_len != len) { 2826 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2827 expected_len, len); 2828 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2829 MGMT_STATUS_INVALID_PARAMS); 2830 } 2831 2832 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2833 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2834 MGMT_STATUS_INVALID_PARAMS); 2835 2836 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2837 key_count); 2838 2839 for (i = 0; i < key_count; i++) { 2840 struct mgmt_link_key_info *key = &cp->keys[i]; 2841 2842 /* Considering SMP over BREDR/LE, there is no need to check addr_type */ 2843 if (key->type > 0x08) 2844 return mgmt_cmd_status(sk, hdev->id, 2845 MGMT_OP_LOAD_LINK_KEYS, 2846 MGMT_STATUS_INVALID_PARAMS); 2847 } 2848 2849 hci_dev_lock(hdev); 2850 2851 hci_link_keys_clear(hdev); 2852 2853 if (cp->debug_keys) 2854 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2855 else 2856 changed = hci_dev_test_and_clear_flag(hdev, 2857 HCI_KEEP_DEBUG_KEYS); 2858 2859 if (changed) 2860 new_settings(hdev, NULL); 2861 2862 for (i = 0; i < key_count; i++) { 2863 struct mgmt_link_key_info *key = &cp->keys[i]; 2864 2865 if (hci_is_blocked_key(hdev, 2866 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2867 key->val)) { 2868 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2869 &key->addr.bdaddr); 2870 continue; 2871 } 2872 2873 /* Always ignore debug keys and require a new pairing if 2874 * the user wants to use them. 2875 */ 2876 if (key->type == HCI_LK_DEBUG_COMBINATION) 2877 continue; 2878 2879 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2880 key->type, key->pin_len, NULL); 2881 } 2882 2883 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2884 2885 hci_dev_unlock(hdev); 2886 2887 return 0; 2888 } 2889 2890 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2891 u8 addr_type, struct sock *skip_sk) 2892 { 2893 struct mgmt_ev_device_unpaired ev; 2894 2895 bacpy(&ev.addr.bdaddr, bdaddr); 2896 ev.addr.type = addr_type; 2897 2898 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2899 skip_sk); 2900 } 2901 2902 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 2903 { 2904 struct mgmt_pending_cmd *cmd = data; 2905 struct mgmt_cp_unpair_device *cp = cmd->param; 2906 2907 if (!err) 2908 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2909 2910 cmd->cmd_complete(cmd, err); 2911 mgmt_pending_free(cmd); 2912 } 2913 2914 static int unpair_device_sync(struct hci_dev *hdev, void *data) 2915 { 2916 struct mgmt_pending_cmd *cmd = data; 2917 struct mgmt_cp_unpair_device *cp = cmd->param; 2918 struct hci_conn *conn; 2919 2920 if (cp->addr.type == BDADDR_BREDR) 2921 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2922 &cp->addr.bdaddr); 2923 else 2924 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2925 le_addr_type(cp->addr.type)); 2926 2927 if (!conn) 2928 return 0; 2929 2930 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 2931 } 2932 2933 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2934 u16 len) 2935 { 2936 struct mgmt_cp_unpair_device *cp = data; 2937 struct mgmt_rp_unpair_device rp; 2938 struct hci_conn_params *params; 2939 struct mgmt_pending_cmd *cmd; 2940 struct hci_conn *conn; 2941 u8 addr_type; 2942 int err; 2943 2944 memset(&rp, 0, sizeof(rp)); 2945 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2946 rp.addr.type = cp->addr.type; 2947 2948 if (!bdaddr_type_is_valid(cp->addr.type)) 2949 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2950 MGMT_STATUS_INVALID_PARAMS, 2951 &rp, sizeof(rp)); 2952 2953 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2954 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2955 MGMT_STATUS_INVALID_PARAMS, 2956 &rp, sizeof(rp)); 2957 2958 hci_dev_lock(hdev); 2959 2960 if (!hdev_is_powered(hdev)) { 2961 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2962 MGMT_STATUS_NOT_POWERED, &rp, 2963 sizeof(rp)); 2964 goto unlock; 2965 } 2966 2967 if (cp->addr.type == BDADDR_BREDR) { 2968 /* If disconnection is requested, then look up the 2969 * connection. If the remote device is connected, it 2970 * will be later used to terminate the link. 2971 * 2972 * Setting it to NULL explicitly will cause no 2973 * termination of the link. 2974 */ 2975 if (cp->disconnect) 2976 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2977 &cp->addr.bdaddr); 2978 else 2979 conn = NULL; 2980 2981 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2982 if (err < 0) { 2983 err = mgmt_cmd_complete(sk, hdev->id, 2984 MGMT_OP_UNPAIR_DEVICE, 2985 MGMT_STATUS_NOT_PAIRED, &rp, 2986 sizeof(rp)); 2987 goto unlock; 2988 } 2989 2990 goto done; 2991 } 2992 2993 /* LE address type */ 2994 addr_type = le_addr_type(cp->addr.type); 2995 2996 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2997 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2998 if (err < 0) { 2999 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3000 MGMT_STATUS_NOT_PAIRED, &rp, 3001 sizeof(rp)); 3002 goto unlock; 3003 } 3004 3005 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3006 if (!conn) { 3007 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3008 goto done; 3009 } 3010 3011 3012 /* Defer clearing up the connection parameters until closing to 3013 * give a chance of keeping them if a repairing happens. 3014 */ 3015 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3016 3017 /* Disable auto-connection parameters if present */ 3018 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3019 if (params) { 3020 if (params->explicit_connect) 3021 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3022 else 3023 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3024 } 3025 3026 /* If disconnection is not requested, then clear the connection 3027 * variable so that the link is not terminated. 3028 */ 3029 if (!cp->disconnect) 3030 conn = NULL; 3031 3032 done: 3033 /* If the connection variable is set, then termination of the 3034 * link is requested. 3035 */ 3036 if (!conn) { 3037 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3038 &rp, sizeof(rp)); 3039 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3040 goto unlock; 3041 } 3042 3043 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3044 sizeof(*cp)); 3045 if (!cmd) { 3046 err = -ENOMEM; 3047 goto unlock; 3048 } 3049 3050 cmd->cmd_complete = addr_cmd_complete; 3051 3052 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3053 unpair_device_complete); 3054 if (err < 0) 3055 mgmt_pending_free(cmd); 3056 3057 unlock: 3058 hci_dev_unlock(hdev); 3059 return err; 3060 } 3061 3062 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3063 u16 len) 3064 { 3065 struct mgmt_cp_disconnect *cp = data; 3066 struct mgmt_rp_disconnect rp; 3067 struct mgmt_pending_cmd *cmd; 3068 struct hci_conn *conn; 3069 int err; 3070 3071 bt_dev_dbg(hdev, "sock %p", sk); 3072 3073 memset(&rp, 0, sizeof(rp)); 3074 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3075 rp.addr.type = cp->addr.type; 3076 3077 if (!bdaddr_type_is_valid(cp->addr.type)) 3078 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3079 MGMT_STATUS_INVALID_PARAMS, 3080 &rp, sizeof(rp)); 3081 3082 hci_dev_lock(hdev); 3083 3084 if (!test_bit(HCI_UP, &hdev->flags)) { 3085 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3086 MGMT_STATUS_NOT_POWERED, &rp, 3087 sizeof(rp)); 3088 goto failed; 3089 } 3090 3091 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 3092 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3093 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3094 goto failed; 3095 } 3096 3097 if (cp->addr.type == BDADDR_BREDR) 3098 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3099 &cp->addr.bdaddr); 3100 else 3101 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3102 le_addr_type(cp->addr.type)); 3103 3104 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 3105 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3106 MGMT_STATUS_NOT_CONNECTED, &rp, 3107 sizeof(rp)); 3108 goto failed; 3109 } 3110 3111 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3112 if (!cmd) { 3113 err = -ENOMEM; 3114 goto failed; 3115 } 3116 3117 cmd->cmd_complete = generic_cmd_complete; 3118 3119 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 3120 if (err < 0) 3121 mgmt_pending_remove(cmd); 3122 3123 failed: 3124 hci_dev_unlock(hdev); 3125 return err; 3126 } 3127 3128 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3129 { 3130 switch (link_type) { 3131 case ISO_LINK: 3132 case LE_LINK: 3133 switch (addr_type) { 3134 case ADDR_LE_DEV_PUBLIC: 3135 return BDADDR_LE_PUBLIC; 3136 3137 default: 3138 /* Fallback to LE Random address type */ 3139 return BDADDR_LE_RANDOM; 3140 } 3141 3142 default: 3143 /* Fallback to BR/EDR type */ 3144 return BDADDR_BREDR; 3145 } 3146 } 3147 3148 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3149 u16 data_len) 3150 { 3151 struct mgmt_rp_get_connections *rp; 3152 struct hci_conn *c; 3153 int err; 3154 u16 i; 3155 3156 bt_dev_dbg(hdev, "sock %p", sk); 3157 3158 hci_dev_lock(hdev); 3159 3160 if (!hdev_is_powered(hdev)) { 3161 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3162 MGMT_STATUS_NOT_POWERED); 3163 goto unlock; 3164 } 3165 3166 i = 0; 3167 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3168 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3169 i++; 3170 } 3171 3172 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 3173 if (!rp) { 3174 err = -ENOMEM; 3175 goto unlock; 3176 } 3177 3178 i = 0; 3179 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3180 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3181 continue; 3182 bacpy(&rp->addr[i].bdaddr, &c->dst); 3183 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3184 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3185 continue; 3186 i++; 3187 } 3188 3189 rp->conn_count = cpu_to_le16(i); 3190 3191 /* Recalculate length in case of filtered SCO connections, etc */ 3192 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3193 struct_size(rp, addr, i)); 3194 3195 kfree(rp); 3196 3197 unlock: 3198 hci_dev_unlock(hdev); 3199 return err; 3200 } 3201 3202 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3203 struct mgmt_cp_pin_code_neg_reply *cp) 3204 { 3205 struct mgmt_pending_cmd *cmd; 3206 int err; 3207 3208 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3209 sizeof(*cp)); 3210 if (!cmd) 3211 return -ENOMEM; 3212 3213 cmd->cmd_complete = addr_cmd_complete; 3214 3215 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3216 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3217 if (err < 0) 3218 mgmt_pending_remove(cmd); 3219 3220 return err; 3221 } 3222 3223 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3224 u16 len) 3225 { 3226 struct hci_conn *conn; 3227 struct mgmt_cp_pin_code_reply *cp = data; 3228 struct hci_cp_pin_code_reply reply; 3229 struct mgmt_pending_cmd *cmd; 3230 int err; 3231 3232 bt_dev_dbg(hdev, "sock %p", sk); 3233 3234 hci_dev_lock(hdev); 3235 3236 if (!hdev_is_powered(hdev)) { 3237 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3238 MGMT_STATUS_NOT_POWERED); 3239 goto failed; 3240 } 3241 3242 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3243 if (!conn) { 3244 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3245 MGMT_STATUS_NOT_CONNECTED); 3246 goto failed; 3247 } 3248 3249 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3250 struct mgmt_cp_pin_code_neg_reply ncp; 3251 3252 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3253 3254 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3255 3256 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3257 if (err >= 0) 3258 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3259 MGMT_STATUS_INVALID_PARAMS); 3260 3261 goto failed; 3262 } 3263 3264 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3265 if (!cmd) { 3266 err = -ENOMEM; 3267 goto failed; 3268 } 3269 3270 cmd->cmd_complete = addr_cmd_complete; 3271 3272 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3273 reply.pin_len = cp->pin_len; 3274 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3275 3276 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3277 if (err < 0) 3278 mgmt_pending_remove(cmd); 3279 3280 failed: 3281 hci_dev_unlock(hdev); 3282 return err; 3283 } 3284 3285 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3286 u16 len) 3287 { 3288 struct mgmt_cp_set_io_capability *cp = data; 3289 3290 bt_dev_dbg(hdev, "sock %p", sk); 3291 3292 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3294 MGMT_STATUS_INVALID_PARAMS); 3295 3296 hci_dev_lock(hdev); 3297 3298 hdev->io_capability = cp->io_capability; 3299 3300 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3301 3302 hci_dev_unlock(hdev); 3303 3304 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3305 NULL, 0); 3306 } 3307 3308 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3309 { 3310 struct hci_dev *hdev = conn->hdev; 3311 struct mgmt_pending_cmd *cmd; 3312 3313 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3314 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3315 continue; 3316 3317 if (cmd->user_data != conn) 3318 continue; 3319 3320 return cmd; 3321 } 3322 3323 return NULL; 3324 } 3325 3326 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3327 { 3328 struct mgmt_rp_pair_device rp; 3329 struct hci_conn *conn = cmd->user_data; 3330 int err; 3331 3332 bacpy(&rp.addr.bdaddr, &conn->dst); 3333 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3334 3335 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 3336 status, &rp, sizeof(rp)); 3337 3338 /* So we don't get further callbacks for this connection */ 3339 conn->connect_cfm_cb = NULL; 3340 conn->security_cfm_cb = NULL; 3341 conn->disconn_cfm_cb = NULL; 3342 3343 hci_conn_drop(conn); 3344 3345 /* The device is paired so there is no need to remove 3346 * its connection parameters anymore. 3347 */ 3348 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3349 3350 hci_conn_put(conn); 3351 3352 return err; 3353 } 3354 3355 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3356 { 3357 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3358 struct mgmt_pending_cmd *cmd; 3359 3360 cmd = find_pairing(conn); 3361 if (cmd) { 3362 cmd->cmd_complete(cmd, status); 3363 mgmt_pending_remove(cmd); 3364 } 3365 } 3366 3367 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3368 { 3369 struct mgmt_pending_cmd *cmd; 3370 3371 BT_DBG("status %u", status); 3372 3373 cmd = find_pairing(conn); 3374 if (!cmd) { 3375 BT_DBG("Unable to find a pending command"); 3376 return; 3377 } 3378 3379 cmd->cmd_complete(cmd, mgmt_status(status)); 3380 mgmt_pending_remove(cmd); 3381 } 3382 3383 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3384 { 3385 struct mgmt_pending_cmd *cmd; 3386 3387 BT_DBG("status %u", status); 3388 3389 if (!status) 3390 return; 3391 3392 cmd = find_pairing(conn); 3393 if (!cmd) { 3394 BT_DBG("Unable to find a pending command"); 3395 return; 3396 } 3397 3398 cmd->cmd_complete(cmd, mgmt_status(status)); 3399 mgmt_pending_remove(cmd); 3400 } 3401 3402 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3403 u16 len) 3404 { 3405 struct mgmt_cp_pair_device *cp = data; 3406 struct mgmt_rp_pair_device rp; 3407 struct mgmt_pending_cmd *cmd; 3408 u8 sec_level, auth_type; 3409 struct hci_conn *conn; 3410 int err; 3411 3412 bt_dev_dbg(hdev, "sock %p", sk); 3413 3414 memset(&rp, 0, sizeof(rp)); 3415 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3416 rp.addr.type = cp->addr.type; 3417 3418 if (!bdaddr_type_is_valid(cp->addr.type)) 3419 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3420 MGMT_STATUS_INVALID_PARAMS, 3421 &rp, sizeof(rp)); 3422 3423 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3424 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3425 MGMT_STATUS_INVALID_PARAMS, 3426 &rp, sizeof(rp)); 3427 3428 hci_dev_lock(hdev); 3429 3430 if (!hdev_is_powered(hdev)) { 3431 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3432 MGMT_STATUS_NOT_POWERED, &rp, 3433 sizeof(rp)); 3434 goto unlock; 3435 } 3436 3437 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3438 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3439 MGMT_STATUS_ALREADY_PAIRED, &rp, 3440 sizeof(rp)); 3441 goto unlock; 3442 } 3443 3444 sec_level = BT_SECURITY_MEDIUM; 3445 auth_type = HCI_AT_DEDICATED_BONDING; 3446 3447 if (cp->addr.type == BDADDR_BREDR) { 3448 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3449 auth_type, CONN_REASON_PAIR_DEVICE); 3450 } else { 3451 u8 addr_type = le_addr_type(cp->addr.type); 3452 struct hci_conn_params *p; 3453 3454 /* When pairing a new device, it is expected to remember 3455 * this device for future connections. Adding the connection 3456 * parameter information ahead of time allows tracking 3457 * of the peripheral preferred values and will speed up any 3458 * further connection establishment. 3459 * 3460 * If connection parameters already exist, then they 3461 * will be kept and this function does nothing. 3462 */ 3463 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3464 3465 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3466 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3467 3468 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3469 sec_level, HCI_LE_CONN_TIMEOUT, 3470 CONN_REASON_PAIR_DEVICE); 3471 } 3472 3473 if (IS_ERR(conn)) { 3474 int status; 3475 3476 if (PTR_ERR(conn) == -EBUSY) 3477 status = MGMT_STATUS_BUSY; 3478 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3479 status = MGMT_STATUS_NOT_SUPPORTED; 3480 else if (PTR_ERR(conn) == -ECONNREFUSED) 3481 status = MGMT_STATUS_REJECTED; 3482 else 3483 status = MGMT_STATUS_CONNECT_FAILED; 3484 3485 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3486 status, &rp, sizeof(rp)); 3487 goto unlock; 3488 } 3489 3490 if (conn->connect_cfm_cb) { 3491 hci_conn_drop(conn); 3492 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3493 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3494 goto unlock; 3495 } 3496 3497 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3498 if (!cmd) { 3499 err = -ENOMEM; 3500 hci_conn_drop(conn); 3501 goto unlock; 3502 } 3503 3504 cmd->cmd_complete = pairing_complete; 3505 3506 /* For LE, just connecting isn't a proof that the pairing finished */ 3507 if (cp->addr.type == BDADDR_BREDR) { 3508 conn->connect_cfm_cb = pairing_complete_cb; 3509 conn->security_cfm_cb = pairing_complete_cb; 3510 conn->disconn_cfm_cb = pairing_complete_cb; 3511 } else { 3512 conn->connect_cfm_cb = le_pairing_complete_cb; 3513 conn->security_cfm_cb = le_pairing_complete_cb; 3514 conn->disconn_cfm_cb = le_pairing_complete_cb; 3515 } 3516 3517 conn->io_capability = cp->io_cap; 3518 cmd->user_data = hci_conn_get(conn); 3519 3520 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3521 hci_conn_security(conn, sec_level, auth_type, true)) { 3522 cmd->cmd_complete(cmd, 0); 3523 mgmt_pending_remove(cmd); 3524 } 3525 3526 err = 0; 3527 3528 unlock: 3529 hci_dev_unlock(hdev); 3530 return err; 3531 } 3532 3533 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3534 u16 len) 3535 { 3536 struct mgmt_addr_info *addr = data; 3537 struct mgmt_pending_cmd *cmd; 3538 struct hci_conn *conn; 3539 int err; 3540 3541 bt_dev_dbg(hdev, "sock %p", sk); 3542 3543 hci_dev_lock(hdev); 3544 3545 if (!hdev_is_powered(hdev)) { 3546 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3547 MGMT_STATUS_NOT_POWERED); 3548 goto unlock; 3549 } 3550 3551 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3552 if (!cmd) { 3553 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3554 MGMT_STATUS_INVALID_PARAMS); 3555 goto unlock; 3556 } 3557 3558 conn = cmd->user_data; 3559 3560 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3561 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3562 MGMT_STATUS_INVALID_PARAMS); 3563 goto unlock; 3564 } 3565 3566 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3567 mgmt_pending_remove(cmd); 3568 3569 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3570 addr, sizeof(*addr)); 3571 3572 /* Since user doesn't want to proceed with the connection, abort any 3573 * ongoing pairing and then terminate the link if it was created 3574 * because of the pair device action. 3575 */ 3576 if (addr->type == BDADDR_BREDR) 3577 hci_remove_link_key(hdev, &addr->bdaddr); 3578 else 3579 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3580 le_addr_type(addr->type)); 3581 3582 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3583 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3584 3585 unlock: 3586 hci_dev_unlock(hdev); 3587 return err; 3588 } 3589 3590 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3591 struct mgmt_addr_info *addr, u16 mgmt_op, 3592 u16 hci_op, __le32 passkey) 3593 { 3594 struct mgmt_pending_cmd *cmd; 3595 struct hci_conn *conn; 3596 int err; 3597 3598 hci_dev_lock(hdev); 3599 3600 if (!hdev_is_powered(hdev)) { 3601 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3602 MGMT_STATUS_NOT_POWERED, addr, 3603 sizeof(*addr)); 3604 goto done; 3605 } 3606 3607 if (addr->type == BDADDR_BREDR) 3608 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3609 else 3610 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3611 le_addr_type(addr->type)); 3612 3613 if (!conn) { 3614 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3615 MGMT_STATUS_NOT_CONNECTED, addr, 3616 sizeof(*addr)); 3617 goto done; 3618 } 3619 3620 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3621 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3622 if (!err) 3623 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3624 MGMT_STATUS_SUCCESS, addr, 3625 sizeof(*addr)); 3626 else 3627 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3628 MGMT_STATUS_FAILED, addr, 3629 sizeof(*addr)); 3630 3631 goto done; 3632 } 3633 3634 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3635 if (!cmd) { 3636 err = -ENOMEM; 3637 goto done; 3638 } 3639 3640 cmd->cmd_complete = addr_cmd_complete; 3641 3642 /* Continue with pairing via HCI */ 3643 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3644 struct hci_cp_user_passkey_reply cp; 3645 3646 bacpy(&cp.bdaddr, &addr->bdaddr); 3647 cp.passkey = passkey; 3648 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3649 } else 3650 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3651 &addr->bdaddr); 3652 3653 if (err < 0) 3654 mgmt_pending_remove(cmd); 3655 3656 done: 3657 hci_dev_unlock(hdev); 3658 return err; 3659 } 3660 3661 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3662 void *data, u16 len) 3663 { 3664 struct mgmt_cp_pin_code_neg_reply *cp = data; 3665 3666 bt_dev_dbg(hdev, "sock %p", sk); 3667 3668 return user_pairing_resp(sk, hdev, &cp->addr, 3669 MGMT_OP_PIN_CODE_NEG_REPLY, 3670 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3671 } 3672 3673 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3674 u16 len) 3675 { 3676 struct mgmt_cp_user_confirm_reply *cp = data; 3677 3678 bt_dev_dbg(hdev, "sock %p", sk); 3679 3680 if (len != sizeof(*cp)) 3681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3682 MGMT_STATUS_INVALID_PARAMS); 3683 3684 return user_pairing_resp(sk, hdev, &cp->addr, 3685 MGMT_OP_USER_CONFIRM_REPLY, 3686 HCI_OP_USER_CONFIRM_REPLY, 0); 3687 } 3688 3689 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3690 void *data, u16 len) 3691 { 3692 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3693 3694 bt_dev_dbg(hdev, "sock %p", sk); 3695 3696 return user_pairing_resp(sk, hdev, &cp->addr, 3697 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3698 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3699 } 3700 3701 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3702 u16 len) 3703 { 3704 struct mgmt_cp_user_passkey_reply *cp = data; 3705 3706 bt_dev_dbg(hdev, "sock %p", sk); 3707 3708 return user_pairing_resp(sk, hdev, &cp->addr, 3709 MGMT_OP_USER_PASSKEY_REPLY, 3710 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3711 } 3712 3713 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3714 void *data, u16 len) 3715 { 3716 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3717 3718 bt_dev_dbg(hdev, "sock %p", sk); 3719 3720 return user_pairing_resp(sk, hdev, &cp->addr, 3721 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3722 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3723 } 3724 3725 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3726 { 3727 struct adv_info *adv_instance; 3728 3729 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3730 if (!adv_instance) 3731 return 0; 3732 3733 /* stop if current instance doesn't need to be changed */ 3734 if (!(adv_instance->flags & flags)) 3735 return 0; 3736 3737 cancel_adv_timeout(hdev); 3738 3739 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3740 if (!adv_instance) 3741 return 0; 3742 3743 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3744 3745 return 0; 3746 } 3747 3748 static int name_changed_sync(struct hci_dev *hdev, void *data) 3749 { 3750 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3751 } 3752 3753 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3754 { 3755 struct mgmt_pending_cmd *cmd = data; 3756 struct mgmt_cp_set_local_name *cp = cmd->param; 3757 u8 status = mgmt_status(err); 3758 3759 bt_dev_dbg(hdev, "err %d", err); 3760 3761 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3762 return; 3763 3764 if (status) { 3765 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3766 status); 3767 } else { 3768 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3769 cp, sizeof(*cp)); 3770 3771 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3772 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3773 } 3774 3775 mgmt_pending_remove(cmd); 3776 } 3777 3778 static int set_name_sync(struct hci_dev *hdev, void *data) 3779 { 3780 if (lmp_bredr_capable(hdev)) { 3781 hci_update_name_sync(hdev); 3782 hci_update_eir_sync(hdev); 3783 } 3784 3785 /* The name is stored in the scan response data and so 3786 * no need to update the advertising data here. 3787 */ 3788 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3789 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3790 3791 return 0; 3792 } 3793 3794 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3795 u16 len) 3796 { 3797 struct mgmt_cp_set_local_name *cp = data; 3798 struct mgmt_pending_cmd *cmd; 3799 int err; 3800 3801 bt_dev_dbg(hdev, "sock %p", sk); 3802 3803 hci_dev_lock(hdev); 3804 3805 /* If the old values are the same as the new ones just return a 3806 * direct command complete event. 3807 */ 3808 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3809 !memcmp(hdev->short_name, cp->short_name, 3810 sizeof(hdev->short_name))) { 3811 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3812 data, len); 3813 goto failed; 3814 } 3815 3816 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3817 3818 if (!hdev_is_powered(hdev)) { 3819 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3820 3821 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3822 data, len); 3823 if (err < 0) 3824 goto failed; 3825 3826 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3827 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3828 ext_info_changed(hdev, sk); 3829 3830 goto failed; 3831 } 3832 3833 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3834 if (!cmd) 3835 err = -ENOMEM; 3836 else 3837 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3838 set_name_complete); 3839 3840 if (err < 0) { 3841 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3842 MGMT_STATUS_FAILED); 3843 3844 if (cmd) 3845 mgmt_pending_remove(cmd); 3846 3847 goto failed; 3848 } 3849 3850 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3851 3852 failed: 3853 hci_dev_unlock(hdev); 3854 return err; 3855 } 3856 3857 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3858 { 3859 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3860 } 3861 3862 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3863 u16 len) 3864 { 3865 struct mgmt_cp_set_appearance *cp = data; 3866 u16 appearance; 3867 int err; 3868 3869 bt_dev_dbg(hdev, "sock %p", sk); 3870 3871 if (!lmp_le_capable(hdev)) 3872 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3873 MGMT_STATUS_NOT_SUPPORTED); 3874 3875 appearance = le16_to_cpu(cp->appearance); 3876 3877 hci_dev_lock(hdev); 3878 3879 if (hdev->appearance != appearance) { 3880 hdev->appearance = appearance; 3881 3882 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3883 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3884 NULL); 3885 3886 ext_info_changed(hdev, sk); 3887 } 3888 3889 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3890 0); 3891 3892 hci_dev_unlock(hdev); 3893 3894 return err; 3895 } 3896 3897 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3898 void *data, u16 len) 3899 { 3900 struct mgmt_rp_get_phy_configuration rp; 3901 3902 bt_dev_dbg(hdev, "sock %p", sk); 3903 3904 hci_dev_lock(hdev); 3905 3906 memset(&rp, 0, sizeof(rp)); 3907 3908 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3909 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3910 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3911 3912 hci_dev_unlock(hdev); 3913 3914 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3915 &rp, sizeof(rp)); 3916 } 3917 3918 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3919 { 3920 struct mgmt_ev_phy_configuration_changed ev; 3921 3922 memset(&ev, 0, sizeof(ev)); 3923 3924 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3925 3926 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3927 sizeof(ev), skip); 3928 } 3929 3930 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3931 { 3932 struct mgmt_pending_cmd *cmd = data; 3933 struct sk_buff *skb = cmd->skb; 3934 u8 status = mgmt_status(err); 3935 3936 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3937 return; 3938 3939 if (!status) { 3940 if (!skb) 3941 status = MGMT_STATUS_FAILED; 3942 else if (IS_ERR(skb)) 3943 status = mgmt_status(PTR_ERR(skb)); 3944 else 3945 status = mgmt_status(skb->data[0]); 3946 } 3947 3948 bt_dev_dbg(hdev, "status %d", status); 3949 3950 if (status) { 3951 mgmt_cmd_status(cmd->sk, hdev->id, 3952 MGMT_OP_SET_PHY_CONFIGURATION, status); 3953 } else { 3954 mgmt_cmd_complete(cmd->sk, hdev->id, 3955 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3956 NULL, 0); 3957 3958 mgmt_phy_configuration_changed(hdev, cmd->sk); 3959 } 3960 3961 if (skb && !IS_ERR(skb)) 3962 kfree_skb(skb); 3963 3964 mgmt_pending_remove(cmd); 3965 } 3966 3967 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 3968 { 3969 struct mgmt_pending_cmd *cmd = data; 3970 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 3971 struct hci_cp_le_set_default_phy cp_phy; 3972 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 3973 3974 memset(&cp_phy, 0, sizeof(cp_phy)); 3975 3976 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3977 cp_phy.all_phys |= 0x01; 3978 3979 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3980 cp_phy.all_phys |= 0x02; 3981 3982 if (selected_phys & MGMT_PHY_LE_1M_TX) 3983 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3984 3985 if (selected_phys & MGMT_PHY_LE_2M_TX) 3986 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3987 3988 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3989 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3990 3991 if (selected_phys & MGMT_PHY_LE_1M_RX) 3992 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3993 3994 if (selected_phys & MGMT_PHY_LE_2M_RX) 3995 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3996 3997 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3998 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3999 4000 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4001 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4002 4003 return 0; 4004 } 4005 4006 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4007 void *data, u16 len) 4008 { 4009 struct mgmt_cp_set_phy_configuration *cp = data; 4010 struct mgmt_pending_cmd *cmd; 4011 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4012 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4013 bool changed = false; 4014 int err; 4015 4016 bt_dev_dbg(hdev, "sock %p", sk); 4017 4018 configurable_phys = get_configurable_phys(hdev); 4019 supported_phys = get_supported_phys(hdev); 4020 selected_phys = __le32_to_cpu(cp->selected_phys); 4021 4022 if (selected_phys & ~supported_phys) 4023 return mgmt_cmd_status(sk, hdev->id, 4024 MGMT_OP_SET_PHY_CONFIGURATION, 4025 MGMT_STATUS_INVALID_PARAMS); 4026 4027 unconfigure_phys = supported_phys & ~configurable_phys; 4028 4029 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4030 return mgmt_cmd_status(sk, hdev->id, 4031 MGMT_OP_SET_PHY_CONFIGURATION, 4032 MGMT_STATUS_INVALID_PARAMS); 4033 4034 if (selected_phys == get_selected_phys(hdev)) 4035 return mgmt_cmd_complete(sk, hdev->id, 4036 MGMT_OP_SET_PHY_CONFIGURATION, 4037 0, NULL, 0); 4038 4039 hci_dev_lock(hdev); 4040 4041 if (!hdev_is_powered(hdev)) { 4042 err = mgmt_cmd_status(sk, hdev->id, 4043 MGMT_OP_SET_PHY_CONFIGURATION, 4044 MGMT_STATUS_REJECTED); 4045 goto unlock; 4046 } 4047 4048 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4049 err = mgmt_cmd_status(sk, hdev->id, 4050 MGMT_OP_SET_PHY_CONFIGURATION, 4051 MGMT_STATUS_BUSY); 4052 goto unlock; 4053 } 4054 4055 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4056 pkt_type |= (HCI_DH3 | HCI_DM3); 4057 else 4058 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4059 4060 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4061 pkt_type |= (HCI_DH5 | HCI_DM5); 4062 else 4063 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4064 4065 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4066 pkt_type &= ~HCI_2DH1; 4067 else 4068 pkt_type |= HCI_2DH1; 4069 4070 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4071 pkt_type &= ~HCI_2DH3; 4072 else 4073 pkt_type |= HCI_2DH3; 4074 4075 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4076 pkt_type &= ~HCI_2DH5; 4077 else 4078 pkt_type |= HCI_2DH5; 4079 4080 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4081 pkt_type &= ~HCI_3DH1; 4082 else 4083 pkt_type |= HCI_3DH1; 4084 4085 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4086 pkt_type &= ~HCI_3DH3; 4087 else 4088 pkt_type |= HCI_3DH3; 4089 4090 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4091 pkt_type &= ~HCI_3DH5; 4092 else 4093 pkt_type |= HCI_3DH5; 4094 4095 if (pkt_type != hdev->pkt_type) { 4096 hdev->pkt_type = pkt_type; 4097 changed = true; 4098 } 4099 4100 if ((selected_phys & MGMT_PHY_LE_MASK) == 4101 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4102 if (changed) 4103 mgmt_phy_configuration_changed(hdev, sk); 4104 4105 err = mgmt_cmd_complete(sk, hdev->id, 4106 MGMT_OP_SET_PHY_CONFIGURATION, 4107 0, NULL, 0); 4108 4109 goto unlock; 4110 } 4111 4112 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4113 len); 4114 if (!cmd) 4115 err = -ENOMEM; 4116 else 4117 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4118 set_default_phy_complete); 4119 4120 if (err < 0) { 4121 err = mgmt_cmd_status(sk, hdev->id, 4122 MGMT_OP_SET_PHY_CONFIGURATION, 4123 MGMT_STATUS_FAILED); 4124 4125 if (cmd) 4126 mgmt_pending_remove(cmd); 4127 } 4128 4129 unlock: 4130 hci_dev_unlock(hdev); 4131 4132 return err; 4133 } 4134 4135 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4136 u16 len) 4137 { 4138 int err = MGMT_STATUS_SUCCESS; 4139 struct mgmt_cp_set_blocked_keys *keys = data; 4140 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4141 sizeof(struct mgmt_blocked_key_info)); 4142 u16 key_count, expected_len; 4143 int i; 4144 4145 bt_dev_dbg(hdev, "sock %p", sk); 4146 4147 key_count = __le16_to_cpu(keys->key_count); 4148 if (key_count > max_key_count) { 4149 bt_dev_err(hdev, "too big key_count value %u", key_count); 4150 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4151 MGMT_STATUS_INVALID_PARAMS); 4152 } 4153 4154 expected_len = struct_size(keys, keys, key_count); 4155 if (expected_len != len) { 4156 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4157 expected_len, len); 4158 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4159 MGMT_STATUS_INVALID_PARAMS); 4160 } 4161 4162 hci_dev_lock(hdev); 4163 4164 hci_blocked_keys_clear(hdev); 4165 4166 for (i = 0; i < key_count; ++i) { 4167 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 4168 4169 if (!b) { 4170 err = MGMT_STATUS_NO_RESOURCES; 4171 break; 4172 } 4173 4174 b->type = keys->keys[i].type; 4175 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4176 list_add_rcu(&b->list, &hdev->blocked_keys); 4177 } 4178 hci_dev_unlock(hdev); 4179 4180 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4181 err, NULL, 0); 4182 } 4183 4184 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4185 void *data, u16 len) 4186 { 4187 struct mgmt_mode *cp = data; 4188 int err; 4189 bool changed = false; 4190 4191 bt_dev_dbg(hdev, "sock %p", sk); 4192 4193 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4194 return mgmt_cmd_status(sk, hdev->id, 4195 MGMT_OP_SET_WIDEBAND_SPEECH, 4196 MGMT_STATUS_NOT_SUPPORTED); 4197 4198 if (cp->val != 0x00 && cp->val != 0x01) 4199 return mgmt_cmd_status(sk, hdev->id, 4200 MGMT_OP_SET_WIDEBAND_SPEECH, 4201 MGMT_STATUS_INVALID_PARAMS); 4202 4203 hci_dev_lock(hdev); 4204 4205 if (hdev_is_powered(hdev) && 4206 !!cp->val != hci_dev_test_flag(hdev, 4207 HCI_WIDEBAND_SPEECH_ENABLED)) { 4208 err = mgmt_cmd_status(sk, hdev->id, 4209 MGMT_OP_SET_WIDEBAND_SPEECH, 4210 MGMT_STATUS_REJECTED); 4211 goto unlock; 4212 } 4213 4214 if (cp->val) 4215 changed = !hci_dev_test_and_set_flag(hdev, 4216 HCI_WIDEBAND_SPEECH_ENABLED); 4217 else 4218 changed = hci_dev_test_and_clear_flag(hdev, 4219 HCI_WIDEBAND_SPEECH_ENABLED); 4220 4221 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4222 if (err < 0) 4223 goto unlock; 4224 4225 if (changed) 4226 err = new_settings(hdev, sk); 4227 4228 unlock: 4229 hci_dev_unlock(hdev); 4230 return err; 4231 } 4232 4233 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4234 void *data, u16 data_len) 4235 { 4236 char buf[20]; 4237 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4238 u16 cap_len = 0; 4239 u8 flags = 0; 4240 u8 tx_power_range[2]; 4241 4242 bt_dev_dbg(hdev, "sock %p", sk); 4243 4244 memset(&buf, 0, sizeof(buf)); 4245 4246 hci_dev_lock(hdev); 4247 4248 /* When the Read Simple Pairing Options command is supported, then 4249 * the remote public key validation is supported. 4250 * 4251 * Alternatively, when Microsoft extensions are available, they can 4252 * indicate support for public key validation as well. 4253 */ 4254 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4255 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4256 4257 flags |= 0x02; /* Remote public key validation (LE) */ 4258 4259 /* When the Read Encryption Key Size command is supported, then the 4260 * encryption key size is enforced. 4261 */ 4262 if (hdev->commands[20] & 0x10) 4263 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4264 4265 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4266 4267 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4268 &flags, 1); 4269 4270 /* When the Read Simple Pairing Options command is supported, then 4271 * also max encryption key size information is provided. 4272 */ 4273 if (hdev->commands[41] & 0x08) 4274 cap_len = eir_append_le16(rp->cap, cap_len, 4275 MGMT_CAP_MAX_ENC_KEY_SIZE, 4276 hdev->max_enc_key_size); 4277 4278 cap_len = eir_append_le16(rp->cap, cap_len, 4279 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4280 SMP_MAX_ENC_KEY_SIZE); 4281 4282 /* Append the min/max LE tx power parameters if we were able to fetch 4283 * it from the controller 4284 */ 4285 if (hdev->commands[38] & 0x80) { 4286 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4287 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4288 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4289 tx_power_range, 2); 4290 } 4291 4292 rp->cap_len = cpu_to_le16(cap_len); 4293 4294 hci_dev_unlock(hdev); 4295 4296 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4297 rp, sizeof(*rp) + cap_len); 4298 } 4299 4300 #ifdef CONFIG_BT_FEATURE_DEBUG 4301 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4302 static const u8 debug_uuid[16] = { 4303 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4304 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4305 }; 4306 #endif 4307 4308 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4309 static const u8 quality_report_uuid[16] = { 4310 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4311 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4312 }; 4313 4314 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4315 static const u8 offload_codecs_uuid[16] = { 4316 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4317 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4318 }; 4319 4320 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4321 static const u8 le_simultaneous_roles_uuid[16] = { 4322 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4323 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4324 }; 4325 4326 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 4327 static const u8 rpa_resolution_uuid[16] = { 4328 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 4329 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 4330 }; 4331 4332 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4333 static const u8 iso_socket_uuid[16] = { 4334 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4335 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4336 }; 4337 4338 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4339 static const u8 mgmt_mesh_uuid[16] = { 4340 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4341 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4342 }; 4343 4344 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4345 void *data, u16 data_len) 4346 { 4347 struct mgmt_rp_read_exp_features_info *rp; 4348 size_t len; 4349 u16 idx = 0; 4350 u32 flags; 4351 int status; 4352 4353 bt_dev_dbg(hdev, "sock %p", sk); 4354 4355 /* Enough space for 7 features */ 4356 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4357 rp = kzalloc(len, GFP_KERNEL); 4358 if (!rp) 4359 return -ENOMEM; 4360 4361 #ifdef CONFIG_BT_FEATURE_DEBUG 4362 if (!hdev) { 4363 flags = bt_dbg_get() ? BIT(0) : 0; 4364 4365 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4366 rp->features[idx].flags = cpu_to_le32(flags); 4367 idx++; 4368 } 4369 #endif 4370 4371 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4372 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4373 flags = BIT(0); 4374 else 4375 flags = 0; 4376 4377 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4378 rp->features[idx].flags = cpu_to_le32(flags); 4379 idx++; 4380 } 4381 4382 if (hdev && ll_privacy_capable(hdev)) { 4383 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 4384 flags = BIT(0) | BIT(1); 4385 else 4386 flags = BIT(1); 4387 4388 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 4389 rp->features[idx].flags = cpu_to_le32(flags); 4390 idx++; 4391 } 4392 4393 if (hdev && (aosp_has_quality_report(hdev) || 4394 hdev->set_quality_report)) { 4395 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4396 flags = BIT(0); 4397 else 4398 flags = 0; 4399 4400 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4401 rp->features[idx].flags = cpu_to_le32(flags); 4402 idx++; 4403 } 4404 4405 if (hdev && hdev->get_data_path_id) { 4406 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4407 flags = BIT(0); 4408 else 4409 flags = 0; 4410 4411 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4412 rp->features[idx].flags = cpu_to_le32(flags); 4413 idx++; 4414 } 4415 4416 if (IS_ENABLED(CONFIG_BT_LE)) { 4417 flags = iso_enabled() ? BIT(0) : 0; 4418 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4419 rp->features[idx].flags = cpu_to_le32(flags); 4420 idx++; 4421 } 4422 4423 if (hdev && lmp_le_capable(hdev)) { 4424 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4425 flags = BIT(0); 4426 else 4427 flags = 0; 4428 4429 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4430 rp->features[idx].flags = cpu_to_le32(flags); 4431 idx++; 4432 } 4433 4434 rp->feature_count = cpu_to_le16(idx); 4435 4436 /* After reading the experimental features information, enable 4437 * the events to update client on any future change. 4438 */ 4439 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4440 4441 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4442 MGMT_OP_READ_EXP_FEATURES_INFO, 4443 0, rp, sizeof(*rp) + (20 * idx)); 4444 4445 kfree(rp); 4446 return status; 4447 } 4448 4449 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4450 struct sock *skip) 4451 { 4452 struct mgmt_ev_exp_feature_changed ev; 4453 4454 memset(&ev, 0, sizeof(ev)); 4455 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4456 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4457 4458 // Do we need to be atomic with the conn_flags? 4459 if (enabled && privacy_mode_capable(hdev)) 4460 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4461 else 4462 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4463 4464 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4465 &ev, sizeof(ev), 4466 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4467 4468 } 4469 4470 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4471 bool enabled, struct sock *skip) 4472 { 4473 struct mgmt_ev_exp_feature_changed ev; 4474 4475 memset(&ev, 0, sizeof(ev)); 4476 memcpy(ev.uuid, uuid, 16); 4477 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4478 4479 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4480 &ev, sizeof(ev), 4481 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4482 } 4483 4484 #define EXP_FEAT(_uuid, _set_func) \ 4485 { \ 4486 .uuid = _uuid, \ 4487 .set_func = _set_func, \ 4488 } 4489 4490 /* The zero key uuid is special. Multiple exp features are set through it. */ 4491 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4492 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4493 { 4494 struct mgmt_rp_set_exp_feature rp; 4495 4496 memset(rp.uuid, 0, 16); 4497 rp.flags = cpu_to_le32(0); 4498 4499 #ifdef CONFIG_BT_FEATURE_DEBUG 4500 if (!hdev) { 4501 bool changed = bt_dbg_get(); 4502 4503 bt_dbg_set(false); 4504 4505 if (changed) 4506 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4507 } 4508 #endif 4509 4510 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4511 bool changed; 4512 4513 changed = hci_dev_test_and_clear_flag(hdev, 4514 HCI_ENABLE_LL_PRIVACY); 4515 if (changed) 4516 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4517 sk); 4518 } 4519 4520 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4521 4522 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4523 MGMT_OP_SET_EXP_FEATURE, 0, 4524 &rp, sizeof(rp)); 4525 } 4526 4527 #ifdef CONFIG_BT_FEATURE_DEBUG 4528 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4529 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4530 { 4531 struct mgmt_rp_set_exp_feature rp; 4532 4533 bool val, changed; 4534 int err; 4535 4536 /* Command requires to use the non-controller index */ 4537 if (hdev) 4538 return mgmt_cmd_status(sk, hdev->id, 4539 MGMT_OP_SET_EXP_FEATURE, 4540 MGMT_STATUS_INVALID_INDEX); 4541 4542 /* Parameters are limited to a single octet */ 4543 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4544 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4545 MGMT_OP_SET_EXP_FEATURE, 4546 MGMT_STATUS_INVALID_PARAMS); 4547 4548 /* Only boolean on/off is supported */ 4549 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4550 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4551 MGMT_OP_SET_EXP_FEATURE, 4552 MGMT_STATUS_INVALID_PARAMS); 4553 4554 val = !!cp->param[0]; 4555 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4556 bt_dbg_set(val); 4557 4558 memcpy(rp.uuid, debug_uuid, 16); 4559 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4560 4561 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4562 4563 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4564 MGMT_OP_SET_EXP_FEATURE, 0, 4565 &rp, sizeof(rp)); 4566 4567 if (changed) 4568 exp_feature_changed(hdev, debug_uuid, val, sk); 4569 4570 return err; 4571 } 4572 #endif 4573 4574 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4575 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4576 { 4577 struct mgmt_rp_set_exp_feature rp; 4578 bool val, changed; 4579 int err; 4580 4581 /* Command requires to use the controller index */ 4582 if (!hdev) 4583 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4584 MGMT_OP_SET_EXP_FEATURE, 4585 MGMT_STATUS_INVALID_INDEX); 4586 4587 /* Parameters are limited to a single octet */ 4588 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4589 return mgmt_cmd_status(sk, hdev->id, 4590 MGMT_OP_SET_EXP_FEATURE, 4591 MGMT_STATUS_INVALID_PARAMS); 4592 4593 /* Only boolean on/off is supported */ 4594 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4595 return mgmt_cmd_status(sk, hdev->id, 4596 MGMT_OP_SET_EXP_FEATURE, 4597 MGMT_STATUS_INVALID_PARAMS); 4598 4599 val = !!cp->param[0]; 4600 4601 if (val) { 4602 changed = !hci_dev_test_and_set_flag(hdev, 4603 HCI_MESH_EXPERIMENTAL); 4604 } else { 4605 hci_dev_clear_flag(hdev, HCI_MESH); 4606 changed = hci_dev_test_and_clear_flag(hdev, 4607 HCI_MESH_EXPERIMENTAL); 4608 } 4609 4610 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4611 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4612 4613 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4614 4615 err = mgmt_cmd_complete(sk, hdev->id, 4616 MGMT_OP_SET_EXP_FEATURE, 0, 4617 &rp, sizeof(rp)); 4618 4619 if (changed) 4620 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4621 4622 return err; 4623 } 4624 4625 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4626 struct mgmt_cp_set_exp_feature *cp, 4627 u16 data_len) 4628 { 4629 struct mgmt_rp_set_exp_feature rp; 4630 bool val, changed; 4631 int err; 4632 u32 flags; 4633 4634 /* Command requires to use the controller index */ 4635 if (!hdev) 4636 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4637 MGMT_OP_SET_EXP_FEATURE, 4638 MGMT_STATUS_INVALID_INDEX); 4639 4640 /* Changes can only be made when controller is powered down */ 4641 if (hdev_is_powered(hdev)) 4642 return mgmt_cmd_status(sk, hdev->id, 4643 MGMT_OP_SET_EXP_FEATURE, 4644 MGMT_STATUS_REJECTED); 4645 4646 /* Parameters are limited to a single octet */ 4647 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4648 return mgmt_cmd_status(sk, hdev->id, 4649 MGMT_OP_SET_EXP_FEATURE, 4650 MGMT_STATUS_INVALID_PARAMS); 4651 4652 /* Only boolean on/off is supported */ 4653 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4654 return mgmt_cmd_status(sk, hdev->id, 4655 MGMT_OP_SET_EXP_FEATURE, 4656 MGMT_STATUS_INVALID_PARAMS); 4657 4658 val = !!cp->param[0]; 4659 4660 if (val) { 4661 changed = !hci_dev_test_and_set_flag(hdev, 4662 HCI_ENABLE_LL_PRIVACY); 4663 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4664 4665 /* Enable LL privacy + supported settings changed */ 4666 flags = BIT(0) | BIT(1); 4667 } else { 4668 changed = hci_dev_test_and_clear_flag(hdev, 4669 HCI_ENABLE_LL_PRIVACY); 4670 4671 /* Disable LL privacy + supported settings changed */ 4672 flags = BIT(1); 4673 } 4674 4675 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4676 rp.flags = cpu_to_le32(flags); 4677 4678 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4679 4680 err = mgmt_cmd_complete(sk, hdev->id, 4681 MGMT_OP_SET_EXP_FEATURE, 0, 4682 &rp, sizeof(rp)); 4683 4684 if (changed) 4685 exp_ll_privacy_feature_changed(val, hdev, sk); 4686 4687 return err; 4688 } 4689 4690 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4691 struct mgmt_cp_set_exp_feature *cp, 4692 u16 data_len) 4693 { 4694 struct mgmt_rp_set_exp_feature rp; 4695 bool val, changed; 4696 int err; 4697 4698 /* Command requires to use a valid controller index */ 4699 if (!hdev) 4700 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4701 MGMT_OP_SET_EXP_FEATURE, 4702 MGMT_STATUS_INVALID_INDEX); 4703 4704 /* Parameters are limited to a single octet */ 4705 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4706 return mgmt_cmd_status(sk, hdev->id, 4707 MGMT_OP_SET_EXP_FEATURE, 4708 MGMT_STATUS_INVALID_PARAMS); 4709 4710 /* Only boolean on/off is supported */ 4711 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4712 return mgmt_cmd_status(sk, hdev->id, 4713 MGMT_OP_SET_EXP_FEATURE, 4714 MGMT_STATUS_INVALID_PARAMS); 4715 4716 hci_req_sync_lock(hdev); 4717 4718 val = !!cp->param[0]; 4719 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4720 4721 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4722 err = mgmt_cmd_status(sk, hdev->id, 4723 MGMT_OP_SET_EXP_FEATURE, 4724 MGMT_STATUS_NOT_SUPPORTED); 4725 goto unlock_quality_report; 4726 } 4727 4728 if (changed) { 4729 if (hdev->set_quality_report) 4730 err = hdev->set_quality_report(hdev, val); 4731 else 4732 err = aosp_set_quality_report(hdev, val); 4733 4734 if (err) { 4735 err = mgmt_cmd_status(sk, hdev->id, 4736 MGMT_OP_SET_EXP_FEATURE, 4737 MGMT_STATUS_FAILED); 4738 goto unlock_quality_report; 4739 } 4740 4741 if (val) 4742 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4743 else 4744 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4745 } 4746 4747 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4748 4749 memcpy(rp.uuid, quality_report_uuid, 16); 4750 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4751 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4752 4753 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4754 &rp, sizeof(rp)); 4755 4756 if (changed) 4757 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4758 4759 unlock_quality_report: 4760 hci_req_sync_unlock(hdev); 4761 return err; 4762 } 4763 4764 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4765 struct mgmt_cp_set_exp_feature *cp, 4766 u16 data_len) 4767 { 4768 bool val, changed; 4769 int err; 4770 struct mgmt_rp_set_exp_feature rp; 4771 4772 /* Command requires to use a valid controller index */ 4773 if (!hdev) 4774 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4775 MGMT_OP_SET_EXP_FEATURE, 4776 MGMT_STATUS_INVALID_INDEX); 4777 4778 /* Parameters are limited to a single octet */ 4779 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4780 return mgmt_cmd_status(sk, hdev->id, 4781 MGMT_OP_SET_EXP_FEATURE, 4782 MGMT_STATUS_INVALID_PARAMS); 4783 4784 /* Only boolean on/off is supported */ 4785 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4786 return mgmt_cmd_status(sk, hdev->id, 4787 MGMT_OP_SET_EXP_FEATURE, 4788 MGMT_STATUS_INVALID_PARAMS); 4789 4790 val = !!cp->param[0]; 4791 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4792 4793 if (!hdev->get_data_path_id) { 4794 return mgmt_cmd_status(sk, hdev->id, 4795 MGMT_OP_SET_EXP_FEATURE, 4796 MGMT_STATUS_NOT_SUPPORTED); 4797 } 4798 4799 if (changed) { 4800 if (val) 4801 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4802 else 4803 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4804 } 4805 4806 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4807 val, changed); 4808 4809 memcpy(rp.uuid, offload_codecs_uuid, 16); 4810 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4811 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4812 err = mgmt_cmd_complete(sk, hdev->id, 4813 MGMT_OP_SET_EXP_FEATURE, 0, 4814 &rp, sizeof(rp)); 4815 4816 if (changed) 4817 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4818 4819 return err; 4820 } 4821 4822 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4823 struct mgmt_cp_set_exp_feature *cp, 4824 u16 data_len) 4825 { 4826 bool val, changed; 4827 int err; 4828 struct mgmt_rp_set_exp_feature rp; 4829 4830 /* Command requires to use a valid controller index */ 4831 if (!hdev) 4832 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4833 MGMT_OP_SET_EXP_FEATURE, 4834 MGMT_STATUS_INVALID_INDEX); 4835 4836 /* Parameters are limited to a single octet */ 4837 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4838 return mgmt_cmd_status(sk, hdev->id, 4839 MGMT_OP_SET_EXP_FEATURE, 4840 MGMT_STATUS_INVALID_PARAMS); 4841 4842 /* Only boolean on/off is supported */ 4843 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4844 return mgmt_cmd_status(sk, hdev->id, 4845 MGMT_OP_SET_EXP_FEATURE, 4846 MGMT_STATUS_INVALID_PARAMS); 4847 4848 val = !!cp->param[0]; 4849 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4850 4851 if (!hci_dev_le_state_simultaneous(hdev)) { 4852 return mgmt_cmd_status(sk, hdev->id, 4853 MGMT_OP_SET_EXP_FEATURE, 4854 MGMT_STATUS_NOT_SUPPORTED); 4855 } 4856 4857 if (changed) { 4858 if (val) 4859 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4860 else 4861 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4862 } 4863 4864 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4865 val, changed); 4866 4867 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4868 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4869 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4870 err = mgmt_cmd_complete(sk, hdev->id, 4871 MGMT_OP_SET_EXP_FEATURE, 0, 4872 &rp, sizeof(rp)); 4873 4874 if (changed) 4875 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4876 4877 return err; 4878 } 4879 4880 #ifdef CONFIG_BT_LE 4881 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4882 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4883 { 4884 struct mgmt_rp_set_exp_feature rp; 4885 bool val, changed = false; 4886 int err; 4887 4888 /* Command requires to use the non-controller index */ 4889 if (hdev) 4890 return mgmt_cmd_status(sk, hdev->id, 4891 MGMT_OP_SET_EXP_FEATURE, 4892 MGMT_STATUS_INVALID_INDEX); 4893 4894 /* Parameters are limited to a single octet */ 4895 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4896 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4897 MGMT_OP_SET_EXP_FEATURE, 4898 MGMT_STATUS_INVALID_PARAMS); 4899 4900 /* Only boolean on/off is supported */ 4901 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4902 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4903 MGMT_OP_SET_EXP_FEATURE, 4904 MGMT_STATUS_INVALID_PARAMS); 4905 4906 val = cp->param[0] ? true : false; 4907 if (val) 4908 err = iso_init(); 4909 else 4910 err = iso_exit(); 4911 4912 if (!err) 4913 changed = true; 4914 4915 memcpy(rp.uuid, iso_socket_uuid, 16); 4916 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4917 4918 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4919 4920 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4921 MGMT_OP_SET_EXP_FEATURE, 0, 4922 &rp, sizeof(rp)); 4923 4924 if (changed) 4925 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 4926 4927 return err; 4928 } 4929 #endif 4930 4931 static const struct mgmt_exp_feature { 4932 const u8 *uuid; 4933 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4934 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4935 } exp_features[] = { 4936 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4937 #ifdef CONFIG_BT_FEATURE_DEBUG 4938 EXP_FEAT(debug_uuid, set_debug_func), 4939 #endif 4940 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 4941 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4942 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4943 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4944 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 4945 #ifdef CONFIG_BT_LE 4946 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 4947 #endif 4948 4949 /* end with a null feature */ 4950 EXP_FEAT(NULL, NULL) 4951 }; 4952 4953 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 4954 void *data, u16 data_len) 4955 { 4956 struct mgmt_cp_set_exp_feature *cp = data; 4957 size_t i = 0; 4958 4959 bt_dev_dbg(hdev, "sock %p", sk); 4960 4961 for (i = 0; exp_features[i].uuid; i++) { 4962 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 4963 return exp_features[i].set_func(sk, hdev, cp, data_len); 4964 } 4965 4966 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4967 MGMT_OP_SET_EXP_FEATURE, 4968 MGMT_STATUS_NOT_SUPPORTED); 4969 } 4970 4971 static u32 get_params_flags(struct hci_dev *hdev, 4972 struct hci_conn_params *params) 4973 { 4974 u32 flags = hdev->conn_flags; 4975 4976 /* Devices using RPAs can only be programmed in the acceptlist if 4977 * LL Privacy has been enable otherwise they cannot mark 4978 * HCI_CONN_FLAG_REMOTE_WAKEUP. 4979 */ 4980 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) && 4981 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) 4982 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP; 4983 4984 return flags; 4985 } 4986 4987 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4988 u16 data_len) 4989 { 4990 struct mgmt_cp_get_device_flags *cp = data; 4991 struct mgmt_rp_get_device_flags rp; 4992 struct bdaddr_list_with_flags *br_params; 4993 struct hci_conn_params *params; 4994 u32 supported_flags; 4995 u32 current_flags = 0; 4996 u8 status = MGMT_STATUS_INVALID_PARAMS; 4997 4998 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4999 &cp->addr.bdaddr, cp->addr.type); 5000 5001 hci_dev_lock(hdev); 5002 5003 supported_flags = hdev->conn_flags; 5004 5005 memset(&rp, 0, sizeof(rp)); 5006 5007 if (cp->addr.type == BDADDR_BREDR) { 5008 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5009 &cp->addr.bdaddr, 5010 cp->addr.type); 5011 if (!br_params) 5012 goto done; 5013 5014 current_flags = br_params->flags; 5015 } else { 5016 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5017 le_addr_type(cp->addr.type)); 5018 if (!params) 5019 goto done; 5020 5021 supported_flags = get_params_flags(hdev, params); 5022 current_flags = params->flags; 5023 } 5024 5025 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5026 rp.addr.type = cp->addr.type; 5027 rp.supported_flags = cpu_to_le32(supported_flags); 5028 rp.current_flags = cpu_to_le32(current_flags); 5029 5030 status = MGMT_STATUS_SUCCESS; 5031 5032 done: 5033 hci_dev_unlock(hdev); 5034 5035 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5036 &rp, sizeof(rp)); 5037 } 5038 5039 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5040 bdaddr_t *bdaddr, u8 bdaddr_type, 5041 u32 supported_flags, u32 current_flags) 5042 { 5043 struct mgmt_ev_device_flags_changed ev; 5044 5045 bacpy(&ev.addr.bdaddr, bdaddr); 5046 ev.addr.type = bdaddr_type; 5047 ev.supported_flags = cpu_to_le32(supported_flags); 5048 ev.current_flags = cpu_to_le32(current_flags); 5049 5050 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5051 } 5052 5053 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5054 u16 len) 5055 { 5056 struct mgmt_cp_set_device_flags *cp = data; 5057 struct bdaddr_list_with_flags *br_params; 5058 struct hci_conn_params *params; 5059 u8 status = MGMT_STATUS_INVALID_PARAMS; 5060 u32 supported_flags; 5061 u32 current_flags = __le32_to_cpu(cp->current_flags); 5062 5063 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5064 &cp->addr.bdaddr, cp->addr.type, current_flags); 5065 5066 // We should take hci_dev_lock() early, I think.. conn_flags can change 5067 supported_flags = hdev->conn_flags; 5068 5069 if ((supported_flags | current_flags) != supported_flags) { 5070 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5071 current_flags, supported_flags); 5072 goto done; 5073 } 5074 5075 hci_dev_lock(hdev); 5076 5077 if (cp->addr.type == BDADDR_BREDR) { 5078 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5079 &cp->addr.bdaddr, 5080 cp->addr.type); 5081 5082 if (br_params) { 5083 br_params->flags = current_flags; 5084 status = MGMT_STATUS_SUCCESS; 5085 } else { 5086 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5087 &cp->addr.bdaddr, cp->addr.type); 5088 } 5089 5090 goto unlock; 5091 } 5092 5093 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5094 le_addr_type(cp->addr.type)); 5095 if (!params) { 5096 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5097 &cp->addr.bdaddr, le_addr_type(cp->addr.type)); 5098 goto unlock; 5099 } 5100 5101 supported_flags = get_params_flags(hdev, params); 5102 5103 if ((supported_flags | current_flags) != supported_flags) { 5104 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5105 current_flags, supported_flags); 5106 goto unlock; 5107 } 5108 5109 WRITE_ONCE(params->flags, current_flags); 5110 status = MGMT_STATUS_SUCCESS; 5111 5112 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5113 * has been set. 5114 */ 5115 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5116 hci_update_passive_scan(hdev); 5117 5118 unlock: 5119 hci_dev_unlock(hdev); 5120 5121 done: 5122 if (status == MGMT_STATUS_SUCCESS) 5123 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5124 supported_flags, current_flags); 5125 5126 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5127 &cp->addr, sizeof(cp->addr)); 5128 } 5129 5130 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5131 u16 handle) 5132 { 5133 struct mgmt_ev_adv_monitor_added ev; 5134 5135 ev.monitor_handle = cpu_to_le16(handle); 5136 5137 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5138 } 5139 5140 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 5141 { 5142 struct mgmt_ev_adv_monitor_removed ev; 5143 struct mgmt_pending_cmd *cmd; 5144 struct sock *sk_skip = NULL; 5145 struct mgmt_cp_remove_adv_monitor *cp; 5146 5147 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 5148 if (cmd) { 5149 cp = cmd->param; 5150 5151 if (cp->monitor_handle) 5152 sk_skip = cmd->sk; 5153 } 5154 5155 ev.monitor_handle = cpu_to_le16(handle); 5156 5157 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 5158 } 5159 5160 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5161 void *data, u16 len) 5162 { 5163 struct adv_monitor *monitor = NULL; 5164 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5165 int handle, err; 5166 size_t rp_size = 0; 5167 __u32 supported = 0; 5168 __u32 enabled = 0; 5169 __u16 num_handles = 0; 5170 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5171 5172 BT_DBG("request for %s", hdev->name); 5173 5174 hci_dev_lock(hdev); 5175 5176 if (msft_monitor_supported(hdev)) 5177 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5178 5179 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5180 handles[num_handles++] = monitor->handle; 5181 5182 hci_dev_unlock(hdev); 5183 5184 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5185 rp = kmalloc(rp_size, GFP_KERNEL); 5186 if (!rp) 5187 return -ENOMEM; 5188 5189 /* All supported features are currently enabled */ 5190 enabled = supported; 5191 5192 rp->supported_features = cpu_to_le32(supported); 5193 rp->enabled_features = cpu_to_le32(enabled); 5194 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5195 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5196 rp->num_handles = cpu_to_le16(num_handles); 5197 if (num_handles) 5198 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5199 5200 err = mgmt_cmd_complete(sk, hdev->id, 5201 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5202 MGMT_STATUS_SUCCESS, rp, rp_size); 5203 5204 kfree(rp); 5205 5206 return err; 5207 } 5208 5209 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5210 void *data, int status) 5211 { 5212 struct mgmt_rp_add_adv_patterns_monitor rp; 5213 struct mgmt_pending_cmd *cmd = data; 5214 struct adv_monitor *monitor = cmd->user_data; 5215 5216 hci_dev_lock(hdev); 5217 5218 rp.monitor_handle = cpu_to_le16(monitor->handle); 5219 5220 if (!status) { 5221 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5222 hdev->adv_monitors_cnt++; 5223 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5224 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5225 hci_update_passive_scan(hdev); 5226 } 5227 5228 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5229 mgmt_status(status), &rp, sizeof(rp)); 5230 mgmt_pending_remove(cmd); 5231 5232 hci_dev_unlock(hdev); 5233 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5234 rp.monitor_handle, status); 5235 } 5236 5237 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5238 { 5239 struct mgmt_pending_cmd *cmd = data; 5240 struct adv_monitor *monitor = cmd->user_data; 5241 5242 return hci_add_adv_monitor(hdev, monitor); 5243 } 5244 5245 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5246 struct adv_monitor *m, u8 status, 5247 void *data, u16 len, u16 op) 5248 { 5249 struct mgmt_pending_cmd *cmd; 5250 int err; 5251 5252 hci_dev_lock(hdev); 5253 5254 if (status) 5255 goto unlock; 5256 5257 if (pending_find(MGMT_OP_SET_LE, hdev) || 5258 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5259 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 5260 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 5261 status = MGMT_STATUS_BUSY; 5262 goto unlock; 5263 } 5264 5265 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5266 if (!cmd) { 5267 status = MGMT_STATUS_NO_RESOURCES; 5268 goto unlock; 5269 } 5270 5271 cmd->user_data = m; 5272 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5273 mgmt_add_adv_patterns_monitor_complete); 5274 if (err) { 5275 if (err == -ENOMEM) 5276 status = MGMT_STATUS_NO_RESOURCES; 5277 else 5278 status = MGMT_STATUS_FAILED; 5279 5280 goto unlock; 5281 } 5282 5283 hci_dev_unlock(hdev); 5284 5285 return 0; 5286 5287 unlock: 5288 hci_free_adv_monitor(hdev, m); 5289 hci_dev_unlock(hdev); 5290 return mgmt_cmd_status(sk, hdev->id, op, status); 5291 } 5292 5293 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5294 struct mgmt_adv_rssi_thresholds *rssi) 5295 { 5296 if (rssi) { 5297 m->rssi.low_threshold = rssi->low_threshold; 5298 m->rssi.low_threshold_timeout = 5299 __le16_to_cpu(rssi->low_threshold_timeout); 5300 m->rssi.high_threshold = rssi->high_threshold; 5301 m->rssi.high_threshold_timeout = 5302 __le16_to_cpu(rssi->high_threshold_timeout); 5303 m->rssi.sampling_period = rssi->sampling_period; 5304 } else { 5305 /* Default values. These numbers are the least constricting 5306 * parameters for MSFT API to work, so it behaves as if there 5307 * are no rssi parameter to consider. May need to be changed 5308 * if other API are to be supported. 5309 */ 5310 m->rssi.low_threshold = -127; 5311 m->rssi.low_threshold_timeout = 60; 5312 m->rssi.high_threshold = -127; 5313 m->rssi.high_threshold_timeout = 0; 5314 m->rssi.sampling_period = 0; 5315 } 5316 } 5317 5318 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5319 struct mgmt_adv_pattern *patterns) 5320 { 5321 u8 offset = 0, length = 0; 5322 struct adv_pattern *p = NULL; 5323 int i; 5324 5325 for (i = 0; i < pattern_count; i++) { 5326 offset = patterns[i].offset; 5327 length = patterns[i].length; 5328 if (offset >= HCI_MAX_EXT_AD_LENGTH || 5329 length > HCI_MAX_EXT_AD_LENGTH || 5330 (offset + length) > HCI_MAX_EXT_AD_LENGTH) 5331 return MGMT_STATUS_INVALID_PARAMS; 5332 5333 p = kmalloc(sizeof(*p), GFP_KERNEL); 5334 if (!p) 5335 return MGMT_STATUS_NO_RESOURCES; 5336 5337 p->ad_type = patterns[i].ad_type; 5338 p->offset = patterns[i].offset; 5339 p->length = patterns[i].length; 5340 memcpy(p->value, patterns[i].value, p->length); 5341 5342 INIT_LIST_HEAD(&p->list); 5343 list_add(&p->list, &m->patterns); 5344 } 5345 5346 return MGMT_STATUS_SUCCESS; 5347 } 5348 5349 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5350 void *data, u16 len) 5351 { 5352 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5353 struct adv_monitor *m = NULL; 5354 u8 status = MGMT_STATUS_SUCCESS; 5355 size_t expected_size = sizeof(*cp); 5356 5357 BT_DBG("request for %s", hdev->name); 5358 5359 if (len <= sizeof(*cp)) { 5360 status = MGMT_STATUS_INVALID_PARAMS; 5361 goto done; 5362 } 5363 5364 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5365 if (len != expected_size) { 5366 status = MGMT_STATUS_INVALID_PARAMS; 5367 goto done; 5368 } 5369 5370 m = kzalloc(sizeof(*m), GFP_KERNEL); 5371 if (!m) { 5372 status = MGMT_STATUS_NO_RESOURCES; 5373 goto done; 5374 } 5375 5376 INIT_LIST_HEAD(&m->patterns); 5377 5378 parse_adv_monitor_rssi(m, NULL); 5379 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5380 5381 done: 5382 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5383 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5384 } 5385 5386 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5387 void *data, u16 len) 5388 { 5389 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5390 struct adv_monitor *m = NULL; 5391 u8 status = MGMT_STATUS_SUCCESS; 5392 size_t expected_size = sizeof(*cp); 5393 5394 BT_DBG("request for %s", hdev->name); 5395 5396 if (len <= sizeof(*cp)) { 5397 status = MGMT_STATUS_INVALID_PARAMS; 5398 goto done; 5399 } 5400 5401 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5402 if (len != expected_size) { 5403 status = MGMT_STATUS_INVALID_PARAMS; 5404 goto done; 5405 } 5406 5407 m = kzalloc(sizeof(*m), GFP_KERNEL); 5408 if (!m) { 5409 status = MGMT_STATUS_NO_RESOURCES; 5410 goto done; 5411 } 5412 5413 INIT_LIST_HEAD(&m->patterns); 5414 5415 parse_adv_monitor_rssi(m, &cp->rssi); 5416 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5417 5418 done: 5419 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5420 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5421 } 5422 5423 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5424 void *data, int status) 5425 { 5426 struct mgmt_rp_remove_adv_monitor rp; 5427 struct mgmt_pending_cmd *cmd = data; 5428 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5429 5430 hci_dev_lock(hdev); 5431 5432 rp.monitor_handle = cp->monitor_handle; 5433 5434 if (!status) 5435 hci_update_passive_scan(hdev); 5436 5437 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5438 mgmt_status(status), &rp, sizeof(rp)); 5439 mgmt_pending_remove(cmd); 5440 5441 hci_dev_unlock(hdev); 5442 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5443 rp.monitor_handle, status); 5444 } 5445 5446 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5447 { 5448 struct mgmt_pending_cmd *cmd = data; 5449 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5450 u16 handle = __le16_to_cpu(cp->monitor_handle); 5451 5452 if (!handle) 5453 return hci_remove_all_adv_monitor(hdev); 5454 5455 return hci_remove_single_adv_monitor(hdev, handle); 5456 } 5457 5458 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5459 void *data, u16 len) 5460 { 5461 struct mgmt_pending_cmd *cmd; 5462 int err, status; 5463 5464 hci_dev_lock(hdev); 5465 5466 if (pending_find(MGMT_OP_SET_LE, hdev) || 5467 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 5468 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5469 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5470 status = MGMT_STATUS_BUSY; 5471 goto unlock; 5472 } 5473 5474 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5475 if (!cmd) { 5476 status = MGMT_STATUS_NO_RESOURCES; 5477 goto unlock; 5478 } 5479 5480 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5481 mgmt_remove_adv_monitor_complete); 5482 5483 if (err) { 5484 mgmt_pending_remove(cmd); 5485 5486 if (err == -ENOMEM) 5487 status = MGMT_STATUS_NO_RESOURCES; 5488 else 5489 status = MGMT_STATUS_FAILED; 5490 5491 goto unlock; 5492 } 5493 5494 hci_dev_unlock(hdev); 5495 5496 return 0; 5497 5498 unlock: 5499 hci_dev_unlock(hdev); 5500 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5501 status); 5502 } 5503 5504 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 5505 { 5506 struct mgmt_rp_read_local_oob_data mgmt_rp; 5507 size_t rp_size = sizeof(mgmt_rp); 5508 struct mgmt_pending_cmd *cmd = data; 5509 struct sk_buff *skb = cmd->skb; 5510 u8 status = mgmt_status(err); 5511 5512 if (!status) { 5513 if (!skb) 5514 status = MGMT_STATUS_FAILED; 5515 else if (IS_ERR(skb)) 5516 status = mgmt_status(PTR_ERR(skb)); 5517 else 5518 status = mgmt_status(skb->data[0]); 5519 } 5520 5521 bt_dev_dbg(hdev, "status %d", status); 5522 5523 if (status) { 5524 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5525 goto remove; 5526 } 5527 5528 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5529 5530 if (!bredr_sc_enabled(hdev)) { 5531 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5532 5533 if (skb->len < sizeof(*rp)) { 5534 mgmt_cmd_status(cmd->sk, hdev->id, 5535 MGMT_OP_READ_LOCAL_OOB_DATA, 5536 MGMT_STATUS_FAILED); 5537 goto remove; 5538 } 5539 5540 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5541 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5542 5543 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5544 } else { 5545 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5546 5547 if (skb->len < sizeof(*rp)) { 5548 mgmt_cmd_status(cmd->sk, hdev->id, 5549 MGMT_OP_READ_LOCAL_OOB_DATA, 5550 MGMT_STATUS_FAILED); 5551 goto remove; 5552 } 5553 5554 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5555 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5556 5557 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5558 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5559 } 5560 5561 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5562 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5563 5564 remove: 5565 if (skb && !IS_ERR(skb)) 5566 kfree_skb(skb); 5567 5568 mgmt_pending_free(cmd); 5569 } 5570 5571 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5572 { 5573 struct mgmt_pending_cmd *cmd = data; 5574 5575 if (bredr_sc_enabled(hdev)) 5576 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5577 else 5578 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5579 5580 if (IS_ERR(cmd->skb)) 5581 return PTR_ERR(cmd->skb); 5582 else 5583 return 0; 5584 } 5585 5586 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5587 void *data, u16 data_len) 5588 { 5589 struct mgmt_pending_cmd *cmd; 5590 int err; 5591 5592 bt_dev_dbg(hdev, "sock %p", sk); 5593 5594 hci_dev_lock(hdev); 5595 5596 if (!hdev_is_powered(hdev)) { 5597 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5598 MGMT_STATUS_NOT_POWERED); 5599 goto unlock; 5600 } 5601 5602 if (!lmp_ssp_capable(hdev)) { 5603 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5604 MGMT_STATUS_NOT_SUPPORTED); 5605 goto unlock; 5606 } 5607 5608 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5609 if (!cmd) 5610 err = -ENOMEM; 5611 else 5612 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5613 read_local_oob_data_complete); 5614 5615 if (err < 0) { 5616 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5617 MGMT_STATUS_FAILED); 5618 5619 if (cmd) 5620 mgmt_pending_free(cmd); 5621 } 5622 5623 unlock: 5624 hci_dev_unlock(hdev); 5625 return err; 5626 } 5627 5628 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5629 void *data, u16 len) 5630 { 5631 struct mgmt_addr_info *addr = data; 5632 int err; 5633 5634 bt_dev_dbg(hdev, "sock %p", sk); 5635 5636 if (!bdaddr_type_is_valid(addr->type)) 5637 return mgmt_cmd_complete(sk, hdev->id, 5638 MGMT_OP_ADD_REMOTE_OOB_DATA, 5639 MGMT_STATUS_INVALID_PARAMS, 5640 addr, sizeof(*addr)); 5641 5642 hci_dev_lock(hdev); 5643 5644 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5645 struct mgmt_cp_add_remote_oob_data *cp = data; 5646 u8 status; 5647 5648 if (cp->addr.type != BDADDR_BREDR) { 5649 err = mgmt_cmd_complete(sk, hdev->id, 5650 MGMT_OP_ADD_REMOTE_OOB_DATA, 5651 MGMT_STATUS_INVALID_PARAMS, 5652 &cp->addr, sizeof(cp->addr)); 5653 goto unlock; 5654 } 5655 5656 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5657 cp->addr.type, cp->hash, 5658 cp->rand, NULL, NULL); 5659 if (err < 0) 5660 status = MGMT_STATUS_FAILED; 5661 else 5662 status = MGMT_STATUS_SUCCESS; 5663 5664 err = mgmt_cmd_complete(sk, hdev->id, 5665 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5666 &cp->addr, sizeof(cp->addr)); 5667 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5668 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5669 u8 *rand192, *hash192, *rand256, *hash256; 5670 u8 status; 5671 5672 if (bdaddr_type_is_le(cp->addr.type)) { 5673 /* Enforce zero-valued 192-bit parameters as 5674 * long as legacy SMP OOB isn't implemented. 5675 */ 5676 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5677 memcmp(cp->hash192, ZERO_KEY, 16)) { 5678 err = mgmt_cmd_complete(sk, hdev->id, 5679 MGMT_OP_ADD_REMOTE_OOB_DATA, 5680 MGMT_STATUS_INVALID_PARAMS, 5681 addr, sizeof(*addr)); 5682 goto unlock; 5683 } 5684 5685 rand192 = NULL; 5686 hash192 = NULL; 5687 } else { 5688 /* In case one of the P-192 values is set to zero, 5689 * then just disable OOB data for P-192. 5690 */ 5691 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5692 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5693 rand192 = NULL; 5694 hash192 = NULL; 5695 } else { 5696 rand192 = cp->rand192; 5697 hash192 = cp->hash192; 5698 } 5699 } 5700 5701 /* In case one of the P-256 values is set to zero, then just 5702 * disable OOB data for P-256. 5703 */ 5704 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5705 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5706 rand256 = NULL; 5707 hash256 = NULL; 5708 } else { 5709 rand256 = cp->rand256; 5710 hash256 = cp->hash256; 5711 } 5712 5713 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5714 cp->addr.type, hash192, rand192, 5715 hash256, rand256); 5716 if (err < 0) 5717 status = MGMT_STATUS_FAILED; 5718 else 5719 status = MGMT_STATUS_SUCCESS; 5720 5721 err = mgmt_cmd_complete(sk, hdev->id, 5722 MGMT_OP_ADD_REMOTE_OOB_DATA, 5723 status, &cp->addr, sizeof(cp->addr)); 5724 } else { 5725 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5726 len); 5727 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5728 MGMT_STATUS_INVALID_PARAMS); 5729 } 5730 5731 unlock: 5732 hci_dev_unlock(hdev); 5733 return err; 5734 } 5735 5736 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5737 void *data, u16 len) 5738 { 5739 struct mgmt_cp_remove_remote_oob_data *cp = data; 5740 u8 status; 5741 int err; 5742 5743 bt_dev_dbg(hdev, "sock %p", sk); 5744 5745 if (cp->addr.type != BDADDR_BREDR) 5746 return mgmt_cmd_complete(sk, hdev->id, 5747 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5748 MGMT_STATUS_INVALID_PARAMS, 5749 &cp->addr, sizeof(cp->addr)); 5750 5751 hci_dev_lock(hdev); 5752 5753 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5754 hci_remote_oob_data_clear(hdev); 5755 status = MGMT_STATUS_SUCCESS; 5756 goto done; 5757 } 5758 5759 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5760 if (err < 0) 5761 status = MGMT_STATUS_INVALID_PARAMS; 5762 else 5763 status = MGMT_STATUS_SUCCESS; 5764 5765 done: 5766 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5767 status, &cp->addr, sizeof(cp->addr)); 5768 5769 hci_dev_unlock(hdev); 5770 return err; 5771 } 5772 5773 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5774 { 5775 struct mgmt_pending_cmd *cmd; 5776 5777 bt_dev_dbg(hdev, "status %u", status); 5778 5779 hci_dev_lock(hdev); 5780 5781 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5782 if (!cmd) 5783 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5784 5785 if (!cmd) 5786 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5787 5788 if (cmd) { 5789 cmd->cmd_complete(cmd, mgmt_status(status)); 5790 mgmt_pending_remove(cmd); 5791 } 5792 5793 hci_dev_unlock(hdev); 5794 } 5795 5796 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5797 uint8_t *mgmt_status) 5798 { 5799 switch (type) { 5800 case DISCOV_TYPE_LE: 5801 *mgmt_status = mgmt_le_support(hdev); 5802 if (*mgmt_status) 5803 return false; 5804 break; 5805 case DISCOV_TYPE_INTERLEAVED: 5806 *mgmt_status = mgmt_le_support(hdev); 5807 if (*mgmt_status) 5808 return false; 5809 fallthrough; 5810 case DISCOV_TYPE_BREDR: 5811 *mgmt_status = mgmt_bredr_support(hdev); 5812 if (*mgmt_status) 5813 return false; 5814 break; 5815 default: 5816 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5817 return false; 5818 } 5819 5820 return true; 5821 } 5822 5823 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5824 { 5825 struct mgmt_pending_cmd *cmd = data; 5826 5827 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5828 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5829 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5830 return; 5831 5832 bt_dev_dbg(hdev, "err %d", err); 5833 5834 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5835 cmd->param, 1); 5836 mgmt_pending_remove(cmd); 5837 5838 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5839 DISCOVERY_FINDING); 5840 } 5841 5842 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5843 { 5844 return hci_start_discovery_sync(hdev); 5845 } 5846 5847 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5848 u16 op, void *data, u16 len) 5849 { 5850 struct mgmt_cp_start_discovery *cp = data; 5851 struct mgmt_pending_cmd *cmd; 5852 u8 status; 5853 int err; 5854 5855 bt_dev_dbg(hdev, "sock %p", sk); 5856 5857 hci_dev_lock(hdev); 5858 5859 if (!hdev_is_powered(hdev)) { 5860 err = mgmt_cmd_complete(sk, hdev->id, op, 5861 MGMT_STATUS_NOT_POWERED, 5862 &cp->type, sizeof(cp->type)); 5863 goto failed; 5864 } 5865 5866 if (hdev->discovery.state != DISCOVERY_STOPPED || 5867 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5868 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5869 &cp->type, sizeof(cp->type)); 5870 goto failed; 5871 } 5872 5873 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5874 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5875 &cp->type, sizeof(cp->type)); 5876 goto failed; 5877 } 5878 5879 /* Can't start discovery when it is paused */ 5880 if (hdev->discovery_paused) { 5881 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5882 &cp->type, sizeof(cp->type)); 5883 goto failed; 5884 } 5885 5886 /* Clear the discovery filter first to free any previously 5887 * allocated memory for the UUID list. 5888 */ 5889 hci_discovery_filter_clear(hdev); 5890 5891 hdev->discovery.type = cp->type; 5892 hdev->discovery.report_invalid_rssi = false; 5893 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5894 hdev->discovery.limited = true; 5895 else 5896 hdev->discovery.limited = false; 5897 5898 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5899 if (!cmd) { 5900 err = -ENOMEM; 5901 goto failed; 5902 } 5903 5904 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5905 start_discovery_complete); 5906 if (err < 0) { 5907 mgmt_pending_remove(cmd); 5908 goto failed; 5909 } 5910 5911 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5912 5913 failed: 5914 hci_dev_unlock(hdev); 5915 return err; 5916 } 5917 5918 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5919 void *data, u16 len) 5920 { 5921 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5922 data, len); 5923 } 5924 5925 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5926 void *data, u16 len) 5927 { 5928 return start_discovery_internal(sk, hdev, 5929 MGMT_OP_START_LIMITED_DISCOVERY, 5930 data, len); 5931 } 5932 5933 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5934 void *data, u16 len) 5935 { 5936 struct mgmt_cp_start_service_discovery *cp = data; 5937 struct mgmt_pending_cmd *cmd; 5938 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5939 u16 uuid_count, expected_len; 5940 u8 status; 5941 int err; 5942 5943 bt_dev_dbg(hdev, "sock %p", sk); 5944 5945 hci_dev_lock(hdev); 5946 5947 if (!hdev_is_powered(hdev)) { 5948 err = mgmt_cmd_complete(sk, hdev->id, 5949 MGMT_OP_START_SERVICE_DISCOVERY, 5950 MGMT_STATUS_NOT_POWERED, 5951 &cp->type, sizeof(cp->type)); 5952 goto failed; 5953 } 5954 5955 if (hdev->discovery.state != DISCOVERY_STOPPED || 5956 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5957 err = mgmt_cmd_complete(sk, hdev->id, 5958 MGMT_OP_START_SERVICE_DISCOVERY, 5959 MGMT_STATUS_BUSY, &cp->type, 5960 sizeof(cp->type)); 5961 goto failed; 5962 } 5963 5964 if (hdev->discovery_paused) { 5965 err = mgmt_cmd_complete(sk, hdev->id, 5966 MGMT_OP_START_SERVICE_DISCOVERY, 5967 MGMT_STATUS_BUSY, &cp->type, 5968 sizeof(cp->type)); 5969 goto failed; 5970 } 5971 5972 uuid_count = __le16_to_cpu(cp->uuid_count); 5973 if (uuid_count > max_uuid_count) { 5974 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5975 uuid_count); 5976 err = mgmt_cmd_complete(sk, hdev->id, 5977 MGMT_OP_START_SERVICE_DISCOVERY, 5978 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5979 sizeof(cp->type)); 5980 goto failed; 5981 } 5982 5983 expected_len = sizeof(*cp) + uuid_count * 16; 5984 if (expected_len != len) { 5985 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5986 expected_len, len); 5987 err = mgmt_cmd_complete(sk, hdev->id, 5988 MGMT_OP_START_SERVICE_DISCOVERY, 5989 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5990 sizeof(cp->type)); 5991 goto failed; 5992 } 5993 5994 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5995 err = mgmt_cmd_complete(sk, hdev->id, 5996 MGMT_OP_START_SERVICE_DISCOVERY, 5997 status, &cp->type, sizeof(cp->type)); 5998 goto failed; 5999 } 6000 6001 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6002 hdev, data, len); 6003 if (!cmd) { 6004 err = -ENOMEM; 6005 goto failed; 6006 } 6007 6008 /* Clear the discovery filter first to free any previously 6009 * allocated memory for the UUID list. 6010 */ 6011 hci_discovery_filter_clear(hdev); 6012 6013 hdev->discovery.result_filtering = true; 6014 hdev->discovery.type = cp->type; 6015 hdev->discovery.rssi = cp->rssi; 6016 hdev->discovery.uuid_count = uuid_count; 6017 6018 if (uuid_count > 0) { 6019 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6020 GFP_KERNEL); 6021 if (!hdev->discovery.uuids) { 6022 err = mgmt_cmd_complete(sk, hdev->id, 6023 MGMT_OP_START_SERVICE_DISCOVERY, 6024 MGMT_STATUS_FAILED, 6025 &cp->type, sizeof(cp->type)); 6026 mgmt_pending_remove(cmd); 6027 goto failed; 6028 } 6029 } 6030 6031 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6032 start_discovery_complete); 6033 if (err < 0) { 6034 mgmt_pending_remove(cmd); 6035 goto failed; 6036 } 6037 6038 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6039 6040 failed: 6041 hci_dev_unlock(hdev); 6042 return err; 6043 } 6044 6045 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 6046 { 6047 struct mgmt_pending_cmd *cmd; 6048 6049 bt_dev_dbg(hdev, "status %u", status); 6050 6051 hci_dev_lock(hdev); 6052 6053 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 6054 if (cmd) { 6055 cmd->cmd_complete(cmd, mgmt_status(status)); 6056 mgmt_pending_remove(cmd); 6057 } 6058 6059 hci_dev_unlock(hdev); 6060 } 6061 6062 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6063 { 6064 struct mgmt_pending_cmd *cmd = data; 6065 6066 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 6067 return; 6068 6069 bt_dev_dbg(hdev, "err %d", err); 6070 6071 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 6072 cmd->param, 1); 6073 mgmt_pending_remove(cmd); 6074 6075 if (!err) 6076 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6077 } 6078 6079 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6080 { 6081 return hci_stop_discovery_sync(hdev); 6082 } 6083 6084 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6085 u16 len) 6086 { 6087 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6088 struct mgmt_pending_cmd *cmd; 6089 int err; 6090 6091 bt_dev_dbg(hdev, "sock %p", sk); 6092 6093 hci_dev_lock(hdev); 6094 6095 if (!hci_discovery_active(hdev)) { 6096 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6097 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6098 sizeof(mgmt_cp->type)); 6099 goto unlock; 6100 } 6101 6102 if (hdev->discovery.type != mgmt_cp->type) { 6103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6104 MGMT_STATUS_INVALID_PARAMS, 6105 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6106 goto unlock; 6107 } 6108 6109 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6110 if (!cmd) { 6111 err = -ENOMEM; 6112 goto unlock; 6113 } 6114 6115 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6116 stop_discovery_complete); 6117 if (err < 0) { 6118 mgmt_pending_remove(cmd); 6119 goto unlock; 6120 } 6121 6122 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6123 6124 unlock: 6125 hci_dev_unlock(hdev); 6126 return err; 6127 } 6128 6129 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6130 u16 len) 6131 { 6132 struct mgmt_cp_confirm_name *cp = data; 6133 struct inquiry_entry *e; 6134 int err; 6135 6136 bt_dev_dbg(hdev, "sock %p", sk); 6137 6138 hci_dev_lock(hdev); 6139 6140 if (!hci_discovery_active(hdev)) { 6141 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6142 MGMT_STATUS_FAILED, &cp->addr, 6143 sizeof(cp->addr)); 6144 goto failed; 6145 } 6146 6147 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6148 if (!e) { 6149 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6150 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6151 sizeof(cp->addr)); 6152 goto failed; 6153 } 6154 6155 if (cp->name_known) { 6156 e->name_state = NAME_KNOWN; 6157 list_del(&e->list); 6158 } else { 6159 e->name_state = NAME_NEEDED; 6160 hci_inquiry_cache_update_resolve(hdev, e); 6161 } 6162 6163 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6164 &cp->addr, sizeof(cp->addr)); 6165 6166 failed: 6167 hci_dev_unlock(hdev); 6168 return err; 6169 } 6170 6171 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6172 u16 len) 6173 { 6174 struct mgmt_cp_block_device *cp = data; 6175 u8 status; 6176 int err; 6177 6178 bt_dev_dbg(hdev, "sock %p", sk); 6179 6180 if (!bdaddr_type_is_valid(cp->addr.type)) 6181 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6182 MGMT_STATUS_INVALID_PARAMS, 6183 &cp->addr, sizeof(cp->addr)); 6184 6185 hci_dev_lock(hdev); 6186 6187 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6188 cp->addr.type); 6189 if (err < 0) { 6190 status = MGMT_STATUS_FAILED; 6191 goto done; 6192 } 6193 6194 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6195 sk); 6196 status = MGMT_STATUS_SUCCESS; 6197 6198 done: 6199 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6200 &cp->addr, sizeof(cp->addr)); 6201 6202 hci_dev_unlock(hdev); 6203 6204 return err; 6205 } 6206 6207 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6208 u16 len) 6209 { 6210 struct mgmt_cp_unblock_device *cp = data; 6211 u8 status; 6212 int err; 6213 6214 bt_dev_dbg(hdev, "sock %p", sk); 6215 6216 if (!bdaddr_type_is_valid(cp->addr.type)) 6217 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6218 MGMT_STATUS_INVALID_PARAMS, 6219 &cp->addr, sizeof(cp->addr)); 6220 6221 hci_dev_lock(hdev); 6222 6223 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6224 cp->addr.type); 6225 if (err < 0) { 6226 status = MGMT_STATUS_INVALID_PARAMS; 6227 goto done; 6228 } 6229 6230 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6231 sk); 6232 status = MGMT_STATUS_SUCCESS; 6233 6234 done: 6235 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6236 &cp->addr, sizeof(cp->addr)); 6237 6238 hci_dev_unlock(hdev); 6239 6240 return err; 6241 } 6242 6243 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6244 { 6245 return hci_update_eir_sync(hdev); 6246 } 6247 6248 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6249 u16 len) 6250 { 6251 struct mgmt_cp_set_device_id *cp = data; 6252 int err; 6253 __u16 source; 6254 6255 bt_dev_dbg(hdev, "sock %p", sk); 6256 6257 source = __le16_to_cpu(cp->source); 6258 6259 if (source > 0x0002) 6260 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6261 MGMT_STATUS_INVALID_PARAMS); 6262 6263 hci_dev_lock(hdev); 6264 6265 hdev->devid_source = source; 6266 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6267 hdev->devid_product = __le16_to_cpu(cp->product); 6268 hdev->devid_version = __le16_to_cpu(cp->version); 6269 6270 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6271 NULL, 0); 6272 6273 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6274 6275 hci_dev_unlock(hdev); 6276 6277 return err; 6278 } 6279 6280 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6281 { 6282 if (err) 6283 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6284 else 6285 bt_dev_dbg(hdev, "status %d", err); 6286 } 6287 6288 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6289 { 6290 struct cmd_lookup match = { NULL, hdev }; 6291 u8 instance; 6292 struct adv_info *adv_instance; 6293 u8 status = mgmt_status(err); 6294 6295 if (status) { 6296 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 6297 cmd_status_rsp, &status); 6298 return; 6299 } 6300 6301 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6302 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6303 else 6304 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6305 6306 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 6307 &match); 6308 6309 new_settings(hdev, match.sk); 6310 6311 if (match.sk) 6312 sock_put(match.sk); 6313 6314 /* If "Set Advertising" was just disabled and instance advertising was 6315 * set up earlier, then re-enable multi-instance advertising. 6316 */ 6317 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6318 list_empty(&hdev->adv_instances)) 6319 return; 6320 6321 instance = hdev->cur_adv_instance; 6322 if (!instance) { 6323 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6324 struct adv_info, list); 6325 if (!adv_instance) 6326 return; 6327 6328 instance = adv_instance->instance; 6329 } 6330 6331 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6332 6333 enable_advertising_instance(hdev, err); 6334 } 6335 6336 static int set_adv_sync(struct hci_dev *hdev, void *data) 6337 { 6338 struct mgmt_pending_cmd *cmd = data; 6339 struct mgmt_mode *cp = cmd->param; 6340 u8 val = !!cp->val; 6341 6342 if (cp->val == 0x02) 6343 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6344 else 6345 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6346 6347 cancel_adv_timeout(hdev); 6348 6349 if (val) { 6350 /* Switch to instance "0" for the Set Advertising setting. 6351 * We cannot use update_[adv|scan_rsp]_data() here as the 6352 * HCI_ADVERTISING flag is not yet set. 6353 */ 6354 hdev->cur_adv_instance = 0x00; 6355 6356 if (ext_adv_capable(hdev)) { 6357 hci_start_ext_adv_sync(hdev, 0x00); 6358 } else { 6359 hci_update_adv_data_sync(hdev, 0x00); 6360 hci_update_scan_rsp_data_sync(hdev, 0x00); 6361 hci_enable_advertising_sync(hdev); 6362 } 6363 } else { 6364 hci_disable_advertising_sync(hdev); 6365 } 6366 6367 return 0; 6368 } 6369 6370 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6371 u16 len) 6372 { 6373 struct mgmt_mode *cp = data; 6374 struct mgmt_pending_cmd *cmd; 6375 u8 val, status; 6376 int err; 6377 6378 bt_dev_dbg(hdev, "sock %p", sk); 6379 6380 status = mgmt_le_support(hdev); 6381 if (status) 6382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6383 status); 6384 6385 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6387 MGMT_STATUS_INVALID_PARAMS); 6388 6389 if (hdev->advertising_paused) 6390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6391 MGMT_STATUS_BUSY); 6392 6393 hci_dev_lock(hdev); 6394 6395 val = !!cp->val; 6396 6397 /* The following conditions are ones which mean that we should 6398 * not do any HCI communication but directly send a mgmt 6399 * response to user space (after toggling the flag if 6400 * necessary). 6401 */ 6402 if (!hdev_is_powered(hdev) || 6403 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6404 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6405 hci_dev_test_flag(hdev, HCI_MESH) || 6406 hci_conn_num(hdev, LE_LINK) > 0 || 6407 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6408 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6409 bool changed; 6410 6411 if (cp->val) { 6412 hdev->cur_adv_instance = 0x00; 6413 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6414 if (cp->val == 0x02) 6415 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6416 else 6417 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6418 } else { 6419 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6420 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6421 } 6422 6423 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6424 if (err < 0) 6425 goto unlock; 6426 6427 if (changed) 6428 err = new_settings(hdev, sk); 6429 6430 goto unlock; 6431 } 6432 6433 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6434 pending_find(MGMT_OP_SET_LE, hdev)) { 6435 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6436 MGMT_STATUS_BUSY); 6437 goto unlock; 6438 } 6439 6440 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6441 if (!cmd) 6442 err = -ENOMEM; 6443 else 6444 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6445 set_advertising_complete); 6446 6447 if (err < 0 && cmd) 6448 mgmt_pending_remove(cmd); 6449 6450 unlock: 6451 hci_dev_unlock(hdev); 6452 return err; 6453 } 6454 6455 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6456 void *data, u16 len) 6457 { 6458 struct mgmt_cp_set_static_address *cp = data; 6459 int err; 6460 6461 bt_dev_dbg(hdev, "sock %p", sk); 6462 6463 if (!lmp_le_capable(hdev)) 6464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6465 MGMT_STATUS_NOT_SUPPORTED); 6466 6467 if (hdev_is_powered(hdev)) 6468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6469 MGMT_STATUS_REJECTED); 6470 6471 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6472 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6473 return mgmt_cmd_status(sk, hdev->id, 6474 MGMT_OP_SET_STATIC_ADDRESS, 6475 MGMT_STATUS_INVALID_PARAMS); 6476 6477 /* Two most significant bits shall be set */ 6478 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6479 return mgmt_cmd_status(sk, hdev->id, 6480 MGMT_OP_SET_STATIC_ADDRESS, 6481 MGMT_STATUS_INVALID_PARAMS); 6482 } 6483 6484 hci_dev_lock(hdev); 6485 6486 bacpy(&hdev->static_addr, &cp->bdaddr); 6487 6488 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6489 if (err < 0) 6490 goto unlock; 6491 6492 err = new_settings(hdev, sk); 6493 6494 unlock: 6495 hci_dev_unlock(hdev); 6496 return err; 6497 } 6498 6499 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6500 void *data, u16 len) 6501 { 6502 struct mgmt_cp_set_scan_params *cp = data; 6503 __u16 interval, window; 6504 int err; 6505 6506 bt_dev_dbg(hdev, "sock %p", sk); 6507 6508 if (!lmp_le_capable(hdev)) 6509 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6510 MGMT_STATUS_NOT_SUPPORTED); 6511 6512 interval = __le16_to_cpu(cp->interval); 6513 6514 if (interval < 0x0004 || interval > 0x4000) 6515 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6516 MGMT_STATUS_INVALID_PARAMS); 6517 6518 window = __le16_to_cpu(cp->window); 6519 6520 if (window < 0x0004 || window > 0x4000) 6521 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6522 MGMT_STATUS_INVALID_PARAMS); 6523 6524 if (window > interval) 6525 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6526 MGMT_STATUS_INVALID_PARAMS); 6527 6528 hci_dev_lock(hdev); 6529 6530 hdev->le_scan_interval = interval; 6531 hdev->le_scan_window = window; 6532 6533 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6534 NULL, 0); 6535 6536 /* If background scan is running, restart it so new parameters are 6537 * loaded. 6538 */ 6539 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6540 hdev->discovery.state == DISCOVERY_STOPPED) 6541 hci_update_passive_scan(hdev); 6542 6543 hci_dev_unlock(hdev); 6544 6545 return err; 6546 } 6547 6548 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6549 { 6550 struct mgmt_pending_cmd *cmd = data; 6551 6552 bt_dev_dbg(hdev, "err %d", err); 6553 6554 if (err) { 6555 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6556 mgmt_status(err)); 6557 } else { 6558 struct mgmt_mode *cp = cmd->param; 6559 6560 if (cp->val) 6561 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6562 else 6563 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6564 6565 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6566 new_settings(hdev, cmd->sk); 6567 } 6568 6569 mgmt_pending_free(cmd); 6570 } 6571 6572 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6573 { 6574 struct mgmt_pending_cmd *cmd = data; 6575 struct mgmt_mode *cp = cmd->param; 6576 6577 return hci_write_fast_connectable_sync(hdev, cp->val); 6578 } 6579 6580 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6581 void *data, u16 len) 6582 { 6583 struct mgmt_mode *cp = data; 6584 struct mgmt_pending_cmd *cmd; 6585 int err; 6586 6587 bt_dev_dbg(hdev, "sock %p", sk); 6588 6589 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6590 hdev->hci_ver < BLUETOOTH_VER_1_2) 6591 return mgmt_cmd_status(sk, hdev->id, 6592 MGMT_OP_SET_FAST_CONNECTABLE, 6593 MGMT_STATUS_NOT_SUPPORTED); 6594 6595 if (cp->val != 0x00 && cp->val != 0x01) 6596 return mgmt_cmd_status(sk, hdev->id, 6597 MGMT_OP_SET_FAST_CONNECTABLE, 6598 MGMT_STATUS_INVALID_PARAMS); 6599 6600 hci_dev_lock(hdev); 6601 6602 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6603 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6604 goto unlock; 6605 } 6606 6607 if (!hdev_is_powered(hdev)) { 6608 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6609 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6610 new_settings(hdev, sk); 6611 goto unlock; 6612 } 6613 6614 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6615 len); 6616 if (!cmd) 6617 err = -ENOMEM; 6618 else 6619 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6620 fast_connectable_complete); 6621 6622 if (err < 0) { 6623 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6624 MGMT_STATUS_FAILED); 6625 6626 if (cmd) 6627 mgmt_pending_free(cmd); 6628 } 6629 6630 unlock: 6631 hci_dev_unlock(hdev); 6632 6633 return err; 6634 } 6635 6636 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6637 { 6638 struct mgmt_pending_cmd *cmd = data; 6639 6640 bt_dev_dbg(hdev, "err %d", err); 6641 6642 if (err) { 6643 u8 mgmt_err = mgmt_status(err); 6644 6645 /* We need to restore the flag if related HCI commands 6646 * failed. 6647 */ 6648 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6649 6650 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6651 } else { 6652 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6653 new_settings(hdev, cmd->sk); 6654 } 6655 6656 mgmt_pending_free(cmd); 6657 } 6658 6659 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6660 { 6661 int status; 6662 6663 status = hci_write_fast_connectable_sync(hdev, false); 6664 6665 if (!status) 6666 status = hci_update_scan_sync(hdev); 6667 6668 /* Since only the advertising data flags will change, there 6669 * is no need to update the scan response data. 6670 */ 6671 if (!status) 6672 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6673 6674 return status; 6675 } 6676 6677 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6678 { 6679 struct mgmt_mode *cp = data; 6680 struct mgmt_pending_cmd *cmd; 6681 int err; 6682 6683 bt_dev_dbg(hdev, "sock %p", sk); 6684 6685 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6687 MGMT_STATUS_NOT_SUPPORTED); 6688 6689 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6690 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6691 MGMT_STATUS_REJECTED); 6692 6693 if (cp->val != 0x00 && cp->val != 0x01) 6694 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6695 MGMT_STATUS_INVALID_PARAMS); 6696 6697 hci_dev_lock(hdev); 6698 6699 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6700 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6701 goto unlock; 6702 } 6703 6704 if (!hdev_is_powered(hdev)) { 6705 if (!cp->val) { 6706 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6707 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6708 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6709 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6710 } 6711 6712 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6713 6714 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6715 if (err < 0) 6716 goto unlock; 6717 6718 err = new_settings(hdev, sk); 6719 goto unlock; 6720 } 6721 6722 /* Reject disabling when powered on */ 6723 if (!cp->val) { 6724 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6725 MGMT_STATUS_REJECTED); 6726 goto unlock; 6727 } else { 6728 /* When configuring a dual-mode controller to operate 6729 * with LE only and using a static address, then switching 6730 * BR/EDR back on is not allowed. 6731 * 6732 * Dual-mode controllers shall operate with the public 6733 * address as its identity address for BR/EDR and LE. So 6734 * reject the attempt to create an invalid configuration. 6735 * 6736 * The same restrictions applies when secure connections 6737 * has been enabled. For BR/EDR this is a controller feature 6738 * while for LE it is a host stack feature. This means that 6739 * switching BR/EDR back on when secure connections has been 6740 * enabled is not a supported transaction. 6741 */ 6742 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6743 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6744 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6745 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6746 MGMT_STATUS_REJECTED); 6747 goto unlock; 6748 } 6749 } 6750 6751 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6752 if (!cmd) 6753 err = -ENOMEM; 6754 else 6755 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6756 set_bredr_complete); 6757 6758 if (err < 0) { 6759 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6760 MGMT_STATUS_FAILED); 6761 if (cmd) 6762 mgmt_pending_free(cmd); 6763 6764 goto unlock; 6765 } 6766 6767 /* We need to flip the bit already here so that 6768 * hci_req_update_adv_data generates the correct flags. 6769 */ 6770 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6771 6772 unlock: 6773 hci_dev_unlock(hdev); 6774 return err; 6775 } 6776 6777 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6778 { 6779 struct mgmt_pending_cmd *cmd = data; 6780 struct mgmt_mode *cp; 6781 6782 bt_dev_dbg(hdev, "err %d", err); 6783 6784 if (err) { 6785 u8 mgmt_err = mgmt_status(err); 6786 6787 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6788 goto done; 6789 } 6790 6791 cp = cmd->param; 6792 6793 switch (cp->val) { 6794 case 0x00: 6795 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6796 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6797 break; 6798 case 0x01: 6799 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6800 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6801 break; 6802 case 0x02: 6803 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6804 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6805 break; 6806 } 6807 6808 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6809 new_settings(hdev, cmd->sk); 6810 6811 done: 6812 mgmt_pending_free(cmd); 6813 } 6814 6815 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6816 { 6817 struct mgmt_pending_cmd *cmd = data; 6818 struct mgmt_mode *cp = cmd->param; 6819 u8 val = !!cp->val; 6820 6821 /* Force write of val */ 6822 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6823 6824 return hci_write_sc_support_sync(hdev, val); 6825 } 6826 6827 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6828 void *data, u16 len) 6829 { 6830 struct mgmt_mode *cp = data; 6831 struct mgmt_pending_cmd *cmd; 6832 u8 val; 6833 int err; 6834 6835 bt_dev_dbg(hdev, "sock %p", sk); 6836 6837 if (!lmp_sc_capable(hdev) && 6838 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6839 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6840 MGMT_STATUS_NOT_SUPPORTED); 6841 6842 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6843 lmp_sc_capable(hdev) && 6844 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6846 MGMT_STATUS_REJECTED); 6847 6848 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6849 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6850 MGMT_STATUS_INVALID_PARAMS); 6851 6852 hci_dev_lock(hdev); 6853 6854 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6855 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6856 bool changed; 6857 6858 if (cp->val) { 6859 changed = !hci_dev_test_and_set_flag(hdev, 6860 HCI_SC_ENABLED); 6861 if (cp->val == 0x02) 6862 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6863 else 6864 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6865 } else { 6866 changed = hci_dev_test_and_clear_flag(hdev, 6867 HCI_SC_ENABLED); 6868 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6869 } 6870 6871 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6872 if (err < 0) 6873 goto failed; 6874 6875 if (changed) 6876 err = new_settings(hdev, sk); 6877 6878 goto failed; 6879 } 6880 6881 val = !!cp->val; 6882 6883 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6884 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6885 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6886 goto failed; 6887 } 6888 6889 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6890 if (!cmd) 6891 err = -ENOMEM; 6892 else 6893 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6894 set_secure_conn_complete); 6895 6896 if (err < 0) { 6897 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6898 MGMT_STATUS_FAILED); 6899 if (cmd) 6900 mgmt_pending_free(cmd); 6901 } 6902 6903 failed: 6904 hci_dev_unlock(hdev); 6905 return err; 6906 } 6907 6908 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6909 void *data, u16 len) 6910 { 6911 struct mgmt_mode *cp = data; 6912 bool changed, use_changed; 6913 int err; 6914 6915 bt_dev_dbg(hdev, "sock %p", sk); 6916 6917 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6918 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6919 MGMT_STATUS_INVALID_PARAMS); 6920 6921 hci_dev_lock(hdev); 6922 6923 if (cp->val) 6924 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6925 else 6926 changed = hci_dev_test_and_clear_flag(hdev, 6927 HCI_KEEP_DEBUG_KEYS); 6928 6929 if (cp->val == 0x02) 6930 use_changed = !hci_dev_test_and_set_flag(hdev, 6931 HCI_USE_DEBUG_KEYS); 6932 else 6933 use_changed = hci_dev_test_and_clear_flag(hdev, 6934 HCI_USE_DEBUG_KEYS); 6935 6936 if (hdev_is_powered(hdev) && use_changed && 6937 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6938 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6939 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6940 sizeof(mode), &mode); 6941 } 6942 6943 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6944 if (err < 0) 6945 goto unlock; 6946 6947 if (changed) 6948 err = new_settings(hdev, sk); 6949 6950 unlock: 6951 hci_dev_unlock(hdev); 6952 return err; 6953 } 6954 6955 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6956 u16 len) 6957 { 6958 struct mgmt_cp_set_privacy *cp = cp_data; 6959 bool changed; 6960 int err; 6961 6962 bt_dev_dbg(hdev, "sock %p", sk); 6963 6964 if (!lmp_le_capable(hdev)) 6965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6966 MGMT_STATUS_NOT_SUPPORTED); 6967 6968 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6970 MGMT_STATUS_INVALID_PARAMS); 6971 6972 if (hdev_is_powered(hdev)) 6973 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6974 MGMT_STATUS_REJECTED); 6975 6976 hci_dev_lock(hdev); 6977 6978 /* If user space supports this command it is also expected to 6979 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6980 */ 6981 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6982 6983 if (cp->privacy) { 6984 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6985 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6986 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6987 hci_adv_instances_set_rpa_expired(hdev, true); 6988 if (cp->privacy == 0x02) 6989 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6990 else 6991 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6992 } else { 6993 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6994 memset(hdev->irk, 0, sizeof(hdev->irk)); 6995 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6996 hci_adv_instances_set_rpa_expired(hdev, false); 6997 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6998 } 6999 7000 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7001 if (err < 0) 7002 goto unlock; 7003 7004 if (changed) 7005 err = new_settings(hdev, sk); 7006 7007 unlock: 7008 hci_dev_unlock(hdev); 7009 return err; 7010 } 7011 7012 static bool irk_is_valid(struct mgmt_irk_info *irk) 7013 { 7014 switch (irk->addr.type) { 7015 case BDADDR_LE_PUBLIC: 7016 return true; 7017 7018 case BDADDR_LE_RANDOM: 7019 /* Two most significant bits shall be set */ 7020 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7021 return false; 7022 return true; 7023 } 7024 7025 return false; 7026 } 7027 7028 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7029 u16 len) 7030 { 7031 struct mgmt_cp_load_irks *cp = cp_data; 7032 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7033 sizeof(struct mgmt_irk_info)); 7034 u16 irk_count, expected_len; 7035 int i, err; 7036 7037 bt_dev_dbg(hdev, "sock %p", sk); 7038 7039 if (!lmp_le_capable(hdev)) 7040 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7041 MGMT_STATUS_NOT_SUPPORTED); 7042 7043 irk_count = __le16_to_cpu(cp->irk_count); 7044 if (irk_count > max_irk_count) { 7045 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7046 irk_count); 7047 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7048 MGMT_STATUS_INVALID_PARAMS); 7049 } 7050 7051 expected_len = struct_size(cp, irks, irk_count); 7052 if (expected_len != len) { 7053 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7054 expected_len, len); 7055 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7056 MGMT_STATUS_INVALID_PARAMS); 7057 } 7058 7059 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7060 7061 for (i = 0; i < irk_count; i++) { 7062 struct mgmt_irk_info *key = &cp->irks[i]; 7063 7064 if (!irk_is_valid(key)) 7065 return mgmt_cmd_status(sk, hdev->id, 7066 MGMT_OP_LOAD_IRKS, 7067 MGMT_STATUS_INVALID_PARAMS); 7068 } 7069 7070 hci_dev_lock(hdev); 7071 7072 hci_smp_irks_clear(hdev); 7073 7074 for (i = 0; i < irk_count; i++) { 7075 struct mgmt_irk_info *irk = &cp->irks[i]; 7076 u8 addr_type = le_addr_type(irk->addr.type); 7077 7078 if (hci_is_blocked_key(hdev, 7079 HCI_BLOCKED_KEY_TYPE_IRK, 7080 irk->val)) { 7081 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7082 &irk->addr.bdaddr); 7083 continue; 7084 } 7085 7086 /* When using SMP over BR/EDR, the addr type should be set to BREDR */ 7087 if (irk->addr.type == BDADDR_BREDR) 7088 addr_type = BDADDR_BREDR; 7089 7090 hci_add_irk(hdev, &irk->addr.bdaddr, 7091 addr_type, irk->val, 7092 BDADDR_ANY); 7093 } 7094 7095 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7096 7097 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7098 7099 hci_dev_unlock(hdev); 7100 7101 return err; 7102 } 7103 7104 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7105 { 7106 if (key->initiator != 0x00 && key->initiator != 0x01) 7107 return false; 7108 7109 switch (key->addr.type) { 7110 case BDADDR_LE_PUBLIC: 7111 return true; 7112 7113 case BDADDR_LE_RANDOM: 7114 /* Two most significant bits shall be set */ 7115 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7116 return false; 7117 return true; 7118 } 7119 7120 return false; 7121 } 7122 7123 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7124 void *cp_data, u16 len) 7125 { 7126 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7127 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7128 sizeof(struct mgmt_ltk_info)); 7129 u16 key_count, expected_len; 7130 int i, err; 7131 7132 bt_dev_dbg(hdev, "sock %p", sk); 7133 7134 if (!lmp_le_capable(hdev)) 7135 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7136 MGMT_STATUS_NOT_SUPPORTED); 7137 7138 key_count = __le16_to_cpu(cp->key_count); 7139 if (key_count > max_key_count) { 7140 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7141 key_count); 7142 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7143 MGMT_STATUS_INVALID_PARAMS); 7144 } 7145 7146 expected_len = struct_size(cp, keys, key_count); 7147 if (expected_len != len) { 7148 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7149 expected_len, len); 7150 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7151 MGMT_STATUS_INVALID_PARAMS); 7152 } 7153 7154 bt_dev_dbg(hdev, "key_count %u", key_count); 7155 7156 for (i = 0; i < key_count; i++) { 7157 struct mgmt_ltk_info *key = &cp->keys[i]; 7158 7159 if (!ltk_is_valid(key)) 7160 return mgmt_cmd_status(sk, hdev->id, 7161 MGMT_OP_LOAD_LONG_TERM_KEYS, 7162 MGMT_STATUS_INVALID_PARAMS); 7163 } 7164 7165 hci_dev_lock(hdev); 7166 7167 hci_smp_ltks_clear(hdev); 7168 7169 for (i = 0; i < key_count; i++) { 7170 struct mgmt_ltk_info *key = &cp->keys[i]; 7171 u8 type, authenticated; 7172 u8 addr_type = le_addr_type(key->addr.type); 7173 7174 if (hci_is_blocked_key(hdev, 7175 HCI_BLOCKED_KEY_TYPE_LTK, 7176 key->val)) { 7177 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7178 &key->addr.bdaddr); 7179 continue; 7180 } 7181 7182 switch (key->type) { 7183 case MGMT_LTK_UNAUTHENTICATED: 7184 authenticated = 0x00; 7185 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7186 break; 7187 case MGMT_LTK_AUTHENTICATED: 7188 authenticated = 0x01; 7189 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7190 break; 7191 case MGMT_LTK_P256_UNAUTH: 7192 authenticated = 0x00; 7193 type = SMP_LTK_P256; 7194 break; 7195 case MGMT_LTK_P256_AUTH: 7196 authenticated = 0x01; 7197 type = SMP_LTK_P256; 7198 break; 7199 case MGMT_LTK_P256_DEBUG: 7200 authenticated = 0x00; 7201 type = SMP_LTK_P256_DEBUG; 7202 fallthrough; 7203 default: 7204 continue; 7205 } 7206 7207 /* When using SMP over BR/EDR, the addr type should be set to BREDR */ 7208 if (key->addr.type == BDADDR_BREDR) 7209 addr_type = BDADDR_BREDR; 7210 7211 hci_add_ltk(hdev, &key->addr.bdaddr, 7212 addr_type, type, authenticated, 7213 key->val, key->enc_size, key->ediv, key->rand); 7214 } 7215 7216 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7217 NULL, 0); 7218 7219 hci_dev_unlock(hdev); 7220 7221 return err; 7222 } 7223 7224 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7225 { 7226 struct mgmt_pending_cmd *cmd = data; 7227 struct hci_conn *conn = cmd->user_data; 7228 struct mgmt_cp_get_conn_info *cp = cmd->param; 7229 struct mgmt_rp_get_conn_info rp; 7230 u8 status; 7231 7232 bt_dev_dbg(hdev, "err %d", err); 7233 7234 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7235 7236 status = mgmt_status(err); 7237 if (status == MGMT_STATUS_SUCCESS) { 7238 rp.rssi = conn->rssi; 7239 rp.tx_power = conn->tx_power; 7240 rp.max_tx_power = conn->max_tx_power; 7241 } else { 7242 rp.rssi = HCI_RSSI_INVALID; 7243 rp.tx_power = HCI_TX_POWER_INVALID; 7244 rp.max_tx_power = HCI_TX_POWER_INVALID; 7245 } 7246 7247 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 7248 &rp, sizeof(rp)); 7249 7250 mgmt_pending_free(cmd); 7251 } 7252 7253 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7254 { 7255 struct mgmt_pending_cmd *cmd = data; 7256 struct mgmt_cp_get_conn_info *cp = cmd->param; 7257 struct hci_conn *conn; 7258 int err; 7259 __le16 handle; 7260 7261 /* Make sure we are still connected */ 7262 if (cp->addr.type == BDADDR_BREDR) 7263 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7264 &cp->addr.bdaddr); 7265 else 7266 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7267 7268 if (!conn || conn->state != BT_CONNECTED) 7269 return MGMT_STATUS_NOT_CONNECTED; 7270 7271 cmd->user_data = conn; 7272 handle = cpu_to_le16(conn->handle); 7273 7274 /* Refresh RSSI each time */ 7275 err = hci_read_rssi_sync(hdev, handle); 7276 7277 /* For LE links TX power does not change thus we don't need to 7278 * query for it once value is known. 7279 */ 7280 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7281 conn->tx_power == HCI_TX_POWER_INVALID)) 7282 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7283 7284 /* Max TX power needs to be read only once per connection */ 7285 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7286 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7287 7288 return err; 7289 } 7290 7291 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7292 u16 len) 7293 { 7294 struct mgmt_cp_get_conn_info *cp = data; 7295 struct mgmt_rp_get_conn_info rp; 7296 struct hci_conn *conn; 7297 unsigned long conn_info_age; 7298 int err = 0; 7299 7300 bt_dev_dbg(hdev, "sock %p", sk); 7301 7302 memset(&rp, 0, sizeof(rp)); 7303 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7304 rp.addr.type = cp->addr.type; 7305 7306 if (!bdaddr_type_is_valid(cp->addr.type)) 7307 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7308 MGMT_STATUS_INVALID_PARAMS, 7309 &rp, sizeof(rp)); 7310 7311 hci_dev_lock(hdev); 7312 7313 if (!hdev_is_powered(hdev)) { 7314 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7315 MGMT_STATUS_NOT_POWERED, &rp, 7316 sizeof(rp)); 7317 goto unlock; 7318 } 7319 7320 if (cp->addr.type == BDADDR_BREDR) 7321 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7322 &cp->addr.bdaddr); 7323 else 7324 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7325 7326 if (!conn || conn->state != BT_CONNECTED) { 7327 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7328 MGMT_STATUS_NOT_CONNECTED, &rp, 7329 sizeof(rp)); 7330 goto unlock; 7331 } 7332 7333 /* To avoid client trying to guess when to poll again for information we 7334 * calculate conn info age as random value between min/max set in hdev. 7335 */ 7336 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7337 hdev->conn_info_max_age - 1); 7338 7339 /* Query controller to refresh cached values if they are too old or were 7340 * never read. 7341 */ 7342 if (time_after(jiffies, conn->conn_info_timestamp + 7343 msecs_to_jiffies(conn_info_age)) || 7344 !conn->conn_info_timestamp) { 7345 struct mgmt_pending_cmd *cmd; 7346 7347 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7348 len); 7349 if (!cmd) { 7350 err = -ENOMEM; 7351 } else { 7352 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7353 cmd, get_conn_info_complete); 7354 } 7355 7356 if (err < 0) { 7357 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7358 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7359 7360 if (cmd) 7361 mgmt_pending_free(cmd); 7362 7363 goto unlock; 7364 } 7365 7366 conn->conn_info_timestamp = jiffies; 7367 } else { 7368 /* Cache is valid, just reply with values cached in hci_conn */ 7369 rp.rssi = conn->rssi; 7370 rp.tx_power = conn->tx_power; 7371 rp.max_tx_power = conn->max_tx_power; 7372 7373 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7374 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7375 } 7376 7377 unlock: 7378 hci_dev_unlock(hdev); 7379 return err; 7380 } 7381 7382 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7383 { 7384 struct mgmt_pending_cmd *cmd = data; 7385 struct mgmt_cp_get_clock_info *cp = cmd->param; 7386 struct mgmt_rp_get_clock_info rp; 7387 struct hci_conn *conn = cmd->user_data; 7388 u8 status = mgmt_status(err); 7389 7390 bt_dev_dbg(hdev, "err %d", err); 7391 7392 memset(&rp, 0, sizeof(rp)); 7393 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7394 rp.addr.type = cp->addr.type; 7395 7396 if (err) 7397 goto complete; 7398 7399 rp.local_clock = cpu_to_le32(hdev->clock); 7400 7401 if (conn) { 7402 rp.piconet_clock = cpu_to_le32(conn->clock); 7403 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7404 } 7405 7406 complete: 7407 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 7408 sizeof(rp)); 7409 7410 mgmt_pending_free(cmd); 7411 } 7412 7413 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7414 { 7415 struct mgmt_pending_cmd *cmd = data; 7416 struct mgmt_cp_get_clock_info *cp = cmd->param; 7417 struct hci_cp_read_clock hci_cp; 7418 struct hci_conn *conn; 7419 7420 memset(&hci_cp, 0, sizeof(hci_cp)); 7421 hci_read_clock_sync(hdev, &hci_cp); 7422 7423 /* Make sure connection still exists */ 7424 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7425 if (!conn || conn->state != BT_CONNECTED) 7426 return MGMT_STATUS_NOT_CONNECTED; 7427 7428 cmd->user_data = conn; 7429 hci_cp.handle = cpu_to_le16(conn->handle); 7430 hci_cp.which = 0x01; /* Piconet clock */ 7431 7432 return hci_read_clock_sync(hdev, &hci_cp); 7433 } 7434 7435 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7436 u16 len) 7437 { 7438 struct mgmt_cp_get_clock_info *cp = data; 7439 struct mgmt_rp_get_clock_info rp; 7440 struct mgmt_pending_cmd *cmd; 7441 struct hci_conn *conn; 7442 int err; 7443 7444 bt_dev_dbg(hdev, "sock %p", sk); 7445 7446 memset(&rp, 0, sizeof(rp)); 7447 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7448 rp.addr.type = cp->addr.type; 7449 7450 if (cp->addr.type != BDADDR_BREDR) 7451 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7452 MGMT_STATUS_INVALID_PARAMS, 7453 &rp, sizeof(rp)); 7454 7455 hci_dev_lock(hdev); 7456 7457 if (!hdev_is_powered(hdev)) { 7458 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7459 MGMT_STATUS_NOT_POWERED, &rp, 7460 sizeof(rp)); 7461 goto unlock; 7462 } 7463 7464 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7465 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7466 &cp->addr.bdaddr); 7467 if (!conn || conn->state != BT_CONNECTED) { 7468 err = mgmt_cmd_complete(sk, hdev->id, 7469 MGMT_OP_GET_CLOCK_INFO, 7470 MGMT_STATUS_NOT_CONNECTED, 7471 &rp, sizeof(rp)); 7472 goto unlock; 7473 } 7474 } else { 7475 conn = NULL; 7476 } 7477 7478 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7479 if (!cmd) 7480 err = -ENOMEM; 7481 else 7482 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7483 get_clock_info_complete); 7484 7485 if (err < 0) { 7486 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7487 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7488 7489 if (cmd) 7490 mgmt_pending_free(cmd); 7491 } 7492 7493 7494 unlock: 7495 hci_dev_unlock(hdev); 7496 return err; 7497 } 7498 7499 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 7500 { 7501 struct hci_conn *conn; 7502 7503 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7504 if (!conn) 7505 return false; 7506 7507 if (conn->dst_type != type) 7508 return false; 7509 7510 if (conn->state != BT_CONNECTED) 7511 return false; 7512 7513 return true; 7514 } 7515 7516 /* This function requires the caller holds hdev->lock */ 7517 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7518 u8 addr_type, u8 auto_connect) 7519 { 7520 struct hci_conn_params *params; 7521 7522 params = hci_conn_params_add(hdev, addr, addr_type); 7523 if (!params) 7524 return -EIO; 7525 7526 if (params->auto_connect == auto_connect) 7527 return 0; 7528 7529 hci_pend_le_list_del_init(params); 7530 7531 switch (auto_connect) { 7532 case HCI_AUTO_CONN_DISABLED: 7533 case HCI_AUTO_CONN_LINK_LOSS: 7534 /* If auto connect is being disabled when we're trying to 7535 * connect to device, keep connecting. 7536 */ 7537 if (params->explicit_connect) 7538 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7539 break; 7540 case HCI_AUTO_CONN_REPORT: 7541 if (params->explicit_connect) 7542 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7543 else 7544 hci_pend_le_list_add(params, &hdev->pend_le_reports); 7545 break; 7546 case HCI_AUTO_CONN_DIRECT: 7547 case HCI_AUTO_CONN_ALWAYS: 7548 if (!is_connected(hdev, addr, addr_type)) 7549 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7550 break; 7551 } 7552 7553 params->auto_connect = auto_connect; 7554 7555 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7556 addr, addr_type, auto_connect); 7557 7558 return 0; 7559 } 7560 7561 static void device_added(struct sock *sk, struct hci_dev *hdev, 7562 bdaddr_t *bdaddr, u8 type, u8 action) 7563 { 7564 struct mgmt_ev_device_added ev; 7565 7566 bacpy(&ev.addr.bdaddr, bdaddr); 7567 ev.addr.type = type; 7568 ev.action = action; 7569 7570 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7571 } 7572 7573 static int add_device_sync(struct hci_dev *hdev, void *data) 7574 { 7575 return hci_update_passive_scan_sync(hdev); 7576 } 7577 7578 static int add_device(struct sock *sk, struct hci_dev *hdev, 7579 void *data, u16 len) 7580 { 7581 struct mgmt_cp_add_device *cp = data; 7582 u8 auto_conn, addr_type; 7583 struct hci_conn_params *params; 7584 int err; 7585 u32 current_flags = 0; 7586 u32 supported_flags; 7587 7588 bt_dev_dbg(hdev, "sock %p", sk); 7589 7590 if (!bdaddr_type_is_valid(cp->addr.type) || 7591 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7592 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7593 MGMT_STATUS_INVALID_PARAMS, 7594 &cp->addr, sizeof(cp->addr)); 7595 7596 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7597 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7598 MGMT_STATUS_INVALID_PARAMS, 7599 &cp->addr, sizeof(cp->addr)); 7600 7601 hci_dev_lock(hdev); 7602 7603 if (cp->addr.type == BDADDR_BREDR) { 7604 /* Only incoming connections action is supported for now */ 7605 if (cp->action != 0x01) { 7606 err = mgmt_cmd_complete(sk, hdev->id, 7607 MGMT_OP_ADD_DEVICE, 7608 MGMT_STATUS_INVALID_PARAMS, 7609 &cp->addr, sizeof(cp->addr)); 7610 goto unlock; 7611 } 7612 7613 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7614 &cp->addr.bdaddr, 7615 cp->addr.type, 0); 7616 if (err) 7617 goto unlock; 7618 7619 hci_update_scan(hdev); 7620 7621 goto added; 7622 } 7623 7624 addr_type = le_addr_type(cp->addr.type); 7625 7626 if (cp->action == 0x02) 7627 auto_conn = HCI_AUTO_CONN_ALWAYS; 7628 else if (cp->action == 0x01) 7629 auto_conn = HCI_AUTO_CONN_DIRECT; 7630 else 7631 auto_conn = HCI_AUTO_CONN_REPORT; 7632 7633 /* Kernel internally uses conn_params with resolvable private 7634 * address, but Add Device allows only identity addresses. 7635 * Make sure it is enforced before calling 7636 * hci_conn_params_lookup. 7637 */ 7638 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7639 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7640 MGMT_STATUS_INVALID_PARAMS, 7641 &cp->addr, sizeof(cp->addr)); 7642 goto unlock; 7643 } 7644 7645 /* If the connection parameters don't exist for this device, 7646 * they will be created and configured with defaults. 7647 */ 7648 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7649 auto_conn) < 0) { 7650 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7651 MGMT_STATUS_FAILED, &cp->addr, 7652 sizeof(cp->addr)); 7653 goto unlock; 7654 } else { 7655 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7656 addr_type); 7657 if (params) 7658 current_flags = params->flags; 7659 } 7660 7661 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7662 if (err < 0) 7663 goto unlock; 7664 7665 added: 7666 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7667 supported_flags = hdev->conn_flags; 7668 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7669 supported_flags, current_flags); 7670 7671 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7672 MGMT_STATUS_SUCCESS, &cp->addr, 7673 sizeof(cp->addr)); 7674 7675 unlock: 7676 hci_dev_unlock(hdev); 7677 return err; 7678 } 7679 7680 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7681 bdaddr_t *bdaddr, u8 type) 7682 { 7683 struct mgmt_ev_device_removed ev; 7684 7685 bacpy(&ev.addr.bdaddr, bdaddr); 7686 ev.addr.type = type; 7687 7688 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7689 } 7690 7691 static int remove_device_sync(struct hci_dev *hdev, void *data) 7692 { 7693 return hci_update_passive_scan_sync(hdev); 7694 } 7695 7696 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7697 void *data, u16 len) 7698 { 7699 struct mgmt_cp_remove_device *cp = data; 7700 int err; 7701 7702 bt_dev_dbg(hdev, "sock %p", sk); 7703 7704 hci_dev_lock(hdev); 7705 7706 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7707 struct hci_conn_params *params; 7708 u8 addr_type; 7709 7710 if (!bdaddr_type_is_valid(cp->addr.type)) { 7711 err = mgmt_cmd_complete(sk, hdev->id, 7712 MGMT_OP_REMOVE_DEVICE, 7713 MGMT_STATUS_INVALID_PARAMS, 7714 &cp->addr, sizeof(cp->addr)); 7715 goto unlock; 7716 } 7717 7718 if (cp->addr.type == BDADDR_BREDR) { 7719 err = hci_bdaddr_list_del(&hdev->accept_list, 7720 &cp->addr.bdaddr, 7721 cp->addr.type); 7722 if (err) { 7723 err = mgmt_cmd_complete(sk, hdev->id, 7724 MGMT_OP_REMOVE_DEVICE, 7725 MGMT_STATUS_INVALID_PARAMS, 7726 &cp->addr, 7727 sizeof(cp->addr)); 7728 goto unlock; 7729 } 7730 7731 hci_update_scan(hdev); 7732 7733 device_removed(sk, hdev, &cp->addr.bdaddr, 7734 cp->addr.type); 7735 goto complete; 7736 } 7737 7738 addr_type = le_addr_type(cp->addr.type); 7739 7740 /* Kernel internally uses conn_params with resolvable private 7741 * address, but Remove Device allows only identity addresses. 7742 * Make sure it is enforced before calling 7743 * hci_conn_params_lookup. 7744 */ 7745 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7746 err = mgmt_cmd_complete(sk, hdev->id, 7747 MGMT_OP_REMOVE_DEVICE, 7748 MGMT_STATUS_INVALID_PARAMS, 7749 &cp->addr, sizeof(cp->addr)); 7750 goto unlock; 7751 } 7752 7753 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7754 addr_type); 7755 if (!params) { 7756 err = mgmt_cmd_complete(sk, hdev->id, 7757 MGMT_OP_REMOVE_DEVICE, 7758 MGMT_STATUS_INVALID_PARAMS, 7759 &cp->addr, sizeof(cp->addr)); 7760 goto unlock; 7761 } 7762 7763 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7764 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7765 err = mgmt_cmd_complete(sk, hdev->id, 7766 MGMT_OP_REMOVE_DEVICE, 7767 MGMT_STATUS_INVALID_PARAMS, 7768 &cp->addr, sizeof(cp->addr)); 7769 goto unlock; 7770 } 7771 7772 hci_conn_params_free(params); 7773 7774 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7775 } else { 7776 struct hci_conn_params *p, *tmp; 7777 struct bdaddr_list *b, *btmp; 7778 7779 if (cp->addr.type) { 7780 err = mgmt_cmd_complete(sk, hdev->id, 7781 MGMT_OP_REMOVE_DEVICE, 7782 MGMT_STATUS_INVALID_PARAMS, 7783 &cp->addr, sizeof(cp->addr)); 7784 goto unlock; 7785 } 7786 7787 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7788 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7789 list_del(&b->list); 7790 kfree(b); 7791 } 7792 7793 hci_update_scan(hdev); 7794 7795 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7796 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7797 continue; 7798 device_removed(sk, hdev, &p->addr, p->addr_type); 7799 if (p->explicit_connect) { 7800 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7801 continue; 7802 } 7803 hci_conn_params_free(p); 7804 } 7805 7806 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7807 } 7808 7809 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7810 7811 complete: 7812 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7813 MGMT_STATUS_SUCCESS, &cp->addr, 7814 sizeof(cp->addr)); 7815 unlock: 7816 hci_dev_unlock(hdev); 7817 return err; 7818 } 7819 7820 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7821 u16 len) 7822 { 7823 struct mgmt_cp_load_conn_param *cp = data; 7824 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7825 sizeof(struct mgmt_conn_param)); 7826 u16 param_count, expected_len; 7827 int i; 7828 7829 if (!lmp_le_capable(hdev)) 7830 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7831 MGMT_STATUS_NOT_SUPPORTED); 7832 7833 param_count = __le16_to_cpu(cp->param_count); 7834 if (param_count > max_param_count) { 7835 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7836 param_count); 7837 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7838 MGMT_STATUS_INVALID_PARAMS); 7839 } 7840 7841 expected_len = struct_size(cp, params, param_count); 7842 if (expected_len != len) { 7843 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7844 expected_len, len); 7845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7846 MGMT_STATUS_INVALID_PARAMS); 7847 } 7848 7849 bt_dev_dbg(hdev, "param_count %u", param_count); 7850 7851 hci_dev_lock(hdev); 7852 7853 hci_conn_params_clear_disabled(hdev); 7854 7855 for (i = 0; i < param_count; i++) { 7856 struct mgmt_conn_param *param = &cp->params[i]; 7857 struct hci_conn_params *hci_param; 7858 u16 min, max, latency, timeout; 7859 u8 addr_type; 7860 7861 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7862 param->addr.type); 7863 7864 if (param->addr.type == BDADDR_LE_PUBLIC) { 7865 addr_type = ADDR_LE_DEV_PUBLIC; 7866 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7867 addr_type = ADDR_LE_DEV_RANDOM; 7868 } else { 7869 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7870 continue; 7871 } 7872 7873 min = le16_to_cpu(param->min_interval); 7874 max = le16_to_cpu(param->max_interval); 7875 latency = le16_to_cpu(param->latency); 7876 timeout = le16_to_cpu(param->timeout); 7877 7878 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7879 min, max, latency, timeout); 7880 7881 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7882 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7883 continue; 7884 } 7885 7886 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7887 addr_type); 7888 if (!hci_param) { 7889 bt_dev_err(hdev, "failed to add connection parameters"); 7890 continue; 7891 } 7892 7893 hci_param->conn_min_interval = min; 7894 hci_param->conn_max_interval = max; 7895 hci_param->conn_latency = latency; 7896 hci_param->supervision_timeout = timeout; 7897 } 7898 7899 hci_dev_unlock(hdev); 7900 7901 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7902 NULL, 0); 7903 } 7904 7905 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7906 void *data, u16 len) 7907 { 7908 struct mgmt_cp_set_external_config *cp = data; 7909 bool changed; 7910 int err; 7911 7912 bt_dev_dbg(hdev, "sock %p", sk); 7913 7914 if (hdev_is_powered(hdev)) 7915 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7916 MGMT_STATUS_REJECTED); 7917 7918 if (cp->config != 0x00 && cp->config != 0x01) 7919 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7920 MGMT_STATUS_INVALID_PARAMS); 7921 7922 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7923 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7924 MGMT_STATUS_NOT_SUPPORTED); 7925 7926 hci_dev_lock(hdev); 7927 7928 if (cp->config) 7929 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7930 else 7931 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7932 7933 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7934 if (err < 0) 7935 goto unlock; 7936 7937 if (!changed) 7938 goto unlock; 7939 7940 err = new_options(hdev, sk); 7941 7942 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7943 mgmt_index_removed(hdev); 7944 7945 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7946 hci_dev_set_flag(hdev, HCI_CONFIG); 7947 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7948 7949 queue_work(hdev->req_workqueue, &hdev->power_on); 7950 } else { 7951 set_bit(HCI_RAW, &hdev->flags); 7952 mgmt_index_added(hdev); 7953 } 7954 } 7955 7956 unlock: 7957 hci_dev_unlock(hdev); 7958 return err; 7959 } 7960 7961 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7962 void *data, u16 len) 7963 { 7964 struct mgmt_cp_set_public_address *cp = data; 7965 bool changed; 7966 int err; 7967 7968 bt_dev_dbg(hdev, "sock %p", sk); 7969 7970 if (hdev_is_powered(hdev)) 7971 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7972 MGMT_STATUS_REJECTED); 7973 7974 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7976 MGMT_STATUS_INVALID_PARAMS); 7977 7978 if (!hdev->set_bdaddr) 7979 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7980 MGMT_STATUS_NOT_SUPPORTED); 7981 7982 hci_dev_lock(hdev); 7983 7984 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7985 bacpy(&hdev->public_addr, &cp->bdaddr); 7986 7987 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7988 if (err < 0) 7989 goto unlock; 7990 7991 if (!changed) 7992 goto unlock; 7993 7994 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7995 err = new_options(hdev, sk); 7996 7997 if (is_configured(hdev)) { 7998 mgmt_index_removed(hdev); 7999 8000 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8001 8002 hci_dev_set_flag(hdev, HCI_CONFIG); 8003 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8004 8005 queue_work(hdev->req_workqueue, &hdev->power_on); 8006 } 8007 8008 unlock: 8009 hci_dev_unlock(hdev); 8010 return err; 8011 } 8012 8013 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8014 int err) 8015 { 8016 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8017 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8018 u8 *h192, *r192, *h256, *r256; 8019 struct mgmt_pending_cmd *cmd = data; 8020 struct sk_buff *skb = cmd->skb; 8021 u8 status = mgmt_status(err); 8022 u16 eir_len; 8023 8024 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 8025 return; 8026 8027 if (!status) { 8028 if (!skb) 8029 status = MGMT_STATUS_FAILED; 8030 else if (IS_ERR(skb)) 8031 status = mgmt_status(PTR_ERR(skb)); 8032 else 8033 status = mgmt_status(skb->data[0]); 8034 } 8035 8036 bt_dev_dbg(hdev, "status %u", status); 8037 8038 mgmt_cp = cmd->param; 8039 8040 if (status) { 8041 status = mgmt_status(status); 8042 eir_len = 0; 8043 8044 h192 = NULL; 8045 r192 = NULL; 8046 h256 = NULL; 8047 r256 = NULL; 8048 } else if (!bredr_sc_enabled(hdev)) { 8049 struct hci_rp_read_local_oob_data *rp; 8050 8051 if (skb->len != sizeof(*rp)) { 8052 status = MGMT_STATUS_FAILED; 8053 eir_len = 0; 8054 } else { 8055 status = MGMT_STATUS_SUCCESS; 8056 rp = (void *)skb->data; 8057 8058 eir_len = 5 + 18 + 18; 8059 h192 = rp->hash; 8060 r192 = rp->rand; 8061 h256 = NULL; 8062 r256 = NULL; 8063 } 8064 } else { 8065 struct hci_rp_read_local_oob_ext_data *rp; 8066 8067 if (skb->len != sizeof(*rp)) { 8068 status = MGMT_STATUS_FAILED; 8069 eir_len = 0; 8070 } else { 8071 status = MGMT_STATUS_SUCCESS; 8072 rp = (void *)skb->data; 8073 8074 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8075 eir_len = 5 + 18 + 18; 8076 h192 = NULL; 8077 r192 = NULL; 8078 } else { 8079 eir_len = 5 + 18 + 18 + 18 + 18; 8080 h192 = rp->hash192; 8081 r192 = rp->rand192; 8082 } 8083 8084 h256 = rp->hash256; 8085 r256 = rp->rand256; 8086 } 8087 } 8088 8089 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8090 if (!mgmt_rp) 8091 goto done; 8092 8093 if (eir_len == 0) 8094 goto send_rsp; 8095 8096 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8097 hdev->dev_class, 3); 8098 8099 if (h192 && r192) { 8100 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8101 EIR_SSP_HASH_C192, h192, 16); 8102 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8103 EIR_SSP_RAND_R192, r192, 16); 8104 } 8105 8106 if (h256 && r256) { 8107 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8108 EIR_SSP_HASH_C256, h256, 16); 8109 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8110 EIR_SSP_RAND_R256, r256, 16); 8111 } 8112 8113 send_rsp: 8114 mgmt_rp->type = mgmt_cp->type; 8115 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8116 8117 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8118 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8119 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8120 if (err < 0 || status) 8121 goto done; 8122 8123 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8124 8125 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8126 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8127 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8128 done: 8129 if (skb && !IS_ERR(skb)) 8130 kfree_skb(skb); 8131 8132 kfree(mgmt_rp); 8133 mgmt_pending_remove(cmd); 8134 } 8135 8136 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8137 struct mgmt_cp_read_local_oob_ext_data *cp) 8138 { 8139 struct mgmt_pending_cmd *cmd; 8140 int err; 8141 8142 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8143 cp, sizeof(*cp)); 8144 if (!cmd) 8145 return -ENOMEM; 8146 8147 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8148 read_local_oob_ext_data_complete); 8149 8150 if (err < 0) { 8151 mgmt_pending_remove(cmd); 8152 return err; 8153 } 8154 8155 return 0; 8156 } 8157 8158 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8159 void *data, u16 data_len) 8160 { 8161 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8162 struct mgmt_rp_read_local_oob_ext_data *rp; 8163 size_t rp_len; 8164 u16 eir_len; 8165 u8 status, flags, role, addr[7], hash[16], rand[16]; 8166 int err; 8167 8168 bt_dev_dbg(hdev, "sock %p", sk); 8169 8170 if (hdev_is_powered(hdev)) { 8171 switch (cp->type) { 8172 case BIT(BDADDR_BREDR): 8173 status = mgmt_bredr_support(hdev); 8174 if (status) 8175 eir_len = 0; 8176 else 8177 eir_len = 5; 8178 break; 8179 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8180 status = mgmt_le_support(hdev); 8181 if (status) 8182 eir_len = 0; 8183 else 8184 eir_len = 9 + 3 + 18 + 18 + 3; 8185 break; 8186 default: 8187 status = MGMT_STATUS_INVALID_PARAMS; 8188 eir_len = 0; 8189 break; 8190 } 8191 } else { 8192 status = MGMT_STATUS_NOT_POWERED; 8193 eir_len = 0; 8194 } 8195 8196 rp_len = sizeof(*rp) + eir_len; 8197 rp = kmalloc(rp_len, GFP_ATOMIC); 8198 if (!rp) 8199 return -ENOMEM; 8200 8201 if (!status && !lmp_ssp_capable(hdev)) { 8202 status = MGMT_STATUS_NOT_SUPPORTED; 8203 eir_len = 0; 8204 } 8205 8206 if (status) 8207 goto complete; 8208 8209 hci_dev_lock(hdev); 8210 8211 eir_len = 0; 8212 switch (cp->type) { 8213 case BIT(BDADDR_BREDR): 8214 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8215 err = read_local_ssp_oob_req(hdev, sk, cp); 8216 hci_dev_unlock(hdev); 8217 if (!err) 8218 goto done; 8219 8220 status = MGMT_STATUS_FAILED; 8221 goto complete; 8222 } else { 8223 eir_len = eir_append_data(rp->eir, eir_len, 8224 EIR_CLASS_OF_DEV, 8225 hdev->dev_class, 3); 8226 } 8227 break; 8228 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8229 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8230 smp_generate_oob(hdev, hash, rand) < 0) { 8231 hci_dev_unlock(hdev); 8232 status = MGMT_STATUS_FAILED; 8233 goto complete; 8234 } 8235 8236 /* This should return the active RPA, but since the RPA 8237 * is only programmed on demand, it is really hard to fill 8238 * this in at the moment. For now disallow retrieving 8239 * local out-of-band data when privacy is in use. 8240 * 8241 * Returning the identity address will not help here since 8242 * pairing happens before the identity resolving key is 8243 * known and thus the connection establishment happens 8244 * based on the RPA and not the identity address. 8245 */ 8246 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8247 hci_dev_unlock(hdev); 8248 status = MGMT_STATUS_REJECTED; 8249 goto complete; 8250 } 8251 8252 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8253 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8254 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8255 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8256 memcpy(addr, &hdev->static_addr, 6); 8257 addr[6] = 0x01; 8258 } else { 8259 memcpy(addr, &hdev->bdaddr, 6); 8260 addr[6] = 0x00; 8261 } 8262 8263 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8264 addr, sizeof(addr)); 8265 8266 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8267 role = 0x02; 8268 else 8269 role = 0x01; 8270 8271 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8272 &role, sizeof(role)); 8273 8274 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8275 eir_len = eir_append_data(rp->eir, eir_len, 8276 EIR_LE_SC_CONFIRM, 8277 hash, sizeof(hash)); 8278 8279 eir_len = eir_append_data(rp->eir, eir_len, 8280 EIR_LE_SC_RANDOM, 8281 rand, sizeof(rand)); 8282 } 8283 8284 flags = mgmt_get_adv_discov_flags(hdev); 8285 8286 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8287 flags |= LE_AD_NO_BREDR; 8288 8289 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8290 &flags, sizeof(flags)); 8291 break; 8292 } 8293 8294 hci_dev_unlock(hdev); 8295 8296 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8297 8298 status = MGMT_STATUS_SUCCESS; 8299 8300 complete: 8301 rp->type = cp->type; 8302 rp->eir_len = cpu_to_le16(eir_len); 8303 8304 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8305 status, rp, sizeof(*rp) + eir_len); 8306 if (err < 0 || status) 8307 goto done; 8308 8309 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8310 rp, sizeof(*rp) + eir_len, 8311 HCI_MGMT_OOB_DATA_EVENTS, sk); 8312 8313 done: 8314 kfree(rp); 8315 8316 return err; 8317 } 8318 8319 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8320 { 8321 u32 flags = 0; 8322 8323 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8324 flags |= MGMT_ADV_FLAG_DISCOV; 8325 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8326 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8327 flags |= MGMT_ADV_FLAG_APPEARANCE; 8328 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8329 flags |= MGMT_ADV_PARAM_DURATION; 8330 flags |= MGMT_ADV_PARAM_TIMEOUT; 8331 flags |= MGMT_ADV_PARAM_INTERVALS; 8332 flags |= MGMT_ADV_PARAM_TX_POWER; 8333 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8334 8335 /* In extended adv TX_POWER returned from Set Adv Param 8336 * will be always valid. 8337 */ 8338 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8339 flags |= MGMT_ADV_FLAG_TX_POWER; 8340 8341 if (ext_adv_capable(hdev)) { 8342 flags |= MGMT_ADV_FLAG_SEC_1M; 8343 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8344 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8345 8346 if (le_2m_capable(hdev)) 8347 flags |= MGMT_ADV_FLAG_SEC_2M; 8348 8349 if (le_coded_capable(hdev)) 8350 flags |= MGMT_ADV_FLAG_SEC_CODED; 8351 } 8352 8353 return flags; 8354 } 8355 8356 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8357 void *data, u16 data_len) 8358 { 8359 struct mgmt_rp_read_adv_features *rp; 8360 size_t rp_len; 8361 int err; 8362 struct adv_info *adv_instance; 8363 u32 supported_flags; 8364 u8 *instance; 8365 8366 bt_dev_dbg(hdev, "sock %p", sk); 8367 8368 if (!lmp_le_capable(hdev)) 8369 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8370 MGMT_STATUS_REJECTED); 8371 8372 hci_dev_lock(hdev); 8373 8374 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8375 rp = kmalloc(rp_len, GFP_ATOMIC); 8376 if (!rp) { 8377 hci_dev_unlock(hdev); 8378 return -ENOMEM; 8379 } 8380 8381 supported_flags = get_supported_adv_flags(hdev); 8382 8383 rp->supported_flags = cpu_to_le32(supported_flags); 8384 rp->max_adv_data_len = max_adv_len(hdev); 8385 rp->max_scan_rsp_len = max_adv_len(hdev); 8386 rp->max_instances = hdev->le_num_of_adv_sets; 8387 rp->num_instances = hdev->adv_instance_cnt; 8388 8389 instance = rp->instance; 8390 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8391 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8392 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8393 *instance = adv_instance->instance; 8394 instance++; 8395 } else { 8396 rp->num_instances--; 8397 rp_len--; 8398 } 8399 } 8400 8401 hci_dev_unlock(hdev); 8402 8403 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8404 MGMT_STATUS_SUCCESS, rp, rp_len); 8405 8406 kfree(rp); 8407 8408 return err; 8409 } 8410 8411 static u8 calculate_name_len(struct hci_dev *hdev) 8412 { 8413 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8414 8415 return eir_append_local_name(hdev, buf, 0); 8416 } 8417 8418 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8419 bool is_adv_data) 8420 { 8421 u8 max_len = max_adv_len(hdev); 8422 8423 if (is_adv_data) { 8424 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8425 MGMT_ADV_FLAG_LIMITED_DISCOV | 8426 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8427 max_len -= 3; 8428 8429 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8430 max_len -= 3; 8431 } else { 8432 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8433 max_len -= calculate_name_len(hdev); 8434 8435 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8436 max_len -= 4; 8437 } 8438 8439 return max_len; 8440 } 8441 8442 static bool flags_managed(u32 adv_flags) 8443 { 8444 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8445 MGMT_ADV_FLAG_LIMITED_DISCOV | 8446 MGMT_ADV_FLAG_MANAGED_FLAGS); 8447 } 8448 8449 static bool tx_power_managed(u32 adv_flags) 8450 { 8451 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8452 } 8453 8454 static bool name_managed(u32 adv_flags) 8455 { 8456 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8457 } 8458 8459 static bool appearance_managed(u32 adv_flags) 8460 { 8461 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8462 } 8463 8464 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8465 u8 len, bool is_adv_data) 8466 { 8467 int i, cur_len; 8468 u8 max_len; 8469 8470 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8471 8472 if (len > max_len) 8473 return false; 8474 8475 /* Make sure that the data is correctly formatted. */ 8476 for (i = 0; i < len; i += (cur_len + 1)) { 8477 cur_len = data[i]; 8478 8479 if (!cur_len) 8480 continue; 8481 8482 if (data[i + 1] == EIR_FLAGS && 8483 (!is_adv_data || flags_managed(adv_flags))) 8484 return false; 8485 8486 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8487 return false; 8488 8489 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8490 return false; 8491 8492 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8493 return false; 8494 8495 if (data[i + 1] == EIR_APPEARANCE && 8496 appearance_managed(adv_flags)) 8497 return false; 8498 8499 /* If the current field length would exceed the total data 8500 * length, then it's invalid. 8501 */ 8502 if (i + cur_len >= len) 8503 return false; 8504 } 8505 8506 return true; 8507 } 8508 8509 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8510 { 8511 u32 supported_flags, phy_flags; 8512 8513 /* The current implementation only supports a subset of the specified 8514 * flags. Also need to check mutual exclusiveness of sec flags. 8515 */ 8516 supported_flags = get_supported_adv_flags(hdev); 8517 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8518 if (adv_flags & ~supported_flags || 8519 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8520 return false; 8521 8522 return true; 8523 } 8524 8525 static bool adv_busy(struct hci_dev *hdev) 8526 { 8527 return pending_find(MGMT_OP_SET_LE, hdev); 8528 } 8529 8530 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8531 int err) 8532 { 8533 struct adv_info *adv, *n; 8534 8535 bt_dev_dbg(hdev, "err %d", err); 8536 8537 hci_dev_lock(hdev); 8538 8539 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8540 u8 instance; 8541 8542 if (!adv->pending) 8543 continue; 8544 8545 if (!err) { 8546 adv->pending = false; 8547 continue; 8548 } 8549 8550 instance = adv->instance; 8551 8552 if (hdev->cur_adv_instance == instance) 8553 cancel_adv_timeout(hdev); 8554 8555 hci_remove_adv_instance(hdev, instance); 8556 mgmt_advertising_removed(sk, hdev, instance); 8557 } 8558 8559 hci_dev_unlock(hdev); 8560 } 8561 8562 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8563 { 8564 struct mgmt_pending_cmd *cmd = data; 8565 struct mgmt_cp_add_advertising *cp = cmd->param; 8566 struct mgmt_rp_add_advertising rp; 8567 8568 memset(&rp, 0, sizeof(rp)); 8569 8570 rp.instance = cp->instance; 8571 8572 if (err) 8573 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8574 mgmt_status(err)); 8575 else 8576 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8577 mgmt_status(err), &rp, sizeof(rp)); 8578 8579 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8580 8581 mgmt_pending_free(cmd); 8582 } 8583 8584 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8585 { 8586 struct mgmt_pending_cmd *cmd = data; 8587 struct mgmt_cp_add_advertising *cp = cmd->param; 8588 8589 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8590 } 8591 8592 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8593 void *data, u16 data_len) 8594 { 8595 struct mgmt_cp_add_advertising *cp = data; 8596 struct mgmt_rp_add_advertising rp; 8597 u32 flags; 8598 u8 status; 8599 u16 timeout, duration; 8600 unsigned int prev_instance_cnt; 8601 u8 schedule_instance = 0; 8602 struct adv_info *adv, *next_instance; 8603 int err; 8604 struct mgmt_pending_cmd *cmd; 8605 8606 bt_dev_dbg(hdev, "sock %p", sk); 8607 8608 status = mgmt_le_support(hdev); 8609 if (status) 8610 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8611 status); 8612 8613 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8614 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8615 MGMT_STATUS_INVALID_PARAMS); 8616 8617 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8618 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8619 MGMT_STATUS_INVALID_PARAMS); 8620 8621 flags = __le32_to_cpu(cp->flags); 8622 timeout = __le16_to_cpu(cp->timeout); 8623 duration = __le16_to_cpu(cp->duration); 8624 8625 if (!requested_adv_flags_are_valid(hdev, flags)) 8626 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8627 MGMT_STATUS_INVALID_PARAMS); 8628 8629 hci_dev_lock(hdev); 8630 8631 if (timeout && !hdev_is_powered(hdev)) { 8632 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8633 MGMT_STATUS_REJECTED); 8634 goto unlock; 8635 } 8636 8637 if (adv_busy(hdev)) { 8638 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8639 MGMT_STATUS_BUSY); 8640 goto unlock; 8641 } 8642 8643 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8644 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8645 cp->scan_rsp_len, false)) { 8646 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8647 MGMT_STATUS_INVALID_PARAMS); 8648 goto unlock; 8649 } 8650 8651 prev_instance_cnt = hdev->adv_instance_cnt; 8652 8653 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8654 cp->adv_data_len, cp->data, 8655 cp->scan_rsp_len, 8656 cp->data + cp->adv_data_len, 8657 timeout, duration, 8658 HCI_ADV_TX_POWER_NO_PREFERENCE, 8659 hdev->le_adv_min_interval, 8660 hdev->le_adv_max_interval, 0); 8661 if (IS_ERR(adv)) { 8662 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8663 MGMT_STATUS_FAILED); 8664 goto unlock; 8665 } 8666 8667 /* Only trigger an advertising added event if a new instance was 8668 * actually added. 8669 */ 8670 if (hdev->adv_instance_cnt > prev_instance_cnt) 8671 mgmt_advertising_added(sk, hdev, cp->instance); 8672 8673 if (hdev->cur_adv_instance == cp->instance) { 8674 /* If the currently advertised instance is being changed then 8675 * cancel the current advertising and schedule the next 8676 * instance. If there is only one instance then the overridden 8677 * advertising data will be visible right away. 8678 */ 8679 cancel_adv_timeout(hdev); 8680 8681 next_instance = hci_get_next_instance(hdev, cp->instance); 8682 if (next_instance) 8683 schedule_instance = next_instance->instance; 8684 } else if (!hdev->adv_instance_timeout) { 8685 /* Immediately advertise the new instance if no other 8686 * instance is currently being advertised. 8687 */ 8688 schedule_instance = cp->instance; 8689 } 8690 8691 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8692 * there is no instance to be advertised then we have no HCI 8693 * communication to make. Simply return. 8694 */ 8695 if (!hdev_is_powered(hdev) || 8696 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8697 !schedule_instance) { 8698 rp.instance = cp->instance; 8699 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8700 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8701 goto unlock; 8702 } 8703 8704 /* We're good to go, update advertising data, parameters, and start 8705 * advertising. 8706 */ 8707 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8708 data_len); 8709 if (!cmd) { 8710 err = -ENOMEM; 8711 goto unlock; 8712 } 8713 8714 cp->instance = schedule_instance; 8715 8716 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8717 add_advertising_complete); 8718 if (err < 0) 8719 mgmt_pending_free(cmd); 8720 8721 unlock: 8722 hci_dev_unlock(hdev); 8723 8724 return err; 8725 } 8726 8727 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8728 int err) 8729 { 8730 struct mgmt_pending_cmd *cmd = data; 8731 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8732 struct mgmt_rp_add_ext_adv_params rp; 8733 struct adv_info *adv; 8734 u32 flags; 8735 8736 BT_DBG("%s", hdev->name); 8737 8738 hci_dev_lock(hdev); 8739 8740 adv = hci_find_adv_instance(hdev, cp->instance); 8741 if (!adv) 8742 goto unlock; 8743 8744 rp.instance = cp->instance; 8745 rp.tx_power = adv->tx_power; 8746 8747 /* While we're at it, inform userspace of the available space for this 8748 * advertisement, given the flags that will be used. 8749 */ 8750 flags = __le32_to_cpu(cp->flags); 8751 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8752 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8753 8754 if (err) { 8755 /* If this advertisement was previously advertising and we 8756 * failed to update it, we signal that it has been removed and 8757 * delete its structure 8758 */ 8759 if (!adv->pending) 8760 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8761 8762 hci_remove_adv_instance(hdev, cp->instance); 8763 8764 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8765 mgmt_status(err)); 8766 } else { 8767 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8768 mgmt_status(err), &rp, sizeof(rp)); 8769 } 8770 8771 unlock: 8772 if (cmd) 8773 mgmt_pending_free(cmd); 8774 8775 hci_dev_unlock(hdev); 8776 } 8777 8778 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8779 { 8780 struct mgmt_pending_cmd *cmd = data; 8781 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8782 8783 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8784 } 8785 8786 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8787 void *data, u16 data_len) 8788 { 8789 struct mgmt_cp_add_ext_adv_params *cp = data; 8790 struct mgmt_rp_add_ext_adv_params rp; 8791 struct mgmt_pending_cmd *cmd = NULL; 8792 struct adv_info *adv; 8793 u32 flags, min_interval, max_interval; 8794 u16 timeout, duration; 8795 u8 status; 8796 s8 tx_power; 8797 int err; 8798 8799 BT_DBG("%s", hdev->name); 8800 8801 status = mgmt_le_support(hdev); 8802 if (status) 8803 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8804 status); 8805 8806 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8807 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8808 MGMT_STATUS_INVALID_PARAMS); 8809 8810 /* The purpose of breaking add_advertising into two separate MGMT calls 8811 * for params and data is to allow more parameters to be added to this 8812 * structure in the future. For this reason, we verify that we have the 8813 * bare minimum structure we know of when the interface was defined. Any 8814 * extra parameters we don't know about will be ignored in this request. 8815 */ 8816 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8817 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8818 MGMT_STATUS_INVALID_PARAMS); 8819 8820 flags = __le32_to_cpu(cp->flags); 8821 8822 if (!requested_adv_flags_are_valid(hdev, flags)) 8823 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8824 MGMT_STATUS_INVALID_PARAMS); 8825 8826 hci_dev_lock(hdev); 8827 8828 /* In new interface, we require that we are powered to register */ 8829 if (!hdev_is_powered(hdev)) { 8830 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8831 MGMT_STATUS_REJECTED); 8832 goto unlock; 8833 } 8834 8835 if (adv_busy(hdev)) { 8836 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8837 MGMT_STATUS_BUSY); 8838 goto unlock; 8839 } 8840 8841 /* Parse defined parameters from request, use defaults otherwise */ 8842 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8843 __le16_to_cpu(cp->timeout) : 0; 8844 8845 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8846 __le16_to_cpu(cp->duration) : 8847 hdev->def_multi_adv_rotation_duration; 8848 8849 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8850 __le32_to_cpu(cp->min_interval) : 8851 hdev->le_adv_min_interval; 8852 8853 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8854 __le32_to_cpu(cp->max_interval) : 8855 hdev->le_adv_max_interval; 8856 8857 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8858 cp->tx_power : 8859 HCI_ADV_TX_POWER_NO_PREFERENCE; 8860 8861 /* Create advertising instance with no advertising or response data */ 8862 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 8863 timeout, duration, tx_power, min_interval, 8864 max_interval, 0); 8865 8866 if (IS_ERR(adv)) { 8867 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8868 MGMT_STATUS_FAILED); 8869 goto unlock; 8870 } 8871 8872 /* Submit request for advertising params if ext adv available */ 8873 if (ext_adv_capable(hdev)) { 8874 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8875 data, data_len); 8876 if (!cmd) { 8877 err = -ENOMEM; 8878 hci_remove_adv_instance(hdev, cp->instance); 8879 goto unlock; 8880 } 8881 8882 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8883 add_ext_adv_params_complete); 8884 if (err < 0) 8885 mgmt_pending_free(cmd); 8886 } else { 8887 rp.instance = cp->instance; 8888 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8889 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8890 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8891 err = mgmt_cmd_complete(sk, hdev->id, 8892 MGMT_OP_ADD_EXT_ADV_PARAMS, 8893 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8894 } 8895 8896 unlock: 8897 hci_dev_unlock(hdev); 8898 8899 return err; 8900 } 8901 8902 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8903 { 8904 struct mgmt_pending_cmd *cmd = data; 8905 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8906 struct mgmt_rp_add_advertising rp; 8907 8908 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8909 8910 memset(&rp, 0, sizeof(rp)); 8911 8912 rp.instance = cp->instance; 8913 8914 if (err) 8915 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8916 mgmt_status(err)); 8917 else 8918 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8919 mgmt_status(err), &rp, sizeof(rp)); 8920 8921 mgmt_pending_free(cmd); 8922 } 8923 8924 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8925 { 8926 struct mgmt_pending_cmd *cmd = data; 8927 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8928 int err; 8929 8930 if (ext_adv_capable(hdev)) { 8931 err = hci_update_adv_data_sync(hdev, cp->instance); 8932 if (err) 8933 return err; 8934 8935 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8936 if (err) 8937 return err; 8938 8939 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8940 } 8941 8942 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8943 } 8944 8945 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8946 u16 data_len) 8947 { 8948 struct mgmt_cp_add_ext_adv_data *cp = data; 8949 struct mgmt_rp_add_ext_adv_data rp; 8950 u8 schedule_instance = 0; 8951 struct adv_info *next_instance; 8952 struct adv_info *adv_instance; 8953 int err = 0; 8954 struct mgmt_pending_cmd *cmd; 8955 8956 BT_DBG("%s", hdev->name); 8957 8958 hci_dev_lock(hdev); 8959 8960 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8961 8962 if (!adv_instance) { 8963 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8964 MGMT_STATUS_INVALID_PARAMS); 8965 goto unlock; 8966 } 8967 8968 /* In new interface, we require that we are powered to register */ 8969 if (!hdev_is_powered(hdev)) { 8970 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8971 MGMT_STATUS_REJECTED); 8972 goto clear_new_instance; 8973 } 8974 8975 if (adv_busy(hdev)) { 8976 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8977 MGMT_STATUS_BUSY); 8978 goto clear_new_instance; 8979 } 8980 8981 /* Validate new data */ 8982 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8983 cp->adv_data_len, true) || 8984 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8985 cp->adv_data_len, cp->scan_rsp_len, false)) { 8986 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8987 MGMT_STATUS_INVALID_PARAMS); 8988 goto clear_new_instance; 8989 } 8990 8991 /* Set the data in the advertising instance */ 8992 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8993 cp->data, cp->scan_rsp_len, 8994 cp->data + cp->adv_data_len); 8995 8996 /* If using software rotation, determine next instance to use */ 8997 if (hdev->cur_adv_instance == cp->instance) { 8998 /* If the currently advertised instance is being changed 8999 * then cancel the current advertising and schedule the 9000 * next instance. If there is only one instance then the 9001 * overridden advertising data will be visible right 9002 * away 9003 */ 9004 cancel_adv_timeout(hdev); 9005 9006 next_instance = hci_get_next_instance(hdev, cp->instance); 9007 if (next_instance) 9008 schedule_instance = next_instance->instance; 9009 } else if (!hdev->adv_instance_timeout) { 9010 /* Immediately advertise the new instance if no other 9011 * instance is currently being advertised. 9012 */ 9013 schedule_instance = cp->instance; 9014 } 9015 9016 /* If the HCI_ADVERTISING flag is set or there is no instance to 9017 * be advertised then we have no HCI communication to make. 9018 * Simply return. 9019 */ 9020 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9021 if (adv_instance->pending) { 9022 mgmt_advertising_added(sk, hdev, cp->instance); 9023 adv_instance->pending = false; 9024 } 9025 rp.instance = cp->instance; 9026 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9027 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9028 goto unlock; 9029 } 9030 9031 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9032 data_len); 9033 if (!cmd) { 9034 err = -ENOMEM; 9035 goto clear_new_instance; 9036 } 9037 9038 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9039 add_ext_adv_data_complete); 9040 if (err < 0) { 9041 mgmt_pending_free(cmd); 9042 goto clear_new_instance; 9043 } 9044 9045 /* We were successful in updating data, so trigger advertising_added 9046 * event if this is an instance that wasn't previously advertising. If 9047 * a failure occurs in the requests we initiated, we will remove the 9048 * instance again in add_advertising_complete 9049 */ 9050 if (adv_instance->pending) 9051 mgmt_advertising_added(sk, hdev, cp->instance); 9052 9053 goto unlock; 9054 9055 clear_new_instance: 9056 hci_remove_adv_instance(hdev, cp->instance); 9057 9058 unlock: 9059 hci_dev_unlock(hdev); 9060 9061 return err; 9062 } 9063 9064 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9065 int err) 9066 { 9067 struct mgmt_pending_cmd *cmd = data; 9068 struct mgmt_cp_remove_advertising *cp = cmd->param; 9069 struct mgmt_rp_remove_advertising rp; 9070 9071 bt_dev_dbg(hdev, "err %d", err); 9072 9073 memset(&rp, 0, sizeof(rp)); 9074 rp.instance = cp->instance; 9075 9076 if (err) 9077 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 9078 mgmt_status(err)); 9079 else 9080 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 9081 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9082 9083 mgmt_pending_free(cmd); 9084 } 9085 9086 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9087 { 9088 struct mgmt_pending_cmd *cmd = data; 9089 struct mgmt_cp_remove_advertising *cp = cmd->param; 9090 int err; 9091 9092 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9093 if (err) 9094 return err; 9095 9096 if (list_empty(&hdev->adv_instances)) 9097 err = hci_disable_advertising_sync(hdev); 9098 9099 return err; 9100 } 9101 9102 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9103 void *data, u16 data_len) 9104 { 9105 struct mgmt_cp_remove_advertising *cp = data; 9106 struct mgmt_pending_cmd *cmd; 9107 int err; 9108 9109 bt_dev_dbg(hdev, "sock %p", sk); 9110 9111 hci_dev_lock(hdev); 9112 9113 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9114 err = mgmt_cmd_status(sk, hdev->id, 9115 MGMT_OP_REMOVE_ADVERTISING, 9116 MGMT_STATUS_INVALID_PARAMS); 9117 goto unlock; 9118 } 9119 9120 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9121 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9122 MGMT_STATUS_BUSY); 9123 goto unlock; 9124 } 9125 9126 if (list_empty(&hdev->adv_instances)) { 9127 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9128 MGMT_STATUS_INVALID_PARAMS); 9129 goto unlock; 9130 } 9131 9132 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9133 data_len); 9134 if (!cmd) { 9135 err = -ENOMEM; 9136 goto unlock; 9137 } 9138 9139 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9140 remove_advertising_complete); 9141 if (err < 0) 9142 mgmt_pending_free(cmd); 9143 9144 unlock: 9145 hci_dev_unlock(hdev); 9146 9147 return err; 9148 } 9149 9150 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9151 void *data, u16 data_len) 9152 { 9153 struct mgmt_cp_get_adv_size_info *cp = data; 9154 struct mgmt_rp_get_adv_size_info rp; 9155 u32 flags, supported_flags; 9156 9157 bt_dev_dbg(hdev, "sock %p", sk); 9158 9159 if (!lmp_le_capable(hdev)) 9160 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9161 MGMT_STATUS_REJECTED); 9162 9163 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9164 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9165 MGMT_STATUS_INVALID_PARAMS); 9166 9167 flags = __le32_to_cpu(cp->flags); 9168 9169 /* The current implementation only supports a subset of the specified 9170 * flags. 9171 */ 9172 supported_flags = get_supported_adv_flags(hdev); 9173 if (flags & ~supported_flags) 9174 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9175 MGMT_STATUS_INVALID_PARAMS); 9176 9177 rp.instance = cp->instance; 9178 rp.flags = cp->flags; 9179 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9180 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9181 9182 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9183 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9184 } 9185 9186 static const struct hci_mgmt_handler mgmt_handlers[] = { 9187 { NULL }, /* 0x0000 (no command) */ 9188 { read_version, MGMT_READ_VERSION_SIZE, 9189 HCI_MGMT_NO_HDEV | 9190 HCI_MGMT_UNTRUSTED }, 9191 { read_commands, MGMT_READ_COMMANDS_SIZE, 9192 HCI_MGMT_NO_HDEV | 9193 HCI_MGMT_UNTRUSTED }, 9194 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9195 HCI_MGMT_NO_HDEV | 9196 HCI_MGMT_UNTRUSTED }, 9197 { read_controller_info, MGMT_READ_INFO_SIZE, 9198 HCI_MGMT_UNTRUSTED }, 9199 { set_powered, MGMT_SETTING_SIZE }, 9200 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9201 { set_connectable, MGMT_SETTING_SIZE }, 9202 { set_fast_connectable, MGMT_SETTING_SIZE }, 9203 { set_bondable, MGMT_SETTING_SIZE }, 9204 { set_link_security, MGMT_SETTING_SIZE }, 9205 { set_ssp, MGMT_SETTING_SIZE }, 9206 { set_hs, MGMT_SETTING_SIZE }, 9207 { set_le, MGMT_SETTING_SIZE }, 9208 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9209 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9210 { add_uuid, MGMT_ADD_UUID_SIZE }, 9211 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9212 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9213 HCI_MGMT_VAR_LEN }, 9214 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9215 HCI_MGMT_VAR_LEN }, 9216 { disconnect, MGMT_DISCONNECT_SIZE }, 9217 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9218 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9219 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9220 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9221 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9222 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9223 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9224 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9225 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9226 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9227 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9228 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9229 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9230 HCI_MGMT_VAR_LEN }, 9231 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9232 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9233 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9234 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9235 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9236 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9237 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9238 { set_advertising, MGMT_SETTING_SIZE }, 9239 { set_bredr, MGMT_SETTING_SIZE }, 9240 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9241 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9242 { set_secure_conn, MGMT_SETTING_SIZE }, 9243 { set_debug_keys, MGMT_SETTING_SIZE }, 9244 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9245 { load_irks, MGMT_LOAD_IRKS_SIZE, 9246 HCI_MGMT_VAR_LEN }, 9247 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9248 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9249 { add_device, MGMT_ADD_DEVICE_SIZE }, 9250 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9251 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9252 HCI_MGMT_VAR_LEN }, 9253 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9254 HCI_MGMT_NO_HDEV | 9255 HCI_MGMT_UNTRUSTED }, 9256 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9257 HCI_MGMT_UNCONFIGURED | 9258 HCI_MGMT_UNTRUSTED }, 9259 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9260 HCI_MGMT_UNCONFIGURED }, 9261 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9262 HCI_MGMT_UNCONFIGURED }, 9263 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9264 HCI_MGMT_VAR_LEN }, 9265 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9266 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9267 HCI_MGMT_NO_HDEV | 9268 HCI_MGMT_UNTRUSTED }, 9269 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9270 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9271 HCI_MGMT_VAR_LEN }, 9272 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9273 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9274 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9275 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9276 HCI_MGMT_UNTRUSTED }, 9277 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9278 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9279 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9280 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9281 HCI_MGMT_VAR_LEN }, 9282 { set_wideband_speech, MGMT_SETTING_SIZE }, 9283 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9284 HCI_MGMT_UNTRUSTED }, 9285 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9286 HCI_MGMT_UNTRUSTED | 9287 HCI_MGMT_HDEV_OPTIONAL }, 9288 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9289 HCI_MGMT_VAR_LEN | 9290 HCI_MGMT_HDEV_OPTIONAL }, 9291 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9292 HCI_MGMT_UNTRUSTED }, 9293 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9294 HCI_MGMT_VAR_LEN }, 9295 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9296 HCI_MGMT_UNTRUSTED }, 9297 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9298 HCI_MGMT_VAR_LEN }, 9299 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9300 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9301 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9302 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9303 HCI_MGMT_VAR_LEN }, 9304 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9305 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9306 HCI_MGMT_VAR_LEN }, 9307 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9308 HCI_MGMT_VAR_LEN }, 9309 { add_adv_patterns_monitor_rssi, 9310 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9311 HCI_MGMT_VAR_LEN }, 9312 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9313 HCI_MGMT_VAR_LEN }, 9314 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9315 { mesh_send, MGMT_MESH_SEND_SIZE, 9316 HCI_MGMT_VAR_LEN }, 9317 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9318 }; 9319 9320 void mgmt_index_added(struct hci_dev *hdev) 9321 { 9322 struct mgmt_ev_ext_index ev; 9323 9324 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9325 return; 9326 9327 switch (hdev->dev_type) { 9328 case HCI_PRIMARY: 9329 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9330 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 9331 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9332 ev.type = 0x01; 9333 } else { 9334 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9335 HCI_MGMT_INDEX_EVENTS); 9336 ev.type = 0x00; 9337 } 9338 break; 9339 case HCI_AMP: 9340 ev.type = 0x02; 9341 break; 9342 default: 9343 return; 9344 } 9345 9346 ev.bus = hdev->bus; 9347 9348 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9349 HCI_MGMT_EXT_INDEX_EVENTS); 9350 } 9351 9352 void mgmt_index_removed(struct hci_dev *hdev) 9353 { 9354 struct mgmt_ev_ext_index ev; 9355 u8 status = MGMT_STATUS_INVALID_INDEX; 9356 9357 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9358 return; 9359 9360 switch (hdev->dev_type) { 9361 case HCI_PRIMARY: 9362 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9363 9364 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9365 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 9366 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9367 ev.type = 0x01; 9368 } else { 9369 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9370 HCI_MGMT_INDEX_EVENTS); 9371 ev.type = 0x00; 9372 } 9373 break; 9374 case HCI_AMP: 9375 ev.type = 0x02; 9376 break; 9377 default: 9378 return; 9379 } 9380 9381 ev.bus = hdev->bus; 9382 9383 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9384 HCI_MGMT_EXT_INDEX_EVENTS); 9385 9386 /* Cancel any remaining timed work */ 9387 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9388 return; 9389 cancel_delayed_work_sync(&hdev->discov_off); 9390 cancel_delayed_work_sync(&hdev->service_cache); 9391 cancel_delayed_work_sync(&hdev->rpa_expired); 9392 } 9393 9394 void mgmt_power_on(struct hci_dev *hdev, int err) 9395 { 9396 struct cmd_lookup match = { NULL, hdev }; 9397 9398 bt_dev_dbg(hdev, "err %d", err); 9399 9400 hci_dev_lock(hdev); 9401 9402 if (!err) { 9403 restart_le_actions(hdev); 9404 hci_update_passive_scan(hdev); 9405 } 9406 9407 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9408 9409 new_settings(hdev, match.sk); 9410 9411 if (match.sk) 9412 sock_put(match.sk); 9413 9414 hci_dev_unlock(hdev); 9415 } 9416 9417 void __mgmt_power_off(struct hci_dev *hdev) 9418 { 9419 struct cmd_lookup match = { NULL, hdev }; 9420 u8 status, zero_cod[] = { 0, 0, 0 }; 9421 9422 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9423 9424 /* If the power off is because of hdev unregistration let 9425 * use the appropriate INVALID_INDEX status. Otherwise use 9426 * NOT_POWERED. We cover both scenarios here since later in 9427 * mgmt_index_removed() any hci_conn callbacks will have already 9428 * been triggered, potentially causing misleading DISCONNECTED 9429 * status responses. 9430 */ 9431 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9432 status = MGMT_STATUS_INVALID_INDEX; 9433 else 9434 status = MGMT_STATUS_NOT_POWERED; 9435 9436 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9437 9438 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9439 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9440 zero_cod, sizeof(zero_cod), 9441 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9442 ext_info_changed(hdev, NULL); 9443 } 9444 9445 new_settings(hdev, match.sk); 9446 9447 if (match.sk) 9448 sock_put(match.sk); 9449 } 9450 9451 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9452 { 9453 struct mgmt_pending_cmd *cmd; 9454 u8 status; 9455 9456 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9457 if (!cmd) 9458 return; 9459 9460 if (err == -ERFKILL) 9461 status = MGMT_STATUS_RFKILLED; 9462 else 9463 status = MGMT_STATUS_FAILED; 9464 9465 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9466 9467 mgmt_pending_remove(cmd); 9468 } 9469 9470 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9471 bool persistent) 9472 { 9473 struct mgmt_ev_new_link_key ev; 9474 9475 memset(&ev, 0, sizeof(ev)); 9476 9477 ev.store_hint = persistent; 9478 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9479 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); 9480 ev.key.type = key->type; 9481 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9482 ev.key.pin_len = key->pin_len; 9483 9484 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9485 } 9486 9487 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9488 { 9489 switch (ltk->type) { 9490 case SMP_LTK: 9491 case SMP_LTK_RESPONDER: 9492 if (ltk->authenticated) 9493 return MGMT_LTK_AUTHENTICATED; 9494 return MGMT_LTK_UNAUTHENTICATED; 9495 case SMP_LTK_P256: 9496 if (ltk->authenticated) 9497 return MGMT_LTK_P256_AUTH; 9498 return MGMT_LTK_P256_UNAUTH; 9499 case SMP_LTK_P256_DEBUG: 9500 return MGMT_LTK_P256_DEBUG; 9501 } 9502 9503 return MGMT_LTK_UNAUTHENTICATED; 9504 } 9505 9506 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9507 { 9508 struct mgmt_ev_new_long_term_key ev; 9509 9510 memset(&ev, 0, sizeof(ev)); 9511 9512 /* Devices using resolvable or non-resolvable random addresses 9513 * without providing an identity resolving key don't require 9514 * to store long term keys. Their addresses will change the 9515 * next time around. 9516 * 9517 * Only when a remote device provides an identity address 9518 * make sure the long term key is stored. If the remote 9519 * identity is known, the long term keys are internally 9520 * mapped to the identity address. So allow static random 9521 * and public addresses here. 9522 */ 9523 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9524 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9525 ev.store_hint = 0x00; 9526 else 9527 ev.store_hint = persistent; 9528 9529 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9530 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); 9531 ev.key.type = mgmt_ltk_type(key); 9532 ev.key.enc_size = key->enc_size; 9533 ev.key.ediv = key->ediv; 9534 ev.key.rand = key->rand; 9535 9536 if (key->type == SMP_LTK) 9537 ev.key.initiator = 1; 9538 9539 /* Make sure we copy only the significant bytes based on the 9540 * encryption key size, and set the rest of the value to zeroes. 9541 */ 9542 memcpy(ev.key.val, key->val, key->enc_size); 9543 memset(ev.key.val + key->enc_size, 0, 9544 sizeof(ev.key.val) - key->enc_size); 9545 9546 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9547 } 9548 9549 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9550 { 9551 struct mgmt_ev_new_irk ev; 9552 9553 memset(&ev, 0, sizeof(ev)); 9554 9555 ev.store_hint = persistent; 9556 9557 bacpy(&ev.rpa, &irk->rpa); 9558 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9559 ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); 9560 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9561 9562 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9563 } 9564 9565 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9566 bool persistent) 9567 { 9568 struct mgmt_ev_new_csrk ev; 9569 9570 memset(&ev, 0, sizeof(ev)); 9571 9572 /* Devices using resolvable or non-resolvable random addresses 9573 * without providing an identity resolving key don't require 9574 * to store signature resolving keys. Their addresses will change 9575 * the next time around. 9576 * 9577 * Only when a remote device provides an identity address 9578 * make sure the signature resolving key is stored. So allow 9579 * static random and public addresses here. 9580 */ 9581 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9582 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9583 ev.store_hint = 0x00; 9584 else 9585 ev.store_hint = persistent; 9586 9587 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9588 ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); 9589 ev.key.type = csrk->type; 9590 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9591 9592 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9593 } 9594 9595 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9596 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9597 u16 max_interval, u16 latency, u16 timeout) 9598 { 9599 struct mgmt_ev_new_conn_param ev; 9600 9601 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9602 return; 9603 9604 memset(&ev, 0, sizeof(ev)); 9605 bacpy(&ev.addr.bdaddr, bdaddr); 9606 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9607 ev.store_hint = store_hint; 9608 ev.min_interval = cpu_to_le16(min_interval); 9609 ev.max_interval = cpu_to_le16(max_interval); 9610 ev.latency = cpu_to_le16(latency); 9611 ev.timeout = cpu_to_le16(timeout); 9612 9613 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9614 } 9615 9616 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9617 u8 *name, u8 name_len) 9618 { 9619 struct sk_buff *skb; 9620 struct mgmt_ev_device_connected *ev; 9621 u16 eir_len = 0; 9622 u32 flags = 0; 9623 9624 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 9625 return; 9626 9627 /* allocate buff for LE or BR/EDR adv */ 9628 if (conn->le_adv_data_len > 0) 9629 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9630 sizeof(*ev) + conn->le_adv_data_len); 9631 else 9632 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9633 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9634 eir_precalc_len(sizeof(conn->dev_class))); 9635 9636 ev = skb_put(skb, sizeof(*ev)); 9637 bacpy(&ev->addr.bdaddr, &conn->dst); 9638 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9639 9640 if (conn->out) 9641 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9642 9643 ev->flags = __cpu_to_le32(flags); 9644 9645 /* We must ensure that the EIR Data fields are ordered and 9646 * unique. Keep it simple for now and avoid the problem by not 9647 * adding any BR/EDR data to the LE adv. 9648 */ 9649 if (conn->le_adv_data_len > 0) { 9650 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9651 eir_len = conn->le_adv_data_len; 9652 } else { 9653 if (name) 9654 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9655 9656 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9657 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9658 conn->dev_class, sizeof(conn->dev_class)); 9659 } 9660 9661 ev->eir_len = cpu_to_le16(eir_len); 9662 9663 mgmt_event_skb(skb, NULL); 9664 } 9665 9666 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9667 { 9668 struct sock **sk = data; 9669 9670 cmd->cmd_complete(cmd, 0); 9671 9672 *sk = cmd->sk; 9673 sock_hold(*sk); 9674 9675 mgmt_pending_remove(cmd); 9676 } 9677 9678 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9679 { 9680 struct hci_dev *hdev = data; 9681 struct mgmt_cp_unpair_device *cp = cmd->param; 9682 9683 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9684 9685 cmd->cmd_complete(cmd, 0); 9686 mgmt_pending_remove(cmd); 9687 } 9688 9689 bool mgmt_powering_down(struct hci_dev *hdev) 9690 { 9691 struct mgmt_pending_cmd *cmd; 9692 struct mgmt_mode *cp; 9693 9694 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9695 if (!cmd) 9696 return false; 9697 9698 cp = cmd->param; 9699 if (!cp->val) 9700 return true; 9701 9702 return false; 9703 } 9704 9705 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9706 u8 link_type, u8 addr_type, u8 reason, 9707 bool mgmt_connected) 9708 { 9709 struct mgmt_ev_device_disconnected ev; 9710 struct sock *sk = NULL; 9711 9712 if (!mgmt_connected) 9713 return; 9714 9715 if (link_type != ACL_LINK && link_type != LE_LINK) 9716 return; 9717 9718 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9719 9720 bacpy(&ev.addr.bdaddr, bdaddr); 9721 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9722 ev.reason = reason; 9723 9724 /* Report disconnects due to suspend */ 9725 if (hdev->suspended) 9726 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9727 9728 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9729 9730 if (sk) 9731 sock_put(sk); 9732 9733 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9734 hdev); 9735 } 9736 9737 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9738 u8 link_type, u8 addr_type, u8 status) 9739 { 9740 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9741 struct mgmt_cp_disconnect *cp; 9742 struct mgmt_pending_cmd *cmd; 9743 9744 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9745 hdev); 9746 9747 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9748 if (!cmd) 9749 return; 9750 9751 cp = cmd->param; 9752 9753 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9754 return; 9755 9756 if (cp->addr.type != bdaddr_type) 9757 return; 9758 9759 cmd->cmd_complete(cmd, mgmt_status(status)); 9760 mgmt_pending_remove(cmd); 9761 } 9762 9763 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9764 u8 addr_type, u8 status) 9765 { 9766 struct mgmt_ev_connect_failed ev; 9767 9768 bacpy(&ev.addr.bdaddr, bdaddr); 9769 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9770 ev.status = mgmt_status(status); 9771 9772 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9773 } 9774 9775 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9776 { 9777 struct mgmt_ev_pin_code_request ev; 9778 9779 bacpy(&ev.addr.bdaddr, bdaddr); 9780 ev.addr.type = BDADDR_BREDR; 9781 ev.secure = secure; 9782 9783 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9784 } 9785 9786 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9787 u8 status) 9788 { 9789 struct mgmt_pending_cmd *cmd; 9790 9791 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9792 if (!cmd) 9793 return; 9794 9795 cmd->cmd_complete(cmd, mgmt_status(status)); 9796 mgmt_pending_remove(cmd); 9797 } 9798 9799 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9800 u8 status) 9801 { 9802 struct mgmt_pending_cmd *cmd; 9803 9804 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9805 if (!cmd) 9806 return; 9807 9808 cmd->cmd_complete(cmd, mgmt_status(status)); 9809 mgmt_pending_remove(cmd); 9810 } 9811 9812 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9813 u8 link_type, u8 addr_type, u32 value, 9814 u8 confirm_hint) 9815 { 9816 struct mgmt_ev_user_confirm_request ev; 9817 9818 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9819 9820 bacpy(&ev.addr.bdaddr, bdaddr); 9821 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9822 ev.confirm_hint = confirm_hint; 9823 ev.value = cpu_to_le32(value); 9824 9825 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9826 NULL); 9827 } 9828 9829 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9830 u8 link_type, u8 addr_type) 9831 { 9832 struct mgmt_ev_user_passkey_request ev; 9833 9834 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9835 9836 bacpy(&ev.addr.bdaddr, bdaddr); 9837 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9838 9839 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9840 NULL); 9841 } 9842 9843 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9844 u8 link_type, u8 addr_type, u8 status, 9845 u8 opcode) 9846 { 9847 struct mgmt_pending_cmd *cmd; 9848 9849 cmd = pending_find(opcode, hdev); 9850 if (!cmd) 9851 return -ENOENT; 9852 9853 cmd->cmd_complete(cmd, mgmt_status(status)); 9854 mgmt_pending_remove(cmd); 9855 9856 return 0; 9857 } 9858 9859 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9860 u8 link_type, u8 addr_type, u8 status) 9861 { 9862 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9863 status, MGMT_OP_USER_CONFIRM_REPLY); 9864 } 9865 9866 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9867 u8 link_type, u8 addr_type, u8 status) 9868 { 9869 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9870 status, 9871 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9872 } 9873 9874 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9875 u8 link_type, u8 addr_type, u8 status) 9876 { 9877 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9878 status, MGMT_OP_USER_PASSKEY_REPLY); 9879 } 9880 9881 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9882 u8 link_type, u8 addr_type, u8 status) 9883 { 9884 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9885 status, 9886 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9887 } 9888 9889 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9890 u8 link_type, u8 addr_type, u32 passkey, 9891 u8 entered) 9892 { 9893 struct mgmt_ev_passkey_notify ev; 9894 9895 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9896 9897 bacpy(&ev.addr.bdaddr, bdaddr); 9898 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9899 ev.passkey = __cpu_to_le32(passkey); 9900 ev.entered = entered; 9901 9902 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9903 } 9904 9905 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9906 { 9907 struct mgmt_ev_auth_failed ev; 9908 struct mgmt_pending_cmd *cmd; 9909 u8 status = mgmt_status(hci_status); 9910 9911 bacpy(&ev.addr.bdaddr, &conn->dst); 9912 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9913 ev.status = status; 9914 9915 cmd = find_pairing(conn); 9916 9917 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9918 cmd ? cmd->sk : NULL); 9919 9920 if (cmd) { 9921 cmd->cmd_complete(cmd, status); 9922 mgmt_pending_remove(cmd); 9923 } 9924 } 9925 9926 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9927 { 9928 struct cmd_lookup match = { NULL, hdev }; 9929 bool changed; 9930 9931 if (status) { 9932 u8 mgmt_err = mgmt_status(status); 9933 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9934 cmd_status_rsp, &mgmt_err); 9935 return; 9936 } 9937 9938 if (test_bit(HCI_AUTH, &hdev->flags)) 9939 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9940 else 9941 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9942 9943 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9944 &match); 9945 9946 if (changed) 9947 new_settings(hdev, match.sk); 9948 9949 if (match.sk) 9950 sock_put(match.sk); 9951 } 9952 9953 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9954 { 9955 struct cmd_lookup *match = data; 9956 9957 if (match->sk == NULL) { 9958 match->sk = cmd->sk; 9959 sock_hold(match->sk); 9960 } 9961 } 9962 9963 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9964 u8 status) 9965 { 9966 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9967 9968 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9969 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9970 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9971 9972 if (!status) { 9973 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9974 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9975 ext_info_changed(hdev, NULL); 9976 } 9977 9978 if (match.sk) 9979 sock_put(match.sk); 9980 } 9981 9982 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9983 { 9984 struct mgmt_cp_set_local_name ev; 9985 struct mgmt_pending_cmd *cmd; 9986 9987 if (status) 9988 return; 9989 9990 memset(&ev, 0, sizeof(ev)); 9991 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9992 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9993 9994 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9995 if (!cmd) { 9996 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9997 9998 /* If this is a HCI command related to powering on the 9999 * HCI dev don't send any mgmt signals. 10000 */ 10001 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10002 return; 10003 } 10004 10005 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10006 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10007 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10008 } 10009 10010 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10011 { 10012 int i; 10013 10014 for (i = 0; i < uuid_count; i++) { 10015 if (!memcmp(uuid, uuids[i], 16)) 10016 return true; 10017 } 10018 10019 return false; 10020 } 10021 10022 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10023 { 10024 u16 parsed = 0; 10025 10026 while (parsed < eir_len) { 10027 u8 field_len = eir[0]; 10028 u8 uuid[16]; 10029 int i; 10030 10031 if (field_len == 0) 10032 break; 10033 10034 if (eir_len - parsed < field_len + 1) 10035 break; 10036 10037 switch (eir[1]) { 10038 case EIR_UUID16_ALL: 10039 case EIR_UUID16_SOME: 10040 for (i = 0; i + 3 <= field_len; i += 2) { 10041 memcpy(uuid, bluetooth_base_uuid, 16); 10042 uuid[13] = eir[i + 3]; 10043 uuid[12] = eir[i + 2]; 10044 if (has_uuid(uuid, uuid_count, uuids)) 10045 return true; 10046 } 10047 break; 10048 case EIR_UUID32_ALL: 10049 case EIR_UUID32_SOME: 10050 for (i = 0; i + 5 <= field_len; i += 4) { 10051 memcpy(uuid, bluetooth_base_uuid, 16); 10052 uuid[15] = eir[i + 5]; 10053 uuid[14] = eir[i + 4]; 10054 uuid[13] = eir[i + 3]; 10055 uuid[12] = eir[i + 2]; 10056 if (has_uuid(uuid, uuid_count, uuids)) 10057 return true; 10058 } 10059 break; 10060 case EIR_UUID128_ALL: 10061 case EIR_UUID128_SOME: 10062 for (i = 0; i + 17 <= field_len; i += 16) { 10063 memcpy(uuid, eir + i + 2, 16); 10064 if (has_uuid(uuid, uuid_count, uuids)) 10065 return true; 10066 } 10067 break; 10068 } 10069 10070 parsed += field_len + 1; 10071 eir += field_len + 1; 10072 } 10073 10074 return false; 10075 } 10076 10077 static void restart_le_scan(struct hci_dev *hdev) 10078 { 10079 /* If controller is not scanning we are done. */ 10080 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 10081 return; 10082 10083 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 10084 hdev->discovery.scan_start + 10085 hdev->discovery.scan_duration)) 10086 return; 10087 10088 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 10089 DISCOV_LE_RESTART_DELAY); 10090 } 10091 10092 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10093 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10094 { 10095 /* If a RSSI threshold has been specified, and 10096 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10097 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10098 * is set, let it through for further processing, as we might need to 10099 * restart the scan. 10100 * 10101 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10102 * the results are also dropped. 10103 */ 10104 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10105 (rssi == HCI_RSSI_INVALID || 10106 (rssi < hdev->discovery.rssi && 10107 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10108 return false; 10109 10110 if (hdev->discovery.uuid_count != 0) { 10111 /* If a list of UUIDs is provided in filter, results with no 10112 * matching UUID should be dropped. 10113 */ 10114 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10115 hdev->discovery.uuids) && 10116 !eir_has_uuids(scan_rsp, scan_rsp_len, 10117 hdev->discovery.uuid_count, 10118 hdev->discovery.uuids)) 10119 return false; 10120 } 10121 10122 /* If duplicate filtering does not report RSSI changes, then restart 10123 * scanning to ensure updated result with updated RSSI values. 10124 */ 10125 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10126 restart_le_scan(hdev); 10127 10128 /* Validate RSSI value against the RSSI threshold once more. */ 10129 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10130 rssi < hdev->discovery.rssi) 10131 return false; 10132 } 10133 10134 return true; 10135 } 10136 10137 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10138 bdaddr_t *bdaddr, u8 addr_type) 10139 { 10140 struct mgmt_ev_adv_monitor_device_lost ev; 10141 10142 ev.monitor_handle = cpu_to_le16(handle); 10143 bacpy(&ev.addr.bdaddr, bdaddr); 10144 ev.addr.type = addr_type; 10145 10146 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10147 NULL); 10148 } 10149 10150 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10151 struct sk_buff *skb, 10152 struct sock *skip_sk, 10153 u16 handle) 10154 { 10155 struct sk_buff *advmon_skb; 10156 size_t advmon_skb_len; 10157 __le16 *monitor_handle; 10158 10159 if (!skb) 10160 return; 10161 10162 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10163 sizeof(struct mgmt_ev_device_found)) + skb->len; 10164 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10165 advmon_skb_len); 10166 if (!advmon_skb) 10167 return; 10168 10169 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10170 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10171 * store monitor_handle of the matched monitor. 10172 */ 10173 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10174 *monitor_handle = cpu_to_le16(handle); 10175 skb_put_data(advmon_skb, skb->data, skb->len); 10176 10177 mgmt_event_skb(advmon_skb, skip_sk); 10178 } 10179 10180 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10181 bdaddr_t *bdaddr, bool report_device, 10182 struct sk_buff *skb, 10183 struct sock *skip_sk) 10184 { 10185 struct monitored_device *dev, *tmp; 10186 bool matched = false; 10187 bool notified = false; 10188 10189 /* We have received the Advertisement Report because: 10190 * 1. the kernel has initiated active discovery 10191 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10192 * passive scanning 10193 * 3. if none of the above is true, we have one or more active 10194 * Advertisement Monitor 10195 * 10196 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10197 * and report ONLY one advertisement per device for the matched Monitor 10198 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10199 * 10200 * For case 3, since we are not active scanning and all advertisements 10201 * received are due to a matched Advertisement Monitor, report all 10202 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10203 */ 10204 if (report_device && !hdev->advmon_pend_notify) { 10205 mgmt_event_skb(skb, skip_sk); 10206 return; 10207 } 10208 10209 hdev->advmon_pend_notify = false; 10210 10211 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10212 if (!bacmp(&dev->bdaddr, bdaddr)) { 10213 matched = true; 10214 10215 if (!dev->notified) { 10216 mgmt_send_adv_monitor_device_found(hdev, skb, 10217 skip_sk, 10218 dev->handle); 10219 notified = true; 10220 dev->notified = true; 10221 } 10222 } 10223 10224 if (!dev->notified) 10225 hdev->advmon_pend_notify = true; 10226 } 10227 10228 if (!report_device && 10229 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10230 /* Handle 0 indicates that we are not active scanning and this 10231 * is a subsequent advertisement report for an already matched 10232 * Advertisement Monitor or the controller offloading support 10233 * is not available. 10234 */ 10235 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10236 } 10237 10238 if (report_device) 10239 mgmt_event_skb(skb, skip_sk); 10240 else 10241 kfree_skb(skb); 10242 } 10243 10244 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10245 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10246 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10247 u64 instant) 10248 { 10249 struct sk_buff *skb; 10250 struct mgmt_ev_mesh_device_found *ev; 10251 int i, j; 10252 10253 if (!hdev->mesh_ad_types[0]) 10254 goto accepted; 10255 10256 /* Scan for requested AD types */ 10257 if (eir_len > 0) { 10258 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10259 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10260 if (!hdev->mesh_ad_types[j]) 10261 break; 10262 10263 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10264 goto accepted; 10265 } 10266 } 10267 } 10268 10269 if (scan_rsp_len > 0) { 10270 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10271 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10272 if (!hdev->mesh_ad_types[j]) 10273 break; 10274 10275 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10276 goto accepted; 10277 } 10278 } 10279 } 10280 10281 return; 10282 10283 accepted: 10284 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10285 sizeof(*ev) + eir_len + scan_rsp_len); 10286 if (!skb) 10287 return; 10288 10289 ev = skb_put(skb, sizeof(*ev)); 10290 10291 bacpy(&ev->addr.bdaddr, bdaddr); 10292 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10293 ev->rssi = rssi; 10294 ev->flags = cpu_to_le32(flags); 10295 ev->instant = cpu_to_le64(instant); 10296 10297 if (eir_len > 0) 10298 /* Copy EIR or advertising data into event */ 10299 skb_put_data(skb, eir, eir_len); 10300 10301 if (scan_rsp_len > 0) 10302 /* Append scan response data to event */ 10303 skb_put_data(skb, scan_rsp, scan_rsp_len); 10304 10305 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10306 10307 mgmt_event_skb(skb, NULL); 10308 } 10309 10310 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10311 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10312 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10313 u64 instant) 10314 { 10315 struct sk_buff *skb; 10316 struct mgmt_ev_device_found *ev; 10317 bool report_device = hci_discovery_active(hdev); 10318 10319 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10320 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10321 eir, eir_len, scan_rsp, scan_rsp_len, 10322 instant); 10323 10324 /* Don't send events for a non-kernel initiated discovery. With 10325 * LE one exception is if we have pend_le_reports > 0 in which 10326 * case we're doing passive scanning and want these events. 10327 */ 10328 if (!hci_discovery_active(hdev)) { 10329 if (link_type == ACL_LINK) 10330 return; 10331 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10332 report_device = true; 10333 else if (!hci_is_adv_monitoring(hdev)) 10334 return; 10335 } 10336 10337 if (hdev->discovery.result_filtering) { 10338 /* We are using service discovery */ 10339 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10340 scan_rsp_len)) 10341 return; 10342 } 10343 10344 if (hdev->discovery.limited) { 10345 /* Check for limited discoverable bit */ 10346 if (dev_class) { 10347 if (!(dev_class[1] & 0x20)) 10348 return; 10349 } else { 10350 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10351 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10352 return; 10353 } 10354 } 10355 10356 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10357 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10358 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10359 if (!skb) 10360 return; 10361 10362 ev = skb_put(skb, sizeof(*ev)); 10363 10364 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10365 * RSSI value was reported as 0 when not available. This behavior 10366 * is kept when using device discovery. This is required for full 10367 * backwards compatibility with the API. 10368 * 10369 * However when using service discovery, the value 127 will be 10370 * returned when the RSSI is not available. 10371 */ 10372 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10373 link_type == ACL_LINK) 10374 rssi = 0; 10375 10376 bacpy(&ev->addr.bdaddr, bdaddr); 10377 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10378 ev->rssi = rssi; 10379 ev->flags = cpu_to_le32(flags); 10380 10381 if (eir_len > 0) 10382 /* Copy EIR or advertising data into event */ 10383 skb_put_data(skb, eir, eir_len); 10384 10385 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10386 u8 eir_cod[5]; 10387 10388 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10389 dev_class, 3); 10390 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10391 } 10392 10393 if (scan_rsp_len > 0) 10394 /* Append scan response data to event */ 10395 skb_put_data(skb, scan_rsp, scan_rsp_len); 10396 10397 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10398 10399 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10400 } 10401 10402 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10403 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10404 { 10405 struct sk_buff *skb; 10406 struct mgmt_ev_device_found *ev; 10407 u16 eir_len = 0; 10408 u32 flags = 0; 10409 10410 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10411 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10412 10413 ev = skb_put(skb, sizeof(*ev)); 10414 bacpy(&ev->addr.bdaddr, bdaddr); 10415 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10416 ev->rssi = rssi; 10417 10418 if (name) 10419 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10420 else 10421 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10422 10423 ev->eir_len = cpu_to_le16(eir_len); 10424 ev->flags = cpu_to_le32(flags); 10425 10426 mgmt_event_skb(skb, NULL); 10427 } 10428 10429 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10430 { 10431 struct mgmt_ev_discovering ev; 10432 10433 bt_dev_dbg(hdev, "discovering %u", discovering); 10434 10435 memset(&ev, 0, sizeof(ev)); 10436 ev.type = hdev->discovery.type; 10437 ev.discovering = discovering; 10438 10439 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10440 } 10441 10442 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10443 { 10444 struct mgmt_ev_controller_suspend ev; 10445 10446 ev.suspend_state = state; 10447 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10448 } 10449 10450 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10451 u8 addr_type) 10452 { 10453 struct mgmt_ev_controller_resume ev; 10454 10455 ev.wake_reason = reason; 10456 if (bdaddr) { 10457 bacpy(&ev.addr.bdaddr, bdaddr); 10458 ev.addr.type = addr_type; 10459 } else { 10460 memset(&ev.addr, 0, sizeof(ev.addr)); 10461 } 10462 10463 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10464 } 10465 10466 static struct hci_mgmt_chan chan = { 10467 .channel = HCI_CHANNEL_CONTROL, 10468 .handler_count = ARRAY_SIZE(mgmt_handlers), 10469 .handlers = mgmt_handlers, 10470 .hdev_init = mgmt_init_hdev, 10471 }; 10472 10473 int mgmt_init(void) 10474 { 10475 return hci_mgmt_chan_register(&chan); 10476 } 10477 10478 void mgmt_exit(void) 10479 { 10480 hci_mgmt_chan_unregister(&chan); 10481 } 10482 10483 void mgmt_cleanup(struct sock *sk) 10484 { 10485 struct mgmt_mesh_tx *mesh_tx; 10486 struct hci_dev *hdev; 10487 10488 read_lock(&hci_dev_list_lock); 10489 10490 list_for_each_entry(hdev, &hci_dev_list, list) { 10491 do { 10492 mesh_tx = mgmt_mesh_next(hdev, sk); 10493 10494 if (mesh_tx) 10495 mesh_send_complete(hdev, mesh_tx, true); 10496 } while (mesh_tx); 10497 } 10498 10499 read_unlock(&hci_dev_list_lock); 10500 } 10501