1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4
5 Copyright (C) 2010 Nokia Corporation
6 Copyright (C) 2011-2012 Intel Corporation
7
8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19 SOFTWARE IS DISCLAIMED.
20 */
21
22 /* Bluetooth HCI Management interface */
23
24 #include <linux/module.h>
25 #include <linux/unaligned.h>
26
27 #include <net/bluetooth/bluetooth.h>
28 #include <net/bluetooth/hci_core.h>
29 #include <net/bluetooth/hci_sock.h>
30 #include <net/bluetooth/l2cap.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "smp.h"
34 #include "mgmt_util.h"
35 #include "mgmt_config.h"
36 #include "msft.h"
37 #include "eir.h"
38 #include "aosp.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 23
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 MGMT_OP_GET_PHY_CONFIGURATION,
110 MGMT_OP_SET_PHY_CONFIGURATION,
111 MGMT_OP_SET_BLOCKED_KEYS,
112 MGMT_OP_SET_WIDEBAND_SPEECH,
113 MGMT_OP_READ_CONTROLLER_CAP,
114 MGMT_OP_READ_EXP_FEATURES_INFO,
115 MGMT_OP_SET_EXP_FEATURE,
116 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
117 MGMT_OP_SET_DEF_SYSTEM_CONFIG,
118 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
119 MGMT_OP_SET_DEF_RUNTIME_CONFIG,
120 MGMT_OP_GET_DEVICE_FLAGS,
121 MGMT_OP_SET_DEVICE_FLAGS,
122 MGMT_OP_READ_ADV_MONITOR_FEATURES,
123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
124 MGMT_OP_REMOVE_ADV_MONITOR,
125 MGMT_OP_ADD_EXT_ADV_PARAMS,
126 MGMT_OP_ADD_EXT_ADV_DATA,
127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
128 MGMT_OP_SET_MESH_RECEIVER,
129 MGMT_OP_MESH_READ_FEATURES,
130 MGMT_OP_MESH_SEND,
131 MGMT_OP_MESH_SEND_CANCEL,
132 MGMT_OP_HCI_CMD_SYNC,
133 };
134
135 static const u16 mgmt_events[] = {
136 MGMT_EV_CONTROLLER_ERROR,
137 MGMT_EV_INDEX_ADDED,
138 MGMT_EV_INDEX_REMOVED,
139 MGMT_EV_NEW_SETTINGS,
140 MGMT_EV_CLASS_OF_DEV_CHANGED,
141 MGMT_EV_LOCAL_NAME_CHANGED,
142 MGMT_EV_NEW_LINK_KEY,
143 MGMT_EV_NEW_LONG_TERM_KEY,
144 MGMT_EV_DEVICE_CONNECTED,
145 MGMT_EV_DEVICE_DISCONNECTED,
146 MGMT_EV_CONNECT_FAILED,
147 MGMT_EV_PIN_CODE_REQUEST,
148 MGMT_EV_USER_CONFIRM_REQUEST,
149 MGMT_EV_USER_PASSKEY_REQUEST,
150 MGMT_EV_AUTH_FAILED,
151 MGMT_EV_DEVICE_FOUND,
152 MGMT_EV_DISCOVERING,
153 MGMT_EV_DEVICE_BLOCKED,
154 MGMT_EV_DEVICE_UNBLOCKED,
155 MGMT_EV_DEVICE_UNPAIRED,
156 MGMT_EV_PASSKEY_NOTIFY,
157 MGMT_EV_NEW_IRK,
158 MGMT_EV_NEW_CSRK,
159 MGMT_EV_DEVICE_ADDED,
160 MGMT_EV_DEVICE_REMOVED,
161 MGMT_EV_NEW_CONN_PARAM,
162 MGMT_EV_UNCONF_INDEX_ADDED,
163 MGMT_EV_UNCONF_INDEX_REMOVED,
164 MGMT_EV_NEW_CONFIG_OPTIONS,
165 MGMT_EV_EXT_INDEX_ADDED,
166 MGMT_EV_EXT_INDEX_REMOVED,
167 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
168 MGMT_EV_ADVERTISING_ADDED,
169 MGMT_EV_ADVERTISING_REMOVED,
170 MGMT_EV_EXT_INFO_CHANGED,
171 MGMT_EV_PHY_CONFIGURATION_CHANGED,
172 MGMT_EV_EXP_FEATURE_CHANGED,
173 MGMT_EV_DEVICE_FLAGS_CHANGED,
174 MGMT_EV_ADV_MONITOR_ADDED,
175 MGMT_EV_ADV_MONITOR_REMOVED,
176 MGMT_EV_CONTROLLER_SUSPEND,
177 MGMT_EV_CONTROLLER_RESUME,
178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
179 MGMT_EV_ADV_MONITOR_DEVICE_LOST,
180 };
181
182 static const u16 mgmt_untrusted_commands[] = {
183 MGMT_OP_READ_INDEX_LIST,
184 MGMT_OP_READ_INFO,
185 MGMT_OP_READ_UNCONF_INDEX_LIST,
186 MGMT_OP_READ_CONFIG_INFO,
187 MGMT_OP_READ_EXT_INDEX_LIST,
188 MGMT_OP_READ_EXT_INFO,
189 MGMT_OP_READ_CONTROLLER_CAP,
190 MGMT_OP_READ_EXP_FEATURES_INFO,
191 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
192 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
193 };
194
195 static const u16 mgmt_untrusted_events[] = {
196 MGMT_EV_INDEX_ADDED,
197 MGMT_EV_INDEX_REMOVED,
198 MGMT_EV_NEW_SETTINGS,
199 MGMT_EV_CLASS_OF_DEV_CHANGED,
200 MGMT_EV_LOCAL_NAME_CHANGED,
201 MGMT_EV_UNCONF_INDEX_ADDED,
202 MGMT_EV_UNCONF_INDEX_REMOVED,
203 MGMT_EV_NEW_CONFIG_OPTIONS,
204 MGMT_EV_EXT_INDEX_ADDED,
205 MGMT_EV_EXT_INDEX_REMOVED,
206 MGMT_EV_EXT_INFO_CHANGED,
207 MGMT_EV_EXP_FEATURE_CHANGED,
208 };
209
210 #define CACHE_TIMEOUT secs_to_jiffies(2)
211
212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
213 "\x00\x00\x00\x00\x00\x00\x00\x00"
214
215 /* HCI to MGMT error code conversion table */
216 static const u8 mgmt_status_table[] = {
217 MGMT_STATUS_SUCCESS,
218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
220 MGMT_STATUS_FAILED, /* Hardware Failure */
221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
229 MGMT_STATUS_BUSY, /* Command Disallowed */
230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
231 MGMT_STATUS_REJECTED, /* Rejected Security */
232 MGMT_STATUS_REJECTED, /* Rejected Personal */
233 MGMT_STATUS_TIMEOUT, /* Host Timeout */
234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
240 MGMT_STATUS_BUSY, /* Repeated Attempts */
241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
248 MGMT_STATUS_FAILED, /* Unspecified Error */
249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
255 MGMT_STATUS_FAILED, /* Unit Link Key Used */
256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
257 MGMT_STATUS_TIMEOUT, /* Instant Passed */
258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
259 MGMT_STATUS_FAILED, /* Transaction Collision */
260 MGMT_STATUS_FAILED, /* Reserved for future use */
261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
262 MGMT_STATUS_REJECTED, /* QoS Rejected */
263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
264 MGMT_STATUS_REJECTED, /* Insufficient Security */
265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
266 MGMT_STATUS_FAILED, /* Reserved for future use */
267 MGMT_STATUS_BUSY, /* Role Switch Pending */
268 MGMT_STATUS_FAILED, /* Reserved for future use */
269 MGMT_STATUS_FAILED, /* Slot Violation */
270 MGMT_STATUS_FAILED, /* Role Switch Failed */
271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
273 MGMT_STATUS_BUSY, /* Host Busy Pairing */
274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
275 MGMT_STATUS_BUSY, /* Controller Busy */
276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
281 };
282
mgmt_errno_status(int err)283 static u8 mgmt_errno_status(int err)
284 {
285 switch (err) {
286 case 0:
287 return MGMT_STATUS_SUCCESS;
288 case -EPERM:
289 return MGMT_STATUS_REJECTED;
290 case -EINVAL:
291 return MGMT_STATUS_INVALID_PARAMS;
292 case -EOPNOTSUPP:
293 return MGMT_STATUS_NOT_SUPPORTED;
294 case -EBUSY:
295 return MGMT_STATUS_BUSY;
296 case -ETIMEDOUT:
297 return MGMT_STATUS_AUTH_FAILED;
298 case -ENOMEM:
299 return MGMT_STATUS_NO_RESOURCES;
300 case -EISCONN:
301 return MGMT_STATUS_ALREADY_CONNECTED;
302 case -ENOTCONN:
303 return MGMT_STATUS_DISCONNECTED;
304 }
305
306 return MGMT_STATUS_FAILED;
307 }
308
mgmt_status(int err)309 static u8 mgmt_status(int err)
310 {
311 if (err < 0)
312 return mgmt_errno_status(err);
313
314 if (err < ARRAY_SIZE(mgmt_status_table))
315 return mgmt_status_table[err];
316
317 return MGMT_STATUS_FAILED;
318 }
319
mgmt_index_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag)320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
321 u16 len, int flag)
322 {
323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
324 flag, NULL);
325 }
326
mgmt_limited_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag,struct sock * skip_sk)327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
328 u16 len, int flag, struct sock *skip_sk)
329 {
330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
331 flag, skip_sk);
332 }
333
mgmt_event(u16 event,struct hci_dev * hdev,void * data,u16 len,struct sock * skip_sk)334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
335 struct sock *skip_sk)
336 {
337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
338 HCI_SOCK_TRUSTED, skip_sk);
339 }
340
mgmt_event_skb(struct sk_buff * skb,struct sock * skip_sk)341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
342 {
343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
344 skip_sk);
345 }
346
le_addr_type(u8 mgmt_addr_type)347 static u8 le_addr_type(u8 mgmt_addr_type)
348 {
349 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
350 return ADDR_LE_DEV_PUBLIC;
351 else
352 return ADDR_LE_DEV_RANDOM;
353 }
354
mgmt_fill_version_info(void * ver)355 void mgmt_fill_version_info(void *ver)
356 {
357 struct mgmt_rp_read_version *rp = ver;
358
359 rp->version = MGMT_VERSION;
360 rp->revision = cpu_to_le16(MGMT_REVISION);
361 }
362
read_version(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
364 u16 data_len)
365 {
366 struct mgmt_rp_read_version rp;
367
368 bt_dev_dbg(hdev, "sock %p", sk);
369
370 mgmt_fill_version_info(&rp);
371
372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
373 &rp, sizeof(rp));
374 }
375
read_commands(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
377 u16 data_len)
378 {
379 struct mgmt_rp_read_commands *rp;
380 u16 num_commands, num_events;
381 size_t rp_size;
382 int i, err;
383
384 bt_dev_dbg(hdev, "sock %p", sk);
385
386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
387 num_commands = ARRAY_SIZE(mgmt_commands);
388 num_events = ARRAY_SIZE(mgmt_events);
389 } else {
390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
391 num_events = ARRAY_SIZE(mgmt_untrusted_events);
392 }
393
394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
395
396 rp = kmalloc(rp_size, GFP_KERNEL);
397 if (!rp)
398 return -ENOMEM;
399
400 rp->num_commands = cpu_to_le16(num_commands);
401 rp->num_events = cpu_to_le16(num_events);
402
403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
404 __le16 *opcode = rp->opcodes;
405
406 for (i = 0; i < num_commands; i++, opcode++)
407 put_unaligned_le16(mgmt_commands[i], opcode);
408
409 for (i = 0; i < num_events; i++, opcode++)
410 put_unaligned_le16(mgmt_events[i], opcode);
411 } else {
412 __le16 *opcode = rp->opcodes;
413
414 for (i = 0; i < num_commands; i++, opcode++)
415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
416
417 for (i = 0; i < num_events; i++, opcode++)
418 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
419 }
420
421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
422 rp, rp_size);
423 kfree(rp);
424
425 return err;
426 }
427
read_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
429 u16 data_len)
430 {
431 struct mgmt_rp_read_index_list *rp;
432 struct hci_dev *d;
433 size_t rp_len;
434 u16 count;
435 int err;
436
437 bt_dev_dbg(hdev, "sock %p", sk);
438
439 read_lock(&hci_dev_list_lock);
440
441 count = 0;
442 list_for_each_entry(d, &hci_dev_list, list) {
443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED))
444 count++;
445 }
446
447 rp_len = sizeof(*rp) + (2 * count);
448 rp = kmalloc(rp_len, GFP_ATOMIC);
449 if (!rp) {
450 read_unlock(&hci_dev_list_lock);
451 return -ENOMEM;
452 }
453
454 count = 0;
455 list_for_each_entry(d, &hci_dev_list, list) {
456 if (hci_dev_test_flag(d, HCI_SETUP) ||
457 hci_dev_test_flag(d, HCI_CONFIG) ||
458 hci_dev_test_flag(d, HCI_USER_CHANNEL))
459 continue;
460
461 /* Devices marked as raw-only are neither configured
462 * nor unconfigured controllers.
463 */
464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
465 continue;
466
467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
468 rp->index[count++] = cpu_to_le16(d->id);
469 bt_dev_dbg(hdev, "Added hci%u", d->id);
470 }
471 }
472
473 rp->num_controllers = cpu_to_le16(count);
474 rp_len = sizeof(*rp) + (2 * count);
475
476 read_unlock(&hci_dev_list_lock);
477
478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
479 0, rp, rp_len);
480
481 kfree(rp);
482
483 return err;
484 }
485
read_unconf_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
487 void *data, u16 data_len)
488 {
489 struct mgmt_rp_read_unconf_index_list *rp;
490 struct hci_dev *d;
491 size_t rp_len;
492 u16 count;
493 int err;
494
495 bt_dev_dbg(hdev, "sock %p", sk);
496
497 read_lock(&hci_dev_list_lock);
498
499 count = list_count_nodes(&hci_dev_list);
500
501 rp_len = sizeof(*rp) + (sizeof(__le16) * count);
502 rp = kmalloc(rp_len, GFP_ATOMIC);
503 if (!rp) {
504 read_unlock(&hci_dev_list_lock);
505 return -ENOMEM;
506 }
507
508 count = 0;
509 list_for_each_entry(d, &hci_dev_list, list) {
510 if (hci_dev_test_flag(d, HCI_SETUP) ||
511 hci_dev_test_flag(d, HCI_CONFIG) ||
512 hci_dev_test_flag(d, HCI_USER_CHANNEL))
513 continue;
514
515 /* Devices marked as raw-only are neither configured
516 * nor unconfigured controllers.
517 */
518 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
519 continue;
520
521 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
522 rp->index[count++] = cpu_to_le16(d->id);
523 bt_dev_dbg(hdev, "Added hci%u", d->id);
524 }
525 }
526
527 rp->num_controllers = cpu_to_le16(count);
528 rp_len = sizeof(*rp) + (2 * count);
529
530 read_unlock(&hci_dev_list_lock);
531
532 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
533 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
534
535 kfree(rp);
536
537 return err;
538 }
539
read_ext_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)540 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
541 void *data, u16 data_len)
542 {
543 struct mgmt_rp_read_ext_index_list *rp;
544 struct hci_dev *d;
545 u16 count;
546 int err;
547
548 bt_dev_dbg(hdev, "sock %p", sk);
549
550 read_lock(&hci_dev_list_lock);
551
552 count = 0;
553 list_for_each_entry(d, &hci_dev_list, list)
554 count++;
555
556 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC);
557 if (!rp) {
558 read_unlock(&hci_dev_list_lock);
559 return -ENOMEM;
560 }
561
562 count = 0;
563 list_for_each_entry(d, &hci_dev_list, list) {
564 if (hci_dev_test_flag(d, HCI_SETUP) ||
565 hci_dev_test_flag(d, HCI_CONFIG) ||
566 hci_dev_test_flag(d, HCI_USER_CHANNEL))
567 continue;
568
569 /* Devices marked as raw-only are neither configured
570 * nor unconfigured controllers.
571 */
572 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
573 continue;
574
575 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
576 rp->entry[count].type = 0x01;
577 else
578 rp->entry[count].type = 0x00;
579
580 rp->entry[count].bus = d->bus;
581 rp->entry[count++].index = cpu_to_le16(d->id);
582 bt_dev_dbg(hdev, "Added hci%u", d->id);
583 }
584
585 rp->num_controllers = cpu_to_le16(count);
586
587 read_unlock(&hci_dev_list_lock);
588
589 /* If this command is called at least once, then all the
590 * default index and unconfigured index events are disabled
591 * and from now on only extended index events are used.
592 */
593 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
594 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
595 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
596
597 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
598 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
599 struct_size(rp, entry, count));
600
601 kfree(rp);
602
603 return err;
604 }
605
is_configured(struct hci_dev * hdev)606 static bool is_configured(struct hci_dev *hdev)
607 {
608 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) &&
609 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
610 return false;
611
612 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) ||
613 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) &&
614 !bacmp(&hdev->public_addr, BDADDR_ANY))
615 return false;
616
617 return true;
618 }
619
get_missing_options(struct hci_dev * hdev)620 static __le32 get_missing_options(struct hci_dev *hdev)
621 {
622 u32 options = 0;
623
624 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) &&
625 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
626 options |= MGMT_OPTION_EXTERNAL_CONFIG;
627
628 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) ||
629 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) &&
630 !bacmp(&hdev->public_addr, BDADDR_ANY))
631 options |= MGMT_OPTION_PUBLIC_ADDRESS;
632
633 return cpu_to_le32(options);
634 }
635
new_options(struct hci_dev * hdev,struct sock * skip)636 static int new_options(struct hci_dev *hdev, struct sock *skip)
637 {
638 __le32 options = get_missing_options(hdev);
639
640 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
641 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
642 }
643
send_options_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)644 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
645 {
646 __le32 options = get_missing_options(hdev);
647
648 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
649 sizeof(options));
650 }
651
read_config_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)652 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
653 void *data, u16 data_len)
654 {
655 struct mgmt_rp_read_config_info rp;
656 u32 options = 0;
657
658 bt_dev_dbg(hdev, "sock %p", sk);
659
660 hci_dev_lock(hdev);
661
662 memset(&rp, 0, sizeof(rp));
663 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
664
665 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG))
666 options |= MGMT_OPTION_EXTERNAL_CONFIG;
667
668 if (hdev->set_bdaddr)
669 options |= MGMT_OPTION_PUBLIC_ADDRESS;
670
671 rp.supported_options = cpu_to_le32(options);
672 rp.missing_options = get_missing_options(hdev);
673
674 hci_dev_unlock(hdev);
675
676 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
677 &rp, sizeof(rp));
678 }
679
get_supported_phys(struct hci_dev * hdev)680 static u32 get_supported_phys(struct hci_dev *hdev)
681 {
682 u32 supported_phys = 0;
683
684 if (lmp_bredr_capable(hdev)) {
685 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
686
687 if (hdev->features[0][0] & LMP_3SLOT)
688 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
689
690 if (hdev->features[0][0] & LMP_5SLOT)
691 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
692
693 if (lmp_edr_2m_capable(hdev)) {
694 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
695
696 if (lmp_edr_3slot_capable(hdev))
697 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
698
699 if (lmp_edr_5slot_capable(hdev))
700 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
701
702 if (lmp_edr_3m_capable(hdev)) {
703 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
704
705 if (lmp_edr_3slot_capable(hdev))
706 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
707
708 if (lmp_edr_5slot_capable(hdev))
709 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
710 }
711 }
712 }
713
714 if (lmp_le_capable(hdev)) {
715 supported_phys |= MGMT_PHY_LE_1M_TX;
716 supported_phys |= MGMT_PHY_LE_1M_RX;
717
718 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
719 supported_phys |= MGMT_PHY_LE_2M_TX;
720 supported_phys |= MGMT_PHY_LE_2M_RX;
721 }
722
723 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
724 supported_phys |= MGMT_PHY_LE_CODED_TX;
725 supported_phys |= MGMT_PHY_LE_CODED_RX;
726 }
727 }
728
729 return supported_phys;
730 }
731
get_selected_phys(struct hci_dev * hdev)732 static u32 get_selected_phys(struct hci_dev *hdev)
733 {
734 u32 selected_phys = 0;
735
736 if (lmp_bredr_capable(hdev)) {
737 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
738
739 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
740 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
741
742 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
743 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
744
745 if (lmp_edr_2m_capable(hdev)) {
746 if (!(hdev->pkt_type & HCI_2DH1))
747 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
748
749 if (lmp_edr_3slot_capable(hdev) &&
750 !(hdev->pkt_type & HCI_2DH3))
751 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
752
753 if (lmp_edr_5slot_capable(hdev) &&
754 !(hdev->pkt_type & HCI_2DH5))
755 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
756
757 if (lmp_edr_3m_capable(hdev)) {
758 if (!(hdev->pkt_type & HCI_3DH1))
759 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
760
761 if (lmp_edr_3slot_capable(hdev) &&
762 !(hdev->pkt_type & HCI_3DH3))
763 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
764
765 if (lmp_edr_5slot_capable(hdev) &&
766 !(hdev->pkt_type & HCI_3DH5))
767 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
768 }
769 }
770 }
771
772 if (lmp_le_capable(hdev)) {
773 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
774 selected_phys |= MGMT_PHY_LE_1M_TX;
775
776 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
777 selected_phys |= MGMT_PHY_LE_1M_RX;
778
779 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
780 selected_phys |= MGMT_PHY_LE_2M_TX;
781
782 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
783 selected_phys |= MGMT_PHY_LE_2M_RX;
784
785 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
786 selected_phys |= MGMT_PHY_LE_CODED_TX;
787
788 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
789 selected_phys |= MGMT_PHY_LE_CODED_RX;
790 }
791
792 return selected_phys;
793 }
794
get_configurable_phys(struct hci_dev * hdev)795 static u32 get_configurable_phys(struct hci_dev *hdev)
796 {
797 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
798 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
799 }
800
get_supported_settings(struct hci_dev * hdev)801 static u32 get_supported_settings(struct hci_dev *hdev)
802 {
803 u32 settings = 0;
804
805 settings |= MGMT_SETTING_POWERED;
806 settings |= MGMT_SETTING_BONDABLE;
807 settings |= MGMT_SETTING_DEBUG_KEYS;
808 settings |= MGMT_SETTING_CONNECTABLE;
809 settings |= MGMT_SETTING_DISCOVERABLE;
810
811 if (lmp_bredr_capable(hdev)) {
812 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
813 settings |= MGMT_SETTING_FAST_CONNECTABLE;
814 settings |= MGMT_SETTING_BREDR;
815 settings |= MGMT_SETTING_LINK_SECURITY;
816
817 if (lmp_ssp_capable(hdev)) {
818 settings |= MGMT_SETTING_SSP;
819 }
820
821 if (lmp_sc_capable(hdev))
822 settings |= MGMT_SETTING_SECURE_CONN;
823
824 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED))
825 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
826 }
827
828 if (lmp_le_capable(hdev)) {
829 settings |= MGMT_SETTING_LE;
830 settings |= MGMT_SETTING_SECURE_CONN;
831 settings |= MGMT_SETTING_PRIVACY;
832 settings |= MGMT_SETTING_STATIC_ADDRESS;
833 settings |= MGMT_SETTING_ADVERTISING;
834 }
835
836 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr)
837 settings |= MGMT_SETTING_CONFIGURATION;
838
839 if (cis_central_capable(hdev))
840 settings |= MGMT_SETTING_CIS_CENTRAL;
841
842 if (cis_peripheral_capable(hdev))
843 settings |= MGMT_SETTING_CIS_PERIPHERAL;
844
845 if (bis_capable(hdev))
846 settings |= MGMT_SETTING_ISO_BROADCASTER;
847
848 if (sync_recv_capable(hdev))
849 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
850
851 if (ll_privacy_capable(hdev))
852 settings |= MGMT_SETTING_LL_PRIVACY;
853
854 if (past_sender_capable(hdev))
855 settings |= MGMT_SETTING_PAST_SENDER;
856
857 if (past_receiver_capable(hdev))
858 settings |= MGMT_SETTING_PAST_RECEIVER;
859
860 if (le_sci_capable(hdev))
861 settings |= MGMT_SETTING_SCI;
862
863 settings |= MGMT_SETTING_PHY_CONFIGURATION;
864
865 return settings;
866 }
867
get_current_settings(struct hci_dev * hdev)868 static u32 get_current_settings(struct hci_dev *hdev)
869 {
870 u32 settings = 0;
871
872 if (hdev_is_powered(hdev))
873 settings |= MGMT_SETTING_POWERED;
874
875 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
876 settings |= MGMT_SETTING_CONNECTABLE;
877
878 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
879 settings |= MGMT_SETTING_FAST_CONNECTABLE;
880
881 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
882 settings |= MGMT_SETTING_DISCOVERABLE;
883
884 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
885 settings |= MGMT_SETTING_BONDABLE;
886
887 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
888 settings |= MGMT_SETTING_BREDR;
889
890 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
891 settings |= MGMT_SETTING_LE;
892
893 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
894 settings |= MGMT_SETTING_LINK_SECURITY;
895
896 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
897 settings |= MGMT_SETTING_SSP;
898
899 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
900 settings |= MGMT_SETTING_ADVERTISING;
901
902 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
903 settings |= MGMT_SETTING_SECURE_CONN;
904
905 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
906 settings |= MGMT_SETTING_DEBUG_KEYS;
907
908 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
909 settings |= MGMT_SETTING_PRIVACY;
910
911 /* The current setting for static address has two purposes. The
912 * first is to indicate if the static address will be used and
913 * the second is to indicate if it is actually set.
914 *
915 * This means if the static address is not configured, this flag
916 * will never be set. If the address is configured, then if the
917 * address is actually used decides if the flag is set or not.
918 *
919 * For single mode LE only controllers and dual-mode controllers
920 * with BR/EDR disabled, the existence of the static address will
921 * be evaluated.
922 */
923 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
924 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
925 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
926 if (bacmp(&hdev->static_addr, BDADDR_ANY))
927 settings |= MGMT_SETTING_STATIC_ADDRESS;
928 }
929
930 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
931 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
932
933 if (cis_central_enabled(hdev))
934 settings |= MGMT_SETTING_CIS_CENTRAL;
935
936 if (cis_peripheral_enabled(hdev))
937 settings |= MGMT_SETTING_CIS_PERIPHERAL;
938
939 if (bis_enabled(hdev))
940 settings |= MGMT_SETTING_ISO_BROADCASTER;
941
942 if (sync_recv_enabled(hdev))
943 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
944
945 if (ll_privacy_enabled(hdev))
946 settings |= MGMT_SETTING_LL_PRIVACY;
947
948 if (past_sender_enabled(hdev))
949 settings |= MGMT_SETTING_PAST_SENDER;
950
951 if (past_receiver_enabled(hdev))
952 settings |= MGMT_SETTING_PAST_RECEIVER;
953
954 if (le_sci_enabled(hdev))
955 settings |= MGMT_SETTING_SCI;
956
957 return settings;
958 }
959
pending_find(u16 opcode,struct hci_dev * hdev)960 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
961 {
962 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
963 }
964
mgmt_get_adv_discov_flags(struct hci_dev * hdev)965 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
966 {
967 struct mgmt_pending_cmd *cmd;
968
969 /* If there's a pending mgmt command the flags will not yet have
970 * their final values, so check for this first.
971 */
972 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
973 if (cmd) {
974 struct mgmt_mode *cp = cmd->param;
975 if (cp->val == 0x01)
976 return LE_AD_GENERAL;
977 else if (cp->val == 0x02)
978 return LE_AD_LIMITED;
979 } else {
980 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
981 return LE_AD_LIMITED;
982 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
983 return LE_AD_GENERAL;
984 }
985
986 return 0;
987 }
988
mgmt_get_connectable(struct hci_dev * hdev)989 bool mgmt_get_connectable(struct hci_dev *hdev)
990 {
991 struct mgmt_pending_cmd *cmd;
992
993 /* If there's a pending mgmt command the flag will not yet have
994 * it's final value, so check for this first.
995 */
996 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
997 if (cmd) {
998 struct mgmt_mode *cp = cmd->param;
999
1000 return cp->val;
1001 }
1002
1003 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1004 }
1005
service_cache_sync(struct hci_dev * hdev,void * data)1006 static int service_cache_sync(struct hci_dev *hdev, void *data)
1007 {
1008 hci_update_eir_sync(hdev);
1009 hci_update_class_sync(hdev);
1010
1011 return 0;
1012 }
1013
service_cache_off(struct work_struct * work)1014 static void service_cache_off(struct work_struct *work)
1015 {
1016 struct hci_dev *hdev = container_of(work, struct hci_dev,
1017 service_cache.work);
1018
1019 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1020 return;
1021
1022 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1023 }
1024
rpa_expired_sync(struct hci_dev * hdev,void * data)1025 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1026 {
1027 /* The generation of a new RPA and programming it into the
1028 * controller happens in the hci_req_enable_advertising()
1029 * function.
1030 */
1031 if (ext_adv_capable(hdev))
1032 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1033 else
1034 return hci_enable_advertising_sync(hdev);
1035 }
1036
rpa_expired(struct work_struct * work)1037 static void rpa_expired(struct work_struct *work)
1038 {
1039 struct hci_dev *hdev = container_of(work, struct hci_dev,
1040 rpa_expired.work);
1041
1042 bt_dev_dbg(hdev, "");
1043
1044 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1045
1046 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1047 return;
1048
1049 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1050 }
1051
1052 static int set_discoverable_sync(struct hci_dev *hdev, void *data);
1053
discov_off(struct work_struct * work)1054 static void discov_off(struct work_struct *work)
1055 {
1056 struct hci_dev *hdev = container_of(work, struct hci_dev,
1057 discov_off.work);
1058
1059 bt_dev_dbg(hdev, "");
1060
1061 hci_dev_lock(hdev);
1062
1063 /* When discoverable timeout triggers, then just make sure
1064 * the limited discoverable flag is cleared. Even in the case
1065 * of a timeout triggered from general discoverable, it is
1066 * safe to unconditionally clear the flag.
1067 */
1068 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1069 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1070 hdev->discov_timeout = 0;
1071
1072 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL);
1073
1074 mgmt_new_settings(hdev);
1075
1076 hci_dev_unlock(hdev);
1077 }
1078
1079 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1080
mesh_send_complete(struct hci_dev * hdev,struct mgmt_mesh_tx * mesh_tx,bool silent)1081 static void mesh_send_complete(struct hci_dev *hdev,
1082 struct mgmt_mesh_tx *mesh_tx, bool silent)
1083 {
1084 u8 handle = mesh_tx->handle;
1085
1086 if (!silent)
1087 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1088 sizeof(handle), NULL);
1089
1090 mgmt_mesh_remove(mesh_tx);
1091 }
1092
mesh_send_done_sync(struct hci_dev * hdev,void * data)1093 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1094 {
1095 struct mgmt_mesh_tx *mesh_tx;
1096
1097 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1098 if (list_empty(&hdev->adv_instances))
1099 hci_disable_advertising_sync(hdev);
1100 mesh_tx = mgmt_mesh_next(hdev, NULL);
1101
1102 if (mesh_tx)
1103 mesh_send_complete(hdev, mesh_tx, false);
1104
1105 return 0;
1106 }
1107
1108 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1109 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
mesh_next(struct hci_dev * hdev,void * data,int err)1110 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1111 {
1112 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1113
1114 if (!mesh_tx)
1115 return;
1116
1117 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1118 mesh_send_start_complete);
1119
1120 if (err < 0)
1121 mesh_send_complete(hdev, mesh_tx, false);
1122 else
1123 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1124 }
1125
mesh_send_done(struct work_struct * work)1126 static void mesh_send_done(struct work_struct *work)
1127 {
1128 struct hci_dev *hdev = container_of(work, struct hci_dev,
1129 mesh_send_done.work);
1130
1131 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1132 return;
1133
1134 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1135 }
1136
mgmt_init_hdev(struct sock * sk,struct hci_dev * hdev)1137 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1138 {
1139 if (hci_dev_test_flag(hdev, HCI_MGMT))
1140 return;
1141
1142 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1143
1144 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1145 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1146 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1147 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1148
1149 /* Non-mgmt controlled devices get this bit set
1150 * implicitly so that pairing works for them, however
1151 * for mgmt we require user-space to explicitly enable
1152 * it
1153 */
1154 hci_dev_clear_flag(hdev, HCI_BONDABLE);
1155
1156 hci_dev_set_flag(hdev, HCI_MGMT);
1157 }
1158
read_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1160 void *data, u16 data_len)
1161 {
1162 struct mgmt_rp_read_info rp;
1163
1164 bt_dev_dbg(hdev, "sock %p", sk);
1165
1166 hci_dev_lock(hdev);
1167
1168 memset(&rp, 0, sizeof(rp));
1169
1170 bacpy(&rp.bdaddr, &hdev->bdaddr);
1171
1172 rp.version = hdev->hci_ver;
1173 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1174
1175 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1176 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1177
1178 memcpy(rp.dev_class, hdev->dev_class, 3);
1179
1180 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1181 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1182
1183 hci_dev_unlock(hdev);
1184
1185 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1186 sizeof(rp));
1187 }
1188
append_eir_data_to_buf(struct hci_dev * hdev,u8 * eir)1189 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1190 {
1191 u16 eir_len = 0;
1192 size_t name_len;
1193
1194 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1195 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1196 hdev->dev_class, 3);
1197
1198 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1199 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1200 hdev->appearance);
1201
1202 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1203 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1204 hdev->dev_name, name_len);
1205
1206 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1207 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1208 hdev->short_name, name_len);
1209
1210 return eir_len;
1211 }
1212
read_ext_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1213 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1214 void *data, u16 data_len)
1215 {
1216 char buf[512];
1217 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1218 u16 eir_len;
1219
1220 bt_dev_dbg(hdev, "sock %p", sk);
1221
1222 memset(&buf, 0, sizeof(buf));
1223
1224 hci_dev_lock(hdev);
1225
1226 bacpy(&rp->bdaddr, &hdev->bdaddr);
1227
1228 rp->version = hdev->hci_ver;
1229 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1230
1231 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1232 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1233
1234
1235 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1236 rp->eir_len = cpu_to_le16(eir_len);
1237
1238 hci_dev_unlock(hdev);
1239
1240 /* If this command is called at least once, then the events
1241 * for class of device and local name changes are disabled
1242 * and only the new extended controller information event
1243 * is used.
1244 */
1245 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1246 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1247 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1248
1249 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1250 sizeof(*rp) + eir_len);
1251 }
1252
ext_info_changed(struct hci_dev * hdev,struct sock * skip)1253 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1254 {
1255 char buf[512];
1256 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1257 u16 eir_len;
1258
1259 memset(buf, 0, sizeof(buf));
1260
1261 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1262 ev->eir_len = cpu_to_le16(eir_len);
1263
1264 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1265 sizeof(*ev) + eir_len,
1266 HCI_MGMT_EXT_INFO_EVENTS, skip);
1267 }
1268
send_settings_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)1269 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1270 {
1271 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1272
1273 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1274 sizeof(settings));
1275 }
1276
mgmt_advertising_added(struct sock * sk,struct hci_dev * hdev,u8 instance)1277 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1278 {
1279 struct mgmt_ev_advertising_added ev;
1280
1281 ev.instance = instance;
1282
1283 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1284 }
1285
mgmt_advertising_removed(struct sock * sk,struct hci_dev * hdev,u8 instance)1286 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1287 u8 instance)
1288 {
1289 struct mgmt_ev_advertising_removed ev;
1290
1291 ev.instance = instance;
1292
1293 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1294 }
1295
cancel_adv_timeout(struct hci_dev * hdev)1296 static void cancel_adv_timeout(struct hci_dev *hdev)
1297 {
1298 if (hdev->adv_instance_timeout) {
1299 hdev->adv_instance_timeout = 0;
1300 cancel_delayed_work(&hdev->adv_instance_expire);
1301 }
1302 }
1303
1304 /* This function requires the caller holds hdev->lock */
restart_le_actions(struct hci_dev * hdev)1305 static void restart_le_actions(struct hci_dev *hdev)
1306 {
1307 struct hci_conn_params *p;
1308
1309 list_for_each_entry(p, &hdev->le_conn_params, list) {
1310 /* Needed for AUTO_OFF case where might not "really"
1311 * have been powered off.
1312 */
1313 hci_pend_le_list_del_init(p);
1314
1315 switch (p->auto_connect) {
1316 case HCI_AUTO_CONN_DIRECT:
1317 case HCI_AUTO_CONN_ALWAYS:
1318 hci_pend_le_list_add(p, &hdev->pend_le_conns);
1319 break;
1320 case HCI_AUTO_CONN_REPORT:
1321 hci_pend_le_list_add(p, &hdev->pend_le_reports);
1322 break;
1323 default:
1324 break;
1325 }
1326 }
1327 }
1328
new_settings(struct hci_dev * hdev,struct sock * skip)1329 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1330 {
1331 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1332
1333 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1334 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1335 }
1336
mgmt_set_powered_complete(struct hci_dev * hdev,void * data,int err)1337 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1338 {
1339 struct mgmt_pending_cmd *cmd = data;
1340 struct mgmt_mode *cp;
1341
1342 /* Make sure cmd still outstanding. */
1343 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1344 return;
1345
1346 cp = cmd->param;
1347
1348 bt_dev_dbg(hdev, "err %d", err);
1349
1350 if (!err) {
1351 if (cp->val) {
1352 hci_dev_lock(hdev);
1353 restart_le_actions(hdev);
1354 hci_update_passive_scan(hdev);
1355 hci_dev_unlock(hdev);
1356 }
1357
1358 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1359
1360 /* Only call new_setting for power on as power off is deferred
1361 * to hdev->power_off work which does call hci_dev_do_close.
1362 */
1363 if (cp->val)
1364 new_settings(hdev, cmd->sk);
1365 } else {
1366 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1367 mgmt_status(err));
1368 }
1369
1370 mgmt_pending_free(cmd);
1371 }
1372
set_powered_sync(struct hci_dev * hdev,void * data)1373 static int set_powered_sync(struct hci_dev *hdev, void *data)
1374 {
1375 struct mgmt_pending_cmd *cmd = data;
1376 struct mgmt_mode cp;
1377
1378 mutex_lock(&hdev->mgmt_pending_lock);
1379
1380 /* Make sure cmd still outstanding. */
1381 if (!__mgmt_pending_listed(hdev, cmd)) {
1382 mutex_unlock(&hdev->mgmt_pending_lock);
1383 return -ECANCELED;
1384 }
1385
1386 memcpy(&cp, cmd->param, sizeof(cp));
1387
1388 mutex_unlock(&hdev->mgmt_pending_lock);
1389
1390 BT_DBG("%s", hdev->name);
1391
1392 return hci_set_powered_sync(hdev, cp.val);
1393 }
1394
set_powered(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1395 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1396 u16 len)
1397 {
1398 struct mgmt_mode *cp = data;
1399 struct mgmt_pending_cmd *cmd;
1400 int err;
1401
1402 bt_dev_dbg(hdev, "sock %p", sk);
1403
1404 if (cp->val != 0x00 && cp->val != 0x01)
1405 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1406 MGMT_STATUS_INVALID_PARAMS);
1407
1408 hci_dev_lock(hdev);
1409
1410 if (!cp->val) {
1411 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
1412 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1413 MGMT_STATUS_BUSY);
1414 goto failed;
1415 }
1416 }
1417
1418 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1419 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1420 MGMT_STATUS_BUSY);
1421 goto failed;
1422 }
1423
1424 if (!!cp->val == hdev_is_powered(hdev)) {
1425 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1426 goto failed;
1427 }
1428
1429 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1430 if (!cmd) {
1431 err = -ENOMEM;
1432 goto failed;
1433 }
1434
1435 /* Cancel potentially blocking sync operation before power off */
1436 if (cp->val == 0x00) {
1437 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
1438 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1439 mgmt_set_powered_complete);
1440 } else {
1441 /* Use hci_cmd_sync_submit since hdev might not be running */
1442 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1443 mgmt_set_powered_complete);
1444 }
1445
1446 if (err < 0)
1447 mgmt_pending_remove(cmd);
1448
1449 failed:
1450 hci_dev_unlock(hdev);
1451 return err;
1452 }
1453
mgmt_new_settings(struct hci_dev * hdev)1454 int mgmt_new_settings(struct hci_dev *hdev)
1455 {
1456 return new_settings(hdev, NULL);
1457 }
1458
1459 struct cmd_lookup {
1460 struct sock *sk;
1461 struct hci_dev *hdev;
1462 u8 mgmt_status;
1463 };
1464
settings_rsp(struct mgmt_pending_cmd * cmd,void * data)1465 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1466 {
1467 struct cmd_lookup *match = data;
1468
1469 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1470
1471 if (match->sk == NULL) {
1472 match->sk = cmd->sk;
1473 sock_hold(match->sk);
1474 }
1475 }
1476
cmd_status_rsp(struct mgmt_pending_cmd * cmd,void * data)1477 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1478 {
1479 u8 *status = data;
1480
1481 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status);
1482 }
1483
cmd_complete_rsp(struct mgmt_pending_cmd * cmd,void * data)1484 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1485 {
1486 struct cmd_lookup *match = data;
1487
1488 /* dequeue cmd_sync entries using cmd as data as that is about to be
1489 * removed/freed.
1490 */
1491 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
1492
1493 if (cmd->cmd_complete) {
1494 cmd->cmd_complete(cmd, match->mgmt_status);
1495 return;
1496 }
1497
1498 cmd_status_rsp(cmd, data);
1499 }
1500
generic_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1501 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1502 {
1503 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,
1504 cmd->param, cmd->param_len);
1505 }
1506
addr_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1507 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1508 {
1509 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,
1510 cmd->param, sizeof(struct mgmt_addr_info));
1511 }
1512
mgmt_bredr_support(struct hci_dev * hdev)1513 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1514 {
1515 if (!lmp_bredr_capable(hdev))
1516 return MGMT_STATUS_NOT_SUPPORTED;
1517 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1518 return MGMT_STATUS_REJECTED;
1519 else
1520 return MGMT_STATUS_SUCCESS;
1521 }
1522
mgmt_le_support(struct hci_dev * hdev)1523 static u8 mgmt_le_support(struct hci_dev *hdev)
1524 {
1525 if (!lmp_le_capable(hdev))
1526 return MGMT_STATUS_NOT_SUPPORTED;
1527 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1528 return MGMT_STATUS_REJECTED;
1529 else
1530 return MGMT_STATUS_SUCCESS;
1531 }
1532
mgmt_set_discoverable_complete(struct hci_dev * hdev,void * data,int err)1533 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1534 int err)
1535 {
1536 struct mgmt_pending_cmd *cmd = data;
1537
1538 bt_dev_dbg(hdev, "err %d", err);
1539
1540 /* Make sure cmd still outstanding. */
1541 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1542 return;
1543
1544 hci_dev_lock(hdev);
1545
1546 if (err) {
1547 u8 mgmt_err = mgmt_status(err);
1548 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1549 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1550 goto done;
1551 }
1552
1553 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1554 hdev->discov_timeout > 0) {
1555 int to = secs_to_jiffies(hdev->discov_timeout);
1556 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1557 }
1558
1559 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1560 new_settings(hdev, cmd->sk);
1561
1562 done:
1563 mgmt_pending_free(cmd);
1564 hci_dev_unlock(hdev);
1565 }
1566
set_discoverable_sync(struct hci_dev * hdev,void * data)1567 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1568 {
1569 if (!mgmt_pending_listed(hdev, data))
1570 return -ECANCELED;
1571
1572 BT_DBG("%s", hdev->name);
1573
1574 return hci_update_discoverable_sync(hdev);
1575 }
1576
set_discoverable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1577 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1578 u16 len)
1579 {
1580 struct mgmt_cp_set_discoverable *cp = data;
1581 struct mgmt_pending_cmd *cmd;
1582 u16 timeout;
1583 int err;
1584
1585 bt_dev_dbg(hdev, "sock %p", sk);
1586
1587 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1588 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1589 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1590 MGMT_STATUS_REJECTED);
1591
1592 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1594 MGMT_STATUS_INVALID_PARAMS);
1595
1596 timeout = __le16_to_cpu(cp->timeout);
1597
1598 /* Disabling discoverable requires that no timeout is set,
1599 * and enabling limited discoverable requires a timeout.
1600 */
1601 if ((cp->val == 0x00 && timeout > 0) ||
1602 (cp->val == 0x02 && timeout == 0))
1603 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1604 MGMT_STATUS_INVALID_PARAMS);
1605
1606 hci_dev_lock(hdev);
1607
1608 if (!hdev_is_powered(hdev) && timeout > 0) {
1609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1610 MGMT_STATUS_NOT_POWERED);
1611 goto failed;
1612 }
1613
1614 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1615 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1616 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1617 MGMT_STATUS_BUSY);
1618 goto failed;
1619 }
1620
1621 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1622 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1623 MGMT_STATUS_REJECTED);
1624 goto failed;
1625 }
1626
1627 if (hdev->advertising_paused) {
1628 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1629 MGMT_STATUS_BUSY);
1630 goto failed;
1631 }
1632
1633 if (!hdev_is_powered(hdev)) {
1634 bool changed = false;
1635
1636 /* Setting limited discoverable when powered off is
1637 * not a valid operation since it requires a timeout
1638 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1639 */
1640 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1641 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1642 changed = true;
1643 }
1644
1645 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1646 if (err < 0)
1647 goto failed;
1648
1649 if (changed)
1650 err = new_settings(hdev, sk);
1651
1652 goto failed;
1653 }
1654
1655 /* If the current mode is the same, then just update the timeout
1656 * value with the new value. And if only the timeout gets updated,
1657 * then no need for any HCI transactions.
1658 */
1659 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1660 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1661 HCI_LIMITED_DISCOVERABLE)) {
1662 cancel_delayed_work(&hdev->discov_off);
1663 hdev->discov_timeout = timeout;
1664
1665 if (cp->val && hdev->discov_timeout > 0) {
1666 int to = secs_to_jiffies(hdev->discov_timeout);
1667 queue_delayed_work(hdev->req_workqueue,
1668 &hdev->discov_off, to);
1669 }
1670
1671 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1672 goto failed;
1673 }
1674
1675 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1676 if (!cmd) {
1677 err = -ENOMEM;
1678 goto failed;
1679 }
1680
1681 /* Cancel any potential discoverable timeout that might be
1682 * still active and store new timeout value. The arming of
1683 * the timeout happens in the complete handler.
1684 */
1685 cancel_delayed_work(&hdev->discov_off);
1686 hdev->discov_timeout = timeout;
1687
1688 if (cp->val)
1689 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1690 else
1691 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1692
1693 /* Limited discoverable mode */
1694 if (cp->val == 0x02)
1695 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1696 else
1697 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1698
1699 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1700 mgmt_set_discoverable_complete);
1701
1702 if (err < 0)
1703 mgmt_pending_remove(cmd);
1704
1705 failed:
1706 hci_dev_unlock(hdev);
1707 return err;
1708 }
1709
mgmt_set_connectable_complete(struct hci_dev * hdev,void * data,int err)1710 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1711 int err)
1712 {
1713 struct mgmt_pending_cmd *cmd = data;
1714
1715 bt_dev_dbg(hdev, "err %d", err);
1716
1717 /* Make sure cmd still outstanding. */
1718 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1719 return;
1720
1721 hci_dev_lock(hdev);
1722
1723 if (err) {
1724 u8 mgmt_err = mgmt_status(err);
1725 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1726 goto done;
1727 }
1728
1729 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1730 new_settings(hdev, cmd->sk);
1731
1732 done:
1733 mgmt_pending_free(cmd);
1734
1735 hci_dev_unlock(hdev);
1736 }
1737
set_connectable_update_settings(struct hci_dev * hdev,struct sock * sk,u8 val)1738 static int set_connectable_update_settings(struct hci_dev *hdev,
1739 struct sock *sk, u8 val)
1740 {
1741 bool changed = false;
1742 int err;
1743
1744 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1745 changed = true;
1746
1747 if (val) {
1748 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1749 } else {
1750 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1751 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1752 }
1753
1754 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1755 if (err < 0)
1756 return err;
1757
1758 if (changed) {
1759 hci_update_scan(hdev);
1760 hci_update_passive_scan(hdev);
1761 return new_settings(hdev, sk);
1762 }
1763
1764 return 0;
1765 }
1766
set_connectable_sync(struct hci_dev * hdev,void * data)1767 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1768 {
1769 if (!mgmt_pending_listed(hdev, data))
1770 return -ECANCELED;
1771
1772 BT_DBG("%s", hdev->name);
1773
1774 return hci_update_connectable_sync(hdev);
1775 }
1776
set_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1777 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1778 u16 len)
1779 {
1780 struct mgmt_mode *cp = data;
1781 struct mgmt_pending_cmd *cmd;
1782 int err;
1783
1784 bt_dev_dbg(hdev, "sock %p", sk);
1785
1786 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1787 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1788 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1789 MGMT_STATUS_REJECTED);
1790
1791 if (cp->val != 0x00 && cp->val != 0x01)
1792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1793 MGMT_STATUS_INVALID_PARAMS);
1794
1795 hci_dev_lock(hdev);
1796
1797 if (!hdev_is_powered(hdev)) {
1798 err = set_connectable_update_settings(hdev, sk, cp->val);
1799 goto failed;
1800 }
1801
1802 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1803 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1804 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1805 MGMT_STATUS_BUSY);
1806 goto failed;
1807 }
1808
1809 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1810 if (!cmd) {
1811 err = -ENOMEM;
1812 goto failed;
1813 }
1814
1815 if (cp->val) {
1816 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1817 } else {
1818 if (hdev->discov_timeout > 0)
1819 cancel_delayed_work(&hdev->discov_off);
1820
1821 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1822 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1823 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1824 }
1825
1826 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1827 mgmt_set_connectable_complete);
1828
1829 if (err < 0)
1830 mgmt_pending_remove(cmd);
1831
1832 failed:
1833 hci_dev_unlock(hdev);
1834 return err;
1835 }
1836
set_bondable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1837 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1838 u16 len)
1839 {
1840 struct mgmt_mode *cp = data;
1841 bool changed;
1842 int err;
1843
1844 bt_dev_dbg(hdev, "sock %p", sk);
1845
1846 if (cp->val != 0x00 && cp->val != 0x01)
1847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1848 MGMT_STATUS_INVALID_PARAMS);
1849
1850 hci_dev_lock(hdev);
1851
1852 if (cp->val)
1853 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1854 else
1855 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1856
1857 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1858 if (err < 0)
1859 goto unlock;
1860
1861 if (changed) {
1862 /* In limited privacy mode the change of bondable mode
1863 * may affect the local advertising address.
1864 */
1865 hci_update_discoverable(hdev);
1866
1867 err = new_settings(hdev, sk);
1868 }
1869
1870 unlock:
1871 hci_dev_unlock(hdev);
1872 return err;
1873 }
1874
set_link_security(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1875 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1876 u16 len)
1877 {
1878 struct mgmt_mode *cp = data;
1879 struct mgmt_pending_cmd *cmd;
1880 u8 val, status;
1881 int err;
1882
1883 bt_dev_dbg(hdev, "sock %p", sk);
1884
1885 status = mgmt_bredr_support(hdev);
1886 if (status)
1887 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1888 status);
1889
1890 if (cp->val != 0x00 && cp->val != 0x01)
1891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1892 MGMT_STATUS_INVALID_PARAMS);
1893
1894 hci_dev_lock(hdev);
1895
1896 if (!hdev_is_powered(hdev)) {
1897 bool changed = false;
1898
1899 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1900 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1901 changed = true;
1902 }
1903
1904 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1905 if (err < 0)
1906 goto failed;
1907
1908 if (changed)
1909 err = new_settings(hdev, sk);
1910
1911 goto failed;
1912 }
1913
1914 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1916 MGMT_STATUS_BUSY);
1917 goto failed;
1918 }
1919
1920 val = !!cp->val;
1921
1922 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1923 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1924 goto failed;
1925 }
1926
1927 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1928 if (!cmd) {
1929 err = -ENOMEM;
1930 goto failed;
1931 }
1932
1933 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1934 if (err < 0) {
1935 mgmt_pending_remove(cmd);
1936 goto failed;
1937 }
1938
1939 failed:
1940 hci_dev_unlock(hdev);
1941 return err;
1942 }
1943
set_ssp_complete(struct hci_dev * hdev,void * data,int err)1944 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1945 {
1946 struct cmd_lookup match = { NULL, hdev };
1947 struct mgmt_pending_cmd *cmd = data;
1948 struct mgmt_mode *cp;
1949 u8 enable;
1950 bool changed;
1951
1952 /* Make sure cmd still outstanding. */
1953 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1954 return;
1955
1956 cp = cmd->param;
1957 enable = cp->val;
1958
1959 if (err) {
1960 u8 mgmt_err = mgmt_status(err);
1961
1962 if (enable && hci_dev_test_and_clear_flag(hdev,
1963 HCI_SSP_ENABLED)) {
1964 new_settings(hdev, NULL);
1965 }
1966
1967 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1968 mgmt_pending_free(cmd);
1969 return;
1970 }
1971
1972 if (enable) {
1973 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1974 } else {
1975 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1976 }
1977
1978 settings_rsp(cmd, &match);
1979
1980 if (changed)
1981 new_settings(hdev, match.sk);
1982
1983 if (match.sk)
1984 sock_put(match.sk);
1985
1986 hci_update_eir_sync(hdev);
1987 mgmt_pending_free(cmd);
1988 }
1989
set_ssp_sync(struct hci_dev * hdev,void * data)1990 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1991 {
1992 struct mgmt_pending_cmd *cmd = data;
1993 struct mgmt_mode cp;
1994 bool changed = false;
1995 int err;
1996
1997 mutex_lock(&hdev->mgmt_pending_lock);
1998
1999 if (!__mgmt_pending_listed(hdev, cmd)) {
2000 mutex_unlock(&hdev->mgmt_pending_lock);
2001 return -ECANCELED;
2002 }
2003
2004 memcpy(&cp, cmd->param, sizeof(cp));
2005
2006 mutex_unlock(&hdev->mgmt_pending_lock);
2007
2008 if (cp.val)
2009 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
2010
2011 err = hci_write_ssp_mode_sync(hdev, cp.val);
2012
2013 if (!err && changed)
2014 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
2015
2016 return err;
2017 }
2018
set_ssp(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2019 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2020 {
2021 struct mgmt_mode *cp = data;
2022 struct mgmt_pending_cmd *cmd;
2023 u8 status;
2024 int err;
2025
2026 bt_dev_dbg(hdev, "sock %p", sk);
2027
2028 status = mgmt_bredr_support(hdev);
2029 if (status)
2030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2031
2032 if (!lmp_ssp_capable(hdev))
2033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2034 MGMT_STATUS_NOT_SUPPORTED);
2035
2036 if (cp->val != 0x00 && cp->val != 0x01)
2037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2038 MGMT_STATUS_INVALID_PARAMS);
2039
2040 hci_dev_lock(hdev);
2041
2042 if (!hdev_is_powered(hdev)) {
2043 bool changed;
2044
2045 if (cp->val) {
2046 changed = !hci_dev_test_and_set_flag(hdev,
2047 HCI_SSP_ENABLED);
2048 } else {
2049 changed = hci_dev_test_and_clear_flag(hdev,
2050 HCI_SSP_ENABLED);
2051 }
2052
2053 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2054 if (err < 0)
2055 goto failed;
2056
2057 if (changed)
2058 err = new_settings(hdev, sk);
2059
2060 goto failed;
2061 }
2062
2063 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2064 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2065 MGMT_STATUS_BUSY);
2066 goto failed;
2067 }
2068
2069 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2070 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2071 goto failed;
2072 }
2073
2074 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2075 if (!cmd)
2076 err = -ENOMEM;
2077 else
2078 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2079 set_ssp_complete);
2080
2081 if (err < 0) {
2082 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2083 MGMT_STATUS_FAILED);
2084
2085 if (cmd)
2086 mgmt_pending_remove(cmd);
2087 }
2088
2089 failed:
2090 hci_dev_unlock(hdev);
2091 return err;
2092 }
2093
set_hs(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2094 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2095 {
2096 bt_dev_dbg(hdev, "sock %p", sk);
2097
2098 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2099 MGMT_STATUS_NOT_SUPPORTED);
2100 }
2101
set_le_complete(struct hci_dev * hdev,void * data,int err)2102 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2103 {
2104 struct mgmt_pending_cmd *cmd = data;
2105 struct cmd_lookup match = { NULL, hdev };
2106 u8 status = mgmt_status(err);
2107
2108 bt_dev_dbg(hdev, "err %d", err);
2109
2110 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
2111 return;
2112
2113 if (status) {
2114 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
2115 goto done;
2116 }
2117
2118 settings_rsp(cmd, &match);
2119
2120 new_settings(hdev, match.sk);
2121
2122 if (match.sk)
2123 sock_put(match.sk);
2124
2125 done:
2126 mgmt_pending_free(cmd);
2127 }
2128
set_le_sync(struct hci_dev * hdev,void * data)2129 static int set_le_sync(struct hci_dev *hdev, void *data)
2130 {
2131 struct mgmt_pending_cmd *cmd = data;
2132 struct mgmt_mode cp;
2133 u8 val;
2134 int err;
2135
2136 mutex_lock(&hdev->mgmt_pending_lock);
2137
2138 if (!__mgmt_pending_listed(hdev, cmd)) {
2139 mutex_unlock(&hdev->mgmt_pending_lock);
2140 return -ECANCELED;
2141 }
2142
2143 memcpy(&cp, cmd->param, sizeof(cp));
2144 val = !!cp.val;
2145
2146 mutex_unlock(&hdev->mgmt_pending_lock);
2147
2148 if (!val) {
2149 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2150
2151 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2152 hci_disable_advertising_sync(hdev);
2153
2154 if (ext_adv_capable(hdev))
2155 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2156 } else {
2157 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2158 }
2159
2160 err = hci_write_le_host_supported_sync(hdev, val, 0);
2161
2162 /* Make sure the controller has a good default for
2163 * advertising data. Restrict the update to when LE
2164 * has actually been enabled. During power on, the
2165 * update in powered_update_hci will take care of it.
2166 */
2167 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2168 if (ext_adv_capable(hdev)) {
2169 int status;
2170
2171 status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2172 if (!status)
2173 hci_update_scan_rsp_data_sync(hdev, 0x00);
2174 } else {
2175 hci_update_adv_data_sync(hdev, 0x00);
2176 hci_update_scan_rsp_data_sync(hdev, 0x00);
2177 }
2178
2179 hci_update_passive_scan(hdev);
2180 }
2181
2182 return err;
2183 }
2184
set_mesh_complete(struct hci_dev * hdev,void * data,int err)2185 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2186 {
2187 struct mgmt_pending_cmd *cmd = data;
2188 u8 status = mgmt_status(err);
2189 struct sock *sk;
2190
2191 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
2192 return;
2193
2194 sk = cmd->sk;
2195
2196 if (status) {
2197 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2198 goto done;
2199 }
2200
2201 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2202
2203 done:
2204 mgmt_pending_free(cmd);
2205 }
2206
set_mesh_sync(struct hci_dev * hdev,void * data)2207 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2208 {
2209 struct mgmt_pending_cmd *cmd = data;
2210 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types,
2211 sizeof(hdev->mesh_ad_types));
2212 size_t len;
2213
2214 mutex_lock(&hdev->mgmt_pending_lock);
2215
2216 if (!__mgmt_pending_listed(hdev, cmd)) {
2217 mutex_unlock(&hdev->mgmt_pending_lock);
2218 return -ECANCELED;
2219 }
2220
2221 len = cmd->param_len;
2222 memcpy(cp, cmd->param, min(__struct_size(cp), len));
2223
2224 mutex_unlock(&hdev->mgmt_pending_lock);
2225
2226 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2227
2228 if (cp->enable)
2229 hci_dev_set_flag(hdev, HCI_MESH);
2230 else
2231 hci_dev_clear_flag(hdev, HCI_MESH);
2232
2233 hdev->le_scan_interval = __le16_to_cpu(cp->period);
2234 hdev->le_scan_window = __le16_to_cpu(cp->window);
2235
2236 len -= sizeof(struct mgmt_cp_set_mesh);
2237
2238 /* If filters don't fit, forward all adv pkts */
2239 if (len <= sizeof(hdev->mesh_ad_types))
2240 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2241
2242 hci_update_passive_scan_sync(hdev);
2243 return 0;
2244 }
2245
set_mesh(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2246 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2247 {
2248 struct mgmt_cp_set_mesh *cp = data;
2249 struct mgmt_pending_cmd *cmd;
2250 __u16 period, window;
2251 int err = 0;
2252
2253 bt_dev_dbg(hdev, "sock %p", sk);
2254
2255 if (!lmp_le_capable(hdev) ||
2256 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2257 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2258 MGMT_STATUS_NOT_SUPPORTED);
2259
2260 if (cp->enable != 0x00 && cp->enable != 0x01)
2261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2262 MGMT_STATUS_INVALID_PARAMS);
2263
2264 /* Keep allowed ranges in sync with set_scan_params() */
2265 period = __le16_to_cpu(cp->period);
2266
2267 if (period < 0x0004 || period > 0x4000)
2268 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2269 MGMT_STATUS_INVALID_PARAMS);
2270
2271 window = __le16_to_cpu(cp->window);
2272
2273 if (window < 0x0004 || window > 0x4000)
2274 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2275 MGMT_STATUS_INVALID_PARAMS);
2276
2277 if (window > period)
2278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2279 MGMT_STATUS_INVALID_PARAMS);
2280
2281 hci_dev_lock(hdev);
2282
2283 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2284 if (!cmd)
2285 err = -ENOMEM;
2286 else
2287 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2288 set_mesh_complete);
2289
2290 if (err < 0) {
2291 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2292 MGMT_STATUS_FAILED);
2293
2294 if (cmd)
2295 mgmt_pending_remove(cmd);
2296 }
2297
2298 hci_dev_unlock(hdev);
2299 return err;
2300 }
2301
mesh_send_start_complete(struct hci_dev * hdev,void * data,int err)2302 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2303 {
2304 struct mgmt_mesh_tx *mesh_tx = data;
2305 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2306 unsigned long mesh_send_interval;
2307 u8 mgmt_err = mgmt_status(err);
2308
2309 /* Report any errors here, but don't report completion */
2310
2311 if (mgmt_err) {
2312 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2313 /* Send Complete Error Code for handle */
2314 mesh_send_complete(hdev, mesh_tx, false);
2315 if (err != -ECANCELED)
2316 mesh_next(hdev, NULL, 0);
2317 return;
2318 }
2319
2320 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2321 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2322 mesh_send_interval);
2323 }
2324
mesh_send_sync(struct hci_dev * hdev,void * data)2325 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2326 {
2327 struct mgmt_mesh_tx *mesh_tx = data;
2328 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2329 struct adv_info *adv, *next_instance;
2330 u8 instance = hdev->le_num_of_adv_sets + 1;
2331 u16 timeout, duration;
2332 int err = 0;
2333
2334 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2335 return MGMT_STATUS_BUSY;
2336
2337 timeout = 1000;
2338 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2339 adv = hci_add_adv_instance(hdev, instance, 0,
2340 send->adv_data_len, send->adv_data,
2341 0, NULL,
2342 timeout, duration,
2343 HCI_ADV_TX_POWER_NO_PREFERENCE,
2344 hdev->le_adv_min_interval,
2345 hdev->le_adv_max_interval,
2346 mesh_tx->handle);
2347
2348 if (!IS_ERR(adv))
2349 mesh_tx->instance = instance;
2350 else
2351 err = PTR_ERR(adv);
2352
2353 if (hdev->cur_adv_instance == instance) {
2354 /* If the currently advertised instance is being changed then
2355 * cancel the current advertising and schedule the next
2356 * instance. If there is only one instance then the overridden
2357 * advertising data will be visible right away.
2358 */
2359 cancel_adv_timeout(hdev);
2360
2361 next_instance = hci_get_next_instance(hdev, instance);
2362 if (next_instance)
2363 instance = next_instance->instance;
2364 else
2365 instance = 0;
2366 } else if (hdev->adv_instance_timeout) {
2367 /* Immediately advertise the new instance if no other, or
2368 * let it go naturally from queue if ADV is already happening
2369 */
2370 instance = 0;
2371 }
2372
2373 if (instance)
2374 return hci_schedule_adv_instance_sync(hdev, instance, true);
2375
2376 return err;
2377 }
2378
send_count(struct mgmt_mesh_tx * mesh_tx,void * data)2379 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2380 {
2381 struct mgmt_rp_mesh_read_features *rp = data;
2382
2383 if (rp->used_handles >= rp->max_handles)
2384 return;
2385
2386 rp->handles[rp->used_handles++] = mesh_tx->handle;
2387 }
2388
mesh_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2389 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2390 void *data, u16 len)
2391 {
2392 struct mgmt_rp_mesh_read_features rp;
2393
2394 if (!lmp_le_capable(hdev) ||
2395 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2396 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2397 MGMT_STATUS_NOT_SUPPORTED);
2398
2399 memset(&rp, 0, sizeof(rp));
2400 rp.index = cpu_to_le16(hdev->id);
2401 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2402 rp.max_handles = MESH_HANDLES_MAX;
2403
2404 hci_dev_lock(hdev);
2405
2406 if (rp.max_handles)
2407 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2408
2409 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2410 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2411
2412 hci_dev_unlock(hdev);
2413 return 0;
2414 }
2415
send_cancel(struct hci_dev * hdev,void * data)2416 static int send_cancel(struct hci_dev *hdev, void *data)
2417 {
2418 struct mgmt_pending_cmd *cmd = data;
2419 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2420 struct mgmt_mesh_tx *mesh_tx;
2421
2422 if (!cancel->handle) {
2423 do {
2424 mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2425
2426 if (mesh_tx) {
2427 if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
2428 mesh_tx, NULL))
2429 mesh_send_complete(hdev, mesh_tx, false);
2430 }
2431 } while (mesh_tx);
2432 } else {
2433 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2434
2435 if (mesh_tx && mesh_tx->sk == cmd->sk) {
2436 if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync,
2437 mesh_tx, NULL))
2438 mesh_send_complete(hdev, mesh_tx, false);
2439 }
2440 }
2441
2442 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2443 0, NULL, 0);
2444
2445 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
2446 mesh_next(hdev, NULL, 0);
2447
2448 return 0;
2449 }
2450
send_cancel_destroy(struct hci_dev * hdev,void * data,int err)2451 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err)
2452 {
2453 mgmt_pending_free(data);
2454 }
2455
mesh_send_cancel(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2456 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2457 void *data, u16 len)
2458 {
2459 struct mgmt_pending_cmd *cmd;
2460 int err;
2461
2462 if (!lmp_le_capable(hdev) ||
2463 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2465 MGMT_STATUS_NOT_SUPPORTED);
2466
2467 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2469 MGMT_STATUS_REJECTED);
2470
2471 hci_dev_lock(hdev);
2472 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2473 if (!cmd)
2474 err = -ENOMEM;
2475 else
2476 err = hci_cmd_sync_queue(hdev, send_cancel, cmd,
2477 send_cancel_destroy);
2478
2479 if (err < 0) {
2480 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2481 MGMT_STATUS_FAILED);
2482
2483 if (cmd)
2484 mgmt_pending_free(cmd);
2485 }
2486
2487 hci_dev_unlock(hdev);
2488 return err;
2489 }
2490
mesh_send(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2491 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2492 {
2493 struct mgmt_mesh_tx *mesh_tx;
2494 struct mgmt_cp_mesh_send *send = data;
2495 struct mgmt_rp_mesh_read_features rp;
2496 u16 expected_len;
2497 bool sending;
2498 int err = 0;
2499
2500 if (!lmp_le_capable(hdev) ||
2501 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2503 MGMT_STATUS_NOT_SUPPORTED);
2504 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2506 MGMT_STATUS_REJECTED);
2507
2508 if (!send->adv_data_len || send->adv_data_len > 31)
2509 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2510 MGMT_STATUS_REJECTED);
2511
2512 expected_len = struct_size(send, adv_data, send->adv_data_len);
2513 if (expected_len != len)
2514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2515 MGMT_STATUS_INVALID_PARAMS);
2516
2517 hci_dev_lock(hdev);
2518
2519 memset(&rp, 0, sizeof(rp));
2520 rp.max_handles = MESH_HANDLES_MAX;
2521
2522 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2523
2524 if (rp.max_handles <= rp.used_handles) {
2525 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2526 MGMT_STATUS_BUSY);
2527 goto done;
2528 }
2529
2530 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2531 mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2532
2533 if (!mesh_tx)
2534 err = -ENOMEM;
2535 else if (!sending)
2536 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2537 mesh_send_start_complete);
2538
2539 if (err < 0) {
2540 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2541 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2542 MGMT_STATUS_FAILED);
2543
2544 if (mesh_tx) {
2545 if (sending)
2546 mgmt_mesh_remove(mesh_tx);
2547 }
2548 } else {
2549 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2550
2551 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2552 &mesh_tx->handle, 1);
2553 }
2554
2555 done:
2556 hci_dev_unlock(hdev);
2557 return err;
2558 }
2559
set_le(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2560 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2561 {
2562 struct mgmt_mode *cp = data;
2563 struct mgmt_pending_cmd *cmd;
2564 int err;
2565 u8 val, enabled;
2566
2567 bt_dev_dbg(hdev, "sock %p", sk);
2568
2569 if (!lmp_le_capable(hdev))
2570 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2571 MGMT_STATUS_NOT_SUPPORTED);
2572
2573 if (cp->val != 0x00 && cp->val != 0x01)
2574 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2575 MGMT_STATUS_INVALID_PARAMS);
2576
2577 /* Bluetooth single mode LE only controllers or dual-mode
2578 * controllers configured as LE only devices, do not allow
2579 * switching LE off. These have either LE enabled explicitly
2580 * or BR/EDR has been previously switched off.
2581 *
2582 * When trying to enable an already enabled LE, then gracefully
2583 * send a positive response. Trying to disable it however will
2584 * result into rejection.
2585 */
2586 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2587 if (cp->val == 0x01)
2588 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2589
2590 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2591 MGMT_STATUS_REJECTED);
2592 }
2593
2594 hci_dev_lock(hdev);
2595
2596 val = !!cp->val;
2597 enabled = lmp_host_le_capable(hdev);
2598
2599 if (!hdev_is_powered(hdev) || val == enabled) {
2600 bool changed = false;
2601
2602 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2603 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2604 changed = true;
2605 }
2606
2607 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2608 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2609 changed = true;
2610 }
2611
2612 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2613 if (err < 0)
2614 goto unlock;
2615
2616 if (changed)
2617 err = new_settings(hdev, sk);
2618
2619 goto unlock;
2620 }
2621
2622 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2623 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2624 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2625 MGMT_STATUS_BUSY);
2626 goto unlock;
2627 }
2628
2629 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2630 if (!cmd)
2631 err = -ENOMEM;
2632 else
2633 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2634 set_le_complete);
2635
2636 if (err < 0) {
2637 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2638 MGMT_STATUS_FAILED);
2639
2640 if (cmd)
2641 mgmt_pending_remove(cmd);
2642 }
2643
2644 unlock:
2645 hci_dev_unlock(hdev);
2646 return err;
2647 }
2648
send_hci_cmd_sync(struct hci_dev * hdev,void * data)2649 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data)
2650 {
2651 struct mgmt_pending_cmd *cmd = data;
2652 struct mgmt_cp_hci_cmd_sync *cp = cmd->param;
2653 struct sk_buff *skb;
2654
2655 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode),
2656 le16_to_cpu(cp->params_len), cp->params,
2657 cp->event, cp->timeout ?
2658 secs_to_jiffies(cp->timeout) :
2659 HCI_CMD_TIMEOUT);
2660 if (IS_ERR(skb)) {
2661 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2662 mgmt_status(PTR_ERR(skb)));
2663 return 0;
2664 }
2665
2666 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0,
2667 skb->data, skb->len);
2668
2669 kfree_skb(skb);
2670
2671 return 0;
2672 }
2673
send_hci_cmd_sync_destroy(struct hci_dev * hdev,void * data,int err)2674 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err)
2675 {
2676 mgmt_pending_free(data);
2677 }
2678
mgmt_hci_cmd_sync(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2679 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev,
2680 void *data, u16 len)
2681 {
2682 struct mgmt_cp_hci_cmd_sync *cp = data;
2683 struct mgmt_pending_cmd *cmd;
2684 int err;
2685
2686 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) +
2687 le16_to_cpu(cp->params_len)))
2688 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2689 MGMT_STATUS_INVALID_PARAMS);
2690
2691 /* The HCI command header carries the parameter length in a u8, a
2692 * larger value would be truncated there while the parameters are
2693 * still appended to the frame in full.
2694 */
2695 if (le16_to_cpu(cp->params_len) > U8_MAX)
2696 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2697 MGMT_STATUS_INVALID_PARAMS);
2698
2699 hci_dev_lock(hdev);
2700 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len);
2701 if (!cmd)
2702 err = -ENOMEM;
2703 else
2704 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd,
2705 send_hci_cmd_sync_destroy);
2706
2707 if (err < 0) {
2708 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2709 MGMT_STATUS_FAILED);
2710
2711 if (cmd)
2712 mgmt_pending_free(cmd);
2713 }
2714
2715 hci_dev_unlock(hdev);
2716 return err;
2717 }
2718
2719 /* This is a helper function to test for pending mgmt commands that can
2720 * cause CoD or EIR HCI commands. We can only allow one such pending
2721 * mgmt command at a time since otherwise we cannot easily track what
2722 * the current values are, will be, and based on that calculate if a new
2723 * HCI command needs to be sent and if yes with what value.
2724 */
pending_eir_or_class(struct hci_dev * hdev)2725 static bool pending_eir_or_class(struct hci_dev *hdev)
2726 {
2727 struct mgmt_pending_cmd *cmd;
2728 bool pending = false;
2729
2730 mutex_lock(&hdev->mgmt_pending_lock);
2731
2732 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2733 switch (cmd->opcode) {
2734 case MGMT_OP_ADD_UUID:
2735 case MGMT_OP_REMOVE_UUID:
2736 case MGMT_OP_SET_DEV_CLASS:
2737 case MGMT_OP_SET_LOCAL_NAME:
2738 case MGMT_OP_SET_POWERED:
2739 pending = true;
2740 break;
2741 }
2742
2743 if (pending)
2744 break;
2745 }
2746
2747 mutex_unlock(&hdev->mgmt_pending_lock);
2748
2749 return pending;
2750 }
2751
2752 static const u8 bluetooth_base_uuid[] = {
2753 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2754 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2755 };
2756
get_uuid_size(const u8 * uuid)2757 static u8 get_uuid_size(const u8 *uuid)
2758 {
2759 u32 val;
2760
2761 if (memcmp(uuid, bluetooth_base_uuid, 12))
2762 return 128;
2763
2764 val = get_unaligned_le32(&uuid[12]);
2765 if (val > 0xffff)
2766 return 32;
2767
2768 return 16;
2769 }
2770
mgmt_class_complete(struct hci_dev * hdev,void * data,int err)2771 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2772 {
2773 struct mgmt_pending_cmd *cmd = data;
2774
2775 bt_dev_dbg(hdev, "err %d", err);
2776
2777 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
2778 mgmt_status(err), hdev->dev_class, 3);
2779
2780 mgmt_pending_free(cmd);
2781 }
2782
add_uuid_sync(struct hci_dev * hdev,void * data)2783 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2784 {
2785 int err;
2786
2787 err = hci_update_class_sync(hdev);
2788 if (err)
2789 return err;
2790
2791 return hci_update_eir_sync(hdev);
2792 }
2793
add_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2794 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2795 {
2796 struct mgmt_cp_add_uuid *cp = data;
2797 struct mgmt_pending_cmd *cmd;
2798 struct bt_uuid *uuid;
2799 int err;
2800
2801 bt_dev_dbg(hdev, "sock %p", sk);
2802
2803 hci_dev_lock(hdev);
2804
2805 if (pending_eir_or_class(hdev)) {
2806 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2807 MGMT_STATUS_BUSY);
2808 goto failed;
2809 }
2810
2811 uuid = kmalloc_obj(*uuid);
2812 if (!uuid) {
2813 err = -ENOMEM;
2814 goto failed;
2815 }
2816
2817 memcpy(uuid->uuid, cp->uuid, 16);
2818 uuid->svc_hint = cp->svc_hint;
2819 uuid->size = get_uuid_size(cp->uuid);
2820
2821 list_add_tail(&uuid->list, &hdev->uuids);
2822
2823 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2824 if (!cmd) {
2825 err = -ENOMEM;
2826 goto failed;
2827 }
2828
2829 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use
2830 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2831 */
2832 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd,
2833 mgmt_class_complete);
2834 if (err < 0) {
2835 mgmt_pending_free(cmd);
2836 goto failed;
2837 }
2838
2839 failed:
2840 hci_dev_unlock(hdev);
2841 return err;
2842 }
2843
enable_service_cache(struct hci_dev * hdev)2844 static bool enable_service_cache(struct hci_dev *hdev)
2845 {
2846 if (!hdev_is_powered(hdev))
2847 return false;
2848
2849 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2850 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2851 CACHE_TIMEOUT);
2852 return true;
2853 }
2854
2855 return false;
2856 }
2857
remove_uuid_sync(struct hci_dev * hdev,void * data)2858 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2859 {
2860 int err;
2861
2862 err = hci_update_class_sync(hdev);
2863 if (err)
2864 return err;
2865
2866 return hci_update_eir_sync(hdev);
2867 }
2868
remove_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2869 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2870 u16 len)
2871 {
2872 struct mgmt_cp_remove_uuid *cp = data;
2873 struct mgmt_pending_cmd *cmd;
2874 struct bt_uuid *match, *tmp;
2875 static const u8 bt_uuid_any[] = {
2876 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2877 };
2878 int err, found;
2879
2880 bt_dev_dbg(hdev, "sock %p", sk);
2881
2882 hci_dev_lock(hdev);
2883
2884 if (pending_eir_or_class(hdev)) {
2885 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2886 MGMT_STATUS_BUSY);
2887 goto unlock;
2888 }
2889
2890 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2891 hci_uuids_clear(hdev);
2892
2893 if (enable_service_cache(hdev)) {
2894 err = mgmt_cmd_complete(sk, hdev->id,
2895 MGMT_OP_REMOVE_UUID,
2896 0, hdev->dev_class, 3);
2897 goto unlock;
2898 }
2899
2900 goto update_class;
2901 }
2902
2903 found = 0;
2904
2905 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2906 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2907 continue;
2908
2909 list_del(&match->list);
2910 kfree(match);
2911 found++;
2912 }
2913
2914 if (found == 0) {
2915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2916 MGMT_STATUS_INVALID_PARAMS);
2917 goto unlock;
2918 }
2919
2920 update_class:
2921 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2922 if (!cmd) {
2923 err = -ENOMEM;
2924 goto unlock;
2925 }
2926
2927 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use
2928 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2929 */
2930 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd,
2931 mgmt_class_complete);
2932 if (err < 0)
2933 mgmt_pending_free(cmd);
2934
2935 unlock:
2936 hci_dev_unlock(hdev);
2937 return err;
2938 }
2939
set_class_sync(struct hci_dev * hdev,void * data)2940 static int set_class_sync(struct hci_dev *hdev, void *data)
2941 {
2942 int err = 0;
2943
2944 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2945 cancel_delayed_work_sync(&hdev->service_cache);
2946 err = hci_update_eir_sync(hdev);
2947 }
2948
2949 if (err)
2950 return err;
2951
2952 return hci_update_class_sync(hdev);
2953 }
2954
set_dev_class(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2955 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2956 u16 len)
2957 {
2958 struct mgmt_cp_set_dev_class *cp = data;
2959 struct mgmt_pending_cmd *cmd;
2960 int err;
2961
2962 bt_dev_dbg(hdev, "sock %p", sk);
2963
2964 if (!lmp_bredr_capable(hdev))
2965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2966 MGMT_STATUS_NOT_SUPPORTED);
2967
2968 hci_dev_lock(hdev);
2969
2970 if (pending_eir_or_class(hdev)) {
2971 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2972 MGMT_STATUS_BUSY);
2973 goto unlock;
2974 }
2975
2976 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2977 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2978 MGMT_STATUS_INVALID_PARAMS);
2979 goto unlock;
2980 }
2981
2982 hdev->major_class = cp->major;
2983 hdev->minor_class = cp->minor;
2984
2985 if (!hdev_is_powered(hdev)) {
2986 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2987 hdev->dev_class, 3);
2988 goto unlock;
2989 }
2990
2991 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2992 if (!cmd) {
2993 err = -ENOMEM;
2994 goto unlock;
2995 }
2996
2997 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use
2998 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2999 */
3000 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd,
3001 mgmt_class_complete);
3002 if (err < 0)
3003 mgmt_pending_free(cmd);
3004
3005 unlock:
3006 hci_dev_unlock(hdev);
3007 return err;
3008 }
3009
load_link_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3010 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3011 u16 len)
3012 {
3013 struct mgmt_cp_load_link_keys *cp = data;
3014 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
3015 sizeof(struct mgmt_link_key_info));
3016 u16 key_count, expected_len;
3017 bool changed;
3018 int i;
3019
3020 bt_dev_dbg(hdev, "sock %p", sk);
3021
3022 if (!lmp_bredr_capable(hdev))
3023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3024 MGMT_STATUS_NOT_SUPPORTED);
3025
3026 key_count = __le16_to_cpu(cp->key_count);
3027 if (key_count > max_key_count) {
3028 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
3029 key_count);
3030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3031 MGMT_STATUS_INVALID_PARAMS);
3032 }
3033
3034 expected_len = struct_size(cp, keys, key_count);
3035 if (expected_len != len) {
3036 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
3037 expected_len, len);
3038 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3039 MGMT_STATUS_INVALID_PARAMS);
3040 }
3041
3042 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
3043 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3044 MGMT_STATUS_INVALID_PARAMS);
3045
3046 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
3047 key_count);
3048
3049 hci_dev_lock(hdev);
3050
3051 hci_link_keys_clear(hdev);
3052
3053 if (cp->debug_keys)
3054 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
3055 else
3056 changed = hci_dev_test_and_clear_flag(hdev,
3057 HCI_KEEP_DEBUG_KEYS);
3058
3059 if (changed)
3060 new_settings(hdev, NULL);
3061
3062 for (i = 0; i < key_count; i++) {
3063 struct mgmt_link_key_info *key = &cp->keys[i];
3064
3065 if (hci_is_blocked_key(hdev,
3066 HCI_BLOCKED_KEY_TYPE_LINKKEY,
3067 key->val)) {
3068 bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
3069 &key->addr.bdaddr);
3070 continue;
3071 }
3072
3073 if (key->addr.type != BDADDR_BREDR) {
3074 bt_dev_warn(hdev,
3075 "Invalid link address type %u for %pMR",
3076 key->addr.type, &key->addr.bdaddr);
3077 continue;
3078 }
3079
3080 if (key->type > 0x08) {
3081 bt_dev_warn(hdev, "Invalid link key type %u for %pMR",
3082 key->type, &key->addr.bdaddr);
3083 continue;
3084 }
3085
3086 /* Always ignore debug keys and require a new pairing if
3087 * the user wants to use them.
3088 */
3089 if (key->type == HCI_LK_DEBUG_COMBINATION)
3090 continue;
3091
3092 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3093 key->type, key->pin_len, NULL);
3094 }
3095
3096 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
3097
3098 hci_dev_unlock(hdev);
3099
3100 return 0;
3101 }
3102
device_unpaired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,struct sock * skip_sk)3103 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
3104 u8 addr_type, struct sock *skip_sk)
3105 {
3106 struct mgmt_ev_device_unpaired ev;
3107
3108 bacpy(&ev.addr.bdaddr, bdaddr);
3109 ev.addr.type = addr_type;
3110
3111 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
3112 skip_sk);
3113 }
3114
unpair_device_complete(struct hci_dev * hdev,void * data,int err)3115 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
3116 {
3117 struct mgmt_pending_cmd *cmd = data;
3118 struct mgmt_cp_unpair_device *cp = cmd->param;
3119
3120 if (!err)
3121 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3122
3123 cmd->cmd_complete(cmd, err);
3124 mgmt_pending_free(cmd);
3125 }
3126
unpair_device_sync(struct hci_dev * hdev,void * data)3127 static int unpair_device_sync(struct hci_dev *hdev, void *data)
3128 {
3129 struct mgmt_pending_cmd *cmd = data;
3130 struct mgmt_cp_unpair_device *cp = cmd->param;
3131 struct hci_conn *conn;
3132
3133 hci_dev_lock(hdev);
3134
3135 if (cp->addr.type == BDADDR_BREDR)
3136 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3137 &cp->addr.bdaddr);
3138 else
3139 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3140 le_addr_type(cp->addr.type));
3141
3142 if (conn)
3143 hci_conn_get(conn);
3144
3145 hci_dev_unlock(hdev);
3146
3147 if (!conn)
3148 return 0;
3149
3150 /* Disregard any possible error since the likes of hci_abort_conn_sync
3151 * will clean up the connection no matter the error.
3152 */
3153 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3154 hci_conn_put(conn);
3155
3156 return 0;
3157 }
3158
unpair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3159 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3160 u16 len)
3161 {
3162 struct mgmt_cp_unpair_device *cp = data;
3163 struct mgmt_rp_unpair_device rp;
3164 struct hci_conn_params *params;
3165 struct mgmt_pending_cmd *cmd;
3166 struct hci_conn *conn;
3167 u8 addr_type;
3168 int err;
3169
3170 memset(&rp, 0, sizeof(rp));
3171 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3172 rp.addr.type = cp->addr.type;
3173
3174 if (!bdaddr_type_is_valid(cp->addr.type))
3175 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3176 MGMT_STATUS_INVALID_PARAMS,
3177 &rp, sizeof(rp));
3178
3179 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3180 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3181 MGMT_STATUS_INVALID_PARAMS,
3182 &rp, sizeof(rp));
3183
3184 hci_dev_lock(hdev);
3185
3186 if (!hdev_is_powered(hdev)) {
3187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3188 MGMT_STATUS_NOT_POWERED, &rp,
3189 sizeof(rp));
3190 goto unlock;
3191 }
3192
3193 if (cp->addr.type == BDADDR_BREDR) {
3194 /* If disconnection is requested, then look up the
3195 * connection. If the remote device is connected, it
3196 * will be later used to terminate the link.
3197 *
3198 * Setting it to NULL explicitly will cause no
3199 * termination of the link.
3200 */
3201 if (cp->disconnect)
3202 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3203 &cp->addr.bdaddr);
3204 else
3205 conn = NULL;
3206
3207 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3208 if (err < 0) {
3209 err = mgmt_cmd_complete(sk, hdev->id,
3210 MGMT_OP_UNPAIR_DEVICE,
3211 MGMT_STATUS_NOT_PAIRED, &rp,
3212 sizeof(rp));
3213 goto unlock;
3214 }
3215
3216 goto done;
3217 }
3218
3219 /* LE address type */
3220 addr_type = le_addr_type(cp->addr.type);
3221
3222 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3223 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3224 if (err < 0) {
3225 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3226 MGMT_STATUS_NOT_PAIRED, &rp,
3227 sizeof(rp));
3228 goto unlock;
3229 }
3230
3231 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3232 if (!conn) {
3233 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3234 goto done;
3235 }
3236
3237
3238 /* Defer clearing up the connection parameters until closing to
3239 * give a chance of keeping them if a repairing happens.
3240 */
3241 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3242
3243 /* Disable auto-connection parameters if present */
3244 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3245 if (params) {
3246 if (params->explicit_connect)
3247 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3248 else
3249 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3250 }
3251
3252 /* If disconnection is not requested, then clear the connection
3253 * variable so that the link is not terminated.
3254 */
3255 if (!cp->disconnect)
3256 conn = NULL;
3257
3258 done:
3259 /* If the connection variable is set, then termination of the
3260 * link is requested.
3261 */
3262 if (!conn) {
3263 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3264 &rp, sizeof(rp));
3265 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3266 goto unlock;
3267 }
3268
3269 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3270 sizeof(*cp));
3271 if (!cmd) {
3272 err = -ENOMEM;
3273 goto unlock;
3274 }
3275
3276 cmd->cmd_complete = addr_cmd_complete;
3277
3278 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3279 unpair_device_complete);
3280 if (err < 0)
3281 mgmt_pending_free(cmd);
3282
3283 unlock:
3284 hci_dev_unlock(hdev);
3285 return err;
3286 }
3287
disconnect_complete(struct hci_dev * hdev,void * data,int err)3288 static void disconnect_complete(struct hci_dev *hdev, void *data, int err)
3289 {
3290 struct mgmt_pending_cmd *cmd = data;
3291
3292 cmd->cmd_complete(cmd, mgmt_status(err));
3293 mgmt_pending_free(cmd);
3294 }
3295
disconnect_sync(struct hci_dev * hdev,void * data)3296 static int disconnect_sync(struct hci_dev *hdev, void *data)
3297 {
3298 struct mgmt_pending_cmd *cmd = data;
3299 struct mgmt_cp_disconnect *cp = cmd->param;
3300 struct hci_conn *conn;
3301
3302 hci_dev_lock(hdev);
3303
3304 if (cp->addr.type == BDADDR_BREDR)
3305 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3306 &cp->addr.bdaddr);
3307 else
3308 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3309 le_addr_type(cp->addr.type));
3310
3311 if (conn)
3312 hci_conn_get(conn);
3313
3314 hci_dev_unlock(hdev);
3315
3316 if (!conn)
3317 return -ENOTCONN;
3318
3319 /* Disregard any possible error since the likes of hci_abort_conn_sync
3320 * will clean up the connection no matter the error.
3321 */
3322 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3323 hci_conn_put(conn);
3324
3325 return 0;
3326 }
3327
disconnect(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3328 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3329 u16 len)
3330 {
3331 struct mgmt_cp_disconnect *cp = data;
3332 struct mgmt_rp_disconnect rp;
3333 struct mgmt_pending_cmd *cmd;
3334 int err;
3335
3336 bt_dev_dbg(hdev, "sock %p", sk);
3337
3338 memset(&rp, 0, sizeof(rp));
3339 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3340 rp.addr.type = cp->addr.type;
3341
3342 if (!bdaddr_type_is_valid(cp->addr.type))
3343 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3344 MGMT_STATUS_INVALID_PARAMS,
3345 &rp, sizeof(rp));
3346
3347 hci_dev_lock(hdev);
3348
3349 if (!test_bit(HCI_UP, &hdev->flags)) {
3350 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3351 MGMT_STATUS_NOT_POWERED, &rp,
3352 sizeof(rp));
3353 goto failed;
3354 }
3355
3356 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3357 if (!cmd) {
3358 err = -ENOMEM;
3359 goto failed;
3360 }
3361
3362 cmd->cmd_complete = generic_cmd_complete;
3363
3364 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd,
3365 disconnect_complete);
3366 if (err < 0)
3367 mgmt_pending_free(cmd);
3368
3369 failed:
3370 hci_dev_unlock(hdev);
3371 return err;
3372 }
3373
link_to_bdaddr(u8 link_type,u8 addr_type)3374 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3375 {
3376 switch (link_type) {
3377 case CIS_LINK:
3378 case BIS_LINK:
3379 case PA_LINK:
3380 case LE_LINK:
3381 switch (addr_type) {
3382 case ADDR_LE_DEV_PUBLIC:
3383 return BDADDR_LE_PUBLIC;
3384
3385 default:
3386 /* Fallback to LE Random address type */
3387 return BDADDR_LE_RANDOM;
3388 }
3389
3390 default:
3391 /* Fallback to BR/EDR type */
3392 return BDADDR_BREDR;
3393 }
3394 }
3395
get_connections(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)3396 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3397 u16 data_len)
3398 {
3399 struct mgmt_rp_get_connections *rp;
3400 struct hci_conn *c;
3401 int err;
3402 u16 i;
3403
3404 bt_dev_dbg(hdev, "sock %p", sk);
3405
3406 hci_dev_lock(hdev);
3407
3408 if (!hdev_is_powered(hdev)) {
3409 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3410 MGMT_STATUS_NOT_POWERED);
3411 goto unlock;
3412 }
3413
3414 i = 0;
3415 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3416 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3417 i++;
3418 }
3419
3420 rp = kmalloc_flex(*rp, addr, i);
3421 if (!rp) {
3422 err = -ENOMEM;
3423 goto unlock;
3424 }
3425
3426 i = 0;
3427 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3428 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3429 continue;
3430 bacpy(&rp->addr[i].bdaddr, &c->dst);
3431 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3432 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3433 continue;
3434 i++;
3435 }
3436
3437 rp->conn_count = cpu_to_le16(i);
3438
3439 /* Recalculate length in case of filtered SCO connections, etc */
3440 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3441 struct_size(rp, addr, i));
3442
3443 kfree(rp);
3444
3445 unlock:
3446 hci_dev_unlock(hdev);
3447 return err;
3448 }
3449
send_pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_pin_code_neg_reply * cp)3450 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3451 struct mgmt_cp_pin_code_neg_reply *cp)
3452 {
3453 struct mgmt_pending_cmd *cmd;
3454 int err;
3455
3456 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3457 sizeof(*cp));
3458 if (!cmd)
3459 return -ENOMEM;
3460
3461 cmd->cmd_complete = addr_cmd_complete;
3462
3463 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3464 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3465 if (err < 0)
3466 mgmt_pending_remove(cmd);
3467
3468 return err;
3469 }
3470
pin_code_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3471 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3472 u16 len)
3473 {
3474 struct hci_conn *conn;
3475 struct mgmt_cp_pin_code_reply *cp = data;
3476 struct hci_cp_pin_code_reply reply;
3477 struct mgmt_pending_cmd *cmd;
3478 int err;
3479
3480 bt_dev_dbg(hdev, "sock %p", sk);
3481
3482 hci_dev_lock(hdev);
3483
3484 if (!hdev_is_powered(hdev)) {
3485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3486 MGMT_STATUS_NOT_POWERED);
3487 goto failed;
3488 }
3489
3490 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3491 if (!conn) {
3492 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3493 MGMT_STATUS_NOT_CONNECTED);
3494 goto failed;
3495 }
3496
3497 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3498 struct mgmt_cp_pin_code_neg_reply ncp;
3499
3500 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3501
3502 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3503
3504 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3505 if (err >= 0)
3506 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3507 MGMT_STATUS_INVALID_PARAMS);
3508
3509 goto failed;
3510 }
3511
3512 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3513 if (!cmd) {
3514 err = -ENOMEM;
3515 goto failed;
3516 }
3517
3518 cmd->cmd_complete = addr_cmd_complete;
3519
3520 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3521 reply.pin_len = cp->pin_len;
3522 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3523
3524 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3525 if (err < 0)
3526 mgmt_pending_remove(cmd);
3527
3528 failed:
3529 hci_dev_unlock(hdev);
3530 return err;
3531 }
3532
set_io_capability(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3533 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3534 u16 len)
3535 {
3536 struct mgmt_cp_set_io_capability *cp = data;
3537
3538 bt_dev_dbg(hdev, "sock %p", sk);
3539
3540 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3541 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3542 MGMT_STATUS_INVALID_PARAMS);
3543
3544 hci_dev_lock(hdev);
3545
3546 hdev->io_capability = cp->io_capability;
3547
3548 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3549
3550 hci_dev_unlock(hdev);
3551
3552 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3553 NULL, 0);
3554 }
3555
remove_pairing(struct hci_conn * conn)3556 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn)
3557 {
3558 struct hci_dev *hdev = conn->hdev;
3559 struct mgmt_pending_cmd *cmd;
3560
3561 mutex_lock(&hdev->mgmt_pending_lock);
3562
3563 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3564 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3565 continue;
3566
3567 if (cmd->user_data != conn)
3568 continue;
3569
3570 list_del(&cmd->list);
3571 mutex_unlock(&hdev->mgmt_pending_lock);
3572 return cmd;
3573 }
3574
3575 mutex_unlock(&hdev->mgmt_pending_lock);
3576
3577 return NULL;
3578 }
3579
remove_pairing_by_addr(struct hci_dev * hdev,bdaddr_t * bdaddr)3580 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev,
3581 bdaddr_t *bdaddr)
3582 {
3583 struct mgmt_pending_cmd *cmd;
3584 struct hci_conn *conn;
3585
3586 mutex_lock(&hdev->mgmt_pending_lock);
3587
3588 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3589 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3590 continue;
3591
3592 conn = cmd->user_data;
3593 if (bacmp(bdaddr, &conn->dst) != 0)
3594 continue;
3595
3596 list_del(&cmd->list);
3597 mutex_unlock(&hdev->mgmt_pending_lock);
3598 return cmd;
3599 }
3600
3601 mutex_unlock(&hdev->mgmt_pending_lock);
3602
3603 return NULL;
3604 }
3605
pairing_complete(struct mgmt_pending_cmd * cmd,u8 status)3606 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3607 {
3608 struct mgmt_rp_pair_device rp;
3609 struct hci_conn *conn = cmd->user_data;
3610 int err;
3611
3612 bacpy(&rp.addr.bdaddr, &conn->dst);
3613 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3614
3615 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE,
3616 status, &rp, sizeof(rp));
3617
3618 /* So we don't get further callbacks for this connection */
3619 conn->connect_cfm_cb = NULL;
3620 conn->security_cfm_cb = NULL;
3621 conn->disconn_cfm_cb = NULL;
3622
3623 hci_conn_drop(conn);
3624
3625 /* The device is paired so there is no need to remove
3626 * its connection parameters anymore.
3627 */
3628 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3629
3630 hci_conn_put(conn);
3631
3632 return err;
3633 }
3634
mgmt_smp_complete(struct hci_conn * conn,bool complete)3635 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3636 {
3637 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3638 struct mgmt_pending_cmd *cmd;
3639
3640 cmd = remove_pairing(conn);
3641 if (cmd) {
3642 cmd->cmd_complete(cmd, status);
3643 mgmt_pending_free(cmd);
3644 }
3645 }
3646
pairing_complete_cb(struct hci_conn * conn,u8 status)3647 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3648 {
3649 struct mgmt_pending_cmd *cmd;
3650
3651 BT_DBG("status %u", status);
3652
3653 cmd = remove_pairing(conn);
3654 if (!cmd) {
3655 BT_DBG("Unable to find a pending command");
3656 return;
3657 }
3658
3659 cmd->cmd_complete(cmd, mgmt_status(status));
3660 mgmt_pending_free(cmd);
3661 }
3662
le_pairing_complete_cb(struct hci_conn * conn,u8 status)3663 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3664 {
3665 struct mgmt_pending_cmd *cmd;
3666
3667 BT_DBG("status %u", status);
3668
3669 if (!status)
3670 return;
3671
3672 cmd = remove_pairing(conn);
3673 if (!cmd) {
3674 BT_DBG("Unable to find a pending command");
3675 return;
3676 }
3677
3678 cmd->cmd_complete(cmd, mgmt_status(status));
3679 mgmt_pending_free(cmd);
3680 }
3681
pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3682 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3683 u16 len)
3684 {
3685 struct mgmt_cp_pair_device *cp = data;
3686 struct mgmt_rp_pair_device rp;
3687 struct mgmt_pending_cmd *cmd;
3688 u8 sec_level, auth_type;
3689 struct hci_conn *conn;
3690 int err;
3691
3692 bt_dev_dbg(hdev, "sock %p", sk);
3693
3694 memset(&rp, 0, sizeof(rp));
3695 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3696 rp.addr.type = cp->addr.type;
3697
3698 if (!bdaddr_type_is_valid(cp->addr.type))
3699 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3700 MGMT_STATUS_INVALID_PARAMS,
3701 &rp, sizeof(rp));
3702
3703 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3704 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3705 MGMT_STATUS_INVALID_PARAMS,
3706 &rp, sizeof(rp));
3707
3708 hci_dev_lock(hdev);
3709
3710 if (!hdev_is_powered(hdev)) {
3711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3712 MGMT_STATUS_NOT_POWERED, &rp,
3713 sizeof(rp));
3714 goto unlock;
3715 }
3716
3717 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3718 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3719 MGMT_STATUS_ALREADY_PAIRED, &rp,
3720 sizeof(rp));
3721 goto unlock;
3722 }
3723
3724 sec_level = BT_SECURITY_MEDIUM;
3725 auth_type = HCI_AT_DEDICATED_BONDING;
3726
3727 if (cp->addr.type == BDADDR_BREDR) {
3728 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3729 auth_type, CONN_REASON_PAIR_DEVICE,
3730 HCI_ACL_CONN_TIMEOUT);
3731 } else {
3732 u8 addr_type = le_addr_type(cp->addr.type);
3733 struct hci_conn_params *p;
3734
3735 /* When pairing a new device, it is expected to remember
3736 * this device for future connections. Adding the connection
3737 * parameter information ahead of time allows tracking
3738 * of the peripheral preferred values and will speed up any
3739 * further connection establishment.
3740 *
3741 * If connection parameters already exist, then they
3742 * will be kept and this function does nothing.
3743 */
3744 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3745 if (!p) {
3746 err = -EIO;
3747 goto unlock;
3748 }
3749
3750 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3751 p->auto_connect = HCI_AUTO_CONN_DISABLED;
3752
3753 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3754 sec_level, HCI_LE_CONN_TIMEOUT,
3755 CONN_REASON_PAIR_DEVICE);
3756 }
3757
3758 if (IS_ERR(conn)) {
3759 int status;
3760
3761 if (PTR_ERR(conn) == -EBUSY)
3762 status = MGMT_STATUS_BUSY;
3763 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3764 status = MGMT_STATUS_NOT_SUPPORTED;
3765 else if (PTR_ERR(conn) == -ECONNREFUSED)
3766 status = MGMT_STATUS_REJECTED;
3767 else
3768 status = MGMT_STATUS_CONNECT_FAILED;
3769
3770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3771 status, &rp, sizeof(rp));
3772 goto unlock;
3773 }
3774
3775 if (conn->connect_cfm_cb) {
3776 hci_conn_drop(conn);
3777 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3778 MGMT_STATUS_BUSY, &rp, sizeof(rp));
3779 goto unlock;
3780 }
3781
3782 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3783 if (!cmd) {
3784 err = -ENOMEM;
3785 hci_conn_drop(conn);
3786 goto unlock;
3787 }
3788
3789 cmd->cmd_complete = pairing_complete;
3790
3791 /* For LE, just connecting isn't a proof that the pairing finished */
3792 if (cp->addr.type == BDADDR_BREDR) {
3793 conn->connect_cfm_cb = pairing_complete_cb;
3794 conn->security_cfm_cb = pairing_complete_cb;
3795 conn->disconn_cfm_cb = pairing_complete_cb;
3796 } else {
3797 conn->connect_cfm_cb = le_pairing_complete_cb;
3798 conn->security_cfm_cb = le_pairing_complete_cb;
3799 conn->disconn_cfm_cb = le_pairing_complete_cb;
3800 }
3801
3802 conn->io_capability = cp->io_cap;
3803 cmd->user_data = hci_conn_get(conn);
3804
3805 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3806 hci_conn_security(conn, sec_level, auth_type, true)) {
3807 cmd->cmd_complete(cmd, 0);
3808 mgmt_pending_remove(cmd);
3809 }
3810
3811 err = 0;
3812
3813 unlock:
3814 hci_dev_unlock(hdev);
3815 return err;
3816 }
3817
cancel_pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3818 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3819 u16 len)
3820 {
3821 struct mgmt_addr_info *addr = data;
3822 struct mgmt_pending_cmd *cmd;
3823 struct hci_conn *conn;
3824 int err;
3825
3826 bt_dev_dbg(hdev, "sock %p", sk);
3827
3828 hci_dev_lock(hdev);
3829
3830 if (!hdev_is_powered(hdev)) {
3831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3832 MGMT_STATUS_NOT_POWERED);
3833 goto unlock;
3834 }
3835
3836 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr);
3837 if (!cmd) {
3838 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3839 MGMT_STATUS_INVALID_PARAMS);
3840 goto unlock;
3841 }
3842
3843 conn = hci_conn_get(cmd->user_data);
3844
3845 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3846 mgmt_pending_free(cmd);
3847
3848 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3849 addr, sizeof(*addr));
3850
3851 /* Since user doesn't want to proceed with the connection, abort any
3852 * ongoing pairing and then terminate the link if it was created
3853 * because of the pair device action.
3854 */
3855 if (addr->type == BDADDR_BREDR)
3856 hci_remove_link_key(hdev, &addr->bdaddr);
3857 else
3858 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3859 le_addr_type(addr->type));
3860
3861 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3862 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3863
3864 hci_conn_put(conn);
3865
3866 unlock:
3867 hci_dev_unlock(hdev);
3868 return err;
3869 }
3870
user_pairing_resp(struct sock * sk,struct hci_dev * hdev,struct mgmt_addr_info * addr,u16 mgmt_op,u16 hci_op,__le32 passkey)3871 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3872 struct mgmt_addr_info *addr, u16 mgmt_op,
3873 u16 hci_op, __le32 passkey)
3874 {
3875 struct mgmt_pending_cmd *cmd;
3876 struct hci_conn *conn;
3877 int err;
3878
3879 hci_dev_lock(hdev);
3880
3881 if (!hdev_is_powered(hdev)) {
3882 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3883 MGMT_STATUS_NOT_POWERED, addr,
3884 sizeof(*addr));
3885 goto done;
3886 }
3887
3888 if (addr->type == BDADDR_BREDR)
3889 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3890 else
3891 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3892 le_addr_type(addr->type));
3893
3894 if (!conn) {
3895 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3896 MGMT_STATUS_NOT_CONNECTED, addr,
3897 sizeof(*addr));
3898 goto done;
3899 }
3900
3901 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3902 lockdep_assert_held(&conn->hdev->lock);
3903
3904 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3905 if (!err)
3906 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3907 MGMT_STATUS_SUCCESS, addr,
3908 sizeof(*addr));
3909 else
3910 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3911 MGMT_STATUS_FAILED, addr,
3912 sizeof(*addr));
3913
3914 goto done;
3915 }
3916
3917 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3918 if (!cmd) {
3919 err = -ENOMEM;
3920 goto done;
3921 }
3922
3923 cmd->cmd_complete = addr_cmd_complete;
3924
3925 /* Continue with pairing via HCI */
3926 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3927 struct hci_cp_user_passkey_reply cp;
3928
3929 bacpy(&cp.bdaddr, &addr->bdaddr);
3930 cp.passkey = passkey;
3931 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3932 } else
3933 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3934 &addr->bdaddr);
3935
3936 if (err < 0)
3937 mgmt_pending_remove(cmd);
3938
3939 done:
3940 hci_dev_unlock(hdev);
3941 return err;
3942 }
3943
pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3944 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3945 void *data, u16 len)
3946 {
3947 struct mgmt_cp_pin_code_neg_reply *cp = data;
3948
3949 bt_dev_dbg(hdev, "sock %p", sk);
3950
3951 return user_pairing_resp(sk, hdev, &cp->addr,
3952 MGMT_OP_PIN_CODE_NEG_REPLY,
3953 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3954 }
3955
user_confirm_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3956 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3957 u16 len)
3958 {
3959 struct mgmt_cp_user_confirm_reply *cp = data;
3960
3961 bt_dev_dbg(hdev, "sock %p", sk);
3962
3963 if (len != sizeof(*cp))
3964 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3965 MGMT_STATUS_INVALID_PARAMS);
3966
3967 return user_pairing_resp(sk, hdev, &cp->addr,
3968 MGMT_OP_USER_CONFIRM_REPLY,
3969 HCI_OP_USER_CONFIRM_REPLY, 0);
3970 }
3971
user_confirm_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3972 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3973 void *data, u16 len)
3974 {
3975 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3976
3977 bt_dev_dbg(hdev, "sock %p", sk);
3978
3979 return user_pairing_resp(sk, hdev, &cp->addr,
3980 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3981 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3982 }
3983
user_passkey_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3984 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3985 u16 len)
3986 {
3987 struct mgmt_cp_user_passkey_reply *cp = data;
3988
3989 bt_dev_dbg(hdev, "sock %p", sk);
3990
3991 return user_pairing_resp(sk, hdev, &cp->addr,
3992 MGMT_OP_USER_PASSKEY_REPLY,
3993 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3994 }
3995
user_passkey_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3996 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3997 void *data, u16 len)
3998 {
3999 struct mgmt_cp_user_passkey_neg_reply *cp = data;
4000
4001 bt_dev_dbg(hdev, "sock %p", sk);
4002
4003 return user_pairing_resp(sk, hdev, &cp->addr,
4004 MGMT_OP_USER_PASSKEY_NEG_REPLY,
4005 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
4006 }
4007
adv_expire_sync(struct hci_dev * hdev,u32 flags)4008 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
4009 {
4010 struct adv_info *adv_instance;
4011
4012 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
4013 if (!adv_instance)
4014 return 0;
4015
4016 /* stop if current instance doesn't need to be changed */
4017 if (!(adv_instance->flags & flags))
4018 return 0;
4019
4020 cancel_adv_timeout(hdev);
4021
4022 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
4023 if (!adv_instance)
4024 return 0;
4025
4026 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
4027
4028 return 0;
4029 }
4030
name_changed_sync(struct hci_dev * hdev,void * data)4031 static int name_changed_sync(struct hci_dev *hdev, void *data)
4032 {
4033 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
4034 }
4035
set_name_complete(struct hci_dev * hdev,void * data,int err)4036 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
4037 {
4038 struct mgmt_pending_cmd *cmd = data;
4039 struct mgmt_cp_set_local_name *cp;
4040 u8 status = mgmt_status(err);
4041
4042 bt_dev_dbg(hdev, "err %d", err);
4043
4044 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
4045 return;
4046
4047 cp = cmd->param;
4048
4049 if (status) {
4050 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4051 status);
4052 } else {
4053 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4054 cp, sizeof(*cp));
4055
4056 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4057 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
4058 }
4059
4060 mgmt_pending_free(cmd);
4061 }
4062
set_name_sync(struct hci_dev * hdev,void * data)4063 static int set_name_sync(struct hci_dev *hdev, void *data)
4064 {
4065 struct mgmt_pending_cmd *cmd = data;
4066 struct mgmt_cp_set_local_name cp;
4067
4068 mutex_lock(&hdev->mgmt_pending_lock);
4069
4070 if (!__mgmt_pending_listed(hdev, cmd)) {
4071 mutex_unlock(&hdev->mgmt_pending_lock);
4072 return -ECANCELED;
4073 }
4074
4075 memcpy(&cp, cmd->param, sizeof(cp));
4076
4077 mutex_unlock(&hdev->mgmt_pending_lock);
4078
4079 if (lmp_bredr_capable(hdev)) {
4080 hci_update_name_sync(hdev, cp.name);
4081 hci_update_eir_sync(hdev);
4082 }
4083
4084 /* The name is stored in the scan response data and so
4085 * no need to update the advertising data here.
4086 */
4087 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
4088 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
4089
4090 return 0;
4091 }
4092
set_local_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4093 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
4094 u16 len)
4095 {
4096 struct mgmt_cp_set_local_name *cp = data;
4097 struct mgmt_pending_cmd *cmd;
4098 int err;
4099
4100 bt_dev_dbg(hdev, "sock %p", sk);
4101
4102 hci_dev_lock(hdev);
4103
4104 /* If the old values are the same as the new ones just return a
4105 * direct command complete event.
4106 */
4107 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
4108 !memcmp(hdev->short_name, cp->short_name,
4109 sizeof(hdev->short_name))) {
4110 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4111 data, len);
4112 goto failed;
4113 }
4114
4115 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) {
4116 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4117 MGMT_STATUS_BUSY);
4118 goto failed;
4119 }
4120
4121 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
4122
4123 if (!hdev_is_powered(hdev)) {
4124 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
4125
4126 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4127 data, len);
4128 if (err < 0)
4129 goto failed;
4130
4131 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
4132 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
4133 ext_info_changed(hdev, sk);
4134
4135 goto failed;
4136 }
4137
4138 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
4139 if (!cmd)
4140 err = -ENOMEM;
4141 else
4142 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
4143 set_name_complete);
4144
4145 if (err < 0) {
4146 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4147 MGMT_STATUS_FAILED);
4148
4149 if (cmd)
4150 mgmt_pending_remove(cmd);
4151
4152 goto failed;
4153 }
4154
4155 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
4156
4157 failed:
4158 hci_dev_unlock(hdev);
4159 return err;
4160 }
4161
appearance_changed_sync(struct hci_dev * hdev,void * data)4162 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
4163 {
4164 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
4165 }
4166
set_appearance(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4167 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
4168 u16 len)
4169 {
4170 struct mgmt_cp_set_appearance *cp = data;
4171 u16 appearance;
4172 int err;
4173
4174 bt_dev_dbg(hdev, "sock %p", sk);
4175
4176 if (!lmp_le_capable(hdev))
4177 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
4178 MGMT_STATUS_NOT_SUPPORTED);
4179
4180 appearance = le16_to_cpu(cp->appearance);
4181
4182 hci_dev_lock(hdev);
4183
4184 if (hdev->appearance != appearance) {
4185 hdev->appearance = appearance;
4186
4187 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4188 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
4189 NULL);
4190
4191 ext_info_changed(hdev, sk);
4192 }
4193
4194 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
4195 0);
4196
4197 hci_dev_unlock(hdev);
4198
4199 return err;
4200 }
4201
get_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4202 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4203 void *data, u16 len)
4204 {
4205 struct mgmt_rp_get_phy_configuration rp;
4206
4207 bt_dev_dbg(hdev, "sock %p", sk);
4208
4209 hci_dev_lock(hdev);
4210
4211 memset(&rp, 0, sizeof(rp));
4212
4213 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
4214 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
4215 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
4216
4217 hci_dev_unlock(hdev);
4218
4219 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
4220 &rp, sizeof(rp));
4221 }
4222
mgmt_phy_configuration_changed(struct hci_dev * hdev,struct sock * skip)4223 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
4224 {
4225 struct mgmt_ev_phy_configuration_changed ev;
4226
4227 memset(&ev, 0, sizeof(ev));
4228
4229 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
4230
4231 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
4232 sizeof(ev), skip);
4233 }
4234
set_default_phy_complete(struct hci_dev * hdev,void * data,int err)4235 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
4236 {
4237 struct mgmt_pending_cmd *cmd = data;
4238 struct sk_buff *skb;
4239 u8 status = mgmt_status(err);
4240
4241 skb = cmd->skb;
4242
4243 if (!status) {
4244 if (!skb)
4245 status = MGMT_STATUS_FAILED;
4246 else if (IS_ERR(skb))
4247 status = mgmt_status(PTR_ERR(skb));
4248 else
4249 status = mgmt_status(skb->data[0]);
4250 }
4251
4252 bt_dev_dbg(hdev, "status %d", status);
4253
4254 if (status) {
4255 mgmt_cmd_status(cmd->sk, hdev->id,
4256 MGMT_OP_SET_PHY_CONFIGURATION, status);
4257 } else {
4258 mgmt_cmd_complete(cmd->sk, hdev->id,
4259 MGMT_OP_SET_PHY_CONFIGURATION, 0,
4260 NULL, 0);
4261
4262 mgmt_phy_configuration_changed(hdev, cmd->sk);
4263 }
4264
4265 if (skb && !IS_ERR(skb))
4266 kfree_skb(skb);
4267
4268 mgmt_pending_free(cmd);
4269 }
4270
set_default_phy_sync(struct hci_dev * hdev,void * data)4271 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4272 {
4273 struct mgmt_pending_cmd *cmd = data;
4274 struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4275 struct hci_cp_le_set_default_phy cp_phy;
4276 u32 selected_phys;
4277
4278 selected_phys = __le32_to_cpu(cp->selected_phys);
4279
4280 memset(&cp_phy, 0, sizeof(cp_phy));
4281
4282 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4283 cp_phy.all_phys |= 0x01;
4284
4285 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4286 cp_phy.all_phys |= 0x02;
4287
4288 if (selected_phys & MGMT_PHY_LE_1M_TX)
4289 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4290
4291 if (selected_phys & MGMT_PHY_LE_2M_TX)
4292 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4293
4294 if (selected_phys & MGMT_PHY_LE_CODED_TX)
4295 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4296
4297 if (selected_phys & MGMT_PHY_LE_1M_RX)
4298 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4299
4300 if (selected_phys & MGMT_PHY_LE_2M_RX)
4301 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4302
4303 if (selected_phys & MGMT_PHY_LE_CODED_RX)
4304 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4305
4306 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4307 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4308
4309 return 0;
4310 }
4311
set_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4312 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4313 void *data, u16 len)
4314 {
4315 struct mgmt_cp_set_phy_configuration *cp = data;
4316 struct mgmt_pending_cmd *cmd;
4317 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4318 u16 pkt_type = (HCI_DH1 | HCI_DM1);
4319 bool changed = false;
4320 int err;
4321
4322 bt_dev_dbg(hdev, "sock %p", sk);
4323
4324 configurable_phys = get_configurable_phys(hdev);
4325 supported_phys = get_supported_phys(hdev);
4326 selected_phys = __le32_to_cpu(cp->selected_phys);
4327
4328 if (selected_phys & ~supported_phys)
4329 return mgmt_cmd_status(sk, hdev->id,
4330 MGMT_OP_SET_PHY_CONFIGURATION,
4331 MGMT_STATUS_INVALID_PARAMS);
4332
4333 unconfigure_phys = supported_phys & ~configurable_phys;
4334
4335 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4336 return mgmt_cmd_status(sk, hdev->id,
4337 MGMT_OP_SET_PHY_CONFIGURATION,
4338 MGMT_STATUS_INVALID_PARAMS);
4339
4340 if (selected_phys == get_selected_phys(hdev))
4341 return mgmt_cmd_complete(sk, hdev->id,
4342 MGMT_OP_SET_PHY_CONFIGURATION,
4343 0, NULL, 0);
4344
4345 hci_dev_lock(hdev);
4346
4347 if (!hdev_is_powered(hdev)) {
4348 err = mgmt_cmd_status(sk, hdev->id,
4349 MGMT_OP_SET_PHY_CONFIGURATION,
4350 MGMT_STATUS_REJECTED);
4351 goto unlock;
4352 }
4353
4354 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4355 err = mgmt_cmd_status(sk, hdev->id,
4356 MGMT_OP_SET_PHY_CONFIGURATION,
4357 MGMT_STATUS_BUSY);
4358 goto unlock;
4359 }
4360
4361 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4362 pkt_type |= (HCI_DH3 | HCI_DM3);
4363 else
4364 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4365
4366 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4367 pkt_type |= (HCI_DH5 | HCI_DM5);
4368 else
4369 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4370
4371 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4372 pkt_type &= ~HCI_2DH1;
4373 else
4374 pkt_type |= HCI_2DH1;
4375
4376 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4377 pkt_type &= ~HCI_2DH3;
4378 else
4379 pkt_type |= HCI_2DH3;
4380
4381 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4382 pkt_type &= ~HCI_2DH5;
4383 else
4384 pkt_type |= HCI_2DH5;
4385
4386 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4387 pkt_type &= ~HCI_3DH1;
4388 else
4389 pkt_type |= HCI_3DH1;
4390
4391 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4392 pkt_type &= ~HCI_3DH3;
4393 else
4394 pkt_type |= HCI_3DH3;
4395
4396 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4397 pkt_type &= ~HCI_3DH5;
4398 else
4399 pkt_type |= HCI_3DH5;
4400
4401 if (pkt_type != hdev->pkt_type) {
4402 hdev->pkt_type = pkt_type;
4403 changed = true;
4404 }
4405
4406 if ((selected_phys & MGMT_PHY_LE_MASK) ==
4407 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4408 if (changed)
4409 mgmt_phy_configuration_changed(hdev, sk);
4410
4411 err = mgmt_cmd_complete(sk, hdev->id,
4412 MGMT_OP_SET_PHY_CONFIGURATION,
4413 0, NULL, 0);
4414
4415 goto unlock;
4416 }
4417
4418 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4419 len);
4420 if (!cmd)
4421 err = -ENOMEM;
4422 else
4423 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4424 set_default_phy_complete);
4425
4426 if (err < 0) {
4427 err = mgmt_cmd_status(sk, hdev->id,
4428 MGMT_OP_SET_PHY_CONFIGURATION,
4429 MGMT_STATUS_FAILED);
4430
4431 if (cmd)
4432 mgmt_pending_remove(cmd);
4433 }
4434
4435 unlock:
4436 hci_dev_unlock(hdev);
4437
4438 return err;
4439 }
4440
set_blocked_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4441 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4442 u16 len)
4443 {
4444 int err = MGMT_STATUS_SUCCESS;
4445 struct mgmt_cp_set_blocked_keys *keys = data;
4446 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4447 sizeof(struct mgmt_blocked_key_info));
4448 u16 key_count, expected_len;
4449 int i;
4450
4451 bt_dev_dbg(hdev, "sock %p", sk);
4452
4453 key_count = __le16_to_cpu(keys->key_count);
4454 if (key_count > max_key_count) {
4455 bt_dev_err(hdev, "too big key_count value %u", key_count);
4456 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4457 MGMT_STATUS_INVALID_PARAMS);
4458 }
4459
4460 expected_len = struct_size(keys, keys, key_count);
4461 if (expected_len != len) {
4462 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4463 expected_len, len);
4464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4465 MGMT_STATUS_INVALID_PARAMS);
4466 }
4467
4468 hci_dev_lock(hdev);
4469
4470 hci_blocked_keys_clear(hdev);
4471
4472 for (i = 0; i < key_count; ++i) {
4473 struct blocked_key *b = kzalloc_obj(*b);
4474
4475 if (!b) {
4476 err = MGMT_STATUS_NO_RESOURCES;
4477 break;
4478 }
4479
4480 b->type = keys->keys[i].type;
4481 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4482 list_add_rcu(&b->list, &hdev->blocked_keys);
4483 }
4484 hci_dev_unlock(hdev);
4485
4486 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4487 err, NULL, 0);
4488 }
4489
set_wideband_speech(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4490 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4491 void *data, u16 len)
4492 {
4493 struct mgmt_mode *cp = data;
4494 int err;
4495 bool changed = false;
4496
4497 bt_dev_dbg(hdev, "sock %p", sk);
4498
4499 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED))
4500 return mgmt_cmd_status(sk, hdev->id,
4501 MGMT_OP_SET_WIDEBAND_SPEECH,
4502 MGMT_STATUS_NOT_SUPPORTED);
4503
4504 if (cp->val != 0x00 && cp->val != 0x01)
4505 return mgmt_cmd_status(sk, hdev->id,
4506 MGMT_OP_SET_WIDEBAND_SPEECH,
4507 MGMT_STATUS_INVALID_PARAMS);
4508
4509 hci_dev_lock(hdev);
4510
4511 if (hdev_is_powered(hdev) &&
4512 !!cp->val != hci_dev_test_flag(hdev,
4513 HCI_WIDEBAND_SPEECH_ENABLED)) {
4514 err = mgmt_cmd_status(sk, hdev->id,
4515 MGMT_OP_SET_WIDEBAND_SPEECH,
4516 MGMT_STATUS_REJECTED);
4517 goto unlock;
4518 }
4519
4520 if (cp->val)
4521 changed = !hci_dev_test_and_set_flag(hdev,
4522 HCI_WIDEBAND_SPEECH_ENABLED);
4523 else
4524 changed = hci_dev_test_and_clear_flag(hdev,
4525 HCI_WIDEBAND_SPEECH_ENABLED);
4526
4527 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4528 if (err < 0)
4529 goto unlock;
4530
4531 if (changed)
4532 err = new_settings(hdev, sk);
4533
4534 unlock:
4535 hci_dev_unlock(hdev);
4536 return err;
4537 }
4538
read_controller_cap(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)4539 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4540 void *data, u16 data_len)
4541 {
4542 char buf[20];
4543 struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4544 u16 cap_len = 0;
4545 u8 flags = 0;
4546 u8 tx_power_range[2];
4547
4548 bt_dev_dbg(hdev, "sock %p", sk);
4549
4550 memset(&buf, 0, sizeof(buf));
4551
4552 hci_dev_lock(hdev);
4553
4554 /* When the Read Simple Pairing Options command is supported, then
4555 * the remote public key validation is supported.
4556 *
4557 * Alternatively, when Microsoft extensions are available, they can
4558 * indicate support for public key validation as well.
4559 */
4560 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4561 flags |= 0x01; /* Remote public key validation (BR/EDR) */
4562
4563 flags |= 0x02; /* Remote public key validation (LE) */
4564
4565 /* When the Read Encryption Key Size command is supported, then the
4566 * encryption key size is enforced.
4567 */
4568 if (hdev->commands[20] & 0x10)
4569 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */
4570
4571 flags |= 0x08; /* Encryption key size enforcement (LE) */
4572
4573 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4574 &flags, 1);
4575
4576 /* When the Read Simple Pairing Options command is supported, then
4577 * also max encryption key size information is provided.
4578 */
4579 if (hdev->commands[41] & 0x08)
4580 cap_len = eir_append_le16(rp->cap, cap_len,
4581 MGMT_CAP_MAX_ENC_KEY_SIZE,
4582 hdev->max_enc_key_size);
4583
4584 cap_len = eir_append_le16(rp->cap, cap_len,
4585 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4586 SMP_MAX_ENC_KEY_SIZE);
4587
4588 /* Append the min/max LE tx power parameters if we were able to fetch
4589 * it from the controller
4590 */
4591 if (hdev->commands[38] & 0x80) {
4592 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4593 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4594 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4595 tx_power_range, 2);
4596 }
4597
4598 rp->cap_len = cpu_to_le16(cap_len);
4599
4600 hci_dev_unlock(hdev);
4601
4602 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4603 rp, sizeof(*rp) + cap_len);
4604 }
4605
4606 #ifdef CONFIG_BT_FEATURE_DEBUG
4607 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4608 static const u8 debug_uuid[16] = {
4609 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4610 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4611 };
4612 #endif
4613
4614 /* 330859bc-7506-492d-9370-9a6f0614037f */
4615 static const u8 quality_report_uuid[16] = {
4616 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4617 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4618 };
4619
4620 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4621 static const u8 offload_codecs_uuid[16] = {
4622 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4623 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4624 };
4625
4626 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4627 static const u8 le_simultaneous_roles_uuid[16] = {
4628 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4629 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4630 };
4631
4632 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4633 static const u8 iso_socket_uuid[16] = {
4634 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4635 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4636 };
4637
4638 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4639 static const u8 mgmt_mesh_uuid[16] = {
4640 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4641 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4642 };
4643
read_exp_features_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)4644 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4645 void *data, u16 data_len)
4646 {
4647 struct mgmt_rp_read_exp_features_info *rp;
4648 size_t len;
4649 u16 idx = 0;
4650 u32 flags;
4651 int status;
4652
4653 bt_dev_dbg(hdev, "sock %p", sk);
4654
4655 /* Enough space for 7 features */
4656 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4657 rp = kzalloc(len, GFP_KERNEL);
4658 if (!rp)
4659 return -ENOMEM;
4660
4661 #ifdef CONFIG_BT_FEATURE_DEBUG
4662 flags = bt_dbg_get() ? BIT(0) : 0;
4663
4664 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4665 rp->features[idx].flags = cpu_to_le32(flags);
4666 idx++;
4667 #endif
4668
4669 if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4670 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4671 flags = BIT(0);
4672 else
4673 flags = 0;
4674
4675 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4676 rp->features[idx].flags = cpu_to_le32(flags);
4677 idx++;
4678 }
4679
4680 if (hdev && (aosp_has_quality_report(hdev) ||
4681 hdev->set_quality_report)) {
4682 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4683 flags = BIT(0);
4684 else
4685 flags = 0;
4686
4687 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4688 rp->features[idx].flags = cpu_to_le32(flags);
4689 idx++;
4690 }
4691
4692 if (hdev && hdev->get_data_path_id) {
4693 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4694 flags = BIT(0);
4695 else
4696 flags = 0;
4697
4698 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4699 rp->features[idx].flags = cpu_to_le32(flags);
4700 idx++;
4701 }
4702
4703 if (IS_ENABLED(CONFIG_BT_LE)) {
4704 flags = iso_inited() ? BIT(0) : 0;
4705 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4706 rp->features[idx].flags = cpu_to_le32(flags);
4707 idx++;
4708 }
4709
4710 if (hdev && lmp_le_capable(hdev)) {
4711 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4712 flags = BIT(0);
4713 else
4714 flags = 0;
4715
4716 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4717 rp->features[idx].flags = cpu_to_le32(flags);
4718 idx++;
4719 }
4720
4721 rp->feature_count = cpu_to_le16(idx);
4722
4723 /* After reading the experimental features information, enable
4724 * the events to update client on any future change.
4725 */
4726 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4727
4728 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4729 MGMT_OP_READ_EXP_FEATURES_INFO,
4730 0, rp, sizeof(*rp) + (20 * idx));
4731
4732 kfree(rp);
4733 return status;
4734 }
4735
exp_feature_changed(struct hci_dev * hdev,const u8 * uuid,bool enabled,struct sock * skip)4736 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4737 bool enabled, struct sock *skip)
4738 {
4739 struct mgmt_ev_exp_feature_changed ev;
4740
4741 memset(&ev, 0, sizeof(ev));
4742 memcpy(ev.uuid, uuid, 16);
4743 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4744
4745 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4746 &ev, sizeof(ev),
4747 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4748 }
4749
4750 #define EXP_FEAT(_uuid, _set_func) \
4751 { \
4752 .uuid = _uuid, \
4753 .set_func = _set_func, \
4754 }
4755
4756 /* The zero key uuid is special. Multiple exp features are set through it. */
set_zero_key_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4757 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4758 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4759 {
4760 struct mgmt_rp_set_exp_feature rp;
4761
4762 memset(rp.uuid, 0, 16);
4763 rp.flags = cpu_to_le32(0);
4764
4765 #ifdef CONFIG_BT_FEATURE_DEBUG
4766 if (!hdev) {
4767 bool changed = bt_dbg_get();
4768
4769 bt_dbg_set(false);
4770
4771 if (changed)
4772 exp_feature_changed(NULL, ZERO_KEY, false, sk);
4773 }
4774 #endif
4775
4776 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4777
4778 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4779 MGMT_OP_SET_EXP_FEATURE, 0,
4780 &rp, sizeof(rp));
4781 }
4782
4783 #ifdef CONFIG_BT_FEATURE_DEBUG
set_debug_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4784 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4785 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4786 {
4787 struct mgmt_rp_set_exp_feature rp;
4788
4789 bool val, changed;
4790 int err;
4791
4792 /* Command requires to use the non-controller index */
4793 if (hdev)
4794 return mgmt_cmd_status(sk, hdev->id,
4795 MGMT_OP_SET_EXP_FEATURE,
4796 MGMT_STATUS_INVALID_INDEX);
4797
4798 /* Parameters are limited to a single octet */
4799 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4800 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4801 MGMT_OP_SET_EXP_FEATURE,
4802 MGMT_STATUS_INVALID_PARAMS);
4803
4804 /* Only boolean on/off is supported */
4805 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4806 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4807 MGMT_OP_SET_EXP_FEATURE,
4808 MGMT_STATUS_INVALID_PARAMS);
4809
4810 val = !!cp->param[0];
4811 changed = val ? !bt_dbg_get() : bt_dbg_get();
4812 bt_dbg_set(val);
4813
4814 memcpy(rp.uuid, debug_uuid, 16);
4815 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4816
4817 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4818
4819 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4820 MGMT_OP_SET_EXP_FEATURE, 0,
4821 &rp, sizeof(rp));
4822
4823 if (changed)
4824 exp_feature_changed(hdev, debug_uuid, val, sk);
4825
4826 return err;
4827 }
4828 #endif
4829
set_mgmt_mesh_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4830 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4831 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4832 {
4833 struct mgmt_rp_set_exp_feature rp;
4834 bool val, changed;
4835 int err;
4836
4837 /* Command requires to use the controller index */
4838 if (!hdev)
4839 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4840 MGMT_OP_SET_EXP_FEATURE,
4841 MGMT_STATUS_INVALID_INDEX);
4842
4843 /* Parameters are limited to a single octet */
4844 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4845 return mgmt_cmd_status(sk, hdev->id,
4846 MGMT_OP_SET_EXP_FEATURE,
4847 MGMT_STATUS_INVALID_PARAMS);
4848
4849 /* Only boolean on/off is supported */
4850 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4851 return mgmt_cmd_status(sk, hdev->id,
4852 MGMT_OP_SET_EXP_FEATURE,
4853 MGMT_STATUS_INVALID_PARAMS);
4854
4855 val = !!cp->param[0];
4856
4857 if (val) {
4858 changed = !hci_dev_test_and_set_flag(hdev,
4859 HCI_MESH_EXPERIMENTAL);
4860 } else {
4861 hci_dev_clear_flag(hdev, HCI_MESH);
4862 changed = hci_dev_test_and_clear_flag(hdev,
4863 HCI_MESH_EXPERIMENTAL);
4864 }
4865
4866 memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4867 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4868
4869 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4870
4871 err = mgmt_cmd_complete(sk, hdev->id,
4872 MGMT_OP_SET_EXP_FEATURE, 0,
4873 &rp, sizeof(rp));
4874
4875 if (changed)
4876 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4877
4878 return err;
4879 }
4880
set_quality_report_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4881 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4882 struct mgmt_cp_set_exp_feature *cp,
4883 u16 data_len)
4884 {
4885 struct mgmt_rp_set_exp_feature rp;
4886 bool val, changed;
4887 int err;
4888
4889 /* Command requires to use a valid controller index */
4890 if (!hdev)
4891 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4892 MGMT_OP_SET_EXP_FEATURE,
4893 MGMT_STATUS_INVALID_INDEX);
4894
4895 /* Parameters are limited to a single octet */
4896 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4897 return mgmt_cmd_status(sk, hdev->id,
4898 MGMT_OP_SET_EXP_FEATURE,
4899 MGMT_STATUS_INVALID_PARAMS);
4900
4901 /* Only boolean on/off is supported */
4902 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4903 return mgmt_cmd_status(sk, hdev->id,
4904 MGMT_OP_SET_EXP_FEATURE,
4905 MGMT_STATUS_INVALID_PARAMS);
4906
4907 hci_req_sync_lock(hdev);
4908
4909 val = !!cp->param[0];
4910 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4911
4912 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4913 err = mgmt_cmd_status(sk, hdev->id,
4914 MGMT_OP_SET_EXP_FEATURE,
4915 MGMT_STATUS_NOT_SUPPORTED);
4916 goto unlock_quality_report;
4917 }
4918
4919 if (changed) {
4920 if (hdev->set_quality_report)
4921 err = hdev->set_quality_report(hdev, val);
4922 else
4923 err = aosp_set_quality_report(hdev, val);
4924
4925 if (err) {
4926 err = mgmt_cmd_status(sk, hdev->id,
4927 MGMT_OP_SET_EXP_FEATURE,
4928 MGMT_STATUS_FAILED);
4929 goto unlock_quality_report;
4930 }
4931
4932 if (val)
4933 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4934 else
4935 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4936 }
4937
4938 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4939
4940 memcpy(rp.uuid, quality_report_uuid, 16);
4941 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4942 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4943
4944 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4945 &rp, sizeof(rp));
4946
4947 if (changed)
4948 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4949
4950 unlock_quality_report:
4951 hci_req_sync_unlock(hdev);
4952 return err;
4953 }
4954
set_offload_codec_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4955 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4956 struct mgmt_cp_set_exp_feature *cp,
4957 u16 data_len)
4958 {
4959 bool val, changed;
4960 int err;
4961 struct mgmt_rp_set_exp_feature rp;
4962
4963 /* Command requires to use a valid controller index */
4964 if (!hdev)
4965 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4966 MGMT_OP_SET_EXP_FEATURE,
4967 MGMT_STATUS_INVALID_INDEX);
4968
4969 /* Parameters are limited to a single octet */
4970 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4971 return mgmt_cmd_status(sk, hdev->id,
4972 MGMT_OP_SET_EXP_FEATURE,
4973 MGMT_STATUS_INVALID_PARAMS);
4974
4975 /* Only boolean on/off is supported */
4976 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4977 return mgmt_cmd_status(sk, hdev->id,
4978 MGMT_OP_SET_EXP_FEATURE,
4979 MGMT_STATUS_INVALID_PARAMS);
4980
4981 val = !!cp->param[0];
4982 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4983
4984 if (!hdev->get_data_path_id) {
4985 return mgmt_cmd_status(sk, hdev->id,
4986 MGMT_OP_SET_EXP_FEATURE,
4987 MGMT_STATUS_NOT_SUPPORTED);
4988 }
4989
4990 if (changed) {
4991 if (val)
4992 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4993 else
4994 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4995 }
4996
4997 bt_dev_info(hdev, "offload codecs enable %d changed %d",
4998 val, changed);
4999
5000 memcpy(rp.uuid, offload_codecs_uuid, 16);
5001 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5002 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5003 err = mgmt_cmd_complete(sk, hdev->id,
5004 MGMT_OP_SET_EXP_FEATURE, 0,
5005 &rp, sizeof(rp));
5006
5007 if (changed)
5008 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
5009
5010 return err;
5011 }
5012
set_le_simultaneous_roles_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)5013 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
5014 struct mgmt_cp_set_exp_feature *cp,
5015 u16 data_len)
5016 {
5017 bool val, changed;
5018 int err;
5019 struct mgmt_rp_set_exp_feature rp;
5020
5021 /* Command requires to use a valid controller index */
5022 if (!hdev)
5023 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5024 MGMT_OP_SET_EXP_FEATURE,
5025 MGMT_STATUS_INVALID_INDEX);
5026
5027 /* Parameters are limited to a single octet */
5028 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
5029 return mgmt_cmd_status(sk, hdev->id,
5030 MGMT_OP_SET_EXP_FEATURE,
5031 MGMT_STATUS_INVALID_PARAMS);
5032
5033 /* Only boolean on/off is supported */
5034 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
5035 return mgmt_cmd_status(sk, hdev->id,
5036 MGMT_OP_SET_EXP_FEATURE,
5037 MGMT_STATUS_INVALID_PARAMS);
5038
5039 val = !!cp->param[0];
5040 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
5041
5042 if (!hci_dev_le_state_simultaneous(hdev)) {
5043 return mgmt_cmd_status(sk, hdev->id,
5044 MGMT_OP_SET_EXP_FEATURE,
5045 MGMT_STATUS_NOT_SUPPORTED);
5046 }
5047
5048 if (changed) {
5049 if (val)
5050 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
5051 else
5052 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
5053 }
5054
5055 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
5056 val, changed);
5057
5058 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
5059 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5060 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5061 err = mgmt_cmd_complete(sk, hdev->id,
5062 MGMT_OP_SET_EXP_FEATURE, 0,
5063 &rp, sizeof(rp));
5064
5065 if (changed)
5066 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
5067
5068 return err;
5069 }
5070
5071 #ifdef CONFIG_BT_LE
set_iso_socket_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)5072 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
5073 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
5074 {
5075 struct mgmt_rp_set_exp_feature rp;
5076 bool val, changed = false;
5077 int err;
5078
5079 /* Command requires to use the non-controller index */
5080 if (hdev)
5081 return mgmt_cmd_status(sk, hdev->id,
5082 MGMT_OP_SET_EXP_FEATURE,
5083 MGMT_STATUS_INVALID_INDEX);
5084
5085 /* Parameters are limited to a single octet */
5086 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
5087 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5088 MGMT_OP_SET_EXP_FEATURE,
5089 MGMT_STATUS_INVALID_PARAMS);
5090
5091 /* Only boolean on/off is supported */
5092 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
5093 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5094 MGMT_OP_SET_EXP_FEATURE,
5095 MGMT_STATUS_INVALID_PARAMS);
5096
5097 val = cp->param[0] ? true : false;
5098 if (val)
5099 err = iso_init();
5100 else
5101 err = iso_exit();
5102
5103 if (!err)
5104 changed = true;
5105
5106 memcpy(rp.uuid, iso_socket_uuid, 16);
5107 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5108
5109 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5110
5111 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
5112 MGMT_OP_SET_EXP_FEATURE, 0,
5113 &rp, sizeof(rp));
5114
5115 if (changed)
5116 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
5117
5118 return err;
5119 }
5120 #endif
5121
5122 static const struct mgmt_exp_feature {
5123 const u8 *uuid;
5124 int (*set_func)(struct sock *sk, struct hci_dev *hdev,
5125 struct mgmt_cp_set_exp_feature *cp, u16 data_len);
5126 } exp_features[] = {
5127 EXP_FEAT(ZERO_KEY, set_zero_key_func),
5128 #ifdef CONFIG_BT_FEATURE_DEBUG
5129 EXP_FEAT(debug_uuid, set_debug_func),
5130 #endif
5131 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5132 EXP_FEAT(quality_report_uuid, set_quality_report_func),
5133 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5134 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5135 #ifdef CONFIG_BT_LE
5136 EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5137 #endif
5138
5139 /* end with a null feature */
5140 EXP_FEAT(NULL, NULL)
5141 };
5142
set_exp_feature(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5143 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5144 void *data, u16 data_len)
5145 {
5146 struct mgmt_cp_set_exp_feature *cp = data;
5147 size_t i = 0;
5148
5149 bt_dev_dbg(hdev, "sock %p", sk);
5150
5151 for (i = 0; exp_features[i].uuid; i++) {
5152 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5153 return exp_features[i].set_func(sk, hdev, cp, data_len);
5154 }
5155
5156 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5157 MGMT_OP_SET_EXP_FEATURE,
5158 MGMT_STATUS_NOT_SUPPORTED);
5159 }
5160
get_device_flags(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5161 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5162 u16 data_len)
5163 {
5164 struct mgmt_cp_get_device_flags *cp = data;
5165 struct mgmt_rp_get_device_flags rp;
5166 struct bdaddr_list_with_flags *br_params;
5167 struct hci_conn_params *params;
5168 u32 supported_flags;
5169 u32 current_flags = 0;
5170 u8 status = MGMT_STATUS_INVALID_PARAMS;
5171
5172 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5173 &cp->addr.bdaddr, cp->addr.type);
5174
5175 hci_dev_lock(hdev);
5176
5177 supported_flags = hdev->conn_flags;
5178
5179 memset(&rp, 0, sizeof(rp));
5180
5181 if (cp->addr.type == BDADDR_BREDR) {
5182 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5183 &cp->addr.bdaddr,
5184 cp->addr.type);
5185 if (!br_params)
5186 goto done;
5187
5188 current_flags = br_params->flags;
5189 } else {
5190 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5191 le_addr_type(cp->addr.type));
5192 if (!params)
5193 goto done;
5194
5195 current_flags = params->flags;
5196 }
5197
5198 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5199 rp.addr.type = cp->addr.type;
5200 rp.supported_flags = cpu_to_le32(supported_flags);
5201 rp.current_flags = cpu_to_le32(current_flags);
5202
5203 status = MGMT_STATUS_SUCCESS;
5204
5205 done:
5206 hci_dev_unlock(hdev);
5207
5208 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5209 &rp, sizeof(rp));
5210 }
5211
device_flags_changed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u32 supported_flags,u32 current_flags)5212 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5213 bdaddr_t *bdaddr, u8 bdaddr_type,
5214 u32 supported_flags, u32 current_flags)
5215 {
5216 struct mgmt_ev_device_flags_changed ev;
5217
5218 bacpy(&ev.addr.bdaddr, bdaddr);
5219 ev.addr.type = bdaddr_type;
5220 ev.supported_flags = cpu_to_le32(supported_flags);
5221 ev.current_flags = cpu_to_le32(current_flags);
5222
5223 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5224 }
5225
is_connected(struct hci_dev * hdev,bdaddr_t * addr,u8 type)5226 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5227 {
5228 struct hci_conn *conn;
5229
5230 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5231 if (!conn)
5232 return false;
5233
5234 if (conn->dst_type != type)
5235 return false;
5236
5237 if (conn->state != BT_CONNECTED)
5238 return false;
5239
5240 return true;
5241 }
5242
5243 /* This function requires the caller holds hdev->lock */
hci_conn_params_set(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,u8 auto_connect)5244 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev,
5245 bdaddr_t *addr, u8 addr_type,
5246 u8 auto_connect)
5247 {
5248 struct hci_conn_params *params;
5249
5250 params = hci_conn_params_add(hdev, addr, addr_type);
5251 if (!params)
5252 return NULL;
5253
5254 if (params->auto_connect == auto_connect)
5255 return params;
5256
5257 hci_pend_le_list_del_init(params);
5258
5259 switch (auto_connect) {
5260 case HCI_AUTO_CONN_DISABLED:
5261 case HCI_AUTO_CONN_LINK_LOSS:
5262 /* If auto connect is being disabled when we're trying to
5263 * connect to device, keep connecting.
5264 */
5265 if (params->explicit_connect)
5266 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5267 break;
5268 case HCI_AUTO_CONN_REPORT:
5269 if (params->explicit_connect)
5270 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5271 else
5272 hci_pend_le_list_add(params, &hdev->pend_le_reports);
5273 break;
5274 case HCI_AUTO_CONN_DIRECT:
5275 case HCI_AUTO_CONN_ALWAYS:
5276 if (!is_connected(hdev, addr, addr_type))
5277 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5278 break;
5279 }
5280
5281 params->auto_connect = auto_connect;
5282
5283 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
5284 addr, addr_type, auto_connect);
5285
5286 return params;
5287 }
5288
set_device_flags(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5289 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5290 u16 len)
5291 {
5292 struct mgmt_cp_set_device_flags *cp = data;
5293 struct bdaddr_list_with_flags *br_params;
5294 struct hci_conn_params *params;
5295 u8 status = MGMT_STATUS_INVALID_PARAMS;
5296 u32 supported_flags;
5297 u32 current_flags = __le32_to_cpu(cp->current_flags);
5298
5299 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5300 &cp->addr.bdaddr, cp->addr.type, current_flags);
5301
5302 // We should take hci_dev_lock() early, I think.. conn_flags can change
5303 supported_flags = hdev->conn_flags;
5304
5305 if ((supported_flags | current_flags) != supported_flags) {
5306 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5307 current_flags, supported_flags);
5308 goto done;
5309 }
5310
5311 hci_dev_lock(hdev);
5312
5313 if (cp->addr.type == BDADDR_BREDR) {
5314 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5315 &cp->addr.bdaddr,
5316 cp->addr.type);
5317
5318 if (br_params) {
5319 br_params->flags = current_flags;
5320 status = MGMT_STATUS_SUCCESS;
5321 } else {
5322 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5323 &cp->addr.bdaddr, cp->addr.type);
5324 }
5325
5326 goto unlock;
5327 }
5328
5329 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5330 le_addr_type(cp->addr.type));
5331 if (!params) {
5332 /* Create a new hci_conn_params if it doesn't exist */
5333 params = hci_conn_params_set(hdev, &cp->addr.bdaddr,
5334 le_addr_type(cp->addr.type),
5335 HCI_AUTO_CONN_DISABLED);
5336 if (!params) {
5337 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5338 &cp->addr.bdaddr,
5339 le_addr_type(cp->addr.type));
5340 goto unlock;
5341 }
5342 }
5343
5344 supported_flags = hdev->conn_flags;
5345
5346 if ((supported_flags | current_flags) != supported_flags) {
5347 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5348 current_flags, supported_flags);
5349 goto unlock;
5350 }
5351
5352 WRITE_ONCE(params->flags, current_flags);
5353 status = MGMT_STATUS_SUCCESS;
5354
5355 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5356 * has been set.
5357 */
5358 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5359 hci_update_passive_scan(hdev);
5360
5361 unlock:
5362 hci_dev_unlock(hdev);
5363
5364 done:
5365 if (status == MGMT_STATUS_SUCCESS)
5366 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5367 supported_flags, current_flags);
5368
5369 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5370 &cp->addr, sizeof(cp->addr));
5371 }
5372
mgmt_adv_monitor_added(struct sock * sk,struct hci_dev * hdev,u16 handle)5373 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5374 u16 handle)
5375 {
5376 struct mgmt_ev_adv_monitor_added ev;
5377
5378 ev.monitor_handle = cpu_to_le16(handle);
5379
5380 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5381 }
5382
mgmt_adv_monitor_removed(struct sock * sk,struct hci_dev * hdev,__le16 handle)5383 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
5384 __le16 handle)
5385 {
5386 struct mgmt_ev_adv_monitor_removed ev;
5387
5388 ev.monitor_handle = handle;
5389
5390 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
5391 }
5392
read_adv_mon_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5393 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5394 void *data, u16 len)
5395 {
5396 struct adv_monitor *monitor = NULL;
5397 struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5398 int handle, err;
5399 size_t rp_size = 0;
5400 __u32 supported = 0;
5401 __u32 enabled = 0;
5402 __u16 num_handles = 0;
5403 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5404
5405 BT_DBG("request for %s", hdev->name);
5406
5407 hci_dev_lock(hdev);
5408
5409 if (msft_monitor_supported(hdev))
5410 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5411
5412 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5413 handles[num_handles++] = monitor->handle;
5414
5415 hci_dev_unlock(hdev);
5416
5417 rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5418 rp = kmalloc(rp_size, GFP_KERNEL);
5419 if (!rp)
5420 return -ENOMEM;
5421
5422 /* All supported features are currently enabled */
5423 enabled = supported;
5424
5425 rp->supported_features = cpu_to_le32(supported);
5426 rp->enabled_features = cpu_to_le32(enabled);
5427 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5428 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5429 rp->num_handles = cpu_to_le16(num_handles);
5430 if (num_handles)
5431 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5432
5433 err = mgmt_cmd_complete(sk, hdev->id,
5434 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5435 MGMT_STATUS_SUCCESS, rp, rp_size);
5436
5437 kfree(rp);
5438
5439 return err;
5440 }
5441
mgmt_add_adv_patterns_monitor_complete(struct hci_dev * hdev,void * data,int status)5442 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5443 void *data, int status)
5444 {
5445 struct mgmt_rp_add_adv_patterns_monitor rp;
5446 struct mgmt_pending_cmd *cmd = data;
5447 struct adv_monitor *monitor;
5448
5449 /* This is likely the result of hdev being closed and mgmt_index_removed
5450 * is attempting to clean up any pending command so
5451 * hci_adv_monitors_clear is about to be called which will take care of
5452 * freeing the adv_monitor instances.
5453 */
5454 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
5455 return;
5456
5457 monitor = cmd->user_data;
5458
5459 hci_dev_lock(hdev);
5460
5461 rp.monitor_handle = cpu_to_le16(monitor->handle);
5462
5463 if (!status) {
5464 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5465 hdev->adv_monitors_cnt++;
5466 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5467 monitor->state = ADV_MONITOR_STATE_REGISTERED;
5468 hci_update_passive_scan(hdev);
5469 } else {
5470 hci_free_adv_monitor(hdev, monitor);
5471 }
5472
5473 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
5474 mgmt_status(status), &rp, sizeof(rp));
5475 mgmt_pending_free(cmd);
5476
5477 hci_dev_unlock(hdev);
5478 bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5479 rp.monitor_handle, status);
5480 }
5481
mgmt_add_adv_patterns_monitor_sync(struct hci_dev * hdev,void * data)5482 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5483 {
5484 struct mgmt_pending_cmd *cmd = data;
5485 struct adv_monitor *mon;
5486
5487 mutex_lock(&hdev->mgmt_pending_lock);
5488
5489 if (!__mgmt_pending_listed(hdev, cmd)) {
5490 mutex_unlock(&hdev->mgmt_pending_lock);
5491 return -ECANCELED;
5492 }
5493
5494 mon = cmd->user_data;
5495
5496 mutex_unlock(&hdev->mgmt_pending_lock);
5497
5498 return hci_add_adv_monitor(hdev, mon);
5499 }
5500
__add_adv_patterns_monitor(struct sock * sk,struct hci_dev * hdev,struct adv_monitor * m,u8 status,void * data,u16 len,u16 op)5501 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5502 struct adv_monitor *m, u8 status,
5503 void *data, u16 len, u16 op)
5504 {
5505 struct mgmt_pending_cmd *cmd;
5506 int err;
5507
5508 hci_dev_lock(hdev);
5509
5510 if (status)
5511 goto unlock;
5512
5513 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5514 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5515 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5516 status = MGMT_STATUS_BUSY;
5517 goto unlock;
5518 }
5519
5520 cmd = mgmt_pending_add(sk, op, hdev, data, len);
5521 if (!cmd) {
5522 status = MGMT_STATUS_NO_RESOURCES;
5523 goto unlock;
5524 }
5525
5526 cmd->user_data = m;
5527 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5528 mgmt_add_adv_patterns_monitor_complete);
5529 if (err) {
5530 if (err == -ENOMEM)
5531 status = MGMT_STATUS_NO_RESOURCES;
5532 else
5533 status = MGMT_STATUS_FAILED;
5534
5535 goto unlock;
5536 }
5537
5538 hci_dev_unlock(hdev);
5539
5540 return 0;
5541
5542 unlock:
5543 hci_free_adv_monitor(hdev, m);
5544 hci_dev_unlock(hdev);
5545 return mgmt_cmd_status(sk, hdev->id, op, status);
5546 }
5547
parse_adv_monitor_rssi(struct adv_monitor * m,struct mgmt_adv_rssi_thresholds * rssi)5548 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5549 struct mgmt_adv_rssi_thresholds *rssi)
5550 {
5551 if (rssi) {
5552 m->rssi.low_threshold = rssi->low_threshold;
5553 m->rssi.low_threshold_timeout =
5554 __le16_to_cpu(rssi->low_threshold_timeout);
5555 m->rssi.high_threshold = rssi->high_threshold;
5556 m->rssi.high_threshold_timeout =
5557 __le16_to_cpu(rssi->high_threshold_timeout);
5558 m->rssi.sampling_period = rssi->sampling_period;
5559 } else {
5560 /* Default values. These numbers are the least constricting
5561 * parameters for MSFT API to work, so it behaves as if there
5562 * are no rssi parameter to consider. May need to be changed
5563 * if other API are to be supported.
5564 */
5565 m->rssi.low_threshold = -127;
5566 m->rssi.low_threshold_timeout = 60;
5567 m->rssi.high_threshold = -127;
5568 m->rssi.high_threshold_timeout = 0;
5569 m->rssi.sampling_period = 0;
5570 }
5571 }
5572
parse_adv_monitor_pattern(struct adv_monitor * m,u8 pattern_count,struct mgmt_adv_pattern * patterns)5573 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5574 struct mgmt_adv_pattern *patterns)
5575 {
5576 u8 offset = 0, length = 0;
5577 struct adv_pattern *p = NULL;
5578 int i;
5579
5580 for (i = 0; i < pattern_count; i++) {
5581 offset = patterns[i].offset;
5582 length = patterns[i].length;
5583 if (offset >= HCI_MAX_AD_LENGTH ||
5584 length > HCI_MAX_AD_LENGTH ||
5585 (offset + length) > HCI_MAX_AD_LENGTH)
5586 return MGMT_STATUS_INVALID_PARAMS;
5587
5588 p = kmalloc_obj(*p);
5589 if (!p)
5590 return MGMT_STATUS_NO_RESOURCES;
5591
5592 p->ad_type = patterns[i].ad_type;
5593 p->offset = patterns[i].offset;
5594 p->length = patterns[i].length;
5595 memcpy(p->value, patterns[i].value, p->length);
5596
5597 INIT_LIST_HEAD(&p->list);
5598 list_add(&p->list, &m->patterns);
5599 }
5600
5601 return MGMT_STATUS_SUCCESS;
5602 }
5603
add_adv_patterns_monitor(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5604 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5605 void *data, u16 len)
5606 {
5607 struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5608 struct adv_monitor *m = NULL;
5609 u8 status = MGMT_STATUS_SUCCESS;
5610 size_t expected_size = sizeof(*cp);
5611
5612 BT_DBG("request for %s", hdev->name);
5613
5614 if (len <= sizeof(*cp)) {
5615 status = MGMT_STATUS_INVALID_PARAMS;
5616 goto done;
5617 }
5618
5619 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5620 if (len != expected_size) {
5621 status = MGMT_STATUS_INVALID_PARAMS;
5622 goto done;
5623 }
5624
5625 m = kzalloc_obj(*m);
5626 if (!m) {
5627 status = MGMT_STATUS_NO_RESOURCES;
5628 goto done;
5629 }
5630
5631 INIT_LIST_HEAD(&m->patterns);
5632
5633 parse_adv_monitor_rssi(m, NULL);
5634 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5635
5636 done:
5637 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5638 MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5639 }
5640
add_adv_patterns_monitor_rssi(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5641 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5642 void *data, u16 len)
5643 {
5644 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5645 struct adv_monitor *m = NULL;
5646 u8 status = MGMT_STATUS_SUCCESS;
5647 size_t expected_size = sizeof(*cp);
5648
5649 BT_DBG("request for %s", hdev->name);
5650
5651 if (len <= sizeof(*cp)) {
5652 status = MGMT_STATUS_INVALID_PARAMS;
5653 goto done;
5654 }
5655
5656 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5657 if (len != expected_size) {
5658 status = MGMT_STATUS_INVALID_PARAMS;
5659 goto done;
5660 }
5661
5662 m = kzalloc_obj(*m);
5663 if (!m) {
5664 status = MGMT_STATUS_NO_RESOURCES;
5665 goto done;
5666 }
5667
5668 INIT_LIST_HEAD(&m->patterns);
5669
5670 parse_adv_monitor_rssi(m, &cp->rssi);
5671 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5672
5673 done:
5674 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5675 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5676 }
5677
mgmt_remove_adv_monitor_complete(struct hci_dev * hdev,void * data,int status)5678 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5679 void *data, int status)
5680 {
5681 struct mgmt_rp_remove_adv_monitor rp;
5682 struct mgmt_pending_cmd *cmd = data;
5683 struct mgmt_cp_remove_adv_monitor *cp;
5684
5685 if (status == -ECANCELED)
5686 return;
5687
5688 hci_dev_lock(hdev);
5689
5690 cp = cmd->param;
5691
5692 rp.monitor_handle = cp->monitor_handle;
5693
5694 if (!status) {
5695 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle);
5696 hci_update_passive_scan(hdev);
5697 }
5698
5699 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
5700 mgmt_status(status), &rp, sizeof(rp));
5701 mgmt_pending_free(cmd);
5702
5703 hci_dev_unlock(hdev);
5704 bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5705 rp.monitor_handle, status);
5706 }
5707
mgmt_remove_adv_monitor_sync(struct hci_dev * hdev,void * data)5708 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5709 {
5710 struct mgmt_pending_cmd *cmd = data;
5711 struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5712 u16 handle = __le16_to_cpu(cp->monitor_handle);
5713
5714 if (!handle)
5715 return hci_remove_all_adv_monitor(hdev);
5716
5717 return hci_remove_single_adv_monitor(hdev, handle);
5718 }
5719
remove_adv_monitor(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5720 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5721 void *data, u16 len)
5722 {
5723 struct mgmt_pending_cmd *cmd;
5724 int err, status;
5725
5726 hci_dev_lock(hdev);
5727
5728 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5729 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5730 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5731 status = MGMT_STATUS_BUSY;
5732 goto unlock;
5733 }
5734
5735 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5736 if (!cmd) {
5737 status = MGMT_STATUS_NO_RESOURCES;
5738 goto unlock;
5739 }
5740
5741 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd,
5742 mgmt_remove_adv_monitor_complete);
5743
5744 if (err) {
5745 mgmt_pending_free(cmd);
5746
5747 if (err == -ENOMEM)
5748 status = MGMT_STATUS_NO_RESOURCES;
5749 else
5750 status = MGMT_STATUS_FAILED;
5751
5752 goto unlock;
5753 }
5754
5755 hci_dev_unlock(hdev);
5756
5757 return 0;
5758
5759 unlock:
5760 hci_dev_unlock(hdev);
5761 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5762 status);
5763 }
5764
read_local_oob_data_complete(struct hci_dev * hdev,void * data,int err)5765 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data,
5766 int err)
5767 {
5768 struct mgmt_rp_read_local_oob_data mgmt_rp;
5769 size_t rp_size = sizeof(mgmt_rp);
5770 struct mgmt_pending_cmd *cmd = data;
5771 struct sk_buff *skb = cmd->skb;
5772 u8 status = mgmt_status(err);
5773
5774 if (!status) {
5775 if (!skb)
5776 status = MGMT_STATUS_FAILED;
5777 else if (IS_ERR(skb))
5778 status = mgmt_status(PTR_ERR(skb));
5779 else
5780 status = mgmt_status(skb->data[0]);
5781 }
5782
5783 bt_dev_dbg(hdev, "status %d", status);
5784
5785 if (status) {
5786 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5787 status);
5788 goto remove;
5789 }
5790
5791 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5792
5793 if (!bredr_sc_enabled(hdev)) {
5794 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5795
5796 if (skb->len < sizeof(*rp)) {
5797 mgmt_cmd_status(cmd->sk, hdev->id,
5798 MGMT_OP_READ_LOCAL_OOB_DATA,
5799 MGMT_STATUS_FAILED);
5800 goto remove;
5801 }
5802
5803 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5804 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5805
5806 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5807 } else {
5808 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5809
5810 if (skb->len < sizeof(*rp)) {
5811 mgmt_cmd_status(cmd->sk, hdev->id,
5812 MGMT_OP_READ_LOCAL_OOB_DATA,
5813 MGMT_STATUS_FAILED);
5814 goto remove;
5815 }
5816
5817 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5818 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5819
5820 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5821 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5822 }
5823
5824 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5825 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5826
5827 remove:
5828 if (skb && !IS_ERR(skb))
5829 kfree_skb(skb);
5830
5831 mgmt_pending_free(cmd);
5832 }
5833
read_local_oob_data_sync(struct hci_dev * hdev,void * data)5834 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5835 {
5836 struct mgmt_pending_cmd *cmd = data;
5837
5838 if (bredr_sc_enabled(hdev))
5839 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5840 else
5841 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5842
5843 if (IS_ERR(cmd->skb))
5844 return PTR_ERR(cmd->skb);
5845 else
5846 return 0;
5847 }
5848
read_local_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5849 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5850 void *data, u16 data_len)
5851 {
5852 struct mgmt_pending_cmd *cmd;
5853 int err;
5854
5855 bt_dev_dbg(hdev, "sock %p", sk);
5856
5857 hci_dev_lock(hdev);
5858
5859 if (!hdev_is_powered(hdev)) {
5860 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5861 MGMT_STATUS_NOT_POWERED);
5862 goto unlock;
5863 }
5864
5865 if (!lmp_ssp_capable(hdev)) {
5866 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5867 MGMT_STATUS_NOT_SUPPORTED);
5868 goto unlock;
5869 }
5870
5871 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5872 if (!cmd)
5873 err = -ENOMEM;
5874 else
5875 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5876 read_local_oob_data_complete);
5877
5878 if (err < 0) {
5879 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5880 MGMT_STATUS_FAILED);
5881
5882 if (cmd)
5883 mgmt_pending_free(cmd);
5884 }
5885
5886 unlock:
5887 hci_dev_unlock(hdev);
5888 return err;
5889 }
5890
add_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5891 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5892 void *data, u16 len)
5893 {
5894 struct mgmt_addr_info *addr = data;
5895 int err;
5896
5897 bt_dev_dbg(hdev, "sock %p", sk);
5898
5899 if (!bdaddr_type_is_valid(addr->type))
5900 return mgmt_cmd_complete(sk, hdev->id,
5901 MGMT_OP_ADD_REMOTE_OOB_DATA,
5902 MGMT_STATUS_INVALID_PARAMS,
5903 addr, sizeof(*addr));
5904
5905 hci_dev_lock(hdev);
5906
5907 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5908 struct mgmt_cp_add_remote_oob_data *cp = data;
5909 u8 status;
5910
5911 if (cp->addr.type != BDADDR_BREDR) {
5912 err = mgmt_cmd_complete(sk, hdev->id,
5913 MGMT_OP_ADD_REMOTE_OOB_DATA,
5914 MGMT_STATUS_INVALID_PARAMS,
5915 &cp->addr, sizeof(cp->addr));
5916 goto unlock;
5917 }
5918
5919 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5920 cp->addr.type, cp->hash,
5921 cp->rand, NULL, NULL);
5922 if (err < 0)
5923 status = MGMT_STATUS_FAILED;
5924 else
5925 status = MGMT_STATUS_SUCCESS;
5926
5927 err = mgmt_cmd_complete(sk, hdev->id,
5928 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5929 &cp->addr, sizeof(cp->addr));
5930 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5931 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5932 u8 *rand192, *hash192, *rand256, *hash256;
5933 u8 status;
5934
5935 if (bdaddr_type_is_le(cp->addr.type)) {
5936 /* Enforce zero-valued 192-bit parameters as
5937 * long as legacy SMP OOB isn't implemented.
5938 */
5939 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5940 memcmp(cp->hash192, ZERO_KEY, 16)) {
5941 err = mgmt_cmd_complete(sk, hdev->id,
5942 MGMT_OP_ADD_REMOTE_OOB_DATA,
5943 MGMT_STATUS_INVALID_PARAMS,
5944 addr, sizeof(*addr));
5945 goto unlock;
5946 }
5947
5948 rand192 = NULL;
5949 hash192 = NULL;
5950 } else {
5951 /* In case one of the P-192 values is set to zero,
5952 * then just disable OOB data for P-192.
5953 */
5954 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5955 !memcmp(cp->hash192, ZERO_KEY, 16)) {
5956 rand192 = NULL;
5957 hash192 = NULL;
5958 } else {
5959 rand192 = cp->rand192;
5960 hash192 = cp->hash192;
5961 }
5962 }
5963
5964 /* In case one of the P-256 values is set to zero, then just
5965 * disable OOB data for P-256.
5966 */
5967 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5968 !memcmp(cp->hash256, ZERO_KEY, 16)) {
5969 rand256 = NULL;
5970 hash256 = NULL;
5971 } else {
5972 rand256 = cp->rand256;
5973 hash256 = cp->hash256;
5974 }
5975
5976 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5977 cp->addr.type, hash192, rand192,
5978 hash256, rand256);
5979 if (err < 0)
5980 status = MGMT_STATUS_FAILED;
5981 else
5982 status = MGMT_STATUS_SUCCESS;
5983
5984 err = mgmt_cmd_complete(sk, hdev->id,
5985 MGMT_OP_ADD_REMOTE_OOB_DATA,
5986 status, &cp->addr, sizeof(cp->addr));
5987 } else {
5988 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5989 len);
5990 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5991 MGMT_STATUS_INVALID_PARAMS);
5992 }
5993
5994 unlock:
5995 hci_dev_unlock(hdev);
5996 return err;
5997 }
5998
remove_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5999 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
6000 void *data, u16 len)
6001 {
6002 struct mgmt_cp_remove_remote_oob_data *cp = data;
6003 u8 status;
6004 int err;
6005
6006 bt_dev_dbg(hdev, "sock %p", sk);
6007
6008 if (cp->addr.type != BDADDR_BREDR)
6009 return mgmt_cmd_complete(sk, hdev->id,
6010 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
6011 MGMT_STATUS_INVALID_PARAMS,
6012 &cp->addr, sizeof(cp->addr));
6013
6014 hci_dev_lock(hdev);
6015
6016 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6017 hci_remote_oob_data_clear(hdev);
6018 status = MGMT_STATUS_SUCCESS;
6019 goto done;
6020 }
6021
6022 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
6023 if (err < 0)
6024 status = MGMT_STATUS_INVALID_PARAMS;
6025 else
6026 status = MGMT_STATUS_SUCCESS;
6027
6028 done:
6029 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
6030 status, &cp->addr, sizeof(cp->addr));
6031
6032 hci_dev_unlock(hdev);
6033 return err;
6034 }
6035
discovery_type_is_valid(struct hci_dev * hdev,uint8_t type,uint8_t * mgmt_status)6036 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
6037 uint8_t *mgmt_status)
6038 {
6039 switch (type) {
6040 case DISCOV_TYPE_LE:
6041 *mgmt_status = mgmt_le_support(hdev);
6042 if (*mgmt_status)
6043 return false;
6044 break;
6045 case DISCOV_TYPE_INTERLEAVED:
6046 *mgmt_status = mgmt_le_support(hdev);
6047 if (*mgmt_status)
6048 return false;
6049 fallthrough;
6050 case DISCOV_TYPE_BREDR:
6051 *mgmt_status = mgmt_bredr_support(hdev);
6052 if (*mgmt_status)
6053 return false;
6054 break;
6055 default:
6056 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
6057 return false;
6058 }
6059
6060 return true;
6061 }
6062
start_discovery_complete(struct hci_dev * hdev,void * data,int err)6063 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
6064 {
6065 struct mgmt_pending_cmd *cmd = data;
6066
6067 bt_dev_dbg(hdev, "err %d", err);
6068
6069 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
6070 return;
6071
6072 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
6073 cmd->param, 1);
6074 mgmt_pending_free(cmd);
6075
6076 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
6077 DISCOVERY_FINDING);
6078 }
6079
start_discovery_sync(struct hci_dev * hdev,void * data)6080 static int start_discovery_sync(struct hci_dev *hdev, void *data)
6081 {
6082 if (!mgmt_pending_listed(hdev, data))
6083 return -ECANCELED;
6084
6085 return hci_start_discovery_sync(hdev);
6086 }
6087
start_discovery_internal(struct sock * sk,struct hci_dev * hdev,u16 op,void * data,u16 len)6088 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
6089 u16 op, void *data, u16 len)
6090 {
6091 struct mgmt_cp_start_discovery *cp = data;
6092 struct mgmt_pending_cmd *cmd;
6093 u8 status;
6094 int err;
6095
6096 bt_dev_dbg(hdev, "sock %p", sk);
6097
6098 hci_dev_lock(hdev);
6099
6100 if (!hdev_is_powered(hdev)) {
6101 err = mgmt_cmd_complete(sk, hdev->id, op,
6102 MGMT_STATUS_NOT_POWERED,
6103 &cp->type, sizeof(cp->type));
6104 goto failed;
6105 }
6106
6107 if (hdev->discovery.state != DISCOVERY_STOPPED ||
6108 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6109 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
6110 &cp->type, sizeof(cp->type));
6111 goto failed;
6112 }
6113
6114 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6115 err = mgmt_cmd_complete(sk, hdev->id, op, status,
6116 &cp->type, sizeof(cp->type));
6117 goto failed;
6118 }
6119
6120 /* Can't start discovery when it is paused */
6121 if (hdev->discovery_paused) {
6122 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
6123 &cp->type, sizeof(cp->type));
6124 goto failed;
6125 }
6126
6127 /* Clear the discovery filter first to free any previously
6128 * allocated memory for the UUID list.
6129 */
6130 hci_discovery_filter_clear(hdev);
6131
6132 hdev->discovery.type = cp->type;
6133 hdev->discovery.report_invalid_rssi = false;
6134 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
6135 hdev->discovery.limited = true;
6136 else
6137 hdev->discovery.limited = false;
6138
6139 cmd = mgmt_pending_add(sk, op, hdev, data, len);
6140 if (!cmd) {
6141 err = -ENOMEM;
6142 goto failed;
6143 }
6144
6145 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6146 start_discovery_complete);
6147 if (err < 0) {
6148 mgmt_pending_remove(cmd);
6149 goto failed;
6150 }
6151
6152 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6153
6154 failed:
6155 hci_dev_unlock(hdev);
6156 return err;
6157 }
6158
start_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6159 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
6160 void *data, u16 len)
6161 {
6162 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
6163 data, len);
6164 }
6165
start_limited_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6166 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
6167 void *data, u16 len)
6168 {
6169 return start_discovery_internal(sk, hdev,
6170 MGMT_OP_START_LIMITED_DISCOVERY,
6171 data, len);
6172 }
6173
start_service_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6174 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
6175 void *data, u16 len)
6176 {
6177 struct mgmt_cp_start_service_discovery *cp = data;
6178 struct mgmt_pending_cmd *cmd;
6179 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
6180 u16 uuid_count, expected_len;
6181 u8 (*uuids)[16] = NULL;
6182 u8 status;
6183 int err;
6184
6185 bt_dev_dbg(hdev, "sock %p", sk);
6186
6187 hci_dev_lock(hdev);
6188
6189 if (!hdev_is_powered(hdev)) {
6190 err = mgmt_cmd_complete(sk, hdev->id,
6191 MGMT_OP_START_SERVICE_DISCOVERY,
6192 MGMT_STATUS_NOT_POWERED,
6193 &cp->type, sizeof(cp->type));
6194 goto failed;
6195 }
6196
6197 if (hdev->discovery.state != DISCOVERY_STOPPED ||
6198 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6199 err = mgmt_cmd_complete(sk, hdev->id,
6200 MGMT_OP_START_SERVICE_DISCOVERY,
6201 MGMT_STATUS_BUSY, &cp->type,
6202 sizeof(cp->type));
6203 goto failed;
6204 }
6205
6206 if (hdev->discovery_paused) {
6207 err = mgmt_cmd_complete(sk, hdev->id,
6208 MGMT_OP_START_SERVICE_DISCOVERY,
6209 MGMT_STATUS_BUSY, &cp->type,
6210 sizeof(cp->type));
6211 goto failed;
6212 }
6213
6214 uuid_count = __le16_to_cpu(cp->uuid_count);
6215 if (uuid_count > max_uuid_count) {
6216 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6217 uuid_count);
6218 err = mgmt_cmd_complete(sk, hdev->id,
6219 MGMT_OP_START_SERVICE_DISCOVERY,
6220 MGMT_STATUS_INVALID_PARAMS, &cp->type,
6221 sizeof(cp->type));
6222 goto failed;
6223 }
6224
6225 expected_len = sizeof(*cp) + uuid_count * 16;
6226 if (expected_len != len) {
6227 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6228 expected_len, len);
6229 err = mgmt_cmd_complete(sk, hdev->id,
6230 MGMT_OP_START_SERVICE_DISCOVERY,
6231 MGMT_STATUS_INVALID_PARAMS, &cp->type,
6232 sizeof(cp->type));
6233 goto failed;
6234 }
6235
6236 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6237 err = mgmt_cmd_complete(sk, hdev->id,
6238 MGMT_OP_START_SERVICE_DISCOVERY,
6239 status, &cp->type, sizeof(cp->type));
6240 goto failed;
6241 }
6242
6243 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6244 hdev, data, len);
6245 if (!cmd) {
6246 err = -ENOMEM;
6247 goto failed;
6248 }
6249
6250 /* Clear the discovery filter first to free any previously
6251 * allocated memory for the UUID list.
6252 */
6253 hci_discovery_filter_clear(hdev);
6254
6255 hdev->discovery.result_filtering = true;
6256 hdev->discovery.type = cp->type;
6257 hdev->discovery.rssi = cp->rssi;
6258
6259 if (uuid_count > 0) {
6260 uuids = kmemdup(cp->uuids, uuid_count * sizeof(*uuids), GFP_KERNEL);
6261 if (!uuids) {
6262 err = mgmt_cmd_complete(sk, hdev->id,
6263 MGMT_OP_START_SERVICE_DISCOVERY,
6264 MGMT_STATUS_FAILED,
6265 &cp->type, sizeof(cp->type));
6266 mgmt_pending_remove(cmd);
6267 goto failed;
6268 }
6269 }
6270
6271 spin_lock(&hdev->discovery.lock);
6272 hdev->discovery.uuids = uuids;
6273 hdev->discovery.uuid_count = uuid_count;
6274 spin_unlock(&hdev->discovery.lock);
6275
6276 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6277 start_discovery_complete);
6278 if (err < 0) {
6279 mgmt_pending_remove(cmd);
6280 goto failed;
6281 }
6282
6283 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6284
6285 failed:
6286 hci_dev_unlock(hdev);
6287 return err;
6288 }
6289
stop_discovery_complete(struct hci_dev * hdev,void * data,int err)6290 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6291 {
6292 struct mgmt_pending_cmd *cmd = data;
6293
6294 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
6295 return;
6296
6297 bt_dev_dbg(hdev, "err %d", err);
6298
6299 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
6300 cmd->param, 1);
6301 mgmt_pending_free(cmd);
6302
6303 if (!err)
6304 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6305 }
6306
stop_discovery_sync(struct hci_dev * hdev,void * data)6307 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6308 {
6309 if (!mgmt_pending_listed(hdev, data))
6310 return -ECANCELED;
6311
6312 return hci_stop_discovery_sync(hdev);
6313 }
6314
stop_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6315 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6316 u16 len)
6317 {
6318 struct mgmt_cp_stop_discovery *mgmt_cp = data;
6319 struct mgmt_pending_cmd *cmd;
6320 int err;
6321
6322 bt_dev_dbg(hdev, "sock %p", sk);
6323
6324 hci_dev_lock(hdev);
6325
6326 if (!hci_discovery_active(hdev)) {
6327 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6328 MGMT_STATUS_REJECTED, &mgmt_cp->type,
6329 sizeof(mgmt_cp->type));
6330 goto unlock;
6331 }
6332
6333 if (hdev->discovery.type != mgmt_cp->type) {
6334 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6335 MGMT_STATUS_INVALID_PARAMS,
6336 &mgmt_cp->type, sizeof(mgmt_cp->type));
6337 goto unlock;
6338 }
6339
6340 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6341 if (!cmd) {
6342 err = -ENOMEM;
6343 goto unlock;
6344 }
6345
6346 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6347 stop_discovery_complete);
6348 if (err < 0) {
6349 mgmt_pending_remove(cmd);
6350 goto unlock;
6351 }
6352
6353 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6354
6355 unlock:
6356 hci_dev_unlock(hdev);
6357 return err;
6358 }
6359
confirm_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6360 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6361 u16 len)
6362 {
6363 struct mgmt_cp_confirm_name *cp = data;
6364 struct inquiry_entry *e;
6365 int err;
6366
6367 bt_dev_dbg(hdev, "sock %p", sk);
6368
6369 hci_dev_lock(hdev);
6370
6371 if (!hci_discovery_active(hdev)) {
6372 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6373 MGMT_STATUS_FAILED, &cp->addr,
6374 sizeof(cp->addr));
6375 goto failed;
6376 }
6377
6378 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6379 if (!e) {
6380 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6381 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6382 sizeof(cp->addr));
6383 goto failed;
6384 }
6385
6386 if (cp->name_known) {
6387 e->name_state = NAME_KNOWN;
6388 list_del(&e->list);
6389 } else {
6390 e->name_state = NAME_NEEDED;
6391 hci_inquiry_cache_update_resolve(hdev, e);
6392 }
6393
6394 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6395 &cp->addr, sizeof(cp->addr));
6396
6397 failed:
6398 hci_dev_unlock(hdev);
6399 return err;
6400 }
6401
block_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6402 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6403 u16 len)
6404 {
6405 struct mgmt_cp_block_device *cp = data;
6406 u8 status;
6407 int err;
6408
6409 bt_dev_dbg(hdev, "sock %p", sk);
6410
6411 if (!bdaddr_type_is_valid(cp->addr.type))
6412 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6413 MGMT_STATUS_INVALID_PARAMS,
6414 &cp->addr, sizeof(cp->addr));
6415
6416 hci_dev_lock(hdev);
6417
6418 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6419 cp->addr.type);
6420 if (err < 0) {
6421 status = MGMT_STATUS_FAILED;
6422 goto done;
6423 }
6424
6425 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6426 sk);
6427 status = MGMT_STATUS_SUCCESS;
6428
6429 done:
6430 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6431 &cp->addr, sizeof(cp->addr));
6432
6433 hci_dev_unlock(hdev);
6434
6435 return err;
6436 }
6437
unblock_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6438 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6439 u16 len)
6440 {
6441 struct mgmt_cp_unblock_device *cp = data;
6442 u8 status;
6443 int err;
6444
6445 bt_dev_dbg(hdev, "sock %p", sk);
6446
6447 if (!bdaddr_type_is_valid(cp->addr.type))
6448 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6449 MGMT_STATUS_INVALID_PARAMS,
6450 &cp->addr, sizeof(cp->addr));
6451
6452 hci_dev_lock(hdev);
6453
6454 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6455 cp->addr.type);
6456 if (err < 0) {
6457 status = MGMT_STATUS_INVALID_PARAMS;
6458 goto done;
6459 }
6460
6461 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6462 sk);
6463 status = MGMT_STATUS_SUCCESS;
6464
6465 done:
6466 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6467 &cp->addr, sizeof(cp->addr));
6468
6469 hci_dev_unlock(hdev);
6470
6471 return err;
6472 }
6473
set_device_id_sync(struct hci_dev * hdev,void * data)6474 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6475 {
6476 return hci_update_eir_sync(hdev);
6477 }
6478
set_device_id(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6479 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6480 u16 len)
6481 {
6482 struct mgmt_cp_set_device_id *cp = data;
6483 int err;
6484 __u16 source;
6485
6486 bt_dev_dbg(hdev, "sock %p", sk);
6487
6488 source = __le16_to_cpu(cp->source);
6489
6490 if (source > 0x0002)
6491 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6492 MGMT_STATUS_INVALID_PARAMS);
6493
6494 hci_dev_lock(hdev);
6495
6496 hdev->devid_source = source;
6497 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6498 hdev->devid_product = __le16_to_cpu(cp->product);
6499 hdev->devid_version = __le16_to_cpu(cp->version);
6500
6501 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6502 NULL, 0);
6503
6504 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6505
6506 hci_dev_unlock(hdev);
6507
6508 return err;
6509 }
6510
enable_advertising_instance(struct hci_dev * hdev,int err)6511 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6512 {
6513 if (err)
6514 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6515 else
6516 bt_dev_dbg(hdev, "status %d", err);
6517 }
6518
set_advertising_complete(struct hci_dev * hdev,void * data,int err)6519 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6520 {
6521 struct mgmt_pending_cmd *cmd = data;
6522 struct cmd_lookup match = { NULL, hdev };
6523 u8 instance;
6524 struct adv_info *adv_instance;
6525 u8 status = mgmt_status(err);
6526
6527 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
6528 return;
6529
6530 if (status) {
6531 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
6532 mgmt_pending_free(cmd);
6533 return;
6534 }
6535
6536 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6537 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6538 else
6539 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6540
6541 settings_rsp(cmd, &match);
6542 mgmt_pending_free(cmd);
6543
6544 new_settings(hdev, match.sk);
6545
6546 if (match.sk)
6547 sock_put(match.sk);
6548
6549 /* If "Set Advertising" was just disabled and instance advertising was
6550 * set up earlier, then re-enable multi-instance advertising.
6551 */
6552 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6553 list_empty(&hdev->adv_instances))
6554 return;
6555
6556 instance = hdev->cur_adv_instance;
6557 if (!instance) {
6558 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6559 struct adv_info, list);
6560 if (!adv_instance)
6561 return;
6562
6563 instance = adv_instance->instance;
6564 }
6565
6566 err = hci_schedule_adv_instance_sync(hdev, instance, true);
6567
6568 enable_advertising_instance(hdev, err);
6569 }
6570
set_adv_sync(struct hci_dev * hdev,void * data)6571 static int set_adv_sync(struct hci_dev *hdev, void *data)
6572 {
6573 struct mgmt_pending_cmd *cmd = data;
6574 struct mgmt_mode cp;
6575 u8 val;
6576
6577 mutex_lock(&hdev->mgmt_pending_lock);
6578
6579 if (!__mgmt_pending_listed(hdev, cmd)) {
6580 mutex_unlock(&hdev->mgmt_pending_lock);
6581 return -ECANCELED;
6582 }
6583
6584 memcpy(&cp, cmd->param, sizeof(cp));
6585
6586 mutex_unlock(&hdev->mgmt_pending_lock);
6587
6588 val = !!cp.val;
6589
6590 if (cp.val == 0x02)
6591 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6592 else
6593 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6594
6595 cancel_adv_timeout(hdev);
6596
6597 if (val) {
6598 /* Switch to instance "0" for the Set Advertising setting.
6599 * We cannot use update_[adv|scan_rsp]_data() here as the
6600 * HCI_ADVERTISING flag is not yet set.
6601 */
6602 hdev->cur_adv_instance = 0x00;
6603
6604 if (ext_adv_capable(hdev)) {
6605 hci_start_ext_adv_sync(hdev, 0x00);
6606 } else {
6607 hci_update_adv_data_sync(hdev, 0x00);
6608 hci_update_scan_rsp_data_sync(hdev, 0x00);
6609 hci_enable_advertising_sync(hdev);
6610 }
6611 } else {
6612 hci_disable_advertising_sync(hdev);
6613 }
6614
6615 return 0;
6616 }
6617
set_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6618 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6619 u16 len)
6620 {
6621 struct mgmt_mode *cp = data;
6622 struct mgmt_pending_cmd *cmd;
6623 u8 val, status;
6624 int err;
6625
6626 bt_dev_dbg(hdev, "sock %p", sk);
6627
6628 status = mgmt_le_support(hdev);
6629 if (status)
6630 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6631 status);
6632
6633 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6634 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6635 MGMT_STATUS_INVALID_PARAMS);
6636
6637 if (hdev->advertising_paused)
6638 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6639 MGMT_STATUS_BUSY);
6640
6641 hci_dev_lock(hdev);
6642
6643 val = !!cp->val;
6644
6645 /* The following conditions are ones which mean that we should
6646 * not do any HCI communication but directly send a mgmt
6647 * response to user space (after toggling the flag if
6648 * necessary).
6649 */
6650 if (!hdev_is_powered(hdev) ||
6651 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6652 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6653 hci_dev_test_flag(hdev, HCI_MESH) ||
6654 hci_conn_num(hdev, LE_LINK) > 0 ||
6655 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6656 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6657 bool changed;
6658
6659 if (cp->val) {
6660 hdev->cur_adv_instance = 0x00;
6661 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6662 if (cp->val == 0x02)
6663 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6664 else
6665 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6666 } else {
6667 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6668 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6669 }
6670
6671 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6672 if (err < 0)
6673 goto unlock;
6674
6675 if (changed)
6676 err = new_settings(hdev, sk);
6677
6678 goto unlock;
6679 }
6680
6681 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6682 pending_find(MGMT_OP_SET_LE, hdev)) {
6683 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6684 MGMT_STATUS_BUSY);
6685 goto unlock;
6686 }
6687
6688 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6689 if (!cmd)
6690 err = -ENOMEM;
6691 else
6692 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6693 set_advertising_complete);
6694
6695 if (err < 0 && cmd)
6696 mgmt_pending_remove(cmd);
6697
6698 unlock:
6699 hci_dev_unlock(hdev);
6700 return err;
6701 }
6702
set_static_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6703 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6704 void *data, u16 len)
6705 {
6706 struct mgmt_cp_set_static_address *cp = data;
6707 int err;
6708
6709 bt_dev_dbg(hdev, "sock %p", sk);
6710
6711 if (!lmp_le_capable(hdev))
6712 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6713 MGMT_STATUS_NOT_SUPPORTED);
6714
6715 if (hdev_is_powered(hdev))
6716 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6717 MGMT_STATUS_REJECTED);
6718
6719 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6720 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6721 return mgmt_cmd_status(sk, hdev->id,
6722 MGMT_OP_SET_STATIC_ADDRESS,
6723 MGMT_STATUS_INVALID_PARAMS);
6724
6725 /* Two most significant bits shall be set */
6726 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6727 return mgmt_cmd_status(sk, hdev->id,
6728 MGMT_OP_SET_STATIC_ADDRESS,
6729 MGMT_STATUS_INVALID_PARAMS);
6730 }
6731
6732 hci_dev_lock(hdev);
6733
6734 bacpy(&hdev->static_addr, &cp->bdaddr);
6735
6736 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6737 if (err < 0)
6738 goto unlock;
6739
6740 err = new_settings(hdev, sk);
6741
6742 unlock:
6743 hci_dev_unlock(hdev);
6744 return err;
6745 }
6746
set_scan_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6747 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6748 void *data, u16 len)
6749 {
6750 struct mgmt_cp_set_scan_params *cp = data;
6751 __u16 interval, window;
6752 int err;
6753
6754 bt_dev_dbg(hdev, "sock %p", sk);
6755
6756 if (!lmp_le_capable(hdev))
6757 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6758 MGMT_STATUS_NOT_SUPPORTED);
6759
6760 /* Keep allowed ranges in sync with set_mesh() */
6761 interval = __le16_to_cpu(cp->interval);
6762
6763 if (interval < 0x0004 || interval > 0x4000)
6764 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6765 MGMT_STATUS_INVALID_PARAMS);
6766
6767 window = __le16_to_cpu(cp->window);
6768
6769 if (window < 0x0004 || window > 0x4000)
6770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6771 MGMT_STATUS_INVALID_PARAMS);
6772
6773 if (window > interval)
6774 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6775 MGMT_STATUS_INVALID_PARAMS);
6776
6777 hci_dev_lock(hdev);
6778
6779 hdev->le_scan_interval = interval;
6780 hdev->le_scan_window = window;
6781
6782 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6783 NULL, 0);
6784
6785 /* If background scan is running, restart it so new parameters are
6786 * loaded.
6787 */
6788 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6789 hdev->discovery.state == DISCOVERY_STOPPED)
6790 hci_update_passive_scan(hdev);
6791
6792 hci_dev_unlock(hdev);
6793
6794 return err;
6795 }
6796
fast_connectable_complete(struct hci_dev * hdev,void * data,int err)6797 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6798 {
6799 struct mgmt_pending_cmd *cmd = data;
6800
6801 bt_dev_dbg(hdev, "err %d", err);
6802
6803 if (err) {
6804 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6805 mgmt_status(err));
6806 } else {
6807 struct mgmt_mode *cp = cmd->param;
6808
6809 if (cp->val)
6810 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6811 else
6812 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6813
6814 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6815 new_settings(hdev, cmd->sk);
6816 }
6817
6818 mgmt_pending_free(cmd);
6819 }
6820
write_fast_connectable_sync(struct hci_dev * hdev,void * data)6821 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6822 {
6823 struct mgmt_pending_cmd *cmd = data;
6824 struct mgmt_mode *cp = cmd->param;
6825
6826 return hci_write_fast_connectable_sync(hdev, cp->val);
6827 }
6828
set_fast_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6829 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6830 void *data, u16 len)
6831 {
6832 struct mgmt_mode *cp = data;
6833 struct mgmt_pending_cmd *cmd;
6834 int err;
6835
6836 bt_dev_dbg(hdev, "sock %p", sk);
6837
6838 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6839 hdev->hci_ver < BLUETOOTH_VER_1_2)
6840 return mgmt_cmd_status(sk, hdev->id,
6841 MGMT_OP_SET_FAST_CONNECTABLE,
6842 MGMT_STATUS_NOT_SUPPORTED);
6843
6844 if (cp->val != 0x00 && cp->val != 0x01)
6845 return mgmt_cmd_status(sk, hdev->id,
6846 MGMT_OP_SET_FAST_CONNECTABLE,
6847 MGMT_STATUS_INVALID_PARAMS);
6848
6849 hci_dev_lock(hdev);
6850
6851 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6852 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6853 goto unlock;
6854 }
6855
6856 if (!hdev_is_powered(hdev)) {
6857 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6858 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6859 new_settings(hdev, sk);
6860 goto unlock;
6861 }
6862
6863 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6864 len);
6865 if (!cmd)
6866 err = -ENOMEM;
6867 else
6868 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6869 fast_connectable_complete);
6870
6871 if (err < 0) {
6872 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6873 MGMT_STATUS_FAILED);
6874
6875 if (cmd)
6876 mgmt_pending_free(cmd);
6877 }
6878
6879 unlock:
6880 hci_dev_unlock(hdev);
6881
6882 return err;
6883 }
6884
set_bredr_complete(struct hci_dev * hdev,void * data,int err)6885 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6886 {
6887 struct mgmt_pending_cmd *cmd = data;
6888
6889 bt_dev_dbg(hdev, "err %d", err);
6890
6891 if (err) {
6892 u8 mgmt_err = mgmt_status(err);
6893
6894 /* We need to restore the flag if related HCI commands
6895 * failed.
6896 */
6897 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6898
6899 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
6900 } else {
6901 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6902 new_settings(hdev, cmd->sk);
6903 }
6904
6905 mgmt_pending_free(cmd);
6906 }
6907
set_bredr_sync(struct hci_dev * hdev,void * data)6908 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6909 {
6910 int status;
6911
6912 status = hci_write_fast_connectable_sync(hdev, false);
6913
6914 if (!status)
6915 status = hci_update_scan_sync(hdev);
6916
6917 /* Since only the advertising data flags will change, there
6918 * is no need to update the scan response data.
6919 */
6920 if (!status)
6921 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6922
6923 return status;
6924 }
6925
set_bredr(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6926 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6927 {
6928 struct mgmt_mode *cp = data;
6929 struct mgmt_pending_cmd *cmd;
6930 int err;
6931
6932 bt_dev_dbg(hdev, "sock %p", sk);
6933
6934 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6935 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6936 MGMT_STATUS_NOT_SUPPORTED);
6937
6938 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6939 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6940 MGMT_STATUS_REJECTED);
6941
6942 if (cp->val != 0x00 && cp->val != 0x01)
6943 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6944 MGMT_STATUS_INVALID_PARAMS);
6945
6946 hci_dev_lock(hdev);
6947
6948 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6949 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6950 goto unlock;
6951 }
6952
6953 if (!hdev_is_powered(hdev)) {
6954 if (!cp->val) {
6955 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6956 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6957 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6958 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6959 }
6960
6961 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6962
6963 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6964 if (err < 0)
6965 goto unlock;
6966
6967 err = new_settings(hdev, sk);
6968 goto unlock;
6969 }
6970
6971 /* Reject disabling when powered on */
6972 if (!cp->val) {
6973 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6974 MGMT_STATUS_REJECTED);
6975 goto unlock;
6976 } else {
6977 /* When configuring a dual-mode controller to operate
6978 * with LE only and using a static address, then switching
6979 * BR/EDR back on is not allowed.
6980 *
6981 * Dual-mode controllers shall operate with the public
6982 * address as its identity address for BR/EDR and LE. So
6983 * reject the attempt to create an invalid configuration.
6984 *
6985 * The same restrictions applies when secure connections
6986 * has been enabled. For BR/EDR this is a controller feature
6987 * while for LE it is a host stack feature. This means that
6988 * switching BR/EDR back on when secure connections has been
6989 * enabled is not a supported transaction.
6990 */
6991 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6992 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6993 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6994 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6995 MGMT_STATUS_REJECTED);
6996 goto unlock;
6997 }
6998 }
6999
7000 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
7001 if (!cmd)
7002 err = -ENOMEM;
7003 else
7004 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
7005 set_bredr_complete);
7006
7007 if (err < 0) {
7008 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
7009 MGMT_STATUS_FAILED);
7010 if (cmd)
7011 mgmt_pending_free(cmd);
7012
7013 goto unlock;
7014 }
7015
7016 /* We need to flip the bit already here so that
7017 * hci_req_update_adv_data generates the correct flags.
7018 */
7019 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
7020
7021 unlock:
7022 hci_dev_unlock(hdev);
7023 return err;
7024 }
7025
set_secure_conn_complete(struct hci_dev * hdev,void * data,int err)7026 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
7027 {
7028 struct mgmt_pending_cmd *cmd = data;
7029 struct mgmt_mode *cp;
7030
7031 bt_dev_dbg(hdev, "err %d", err);
7032
7033 if (err) {
7034 u8 mgmt_err = mgmt_status(err);
7035
7036 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
7037 goto done;
7038 }
7039
7040 cp = cmd->param;
7041
7042 switch (cp->val) {
7043 case 0x00:
7044 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
7045 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7046 break;
7047 case 0x01:
7048 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7049 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7050 break;
7051 case 0x02:
7052 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7053 hci_dev_set_flag(hdev, HCI_SC_ONLY);
7054 break;
7055 }
7056
7057 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
7058 new_settings(hdev, cmd->sk);
7059
7060 done:
7061 mgmt_pending_free(cmd);
7062 }
7063
set_secure_conn_sync(struct hci_dev * hdev,void * data)7064 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
7065 {
7066 struct mgmt_pending_cmd *cmd = data;
7067 struct mgmt_mode *cp = cmd->param;
7068 u8 val = !!cp->val;
7069
7070 /* Force write of val */
7071 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7072
7073 return hci_write_sc_support_sync(hdev, val);
7074 }
7075
set_secure_conn(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7076 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
7077 void *data, u16 len)
7078 {
7079 struct mgmt_mode *cp = data;
7080 struct mgmt_pending_cmd *cmd;
7081 u8 val;
7082 int err;
7083
7084 bt_dev_dbg(hdev, "sock %p", sk);
7085
7086 if (!lmp_sc_capable(hdev) &&
7087 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
7088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7089 MGMT_STATUS_NOT_SUPPORTED);
7090
7091 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7092 lmp_sc_capable(hdev) &&
7093 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
7094 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7095 MGMT_STATUS_REJECTED);
7096
7097 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
7098 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7099 MGMT_STATUS_INVALID_PARAMS);
7100
7101 hci_dev_lock(hdev);
7102
7103 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
7104 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7105 bool changed;
7106
7107 if (cp->val) {
7108 changed = !hci_dev_test_and_set_flag(hdev,
7109 HCI_SC_ENABLED);
7110 if (cp->val == 0x02)
7111 hci_dev_set_flag(hdev, HCI_SC_ONLY);
7112 else
7113 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7114 } else {
7115 changed = hci_dev_test_and_clear_flag(hdev,
7116 HCI_SC_ENABLED);
7117 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7118 }
7119
7120 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
7121 if (err < 0)
7122 goto failed;
7123
7124 if (changed)
7125 err = new_settings(hdev, sk);
7126
7127 goto failed;
7128 }
7129
7130 val = !!cp->val;
7131
7132 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7133 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7134 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
7135 goto failed;
7136 }
7137
7138 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
7139 if (!cmd)
7140 err = -ENOMEM;
7141 else
7142 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
7143 set_secure_conn_complete);
7144
7145 if (err < 0) {
7146 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7147 MGMT_STATUS_FAILED);
7148 if (cmd)
7149 mgmt_pending_free(cmd);
7150 }
7151
7152 failed:
7153 hci_dev_unlock(hdev);
7154 return err;
7155 }
7156
set_debug_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7157 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
7158 void *data, u16 len)
7159 {
7160 struct mgmt_mode *cp = data;
7161 bool changed, use_changed;
7162 int err;
7163
7164 bt_dev_dbg(hdev, "sock %p", sk);
7165
7166 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
7167 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
7168 MGMT_STATUS_INVALID_PARAMS);
7169
7170 hci_dev_lock(hdev);
7171
7172 if (cp->val)
7173 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
7174 else
7175 changed = hci_dev_test_and_clear_flag(hdev,
7176 HCI_KEEP_DEBUG_KEYS);
7177
7178 if (cp->val == 0x02)
7179 use_changed = !hci_dev_test_and_set_flag(hdev,
7180 HCI_USE_DEBUG_KEYS);
7181 else
7182 use_changed = hci_dev_test_and_clear_flag(hdev,
7183 HCI_USE_DEBUG_KEYS);
7184
7185 if (hdev_is_powered(hdev) && use_changed &&
7186 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7187 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
7188 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7189 sizeof(mode), &mode);
7190 }
7191
7192 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7193 if (err < 0)
7194 goto unlock;
7195
7196 if (changed)
7197 err = new_settings(hdev, sk);
7198
7199 unlock:
7200 hci_dev_unlock(hdev);
7201 return err;
7202 }
7203
set_privacy(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7204 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7205 u16 len)
7206 {
7207 struct mgmt_cp_set_privacy *cp = cp_data;
7208 bool changed;
7209 int err;
7210
7211 bt_dev_dbg(hdev, "sock %p", sk);
7212
7213 if (!lmp_le_capable(hdev))
7214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7215 MGMT_STATUS_NOT_SUPPORTED);
7216
7217 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7219 MGMT_STATUS_INVALID_PARAMS);
7220
7221 if (hdev_is_powered(hdev))
7222 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7223 MGMT_STATUS_REJECTED);
7224
7225 hci_dev_lock(hdev);
7226
7227 /* If user space supports this command it is also expected to
7228 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7229 */
7230 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7231
7232 if (cp->privacy) {
7233 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7234 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7235 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7236 hci_adv_instances_set_rpa_expired(hdev, true);
7237 if (cp->privacy == 0x02)
7238 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7239 else
7240 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7241 } else {
7242 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7243 memset(hdev->irk, 0, sizeof(hdev->irk));
7244 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7245 hci_adv_instances_set_rpa_expired(hdev, false);
7246 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7247 }
7248
7249 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7250 if (err < 0)
7251 goto unlock;
7252
7253 if (changed)
7254 err = new_settings(hdev, sk);
7255
7256 unlock:
7257 hci_dev_unlock(hdev);
7258 return err;
7259 }
7260
irk_is_valid(struct mgmt_irk_info * irk)7261 static bool irk_is_valid(struct mgmt_irk_info *irk)
7262 {
7263 switch (irk->addr.type) {
7264 case BDADDR_LE_PUBLIC:
7265 return true;
7266
7267 case BDADDR_LE_RANDOM:
7268 /* Two most significant bits shall be set */
7269 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7270 return false;
7271 return true;
7272 }
7273
7274 return false;
7275 }
7276
load_irks(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7277 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7278 u16 len)
7279 {
7280 struct mgmt_cp_load_irks *cp = cp_data;
7281 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7282 sizeof(struct mgmt_irk_info));
7283 u16 irk_count, expected_len;
7284 int i, err;
7285
7286 bt_dev_dbg(hdev, "sock %p", sk);
7287
7288 if (!lmp_le_capable(hdev))
7289 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7290 MGMT_STATUS_NOT_SUPPORTED);
7291
7292 irk_count = __le16_to_cpu(cp->irk_count);
7293 if (irk_count > max_irk_count) {
7294 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7295 irk_count);
7296 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7297 MGMT_STATUS_INVALID_PARAMS);
7298 }
7299
7300 expected_len = struct_size(cp, irks, irk_count);
7301 if (expected_len != len) {
7302 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7303 expected_len, len);
7304 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7305 MGMT_STATUS_INVALID_PARAMS);
7306 }
7307
7308 bt_dev_dbg(hdev, "irk_count %u", irk_count);
7309
7310 for (i = 0; i < irk_count; i++) {
7311 struct mgmt_irk_info *key = &cp->irks[i];
7312
7313 if (!irk_is_valid(key))
7314 return mgmt_cmd_status(sk, hdev->id,
7315 MGMT_OP_LOAD_IRKS,
7316 MGMT_STATUS_INVALID_PARAMS);
7317 }
7318
7319 hci_dev_lock(hdev);
7320
7321 hci_smp_irks_clear(hdev);
7322
7323 for (i = 0; i < irk_count; i++) {
7324 struct mgmt_irk_info *irk = &cp->irks[i];
7325
7326 if (hci_is_blocked_key(hdev,
7327 HCI_BLOCKED_KEY_TYPE_IRK,
7328 irk->val)) {
7329 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7330 &irk->addr.bdaddr);
7331 continue;
7332 }
7333
7334 hci_add_irk(hdev, &irk->addr.bdaddr,
7335 le_addr_type(irk->addr.type), irk->val,
7336 BDADDR_ANY);
7337 }
7338
7339 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7340
7341 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7342
7343 hci_dev_unlock(hdev);
7344
7345 return err;
7346 }
7347
ltk_is_valid(struct mgmt_ltk_info * key)7348 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7349 {
7350 if (key->initiator != 0x00 && key->initiator != 0x01)
7351 return false;
7352
7353 if (key->enc_size > sizeof(key->val))
7354 return false;
7355
7356 switch (key->addr.type) {
7357 case BDADDR_LE_PUBLIC:
7358 return true;
7359
7360 case BDADDR_LE_RANDOM:
7361 /* Two most significant bits shall be set */
7362 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7363 return false;
7364 return true;
7365 }
7366
7367 return false;
7368 }
7369
load_long_term_keys(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7370 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7371 void *cp_data, u16 len)
7372 {
7373 struct mgmt_cp_load_long_term_keys *cp = cp_data;
7374 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7375 sizeof(struct mgmt_ltk_info));
7376 u16 key_count, expected_len;
7377 int i, err;
7378
7379 bt_dev_dbg(hdev, "sock %p", sk);
7380
7381 if (!lmp_le_capable(hdev))
7382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7383 MGMT_STATUS_NOT_SUPPORTED);
7384
7385 key_count = __le16_to_cpu(cp->key_count);
7386 if (key_count > max_key_count) {
7387 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7388 key_count);
7389 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7390 MGMT_STATUS_INVALID_PARAMS);
7391 }
7392
7393 expected_len = struct_size(cp, keys, key_count);
7394 if (expected_len != len) {
7395 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7396 expected_len, len);
7397 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7398 MGMT_STATUS_INVALID_PARAMS);
7399 }
7400
7401 bt_dev_dbg(hdev, "key_count %u", key_count);
7402
7403 hci_dev_lock(hdev);
7404
7405 hci_smp_ltks_clear(hdev);
7406
7407 for (i = 0; i < key_count; i++) {
7408 struct mgmt_ltk_info *key = &cp->keys[i];
7409 u8 type, authenticated;
7410
7411 if (hci_is_blocked_key(hdev,
7412 HCI_BLOCKED_KEY_TYPE_LTK,
7413 key->val)) {
7414 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7415 &key->addr.bdaddr);
7416 continue;
7417 }
7418
7419 if (!ltk_is_valid(key)) {
7420 bt_dev_warn(hdev, "Invalid LTK for %pMR",
7421 &key->addr.bdaddr);
7422 continue;
7423 }
7424
7425 switch (key->type) {
7426 case MGMT_LTK_UNAUTHENTICATED:
7427 authenticated = 0x00;
7428 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7429 break;
7430 case MGMT_LTK_AUTHENTICATED:
7431 authenticated = 0x01;
7432 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7433 break;
7434 case MGMT_LTK_P256_UNAUTH:
7435 authenticated = 0x00;
7436 type = SMP_LTK_P256;
7437 break;
7438 case MGMT_LTK_P256_AUTH:
7439 authenticated = 0x01;
7440 type = SMP_LTK_P256;
7441 break;
7442 case MGMT_LTK_P256_DEBUG:
7443 authenticated = 0x00;
7444 type = SMP_LTK_P256_DEBUG;
7445 fallthrough;
7446 default:
7447 continue;
7448 }
7449
7450 hci_add_ltk(hdev, &key->addr.bdaddr,
7451 le_addr_type(key->addr.type), type, authenticated,
7452 key->val, key->enc_size, key->ediv, key->rand);
7453 }
7454
7455 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7456 NULL, 0);
7457
7458 hci_dev_unlock(hdev);
7459
7460 return err;
7461 }
7462
get_conn_info_complete(struct hci_dev * hdev,void * data,int err)7463 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7464 {
7465 struct mgmt_pending_cmd *cmd = data;
7466 struct hci_conn *conn = cmd->user_data;
7467 struct mgmt_cp_get_conn_info *cp = cmd->param;
7468 struct mgmt_rp_get_conn_info rp;
7469 u8 status;
7470
7471 bt_dev_dbg(hdev, "err %d", err);
7472
7473 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
7474
7475 status = mgmt_status(err);
7476 if (status == MGMT_STATUS_SUCCESS) {
7477 rp.rssi = conn->rssi;
7478 rp.tx_power = conn->tx_power;
7479 rp.max_tx_power = conn->max_tx_power;
7480 } else {
7481 rp.rssi = HCI_RSSI_INVALID;
7482 rp.tx_power = HCI_TX_POWER_INVALID;
7483 rp.max_tx_power = HCI_TX_POWER_INVALID;
7484 }
7485
7486 if (conn)
7487 hci_conn_put(conn);
7488
7489 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status,
7490 &rp, sizeof(rp));
7491
7492 mgmt_pending_free(cmd);
7493 }
7494
get_conn_info_sync(struct hci_dev * hdev,void * data)7495 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7496 {
7497 struct mgmt_pending_cmd *cmd = data;
7498 struct mgmt_cp_get_conn_info *cp = cmd->param;
7499 struct hci_conn *conn;
7500 int err;
7501 __le16 handle;
7502
7503 hci_dev_lock(hdev);
7504
7505 /* Make sure we are still connected */
7506 if (cp->addr.type == BDADDR_BREDR)
7507 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7508 &cp->addr.bdaddr);
7509 else
7510 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7511
7512 if (!conn || conn->state != BT_CONNECTED) {
7513 hci_dev_unlock(hdev);
7514 return MGMT_STATUS_NOT_CONNECTED;
7515 }
7516
7517 cmd->user_data = hci_conn_get(conn);
7518 handle = cpu_to_le16(conn->handle);
7519
7520 hci_dev_unlock(hdev);
7521
7522 /* Refresh RSSI each time */
7523 err = hci_read_rssi_sync(hdev, handle);
7524
7525 /* For LE links TX power does not change thus we don't need to
7526 * query for it once value is known.
7527 */
7528 if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7529 conn->tx_power == HCI_TX_POWER_INVALID))
7530 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7531
7532 /* Max TX power needs to be read only once per connection */
7533 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7534 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7535
7536 return err;
7537 }
7538
get_conn_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7539 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7540 u16 len)
7541 {
7542 struct mgmt_cp_get_conn_info *cp = data;
7543 struct mgmt_rp_get_conn_info rp;
7544 struct hci_conn *conn;
7545 unsigned long conn_info_age;
7546 int err = 0;
7547
7548 bt_dev_dbg(hdev, "sock %p", sk);
7549
7550 memset(&rp, 0, sizeof(rp));
7551 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7552 rp.addr.type = cp->addr.type;
7553
7554 if (!bdaddr_type_is_valid(cp->addr.type))
7555 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7556 MGMT_STATUS_INVALID_PARAMS,
7557 &rp, sizeof(rp));
7558
7559 hci_dev_lock(hdev);
7560
7561 if (!hdev_is_powered(hdev)) {
7562 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7563 MGMT_STATUS_NOT_POWERED, &rp,
7564 sizeof(rp));
7565 goto unlock;
7566 }
7567
7568 if (cp->addr.type == BDADDR_BREDR)
7569 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7570 &cp->addr.bdaddr);
7571 else
7572 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7573
7574 if (!conn || conn->state != BT_CONNECTED) {
7575 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7576 MGMT_STATUS_NOT_CONNECTED, &rp,
7577 sizeof(rp));
7578 goto unlock;
7579 }
7580
7581 /* To avoid client trying to guess when to poll again for information we
7582 * calculate conn info age as random value between min/max set in hdev.
7583 */
7584 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7585 hdev->conn_info_max_age - 1);
7586
7587 /* Query controller to refresh cached values if they are too old or were
7588 * never read.
7589 */
7590 if (time_after(jiffies, conn->conn_info_timestamp +
7591 msecs_to_jiffies(conn_info_age)) ||
7592 !conn->conn_info_timestamp) {
7593 struct mgmt_pending_cmd *cmd;
7594
7595 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7596 len);
7597 if (!cmd) {
7598 err = -ENOMEM;
7599 } else {
7600 err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7601 cmd, get_conn_info_complete);
7602 }
7603
7604 if (err < 0) {
7605 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7606 MGMT_STATUS_FAILED, &rp, sizeof(rp));
7607
7608 if (cmd)
7609 mgmt_pending_free(cmd);
7610
7611 goto unlock;
7612 }
7613
7614 conn->conn_info_timestamp = jiffies;
7615 } else {
7616 /* Cache is valid, just reply with values cached in hci_conn */
7617 rp.rssi = conn->rssi;
7618 rp.tx_power = conn->tx_power;
7619 rp.max_tx_power = conn->max_tx_power;
7620
7621 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7622 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7623 }
7624
7625 unlock:
7626 hci_dev_unlock(hdev);
7627 return err;
7628 }
7629
get_clock_info_complete(struct hci_dev * hdev,void * data,int err)7630 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7631 {
7632 struct mgmt_pending_cmd *cmd = data;
7633 struct mgmt_cp_get_clock_info *cp = cmd->param;
7634 struct mgmt_rp_get_clock_info rp;
7635 struct hci_conn *conn = cmd->user_data;
7636 u8 status = mgmt_status(err);
7637
7638 bt_dev_dbg(hdev, "err %d", err);
7639
7640 memset(&rp, 0, sizeof(rp));
7641 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7642 rp.addr.type = cp->addr.type;
7643
7644 if (err)
7645 goto complete;
7646
7647 rp.local_clock = cpu_to_le32(hdev->clock);
7648
7649 if (conn) {
7650 rp.piconet_clock = cpu_to_le32(conn->clock);
7651 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7652 }
7653
7654 complete:
7655 if (conn)
7656 hci_conn_put(conn);
7657
7658 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp,
7659 sizeof(rp));
7660
7661 mgmt_pending_free(cmd);
7662 }
7663
get_clock_info_sync(struct hci_dev * hdev,void * data)7664 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7665 {
7666 struct mgmt_pending_cmd *cmd = data;
7667 struct mgmt_cp_get_clock_info *cp = cmd->param;
7668 struct hci_cp_read_clock hci_cp;
7669 struct hci_conn *conn;
7670
7671 memset(&hci_cp, 0, sizeof(hci_cp));
7672 hci_read_clock_sync(hdev, &hci_cp);
7673
7674 hci_dev_lock(hdev);
7675
7676 /* Make sure connection still exists */
7677 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7678 if (!conn || conn->state != BT_CONNECTED) {
7679 hci_dev_unlock(hdev);
7680 return MGMT_STATUS_NOT_CONNECTED;
7681 }
7682
7683 cmd->user_data = hci_conn_get(conn);
7684 hci_cp.handle = cpu_to_le16(conn->handle);
7685 hci_cp.which = 0x01; /* Piconet clock */
7686
7687 hci_dev_unlock(hdev);
7688
7689 return hci_read_clock_sync(hdev, &hci_cp);
7690 }
7691
get_clock_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7692 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7693 u16 len)
7694 {
7695 struct mgmt_cp_get_clock_info *cp = data;
7696 struct mgmt_rp_get_clock_info rp;
7697 struct mgmt_pending_cmd *cmd;
7698 struct hci_conn *conn;
7699 int err;
7700
7701 bt_dev_dbg(hdev, "sock %p", sk);
7702
7703 memset(&rp, 0, sizeof(rp));
7704 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7705 rp.addr.type = cp->addr.type;
7706
7707 if (cp->addr.type != BDADDR_BREDR)
7708 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7709 MGMT_STATUS_INVALID_PARAMS,
7710 &rp, sizeof(rp));
7711
7712 hci_dev_lock(hdev);
7713
7714 if (!hdev_is_powered(hdev)) {
7715 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7716 MGMT_STATUS_NOT_POWERED, &rp,
7717 sizeof(rp));
7718 goto unlock;
7719 }
7720
7721 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7722 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7723 &cp->addr.bdaddr);
7724 if (!conn || conn->state != BT_CONNECTED) {
7725 err = mgmt_cmd_complete(sk, hdev->id,
7726 MGMT_OP_GET_CLOCK_INFO,
7727 MGMT_STATUS_NOT_CONNECTED,
7728 &rp, sizeof(rp));
7729 goto unlock;
7730 }
7731 } else {
7732 conn = NULL;
7733 }
7734
7735 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7736 if (!cmd)
7737 err = -ENOMEM;
7738 else
7739 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7740 get_clock_info_complete);
7741
7742 if (err < 0) {
7743 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7744 MGMT_STATUS_FAILED, &rp, sizeof(rp));
7745
7746 if (cmd)
7747 mgmt_pending_free(cmd);
7748 }
7749
7750
7751 unlock:
7752 hci_dev_unlock(hdev);
7753 return err;
7754 }
7755
device_added(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type,u8 action)7756 static void device_added(struct sock *sk, struct hci_dev *hdev,
7757 bdaddr_t *bdaddr, u8 type, u8 action)
7758 {
7759 struct mgmt_ev_device_added ev;
7760
7761 bacpy(&ev.addr.bdaddr, bdaddr);
7762 ev.addr.type = type;
7763 ev.action = action;
7764
7765 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7766 }
7767
add_device_complete(struct hci_dev * hdev,void * data,int err)7768 static void add_device_complete(struct hci_dev *hdev, void *data, int err)
7769 {
7770 struct mgmt_pending_cmd *cmd = data;
7771 struct mgmt_cp_add_device *cp = cmd->param;
7772
7773 if (!err) {
7774 struct hci_conn_params *params;
7775
7776 hci_dev_lock(hdev);
7777
7778 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7779 le_addr_type(cp->addr.type));
7780
7781 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type,
7782 cp->action);
7783 device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
7784 cp->addr.type, hdev->conn_flags,
7785 params ? params->flags : 0);
7786 hci_dev_unlock(hdev);
7787 }
7788
7789 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
7790 mgmt_status(err), &cp->addr, sizeof(cp->addr));
7791 mgmt_pending_free(cmd);
7792 }
7793
add_device_sync(struct hci_dev * hdev,void * data)7794 static int add_device_sync(struct hci_dev *hdev, void *data)
7795 {
7796 return hci_update_passive_scan_sync(hdev);
7797 }
7798
add_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7799 static int add_device(struct sock *sk, struct hci_dev *hdev,
7800 void *data, u16 len)
7801 {
7802 struct mgmt_pending_cmd *cmd;
7803 struct mgmt_cp_add_device *cp = data;
7804 u8 auto_conn, addr_type;
7805 struct hci_conn_params *params;
7806 int err;
7807 u32 current_flags = 0;
7808 u32 supported_flags;
7809
7810 bt_dev_dbg(hdev, "sock %p", sk);
7811
7812 if (!bdaddr_type_is_valid(cp->addr.type) ||
7813 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7814 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7815 MGMT_STATUS_INVALID_PARAMS,
7816 &cp->addr, sizeof(cp->addr));
7817
7818 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7819 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7820 MGMT_STATUS_INVALID_PARAMS,
7821 &cp->addr, sizeof(cp->addr));
7822
7823 hci_dev_lock(hdev);
7824
7825 if (cp->addr.type == BDADDR_BREDR) {
7826 /* Only incoming connections action is supported for now */
7827 if (cp->action != 0x01) {
7828 err = mgmt_cmd_complete(sk, hdev->id,
7829 MGMT_OP_ADD_DEVICE,
7830 MGMT_STATUS_INVALID_PARAMS,
7831 &cp->addr, sizeof(cp->addr));
7832 goto unlock;
7833 }
7834
7835 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7836 &cp->addr.bdaddr,
7837 cp->addr.type, 0);
7838 if (err)
7839 goto unlock;
7840
7841 hci_update_scan(hdev);
7842
7843 goto added;
7844 }
7845
7846 addr_type = le_addr_type(cp->addr.type);
7847
7848 if (cp->action == 0x02)
7849 auto_conn = HCI_AUTO_CONN_ALWAYS;
7850 else if (cp->action == 0x01)
7851 auto_conn = HCI_AUTO_CONN_DIRECT;
7852 else
7853 auto_conn = HCI_AUTO_CONN_REPORT;
7854
7855 /* Kernel internally uses conn_params with resolvable private
7856 * address, but Add Device allows only identity addresses.
7857 * Make sure it is enforced before calling
7858 * hci_conn_params_lookup.
7859 */
7860 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7861 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7862 MGMT_STATUS_INVALID_PARAMS,
7863 &cp->addr, sizeof(cp->addr));
7864 goto unlock;
7865 }
7866
7867 /* If the connection parameters don't exist for this device,
7868 * they will be created and configured with defaults.
7869 */
7870 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7871 auto_conn);
7872 if (!params) {
7873 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7874 MGMT_STATUS_FAILED, &cp->addr,
7875 sizeof(cp->addr));
7876 goto unlock;
7877 }
7878
7879 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
7880 if (!cmd) {
7881 err = -ENOMEM;
7882 goto unlock;
7883 }
7884
7885 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd,
7886 add_device_complete);
7887 if (err < 0) {
7888 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7889 MGMT_STATUS_FAILED, &cp->addr,
7890 sizeof(cp->addr));
7891 mgmt_pending_free(cmd);
7892 }
7893
7894 goto unlock;
7895
7896 added:
7897 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7898 supported_flags = hdev->conn_flags;
7899 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7900 supported_flags, current_flags);
7901
7902 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7903 MGMT_STATUS_SUCCESS, &cp->addr,
7904 sizeof(cp->addr));
7905
7906 unlock:
7907 hci_dev_unlock(hdev);
7908 return err;
7909 }
7910
device_removed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)7911 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7912 bdaddr_t *bdaddr, u8 type)
7913 {
7914 struct mgmt_ev_device_removed ev;
7915
7916 bacpy(&ev.addr.bdaddr, bdaddr);
7917 ev.addr.type = type;
7918
7919 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7920 }
7921
remove_device_sync(struct hci_dev * hdev,void * data)7922 static int remove_device_sync(struct hci_dev *hdev, void *data)
7923 {
7924 return hci_update_passive_scan_sync(hdev);
7925 }
7926
remove_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7927 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7928 void *data, u16 len)
7929 {
7930 struct mgmt_cp_remove_device *cp = data;
7931 int err;
7932
7933 bt_dev_dbg(hdev, "sock %p", sk);
7934
7935 hci_dev_lock(hdev);
7936
7937 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7938 struct hci_conn_params *params;
7939 u8 addr_type;
7940
7941 if (!bdaddr_type_is_valid(cp->addr.type)) {
7942 err = mgmt_cmd_complete(sk, hdev->id,
7943 MGMT_OP_REMOVE_DEVICE,
7944 MGMT_STATUS_INVALID_PARAMS,
7945 &cp->addr, sizeof(cp->addr));
7946 goto unlock;
7947 }
7948
7949 if (cp->addr.type == BDADDR_BREDR) {
7950 err = hci_bdaddr_list_del(&hdev->accept_list,
7951 &cp->addr.bdaddr,
7952 cp->addr.type);
7953 if (err) {
7954 err = mgmt_cmd_complete(sk, hdev->id,
7955 MGMT_OP_REMOVE_DEVICE,
7956 MGMT_STATUS_INVALID_PARAMS,
7957 &cp->addr,
7958 sizeof(cp->addr));
7959 goto unlock;
7960 }
7961
7962 hci_update_scan(hdev);
7963
7964 device_removed(sk, hdev, &cp->addr.bdaddr,
7965 cp->addr.type);
7966 goto complete;
7967 }
7968
7969 addr_type = le_addr_type(cp->addr.type);
7970
7971 /* Kernel internally uses conn_params with resolvable private
7972 * address, but Remove Device allows only identity addresses.
7973 * Make sure it is enforced before calling
7974 * hci_conn_params_lookup.
7975 */
7976 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7977 err = mgmt_cmd_complete(sk, hdev->id,
7978 MGMT_OP_REMOVE_DEVICE,
7979 MGMT_STATUS_INVALID_PARAMS,
7980 &cp->addr, sizeof(cp->addr));
7981 goto unlock;
7982 }
7983
7984 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7985 addr_type);
7986 if (!params) {
7987 err = mgmt_cmd_complete(sk, hdev->id,
7988 MGMT_OP_REMOVE_DEVICE,
7989 MGMT_STATUS_INVALID_PARAMS,
7990 &cp->addr, sizeof(cp->addr));
7991 goto unlock;
7992 }
7993
7994 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7995 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7996 err = mgmt_cmd_complete(sk, hdev->id,
7997 MGMT_OP_REMOVE_DEVICE,
7998 MGMT_STATUS_INVALID_PARAMS,
7999 &cp->addr, sizeof(cp->addr));
8000 goto unlock;
8001 }
8002
8003 hci_conn_params_free(params);
8004
8005 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
8006 } else {
8007 struct hci_conn_params *p, *tmp;
8008 struct bdaddr_list *b, *btmp;
8009
8010 if (cp->addr.type) {
8011 err = mgmt_cmd_complete(sk, hdev->id,
8012 MGMT_OP_REMOVE_DEVICE,
8013 MGMT_STATUS_INVALID_PARAMS,
8014 &cp->addr, sizeof(cp->addr));
8015 goto unlock;
8016 }
8017
8018 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8019 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8020 list_del(&b->list);
8021 kfree(b);
8022 }
8023
8024 hci_update_scan(hdev);
8025
8026 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8027 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8028 continue;
8029 device_removed(sk, hdev, &p->addr, p->addr_type);
8030 if (p->explicit_connect) {
8031 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8032 continue;
8033 }
8034 hci_conn_params_free(p);
8035 }
8036
8037 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8038 }
8039
8040 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
8041
8042 complete:
8043 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8044 MGMT_STATUS_SUCCESS, &cp->addr,
8045 sizeof(cp->addr));
8046 unlock:
8047 hci_dev_unlock(hdev);
8048 return err;
8049 }
8050
conn_update_sync(struct hci_dev * hdev,void * data)8051 static int conn_update_sync(struct hci_dev *hdev, void *data)
8052 {
8053 struct hci_conn *conn = data;
8054 struct hci_conn_params *params;
8055 struct hci_conn_params local = {};
8056
8057 hci_dev_lock(hdev);
8058
8059 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER)
8060 goto cancel;
8061
8062 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
8063 if (!params)
8064 goto cancel;
8065
8066 local.conn_min_interval = params->conn_min_interval;
8067 local.conn_max_interval = params->conn_max_interval;
8068 local.conn_latency = params->conn_latency;
8069 local.supervision_timeout = params->supervision_timeout;
8070
8071 hci_dev_unlock(hdev);
8072
8073 return hci_le_conn_update_sync(hdev, conn, &local);
8074
8075 cancel:
8076 hci_dev_unlock(hdev);
8077 return -ECANCELED;
8078 }
8079
conn_update_sync_destroy(struct hci_dev * hdev,void * data,int err)8080 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err)
8081 {
8082 hci_conn_put(data);
8083 }
8084
load_conn_param(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8085 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8086 u16 len)
8087 {
8088 struct mgmt_cp_load_conn_param *cp = data;
8089 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8090 sizeof(struct mgmt_conn_param));
8091 u16 param_count, expected_len;
8092 int i;
8093
8094 if (!lmp_le_capable(hdev))
8095 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8096 MGMT_STATUS_NOT_SUPPORTED);
8097
8098 param_count = __le16_to_cpu(cp->param_count);
8099 if (param_count > max_param_count) {
8100 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8101 param_count);
8102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8103 MGMT_STATUS_INVALID_PARAMS);
8104 }
8105
8106 expected_len = struct_size(cp, params, param_count);
8107 if (expected_len != len) {
8108 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8109 expected_len, len);
8110 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8111 MGMT_STATUS_INVALID_PARAMS);
8112 }
8113
8114 bt_dev_dbg(hdev, "param_count %u", param_count);
8115
8116 hci_dev_lock(hdev);
8117
8118 if (param_count > 1)
8119 hci_conn_params_clear_disabled(hdev);
8120
8121 for (i = 0; i < param_count; i++) {
8122 struct mgmt_conn_param *param = &cp->params[i];
8123 struct hci_conn_params *hci_param;
8124 u16 min, max, latency, timeout;
8125 bool update = false;
8126 u8 addr_type;
8127
8128 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr,
8129 param->addr.type);
8130
8131 if (param->addr.type == BDADDR_LE_PUBLIC) {
8132 addr_type = ADDR_LE_DEV_PUBLIC;
8133 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8134 addr_type = ADDR_LE_DEV_RANDOM;
8135 } else {
8136 bt_dev_err(hdev, "ignoring invalid connection parameters");
8137 continue;
8138 }
8139
8140 min = le16_to_cpu(param->min_interval);
8141 max = le16_to_cpu(param->max_interval);
8142 latency = le16_to_cpu(param->latency);
8143 timeout = le16_to_cpu(param->timeout);
8144
8145 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8146 min, max, latency, timeout);
8147
8148 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8149 bt_dev_err(hdev, "ignoring invalid connection parameters");
8150 continue;
8151 }
8152
8153 /* Detect when the loading is for an existing parameter then
8154 * attempt to trigger the connection update procedure.
8155 */
8156 if (!i && param_count == 1) {
8157 hci_param = hci_conn_params_lookup(hdev,
8158 ¶m->addr.bdaddr,
8159 addr_type);
8160 if (hci_param)
8161 update = true;
8162 else
8163 hci_conn_params_clear_disabled(hdev);
8164 }
8165
8166 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
8167 addr_type);
8168 if (!hci_param) {
8169 bt_dev_err(hdev, "failed to add connection parameters");
8170 continue;
8171 }
8172
8173 hci_param->conn_min_interval = min;
8174 hci_param->conn_max_interval = max;
8175 hci_param->conn_latency = latency;
8176 hci_param->supervision_timeout = timeout;
8177
8178 /* Check if we need to trigger a connection update */
8179 if (update) {
8180 struct hci_conn *conn;
8181
8182 /* Lookup for existing connection as central and check
8183 * if parameters match and if they don't then trigger
8184 * a connection update.
8185 */
8186 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr,
8187 addr_type);
8188 if (conn && conn->role == HCI_ROLE_MASTER &&
8189 (conn->le_conn_min_interval != min ||
8190 conn->le_conn_max_interval != max ||
8191 conn->le_conn_latency != latency ||
8192 conn->le_supv_timeout != timeout)) {
8193 hci_conn_get(conn);
8194 if (hci_cmd_sync_queue(hdev, conn_update_sync,
8195 conn,
8196 conn_update_sync_destroy) < 0)
8197 hci_conn_put(conn);
8198 }
8199 }
8200 }
8201
8202 hci_dev_unlock(hdev);
8203
8204 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8205 NULL, 0);
8206 }
8207
load_conn_subrate(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8208 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data,
8209 u16 len)
8210 {
8211 struct mgmt_cp_load_conn_subrate *cp = data;
8212 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8213 sizeof(struct mgmt_conn_subrate));
8214 u16 param_count, expected_len;
8215 int i;
8216
8217 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev))
8218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8219 MGMT_STATUS_NOT_SUPPORTED);
8220
8221 param_count = __le16_to_cpu(cp->param_count);
8222 if (param_count > max_param_count) {
8223 bt_dev_err(hdev, "too big param_count value %u", param_count);
8224 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8225 MGMT_STATUS_INVALID_PARAMS);
8226 }
8227
8228 expected_len = struct_size(cp, params, param_count);
8229 if (expected_len != len) {
8230 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
8231 expected_len, len);
8232 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8233 MGMT_STATUS_INVALID_PARAMS);
8234 }
8235
8236 bt_dev_dbg(hdev, "param_count %u", param_count);
8237
8238 hci_dev_lock(hdev);
8239
8240 for (i = 0; i < param_count; i++) {
8241 struct mgmt_conn_subrate *param = &cp->params[i];
8242 struct hci_conn_params *hci_param;
8243 u16 min, max, subrate_min, subrate_max;
8244 u16 max_latency, cont_num, supv_timeout;
8245 u8 addr_type;
8246
8247 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)",
8248 ¶m->addr.bdaddr, param->addr.type);
8249
8250 if (param->addr.type == BDADDR_LE_PUBLIC) {
8251 addr_type = ADDR_LE_DEV_PUBLIC;
8252 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8253 addr_type = ADDR_LE_DEV_RANDOM;
8254 } else {
8255 bt_dev_err(hdev, "ignoring invalid connection subrate parameters");
8256 continue;
8257 }
8258
8259 min = le16_to_cpu(param->min_interval);
8260 max = le16_to_cpu(param->max_interval);
8261 subrate_min = le16_to_cpu(param->subrate_min);
8262 subrate_max = le16_to_cpu(param->subrate_max);
8263 max_latency = le16_to_cpu(param->max_latency);
8264 cont_num = le16_to_cpu(param->cont_num);
8265 supv_timeout = le16_to_cpu(param->supv_timeout);
8266
8267 /* Validate the parameters before storing them. Reject
8268 * logically inconsistent values instead of forwarding them to
8269 * the controller.
8270 */
8271 if (min > max || subrate_min > subrate_max ||
8272 subrate_min < 1 || supv_timeout < 1) {
8273 bt_dev_err(hdev, "ignoring invalid connection subrate parameters");
8274 continue;
8275 }
8276
8277 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
8278 addr_type);
8279 if (!hci_param) {
8280 bt_dev_err(hdev, "failed to add connection parameters");
8281 continue;
8282 }
8283
8284 hci_param->rate_min_interval = min;
8285 hci_param->rate_max_interval = max;
8286 hci_param->subrate_min = subrate_min;
8287 hci_param->subrate_max = subrate_max;
8288 hci_param->max_latency = max_latency;
8289 hci_param->cont_num = cont_num;
8290 hci_param->rate_supv_timeout = supv_timeout;
8291
8292 /* If the device is connected as central check if the
8293 * connection rate parameters need to be updated.
8294 */
8295 if (!i && param_count == 1) {
8296 struct hci_conn *conn;
8297
8298 conn = hci_conn_hash_lookup_le(hdev,
8299 &hci_param->addr,
8300 addr_type);
8301 if (conn && conn->state == BT_CONNECTED &&
8302 conn->role == HCI_ROLE_MASTER &&
8303 (conn->le_rate_interval < min ||
8304 conn->le_rate_interval > max ||
8305 conn->le_subrate < subrate_min ||
8306 conn->le_subrate > subrate_max ||
8307 conn->le_rate_latency != max_latency ||
8308 conn->le_cont_num != cont_num ||
8309 conn->le_rate_supv_timeout != supv_timeout))
8310 hci_le_conn_rate_request(hdev, conn);
8311 }
8312 }
8313
8314 hci_dev_unlock(hdev);
8315
8316 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0,
8317 NULL, 0);
8318 }
8319
set_external_config(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8320 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8321 void *data, u16 len)
8322 {
8323 struct mgmt_cp_set_external_config *cp = data;
8324 bool changed;
8325 int err;
8326
8327 bt_dev_dbg(hdev, "sock %p", sk);
8328
8329 if (hdev_is_powered(hdev))
8330 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8331 MGMT_STATUS_REJECTED);
8332
8333 if (cp->config != 0x00 && cp->config != 0x01)
8334 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8335 MGMT_STATUS_INVALID_PARAMS);
8336
8337 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG))
8338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8339 MGMT_STATUS_NOT_SUPPORTED);
8340
8341 hci_dev_lock(hdev);
8342
8343 if (cp->config)
8344 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8345 else
8346 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8347
8348 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8349 if (err < 0)
8350 goto unlock;
8351
8352 if (!changed)
8353 goto unlock;
8354
8355 err = new_options(hdev, sk);
8356
8357 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8358 mgmt_index_removed(hdev);
8359
8360 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8361 hci_dev_set_flag(hdev, HCI_CONFIG);
8362 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8363
8364 queue_work(hdev->req_workqueue, &hdev->power_on);
8365 } else {
8366 set_bit(HCI_RAW, &hdev->flags);
8367 mgmt_index_added(hdev);
8368 }
8369 }
8370
8371 unlock:
8372 hci_dev_unlock(hdev);
8373 return err;
8374 }
8375
set_public_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8376 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8377 void *data, u16 len)
8378 {
8379 struct mgmt_cp_set_public_address *cp = data;
8380 bool changed;
8381 int err;
8382
8383 bt_dev_dbg(hdev, "sock %p", sk);
8384
8385 if (hdev_is_powered(hdev))
8386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8387 MGMT_STATUS_REJECTED);
8388
8389 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8391 MGMT_STATUS_INVALID_PARAMS);
8392
8393 if (!hdev->set_bdaddr)
8394 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8395 MGMT_STATUS_NOT_SUPPORTED);
8396
8397 hci_dev_lock(hdev);
8398
8399 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8400 bacpy(&hdev->public_addr, &cp->bdaddr);
8401
8402 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8403 if (err < 0)
8404 goto unlock;
8405
8406 if (!changed)
8407 goto unlock;
8408
8409 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8410 err = new_options(hdev, sk);
8411
8412 if (is_configured(hdev)) {
8413 mgmt_index_removed(hdev);
8414
8415 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8416
8417 hci_dev_set_flag(hdev, HCI_CONFIG);
8418 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8419
8420 queue_work(hdev->req_workqueue, &hdev->power_on);
8421 }
8422
8423 unlock:
8424 hci_dev_unlock(hdev);
8425 return err;
8426 }
8427
read_local_oob_ext_data_complete(struct hci_dev * hdev,void * data,int err)8428 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8429 int err)
8430 {
8431 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8432 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8433 u8 *h192, *r192, *h256, *r256;
8434 struct mgmt_pending_cmd *cmd = data;
8435 struct sk_buff *skb = cmd->skb;
8436 u8 status = mgmt_status(err);
8437 u16 eir_len;
8438
8439 if (!status) {
8440 if (!skb)
8441 status = MGMT_STATUS_FAILED;
8442 else if (IS_ERR(skb))
8443 status = mgmt_status(PTR_ERR(skb));
8444 else
8445 status = mgmt_status(skb->data[0]);
8446 }
8447
8448 bt_dev_dbg(hdev, "status %u", status);
8449
8450 mgmt_cp = cmd->param;
8451
8452 if (status) {
8453 status = mgmt_status(status);
8454 eir_len = 0;
8455
8456 h192 = NULL;
8457 r192 = NULL;
8458 h256 = NULL;
8459 r256 = NULL;
8460 } else if (!bredr_sc_enabled(hdev)) {
8461 struct hci_rp_read_local_oob_data *rp;
8462
8463 if (skb->len != sizeof(*rp)) {
8464 status = MGMT_STATUS_FAILED;
8465 eir_len = 0;
8466 } else {
8467 status = MGMT_STATUS_SUCCESS;
8468 rp = (void *)skb->data;
8469
8470 eir_len = 5 + 18 + 18;
8471 h192 = rp->hash;
8472 r192 = rp->rand;
8473 h256 = NULL;
8474 r256 = NULL;
8475 }
8476 } else {
8477 struct hci_rp_read_local_oob_ext_data *rp;
8478
8479 if (skb->len != sizeof(*rp)) {
8480 status = MGMT_STATUS_FAILED;
8481 eir_len = 0;
8482 } else {
8483 status = MGMT_STATUS_SUCCESS;
8484 rp = (void *)skb->data;
8485
8486 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8487 eir_len = 5 + 18 + 18;
8488 h192 = NULL;
8489 r192 = NULL;
8490 } else {
8491 eir_len = 5 + 18 + 18 + 18 + 18;
8492 h192 = rp->hash192;
8493 r192 = rp->rand192;
8494 }
8495
8496 h256 = rp->hash256;
8497 r256 = rp->rand256;
8498 }
8499 }
8500
8501 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8502 if (!mgmt_rp)
8503 goto done;
8504
8505 if (eir_len == 0)
8506 goto send_rsp;
8507
8508 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8509 hdev->dev_class, 3);
8510
8511 if (h192 && r192) {
8512 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8513 EIR_SSP_HASH_C192, h192, 16);
8514 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8515 EIR_SSP_RAND_R192, r192, 16);
8516 }
8517
8518 if (h256 && r256) {
8519 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8520 EIR_SSP_HASH_C256, h256, 16);
8521 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8522 EIR_SSP_RAND_R256, r256, 16);
8523 }
8524
8525 send_rsp:
8526 mgmt_rp->type = mgmt_cp->type;
8527 mgmt_rp->eir_len = cpu_to_le16(eir_len);
8528
8529 err = mgmt_cmd_complete(cmd->sk, hdev->id,
8530 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8531 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8532 if (err < 0 || status)
8533 goto done;
8534
8535 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8536
8537 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8538 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8539 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8540 done:
8541 if (skb && !IS_ERR(skb))
8542 kfree_skb(skb);
8543
8544 kfree(mgmt_rp);
8545 mgmt_pending_free(cmd);
8546 }
8547
read_local_ssp_oob_req(struct hci_dev * hdev,struct sock * sk,struct mgmt_cp_read_local_oob_ext_data * cp)8548 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8549 struct mgmt_cp_read_local_oob_ext_data *cp)
8550 {
8551 struct mgmt_pending_cmd *cmd;
8552 int err;
8553
8554 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8555 cp, sizeof(*cp));
8556 if (!cmd)
8557 return -ENOMEM;
8558
8559 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8560 read_local_oob_ext_data_complete);
8561
8562 if (err < 0) {
8563 mgmt_pending_remove(cmd);
8564 return err;
8565 }
8566
8567 return 0;
8568 }
8569
read_local_oob_ext_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8570 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8571 void *data, u16 data_len)
8572 {
8573 struct mgmt_cp_read_local_oob_ext_data *cp = data;
8574 struct mgmt_rp_read_local_oob_ext_data *rp;
8575 size_t rp_len;
8576 u16 eir_len;
8577 u8 status, flags, role, addr[7], hash[16], rand[16];
8578 int err;
8579
8580 bt_dev_dbg(hdev, "sock %p", sk);
8581
8582 if (hdev_is_powered(hdev)) {
8583 switch (cp->type) {
8584 case BIT(BDADDR_BREDR):
8585 status = mgmt_bredr_support(hdev);
8586 if (status)
8587 eir_len = 0;
8588 else
8589 eir_len = 5;
8590 break;
8591 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8592 status = mgmt_le_support(hdev);
8593 if (status)
8594 eir_len = 0;
8595 else
8596 eir_len = 9 + 3 + 18 + 18 + 3;
8597 break;
8598 default:
8599 status = MGMT_STATUS_INVALID_PARAMS;
8600 eir_len = 0;
8601 break;
8602 }
8603 } else {
8604 status = MGMT_STATUS_NOT_POWERED;
8605 eir_len = 0;
8606 }
8607
8608 rp_len = sizeof(*rp) + eir_len;
8609 rp = kmalloc(rp_len, GFP_ATOMIC);
8610 if (!rp)
8611 return -ENOMEM;
8612
8613 if (!status && !lmp_ssp_capable(hdev)) {
8614 status = MGMT_STATUS_NOT_SUPPORTED;
8615 eir_len = 0;
8616 }
8617
8618 if (status)
8619 goto complete;
8620
8621 hci_dev_lock(hdev);
8622
8623 eir_len = 0;
8624 switch (cp->type) {
8625 case BIT(BDADDR_BREDR):
8626 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8627 err = read_local_ssp_oob_req(hdev, sk, cp);
8628 hci_dev_unlock(hdev);
8629 if (!err)
8630 goto done;
8631
8632 status = MGMT_STATUS_FAILED;
8633 goto complete;
8634 } else {
8635 eir_len = eir_append_data(rp->eir, eir_len,
8636 EIR_CLASS_OF_DEV,
8637 hdev->dev_class, 3);
8638 }
8639 break;
8640 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8641 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8642 smp_generate_oob(hdev, hash, rand) < 0) {
8643 hci_dev_unlock(hdev);
8644 status = MGMT_STATUS_FAILED;
8645 goto complete;
8646 }
8647
8648 /* This should return the active RPA, but since the RPA
8649 * is only programmed on demand, it is really hard to fill
8650 * this in at the moment. For now disallow retrieving
8651 * local out-of-band data when privacy is in use.
8652 *
8653 * Returning the identity address will not help here since
8654 * pairing happens before the identity resolving key is
8655 * known and thus the connection establishment happens
8656 * based on the RPA and not the identity address.
8657 */
8658 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8659 hci_dev_unlock(hdev);
8660 status = MGMT_STATUS_REJECTED;
8661 goto complete;
8662 }
8663
8664 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8665 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8666 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8667 bacmp(&hdev->static_addr, BDADDR_ANY))) {
8668 memcpy(addr, &hdev->static_addr, 6);
8669 addr[6] = 0x01;
8670 } else {
8671 memcpy(addr, &hdev->bdaddr, 6);
8672 addr[6] = 0x00;
8673 }
8674
8675 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8676 addr, sizeof(addr));
8677
8678 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8679 role = 0x02;
8680 else
8681 role = 0x01;
8682
8683 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8684 &role, sizeof(role));
8685
8686 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8687 eir_len = eir_append_data(rp->eir, eir_len,
8688 EIR_LE_SC_CONFIRM,
8689 hash, sizeof(hash));
8690
8691 eir_len = eir_append_data(rp->eir, eir_len,
8692 EIR_LE_SC_RANDOM,
8693 rand, sizeof(rand));
8694 }
8695
8696 flags = mgmt_get_adv_discov_flags(hdev);
8697
8698 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8699 flags |= LE_AD_NO_BREDR;
8700
8701 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8702 &flags, sizeof(flags));
8703 break;
8704 }
8705
8706 hci_dev_unlock(hdev);
8707
8708 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8709
8710 status = MGMT_STATUS_SUCCESS;
8711
8712 complete:
8713 rp->type = cp->type;
8714 rp->eir_len = cpu_to_le16(eir_len);
8715
8716 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8717 status, rp, sizeof(*rp) + eir_len);
8718 if (err < 0 || status)
8719 goto done;
8720
8721 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8722 rp, sizeof(*rp) + eir_len,
8723 HCI_MGMT_OOB_DATA_EVENTS, sk);
8724
8725 done:
8726 kfree(rp);
8727
8728 return err;
8729 }
8730
get_supported_adv_flags(struct hci_dev * hdev)8731 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8732 {
8733 u32 flags = 0;
8734
8735 flags |= MGMT_ADV_FLAG_CONNECTABLE;
8736 flags |= MGMT_ADV_FLAG_DISCOV;
8737 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8738 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8739 flags |= MGMT_ADV_FLAG_APPEARANCE;
8740 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8741 flags |= MGMT_ADV_PARAM_DURATION;
8742 flags |= MGMT_ADV_PARAM_TIMEOUT;
8743 flags |= MGMT_ADV_PARAM_INTERVALS;
8744 flags |= MGMT_ADV_PARAM_TX_POWER;
8745 flags |= MGMT_ADV_PARAM_SCAN_RSP;
8746
8747 /* In extended adv TX_POWER returned from Set Adv Param
8748 * will be always valid.
8749 */
8750 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8751 flags |= MGMT_ADV_FLAG_TX_POWER;
8752
8753 if (ext_adv_capable(hdev)) {
8754 flags |= MGMT_ADV_FLAG_SEC_1M;
8755 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8756 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8757
8758 if (le_2m_capable(hdev))
8759 flags |= MGMT_ADV_FLAG_SEC_2M;
8760
8761 if (le_coded_capable(hdev))
8762 flags |= MGMT_ADV_FLAG_SEC_CODED;
8763 }
8764
8765 return flags;
8766 }
8767
read_adv_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8768 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8769 void *data, u16 data_len)
8770 {
8771 struct mgmt_rp_read_adv_features *rp;
8772 size_t rp_len;
8773 int err;
8774 struct adv_info *adv_instance;
8775 u32 supported_flags;
8776 u8 *instance;
8777
8778 bt_dev_dbg(hdev, "sock %p", sk);
8779
8780 if (!lmp_le_capable(hdev))
8781 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8782 MGMT_STATUS_REJECTED);
8783
8784 hci_dev_lock(hdev);
8785
8786 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8787 rp = kmalloc(rp_len, GFP_ATOMIC);
8788 if (!rp) {
8789 hci_dev_unlock(hdev);
8790 return -ENOMEM;
8791 }
8792
8793 supported_flags = get_supported_adv_flags(hdev);
8794
8795 rp->supported_flags = cpu_to_le32(supported_flags);
8796 rp->max_adv_data_len = max_adv_len(hdev);
8797 rp->max_scan_rsp_len = max_adv_len(hdev);
8798 rp->max_instances = hdev->le_num_of_adv_sets;
8799 rp->num_instances = hdev->adv_instance_cnt;
8800
8801 instance = rp->instance;
8802 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8803 /* Only instances 1-le_num_of_adv_sets are externally visible */
8804 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8805 *instance = adv_instance->instance;
8806 instance++;
8807 } else {
8808 rp->num_instances--;
8809 rp_len--;
8810 }
8811 }
8812
8813 hci_dev_unlock(hdev);
8814
8815 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8816 MGMT_STATUS_SUCCESS, rp, rp_len);
8817
8818 kfree(rp);
8819
8820 return err;
8821 }
8822
calculate_name_len(struct hci_dev * hdev)8823 static u8 calculate_name_len(struct hci_dev *hdev)
8824 {
8825 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
8826
8827 return eir_append_local_name(hdev, buf, 0);
8828 }
8829
tlv_data_max_len(struct hci_dev * hdev,u32 adv_flags,bool is_adv_data)8830 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8831 bool is_adv_data)
8832 {
8833 u8 max_len = max_adv_len(hdev);
8834
8835 if (is_adv_data) {
8836 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8837 MGMT_ADV_FLAG_LIMITED_DISCOV |
8838 MGMT_ADV_FLAG_MANAGED_FLAGS))
8839 max_len -= 3;
8840
8841 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8842 max_len -= 3;
8843 } else {
8844 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8845 max_len -= calculate_name_len(hdev);
8846
8847 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8848 max_len -= 4;
8849 }
8850
8851 return max_len;
8852 }
8853
flags_managed(u32 adv_flags)8854 static bool flags_managed(u32 adv_flags)
8855 {
8856 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8857 MGMT_ADV_FLAG_LIMITED_DISCOV |
8858 MGMT_ADV_FLAG_MANAGED_FLAGS);
8859 }
8860
tx_power_managed(u32 adv_flags)8861 static bool tx_power_managed(u32 adv_flags)
8862 {
8863 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8864 }
8865
name_managed(u32 adv_flags)8866 static bool name_managed(u32 adv_flags)
8867 {
8868 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8869 }
8870
appearance_managed(u32 adv_flags)8871 static bool appearance_managed(u32 adv_flags)
8872 {
8873 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8874 }
8875
tlv_data_is_valid(struct hci_dev * hdev,u32 adv_flags,u8 * data,u8 len,bool is_adv_data)8876 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8877 u8 len, bool is_adv_data)
8878 {
8879 int i, cur_len;
8880 u8 max_len;
8881
8882 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8883
8884 if (len > max_len)
8885 return false;
8886
8887 /* Make sure that the data is correctly formatted. */
8888 for (i = 0; i < len; i += (cur_len + 1)) {
8889 cur_len = data[i];
8890
8891 if (!cur_len)
8892 continue;
8893
8894 /* If the current field length would exceed the total data
8895 * length, then it's invalid.
8896 */
8897 if (i + cur_len >= len)
8898 return false;
8899
8900 if (data[i + 1] == EIR_FLAGS &&
8901 (!is_adv_data || flags_managed(adv_flags)))
8902 return false;
8903
8904 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8905 return false;
8906
8907 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8908 return false;
8909
8910 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8911 return false;
8912
8913 if (data[i + 1] == EIR_APPEARANCE &&
8914 appearance_managed(adv_flags))
8915 return false;
8916 }
8917
8918 return true;
8919 }
8920
requested_adv_flags_are_valid(struct hci_dev * hdev,u32 adv_flags)8921 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8922 {
8923 u32 supported_flags, phy_flags;
8924
8925 /* The current implementation only supports a subset of the specified
8926 * flags. Also need to check mutual exclusiveness of sec flags.
8927 */
8928 supported_flags = get_supported_adv_flags(hdev);
8929 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8930 if (adv_flags & ~supported_flags ||
8931 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8932 return false;
8933
8934 return true;
8935 }
8936
adv_busy(struct hci_dev * hdev)8937 static bool adv_busy(struct hci_dev *hdev)
8938 {
8939 return pending_find(MGMT_OP_SET_LE, hdev);
8940 }
8941
add_adv_complete(struct hci_dev * hdev,struct sock * sk,u8 instance,int err)8942 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8943 int err)
8944 {
8945 struct adv_info *adv, *n;
8946
8947 bt_dev_dbg(hdev, "err %d", err);
8948
8949 hci_dev_lock(hdev);
8950
8951 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8952 u8 instance;
8953
8954 if (!adv->pending)
8955 continue;
8956
8957 if (!err) {
8958 adv->pending = false;
8959 continue;
8960 }
8961
8962 instance = adv->instance;
8963
8964 if (hdev->cur_adv_instance == instance)
8965 cancel_adv_timeout(hdev);
8966
8967 hci_remove_adv_instance(hdev, instance);
8968 mgmt_advertising_removed(sk, hdev, instance);
8969 }
8970
8971 hci_dev_unlock(hdev);
8972 }
8973
add_advertising_complete(struct hci_dev * hdev,void * data,int err)8974 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8975 {
8976 struct mgmt_pending_cmd *cmd = data;
8977 struct mgmt_cp_add_advertising *cp = cmd->param;
8978 struct mgmt_rp_add_advertising rp;
8979
8980 memset(&rp, 0, sizeof(rp));
8981
8982 rp.instance = cp->instance;
8983
8984 if (err)
8985 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
8986 mgmt_status(err));
8987 else
8988 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
8989 mgmt_status(err), &rp, sizeof(rp));
8990
8991 add_adv_complete(hdev, cmd->sk, cp->instance, err);
8992
8993 mgmt_pending_free(cmd);
8994 }
8995
add_advertising_sync(struct hci_dev * hdev,void * data)8996 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8997 {
8998 struct mgmt_pending_cmd *cmd = data;
8999 struct mgmt_cp_add_advertising *cp = cmd->param;
9000
9001 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
9002 }
9003
add_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9004 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
9005 void *data, u16 data_len)
9006 {
9007 struct mgmt_cp_add_advertising *cp = data;
9008 struct mgmt_rp_add_advertising rp;
9009 u32 flags;
9010 u8 status;
9011 u16 timeout, duration;
9012 unsigned int prev_instance_cnt;
9013 u8 schedule_instance = 0;
9014 struct adv_info *adv, *next_instance;
9015 int err;
9016 struct mgmt_pending_cmd *cmd;
9017
9018 bt_dev_dbg(hdev, "sock %p", sk);
9019
9020 status = mgmt_le_support(hdev);
9021 if (status)
9022 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9023 status);
9024
9025 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9027 MGMT_STATUS_INVALID_PARAMS);
9028
9029 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9031 MGMT_STATUS_INVALID_PARAMS);
9032
9033 flags = __le32_to_cpu(cp->flags);
9034 timeout = __le16_to_cpu(cp->timeout);
9035 duration = __le16_to_cpu(cp->duration);
9036
9037 if (!requested_adv_flags_are_valid(hdev, flags))
9038 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9039 MGMT_STATUS_INVALID_PARAMS);
9040
9041 hci_dev_lock(hdev);
9042
9043 if (timeout && !hdev_is_powered(hdev)) {
9044 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9045 MGMT_STATUS_REJECTED);
9046 goto unlock;
9047 }
9048
9049 if (adv_busy(hdev)) {
9050 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9051 MGMT_STATUS_BUSY);
9052 goto unlock;
9053 }
9054
9055 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9056 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9057 cp->scan_rsp_len, false)) {
9058 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9059 MGMT_STATUS_INVALID_PARAMS);
9060 goto unlock;
9061 }
9062
9063 prev_instance_cnt = hdev->adv_instance_cnt;
9064
9065 adv = hci_add_adv_instance(hdev, cp->instance, flags,
9066 cp->adv_data_len, cp->data,
9067 cp->scan_rsp_len,
9068 cp->data + cp->adv_data_len,
9069 timeout, duration,
9070 HCI_ADV_TX_POWER_NO_PREFERENCE,
9071 hdev->le_adv_min_interval,
9072 hdev->le_adv_max_interval, 0);
9073 if (IS_ERR(adv)) {
9074 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9075 MGMT_STATUS_FAILED);
9076 goto unlock;
9077 }
9078
9079 /* Only trigger an advertising added event if a new instance was
9080 * actually added.
9081 */
9082 if (hdev->adv_instance_cnt > prev_instance_cnt)
9083 mgmt_advertising_added(sk, hdev, cp->instance);
9084
9085 if (hdev->cur_adv_instance == cp->instance) {
9086 /* If the currently advertised instance is being changed then
9087 * cancel the current advertising and schedule the next
9088 * instance. If there is only one instance then the overridden
9089 * advertising data will be visible right away.
9090 */
9091 cancel_adv_timeout(hdev);
9092
9093 next_instance = hci_get_next_instance(hdev, cp->instance);
9094 if (next_instance)
9095 schedule_instance = next_instance->instance;
9096 } else if (!hdev->adv_instance_timeout) {
9097 /* Immediately advertise the new instance if no other
9098 * instance is currently being advertised.
9099 */
9100 schedule_instance = cp->instance;
9101 }
9102
9103 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9104 * there is no instance to be advertised then we have no HCI
9105 * communication to make. Simply return.
9106 */
9107 if (!hdev_is_powered(hdev) ||
9108 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9109 !schedule_instance) {
9110 rp.instance = cp->instance;
9111 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9112 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9113 goto unlock;
9114 }
9115
9116 /* We're good to go, update advertising data, parameters, and start
9117 * advertising.
9118 */
9119 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9120 data_len);
9121 if (!cmd) {
9122 err = -ENOMEM;
9123 goto unlock;
9124 }
9125
9126 cp->instance = schedule_instance;
9127
9128 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
9129 add_advertising_complete);
9130 if (err < 0)
9131 mgmt_pending_free(cmd);
9132
9133 unlock:
9134 hci_dev_unlock(hdev);
9135
9136 return err;
9137 }
9138
add_ext_adv_params_complete(struct hci_dev * hdev,void * data,int err)9139 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
9140 int err)
9141 {
9142 struct mgmt_pending_cmd *cmd = data;
9143 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9144 struct mgmt_rp_add_ext_adv_params rp;
9145 struct adv_info *adv;
9146 u32 flags;
9147
9148 BT_DBG("%s", hdev->name);
9149
9150 hci_dev_lock(hdev);
9151
9152 adv = hci_find_adv_instance(hdev, cp->instance);
9153 if (!adv)
9154 goto unlock;
9155
9156 rp.instance = cp->instance;
9157 rp.tx_power = adv->tx_power;
9158
9159 /* While we're at it, inform userspace of the available space for this
9160 * advertisement, given the flags that will be used.
9161 */
9162 flags = __le32_to_cpu(cp->flags);
9163 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9164 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9165
9166 if (err) {
9167 /* If this advertisement was previously advertising and we
9168 * failed to update it, we signal that it has been removed and
9169 * delete its structure
9170 */
9171 if (!adv->pending)
9172 mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9173
9174 hci_remove_adv_instance(hdev, cp->instance);
9175
9176 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9177 mgmt_status(err));
9178 } else {
9179 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9180 mgmt_status(err), &rp, sizeof(rp));
9181 }
9182
9183 unlock:
9184 mgmt_pending_free(cmd);
9185
9186 hci_dev_unlock(hdev);
9187 }
9188
add_ext_adv_params_sync(struct hci_dev * hdev,void * data)9189 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
9190 {
9191 struct mgmt_pending_cmd *cmd = data;
9192 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9193
9194 return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
9195 }
9196
add_ext_adv_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9197 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9198 void *data, u16 data_len)
9199 {
9200 struct mgmt_cp_add_ext_adv_params *cp = data;
9201 struct mgmt_rp_add_ext_adv_params rp;
9202 struct mgmt_pending_cmd *cmd = NULL;
9203 struct adv_info *adv;
9204 u32 flags, min_interval, max_interval;
9205 u16 timeout, duration;
9206 u8 status;
9207 s8 tx_power;
9208 int err;
9209
9210 BT_DBG("%s", hdev->name);
9211
9212 status = mgmt_le_support(hdev);
9213 if (status)
9214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9215 status);
9216
9217 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9219 MGMT_STATUS_INVALID_PARAMS);
9220
9221 /* The purpose of breaking add_advertising into two separate MGMT calls
9222 * for params and data is to allow more parameters to be added to this
9223 * structure in the future. For this reason, we verify that we have the
9224 * bare minimum structure we know of when the interface was defined. Any
9225 * extra parameters we don't know about will be ignored in this request.
9226 */
9227 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9228 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9229 MGMT_STATUS_INVALID_PARAMS);
9230
9231 flags = __le32_to_cpu(cp->flags);
9232
9233 if (!requested_adv_flags_are_valid(hdev, flags))
9234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9235 MGMT_STATUS_INVALID_PARAMS);
9236
9237 hci_dev_lock(hdev);
9238
9239 /* In new interface, we require that we are powered to register */
9240 if (!hdev_is_powered(hdev)) {
9241 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9242 MGMT_STATUS_REJECTED);
9243 goto unlock;
9244 }
9245
9246 if (adv_busy(hdev)) {
9247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9248 MGMT_STATUS_BUSY);
9249 goto unlock;
9250 }
9251
9252 /* Parse defined parameters from request, use defaults otherwise */
9253 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9254 __le16_to_cpu(cp->timeout) : 0;
9255
9256 duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9257 __le16_to_cpu(cp->duration) :
9258 hdev->def_multi_adv_rotation_duration;
9259
9260 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9261 __le32_to_cpu(cp->min_interval) :
9262 hdev->le_adv_min_interval;
9263
9264 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9265 __le32_to_cpu(cp->max_interval) :
9266 hdev->le_adv_max_interval;
9267
9268 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9269 cp->tx_power :
9270 HCI_ADV_TX_POWER_NO_PREFERENCE;
9271
9272 /* Create advertising instance with no advertising or response data */
9273 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
9274 timeout, duration, tx_power, min_interval,
9275 max_interval, 0);
9276
9277 if (IS_ERR(adv)) {
9278 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9279 MGMT_STATUS_FAILED);
9280 goto unlock;
9281 }
9282
9283 /* Submit request for advertising params if ext adv available */
9284 if (ext_adv_capable(hdev)) {
9285 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
9286 data, data_len);
9287 if (!cmd) {
9288 err = -ENOMEM;
9289 hci_remove_adv_instance(hdev, cp->instance);
9290 goto unlock;
9291 }
9292
9293 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
9294 add_ext_adv_params_complete);
9295 if (err < 0)
9296 mgmt_pending_free(cmd);
9297 } else {
9298 rp.instance = cp->instance;
9299 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9300 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9301 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9302 err = mgmt_cmd_complete(sk, hdev->id,
9303 MGMT_OP_ADD_EXT_ADV_PARAMS,
9304 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9305 }
9306
9307 unlock:
9308 hci_dev_unlock(hdev);
9309
9310 return err;
9311 }
9312
add_ext_adv_data_complete(struct hci_dev * hdev,void * data,int err)9313 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
9314 {
9315 struct mgmt_pending_cmd *cmd = data;
9316 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
9317 struct mgmt_rp_add_advertising rp;
9318
9319 add_adv_complete(hdev, cmd->sk, cp->instance, err);
9320
9321 memset(&rp, 0, sizeof(rp));
9322
9323 rp.instance = cp->instance;
9324
9325 if (err)
9326 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9327 mgmt_status(err));
9328 else
9329 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9330 mgmt_status(err), &rp, sizeof(rp));
9331
9332 mgmt_pending_free(cmd);
9333 }
9334
add_ext_adv_data_sync(struct hci_dev * hdev,void * data)9335 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
9336 {
9337 struct mgmt_pending_cmd *cmd = data;
9338 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
9339 int err;
9340
9341 if (ext_adv_capable(hdev)) {
9342 err = hci_update_adv_data_sync(hdev, cp->instance);
9343 if (err)
9344 return err;
9345
9346 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
9347 if (err)
9348 return err;
9349
9350 return hci_enable_ext_advertising_sync(hdev, cp->instance);
9351 }
9352
9353 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
9354 }
9355
add_ext_adv_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9356 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9357 u16 data_len)
9358 {
9359 struct mgmt_cp_add_ext_adv_data *cp = data;
9360 struct mgmt_rp_add_ext_adv_data rp;
9361 u8 schedule_instance = 0;
9362 struct adv_info *next_instance;
9363 struct adv_info *adv_instance;
9364 int err = 0;
9365 struct mgmt_pending_cmd *cmd;
9366 u16 expected_len;
9367
9368 BT_DBG("%s", hdev->name);
9369
9370 expected_len = struct_size(cp, data, cp->adv_data_len +
9371 cp->scan_rsp_len);
9372 if (expected_len > data_len)
9373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9374 MGMT_STATUS_INVALID_PARAMS);
9375
9376 hci_dev_lock(hdev);
9377
9378 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9379
9380 if (!adv_instance) {
9381 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9382 MGMT_STATUS_INVALID_PARAMS);
9383 goto unlock;
9384 }
9385
9386 /* In new interface, we require that we are powered to register */
9387 if (!hdev_is_powered(hdev)) {
9388 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9389 MGMT_STATUS_REJECTED);
9390 goto clear_new_instance;
9391 }
9392
9393 if (adv_busy(hdev)) {
9394 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9395 MGMT_STATUS_BUSY);
9396 goto clear_new_instance;
9397 }
9398
9399 /* Validate new data */
9400 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9401 cp->adv_data_len, true) ||
9402 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9403 cp->adv_data_len, cp->scan_rsp_len, false)) {
9404 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9405 MGMT_STATUS_INVALID_PARAMS);
9406 goto clear_new_instance;
9407 }
9408
9409 /* Set the data in the advertising instance */
9410 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9411 cp->data, cp->scan_rsp_len,
9412 cp->data + cp->adv_data_len);
9413
9414 /* If using software rotation, determine next instance to use */
9415 if (hdev->cur_adv_instance == cp->instance) {
9416 /* If the currently advertised instance is being changed
9417 * then cancel the current advertising and schedule the
9418 * next instance. If there is only one instance then the
9419 * overridden advertising data will be visible right
9420 * away
9421 */
9422 cancel_adv_timeout(hdev);
9423
9424 next_instance = hci_get_next_instance(hdev, cp->instance);
9425 if (next_instance)
9426 schedule_instance = next_instance->instance;
9427 } else if (!hdev->adv_instance_timeout) {
9428 /* Immediately advertise the new instance if no other
9429 * instance is currently being advertised.
9430 */
9431 schedule_instance = cp->instance;
9432 }
9433
9434 /* If the HCI_ADVERTISING flag is set or there is no instance to
9435 * be advertised then we have no HCI communication to make.
9436 * Simply return.
9437 */
9438 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9439 if (adv_instance->pending) {
9440 mgmt_advertising_added(sk, hdev, cp->instance);
9441 adv_instance->pending = false;
9442 }
9443 rp.instance = cp->instance;
9444 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9445 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9446 goto unlock;
9447 }
9448
9449 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9450 data_len);
9451 if (!cmd) {
9452 err = -ENOMEM;
9453 goto clear_new_instance;
9454 }
9455
9456 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9457 add_ext_adv_data_complete);
9458 if (err < 0) {
9459 mgmt_pending_free(cmd);
9460 goto clear_new_instance;
9461 }
9462
9463 /* We were successful in updating data, so trigger advertising_added
9464 * event if this is an instance that wasn't previously advertising. If
9465 * a failure occurs in the requests we initiated, we will remove the
9466 * instance again in add_advertising_complete
9467 */
9468 if (adv_instance->pending)
9469 mgmt_advertising_added(sk, hdev, cp->instance);
9470
9471 goto unlock;
9472
9473 clear_new_instance:
9474 hci_remove_adv_instance(hdev, cp->instance);
9475
9476 unlock:
9477 hci_dev_unlock(hdev);
9478
9479 return err;
9480 }
9481
remove_advertising_complete(struct hci_dev * hdev,void * data,int err)9482 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9483 int err)
9484 {
9485 struct mgmt_pending_cmd *cmd = data;
9486 struct mgmt_cp_remove_advertising *cp = cmd->param;
9487 struct mgmt_rp_remove_advertising rp;
9488
9489 bt_dev_dbg(hdev, "err %d", err);
9490
9491 memset(&rp, 0, sizeof(rp));
9492 rp.instance = cp->instance;
9493
9494 if (err)
9495 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9496 mgmt_status(err));
9497 else
9498 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9499 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9500
9501 mgmt_pending_free(cmd);
9502 }
9503
remove_advertising_sync(struct hci_dev * hdev,void * data)9504 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9505 {
9506 struct mgmt_pending_cmd *cmd = data;
9507 struct mgmt_cp_remove_advertising *cp = cmd->param;
9508 int err;
9509
9510 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9511 if (err)
9512 return err;
9513
9514 if (list_empty(&hdev->adv_instances))
9515 err = hci_disable_advertising_sync(hdev);
9516
9517 return err;
9518 }
9519
remove_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9520 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9521 void *data, u16 data_len)
9522 {
9523 struct mgmt_cp_remove_advertising *cp = data;
9524 struct mgmt_pending_cmd *cmd;
9525 int err;
9526
9527 bt_dev_dbg(hdev, "sock %p", sk);
9528
9529 hci_dev_lock(hdev);
9530
9531 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9532 err = mgmt_cmd_status(sk, hdev->id,
9533 MGMT_OP_REMOVE_ADVERTISING,
9534 MGMT_STATUS_INVALID_PARAMS);
9535 goto unlock;
9536 }
9537
9538 if (pending_find(MGMT_OP_SET_LE, hdev)) {
9539 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9540 MGMT_STATUS_BUSY);
9541 goto unlock;
9542 }
9543
9544 if (list_empty(&hdev->adv_instances)) {
9545 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9546 MGMT_STATUS_INVALID_PARAMS);
9547 goto unlock;
9548 }
9549
9550 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9551 data_len);
9552 if (!cmd) {
9553 err = -ENOMEM;
9554 goto unlock;
9555 }
9556
9557 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9558 remove_advertising_complete);
9559 if (err < 0)
9560 mgmt_pending_free(cmd);
9561
9562 unlock:
9563 hci_dev_unlock(hdev);
9564
9565 return err;
9566 }
9567
get_adv_size_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9568 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9569 void *data, u16 data_len)
9570 {
9571 struct mgmt_cp_get_adv_size_info *cp = data;
9572 struct mgmt_rp_get_adv_size_info rp;
9573 u32 flags, supported_flags;
9574
9575 bt_dev_dbg(hdev, "sock %p", sk);
9576
9577 if (!lmp_le_capable(hdev))
9578 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9579 MGMT_STATUS_REJECTED);
9580
9581 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9583 MGMT_STATUS_INVALID_PARAMS);
9584
9585 flags = __le32_to_cpu(cp->flags);
9586
9587 /* The current implementation only supports a subset of the specified
9588 * flags.
9589 */
9590 supported_flags = get_supported_adv_flags(hdev);
9591 if (flags & ~supported_flags)
9592 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9593 MGMT_STATUS_INVALID_PARAMS);
9594
9595 rp.instance = cp->instance;
9596 rp.flags = cp->flags;
9597 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9598 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9599
9600 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9601 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9602 }
9603
9604 static const struct hci_mgmt_handler mgmt_handlers[] = {
9605 { NULL }, /* 0x0000 (no command) */
9606 { read_version, MGMT_READ_VERSION_SIZE,
9607 HCI_MGMT_NO_HDEV |
9608 HCI_MGMT_UNTRUSTED },
9609 { read_commands, MGMT_READ_COMMANDS_SIZE,
9610 HCI_MGMT_NO_HDEV |
9611 HCI_MGMT_UNTRUSTED },
9612 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
9613 HCI_MGMT_NO_HDEV |
9614 HCI_MGMT_UNTRUSTED },
9615 { read_controller_info, MGMT_READ_INFO_SIZE,
9616 HCI_MGMT_UNTRUSTED },
9617 { set_powered, MGMT_SETTING_SIZE },
9618 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
9619 { set_connectable, MGMT_SETTING_SIZE },
9620 { set_fast_connectable, MGMT_SETTING_SIZE },
9621 { set_bondable, MGMT_SETTING_SIZE },
9622 { set_link_security, MGMT_SETTING_SIZE },
9623 { set_ssp, MGMT_SETTING_SIZE },
9624 { set_hs, MGMT_SETTING_SIZE },
9625 { set_le, MGMT_SETTING_SIZE },
9626 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
9627 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
9628 { add_uuid, MGMT_ADD_UUID_SIZE },
9629 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
9630 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
9631 HCI_MGMT_VAR_LEN },
9632 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9633 HCI_MGMT_VAR_LEN },
9634 { disconnect, MGMT_DISCONNECT_SIZE },
9635 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
9636 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
9637 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
9638 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
9639 { pair_device, MGMT_PAIR_DEVICE_SIZE },
9640 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
9641 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
9642 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
9643 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9644 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
9645 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9646 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
9647 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9648 HCI_MGMT_VAR_LEN },
9649 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9650 { start_discovery, MGMT_START_DISCOVERY_SIZE },
9651 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
9652 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
9653 { block_device, MGMT_BLOCK_DEVICE_SIZE },
9654 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
9655 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
9656 { set_advertising, MGMT_SETTING_SIZE },
9657 { set_bredr, MGMT_SETTING_SIZE },
9658 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
9659 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
9660 { set_secure_conn, MGMT_SETTING_SIZE },
9661 { set_debug_keys, MGMT_SETTING_SIZE },
9662 { set_privacy, MGMT_SET_PRIVACY_SIZE },
9663 { load_irks, MGMT_LOAD_IRKS_SIZE,
9664 HCI_MGMT_VAR_LEN },
9665 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
9666 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
9667 { add_device, MGMT_ADD_DEVICE_SIZE },
9668 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
9669 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
9670 HCI_MGMT_VAR_LEN },
9671 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9672 HCI_MGMT_NO_HDEV |
9673 HCI_MGMT_UNTRUSTED },
9674 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
9675 HCI_MGMT_UNCONFIGURED |
9676 HCI_MGMT_UNTRUSTED },
9677 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
9678 HCI_MGMT_UNCONFIGURED },
9679 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
9680 HCI_MGMT_UNCONFIGURED },
9681 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9682 HCI_MGMT_VAR_LEN },
9683 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9684 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
9685 HCI_MGMT_NO_HDEV |
9686 HCI_MGMT_UNTRUSTED },
9687 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
9688 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
9689 HCI_MGMT_VAR_LEN },
9690 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
9691 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
9692 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9693 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9694 HCI_MGMT_UNTRUSTED },
9695 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
9696 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
9697 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
9698 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9699 HCI_MGMT_VAR_LEN },
9700 { set_wideband_speech, MGMT_SETTING_SIZE },
9701 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE,
9702 HCI_MGMT_UNTRUSTED },
9703 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE,
9704 HCI_MGMT_UNTRUSTED |
9705 HCI_MGMT_HDEV_OPTIONAL },
9706 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE,
9707 HCI_MGMT_VAR_LEN |
9708 HCI_MGMT_HDEV_OPTIONAL },
9709 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9710 HCI_MGMT_UNTRUSTED },
9711 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9712 HCI_MGMT_VAR_LEN },
9713 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9714 HCI_MGMT_UNTRUSTED },
9715 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9716 HCI_MGMT_VAR_LEN },
9717 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE },
9718 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE },
9719 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9720 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9721 HCI_MGMT_VAR_LEN },
9722 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE },
9723 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9724 HCI_MGMT_VAR_LEN },
9725 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE,
9726 HCI_MGMT_VAR_LEN },
9727 { add_adv_patterns_monitor_rssi,
9728 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9729 HCI_MGMT_VAR_LEN },
9730 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE,
9731 HCI_MGMT_VAR_LEN },
9732 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE },
9733 { mesh_send, MGMT_MESH_SEND_SIZE,
9734 HCI_MGMT_VAR_LEN },
9735 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE },
9736 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN },
9737 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE,
9738 HCI_MGMT_VAR_LEN },
9739 };
9740
mgmt_index_added(struct hci_dev * hdev)9741 void mgmt_index_added(struct hci_dev *hdev)
9742 {
9743 struct mgmt_ev_ext_index ev;
9744
9745 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE))
9746 return;
9747
9748 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9749 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0,
9750 HCI_MGMT_UNCONF_INDEX_EVENTS);
9751 ev.type = 0x01;
9752 } else {
9753 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9754 HCI_MGMT_INDEX_EVENTS);
9755 ev.type = 0x00;
9756 }
9757
9758 ev.bus = hdev->bus;
9759
9760 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9761 HCI_MGMT_EXT_INDEX_EVENTS);
9762 }
9763
mgmt_index_removed(struct hci_dev * hdev)9764 void mgmt_index_removed(struct hci_dev *hdev)
9765 {
9766 struct mgmt_ev_ext_index ev;
9767 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX };
9768
9769 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE))
9770 return;
9771
9772 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);
9773
9774 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9775 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
9776 HCI_MGMT_UNCONF_INDEX_EVENTS);
9777 ev.type = 0x01;
9778 } else {
9779 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9780 HCI_MGMT_INDEX_EVENTS);
9781 ev.type = 0x00;
9782 }
9783
9784 ev.bus = hdev->bus;
9785
9786 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9787 HCI_MGMT_EXT_INDEX_EVENTS);
9788
9789 /* Cancel any remaining timed work */
9790 if (!hci_dev_test_flag(hdev, HCI_MGMT))
9791 return;
9792 cancel_delayed_work_sync(&hdev->discov_off);
9793 cancel_delayed_work_sync(&hdev->service_cache);
9794 cancel_delayed_work_sync(&hdev->rpa_expired);
9795 cancel_delayed_work_sync(&hdev->mesh_send_done);
9796 }
9797
mgmt_power_on(struct hci_dev * hdev,int err)9798 void mgmt_power_on(struct hci_dev *hdev, int err)
9799 {
9800 struct cmd_lookup match = { NULL, hdev };
9801
9802 bt_dev_dbg(hdev, "err %d", err);
9803
9804 hci_dev_lock(hdev);
9805
9806 if (!err) {
9807 restart_le_actions(hdev);
9808 hci_update_passive_scan(hdev);
9809 }
9810
9811 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,
9812 &match);
9813
9814 new_settings(hdev, match.sk);
9815
9816 if (match.sk)
9817 sock_put(match.sk);
9818
9819 hci_dev_unlock(hdev);
9820 }
9821
__mgmt_power_off(struct hci_dev * hdev)9822 void __mgmt_power_off(struct hci_dev *hdev)
9823 {
9824 struct cmd_lookup match = { NULL, hdev };
9825 u8 zero_cod[] = { 0, 0, 0 };
9826
9827 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,
9828 &match);
9829
9830 /* If the power off is because of hdev unregistration let
9831 * use the appropriate INVALID_INDEX status. Otherwise use
9832 * NOT_POWERED. We cover both scenarios here since later in
9833 * mgmt_index_removed() any hci_conn callbacks will have already
9834 * been triggered, potentially causing misleading DISCONNECTED
9835 * status responses.
9836 */
9837 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9838 match.mgmt_status = MGMT_STATUS_INVALID_INDEX;
9839 else
9840 match.mgmt_status = MGMT_STATUS_NOT_POWERED;
9841
9842 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);
9843
9844 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9845 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9846 zero_cod, sizeof(zero_cod),
9847 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9848 ext_info_changed(hdev, NULL);
9849 }
9850
9851 new_settings(hdev, match.sk);
9852
9853 if (match.sk)
9854 sock_put(match.sk);
9855 }
9856
mgmt_set_powered_failed(struct hci_dev * hdev,int err)9857 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9858 {
9859 struct mgmt_pending_cmd *cmd;
9860 u8 status;
9861
9862 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9863 if (!cmd)
9864 return;
9865
9866 if (err == -ERFKILL)
9867 status = MGMT_STATUS_RFKILLED;
9868 else
9869 status = MGMT_STATUS_FAILED;
9870
9871 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9872
9873 mgmt_pending_remove(cmd);
9874 }
9875
mgmt_new_link_key(struct hci_dev * hdev,struct link_key * key,bool persistent)9876 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9877 bool persistent)
9878 {
9879 struct mgmt_ev_new_link_key ev;
9880
9881 memset(&ev, 0, sizeof(ev));
9882
9883 ev.store_hint = persistent;
9884 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9885 ev.key.addr.type = BDADDR_BREDR;
9886 ev.key.type = key->type;
9887 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9888 ev.key.pin_len = key->pin_len;
9889
9890 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9891 }
9892
mgmt_ltk_type(struct smp_ltk * ltk)9893 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9894 {
9895 switch (ltk->type) {
9896 case SMP_LTK:
9897 case SMP_LTK_RESPONDER:
9898 if (ltk->authenticated)
9899 return MGMT_LTK_AUTHENTICATED;
9900 return MGMT_LTK_UNAUTHENTICATED;
9901 case SMP_LTK_P256:
9902 if (ltk->authenticated)
9903 return MGMT_LTK_P256_AUTH;
9904 return MGMT_LTK_P256_UNAUTH;
9905 case SMP_LTK_P256_DEBUG:
9906 return MGMT_LTK_P256_DEBUG;
9907 }
9908
9909 return MGMT_LTK_UNAUTHENTICATED;
9910 }
9911
mgmt_new_ltk(struct hci_dev * hdev,struct smp_ltk * key,bool persistent)9912 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9913 {
9914 struct mgmt_ev_new_long_term_key ev;
9915
9916 memset(&ev, 0, sizeof(ev));
9917
9918 /* Devices using resolvable or non-resolvable random addresses
9919 * without providing an identity resolving key don't require
9920 * to store long term keys. Their addresses will change the
9921 * next time around.
9922 *
9923 * Only when a remote device provides an identity address
9924 * make sure the long term key is stored. If the remote
9925 * identity is known, the long term keys are internally
9926 * mapped to the identity address. So allow static random
9927 * and public addresses here.
9928 */
9929 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9930 (key->bdaddr.b[5] & 0xc0) != 0xc0)
9931 ev.store_hint = 0x00;
9932 else
9933 ev.store_hint = persistent;
9934
9935 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9936 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9937 ev.key.type = mgmt_ltk_type(key);
9938 ev.key.enc_size = key->enc_size;
9939 ev.key.ediv = key->ediv;
9940 ev.key.rand = key->rand;
9941
9942 if (key->type == SMP_LTK)
9943 ev.key.initiator = 1;
9944
9945 /* Make sure we copy only the significant bytes based on the
9946 * encryption key size, and set the rest of the value to zeroes.
9947 */
9948 memcpy(ev.key.val, key->val, key->enc_size);
9949 memset(ev.key.val + key->enc_size, 0,
9950 sizeof(ev.key.val) - key->enc_size);
9951
9952 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9953 }
9954
mgmt_new_irk(struct hci_dev * hdev,struct smp_irk * irk,bool persistent)9955 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9956 {
9957 struct mgmt_ev_new_irk ev;
9958
9959 memset(&ev, 0, sizeof(ev));
9960
9961 ev.store_hint = persistent;
9962
9963 bacpy(&ev.rpa, &irk->rpa);
9964 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9965 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9966 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9967
9968 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9969 }
9970
mgmt_new_csrk(struct hci_dev * hdev,struct smp_csrk * csrk,bool persistent)9971 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9972 bool persistent)
9973 {
9974 struct mgmt_ev_new_csrk ev;
9975
9976 memset(&ev, 0, sizeof(ev));
9977
9978 /* Devices using resolvable or non-resolvable random addresses
9979 * without providing an identity resolving key don't require
9980 * to store signature resolving keys. Their addresses will change
9981 * the next time around.
9982 *
9983 * Only when a remote device provides an identity address
9984 * make sure the signature resolving key is stored. So allow
9985 * static random and public addresses here.
9986 */
9987 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9988 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9989 ev.store_hint = 0x00;
9990 else
9991 ev.store_hint = persistent;
9992
9993 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9994 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9995 ev.key.type = csrk->type;
9996 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9997
9998 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9999 }
10000
mgmt_new_conn_param(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 store_hint,u16 min_interval,u16 max_interval,u16 latency,u16 timeout)10001 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
10002 u8 bdaddr_type, u8 store_hint, u16 min_interval,
10003 u16 max_interval, u16 latency, u16 timeout)
10004 {
10005 struct mgmt_ev_new_conn_param ev;
10006
10007 if (!hci_is_identity_address(bdaddr, bdaddr_type))
10008 return;
10009
10010 memset(&ev, 0, sizeof(ev));
10011 bacpy(&ev.addr.bdaddr, bdaddr);
10012 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10013 ev.store_hint = store_hint;
10014 ev.min_interval = cpu_to_le16(min_interval);
10015 ev.max_interval = cpu_to_le16(max_interval);
10016 ev.latency = cpu_to_le16(latency);
10017 ev.timeout = cpu_to_le16(timeout);
10018
10019 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10020 }
10021
mgmt_device_connected(struct hci_dev * hdev,struct hci_conn * conn,u8 * name,u8 name_len)10022 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10023 u8 *name, u8 name_len)
10024 {
10025 struct sk_buff *skb;
10026 struct mgmt_ev_device_connected *ev;
10027 u16 eir_len = 0;
10028 u32 flags = 0;
10029
10030 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
10031 return;
10032
10033 /* allocate buff for LE or BR/EDR adv */
10034 if (conn->le_adv_data_len > 0)
10035 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10036 sizeof(*ev) + conn->le_adv_data_len);
10037 else
10038 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10039 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
10040 eir_precalc_len(sizeof(conn->dev_class)));
10041
10042 if (!skb)
10043 return;
10044
10045 ev = skb_put(skb, sizeof(*ev));
10046 bacpy(&ev->addr.bdaddr, &conn->dst);
10047 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10048
10049 if (conn->out)
10050 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10051
10052 ev->flags = __cpu_to_le32(flags);
10053
10054 /* We must ensure that the EIR Data fields are ordered and
10055 * unique. Keep it simple for now and avoid the problem by not
10056 * adding any BR/EDR data to the LE adv.
10057 */
10058 if (conn->le_adv_data_len > 0) {
10059 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
10060 eir_len = conn->le_adv_data_len;
10061 } else {
10062 if (name)
10063 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10064
10065 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
10066 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
10067 conn->dev_class, sizeof(conn->dev_class));
10068 }
10069
10070 ev->eir_len = cpu_to_le16(eir_len);
10071
10072 mgmt_event_skb(skb, NULL);
10073 }
10074
unpair_device_rsp(struct mgmt_pending_cmd * cmd,void * data)10075 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10076 {
10077 struct hci_dev *hdev = data;
10078 struct mgmt_cp_unpair_device *cp = cmd->param;
10079
10080 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10081
10082 cmd->cmd_complete(cmd, 0);
10083 }
10084
mgmt_powering_down(struct hci_dev * hdev)10085 bool mgmt_powering_down(struct hci_dev *hdev)
10086 {
10087 struct mgmt_pending_cmd *cmd;
10088 struct mgmt_mode *cp;
10089
10090 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10091 return true;
10092
10093 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10094 if (!cmd)
10095 return false;
10096
10097 cp = cmd->param;
10098 if (!cp->val)
10099 return true;
10100
10101 return false;
10102 }
10103
hci_to_mgmt_reason(u8 err)10104 u8 hci_to_mgmt_reason(u8 err)
10105 {
10106 switch (err) {
10107 case HCI_ERROR_CONNECTION_TIMEOUT:
10108 return MGMT_DEV_DISCONN_TIMEOUT;
10109 case HCI_ERROR_REMOTE_USER_TERM:
10110 case HCI_ERROR_REMOTE_LOW_RESOURCES:
10111 case HCI_ERROR_REMOTE_POWER_OFF:
10112 return MGMT_DEV_DISCONN_REMOTE;
10113 case HCI_ERROR_LOCAL_HOST_TERM:
10114 return MGMT_DEV_DISCONN_LOCAL_HOST;
10115 default:
10116 return MGMT_DEV_DISCONN_UNKNOWN;
10117 }
10118 }
10119
mgmt_device_disconnected(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 reason,bool mgmt_connected)10120 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10121 u8 link_type, u8 addr_type, u8 reason,
10122 bool mgmt_connected)
10123 {
10124 struct mgmt_ev_device_disconnected ev;
10125 struct sock *sk = NULL;
10126
10127 if (!mgmt_connected)
10128 return;
10129
10130 if (link_type != ACL_LINK &&
10131 link_type != LE_LINK &&
10132 link_type != BIS_LINK)
10133 return;
10134
10135 bacpy(&ev.addr.bdaddr, bdaddr);
10136 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10137 ev.reason = reason;
10138
10139 /* Report disconnects due to suspend */
10140 if (hdev->suspended)
10141 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10142
10143 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10144
10145 if (sk)
10146 sock_put(sk);
10147 }
10148
mgmt_disconnect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10149 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10150 u8 link_type, u8 addr_type, u8 status)
10151 {
10152 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10153 struct mgmt_cp_disconnect *cp;
10154 struct mgmt_pending_cmd *cmd;
10155
10156 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true,
10157 unpair_device_rsp, hdev);
10158
10159 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10160 if (!cmd)
10161 return;
10162
10163 cp = cmd->param;
10164
10165 if (bacmp(bdaddr, &cp->addr.bdaddr))
10166 return;
10167
10168 if (cp->addr.type != bdaddr_type)
10169 return;
10170
10171 cmd->cmd_complete(cmd, mgmt_status(status));
10172 mgmt_pending_remove(cmd);
10173 }
10174
mgmt_connect_failed(struct hci_dev * hdev,struct hci_conn * conn,u8 status)10175 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status)
10176 {
10177 struct mgmt_ev_connect_failed ev;
10178
10179 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
10180 mgmt_device_disconnected(hdev, &conn->dst, conn->type,
10181 conn->dst_type,
10182 hci_to_mgmt_reason(status), true);
10183 return;
10184 }
10185
10186 bacpy(&ev.addr.bdaddr, &conn->dst);
10187 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10188 ev.status = mgmt_status(status);
10189
10190 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10191 }
10192
mgmt_pin_code_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 secure)10193 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10194 {
10195 struct mgmt_ev_pin_code_request ev;
10196
10197 bacpy(&ev.addr.bdaddr, bdaddr);
10198 ev.addr.type = BDADDR_BREDR;
10199 ev.secure = secure;
10200
10201 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10202 }
10203
mgmt_pin_code_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)10204 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10205 u8 status)
10206 {
10207 struct mgmt_pending_cmd *cmd;
10208
10209 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10210 if (!cmd)
10211 return;
10212
10213 cmd->cmd_complete(cmd, mgmt_status(status));
10214 mgmt_pending_remove(cmd);
10215 }
10216
mgmt_pin_code_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)10217 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10218 u8 status)
10219 {
10220 struct mgmt_pending_cmd *cmd;
10221
10222 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10223 if (!cmd)
10224 return;
10225
10226 cmd->cmd_complete(cmd, mgmt_status(status));
10227 mgmt_pending_remove(cmd);
10228 }
10229
mgmt_user_confirm_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 value,u8 confirm_hint)10230 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10231 u8 link_type, u8 addr_type, u32 value,
10232 u8 confirm_hint)
10233 {
10234 struct mgmt_ev_user_confirm_request ev;
10235
10236 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10237
10238 bacpy(&ev.addr.bdaddr, bdaddr);
10239 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10240 ev.confirm_hint = confirm_hint;
10241 ev.value = cpu_to_le32(value);
10242
10243 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10244 NULL);
10245 }
10246
mgmt_user_passkey_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type)10247 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10248 u8 link_type, u8 addr_type)
10249 {
10250 struct mgmt_ev_user_passkey_request ev;
10251
10252 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10253
10254 bacpy(&ev.addr.bdaddr, bdaddr);
10255 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10256
10257 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10258 NULL);
10259 }
10260
user_pairing_resp_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status,u8 opcode)10261 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10262 u8 link_type, u8 addr_type, u8 status,
10263 u8 opcode)
10264 {
10265 struct mgmt_pending_cmd *cmd;
10266
10267 cmd = pending_find(opcode, hdev);
10268 if (!cmd)
10269 return -ENOENT;
10270
10271 cmd->cmd_complete(cmd, mgmt_status(status));
10272 mgmt_pending_remove(cmd);
10273
10274 return 0;
10275 }
10276
mgmt_user_confirm_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10277 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10278 u8 link_type, u8 addr_type, u8 status)
10279 {
10280 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10281 status, MGMT_OP_USER_CONFIRM_REPLY);
10282 }
10283
mgmt_user_confirm_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10284 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10285 u8 link_type, u8 addr_type, u8 status)
10286 {
10287 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10288 status,
10289 MGMT_OP_USER_CONFIRM_NEG_REPLY);
10290 }
10291
mgmt_user_passkey_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10292 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10293 u8 link_type, u8 addr_type, u8 status)
10294 {
10295 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10296 status, MGMT_OP_USER_PASSKEY_REPLY);
10297 }
10298
mgmt_user_passkey_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10299 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10300 u8 link_type, u8 addr_type, u8 status)
10301 {
10302 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10303 status,
10304 MGMT_OP_USER_PASSKEY_NEG_REPLY);
10305 }
10306
mgmt_user_passkey_notify(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 passkey,u8 entered)10307 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10308 u8 link_type, u8 addr_type, u32 passkey,
10309 u8 entered)
10310 {
10311 struct mgmt_ev_passkey_notify ev;
10312
10313 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10314
10315 bacpy(&ev.addr.bdaddr, bdaddr);
10316 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10317 ev.passkey = __cpu_to_le32(passkey);
10318 ev.entered = entered;
10319
10320 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10321 }
10322
mgmt_auth_failed(struct hci_conn * conn,u8 hci_status)10323 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10324 {
10325 struct mgmt_ev_auth_failed ev;
10326 struct mgmt_pending_cmd *cmd;
10327 u8 status = mgmt_status(hci_status);
10328
10329 bacpy(&ev.addr.bdaddr, &conn->dst);
10330 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10331 ev.status = status;
10332
10333 cmd = remove_pairing(conn);
10334
10335 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10336 cmd ? cmd->sk : NULL);
10337
10338 if (cmd) {
10339 cmd->cmd_complete(cmd, status);
10340 mgmt_pending_free(cmd);
10341 }
10342 }
10343
mgmt_auth_enable_complete(struct hci_dev * hdev,u8 status)10344 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10345 {
10346 struct cmd_lookup match = { NULL, hdev };
10347 bool changed;
10348
10349 if (status) {
10350 u8 mgmt_err = mgmt_status(status);
10351 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,
10352 cmd_status_rsp, &mgmt_err);
10353 return;
10354 }
10355
10356 if (test_bit(HCI_AUTH, &hdev->flags))
10357 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10358 else
10359 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10360
10361 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,
10362 settings_rsp, &match);
10363
10364 if (changed)
10365 new_settings(hdev, match.sk);
10366
10367 if (match.sk)
10368 sock_put(match.sk);
10369 }
10370
sk_lookup(struct mgmt_pending_cmd * cmd,void * data)10371 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10372 {
10373 struct cmd_lookup *match = data;
10374
10375 if (match->sk == NULL) {
10376 match->sk = cmd->sk;
10377 sock_hold(match->sk);
10378 }
10379 }
10380
mgmt_set_class_of_dev_complete(struct hci_dev * hdev,u8 * dev_class,u8 status)10381 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10382 u8 status)
10383 {
10384 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10385
10386 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup,
10387 &match);
10388 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup,
10389 &match);
10390 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup,
10391 &match);
10392
10393 if (!status) {
10394 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10395 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10396 ext_info_changed(hdev, NULL);
10397 }
10398
10399 if (match.sk)
10400 sock_put(match.sk);
10401 }
10402
mgmt_set_local_name_complete(struct hci_dev * hdev,u8 * name,u8 status)10403 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10404 {
10405 struct mgmt_cp_set_local_name ev;
10406 struct mgmt_pending_cmd *cmd;
10407
10408 if (status)
10409 return;
10410
10411 memset(&ev, 0, sizeof(ev));
10412 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10413 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10414
10415 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10416 if (!cmd) {
10417 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10418
10419 /* If this is a HCI command related to powering on the
10420 * HCI dev don't send any mgmt signals.
10421 */
10422 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10423 return;
10424
10425 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10426 return;
10427 }
10428
10429 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10430 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10431 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10432 }
10433
has_uuid(u8 * uuid,u16 uuid_count,u8 (* uuids)[16])10434 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10435 {
10436 int i;
10437
10438 for (i = 0; i < uuid_count; i++) {
10439 if (!memcmp(uuid, uuids[i], 16))
10440 return true;
10441 }
10442
10443 return false;
10444 }
10445
eir_has_uuids(u8 * eir,u16 eir_len,u16 uuid_count,u8 (* uuids)[16])10446 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10447 {
10448 u16 parsed = 0;
10449
10450 while (parsed < eir_len) {
10451 u8 field_len = eir[0];
10452 u8 uuid[16];
10453 int i;
10454
10455 if (field_len == 0)
10456 break;
10457
10458 if (eir_len - parsed < field_len + 1)
10459 break;
10460
10461 switch (eir[1]) {
10462 case EIR_UUID16_ALL:
10463 case EIR_UUID16_SOME:
10464 for (i = 0; i + 3 <= field_len; i += 2) {
10465 memcpy(uuid, bluetooth_base_uuid, 16);
10466 uuid[13] = eir[i + 3];
10467 uuid[12] = eir[i + 2];
10468 if (has_uuid(uuid, uuid_count, uuids))
10469 return true;
10470 }
10471 break;
10472 case EIR_UUID32_ALL:
10473 case EIR_UUID32_SOME:
10474 for (i = 0; i + 5 <= field_len; i += 4) {
10475 memcpy(uuid, bluetooth_base_uuid, 16);
10476 uuid[15] = eir[i + 5];
10477 uuid[14] = eir[i + 4];
10478 uuid[13] = eir[i + 3];
10479 uuid[12] = eir[i + 2];
10480 if (has_uuid(uuid, uuid_count, uuids))
10481 return true;
10482 }
10483 break;
10484 case EIR_UUID128_ALL:
10485 case EIR_UUID128_SOME:
10486 for (i = 0; i + 17 <= field_len; i += 16) {
10487 memcpy(uuid, eir + i + 2, 16);
10488 if (has_uuid(uuid, uuid_count, uuids))
10489 return true;
10490 }
10491 break;
10492 }
10493
10494 parsed += field_len + 1;
10495 eir += field_len + 1;
10496 }
10497
10498 return false;
10499 }
10500
is_filter_match(struct hci_dev * hdev,s8 rssi,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)10501 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10502 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10503 {
10504 /* If a RSSI threshold has been specified, and
10505 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10506 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10507 * is set, let it through for further processing, as we might need to
10508 * restart the scan.
10509 *
10510 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10511 * the results are also dropped.
10512 */
10513 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10514 (rssi == HCI_RSSI_INVALID ||
10515 (rssi < hdev->discovery.rssi &&
10516 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER))))
10517 return false;
10518
10519 spin_lock(&hdev->discovery.lock);
10520 if (hdev->discovery.uuid_count != 0) {
10521 /* If a list of UUIDs is provided in filter, results with no
10522 * matching UUID should be dropped.
10523 */
10524 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10525 hdev->discovery.uuids) &&
10526 !eir_has_uuids(scan_rsp, scan_rsp_len,
10527 hdev->discovery.uuid_count,
10528 hdev->discovery.uuids)) {
10529 spin_unlock(&hdev->discovery.lock);
10530 return false;
10531 }
10532 }
10533 spin_unlock(&hdev->discovery.lock);
10534
10535 /* If duplicate filtering does not report RSSI changes, then restart
10536 * scanning to ensure updated result with updated RSSI values.
10537 */
10538 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) {
10539 /* Validate RSSI value against the RSSI threshold once more. */
10540 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10541 rssi < hdev->discovery.rssi)
10542 return false;
10543 }
10544
10545 return true;
10546 }
10547
mgmt_adv_monitor_device_lost(struct hci_dev * hdev,u16 handle,bdaddr_t * bdaddr,u8 addr_type)10548 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10549 bdaddr_t *bdaddr, u8 addr_type)
10550 {
10551 struct mgmt_ev_adv_monitor_device_lost ev;
10552
10553 ev.monitor_handle = cpu_to_le16(handle);
10554 bacpy(&ev.addr.bdaddr, bdaddr);
10555 ev.addr.type = addr_type;
10556
10557 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10558 NULL);
10559 }
10560
mgmt_send_adv_monitor_device_found(struct hci_dev * hdev,struct sk_buff * skb,struct sock * skip_sk,u16 handle)10561 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10562 struct sk_buff *skb,
10563 struct sock *skip_sk,
10564 u16 handle)
10565 {
10566 struct sk_buff *advmon_skb;
10567 size_t advmon_skb_len;
10568 __le16 *monitor_handle;
10569
10570 if (!skb)
10571 return;
10572
10573 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10574 sizeof(struct mgmt_ev_device_found)) + skb->len;
10575 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10576 advmon_skb_len);
10577 if (!advmon_skb)
10578 return;
10579
10580 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10581 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10582 * store monitor_handle of the matched monitor.
10583 */
10584 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10585 *monitor_handle = cpu_to_le16(handle);
10586 skb_put_data(advmon_skb, skb->data, skb->len);
10587
10588 mgmt_event_skb(advmon_skb, skip_sk);
10589 }
10590
mgmt_adv_monitor_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,bool report_device,struct sk_buff * skb,struct sock * skip_sk)10591 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10592 bdaddr_t *bdaddr, bool report_device,
10593 struct sk_buff *skb,
10594 struct sock *skip_sk)
10595 {
10596 struct monitored_device *dev, *tmp;
10597 bool matched = false;
10598 bool notified = false;
10599
10600 /* We have received the Advertisement Report because:
10601 * 1. the kernel has initiated active discovery
10602 * 2. if not, we have pend_le_reports > 0 in which case we are doing
10603 * passive scanning
10604 * 3. if none of the above is true, we have one or more active
10605 * Advertisement Monitor
10606 *
10607 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10608 * and report ONLY one advertisement per device for the matched Monitor
10609 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10610 *
10611 * For case 3, since we are not active scanning and all advertisements
10612 * received are due to a matched Advertisement Monitor, report all
10613 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10614 */
10615 if (report_device && !hdev->advmon_pend_notify) {
10616 mgmt_event_skb(skb, skip_sk);
10617 return;
10618 }
10619
10620 hdev->advmon_pend_notify = false;
10621
10622 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10623 if (!bacmp(&dev->bdaddr, bdaddr)) {
10624 matched = true;
10625
10626 if (!dev->notified) {
10627 mgmt_send_adv_monitor_device_found(hdev, skb,
10628 skip_sk,
10629 dev->handle);
10630 notified = true;
10631 dev->notified = true;
10632 }
10633 }
10634
10635 if (!dev->notified)
10636 hdev->advmon_pend_notify = true;
10637 }
10638
10639 if (!report_device &&
10640 ((matched && !notified) || !msft_monitor_supported(hdev))) {
10641 /* Handle 0 indicates that we are not active scanning and this
10642 * is a subsequent advertisement report for an already matched
10643 * Advertisement Monitor or the controller offloading support
10644 * is not available.
10645 */
10646 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10647 }
10648
10649 if (report_device)
10650 mgmt_event_skb(skb, skip_sk);
10651 else
10652 kfree_skb(skb);
10653 }
10654
mesh_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len,u64 instant)10655 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10656 u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10657 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10658 u64 instant)
10659 {
10660 struct sk_buff *skb;
10661 struct mgmt_ev_mesh_device_found *ev;
10662 int i, j;
10663
10664 if (!hdev->mesh_ad_types[0])
10665 goto accepted;
10666
10667 /* Scan for requested AD types */
10668 if (eir_len > 0) {
10669 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10670 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10671 if (!hdev->mesh_ad_types[j])
10672 break;
10673
10674 if (hdev->mesh_ad_types[j] == eir[i + 1])
10675 goto accepted;
10676 }
10677 }
10678 }
10679
10680 if (scan_rsp_len > 0) {
10681 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10682 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10683 if (!hdev->mesh_ad_types[j])
10684 break;
10685
10686 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10687 goto accepted;
10688 }
10689 }
10690 }
10691
10692 return;
10693
10694 accepted:
10695 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10696 sizeof(*ev) + eir_len + scan_rsp_len);
10697 if (!skb)
10698 return;
10699
10700 ev = skb_put(skb, sizeof(*ev));
10701
10702 bacpy(&ev->addr.bdaddr, bdaddr);
10703 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10704 ev->rssi = rssi;
10705 ev->flags = cpu_to_le32(flags);
10706 ev->instant = cpu_to_le64(instant);
10707
10708 if (eir_len > 0)
10709 /* Copy EIR or advertising data into event */
10710 skb_put_data(skb, eir, eir_len);
10711
10712 if (scan_rsp_len > 0)
10713 /* Append scan response data to event */
10714 skb_put_data(skb, scan_rsp, scan_rsp_len);
10715
10716 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10717
10718 mgmt_event_skb(skb, NULL);
10719 }
10720
mgmt_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 * dev_class,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len,u64 instant)10721 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10722 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10723 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10724 u64 instant)
10725 {
10726 struct sk_buff *skb;
10727 struct mgmt_ev_device_found *ev;
10728 bool report_device = hci_discovery_active(hdev);
10729
10730 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10731 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10732 eir, eir_len, scan_rsp, scan_rsp_len,
10733 instant);
10734
10735 /* Don't send events for a non-kernel initiated discovery. With
10736 * LE one exception is if we have pend_le_reports > 0 in which
10737 * case we're doing passive scanning and want these events.
10738 */
10739 if (!hci_discovery_active(hdev)) {
10740 if (link_type == ACL_LINK)
10741 return;
10742 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10743 report_device = true;
10744 else if (!hci_is_adv_monitoring(hdev))
10745 return;
10746 }
10747
10748 if (hdev->discovery.result_filtering) {
10749 /* We are using service discovery */
10750 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10751 scan_rsp_len))
10752 return;
10753 }
10754
10755 if (hdev->discovery.limited) {
10756 /* Check for limited discoverable bit */
10757 if (dev_class) {
10758 if (!(dev_class[1] & 0x20))
10759 return;
10760 } else {
10761 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10762 if (!flags || !(flags[0] & LE_AD_LIMITED))
10763 return;
10764 }
10765 }
10766
10767 /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10768 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10769 sizeof(*ev) + eir_len + scan_rsp_len + 5);
10770 if (!skb)
10771 return;
10772
10773 ev = skb_put(skb, sizeof(*ev));
10774
10775 /* In case of device discovery with BR/EDR devices (pre 1.2), the
10776 * RSSI value was reported as 0 when not available. This behavior
10777 * is kept when using device discovery. This is required for full
10778 * backwards compatibility with the API.
10779 *
10780 * However when using service discovery, the value 127 will be
10781 * returned when the RSSI is not available.
10782 */
10783 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10784 link_type == ACL_LINK)
10785 rssi = 0;
10786
10787 bacpy(&ev->addr.bdaddr, bdaddr);
10788 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10789 ev->rssi = rssi;
10790 ev->flags = cpu_to_le32(flags);
10791
10792 if (eir_len > 0)
10793 /* Copy EIR or advertising data into event */
10794 skb_put_data(skb, eir, eir_len);
10795
10796 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10797 u8 eir_cod[5];
10798
10799 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10800 dev_class, 3);
10801 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10802 }
10803
10804 if (scan_rsp_len > 0)
10805 /* Append scan response data to event */
10806 skb_put_data(skb, scan_rsp, scan_rsp_len);
10807
10808 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10809
10810 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10811 }
10812
mgmt_remote_name(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,s8 rssi,u8 * name,u8 name_len)10813 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10814 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10815 {
10816 struct sk_buff *skb;
10817 struct mgmt_ev_device_found *ev;
10818 u16 eir_len = 0;
10819 u32 flags = 0;
10820
10821 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10822 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10823 if (!skb)
10824 return;
10825
10826 ev = skb_put(skb, sizeof(*ev));
10827 bacpy(&ev->addr.bdaddr, bdaddr);
10828 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10829 ev->rssi = rssi;
10830
10831 if (name)
10832 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10833 else
10834 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10835
10836 ev->eir_len = cpu_to_le16(eir_len);
10837 ev->flags = cpu_to_le32(flags);
10838
10839 mgmt_event_skb(skb, NULL);
10840 }
10841
mgmt_discovering(struct hci_dev * hdev,u8 discovering)10842 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10843 {
10844 struct mgmt_ev_discovering ev;
10845
10846 bt_dev_dbg(hdev, "discovering %u", discovering);
10847
10848 memset(&ev, 0, sizeof(ev));
10849 ev.type = hdev->discovery.type;
10850 ev.discovering = discovering;
10851
10852 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10853 }
10854
mgmt_suspending(struct hci_dev * hdev,u8 state)10855 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10856 {
10857 struct mgmt_ev_controller_suspend ev;
10858
10859 ev.suspend_state = state;
10860 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10861 }
10862
mgmt_resuming(struct hci_dev * hdev,u8 reason,bdaddr_t * bdaddr,u8 addr_type)10863 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10864 u8 addr_type)
10865 {
10866 struct mgmt_ev_controller_resume ev;
10867
10868 ev.wake_reason = reason;
10869 if (bdaddr) {
10870 bacpy(&ev.addr.bdaddr, bdaddr);
10871 ev.addr.type = addr_type;
10872 } else {
10873 memset(&ev.addr, 0, sizeof(ev.addr));
10874 }
10875
10876 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10877 }
10878
10879 static struct hci_mgmt_chan chan = {
10880 .channel = HCI_CHANNEL_CONTROL,
10881 .handler_count = ARRAY_SIZE(mgmt_handlers),
10882 .handlers = mgmt_handlers,
10883 .hdev_init = mgmt_init_hdev,
10884 };
10885
mgmt_init(void)10886 int mgmt_init(void)
10887 {
10888 return hci_mgmt_chan_register(&chan);
10889 }
10890
mgmt_conn_subrate_notify(struct hci_dev * hdev,struct hci_conn * conn,u8 status)10891 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn,
10892 u8 status)
10893 {
10894 struct mgmt_ev_conn_subrate ev;
10895
10896 bacpy(&ev.addr.bdaddr, &conn->dst);
10897 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10898 ev.status = mgmt_status(status);
10899 ev.interval = cpu_to_le16(conn->le_rate_interval);
10900 ev.subrate = cpu_to_le16(conn->le_subrate);
10901 ev.latency = cpu_to_le16(conn->le_rate_latency);
10902 ev.cont_num = cpu_to_le16(conn->le_cont_num);
10903 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout);
10904
10905 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL);
10906 }
10907
mgmt_exit(void)10908 void mgmt_exit(void)
10909 {
10910 hci_mgmt_chan_unregister(&chan);
10911 }
10912
mgmt_cleanup(struct sock * sk)10913 void mgmt_cleanup(struct sock *sk)
10914 {
10915 struct mgmt_mesh_tx *mesh_tx;
10916 struct hci_dev *hdev;
10917
10918 read_lock(&hci_dev_list_lock);
10919
10920 list_for_each_entry(hdev, &hci_dev_list, list) {
10921 do {
10922 mesh_tx = mgmt_mesh_next(hdev, sk);
10923
10924 if (mesh_tx)
10925 mesh_send_complete(hdev, mesh_tx, true);
10926 } while (mesh_tx);
10927 }
10928
10929 read_unlock(&hci_dev_list_lock);
10930 }
10931