1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4
5 Copyright (C) 2010 Nokia Corporation
6 Copyright (C) 2011-2012 Intel Corporation
7
8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19 SOFTWARE IS DISCLAIMED.
20 */
21
22 /* Bluetooth HCI Management interface */
23
24 #include <linux/module.h>
25 #include <linux/unaligned.h>
26
27 #include <net/bluetooth/bluetooth.h>
28 #include <net/bluetooth/hci_core.h>
29 #include <net/bluetooth/hci_sock.h>
30 #include <net/bluetooth/l2cap.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "smp.h"
34 #include "mgmt_util.h"
35 #include "mgmt_config.h"
36 #include "msft.h"
37 #include "eir.h"
38 #include "aosp.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 23
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 MGMT_OP_GET_PHY_CONFIGURATION,
110 MGMT_OP_SET_PHY_CONFIGURATION,
111 MGMT_OP_SET_BLOCKED_KEYS,
112 MGMT_OP_SET_WIDEBAND_SPEECH,
113 MGMT_OP_READ_CONTROLLER_CAP,
114 MGMT_OP_READ_EXP_FEATURES_INFO,
115 MGMT_OP_SET_EXP_FEATURE,
116 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
117 MGMT_OP_SET_DEF_SYSTEM_CONFIG,
118 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
119 MGMT_OP_SET_DEF_RUNTIME_CONFIG,
120 MGMT_OP_GET_DEVICE_FLAGS,
121 MGMT_OP_SET_DEVICE_FLAGS,
122 MGMT_OP_READ_ADV_MONITOR_FEATURES,
123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
124 MGMT_OP_REMOVE_ADV_MONITOR,
125 MGMT_OP_ADD_EXT_ADV_PARAMS,
126 MGMT_OP_ADD_EXT_ADV_DATA,
127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
128 MGMT_OP_SET_MESH_RECEIVER,
129 MGMT_OP_MESH_READ_FEATURES,
130 MGMT_OP_MESH_SEND,
131 MGMT_OP_MESH_SEND_CANCEL,
132 MGMT_OP_HCI_CMD_SYNC,
133 };
134
135 static const u16 mgmt_events[] = {
136 MGMT_EV_CONTROLLER_ERROR,
137 MGMT_EV_INDEX_ADDED,
138 MGMT_EV_INDEX_REMOVED,
139 MGMT_EV_NEW_SETTINGS,
140 MGMT_EV_CLASS_OF_DEV_CHANGED,
141 MGMT_EV_LOCAL_NAME_CHANGED,
142 MGMT_EV_NEW_LINK_KEY,
143 MGMT_EV_NEW_LONG_TERM_KEY,
144 MGMT_EV_DEVICE_CONNECTED,
145 MGMT_EV_DEVICE_DISCONNECTED,
146 MGMT_EV_CONNECT_FAILED,
147 MGMT_EV_PIN_CODE_REQUEST,
148 MGMT_EV_USER_CONFIRM_REQUEST,
149 MGMT_EV_USER_PASSKEY_REQUEST,
150 MGMT_EV_AUTH_FAILED,
151 MGMT_EV_DEVICE_FOUND,
152 MGMT_EV_DISCOVERING,
153 MGMT_EV_DEVICE_BLOCKED,
154 MGMT_EV_DEVICE_UNBLOCKED,
155 MGMT_EV_DEVICE_UNPAIRED,
156 MGMT_EV_PASSKEY_NOTIFY,
157 MGMT_EV_NEW_IRK,
158 MGMT_EV_NEW_CSRK,
159 MGMT_EV_DEVICE_ADDED,
160 MGMT_EV_DEVICE_REMOVED,
161 MGMT_EV_NEW_CONN_PARAM,
162 MGMT_EV_UNCONF_INDEX_ADDED,
163 MGMT_EV_UNCONF_INDEX_REMOVED,
164 MGMT_EV_NEW_CONFIG_OPTIONS,
165 MGMT_EV_EXT_INDEX_ADDED,
166 MGMT_EV_EXT_INDEX_REMOVED,
167 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
168 MGMT_EV_ADVERTISING_ADDED,
169 MGMT_EV_ADVERTISING_REMOVED,
170 MGMT_EV_EXT_INFO_CHANGED,
171 MGMT_EV_PHY_CONFIGURATION_CHANGED,
172 MGMT_EV_EXP_FEATURE_CHANGED,
173 MGMT_EV_DEVICE_FLAGS_CHANGED,
174 MGMT_EV_ADV_MONITOR_ADDED,
175 MGMT_EV_ADV_MONITOR_REMOVED,
176 MGMT_EV_CONTROLLER_SUSPEND,
177 MGMT_EV_CONTROLLER_RESUME,
178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
179 MGMT_EV_ADV_MONITOR_DEVICE_LOST,
180 };
181
182 static const u16 mgmt_untrusted_commands[] = {
183 MGMT_OP_READ_INDEX_LIST,
184 MGMT_OP_READ_INFO,
185 MGMT_OP_READ_UNCONF_INDEX_LIST,
186 MGMT_OP_READ_CONFIG_INFO,
187 MGMT_OP_READ_EXT_INDEX_LIST,
188 MGMT_OP_READ_EXT_INFO,
189 MGMT_OP_READ_CONTROLLER_CAP,
190 MGMT_OP_READ_EXP_FEATURES_INFO,
191 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
192 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
193 };
194
195 static const u16 mgmt_untrusted_events[] = {
196 MGMT_EV_INDEX_ADDED,
197 MGMT_EV_INDEX_REMOVED,
198 MGMT_EV_NEW_SETTINGS,
199 MGMT_EV_CLASS_OF_DEV_CHANGED,
200 MGMT_EV_LOCAL_NAME_CHANGED,
201 MGMT_EV_UNCONF_INDEX_ADDED,
202 MGMT_EV_UNCONF_INDEX_REMOVED,
203 MGMT_EV_NEW_CONFIG_OPTIONS,
204 MGMT_EV_EXT_INDEX_ADDED,
205 MGMT_EV_EXT_INDEX_REMOVED,
206 MGMT_EV_EXT_INFO_CHANGED,
207 MGMT_EV_EXP_FEATURE_CHANGED,
208 };
209
210 #define CACHE_TIMEOUT secs_to_jiffies(2)
211
212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
213 "\x00\x00\x00\x00\x00\x00\x00\x00"
214
215 /* HCI to MGMT error code conversion table */
216 static const u8 mgmt_status_table[] = {
217 MGMT_STATUS_SUCCESS,
218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
220 MGMT_STATUS_FAILED, /* Hardware Failure */
221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
229 MGMT_STATUS_BUSY, /* Command Disallowed */
230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
231 MGMT_STATUS_REJECTED, /* Rejected Security */
232 MGMT_STATUS_REJECTED, /* Rejected Personal */
233 MGMT_STATUS_TIMEOUT, /* Host Timeout */
234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
240 MGMT_STATUS_BUSY, /* Repeated Attempts */
241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
248 MGMT_STATUS_FAILED, /* Unspecified Error */
249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
255 MGMT_STATUS_FAILED, /* Unit Link Key Used */
256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
257 MGMT_STATUS_TIMEOUT, /* Instant Passed */
258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
259 MGMT_STATUS_FAILED, /* Transaction Collision */
260 MGMT_STATUS_FAILED, /* Reserved for future use */
261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
262 MGMT_STATUS_REJECTED, /* QoS Rejected */
263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
264 MGMT_STATUS_REJECTED, /* Insufficient Security */
265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
266 MGMT_STATUS_FAILED, /* Reserved for future use */
267 MGMT_STATUS_BUSY, /* Role Switch Pending */
268 MGMT_STATUS_FAILED, /* Reserved for future use */
269 MGMT_STATUS_FAILED, /* Slot Violation */
270 MGMT_STATUS_FAILED, /* Role Switch Failed */
271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
273 MGMT_STATUS_BUSY, /* Host Busy Pairing */
274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
275 MGMT_STATUS_BUSY, /* Controller Busy */
276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
281 };
282
mgmt_errno_status(int err)283 static u8 mgmt_errno_status(int err)
284 {
285 switch (err) {
286 case 0:
287 return MGMT_STATUS_SUCCESS;
288 case -EPERM:
289 return MGMT_STATUS_REJECTED;
290 case -EINVAL:
291 return MGMT_STATUS_INVALID_PARAMS;
292 case -EOPNOTSUPP:
293 return MGMT_STATUS_NOT_SUPPORTED;
294 case -EBUSY:
295 return MGMT_STATUS_BUSY;
296 case -ETIMEDOUT:
297 return MGMT_STATUS_AUTH_FAILED;
298 case -ENOMEM:
299 return MGMT_STATUS_NO_RESOURCES;
300 case -EISCONN:
301 return MGMT_STATUS_ALREADY_CONNECTED;
302 case -ENOTCONN:
303 return MGMT_STATUS_DISCONNECTED;
304 }
305
306 return MGMT_STATUS_FAILED;
307 }
308
mgmt_status(int err)309 static u8 mgmt_status(int err)
310 {
311 if (err < 0)
312 return mgmt_errno_status(err);
313
314 if (err < ARRAY_SIZE(mgmt_status_table))
315 return mgmt_status_table[err];
316
317 return MGMT_STATUS_FAILED;
318 }
319
mgmt_index_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag)320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
321 u16 len, int flag)
322 {
323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
324 flag, NULL);
325 }
326
mgmt_limited_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag,struct sock * skip_sk)327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
328 u16 len, int flag, struct sock *skip_sk)
329 {
330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
331 flag, skip_sk);
332 }
333
mgmt_event(u16 event,struct hci_dev * hdev,void * data,u16 len,struct sock * skip_sk)334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
335 struct sock *skip_sk)
336 {
337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
338 HCI_SOCK_TRUSTED, skip_sk);
339 }
340
mgmt_event_skb(struct sk_buff * skb,struct sock * skip_sk)341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
342 {
343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
344 skip_sk);
345 }
346
le_addr_type(u8 mgmt_addr_type)347 static u8 le_addr_type(u8 mgmt_addr_type)
348 {
349 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
350 return ADDR_LE_DEV_PUBLIC;
351 else
352 return ADDR_LE_DEV_RANDOM;
353 }
354
mgmt_fill_version_info(void * ver)355 void mgmt_fill_version_info(void *ver)
356 {
357 struct mgmt_rp_read_version *rp = ver;
358
359 rp->version = MGMT_VERSION;
360 rp->revision = cpu_to_le16(MGMT_REVISION);
361 }
362
read_version(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
364 u16 data_len)
365 {
366 struct mgmt_rp_read_version rp;
367
368 bt_dev_dbg(hdev, "sock %p", sk);
369
370 mgmt_fill_version_info(&rp);
371
372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
373 &rp, sizeof(rp));
374 }
375
read_commands(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
377 u16 data_len)
378 {
379 struct mgmt_rp_read_commands *rp;
380 u16 num_commands, num_events;
381 size_t rp_size;
382 int i, err;
383
384 bt_dev_dbg(hdev, "sock %p", sk);
385
386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
387 num_commands = ARRAY_SIZE(mgmt_commands);
388 num_events = ARRAY_SIZE(mgmt_events);
389 } else {
390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
391 num_events = ARRAY_SIZE(mgmt_untrusted_events);
392 }
393
394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
395
396 rp = kmalloc(rp_size, GFP_KERNEL);
397 if (!rp)
398 return -ENOMEM;
399
400 rp->num_commands = cpu_to_le16(num_commands);
401 rp->num_events = cpu_to_le16(num_events);
402
403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
404 __le16 *opcode = rp->opcodes;
405
406 for (i = 0; i < num_commands; i++, opcode++)
407 put_unaligned_le16(mgmt_commands[i], opcode);
408
409 for (i = 0; i < num_events; i++, opcode++)
410 put_unaligned_le16(mgmt_events[i], opcode);
411 } else {
412 __le16 *opcode = rp->opcodes;
413
414 for (i = 0; i < num_commands; i++, opcode++)
415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
416
417 for (i = 0; i < num_events; i++, opcode++)
418 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
419 }
420
421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
422 rp, rp_size);
423 kfree(rp);
424
425 return err;
426 }
427
read_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
429 u16 data_len)
430 {
431 struct mgmt_rp_read_index_list *rp;
432 struct hci_dev *d;
433 size_t rp_len;
434 u16 count;
435 int err;
436
437 bt_dev_dbg(hdev, "sock %p", sk);
438
439 read_lock(&hci_dev_list_lock);
440
441 count = 0;
442 list_for_each_entry(d, &hci_dev_list, list) {
443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED))
444 count++;
445 }
446
447 rp_len = sizeof(*rp) + (2 * count);
448 rp = kmalloc(rp_len, GFP_ATOMIC);
449 if (!rp) {
450 read_unlock(&hci_dev_list_lock);
451 return -ENOMEM;
452 }
453
454 count = 0;
455 list_for_each_entry(d, &hci_dev_list, list) {
456 if (hci_dev_test_flag(d, HCI_SETUP) ||
457 hci_dev_test_flag(d, HCI_CONFIG) ||
458 hci_dev_test_flag(d, HCI_USER_CHANNEL))
459 continue;
460
461 /* Devices marked as raw-only are neither configured
462 * nor unconfigured controllers.
463 */
464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
465 continue;
466
467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
468 rp->index[count++] = cpu_to_le16(d->id);
469 bt_dev_dbg(hdev, "Added hci%u", d->id);
470 }
471 }
472
473 rp->num_controllers = cpu_to_le16(count);
474 rp_len = sizeof(*rp) + (2 * count);
475
476 read_unlock(&hci_dev_list_lock);
477
478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
479 0, rp, rp_len);
480
481 kfree(rp);
482
483 return err;
484 }
485
read_unconf_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
487 void *data, u16 data_len)
488 {
489 struct mgmt_rp_read_unconf_index_list *rp;
490 struct hci_dev *d;
491 size_t rp_len;
492 u16 count;
493 int err;
494
495 bt_dev_dbg(hdev, "sock %p", sk);
496
497 read_lock(&hci_dev_list_lock);
498
499 count = 0;
500 list_for_each_entry(d, &hci_dev_list, list) {
501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
502 count++;
503 }
504
505 rp_len = sizeof(*rp) + (2 * count);
506 rp = kmalloc(rp_len, GFP_ATOMIC);
507 if (!rp) {
508 read_unlock(&hci_dev_list_lock);
509 return -ENOMEM;
510 }
511
512 count = 0;
513 list_for_each_entry(d, &hci_dev_list, list) {
514 if (hci_dev_test_flag(d, HCI_SETUP) ||
515 hci_dev_test_flag(d, HCI_CONFIG) ||
516 hci_dev_test_flag(d, HCI_USER_CHANNEL))
517 continue;
518
519 /* Devices marked as raw-only are neither configured
520 * nor unconfigured controllers.
521 */
522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
523 continue;
524
525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
526 rp->index[count++] = cpu_to_le16(d->id);
527 bt_dev_dbg(hdev, "Added hci%u", d->id);
528 }
529 }
530
531 rp->num_controllers = cpu_to_le16(count);
532 rp_len = sizeof(*rp) + (2 * count);
533
534 read_unlock(&hci_dev_list_lock);
535
536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
538
539 kfree(rp);
540
541 return err;
542 }
543
read_ext_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
545 void *data, u16 data_len)
546 {
547 struct mgmt_rp_read_ext_index_list *rp;
548 struct hci_dev *d;
549 u16 count;
550 int err;
551
552 bt_dev_dbg(hdev, "sock %p", sk);
553
554 read_lock(&hci_dev_list_lock);
555
556 count = 0;
557 list_for_each_entry(d, &hci_dev_list, list)
558 count++;
559
560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC);
561 if (!rp) {
562 read_unlock(&hci_dev_list_lock);
563 return -ENOMEM;
564 }
565
566 count = 0;
567 list_for_each_entry(d, &hci_dev_list, list) {
568 if (hci_dev_test_flag(d, HCI_SETUP) ||
569 hci_dev_test_flag(d, HCI_CONFIG) ||
570 hci_dev_test_flag(d, HCI_USER_CHANNEL))
571 continue;
572
573 /* Devices marked as raw-only are neither configured
574 * nor unconfigured controllers.
575 */
576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
577 continue;
578
579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
580 rp->entry[count].type = 0x01;
581 else
582 rp->entry[count].type = 0x00;
583
584 rp->entry[count].bus = d->bus;
585 rp->entry[count++].index = cpu_to_le16(d->id);
586 bt_dev_dbg(hdev, "Added hci%u", d->id);
587 }
588
589 rp->num_controllers = cpu_to_le16(count);
590
591 read_unlock(&hci_dev_list_lock);
592
593 /* If this command is called at least once, then all the
594 * default index and unconfigured index events are disabled
595 * and from now on only extended index events are used.
596 */
597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
600
601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
603 struct_size(rp, entry, count));
604
605 kfree(rp);
606
607 return err;
608 }
609
is_configured(struct hci_dev * hdev)610 static bool is_configured(struct hci_dev *hdev)
611 {
612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) &&
613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
614 return false;
615
616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) ||
617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) &&
618 !bacmp(&hdev->public_addr, BDADDR_ANY))
619 return false;
620
621 return true;
622 }
623
get_missing_options(struct hci_dev * hdev)624 static __le32 get_missing_options(struct hci_dev *hdev)
625 {
626 u32 options = 0;
627
628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) &&
629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
630 options |= MGMT_OPTION_EXTERNAL_CONFIG;
631
632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) ||
633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) &&
634 !bacmp(&hdev->public_addr, BDADDR_ANY))
635 options |= MGMT_OPTION_PUBLIC_ADDRESS;
636
637 return cpu_to_le32(options);
638 }
639
new_options(struct hci_dev * hdev,struct sock * skip)640 static int new_options(struct hci_dev *hdev, struct sock *skip)
641 {
642 __le32 options = get_missing_options(hdev);
643
644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
646 }
647
send_options_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
649 {
650 __le32 options = get_missing_options(hdev);
651
652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
653 sizeof(options));
654 }
655
read_config_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)656 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
657 void *data, u16 data_len)
658 {
659 struct mgmt_rp_read_config_info rp;
660 u32 options = 0;
661
662 bt_dev_dbg(hdev, "sock %p", sk);
663
664 hci_dev_lock(hdev);
665
666 memset(&rp, 0, sizeof(rp));
667 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
668
669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG))
670 options |= MGMT_OPTION_EXTERNAL_CONFIG;
671
672 if (hdev->set_bdaddr)
673 options |= MGMT_OPTION_PUBLIC_ADDRESS;
674
675 rp.supported_options = cpu_to_le32(options);
676 rp.missing_options = get_missing_options(hdev);
677
678 hci_dev_unlock(hdev);
679
680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
681 &rp, sizeof(rp));
682 }
683
get_supported_phys(struct hci_dev * hdev)684 static u32 get_supported_phys(struct hci_dev *hdev)
685 {
686 u32 supported_phys = 0;
687
688 if (lmp_bredr_capable(hdev)) {
689 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
690
691 if (hdev->features[0][0] & LMP_3SLOT)
692 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
693
694 if (hdev->features[0][0] & LMP_5SLOT)
695 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
696
697 if (lmp_edr_2m_capable(hdev)) {
698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
699
700 if (lmp_edr_3slot_capable(hdev))
701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
702
703 if (lmp_edr_5slot_capable(hdev))
704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
705
706 if (lmp_edr_3m_capable(hdev)) {
707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
708
709 if (lmp_edr_3slot_capable(hdev))
710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
711
712 if (lmp_edr_5slot_capable(hdev))
713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
714 }
715 }
716 }
717
718 if (lmp_le_capable(hdev)) {
719 supported_phys |= MGMT_PHY_LE_1M_TX;
720 supported_phys |= MGMT_PHY_LE_1M_RX;
721
722 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
723 supported_phys |= MGMT_PHY_LE_2M_TX;
724 supported_phys |= MGMT_PHY_LE_2M_RX;
725 }
726
727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
728 supported_phys |= MGMT_PHY_LE_CODED_TX;
729 supported_phys |= MGMT_PHY_LE_CODED_RX;
730 }
731 }
732
733 return supported_phys;
734 }
735
get_selected_phys(struct hci_dev * hdev)736 static u32 get_selected_phys(struct hci_dev *hdev)
737 {
738 u32 selected_phys = 0;
739
740 if (lmp_bredr_capable(hdev)) {
741 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
742
743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
744 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
745
746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
747 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
748
749 if (lmp_edr_2m_capable(hdev)) {
750 if (!(hdev->pkt_type & HCI_2DH1))
751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
752
753 if (lmp_edr_3slot_capable(hdev) &&
754 !(hdev->pkt_type & HCI_2DH3))
755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
756
757 if (lmp_edr_5slot_capable(hdev) &&
758 !(hdev->pkt_type & HCI_2DH5))
759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
760
761 if (lmp_edr_3m_capable(hdev)) {
762 if (!(hdev->pkt_type & HCI_3DH1))
763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
764
765 if (lmp_edr_3slot_capable(hdev) &&
766 !(hdev->pkt_type & HCI_3DH3))
767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
768
769 if (lmp_edr_5slot_capable(hdev) &&
770 !(hdev->pkt_type & HCI_3DH5))
771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
772 }
773 }
774 }
775
776 if (lmp_le_capable(hdev)) {
777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
778 selected_phys |= MGMT_PHY_LE_1M_TX;
779
780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
781 selected_phys |= MGMT_PHY_LE_1M_RX;
782
783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
784 selected_phys |= MGMT_PHY_LE_2M_TX;
785
786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
787 selected_phys |= MGMT_PHY_LE_2M_RX;
788
789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
790 selected_phys |= MGMT_PHY_LE_CODED_TX;
791
792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
793 selected_phys |= MGMT_PHY_LE_CODED_RX;
794 }
795
796 return selected_phys;
797 }
798
get_configurable_phys(struct hci_dev * hdev)799 static u32 get_configurable_phys(struct hci_dev *hdev)
800 {
801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
803 }
804
get_supported_settings(struct hci_dev * hdev)805 static u32 get_supported_settings(struct hci_dev *hdev)
806 {
807 u32 settings = 0;
808
809 settings |= MGMT_SETTING_POWERED;
810 settings |= MGMT_SETTING_BONDABLE;
811 settings |= MGMT_SETTING_DEBUG_KEYS;
812 settings |= MGMT_SETTING_CONNECTABLE;
813 settings |= MGMT_SETTING_DISCOVERABLE;
814
815 if (lmp_bredr_capable(hdev)) {
816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
817 settings |= MGMT_SETTING_FAST_CONNECTABLE;
818 settings |= MGMT_SETTING_BREDR;
819 settings |= MGMT_SETTING_LINK_SECURITY;
820
821 if (lmp_ssp_capable(hdev)) {
822 settings |= MGMT_SETTING_SSP;
823 }
824
825 if (lmp_sc_capable(hdev))
826 settings |= MGMT_SETTING_SECURE_CONN;
827
828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED))
829 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
830 }
831
832 if (lmp_le_capable(hdev)) {
833 settings |= MGMT_SETTING_LE;
834 settings |= MGMT_SETTING_SECURE_CONN;
835 settings |= MGMT_SETTING_PRIVACY;
836 settings |= MGMT_SETTING_STATIC_ADDRESS;
837 settings |= MGMT_SETTING_ADVERTISING;
838 }
839
840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr)
841 settings |= MGMT_SETTING_CONFIGURATION;
842
843 if (cis_central_capable(hdev))
844 settings |= MGMT_SETTING_CIS_CENTRAL;
845
846 if (cis_peripheral_capable(hdev))
847 settings |= MGMT_SETTING_CIS_PERIPHERAL;
848
849 if (bis_capable(hdev))
850 settings |= MGMT_SETTING_ISO_BROADCASTER;
851
852 if (sync_recv_capable(hdev))
853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
854
855 if (ll_privacy_capable(hdev))
856 settings |= MGMT_SETTING_LL_PRIVACY;
857
858 if (past_sender_capable(hdev))
859 settings |= MGMT_SETTING_PAST_SENDER;
860
861 if (past_receiver_capable(hdev))
862 settings |= MGMT_SETTING_PAST_RECEIVER;
863
864 if (le_sci_capable(hdev))
865 settings |= MGMT_SETTING_SCI;
866
867 settings |= MGMT_SETTING_PHY_CONFIGURATION;
868
869 return settings;
870 }
871
get_current_settings(struct hci_dev * hdev)872 static u32 get_current_settings(struct hci_dev *hdev)
873 {
874 u32 settings = 0;
875
876 if (hdev_is_powered(hdev))
877 settings |= MGMT_SETTING_POWERED;
878
879 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
880 settings |= MGMT_SETTING_CONNECTABLE;
881
882 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
883 settings |= MGMT_SETTING_FAST_CONNECTABLE;
884
885 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
886 settings |= MGMT_SETTING_DISCOVERABLE;
887
888 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
889 settings |= MGMT_SETTING_BONDABLE;
890
891 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
892 settings |= MGMT_SETTING_BREDR;
893
894 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
895 settings |= MGMT_SETTING_LE;
896
897 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
898 settings |= MGMT_SETTING_LINK_SECURITY;
899
900 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
901 settings |= MGMT_SETTING_SSP;
902
903 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
904 settings |= MGMT_SETTING_ADVERTISING;
905
906 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
907 settings |= MGMT_SETTING_SECURE_CONN;
908
909 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
910 settings |= MGMT_SETTING_DEBUG_KEYS;
911
912 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
913 settings |= MGMT_SETTING_PRIVACY;
914
915 /* The current setting for static address has two purposes. The
916 * first is to indicate if the static address will be used and
917 * the second is to indicate if it is actually set.
918 *
919 * This means if the static address is not configured, this flag
920 * will never be set. If the address is configured, then if the
921 * address is actually used decides if the flag is set or not.
922 *
923 * For single mode LE only controllers and dual-mode controllers
924 * with BR/EDR disabled, the existence of the static address will
925 * be evaluated.
926 */
927 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
928 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
929 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
930 if (bacmp(&hdev->static_addr, BDADDR_ANY))
931 settings |= MGMT_SETTING_STATIC_ADDRESS;
932 }
933
934 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
935 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
936
937 if (cis_central_enabled(hdev))
938 settings |= MGMT_SETTING_CIS_CENTRAL;
939
940 if (cis_peripheral_enabled(hdev))
941 settings |= MGMT_SETTING_CIS_PERIPHERAL;
942
943 if (bis_enabled(hdev))
944 settings |= MGMT_SETTING_ISO_BROADCASTER;
945
946 if (sync_recv_enabled(hdev))
947 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
948
949 if (ll_privacy_enabled(hdev))
950 settings |= MGMT_SETTING_LL_PRIVACY;
951
952 if (past_sender_enabled(hdev))
953 settings |= MGMT_SETTING_PAST_SENDER;
954
955 if (past_receiver_enabled(hdev))
956 settings |= MGMT_SETTING_PAST_RECEIVER;
957
958 if (le_sci_enabled(hdev))
959 settings |= MGMT_SETTING_SCI;
960
961 return settings;
962 }
963
pending_find(u16 opcode,struct hci_dev * hdev)964 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
965 {
966 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
967 }
968
mgmt_get_adv_discov_flags(struct hci_dev * hdev)969 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
970 {
971 struct mgmt_pending_cmd *cmd;
972
973 /* If there's a pending mgmt command the flags will not yet have
974 * their final values, so check for this first.
975 */
976 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
977 if (cmd) {
978 struct mgmt_mode *cp = cmd->param;
979 if (cp->val == 0x01)
980 return LE_AD_GENERAL;
981 else if (cp->val == 0x02)
982 return LE_AD_LIMITED;
983 } else {
984 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
985 return LE_AD_LIMITED;
986 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
987 return LE_AD_GENERAL;
988 }
989
990 return 0;
991 }
992
mgmt_get_connectable(struct hci_dev * hdev)993 bool mgmt_get_connectable(struct hci_dev *hdev)
994 {
995 struct mgmt_pending_cmd *cmd;
996
997 /* If there's a pending mgmt command the flag will not yet have
998 * it's final value, so check for this first.
999 */
1000 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1001 if (cmd) {
1002 struct mgmt_mode *cp = cmd->param;
1003
1004 return cp->val;
1005 }
1006
1007 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1008 }
1009
service_cache_sync(struct hci_dev * hdev,void * data)1010 static int service_cache_sync(struct hci_dev *hdev, void *data)
1011 {
1012 hci_update_eir_sync(hdev);
1013 hci_update_class_sync(hdev);
1014
1015 return 0;
1016 }
1017
service_cache_off(struct work_struct * work)1018 static void service_cache_off(struct work_struct *work)
1019 {
1020 struct hci_dev *hdev = container_of(work, struct hci_dev,
1021 service_cache.work);
1022
1023 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1024 return;
1025
1026 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1027 }
1028
rpa_expired_sync(struct hci_dev * hdev,void * data)1029 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1030 {
1031 /* The generation of a new RPA and programming it into the
1032 * controller happens in the hci_req_enable_advertising()
1033 * function.
1034 */
1035 if (ext_adv_capable(hdev))
1036 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1037 else
1038 return hci_enable_advertising_sync(hdev);
1039 }
1040
rpa_expired(struct work_struct * work)1041 static void rpa_expired(struct work_struct *work)
1042 {
1043 struct hci_dev *hdev = container_of(work, struct hci_dev,
1044 rpa_expired.work);
1045
1046 bt_dev_dbg(hdev, "");
1047
1048 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1049
1050 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1051 return;
1052
1053 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1054 }
1055
1056 static int set_discoverable_sync(struct hci_dev *hdev, void *data);
1057
discov_off(struct work_struct * work)1058 static void discov_off(struct work_struct *work)
1059 {
1060 struct hci_dev *hdev = container_of(work, struct hci_dev,
1061 discov_off.work);
1062
1063 bt_dev_dbg(hdev, "");
1064
1065 hci_dev_lock(hdev);
1066
1067 /* When discoverable timeout triggers, then just make sure
1068 * the limited discoverable flag is cleared. Even in the case
1069 * of a timeout triggered from general discoverable, it is
1070 * safe to unconditionally clear the flag.
1071 */
1072 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1073 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1074 hdev->discov_timeout = 0;
1075
1076 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL);
1077
1078 mgmt_new_settings(hdev);
1079
1080 hci_dev_unlock(hdev);
1081 }
1082
1083 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1084
mesh_send_complete(struct hci_dev * hdev,struct mgmt_mesh_tx * mesh_tx,bool silent)1085 static void mesh_send_complete(struct hci_dev *hdev,
1086 struct mgmt_mesh_tx *mesh_tx, bool silent)
1087 {
1088 u8 handle = mesh_tx->handle;
1089
1090 if (!silent)
1091 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1092 sizeof(handle), NULL);
1093
1094 mgmt_mesh_remove(mesh_tx);
1095 }
1096
mesh_send_done_sync(struct hci_dev * hdev,void * data)1097 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1098 {
1099 struct mgmt_mesh_tx *mesh_tx;
1100
1101 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1102 if (list_empty(&hdev->adv_instances))
1103 hci_disable_advertising_sync(hdev);
1104 mesh_tx = mgmt_mesh_next(hdev, NULL);
1105
1106 if (mesh_tx)
1107 mesh_send_complete(hdev, mesh_tx, false);
1108
1109 return 0;
1110 }
1111
1112 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1113 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
mesh_next(struct hci_dev * hdev,void * data,int err)1114 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1115 {
1116 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1117
1118 if (!mesh_tx)
1119 return;
1120
1121 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1122 mesh_send_start_complete);
1123
1124 if (err < 0)
1125 mesh_send_complete(hdev, mesh_tx, false);
1126 else
1127 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1128 }
1129
mesh_send_done(struct work_struct * work)1130 static void mesh_send_done(struct work_struct *work)
1131 {
1132 struct hci_dev *hdev = container_of(work, struct hci_dev,
1133 mesh_send_done.work);
1134
1135 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1136 return;
1137
1138 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1139 }
1140
mgmt_init_hdev(struct sock * sk,struct hci_dev * hdev)1141 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1142 {
1143 if (hci_dev_test_flag(hdev, HCI_MGMT))
1144 return;
1145
1146 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1147
1148 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1149 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1150 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1151 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1152
1153 /* Non-mgmt controlled devices get this bit set
1154 * implicitly so that pairing works for them, however
1155 * for mgmt we require user-space to explicitly enable
1156 * it
1157 */
1158 hci_dev_clear_flag(hdev, HCI_BONDABLE);
1159
1160 hci_dev_set_flag(hdev, HCI_MGMT);
1161 }
1162
read_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1163 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1164 void *data, u16 data_len)
1165 {
1166 struct mgmt_rp_read_info rp;
1167
1168 bt_dev_dbg(hdev, "sock %p", sk);
1169
1170 hci_dev_lock(hdev);
1171
1172 memset(&rp, 0, sizeof(rp));
1173
1174 bacpy(&rp.bdaddr, &hdev->bdaddr);
1175
1176 rp.version = hdev->hci_ver;
1177 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1178
1179 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1180 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1181
1182 memcpy(rp.dev_class, hdev->dev_class, 3);
1183
1184 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1185 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1186
1187 hci_dev_unlock(hdev);
1188
1189 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1190 sizeof(rp));
1191 }
1192
append_eir_data_to_buf(struct hci_dev * hdev,u8 * eir)1193 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1194 {
1195 u16 eir_len = 0;
1196 size_t name_len;
1197
1198 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1199 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1200 hdev->dev_class, 3);
1201
1202 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1203 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1204 hdev->appearance);
1205
1206 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1207 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1208 hdev->dev_name, name_len);
1209
1210 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1211 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1212 hdev->short_name, name_len);
1213
1214 return eir_len;
1215 }
1216
read_ext_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1217 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1218 void *data, u16 data_len)
1219 {
1220 char buf[512];
1221 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1222 u16 eir_len;
1223
1224 bt_dev_dbg(hdev, "sock %p", sk);
1225
1226 memset(&buf, 0, sizeof(buf));
1227
1228 hci_dev_lock(hdev);
1229
1230 bacpy(&rp->bdaddr, &hdev->bdaddr);
1231
1232 rp->version = hdev->hci_ver;
1233 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1234
1235 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1236 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1237
1238
1239 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1240 rp->eir_len = cpu_to_le16(eir_len);
1241
1242 hci_dev_unlock(hdev);
1243
1244 /* If this command is called at least once, then the events
1245 * for class of device and local name changes are disabled
1246 * and only the new extended controller information event
1247 * is used.
1248 */
1249 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1250 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1251 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1252
1253 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1254 sizeof(*rp) + eir_len);
1255 }
1256
ext_info_changed(struct hci_dev * hdev,struct sock * skip)1257 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1258 {
1259 char buf[512];
1260 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1261 u16 eir_len;
1262
1263 memset(buf, 0, sizeof(buf));
1264
1265 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1266 ev->eir_len = cpu_to_le16(eir_len);
1267
1268 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1269 sizeof(*ev) + eir_len,
1270 HCI_MGMT_EXT_INFO_EVENTS, skip);
1271 }
1272
send_settings_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)1273 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1274 {
1275 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1276
1277 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1278 sizeof(settings));
1279 }
1280
mgmt_advertising_added(struct sock * sk,struct hci_dev * hdev,u8 instance)1281 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1282 {
1283 struct mgmt_ev_advertising_added ev;
1284
1285 ev.instance = instance;
1286
1287 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1288 }
1289
mgmt_advertising_removed(struct sock * sk,struct hci_dev * hdev,u8 instance)1290 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1291 u8 instance)
1292 {
1293 struct mgmt_ev_advertising_removed ev;
1294
1295 ev.instance = instance;
1296
1297 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1298 }
1299
cancel_adv_timeout(struct hci_dev * hdev)1300 static void cancel_adv_timeout(struct hci_dev *hdev)
1301 {
1302 if (hdev->adv_instance_timeout) {
1303 hdev->adv_instance_timeout = 0;
1304 cancel_delayed_work(&hdev->adv_instance_expire);
1305 }
1306 }
1307
1308 /* This function requires the caller holds hdev->lock */
restart_le_actions(struct hci_dev * hdev)1309 static void restart_le_actions(struct hci_dev *hdev)
1310 {
1311 struct hci_conn_params *p;
1312
1313 list_for_each_entry(p, &hdev->le_conn_params, list) {
1314 /* Needed for AUTO_OFF case where might not "really"
1315 * have been powered off.
1316 */
1317 hci_pend_le_list_del_init(p);
1318
1319 switch (p->auto_connect) {
1320 case HCI_AUTO_CONN_DIRECT:
1321 case HCI_AUTO_CONN_ALWAYS:
1322 hci_pend_le_list_add(p, &hdev->pend_le_conns);
1323 break;
1324 case HCI_AUTO_CONN_REPORT:
1325 hci_pend_le_list_add(p, &hdev->pend_le_reports);
1326 break;
1327 default:
1328 break;
1329 }
1330 }
1331 }
1332
new_settings(struct hci_dev * hdev,struct sock * skip)1333 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1334 {
1335 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1336
1337 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1338 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1339 }
1340
mgmt_set_powered_complete(struct hci_dev * hdev,void * data,int err)1341 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1342 {
1343 struct mgmt_pending_cmd *cmd = data;
1344 struct mgmt_mode *cp;
1345
1346 /* Make sure cmd still outstanding. */
1347 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1348 return;
1349
1350 cp = cmd->param;
1351
1352 bt_dev_dbg(hdev, "err %d", err);
1353
1354 if (!err) {
1355 if (cp->val) {
1356 hci_dev_lock(hdev);
1357 restart_le_actions(hdev);
1358 hci_update_passive_scan(hdev);
1359 hci_dev_unlock(hdev);
1360 }
1361
1362 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1363
1364 /* Only call new_setting for power on as power off is deferred
1365 * to hdev->power_off work which does call hci_dev_do_close.
1366 */
1367 if (cp->val)
1368 new_settings(hdev, cmd->sk);
1369 } else {
1370 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1371 mgmt_status(err));
1372 }
1373
1374 mgmt_pending_free(cmd);
1375 }
1376
set_powered_sync(struct hci_dev * hdev,void * data)1377 static int set_powered_sync(struct hci_dev *hdev, void *data)
1378 {
1379 struct mgmt_pending_cmd *cmd = data;
1380 struct mgmt_mode cp;
1381
1382 mutex_lock(&hdev->mgmt_pending_lock);
1383
1384 /* Make sure cmd still outstanding. */
1385 if (!__mgmt_pending_listed(hdev, cmd)) {
1386 mutex_unlock(&hdev->mgmt_pending_lock);
1387 return -ECANCELED;
1388 }
1389
1390 memcpy(&cp, cmd->param, sizeof(cp));
1391
1392 mutex_unlock(&hdev->mgmt_pending_lock);
1393
1394 BT_DBG("%s", hdev->name);
1395
1396 return hci_set_powered_sync(hdev, cp.val);
1397 }
1398
set_powered(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1399 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1400 u16 len)
1401 {
1402 struct mgmt_mode *cp = data;
1403 struct mgmt_pending_cmd *cmd;
1404 int err;
1405
1406 bt_dev_dbg(hdev, "sock %p", sk);
1407
1408 if (cp->val != 0x00 && cp->val != 0x01)
1409 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1410 MGMT_STATUS_INVALID_PARAMS);
1411
1412 hci_dev_lock(hdev);
1413
1414 if (!cp->val) {
1415 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1417 MGMT_STATUS_BUSY);
1418 goto failed;
1419 }
1420 }
1421
1422 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1423 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1424 MGMT_STATUS_BUSY);
1425 goto failed;
1426 }
1427
1428 if (!!cp->val == hdev_is_powered(hdev)) {
1429 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1430 goto failed;
1431 }
1432
1433 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1434 if (!cmd) {
1435 err = -ENOMEM;
1436 goto failed;
1437 }
1438
1439 /* Cancel potentially blocking sync operation before power off */
1440 if (cp->val == 0x00) {
1441 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
1442 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1443 mgmt_set_powered_complete);
1444 } else {
1445 /* Use hci_cmd_sync_submit since hdev might not be running */
1446 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1447 mgmt_set_powered_complete);
1448 }
1449
1450 if (err < 0)
1451 mgmt_pending_remove(cmd);
1452
1453 failed:
1454 hci_dev_unlock(hdev);
1455 return err;
1456 }
1457
mgmt_new_settings(struct hci_dev * hdev)1458 int mgmt_new_settings(struct hci_dev *hdev)
1459 {
1460 return new_settings(hdev, NULL);
1461 }
1462
1463 struct cmd_lookup {
1464 struct sock *sk;
1465 struct hci_dev *hdev;
1466 u8 mgmt_status;
1467 };
1468
settings_rsp(struct mgmt_pending_cmd * cmd,void * data)1469 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1470 {
1471 struct cmd_lookup *match = data;
1472
1473 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1474
1475 if (match->sk == NULL) {
1476 match->sk = cmd->sk;
1477 sock_hold(match->sk);
1478 }
1479 }
1480
cmd_status_rsp(struct mgmt_pending_cmd * cmd,void * data)1481 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1482 {
1483 u8 *status = data;
1484
1485 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status);
1486 }
1487
cmd_complete_rsp(struct mgmt_pending_cmd * cmd,void * data)1488 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1489 {
1490 struct cmd_lookup *match = data;
1491
1492 /* dequeue cmd_sync entries using cmd as data as that is about to be
1493 * removed/freed.
1494 */
1495 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
1496
1497 if (cmd->cmd_complete) {
1498 cmd->cmd_complete(cmd, match->mgmt_status);
1499 return;
1500 }
1501
1502 cmd_status_rsp(cmd, data);
1503 }
1504
generic_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1505 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1506 {
1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,
1508 cmd->param, cmd->param_len);
1509 }
1510
addr_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1511 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1512 {
1513 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,
1514 cmd->param, sizeof(struct mgmt_addr_info));
1515 }
1516
mgmt_bredr_support(struct hci_dev * hdev)1517 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1518 {
1519 if (!lmp_bredr_capable(hdev))
1520 return MGMT_STATUS_NOT_SUPPORTED;
1521 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1522 return MGMT_STATUS_REJECTED;
1523 else
1524 return MGMT_STATUS_SUCCESS;
1525 }
1526
mgmt_le_support(struct hci_dev * hdev)1527 static u8 mgmt_le_support(struct hci_dev *hdev)
1528 {
1529 if (!lmp_le_capable(hdev))
1530 return MGMT_STATUS_NOT_SUPPORTED;
1531 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1532 return MGMT_STATUS_REJECTED;
1533 else
1534 return MGMT_STATUS_SUCCESS;
1535 }
1536
mgmt_set_discoverable_complete(struct hci_dev * hdev,void * data,int err)1537 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1538 int err)
1539 {
1540 struct mgmt_pending_cmd *cmd = data;
1541
1542 bt_dev_dbg(hdev, "err %d", err);
1543
1544 /* Make sure cmd still outstanding. */
1545 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1546 return;
1547
1548 hci_dev_lock(hdev);
1549
1550 if (err) {
1551 u8 mgmt_err = mgmt_status(err);
1552 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1553 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1554 goto done;
1555 }
1556
1557 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1558 hdev->discov_timeout > 0) {
1559 int to = secs_to_jiffies(hdev->discov_timeout);
1560 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1561 }
1562
1563 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1564 new_settings(hdev, cmd->sk);
1565
1566 done:
1567 mgmt_pending_free(cmd);
1568 hci_dev_unlock(hdev);
1569 }
1570
set_discoverable_sync(struct hci_dev * hdev,void * data)1571 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1572 {
1573 if (!mgmt_pending_listed(hdev, data))
1574 return -ECANCELED;
1575
1576 BT_DBG("%s", hdev->name);
1577
1578 return hci_update_discoverable_sync(hdev);
1579 }
1580
set_discoverable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1581 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1582 u16 len)
1583 {
1584 struct mgmt_cp_set_discoverable *cp = data;
1585 struct mgmt_pending_cmd *cmd;
1586 u16 timeout;
1587 int err;
1588
1589 bt_dev_dbg(hdev, "sock %p", sk);
1590
1591 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1592 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1594 MGMT_STATUS_REJECTED);
1595
1596 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1597 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1598 MGMT_STATUS_INVALID_PARAMS);
1599
1600 timeout = __le16_to_cpu(cp->timeout);
1601
1602 /* Disabling discoverable requires that no timeout is set,
1603 * and enabling limited discoverable requires a timeout.
1604 */
1605 if ((cp->val == 0x00 && timeout > 0) ||
1606 (cp->val == 0x02 && timeout == 0))
1607 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1608 MGMT_STATUS_INVALID_PARAMS);
1609
1610 hci_dev_lock(hdev);
1611
1612 if (!hdev_is_powered(hdev) && timeout > 0) {
1613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1614 MGMT_STATUS_NOT_POWERED);
1615 goto failed;
1616 }
1617
1618 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1619 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1621 MGMT_STATUS_BUSY);
1622 goto failed;
1623 }
1624
1625 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1627 MGMT_STATUS_REJECTED);
1628 goto failed;
1629 }
1630
1631 if (hdev->advertising_paused) {
1632 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1633 MGMT_STATUS_BUSY);
1634 goto failed;
1635 }
1636
1637 if (!hdev_is_powered(hdev)) {
1638 bool changed = false;
1639
1640 /* Setting limited discoverable when powered off is
1641 * not a valid operation since it requires a timeout
1642 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1643 */
1644 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1645 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1646 changed = true;
1647 }
1648
1649 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1650 if (err < 0)
1651 goto failed;
1652
1653 if (changed)
1654 err = new_settings(hdev, sk);
1655
1656 goto failed;
1657 }
1658
1659 /* If the current mode is the same, then just update the timeout
1660 * value with the new value. And if only the timeout gets updated,
1661 * then no need for any HCI transactions.
1662 */
1663 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1664 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1665 HCI_LIMITED_DISCOVERABLE)) {
1666 cancel_delayed_work(&hdev->discov_off);
1667 hdev->discov_timeout = timeout;
1668
1669 if (cp->val && hdev->discov_timeout > 0) {
1670 int to = secs_to_jiffies(hdev->discov_timeout);
1671 queue_delayed_work(hdev->req_workqueue,
1672 &hdev->discov_off, to);
1673 }
1674
1675 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1676 goto failed;
1677 }
1678
1679 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1680 if (!cmd) {
1681 err = -ENOMEM;
1682 goto failed;
1683 }
1684
1685 /* Cancel any potential discoverable timeout that might be
1686 * still active and store new timeout value. The arming of
1687 * the timeout happens in the complete handler.
1688 */
1689 cancel_delayed_work(&hdev->discov_off);
1690 hdev->discov_timeout = timeout;
1691
1692 if (cp->val)
1693 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1694 else
1695 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1696
1697 /* Limited discoverable mode */
1698 if (cp->val == 0x02)
1699 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1700 else
1701 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1702
1703 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1704 mgmt_set_discoverable_complete);
1705
1706 if (err < 0)
1707 mgmt_pending_remove(cmd);
1708
1709 failed:
1710 hci_dev_unlock(hdev);
1711 return err;
1712 }
1713
mgmt_set_connectable_complete(struct hci_dev * hdev,void * data,int err)1714 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1715 int err)
1716 {
1717 struct mgmt_pending_cmd *cmd = data;
1718
1719 bt_dev_dbg(hdev, "err %d", err);
1720
1721 /* Make sure cmd still outstanding. */
1722 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1723 return;
1724
1725 hci_dev_lock(hdev);
1726
1727 if (err) {
1728 u8 mgmt_err = mgmt_status(err);
1729 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1730 goto done;
1731 }
1732
1733 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1734 new_settings(hdev, cmd->sk);
1735
1736 done:
1737 mgmt_pending_free(cmd);
1738
1739 hci_dev_unlock(hdev);
1740 }
1741
set_connectable_update_settings(struct hci_dev * hdev,struct sock * sk,u8 val)1742 static int set_connectable_update_settings(struct hci_dev *hdev,
1743 struct sock *sk, u8 val)
1744 {
1745 bool changed = false;
1746 int err;
1747
1748 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1749 changed = true;
1750
1751 if (val) {
1752 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1753 } else {
1754 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1755 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1756 }
1757
1758 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1759 if (err < 0)
1760 return err;
1761
1762 if (changed) {
1763 hci_update_scan(hdev);
1764 hci_update_passive_scan(hdev);
1765 return new_settings(hdev, sk);
1766 }
1767
1768 return 0;
1769 }
1770
set_connectable_sync(struct hci_dev * hdev,void * data)1771 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1772 {
1773 if (!mgmt_pending_listed(hdev, data))
1774 return -ECANCELED;
1775
1776 BT_DBG("%s", hdev->name);
1777
1778 return hci_update_connectable_sync(hdev);
1779 }
1780
set_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1781 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1782 u16 len)
1783 {
1784 struct mgmt_mode *cp = data;
1785 struct mgmt_pending_cmd *cmd;
1786 int err;
1787
1788 bt_dev_dbg(hdev, "sock %p", sk);
1789
1790 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1791 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1793 MGMT_STATUS_REJECTED);
1794
1795 if (cp->val != 0x00 && cp->val != 0x01)
1796 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1797 MGMT_STATUS_INVALID_PARAMS);
1798
1799 hci_dev_lock(hdev);
1800
1801 if (!hdev_is_powered(hdev)) {
1802 err = set_connectable_update_settings(hdev, sk, cp->val);
1803 goto failed;
1804 }
1805
1806 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1807 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1808 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1809 MGMT_STATUS_BUSY);
1810 goto failed;
1811 }
1812
1813 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1814 if (!cmd) {
1815 err = -ENOMEM;
1816 goto failed;
1817 }
1818
1819 if (cp->val) {
1820 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1821 } else {
1822 if (hdev->discov_timeout > 0)
1823 cancel_delayed_work(&hdev->discov_off);
1824
1825 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1826 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1827 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1828 }
1829
1830 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1831 mgmt_set_connectable_complete);
1832
1833 if (err < 0)
1834 mgmt_pending_remove(cmd);
1835
1836 failed:
1837 hci_dev_unlock(hdev);
1838 return err;
1839 }
1840
set_bondable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1841 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1842 u16 len)
1843 {
1844 struct mgmt_mode *cp = data;
1845 bool changed;
1846 int err;
1847
1848 bt_dev_dbg(hdev, "sock %p", sk);
1849
1850 if (cp->val != 0x00 && cp->val != 0x01)
1851 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1852 MGMT_STATUS_INVALID_PARAMS);
1853
1854 hci_dev_lock(hdev);
1855
1856 if (cp->val)
1857 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1858 else
1859 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1860
1861 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1862 if (err < 0)
1863 goto unlock;
1864
1865 if (changed) {
1866 /* In limited privacy mode the change of bondable mode
1867 * may affect the local advertising address.
1868 */
1869 hci_update_discoverable(hdev);
1870
1871 err = new_settings(hdev, sk);
1872 }
1873
1874 unlock:
1875 hci_dev_unlock(hdev);
1876 return err;
1877 }
1878
set_link_security(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1879 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1880 u16 len)
1881 {
1882 struct mgmt_mode *cp = data;
1883 struct mgmt_pending_cmd *cmd;
1884 u8 val, status;
1885 int err;
1886
1887 bt_dev_dbg(hdev, "sock %p", sk);
1888
1889 status = mgmt_bredr_support(hdev);
1890 if (status)
1891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1892 status);
1893
1894 if (cp->val != 0x00 && cp->val != 0x01)
1895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1896 MGMT_STATUS_INVALID_PARAMS);
1897
1898 hci_dev_lock(hdev);
1899
1900 if (!hdev_is_powered(hdev)) {
1901 bool changed = false;
1902
1903 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1904 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1905 changed = true;
1906 }
1907
1908 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1909 if (err < 0)
1910 goto failed;
1911
1912 if (changed)
1913 err = new_settings(hdev, sk);
1914
1915 goto failed;
1916 }
1917
1918 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1919 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1920 MGMT_STATUS_BUSY);
1921 goto failed;
1922 }
1923
1924 val = !!cp->val;
1925
1926 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1927 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1928 goto failed;
1929 }
1930
1931 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1932 if (!cmd) {
1933 err = -ENOMEM;
1934 goto failed;
1935 }
1936
1937 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1938 if (err < 0) {
1939 mgmt_pending_remove(cmd);
1940 goto failed;
1941 }
1942
1943 failed:
1944 hci_dev_unlock(hdev);
1945 return err;
1946 }
1947
set_ssp_complete(struct hci_dev * hdev,void * data,int err)1948 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1949 {
1950 struct cmd_lookup match = { NULL, hdev };
1951 struct mgmt_pending_cmd *cmd = data;
1952 struct mgmt_mode *cp;
1953 u8 enable;
1954 bool changed;
1955
1956 /* Make sure cmd still outstanding. */
1957 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1958 return;
1959
1960 cp = cmd->param;
1961 enable = cp->val;
1962
1963 if (err) {
1964 u8 mgmt_err = mgmt_status(err);
1965
1966 if (enable && hci_dev_test_and_clear_flag(hdev,
1967 HCI_SSP_ENABLED)) {
1968 new_settings(hdev, NULL);
1969 }
1970
1971 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1972 mgmt_pending_free(cmd);
1973 return;
1974 }
1975
1976 if (enable) {
1977 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1978 } else {
1979 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1980 }
1981
1982 settings_rsp(cmd, &match);
1983
1984 if (changed)
1985 new_settings(hdev, match.sk);
1986
1987 if (match.sk)
1988 sock_put(match.sk);
1989
1990 hci_update_eir_sync(hdev);
1991 mgmt_pending_free(cmd);
1992 }
1993
set_ssp_sync(struct hci_dev * hdev,void * data)1994 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1995 {
1996 struct mgmt_pending_cmd *cmd = data;
1997 struct mgmt_mode cp;
1998 bool changed = false;
1999 int err;
2000
2001 mutex_lock(&hdev->mgmt_pending_lock);
2002
2003 if (!__mgmt_pending_listed(hdev, cmd)) {
2004 mutex_unlock(&hdev->mgmt_pending_lock);
2005 return -ECANCELED;
2006 }
2007
2008 memcpy(&cp, cmd->param, sizeof(cp));
2009
2010 mutex_unlock(&hdev->mgmt_pending_lock);
2011
2012 if (cp.val)
2013 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
2014
2015 err = hci_write_ssp_mode_sync(hdev, cp.val);
2016
2017 if (!err && changed)
2018 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
2019
2020 return err;
2021 }
2022
set_ssp(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2023 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2024 {
2025 struct mgmt_mode *cp = data;
2026 struct mgmt_pending_cmd *cmd;
2027 u8 status;
2028 int err;
2029
2030 bt_dev_dbg(hdev, "sock %p", sk);
2031
2032 status = mgmt_bredr_support(hdev);
2033 if (status)
2034 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2035
2036 if (!lmp_ssp_capable(hdev))
2037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2038 MGMT_STATUS_NOT_SUPPORTED);
2039
2040 if (cp->val != 0x00 && cp->val != 0x01)
2041 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2042 MGMT_STATUS_INVALID_PARAMS);
2043
2044 hci_dev_lock(hdev);
2045
2046 if (!hdev_is_powered(hdev)) {
2047 bool changed;
2048
2049 if (cp->val) {
2050 changed = !hci_dev_test_and_set_flag(hdev,
2051 HCI_SSP_ENABLED);
2052 } else {
2053 changed = hci_dev_test_and_clear_flag(hdev,
2054 HCI_SSP_ENABLED);
2055 }
2056
2057 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2058 if (err < 0)
2059 goto failed;
2060
2061 if (changed)
2062 err = new_settings(hdev, sk);
2063
2064 goto failed;
2065 }
2066
2067 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2068 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2069 MGMT_STATUS_BUSY);
2070 goto failed;
2071 }
2072
2073 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2074 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2075 goto failed;
2076 }
2077
2078 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2079 if (!cmd)
2080 err = -ENOMEM;
2081 else
2082 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2083 set_ssp_complete);
2084
2085 if (err < 0) {
2086 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2087 MGMT_STATUS_FAILED);
2088
2089 if (cmd)
2090 mgmt_pending_remove(cmd);
2091 }
2092
2093 failed:
2094 hci_dev_unlock(hdev);
2095 return err;
2096 }
2097
set_hs(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2098 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2099 {
2100 bt_dev_dbg(hdev, "sock %p", sk);
2101
2102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2103 MGMT_STATUS_NOT_SUPPORTED);
2104 }
2105
set_le_complete(struct hci_dev * hdev,void * data,int err)2106 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2107 {
2108 struct mgmt_pending_cmd *cmd = data;
2109 struct cmd_lookup match = { NULL, hdev };
2110 u8 status = mgmt_status(err);
2111
2112 bt_dev_dbg(hdev, "err %d", err);
2113
2114 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
2115 return;
2116
2117 if (status) {
2118 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
2119 goto done;
2120 }
2121
2122 settings_rsp(cmd, &match);
2123
2124 new_settings(hdev, match.sk);
2125
2126 if (match.sk)
2127 sock_put(match.sk);
2128
2129 done:
2130 mgmt_pending_free(cmd);
2131 }
2132
set_le_sync(struct hci_dev * hdev,void * data)2133 static int set_le_sync(struct hci_dev *hdev, void *data)
2134 {
2135 struct mgmt_pending_cmd *cmd = data;
2136 struct mgmt_mode cp;
2137 u8 val;
2138 int err;
2139
2140 mutex_lock(&hdev->mgmt_pending_lock);
2141
2142 if (!__mgmt_pending_listed(hdev, cmd)) {
2143 mutex_unlock(&hdev->mgmt_pending_lock);
2144 return -ECANCELED;
2145 }
2146
2147 memcpy(&cp, cmd->param, sizeof(cp));
2148 val = !!cp.val;
2149
2150 mutex_unlock(&hdev->mgmt_pending_lock);
2151
2152 if (!val) {
2153 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2154
2155 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2156 hci_disable_advertising_sync(hdev);
2157
2158 if (ext_adv_capable(hdev))
2159 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2160 } else {
2161 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2162 }
2163
2164 err = hci_write_le_host_supported_sync(hdev, val, 0);
2165
2166 /* Make sure the controller has a good default for
2167 * advertising data. Restrict the update to when LE
2168 * has actually been enabled. During power on, the
2169 * update in powered_update_hci will take care of it.
2170 */
2171 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2172 if (ext_adv_capable(hdev)) {
2173 int status;
2174
2175 status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2176 if (!status)
2177 hci_update_scan_rsp_data_sync(hdev, 0x00);
2178 } else {
2179 hci_update_adv_data_sync(hdev, 0x00);
2180 hci_update_scan_rsp_data_sync(hdev, 0x00);
2181 }
2182
2183 hci_update_passive_scan(hdev);
2184 }
2185
2186 return err;
2187 }
2188
set_mesh_complete(struct hci_dev * hdev,void * data,int err)2189 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2190 {
2191 struct mgmt_pending_cmd *cmd = data;
2192 u8 status = mgmt_status(err);
2193 struct sock *sk;
2194
2195 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
2196 return;
2197
2198 sk = cmd->sk;
2199
2200 if (status) {
2201 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2202 goto done;
2203 }
2204
2205 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2206
2207 done:
2208 mgmt_pending_free(cmd);
2209 }
2210
set_mesh_sync(struct hci_dev * hdev,void * data)2211 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2212 {
2213 struct mgmt_pending_cmd *cmd = data;
2214 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types,
2215 sizeof(hdev->mesh_ad_types));
2216 size_t len;
2217
2218 mutex_lock(&hdev->mgmt_pending_lock);
2219
2220 if (!__mgmt_pending_listed(hdev, cmd)) {
2221 mutex_unlock(&hdev->mgmt_pending_lock);
2222 return -ECANCELED;
2223 }
2224
2225 len = cmd->param_len;
2226 memcpy(cp, cmd->param, min(__struct_size(cp), len));
2227
2228 mutex_unlock(&hdev->mgmt_pending_lock);
2229
2230 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2231
2232 if (cp->enable)
2233 hci_dev_set_flag(hdev, HCI_MESH);
2234 else
2235 hci_dev_clear_flag(hdev, HCI_MESH);
2236
2237 hdev->le_scan_interval = __le16_to_cpu(cp->period);
2238 hdev->le_scan_window = __le16_to_cpu(cp->window);
2239
2240 len -= sizeof(struct mgmt_cp_set_mesh);
2241
2242 /* If filters don't fit, forward all adv pkts */
2243 if (len <= sizeof(hdev->mesh_ad_types))
2244 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2245
2246 hci_update_passive_scan_sync(hdev);
2247 return 0;
2248 }
2249
set_mesh(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2250 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2251 {
2252 struct mgmt_cp_set_mesh *cp = data;
2253 struct mgmt_pending_cmd *cmd;
2254 __u16 period, window;
2255 int err = 0;
2256
2257 bt_dev_dbg(hdev, "sock %p", sk);
2258
2259 if (!lmp_le_capable(hdev) ||
2260 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2262 MGMT_STATUS_NOT_SUPPORTED);
2263
2264 if (cp->enable != 0x00 && cp->enable != 0x01)
2265 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2266 MGMT_STATUS_INVALID_PARAMS);
2267
2268 /* Keep allowed ranges in sync with set_scan_params() */
2269 period = __le16_to_cpu(cp->period);
2270
2271 if (period < 0x0004 || period > 0x4000)
2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2273 MGMT_STATUS_INVALID_PARAMS);
2274
2275 window = __le16_to_cpu(cp->window);
2276
2277 if (window < 0x0004 || window > 0x4000)
2278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2279 MGMT_STATUS_INVALID_PARAMS);
2280
2281 if (window > period)
2282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2283 MGMT_STATUS_INVALID_PARAMS);
2284
2285 hci_dev_lock(hdev);
2286
2287 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2288 if (!cmd)
2289 err = -ENOMEM;
2290 else
2291 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2292 set_mesh_complete);
2293
2294 if (err < 0) {
2295 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2296 MGMT_STATUS_FAILED);
2297
2298 if (cmd)
2299 mgmt_pending_remove(cmd);
2300 }
2301
2302 hci_dev_unlock(hdev);
2303 return err;
2304 }
2305
mesh_send_start_complete(struct hci_dev * hdev,void * data,int err)2306 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2307 {
2308 struct mgmt_mesh_tx *mesh_tx = data;
2309 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2310 unsigned long mesh_send_interval;
2311 u8 mgmt_err = mgmt_status(err);
2312
2313 /* Report any errors here, but don't report completion */
2314
2315 if (mgmt_err) {
2316 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2317 /* Send Complete Error Code for handle */
2318 mesh_send_complete(hdev, mesh_tx, false);
2319 return;
2320 }
2321
2322 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2323 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2324 mesh_send_interval);
2325 }
2326
mesh_send_sync(struct hci_dev * hdev,void * data)2327 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2328 {
2329 struct mgmt_mesh_tx *mesh_tx = data;
2330 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2331 struct adv_info *adv, *next_instance;
2332 u8 instance = hdev->le_num_of_adv_sets + 1;
2333 u16 timeout, duration;
2334 int err = 0;
2335
2336 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2337 return MGMT_STATUS_BUSY;
2338
2339 timeout = 1000;
2340 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2341 adv = hci_add_adv_instance(hdev, instance, 0,
2342 send->adv_data_len, send->adv_data,
2343 0, NULL,
2344 timeout, duration,
2345 HCI_ADV_TX_POWER_NO_PREFERENCE,
2346 hdev->le_adv_min_interval,
2347 hdev->le_adv_max_interval,
2348 mesh_tx->handle);
2349
2350 if (!IS_ERR(adv))
2351 mesh_tx->instance = instance;
2352 else
2353 err = PTR_ERR(adv);
2354
2355 if (hdev->cur_adv_instance == instance) {
2356 /* If the currently advertised instance is being changed then
2357 * cancel the current advertising and schedule the next
2358 * instance. If there is only one instance then the overridden
2359 * advertising data will be visible right away.
2360 */
2361 cancel_adv_timeout(hdev);
2362
2363 next_instance = hci_get_next_instance(hdev, instance);
2364 if (next_instance)
2365 instance = next_instance->instance;
2366 else
2367 instance = 0;
2368 } else if (hdev->adv_instance_timeout) {
2369 /* Immediately advertise the new instance if no other, or
2370 * let it go naturally from queue if ADV is already happening
2371 */
2372 instance = 0;
2373 }
2374
2375 if (instance)
2376 return hci_schedule_adv_instance_sync(hdev, instance, true);
2377
2378 return err;
2379 }
2380
send_count(struct mgmt_mesh_tx * mesh_tx,void * data)2381 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2382 {
2383 struct mgmt_rp_mesh_read_features *rp = data;
2384
2385 if (rp->used_handles >= rp->max_handles)
2386 return;
2387
2388 rp->handles[rp->used_handles++] = mesh_tx->handle;
2389 }
2390
mesh_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2391 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2392 void *data, u16 len)
2393 {
2394 struct mgmt_rp_mesh_read_features rp;
2395
2396 if (!lmp_le_capable(hdev) ||
2397 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2398 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2399 MGMT_STATUS_NOT_SUPPORTED);
2400
2401 memset(&rp, 0, sizeof(rp));
2402 rp.index = cpu_to_le16(hdev->id);
2403 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2404 rp.max_handles = MESH_HANDLES_MAX;
2405
2406 hci_dev_lock(hdev);
2407
2408 if (rp.max_handles)
2409 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2410
2411 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2412 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2413
2414 hci_dev_unlock(hdev);
2415 return 0;
2416 }
2417
send_cancel(struct hci_dev * hdev,void * data)2418 static int send_cancel(struct hci_dev *hdev, void *data)
2419 {
2420 struct mgmt_pending_cmd *cmd = data;
2421 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2422 struct mgmt_mesh_tx *mesh_tx;
2423
2424 if (!cancel->handle) {
2425 do {
2426 mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2427
2428 if (mesh_tx)
2429 mesh_send_complete(hdev, mesh_tx, false);
2430 } while (mesh_tx);
2431 } else {
2432 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2433
2434 if (mesh_tx && mesh_tx->sk == cmd->sk)
2435 mesh_send_complete(hdev, mesh_tx, false);
2436 }
2437
2438 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2439 0, NULL, 0);
2440
2441 return 0;
2442 }
2443
send_cancel_destroy(struct hci_dev * hdev,void * data,int err)2444 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err)
2445 {
2446 mgmt_pending_free(data);
2447 }
2448
mesh_send_cancel(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2449 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2450 void *data, u16 len)
2451 {
2452 struct mgmt_pending_cmd *cmd;
2453 int err;
2454
2455 if (!lmp_le_capable(hdev) ||
2456 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2458 MGMT_STATUS_NOT_SUPPORTED);
2459
2460 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2462 MGMT_STATUS_REJECTED);
2463
2464 hci_dev_lock(hdev);
2465 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2466 if (!cmd)
2467 err = -ENOMEM;
2468 else
2469 err = hci_cmd_sync_queue(hdev, send_cancel, cmd,
2470 send_cancel_destroy);
2471
2472 if (err < 0) {
2473 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2474 MGMT_STATUS_FAILED);
2475
2476 if (cmd)
2477 mgmt_pending_free(cmd);
2478 }
2479
2480 hci_dev_unlock(hdev);
2481 return err;
2482 }
2483
mesh_send(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2484 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2485 {
2486 struct mgmt_mesh_tx *mesh_tx;
2487 struct mgmt_cp_mesh_send *send = data;
2488 struct mgmt_rp_mesh_read_features rp;
2489 u16 expected_len;
2490 bool sending;
2491 int err = 0;
2492
2493 if (!lmp_le_capable(hdev) ||
2494 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2496 MGMT_STATUS_NOT_SUPPORTED);
2497 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2498 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2499 MGMT_STATUS_REJECTED);
2500
2501 if (!send->adv_data_len || send->adv_data_len > 31)
2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2503 MGMT_STATUS_REJECTED);
2504
2505 expected_len = struct_size(send, adv_data, send->adv_data_len);
2506 if (expected_len != len)
2507 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2508 MGMT_STATUS_INVALID_PARAMS);
2509
2510 hci_dev_lock(hdev);
2511
2512 memset(&rp, 0, sizeof(rp));
2513 rp.max_handles = MESH_HANDLES_MAX;
2514
2515 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2516
2517 if (rp.max_handles <= rp.used_handles) {
2518 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2519 MGMT_STATUS_BUSY);
2520 goto done;
2521 }
2522
2523 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2524 mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2525
2526 if (!mesh_tx)
2527 err = -ENOMEM;
2528 else if (!sending)
2529 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2530 mesh_send_start_complete);
2531
2532 if (err < 0) {
2533 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2535 MGMT_STATUS_FAILED);
2536
2537 if (mesh_tx) {
2538 if (sending)
2539 mgmt_mesh_remove(mesh_tx);
2540 }
2541 } else {
2542 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2543
2544 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2545 &mesh_tx->handle, 1);
2546 }
2547
2548 done:
2549 hci_dev_unlock(hdev);
2550 return err;
2551 }
2552
set_le(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2553 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2554 {
2555 struct mgmt_mode *cp = data;
2556 struct mgmt_pending_cmd *cmd;
2557 int err;
2558 u8 val, enabled;
2559
2560 bt_dev_dbg(hdev, "sock %p", sk);
2561
2562 if (!lmp_le_capable(hdev))
2563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2564 MGMT_STATUS_NOT_SUPPORTED);
2565
2566 if (cp->val != 0x00 && cp->val != 0x01)
2567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2568 MGMT_STATUS_INVALID_PARAMS);
2569
2570 /* Bluetooth single mode LE only controllers or dual-mode
2571 * controllers configured as LE only devices, do not allow
2572 * switching LE off. These have either LE enabled explicitly
2573 * or BR/EDR has been previously switched off.
2574 *
2575 * When trying to enable an already enabled LE, then gracefully
2576 * send a positive response. Trying to disable it however will
2577 * result into rejection.
2578 */
2579 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2580 if (cp->val == 0x01)
2581 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2582
2583 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2584 MGMT_STATUS_REJECTED);
2585 }
2586
2587 hci_dev_lock(hdev);
2588
2589 val = !!cp->val;
2590 enabled = lmp_host_le_capable(hdev);
2591
2592 if (!hdev_is_powered(hdev) || val == enabled) {
2593 bool changed = false;
2594
2595 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2596 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2597 changed = true;
2598 }
2599
2600 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2601 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2602 changed = true;
2603 }
2604
2605 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2606 if (err < 0)
2607 goto unlock;
2608
2609 if (changed)
2610 err = new_settings(hdev, sk);
2611
2612 goto unlock;
2613 }
2614
2615 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2616 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2618 MGMT_STATUS_BUSY);
2619 goto unlock;
2620 }
2621
2622 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2623 if (!cmd)
2624 err = -ENOMEM;
2625 else
2626 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2627 set_le_complete);
2628
2629 if (err < 0) {
2630 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2631 MGMT_STATUS_FAILED);
2632
2633 if (cmd)
2634 mgmt_pending_remove(cmd);
2635 }
2636
2637 unlock:
2638 hci_dev_unlock(hdev);
2639 return err;
2640 }
2641
send_hci_cmd_sync(struct hci_dev * hdev,void * data)2642 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data)
2643 {
2644 struct mgmt_pending_cmd *cmd = data;
2645 struct mgmt_cp_hci_cmd_sync *cp = cmd->param;
2646 struct sk_buff *skb;
2647
2648 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode),
2649 le16_to_cpu(cp->params_len), cp->params,
2650 cp->event, cp->timeout ?
2651 secs_to_jiffies(cp->timeout) :
2652 HCI_CMD_TIMEOUT);
2653 if (IS_ERR(skb)) {
2654 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2655 mgmt_status(PTR_ERR(skb)));
2656 return 0;
2657 }
2658
2659 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0,
2660 skb->data, skb->len);
2661
2662 kfree_skb(skb);
2663
2664 return 0;
2665 }
2666
send_hci_cmd_sync_destroy(struct hci_dev * hdev,void * data,int err)2667 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err)
2668 {
2669 mgmt_pending_free(data);
2670 }
2671
mgmt_hci_cmd_sync(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2672 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev,
2673 void *data, u16 len)
2674 {
2675 struct mgmt_cp_hci_cmd_sync *cp = data;
2676 struct mgmt_pending_cmd *cmd;
2677 int err;
2678
2679 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) +
2680 le16_to_cpu(cp->params_len)))
2681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2682 MGMT_STATUS_INVALID_PARAMS);
2683
2684 /* The HCI command header carries the parameter length in a u8, a
2685 * larger value would be truncated there while the parameters are
2686 * still appended to the frame in full.
2687 */
2688 if (le16_to_cpu(cp->params_len) > U8_MAX)
2689 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2690 MGMT_STATUS_INVALID_PARAMS);
2691
2692 hci_dev_lock(hdev);
2693 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len);
2694 if (!cmd)
2695 err = -ENOMEM;
2696 else
2697 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd,
2698 send_hci_cmd_sync_destroy);
2699
2700 if (err < 0) {
2701 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2702 MGMT_STATUS_FAILED);
2703
2704 if (cmd)
2705 mgmt_pending_free(cmd);
2706 }
2707
2708 hci_dev_unlock(hdev);
2709 return err;
2710 }
2711
2712 /* This is a helper function to test for pending mgmt commands that can
2713 * cause CoD or EIR HCI commands. We can only allow one such pending
2714 * mgmt command at a time since otherwise we cannot easily track what
2715 * the current values are, will be, and based on that calculate if a new
2716 * HCI command needs to be sent and if yes with what value.
2717 */
pending_eir_or_class(struct hci_dev * hdev)2718 static bool pending_eir_or_class(struct hci_dev *hdev)
2719 {
2720 struct mgmt_pending_cmd *cmd;
2721 bool pending = false;
2722
2723 mutex_lock(&hdev->mgmt_pending_lock);
2724
2725 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2726 switch (cmd->opcode) {
2727 case MGMT_OP_ADD_UUID:
2728 case MGMT_OP_REMOVE_UUID:
2729 case MGMT_OP_SET_DEV_CLASS:
2730 case MGMT_OP_SET_LOCAL_NAME:
2731 case MGMT_OP_SET_POWERED:
2732 pending = true;
2733 break;
2734 }
2735
2736 if (pending)
2737 break;
2738 }
2739
2740 mutex_unlock(&hdev->mgmt_pending_lock);
2741
2742 return pending;
2743 }
2744
2745 static const u8 bluetooth_base_uuid[] = {
2746 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2747 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2748 };
2749
get_uuid_size(const u8 * uuid)2750 static u8 get_uuid_size(const u8 *uuid)
2751 {
2752 u32 val;
2753
2754 if (memcmp(uuid, bluetooth_base_uuid, 12))
2755 return 128;
2756
2757 val = get_unaligned_le32(&uuid[12]);
2758 if (val > 0xffff)
2759 return 32;
2760
2761 return 16;
2762 }
2763
mgmt_class_complete(struct hci_dev * hdev,void * data,int err)2764 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2765 {
2766 struct mgmt_pending_cmd *cmd = data;
2767
2768 bt_dev_dbg(hdev, "err %d", err);
2769
2770 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
2771 mgmt_status(err), hdev->dev_class, 3);
2772
2773 mgmt_pending_free(cmd);
2774 }
2775
add_uuid_sync(struct hci_dev * hdev,void * data)2776 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2777 {
2778 int err;
2779
2780 err = hci_update_class_sync(hdev);
2781 if (err)
2782 return err;
2783
2784 return hci_update_eir_sync(hdev);
2785 }
2786
add_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2787 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2788 {
2789 struct mgmt_cp_add_uuid *cp = data;
2790 struct mgmt_pending_cmd *cmd;
2791 struct bt_uuid *uuid;
2792 int err;
2793
2794 bt_dev_dbg(hdev, "sock %p", sk);
2795
2796 hci_dev_lock(hdev);
2797
2798 if (pending_eir_or_class(hdev)) {
2799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2800 MGMT_STATUS_BUSY);
2801 goto failed;
2802 }
2803
2804 uuid = kmalloc_obj(*uuid);
2805 if (!uuid) {
2806 err = -ENOMEM;
2807 goto failed;
2808 }
2809
2810 memcpy(uuid->uuid, cp->uuid, 16);
2811 uuid->svc_hint = cp->svc_hint;
2812 uuid->size = get_uuid_size(cp->uuid);
2813
2814 list_add_tail(&uuid->list, &hdev->uuids);
2815
2816 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2817 if (!cmd) {
2818 err = -ENOMEM;
2819 goto failed;
2820 }
2821
2822 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use
2823 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2824 */
2825 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd,
2826 mgmt_class_complete);
2827 if (err < 0) {
2828 mgmt_pending_free(cmd);
2829 goto failed;
2830 }
2831
2832 failed:
2833 hci_dev_unlock(hdev);
2834 return err;
2835 }
2836
enable_service_cache(struct hci_dev * hdev)2837 static bool enable_service_cache(struct hci_dev *hdev)
2838 {
2839 if (!hdev_is_powered(hdev))
2840 return false;
2841
2842 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2843 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2844 CACHE_TIMEOUT);
2845 return true;
2846 }
2847
2848 return false;
2849 }
2850
remove_uuid_sync(struct hci_dev * hdev,void * data)2851 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2852 {
2853 int err;
2854
2855 err = hci_update_class_sync(hdev);
2856 if (err)
2857 return err;
2858
2859 return hci_update_eir_sync(hdev);
2860 }
2861
remove_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2862 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2863 u16 len)
2864 {
2865 struct mgmt_cp_remove_uuid *cp = data;
2866 struct mgmt_pending_cmd *cmd;
2867 struct bt_uuid *match, *tmp;
2868 static const u8 bt_uuid_any[] = {
2869 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2870 };
2871 int err, found;
2872
2873 bt_dev_dbg(hdev, "sock %p", sk);
2874
2875 hci_dev_lock(hdev);
2876
2877 if (pending_eir_or_class(hdev)) {
2878 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2879 MGMT_STATUS_BUSY);
2880 goto unlock;
2881 }
2882
2883 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2884 hci_uuids_clear(hdev);
2885
2886 if (enable_service_cache(hdev)) {
2887 err = mgmt_cmd_complete(sk, hdev->id,
2888 MGMT_OP_REMOVE_UUID,
2889 0, hdev->dev_class, 3);
2890 goto unlock;
2891 }
2892
2893 goto update_class;
2894 }
2895
2896 found = 0;
2897
2898 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2899 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2900 continue;
2901
2902 list_del(&match->list);
2903 kfree(match);
2904 found++;
2905 }
2906
2907 if (found == 0) {
2908 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2909 MGMT_STATUS_INVALID_PARAMS);
2910 goto unlock;
2911 }
2912
2913 update_class:
2914 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2915 if (!cmd) {
2916 err = -ENOMEM;
2917 goto unlock;
2918 }
2919
2920 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use
2921 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2922 */
2923 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd,
2924 mgmt_class_complete);
2925 if (err < 0)
2926 mgmt_pending_free(cmd);
2927
2928 unlock:
2929 hci_dev_unlock(hdev);
2930 return err;
2931 }
2932
set_class_sync(struct hci_dev * hdev,void * data)2933 static int set_class_sync(struct hci_dev *hdev, void *data)
2934 {
2935 int err = 0;
2936
2937 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2938 cancel_delayed_work_sync(&hdev->service_cache);
2939 err = hci_update_eir_sync(hdev);
2940 }
2941
2942 if (err)
2943 return err;
2944
2945 return hci_update_class_sync(hdev);
2946 }
2947
set_dev_class(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2948 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2949 u16 len)
2950 {
2951 struct mgmt_cp_set_dev_class *cp = data;
2952 struct mgmt_pending_cmd *cmd;
2953 int err;
2954
2955 bt_dev_dbg(hdev, "sock %p", sk);
2956
2957 if (!lmp_bredr_capable(hdev))
2958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2959 MGMT_STATUS_NOT_SUPPORTED);
2960
2961 hci_dev_lock(hdev);
2962
2963 if (pending_eir_or_class(hdev)) {
2964 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2965 MGMT_STATUS_BUSY);
2966 goto unlock;
2967 }
2968
2969 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2970 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2971 MGMT_STATUS_INVALID_PARAMS);
2972 goto unlock;
2973 }
2974
2975 hdev->major_class = cp->major;
2976 hdev->minor_class = cp->minor;
2977
2978 if (!hdev_is_powered(hdev)) {
2979 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2980 hdev->dev_class, 3);
2981 goto unlock;
2982 }
2983
2984 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2985 if (!cmd) {
2986 err = -ENOMEM;
2987 goto unlock;
2988 }
2989
2990 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use
2991 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2992 */
2993 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd,
2994 mgmt_class_complete);
2995 if (err < 0)
2996 mgmt_pending_free(cmd);
2997
2998 unlock:
2999 hci_dev_unlock(hdev);
3000 return err;
3001 }
3002
load_link_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3003 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3004 u16 len)
3005 {
3006 struct mgmt_cp_load_link_keys *cp = data;
3007 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
3008 sizeof(struct mgmt_link_key_info));
3009 u16 key_count, expected_len;
3010 bool changed;
3011 int i;
3012
3013 bt_dev_dbg(hdev, "sock %p", sk);
3014
3015 if (!lmp_bredr_capable(hdev))
3016 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3017 MGMT_STATUS_NOT_SUPPORTED);
3018
3019 key_count = __le16_to_cpu(cp->key_count);
3020 if (key_count > max_key_count) {
3021 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
3022 key_count);
3023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3024 MGMT_STATUS_INVALID_PARAMS);
3025 }
3026
3027 expected_len = struct_size(cp, keys, key_count);
3028 if (expected_len != len) {
3029 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
3030 expected_len, len);
3031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3032 MGMT_STATUS_INVALID_PARAMS);
3033 }
3034
3035 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
3036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3037 MGMT_STATUS_INVALID_PARAMS);
3038
3039 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
3040 key_count);
3041
3042 hci_dev_lock(hdev);
3043
3044 hci_link_keys_clear(hdev);
3045
3046 if (cp->debug_keys)
3047 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
3048 else
3049 changed = hci_dev_test_and_clear_flag(hdev,
3050 HCI_KEEP_DEBUG_KEYS);
3051
3052 if (changed)
3053 new_settings(hdev, NULL);
3054
3055 for (i = 0; i < key_count; i++) {
3056 struct mgmt_link_key_info *key = &cp->keys[i];
3057
3058 if (hci_is_blocked_key(hdev,
3059 HCI_BLOCKED_KEY_TYPE_LINKKEY,
3060 key->val)) {
3061 bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
3062 &key->addr.bdaddr);
3063 continue;
3064 }
3065
3066 if (key->addr.type != BDADDR_BREDR) {
3067 bt_dev_warn(hdev,
3068 "Invalid link address type %u for %pMR",
3069 key->addr.type, &key->addr.bdaddr);
3070 continue;
3071 }
3072
3073 if (key->type > 0x08) {
3074 bt_dev_warn(hdev, "Invalid link key type %u for %pMR",
3075 key->type, &key->addr.bdaddr);
3076 continue;
3077 }
3078
3079 /* Always ignore debug keys and require a new pairing if
3080 * the user wants to use them.
3081 */
3082 if (key->type == HCI_LK_DEBUG_COMBINATION)
3083 continue;
3084
3085 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3086 key->type, key->pin_len, NULL);
3087 }
3088
3089 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
3090
3091 hci_dev_unlock(hdev);
3092
3093 return 0;
3094 }
3095
device_unpaired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,struct sock * skip_sk)3096 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
3097 u8 addr_type, struct sock *skip_sk)
3098 {
3099 struct mgmt_ev_device_unpaired ev;
3100
3101 bacpy(&ev.addr.bdaddr, bdaddr);
3102 ev.addr.type = addr_type;
3103
3104 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
3105 skip_sk);
3106 }
3107
unpair_device_complete(struct hci_dev * hdev,void * data,int err)3108 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
3109 {
3110 struct mgmt_pending_cmd *cmd = data;
3111 struct mgmt_cp_unpair_device *cp = cmd->param;
3112
3113 if (!err)
3114 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3115
3116 cmd->cmd_complete(cmd, err);
3117 mgmt_pending_free(cmd);
3118 }
3119
unpair_device_sync(struct hci_dev * hdev,void * data)3120 static int unpair_device_sync(struct hci_dev *hdev, void *data)
3121 {
3122 struct mgmt_pending_cmd *cmd = data;
3123 struct mgmt_cp_unpair_device *cp = cmd->param;
3124 struct hci_conn *conn;
3125
3126 hci_dev_lock(hdev);
3127
3128 if (cp->addr.type == BDADDR_BREDR)
3129 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3130 &cp->addr.bdaddr);
3131 else
3132 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3133 le_addr_type(cp->addr.type));
3134
3135 if (conn)
3136 hci_conn_get(conn);
3137
3138 hci_dev_unlock(hdev);
3139
3140 if (!conn)
3141 return 0;
3142
3143 /* Disregard any possible error since the likes of hci_abort_conn_sync
3144 * will clean up the connection no matter the error.
3145 */
3146 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3147 hci_conn_put(conn);
3148
3149 return 0;
3150 }
3151
unpair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3152 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3153 u16 len)
3154 {
3155 struct mgmt_cp_unpair_device *cp = data;
3156 struct mgmt_rp_unpair_device rp;
3157 struct hci_conn_params *params;
3158 struct mgmt_pending_cmd *cmd;
3159 struct hci_conn *conn;
3160 u8 addr_type;
3161 int err;
3162
3163 memset(&rp, 0, sizeof(rp));
3164 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3165 rp.addr.type = cp->addr.type;
3166
3167 if (!bdaddr_type_is_valid(cp->addr.type))
3168 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3169 MGMT_STATUS_INVALID_PARAMS,
3170 &rp, sizeof(rp));
3171
3172 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3173 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3174 MGMT_STATUS_INVALID_PARAMS,
3175 &rp, sizeof(rp));
3176
3177 hci_dev_lock(hdev);
3178
3179 if (!hdev_is_powered(hdev)) {
3180 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3181 MGMT_STATUS_NOT_POWERED, &rp,
3182 sizeof(rp));
3183 goto unlock;
3184 }
3185
3186 if (cp->addr.type == BDADDR_BREDR) {
3187 /* If disconnection is requested, then look up the
3188 * connection. If the remote device is connected, it
3189 * will be later used to terminate the link.
3190 *
3191 * Setting it to NULL explicitly will cause no
3192 * termination of the link.
3193 */
3194 if (cp->disconnect)
3195 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3196 &cp->addr.bdaddr);
3197 else
3198 conn = NULL;
3199
3200 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3201 if (err < 0) {
3202 err = mgmt_cmd_complete(sk, hdev->id,
3203 MGMT_OP_UNPAIR_DEVICE,
3204 MGMT_STATUS_NOT_PAIRED, &rp,
3205 sizeof(rp));
3206 goto unlock;
3207 }
3208
3209 goto done;
3210 }
3211
3212 /* LE address type */
3213 addr_type = le_addr_type(cp->addr.type);
3214
3215 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3216 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3217 if (err < 0) {
3218 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3219 MGMT_STATUS_NOT_PAIRED, &rp,
3220 sizeof(rp));
3221 goto unlock;
3222 }
3223
3224 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3225 if (!conn) {
3226 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3227 goto done;
3228 }
3229
3230
3231 /* Defer clearing up the connection parameters until closing to
3232 * give a chance of keeping them if a repairing happens.
3233 */
3234 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3235
3236 /* Disable auto-connection parameters if present */
3237 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3238 if (params) {
3239 if (params->explicit_connect)
3240 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3241 else
3242 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3243 }
3244
3245 /* If disconnection is not requested, then clear the connection
3246 * variable so that the link is not terminated.
3247 */
3248 if (!cp->disconnect)
3249 conn = NULL;
3250
3251 done:
3252 /* If the connection variable is set, then termination of the
3253 * link is requested.
3254 */
3255 if (!conn) {
3256 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3257 &rp, sizeof(rp));
3258 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3259 goto unlock;
3260 }
3261
3262 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3263 sizeof(*cp));
3264 if (!cmd) {
3265 err = -ENOMEM;
3266 goto unlock;
3267 }
3268
3269 cmd->cmd_complete = addr_cmd_complete;
3270
3271 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3272 unpair_device_complete);
3273 if (err < 0)
3274 mgmt_pending_free(cmd);
3275
3276 unlock:
3277 hci_dev_unlock(hdev);
3278 return err;
3279 }
3280
disconnect_complete(struct hci_dev * hdev,void * data,int err)3281 static void disconnect_complete(struct hci_dev *hdev, void *data, int err)
3282 {
3283 struct mgmt_pending_cmd *cmd = data;
3284
3285 cmd->cmd_complete(cmd, mgmt_status(err));
3286 mgmt_pending_free(cmd);
3287 }
3288
disconnect_sync(struct hci_dev * hdev,void * data)3289 static int disconnect_sync(struct hci_dev *hdev, void *data)
3290 {
3291 struct mgmt_pending_cmd *cmd = data;
3292 struct mgmt_cp_disconnect *cp = cmd->param;
3293 struct hci_conn *conn;
3294
3295 hci_dev_lock(hdev);
3296
3297 if (cp->addr.type == BDADDR_BREDR)
3298 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3299 &cp->addr.bdaddr);
3300 else
3301 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3302 le_addr_type(cp->addr.type));
3303
3304 if (conn)
3305 hci_conn_get(conn);
3306
3307 hci_dev_unlock(hdev);
3308
3309 if (!conn)
3310 return -ENOTCONN;
3311
3312 /* Disregard any possible error since the likes of hci_abort_conn_sync
3313 * will clean up the connection no matter the error.
3314 */
3315 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3316 hci_conn_put(conn);
3317
3318 return 0;
3319 }
3320
disconnect(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3321 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3322 u16 len)
3323 {
3324 struct mgmt_cp_disconnect *cp = data;
3325 struct mgmt_rp_disconnect rp;
3326 struct mgmt_pending_cmd *cmd;
3327 int err;
3328
3329 bt_dev_dbg(hdev, "sock %p", sk);
3330
3331 memset(&rp, 0, sizeof(rp));
3332 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3333 rp.addr.type = cp->addr.type;
3334
3335 if (!bdaddr_type_is_valid(cp->addr.type))
3336 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3337 MGMT_STATUS_INVALID_PARAMS,
3338 &rp, sizeof(rp));
3339
3340 hci_dev_lock(hdev);
3341
3342 if (!test_bit(HCI_UP, &hdev->flags)) {
3343 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3344 MGMT_STATUS_NOT_POWERED, &rp,
3345 sizeof(rp));
3346 goto failed;
3347 }
3348
3349 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3350 if (!cmd) {
3351 err = -ENOMEM;
3352 goto failed;
3353 }
3354
3355 cmd->cmd_complete = generic_cmd_complete;
3356
3357 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd,
3358 disconnect_complete);
3359 if (err < 0)
3360 mgmt_pending_free(cmd);
3361
3362 failed:
3363 hci_dev_unlock(hdev);
3364 return err;
3365 }
3366
link_to_bdaddr(u8 link_type,u8 addr_type)3367 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3368 {
3369 switch (link_type) {
3370 case CIS_LINK:
3371 case BIS_LINK:
3372 case PA_LINK:
3373 case LE_LINK:
3374 switch (addr_type) {
3375 case ADDR_LE_DEV_PUBLIC:
3376 return BDADDR_LE_PUBLIC;
3377
3378 default:
3379 /* Fallback to LE Random address type */
3380 return BDADDR_LE_RANDOM;
3381 }
3382
3383 default:
3384 /* Fallback to BR/EDR type */
3385 return BDADDR_BREDR;
3386 }
3387 }
3388
get_connections(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)3389 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3390 u16 data_len)
3391 {
3392 struct mgmt_rp_get_connections *rp;
3393 struct hci_conn *c;
3394 int err;
3395 u16 i;
3396
3397 bt_dev_dbg(hdev, "sock %p", sk);
3398
3399 hci_dev_lock(hdev);
3400
3401 if (!hdev_is_powered(hdev)) {
3402 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3403 MGMT_STATUS_NOT_POWERED);
3404 goto unlock;
3405 }
3406
3407 i = 0;
3408 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3409 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3410 i++;
3411 }
3412
3413 rp = kmalloc_flex(*rp, addr, i);
3414 if (!rp) {
3415 err = -ENOMEM;
3416 goto unlock;
3417 }
3418
3419 i = 0;
3420 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3421 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3422 continue;
3423 bacpy(&rp->addr[i].bdaddr, &c->dst);
3424 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3425 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3426 continue;
3427 i++;
3428 }
3429
3430 rp->conn_count = cpu_to_le16(i);
3431
3432 /* Recalculate length in case of filtered SCO connections, etc */
3433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3434 struct_size(rp, addr, i));
3435
3436 kfree(rp);
3437
3438 unlock:
3439 hci_dev_unlock(hdev);
3440 return err;
3441 }
3442
send_pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_pin_code_neg_reply * cp)3443 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3444 struct mgmt_cp_pin_code_neg_reply *cp)
3445 {
3446 struct mgmt_pending_cmd *cmd;
3447 int err;
3448
3449 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3450 sizeof(*cp));
3451 if (!cmd)
3452 return -ENOMEM;
3453
3454 cmd->cmd_complete = addr_cmd_complete;
3455
3456 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3457 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3458 if (err < 0)
3459 mgmt_pending_remove(cmd);
3460
3461 return err;
3462 }
3463
pin_code_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3464 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3465 u16 len)
3466 {
3467 struct hci_conn *conn;
3468 struct mgmt_cp_pin_code_reply *cp = data;
3469 struct hci_cp_pin_code_reply reply;
3470 struct mgmt_pending_cmd *cmd;
3471 int err;
3472
3473 bt_dev_dbg(hdev, "sock %p", sk);
3474
3475 hci_dev_lock(hdev);
3476
3477 if (!hdev_is_powered(hdev)) {
3478 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3479 MGMT_STATUS_NOT_POWERED);
3480 goto failed;
3481 }
3482
3483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3484 if (!conn) {
3485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3486 MGMT_STATUS_NOT_CONNECTED);
3487 goto failed;
3488 }
3489
3490 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3491 struct mgmt_cp_pin_code_neg_reply ncp;
3492
3493 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3494
3495 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3496
3497 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3498 if (err >= 0)
3499 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3500 MGMT_STATUS_INVALID_PARAMS);
3501
3502 goto failed;
3503 }
3504
3505 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3506 if (!cmd) {
3507 err = -ENOMEM;
3508 goto failed;
3509 }
3510
3511 cmd->cmd_complete = addr_cmd_complete;
3512
3513 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3514 reply.pin_len = cp->pin_len;
3515 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3516
3517 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3518 if (err < 0)
3519 mgmt_pending_remove(cmd);
3520
3521 failed:
3522 hci_dev_unlock(hdev);
3523 return err;
3524 }
3525
set_io_capability(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3526 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3527 u16 len)
3528 {
3529 struct mgmt_cp_set_io_capability *cp = data;
3530
3531 bt_dev_dbg(hdev, "sock %p", sk);
3532
3533 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3535 MGMT_STATUS_INVALID_PARAMS);
3536
3537 hci_dev_lock(hdev);
3538
3539 hdev->io_capability = cp->io_capability;
3540
3541 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3542
3543 hci_dev_unlock(hdev);
3544
3545 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3546 NULL, 0);
3547 }
3548
remove_pairing(struct hci_conn * conn)3549 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn)
3550 {
3551 struct hci_dev *hdev = conn->hdev;
3552 struct mgmt_pending_cmd *cmd;
3553
3554 mutex_lock(&hdev->mgmt_pending_lock);
3555
3556 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3557 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3558 continue;
3559
3560 if (cmd->user_data != conn)
3561 continue;
3562
3563 list_del(&cmd->list);
3564 mutex_unlock(&hdev->mgmt_pending_lock);
3565 return cmd;
3566 }
3567
3568 mutex_unlock(&hdev->mgmt_pending_lock);
3569
3570 return NULL;
3571 }
3572
remove_pairing_by_addr(struct hci_dev * hdev,bdaddr_t * bdaddr)3573 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev,
3574 bdaddr_t *bdaddr)
3575 {
3576 struct mgmt_pending_cmd *cmd;
3577 struct hci_conn *conn;
3578
3579 mutex_lock(&hdev->mgmt_pending_lock);
3580
3581 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3582 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3583 continue;
3584
3585 conn = cmd->user_data;
3586 if (bacmp(bdaddr, &conn->dst) != 0)
3587 continue;
3588
3589 list_del(&cmd->list);
3590 mutex_unlock(&hdev->mgmt_pending_lock);
3591 return cmd;
3592 }
3593
3594 mutex_unlock(&hdev->mgmt_pending_lock);
3595
3596 return NULL;
3597 }
3598
pairing_complete(struct mgmt_pending_cmd * cmd,u8 status)3599 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3600 {
3601 struct mgmt_rp_pair_device rp;
3602 struct hci_conn *conn = cmd->user_data;
3603 int err;
3604
3605 bacpy(&rp.addr.bdaddr, &conn->dst);
3606 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3607
3608 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE,
3609 status, &rp, sizeof(rp));
3610
3611 /* So we don't get further callbacks for this connection */
3612 conn->connect_cfm_cb = NULL;
3613 conn->security_cfm_cb = NULL;
3614 conn->disconn_cfm_cb = NULL;
3615
3616 hci_conn_drop(conn);
3617
3618 /* The device is paired so there is no need to remove
3619 * its connection parameters anymore.
3620 */
3621 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3622
3623 hci_conn_put(conn);
3624
3625 return err;
3626 }
3627
mgmt_smp_complete(struct hci_conn * conn,bool complete)3628 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3629 {
3630 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3631 struct mgmt_pending_cmd *cmd;
3632
3633 cmd = remove_pairing(conn);
3634 if (cmd) {
3635 cmd->cmd_complete(cmd, status);
3636 mgmt_pending_free(cmd);
3637 }
3638 }
3639
pairing_complete_cb(struct hci_conn * conn,u8 status)3640 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3641 {
3642 struct mgmt_pending_cmd *cmd;
3643
3644 BT_DBG("status %u", status);
3645
3646 cmd = remove_pairing(conn);
3647 if (!cmd) {
3648 BT_DBG("Unable to find a pending command");
3649 return;
3650 }
3651
3652 cmd->cmd_complete(cmd, mgmt_status(status));
3653 mgmt_pending_free(cmd);
3654 }
3655
le_pairing_complete_cb(struct hci_conn * conn,u8 status)3656 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3657 {
3658 struct mgmt_pending_cmd *cmd;
3659
3660 BT_DBG("status %u", status);
3661
3662 if (!status)
3663 return;
3664
3665 cmd = remove_pairing(conn);
3666 if (!cmd) {
3667 BT_DBG("Unable to find a pending command");
3668 return;
3669 }
3670
3671 cmd->cmd_complete(cmd, mgmt_status(status));
3672 mgmt_pending_free(cmd);
3673 }
3674
pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3675 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3676 u16 len)
3677 {
3678 struct mgmt_cp_pair_device *cp = data;
3679 struct mgmt_rp_pair_device rp;
3680 struct mgmt_pending_cmd *cmd;
3681 u8 sec_level, auth_type;
3682 struct hci_conn *conn;
3683 int err;
3684
3685 bt_dev_dbg(hdev, "sock %p", sk);
3686
3687 memset(&rp, 0, sizeof(rp));
3688 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3689 rp.addr.type = cp->addr.type;
3690
3691 if (!bdaddr_type_is_valid(cp->addr.type))
3692 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3693 MGMT_STATUS_INVALID_PARAMS,
3694 &rp, sizeof(rp));
3695
3696 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3697 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3698 MGMT_STATUS_INVALID_PARAMS,
3699 &rp, sizeof(rp));
3700
3701 hci_dev_lock(hdev);
3702
3703 if (!hdev_is_powered(hdev)) {
3704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3705 MGMT_STATUS_NOT_POWERED, &rp,
3706 sizeof(rp));
3707 goto unlock;
3708 }
3709
3710 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3712 MGMT_STATUS_ALREADY_PAIRED, &rp,
3713 sizeof(rp));
3714 goto unlock;
3715 }
3716
3717 sec_level = BT_SECURITY_MEDIUM;
3718 auth_type = HCI_AT_DEDICATED_BONDING;
3719
3720 if (cp->addr.type == BDADDR_BREDR) {
3721 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3722 auth_type, CONN_REASON_PAIR_DEVICE,
3723 HCI_ACL_CONN_TIMEOUT);
3724 } else {
3725 u8 addr_type = le_addr_type(cp->addr.type);
3726 struct hci_conn_params *p;
3727
3728 /* When pairing a new device, it is expected to remember
3729 * this device for future connections. Adding the connection
3730 * parameter information ahead of time allows tracking
3731 * of the peripheral preferred values and will speed up any
3732 * further connection establishment.
3733 *
3734 * If connection parameters already exist, then they
3735 * will be kept and this function does nothing.
3736 */
3737 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3738 if (!p) {
3739 err = -EIO;
3740 goto unlock;
3741 }
3742
3743 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3744 p->auto_connect = HCI_AUTO_CONN_DISABLED;
3745
3746 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3747 sec_level, HCI_LE_CONN_TIMEOUT,
3748 CONN_REASON_PAIR_DEVICE);
3749 }
3750
3751 if (IS_ERR(conn)) {
3752 int status;
3753
3754 if (PTR_ERR(conn) == -EBUSY)
3755 status = MGMT_STATUS_BUSY;
3756 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3757 status = MGMT_STATUS_NOT_SUPPORTED;
3758 else if (PTR_ERR(conn) == -ECONNREFUSED)
3759 status = MGMT_STATUS_REJECTED;
3760 else
3761 status = MGMT_STATUS_CONNECT_FAILED;
3762
3763 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3764 status, &rp, sizeof(rp));
3765 goto unlock;
3766 }
3767
3768 if (conn->connect_cfm_cb) {
3769 hci_conn_drop(conn);
3770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3771 MGMT_STATUS_BUSY, &rp, sizeof(rp));
3772 goto unlock;
3773 }
3774
3775 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3776 if (!cmd) {
3777 err = -ENOMEM;
3778 hci_conn_drop(conn);
3779 goto unlock;
3780 }
3781
3782 cmd->cmd_complete = pairing_complete;
3783
3784 /* For LE, just connecting isn't a proof that the pairing finished */
3785 if (cp->addr.type == BDADDR_BREDR) {
3786 conn->connect_cfm_cb = pairing_complete_cb;
3787 conn->security_cfm_cb = pairing_complete_cb;
3788 conn->disconn_cfm_cb = pairing_complete_cb;
3789 } else {
3790 conn->connect_cfm_cb = le_pairing_complete_cb;
3791 conn->security_cfm_cb = le_pairing_complete_cb;
3792 conn->disconn_cfm_cb = le_pairing_complete_cb;
3793 }
3794
3795 conn->io_capability = cp->io_cap;
3796 cmd->user_data = hci_conn_get(conn);
3797
3798 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3799 hci_conn_security(conn, sec_level, auth_type, true)) {
3800 cmd->cmd_complete(cmd, 0);
3801 mgmt_pending_remove(cmd);
3802 }
3803
3804 err = 0;
3805
3806 unlock:
3807 hci_dev_unlock(hdev);
3808 return err;
3809 }
3810
cancel_pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3811 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3812 u16 len)
3813 {
3814 struct mgmt_addr_info *addr = data;
3815 struct mgmt_pending_cmd *cmd;
3816 struct hci_conn *conn;
3817 int err;
3818
3819 bt_dev_dbg(hdev, "sock %p", sk);
3820
3821 hci_dev_lock(hdev);
3822
3823 if (!hdev_is_powered(hdev)) {
3824 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3825 MGMT_STATUS_NOT_POWERED);
3826 goto unlock;
3827 }
3828
3829 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr);
3830 if (!cmd) {
3831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3832 MGMT_STATUS_INVALID_PARAMS);
3833 goto unlock;
3834 }
3835
3836 conn = hci_conn_get(cmd->user_data);
3837
3838 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3839 mgmt_pending_free(cmd);
3840
3841 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3842 addr, sizeof(*addr));
3843
3844 /* Since user doesn't want to proceed with the connection, abort any
3845 * ongoing pairing and then terminate the link if it was created
3846 * because of the pair device action.
3847 */
3848 if (addr->type == BDADDR_BREDR)
3849 hci_remove_link_key(hdev, &addr->bdaddr);
3850 else
3851 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3852 le_addr_type(addr->type));
3853
3854 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3855 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3856
3857 hci_conn_put(conn);
3858
3859 unlock:
3860 hci_dev_unlock(hdev);
3861 return err;
3862 }
3863
user_pairing_resp(struct sock * sk,struct hci_dev * hdev,struct mgmt_addr_info * addr,u16 mgmt_op,u16 hci_op,__le32 passkey)3864 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3865 struct mgmt_addr_info *addr, u16 mgmt_op,
3866 u16 hci_op, __le32 passkey)
3867 {
3868 struct mgmt_pending_cmd *cmd;
3869 struct hci_conn *conn;
3870 int err;
3871
3872 hci_dev_lock(hdev);
3873
3874 if (!hdev_is_powered(hdev)) {
3875 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3876 MGMT_STATUS_NOT_POWERED, addr,
3877 sizeof(*addr));
3878 goto done;
3879 }
3880
3881 if (addr->type == BDADDR_BREDR)
3882 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3883 else
3884 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3885 le_addr_type(addr->type));
3886
3887 if (!conn) {
3888 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3889 MGMT_STATUS_NOT_CONNECTED, addr,
3890 sizeof(*addr));
3891 goto done;
3892 }
3893
3894 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3895 lockdep_assert_held(&conn->hdev->lock);
3896
3897 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3898 if (!err)
3899 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3900 MGMT_STATUS_SUCCESS, addr,
3901 sizeof(*addr));
3902 else
3903 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3904 MGMT_STATUS_FAILED, addr,
3905 sizeof(*addr));
3906
3907 goto done;
3908 }
3909
3910 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3911 if (!cmd) {
3912 err = -ENOMEM;
3913 goto done;
3914 }
3915
3916 cmd->cmd_complete = addr_cmd_complete;
3917
3918 /* Continue with pairing via HCI */
3919 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3920 struct hci_cp_user_passkey_reply cp;
3921
3922 bacpy(&cp.bdaddr, &addr->bdaddr);
3923 cp.passkey = passkey;
3924 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3925 } else
3926 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3927 &addr->bdaddr);
3928
3929 if (err < 0)
3930 mgmt_pending_remove(cmd);
3931
3932 done:
3933 hci_dev_unlock(hdev);
3934 return err;
3935 }
3936
pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3937 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3938 void *data, u16 len)
3939 {
3940 struct mgmt_cp_pin_code_neg_reply *cp = data;
3941
3942 bt_dev_dbg(hdev, "sock %p", sk);
3943
3944 return user_pairing_resp(sk, hdev, &cp->addr,
3945 MGMT_OP_PIN_CODE_NEG_REPLY,
3946 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3947 }
3948
user_confirm_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3949 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3950 u16 len)
3951 {
3952 struct mgmt_cp_user_confirm_reply *cp = data;
3953
3954 bt_dev_dbg(hdev, "sock %p", sk);
3955
3956 if (len != sizeof(*cp))
3957 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3958 MGMT_STATUS_INVALID_PARAMS);
3959
3960 return user_pairing_resp(sk, hdev, &cp->addr,
3961 MGMT_OP_USER_CONFIRM_REPLY,
3962 HCI_OP_USER_CONFIRM_REPLY, 0);
3963 }
3964
user_confirm_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3965 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3966 void *data, u16 len)
3967 {
3968 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3969
3970 bt_dev_dbg(hdev, "sock %p", sk);
3971
3972 return user_pairing_resp(sk, hdev, &cp->addr,
3973 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3974 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3975 }
3976
user_passkey_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3977 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3978 u16 len)
3979 {
3980 struct mgmt_cp_user_passkey_reply *cp = data;
3981
3982 bt_dev_dbg(hdev, "sock %p", sk);
3983
3984 return user_pairing_resp(sk, hdev, &cp->addr,
3985 MGMT_OP_USER_PASSKEY_REPLY,
3986 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3987 }
3988
user_passkey_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3989 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3990 void *data, u16 len)
3991 {
3992 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3993
3994 bt_dev_dbg(hdev, "sock %p", sk);
3995
3996 return user_pairing_resp(sk, hdev, &cp->addr,
3997 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3998 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3999 }
4000
adv_expire_sync(struct hci_dev * hdev,u32 flags)4001 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
4002 {
4003 struct adv_info *adv_instance;
4004
4005 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
4006 if (!adv_instance)
4007 return 0;
4008
4009 /* stop if current instance doesn't need to be changed */
4010 if (!(adv_instance->flags & flags))
4011 return 0;
4012
4013 cancel_adv_timeout(hdev);
4014
4015 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
4016 if (!adv_instance)
4017 return 0;
4018
4019 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
4020
4021 return 0;
4022 }
4023
name_changed_sync(struct hci_dev * hdev,void * data)4024 static int name_changed_sync(struct hci_dev *hdev, void *data)
4025 {
4026 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
4027 }
4028
set_name_complete(struct hci_dev * hdev,void * data,int err)4029 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
4030 {
4031 struct mgmt_pending_cmd *cmd = data;
4032 struct mgmt_cp_set_local_name *cp;
4033 u8 status = mgmt_status(err);
4034
4035 bt_dev_dbg(hdev, "err %d", err);
4036
4037 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
4038 return;
4039
4040 cp = cmd->param;
4041
4042 if (status) {
4043 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4044 status);
4045 } else {
4046 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4047 cp, sizeof(*cp));
4048
4049 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4050 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
4051 }
4052
4053 mgmt_pending_free(cmd);
4054 }
4055
set_name_sync(struct hci_dev * hdev,void * data)4056 static int set_name_sync(struct hci_dev *hdev, void *data)
4057 {
4058 struct mgmt_pending_cmd *cmd = data;
4059 struct mgmt_cp_set_local_name cp;
4060
4061 mutex_lock(&hdev->mgmt_pending_lock);
4062
4063 if (!__mgmt_pending_listed(hdev, cmd)) {
4064 mutex_unlock(&hdev->mgmt_pending_lock);
4065 return -ECANCELED;
4066 }
4067
4068 memcpy(&cp, cmd->param, sizeof(cp));
4069
4070 mutex_unlock(&hdev->mgmt_pending_lock);
4071
4072 if (lmp_bredr_capable(hdev)) {
4073 hci_update_name_sync(hdev, cp.name);
4074 hci_update_eir_sync(hdev);
4075 }
4076
4077 /* The name is stored in the scan response data and so
4078 * no need to update the advertising data here.
4079 */
4080 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
4081 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
4082
4083 return 0;
4084 }
4085
set_local_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4086 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
4087 u16 len)
4088 {
4089 struct mgmt_cp_set_local_name *cp = data;
4090 struct mgmt_pending_cmd *cmd;
4091 int err;
4092
4093 bt_dev_dbg(hdev, "sock %p", sk);
4094
4095 hci_dev_lock(hdev);
4096
4097 /* If the old values are the same as the new ones just return a
4098 * direct command complete event.
4099 */
4100 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
4101 !memcmp(hdev->short_name, cp->short_name,
4102 sizeof(hdev->short_name))) {
4103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4104 data, len);
4105 goto failed;
4106 }
4107
4108 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) {
4109 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4110 MGMT_STATUS_BUSY);
4111 goto failed;
4112 }
4113
4114 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
4115
4116 if (!hdev_is_powered(hdev)) {
4117 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
4118
4119 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4120 data, len);
4121 if (err < 0)
4122 goto failed;
4123
4124 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
4125 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
4126 ext_info_changed(hdev, sk);
4127
4128 goto failed;
4129 }
4130
4131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
4132 if (!cmd)
4133 err = -ENOMEM;
4134 else
4135 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
4136 set_name_complete);
4137
4138 if (err < 0) {
4139 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4140 MGMT_STATUS_FAILED);
4141
4142 if (cmd)
4143 mgmt_pending_remove(cmd);
4144
4145 goto failed;
4146 }
4147
4148 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
4149
4150 failed:
4151 hci_dev_unlock(hdev);
4152 return err;
4153 }
4154
appearance_changed_sync(struct hci_dev * hdev,void * data)4155 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
4156 {
4157 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
4158 }
4159
set_appearance(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4160 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
4161 u16 len)
4162 {
4163 struct mgmt_cp_set_appearance *cp = data;
4164 u16 appearance;
4165 int err;
4166
4167 bt_dev_dbg(hdev, "sock %p", sk);
4168
4169 if (!lmp_le_capable(hdev))
4170 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
4171 MGMT_STATUS_NOT_SUPPORTED);
4172
4173 appearance = le16_to_cpu(cp->appearance);
4174
4175 hci_dev_lock(hdev);
4176
4177 if (hdev->appearance != appearance) {
4178 hdev->appearance = appearance;
4179
4180 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4181 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
4182 NULL);
4183
4184 ext_info_changed(hdev, sk);
4185 }
4186
4187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
4188 0);
4189
4190 hci_dev_unlock(hdev);
4191
4192 return err;
4193 }
4194
get_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4195 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4196 void *data, u16 len)
4197 {
4198 struct mgmt_rp_get_phy_configuration rp;
4199
4200 bt_dev_dbg(hdev, "sock %p", sk);
4201
4202 hci_dev_lock(hdev);
4203
4204 memset(&rp, 0, sizeof(rp));
4205
4206 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
4207 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
4208 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
4209
4210 hci_dev_unlock(hdev);
4211
4212 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
4213 &rp, sizeof(rp));
4214 }
4215
mgmt_phy_configuration_changed(struct hci_dev * hdev,struct sock * skip)4216 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
4217 {
4218 struct mgmt_ev_phy_configuration_changed ev;
4219
4220 memset(&ev, 0, sizeof(ev));
4221
4222 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
4223
4224 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
4225 sizeof(ev), skip);
4226 }
4227
set_default_phy_complete(struct hci_dev * hdev,void * data,int err)4228 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
4229 {
4230 struct mgmt_pending_cmd *cmd = data;
4231 struct sk_buff *skb;
4232 u8 status = mgmt_status(err);
4233
4234 skb = cmd->skb;
4235
4236 if (!status) {
4237 if (!skb)
4238 status = MGMT_STATUS_FAILED;
4239 else if (IS_ERR(skb))
4240 status = mgmt_status(PTR_ERR(skb));
4241 else
4242 status = mgmt_status(skb->data[0]);
4243 }
4244
4245 bt_dev_dbg(hdev, "status %d", status);
4246
4247 if (status) {
4248 mgmt_cmd_status(cmd->sk, hdev->id,
4249 MGMT_OP_SET_PHY_CONFIGURATION, status);
4250 } else {
4251 mgmt_cmd_complete(cmd->sk, hdev->id,
4252 MGMT_OP_SET_PHY_CONFIGURATION, 0,
4253 NULL, 0);
4254
4255 mgmt_phy_configuration_changed(hdev, cmd->sk);
4256 }
4257
4258 if (skb && !IS_ERR(skb))
4259 kfree_skb(skb);
4260
4261 mgmt_pending_free(cmd);
4262 }
4263
set_default_phy_sync(struct hci_dev * hdev,void * data)4264 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4265 {
4266 struct mgmt_pending_cmd *cmd = data;
4267 struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4268 struct hci_cp_le_set_default_phy cp_phy;
4269 u32 selected_phys;
4270
4271 selected_phys = __le32_to_cpu(cp->selected_phys);
4272
4273 memset(&cp_phy, 0, sizeof(cp_phy));
4274
4275 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4276 cp_phy.all_phys |= 0x01;
4277
4278 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4279 cp_phy.all_phys |= 0x02;
4280
4281 if (selected_phys & MGMT_PHY_LE_1M_TX)
4282 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4283
4284 if (selected_phys & MGMT_PHY_LE_2M_TX)
4285 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4286
4287 if (selected_phys & MGMT_PHY_LE_CODED_TX)
4288 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4289
4290 if (selected_phys & MGMT_PHY_LE_1M_RX)
4291 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4292
4293 if (selected_phys & MGMT_PHY_LE_2M_RX)
4294 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4295
4296 if (selected_phys & MGMT_PHY_LE_CODED_RX)
4297 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4298
4299 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4300 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4301
4302 return 0;
4303 }
4304
set_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4305 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4306 void *data, u16 len)
4307 {
4308 struct mgmt_cp_set_phy_configuration *cp = data;
4309 struct mgmt_pending_cmd *cmd;
4310 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4311 u16 pkt_type = (HCI_DH1 | HCI_DM1);
4312 bool changed = false;
4313 int err;
4314
4315 bt_dev_dbg(hdev, "sock %p", sk);
4316
4317 configurable_phys = get_configurable_phys(hdev);
4318 supported_phys = get_supported_phys(hdev);
4319 selected_phys = __le32_to_cpu(cp->selected_phys);
4320
4321 if (selected_phys & ~supported_phys)
4322 return mgmt_cmd_status(sk, hdev->id,
4323 MGMT_OP_SET_PHY_CONFIGURATION,
4324 MGMT_STATUS_INVALID_PARAMS);
4325
4326 unconfigure_phys = supported_phys & ~configurable_phys;
4327
4328 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4329 return mgmt_cmd_status(sk, hdev->id,
4330 MGMT_OP_SET_PHY_CONFIGURATION,
4331 MGMT_STATUS_INVALID_PARAMS);
4332
4333 if (selected_phys == get_selected_phys(hdev))
4334 return mgmt_cmd_complete(sk, hdev->id,
4335 MGMT_OP_SET_PHY_CONFIGURATION,
4336 0, NULL, 0);
4337
4338 hci_dev_lock(hdev);
4339
4340 if (!hdev_is_powered(hdev)) {
4341 err = mgmt_cmd_status(sk, hdev->id,
4342 MGMT_OP_SET_PHY_CONFIGURATION,
4343 MGMT_STATUS_REJECTED);
4344 goto unlock;
4345 }
4346
4347 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4348 err = mgmt_cmd_status(sk, hdev->id,
4349 MGMT_OP_SET_PHY_CONFIGURATION,
4350 MGMT_STATUS_BUSY);
4351 goto unlock;
4352 }
4353
4354 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4355 pkt_type |= (HCI_DH3 | HCI_DM3);
4356 else
4357 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4358
4359 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4360 pkt_type |= (HCI_DH5 | HCI_DM5);
4361 else
4362 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4363
4364 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4365 pkt_type &= ~HCI_2DH1;
4366 else
4367 pkt_type |= HCI_2DH1;
4368
4369 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4370 pkt_type &= ~HCI_2DH3;
4371 else
4372 pkt_type |= HCI_2DH3;
4373
4374 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4375 pkt_type &= ~HCI_2DH5;
4376 else
4377 pkt_type |= HCI_2DH5;
4378
4379 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4380 pkt_type &= ~HCI_3DH1;
4381 else
4382 pkt_type |= HCI_3DH1;
4383
4384 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4385 pkt_type &= ~HCI_3DH3;
4386 else
4387 pkt_type |= HCI_3DH3;
4388
4389 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4390 pkt_type &= ~HCI_3DH5;
4391 else
4392 pkt_type |= HCI_3DH5;
4393
4394 if (pkt_type != hdev->pkt_type) {
4395 hdev->pkt_type = pkt_type;
4396 changed = true;
4397 }
4398
4399 if ((selected_phys & MGMT_PHY_LE_MASK) ==
4400 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4401 if (changed)
4402 mgmt_phy_configuration_changed(hdev, sk);
4403
4404 err = mgmt_cmd_complete(sk, hdev->id,
4405 MGMT_OP_SET_PHY_CONFIGURATION,
4406 0, NULL, 0);
4407
4408 goto unlock;
4409 }
4410
4411 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4412 len);
4413 if (!cmd)
4414 err = -ENOMEM;
4415 else
4416 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4417 set_default_phy_complete);
4418
4419 if (err < 0) {
4420 err = mgmt_cmd_status(sk, hdev->id,
4421 MGMT_OP_SET_PHY_CONFIGURATION,
4422 MGMT_STATUS_FAILED);
4423
4424 if (cmd)
4425 mgmt_pending_remove(cmd);
4426 }
4427
4428 unlock:
4429 hci_dev_unlock(hdev);
4430
4431 return err;
4432 }
4433
set_blocked_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4434 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4435 u16 len)
4436 {
4437 int err = MGMT_STATUS_SUCCESS;
4438 struct mgmt_cp_set_blocked_keys *keys = data;
4439 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4440 sizeof(struct mgmt_blocked_key_info));
4441 u16 key_count, expected_len;
4442 int i;
4443
4444 bt_dev_dbg(hdev, "sock %p", sk);
4445
4446 key_count = __le16_to_cpu(keys->key_count);
4447 if (key_count > max_key_count) {
4448 bt_dev_err(hdev, "too big key_count value %u", key_count);
4449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4450 MGMT_STATUS_INVALID_PARAMS);
4451 }
4452
4453 expected_len = struct_size(keys, keys, key_count);
4454 if (expected_len != len) {
4455 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4456 expected_len, len);
4457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4458 MGMT_STATUS_INVALID_PARAMS);
4459 }
4460
4461 hci_dev_lock(hdev);
4462
4463 hci_blocked_keys_clear(hdev);
4464
4465 for (i = 0; i < key_count; ++i) {
4466 struct blocked_key *b = kzalloc_obj(*b);
4467
4468 if (!b) {
4469 err = MGMT_STATUS_NO_RESOURCES;
4470 break;
4471 }
4472
4473 b->type = keys->keys[i].type;
4474 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4475 list_add_rcu(&b->list, &hdev->blocked_keys);
4476 }
4477 hci_dev_unlock(hdev);
4478
4479 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4480 err, NULL, 0);
4481 }
4482
set_wideband_speech(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4483 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4484 void *data, u16 len)
4485 {
4486 struct mgmt_mode *cp = data;
4487 int err;
4488 bool changed = false;
4489
4490 bt_dev_dbg(hdev, "sock %p", sk);
4491
4492 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED))
4493 return mgmt_cmd_status(sk, hdev->id,
4494 MGMT_OP_SET_WIDEBAND_SPEECH,
4495 MGMT_STATUS_NOT_SUPPORTED);
4496
4497 if (cp->val != 0x00 && cp->val != 0x01)
4498 return mgmt_cmd_status(sk, hdev->id,
4499 MGMT_OP_SET_WIDEBAND_SPEECH,
4500 MGMT_STATUS_INVALID_PARAMS);
4501
4502 hci_dev_lock(hdev);
4503
4504 if (hdev_is_powered(hdev) &&
4505 !!cp->val != hci_dev_test_flag(hdev,
4506 HCI_WIDEBAND_SPEECH_ENABLED)) {
4507 err = mgmt_cmd_status(sk, hdev->id,
4508 MGMT_OP_SET_WIDEBAND_SPEECH,
4509 MGMT_STATUS_REJECTED);
4510 goto unlock;
4511 }
4512
4513 if (cp->val)
4514 changed = !hci_dev_test_and_set_flag(hdev,
4515 HCI_WIDEBAND_SPEECH_ENABLED);
4516 else
4517 changed = hci_dev_test_and_clear_flag(hdev,
4518 HCI_WIDEBAND_SPEECH_ENABLED);
4519
4520 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4521 if (err < 0)
4522 goto unlock;
4523
4524 if (changed)
4525 err = new_settings(hdev, sk);
4526
4527 unlock:
4528 hci_dev_unlock(hdev);
4529 return err;
4530 }
4531
read_controller_cap(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)4532 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4533 void *data, u16 data_len)
4534 {
4535 char buf[20];
4536 struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4537 u16 cap_len = 0;
4538 u8 flags = 0;
4539 u8 tx_power_range[2];
4540
4541 bt_dev_dbg(hdev, "sock %p", sk);
4542
4543 memset(&buf, 0, sizeof(buf));
4544
4545 hci_dev_lock(hdev);
4546
4547 /* When the Read Simple Pairing Options command is supported, then
4548 * the remote public key validation is supported.
4549 *
4550 * Alternatively, when Microsoft extensions are available, they can
4551 * indicate support for public key validation as well.
4552 */
4553 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4554 flags |= 0x01; /* Remote public key validation (BR/EDR) */
4555
4556 flags |= 0x02; /* Remote public key validation (LE) */
4557
4558 /* When the Read Encryption Key Size command is supported, then the
4559 * encryption key size is enforced.
4560 */
4561 if (hdev->commands[20] & 0x10)
4562 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */
4563
4564 flags |= 0x08; /* Encryption key size enforcement (LE) */
4565
4566 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4567 &flags, 1);
4568
4569 /* When the Read Simple Pairing Options command is supported, then
4570 * also max encryption key size information is provided.
4571 */
4572 if (hdev->commands[41] & 0x08)
4573 cap_len = eir_append_le16(rp->cap, cap_len,
4574 MGMT_CAP_MAX_ENC_KEY_SIZE,
4575 hdev->max_enc_key_size);
4576
4577 cap_len = eir_append_le16(rp->cap, cap_len,
4578 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4579 SMP_MAX_ENC_KEY_SIZE);
4580
4581 /* Append the min/max LE tx power parameters if we were able to fetch
4582 * it from the controller
4583 */
4584 if (hdev->commands[38] & 0x80) {
4585 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4586 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4587 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4588 tx_power_range, 2);
4589 }
4590
4591 rp->cap_len = cpu_to_le16(cap_len);
4592
4593 hci_dev_unlock(hdev);
4594
4595 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4596 rp, sizeof(*rp) + cap_len);
4597 }
4598
4599 #ifdef CONFIG_BT_FEATURE_DEBUG
4600 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4601 static const u8 debug_uuid[16] = {
4602 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4603 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4604 };
4605 #endif
4606
4607 /* 330859bc-7506-492d-9370-9a6f0614037f */
4608 static const u8 quality_report_uuid[16] = {
4609 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4610 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4611 };
4612
4613 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4614 static const u8 offload_codecs_uuid[16] = {
4615 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4616 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4617 };
4618
4619 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4620 static const u8 le_simultaneous_roles_uuid[16] = {
4621 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4622 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4623 };
4624
4625 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4626 static const u8 iso_socket_uuid[16] = {
4627 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4628 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4629 };
4630
4631 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4632 static const u8 mgmt_mesh_uuid[16] = {
4633 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4634 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4635 };
4636
read_exp_features_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)4637 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4638 void *data, u16 data_len)
4639 {
4640 struct mgmt_rp_read_exp_features_info *rp;
4641 size_t len;
4642 u16 idx = 0;
4643 u32 flags;
4644 int status;
4645
4646 bt_dev_dbg(hdev, "sock %p", sk);
4647
4648 /* Enough space for 7 features */
4649 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4650 rp = kzalloc(len, GFP_KERNEL);
4651 if (!rp)
4652 return -ENOMEM;
4653
4654 #ifdef CONFIG_BT_FEATURE_DEBUG
4655 flags = bt_dbg_get() ? BIT(0) : 0;
4656
4657 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4658 rp->features[idx].flags = cpu_to_le32(flags);
4659 idx++;
4660 #endif
4661
4662 if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4663 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4664 flags = BIT(0);
4665 else
4666 flags = 0;
4667
4668 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4669 rp->features[idx].flags = cpu_to_le32(flags);
4670 idx++;
4671 }
4672
4673 if (hdev && (aosp_has_quality_report(hdev) ||
4674 hdev->set_quality_report)) {
4675 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4676 flags = BIT(0);
4677 else
4678 flags = 0;
4679
4680 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4681 rp->features[idx].flags = cpu_to_le32(flags);
4682 idx++;
4683 }
4684
4685 if (hdev && hdev->get_data_path_id) {
4686 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4687 flags = BIT(0);
4688 else
4689 flags = 0;
4690
4691 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4692 rp->features[idx].flags = cpu_to_le32(flags);
4693 idx++;
4694 }
4695
4696 if (IS_ENABLED(CONFIG_BT_LE)) {
4697 flags = iso_inited() ? BIT(0) : 0;
4698 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4699 rp->features[idx].flags = cpu_to_le32(flags);
4700 idx++;
4701 }
4702
4703 if (hdev && lmp_le_capable(hdev)) {
4704 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4705 flags = BIT(0);
4706 else
4707 flags = 0;
4708
4709 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4710 rp->features[idx].flags = cpu_to_le32(flags);
4711 idx++;
4712 }
4713
4714 rp->feature_count = cpu_to_le16(idx);
4715
4716 /* After reading the experimental features information, enable
4717 * the events to update client on any future change.
4718 */
4719 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4720
4721 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4722 MGMT_OP_READ_EXP_FEATURES_INFO,
4723 0, rp, sizeof(*rp) + (20 * idx));
4724
4725 kfree(rp);
4726 return status;
4727 }
4728
exp_feature_changed(struct hci_dev * hdev,const u8 * uuid,bool enabled,struct sock * skip)4729 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4730 bool enabled, struct sock *skip)
4731 {
4732 struct mgmt_ev_exp_feature_changed ev;
4733
4734 memset(&ev, 0, sizeof(ev));
4735 memcpy(ev.uuid, uuid, 16);
4736 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4737
4738 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4739 &ev, sizeof(ev),
4740 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4741 }
4742
4743 #define EXP_FEAT(_uuid, _set_func) \
4744 { \
4745 .uuid = _uuid, \
4746 .set_func = _set_func, \
4747 }
4748
4749 /* The zero key uuid is special. Multiple exp features are set through it. */
set_zero_key_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4750 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4751 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4752 {
4753 struct mgmt_rp_set_exp_feature rp;
4754
4755 memset(rp.uuid, 0, 16);
4756 rp.flags = cpu_to_le32(0);
4757
4758 #ifdef CONFIG_BT_FEATURE_DEBUG
4759 if (!hdev) {
4760 bool changed = bt_dbg_get();
4761
4762 bt_dbg_set(false);
4763
4764 if (changed)
4765 exp_feature_changed(NULL, ZERO_KEY, false, sk);
4766 }
4767 #endif
4768
4769 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4770
4771 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4772 MGMT_OP_SET_EXP_FEATURE, 0,
4773 &rp, sizeof(rp));
4774 }
4775
4776 #ifdef CONFIG_BT_FEATURE_DEBUG
set_debug_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4777 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4778 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4779 {
4780 struct mgmt_rp_set_exp_feature rp;
4781
4782 bool val, changed;
4783 int err;
4784
4785 /* Command requires to use the non-controller index */
4786 if (hdev)
4787 return mgmt_cmd_status(sk, hdev->id,
4788 MGMT_OP_SET_EXP_FEATURE,
4789 MGMT_STATUS_INVALID_INDEX);
4790
4791 /* Parameters are limited to a single octet */
4792 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4793 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4794 MGMT_OP_SET_EXP_FEATURE,
4795 MGMT_STATUS_INVALID_PARAMS);
4796
4797 /* Only boolean on/off is supported */
4798 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4799 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4800 MGMT_OP_SET_EXP_FEATURE,
4801 MGMT_STATUS_INVALID_PARAMS);
4802
4803 val = !!cp->param[0];
4804 changed = val ? !bt_dbg_get() : bt_dbg_get();
4805 bt_dbg_set(val);
4806
4807 memcpy(rp.uuid, debug_uuid, 16);
4808 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4809
4810 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4811
4812 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4813 MGMT_OP_SET_EXP_FEATURE, 0,
4814 &rp, sizeof(rp));
4815
4816 if (changed)
4817 exp_feature_changed(hdev, debug_uuid, val, sk);
4818
4819 return err;
4820 }
4821 #endif
4822
set_mgmt_mesh_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4823 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4824 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4825 {
4826 struct mgmt_rp_set_exp_feature rp;
4827 bool val, changed;
4828 int err;
4829
4830 /* Command requires to use the controller index */
4831 if (!hdev)
4832 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4833 MGMT_OP_SET_EXP_FEATURE,
4834 MGMT_STATUS_INVALID_INDEX);
4835
4836 /* Parameters are limited to a single octet */
4837 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4838 return mgmt_cmd_status(sk, hdev->id,
4839 MGMT_OP_SET_EXP_FEATURE,
4840 MGMT_STATUS_INVALID_PARAMS);
4841
4842 /* Only boolean on/off is supported */
4843 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4844 return mgmt_cmd_status(sk, hdev->id,
4845 MGMT_OP_SET_EXP_FEATURE,
4846 MGMT_STATUS_INVALID_PARAMS);
4847
4848 val = !!cp->param[0];
4849
4850 if (val) {
4851 changed = !hci_dev_test_and_set_flag(hdev,
4852 HCI_MESH_EXPERIMENTAL);
4853 } else {
4854 hci_dev_clear_flag(hdev, HCI_MESH);
4855 changed = hci_dev_test_and_clear_flag(hdev,
4856 HCI_MESH_EXPERIMENTAL);
4857 }
4858
4859 memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4860 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4861
4862 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4863
4864 err = mgmt_cmd_complete(sk, hdev->id,
4865 MGMT_OP_SET_EXP_FEATURE, 0,
4866 &rp, sizeof(rp));
4867
4868 if (changed)
4869 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4870
4871 return err;
4872 }
4873
set_quality_report_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4874 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4875 struct mgmt_cp_set_exp_feature *cp,
4876 u16 data_len)
4877 {
4878 struct mgmt_rp_set_exp_feature rp;
4879 bool val, changed;
4880 int err;
4881
4882 /* Command requires to use a valid controller index */
4883 if (!hdev)
4884 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4885 MGMT_OP_SET_EXP_FEATURE,
4886 MGMT_STATUS_INVALID_INDEX);
4887
4888 /* Parameters are limited to a single octet */
4889 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4890 return mgmt_cmd_status(sk, hdev->id,
4891 MGMT_OP_SET_EXP_FEATURE,
4892 MGMT_STATUS_INVALID_PARAMS);
4893
4894 /* Only boolean on/off is supported */
4895 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4896 return mgmt_cmd_status(sk, hdev->id,
4897 MGMT_OP_SET_EXP_FEATURE,
4898 MGMT_STATUS_INVALID_PARAMS);
4899
4900 hci_req_sync_lock(hdev);
4901
4902 val = !!cp->param[0];
4903 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4904
4905 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4906 err = mgmt_cmd_status(sk, hdev->id,
4907 MGMT_OP_SET_EXP_FEATURE,
4908 MGMT_STATUS_NOT_SUPPORTED);
4909 goto unlock_quality_report;
4910 }
4911
4912 if (changed) {
4913 if (hdev->set_quality_report)
4914 err = hdev->set_quality_report(hdev, val);
4915 else
4916 err = aosp_set_quality_report(hdev, val);
4917
4918 if (err) {
4919 err = mgmt_cmd_status(sk, hdev->id,
4920 MGMT_OP_SET_EXP_FEATURE,
4921 MGMT_STATUS_FAILED);
4922 goto unlock_quality_report;
4923 }
4924
4925 if (val)
4926 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4927 else
4928 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4929 }
4930
4931 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4932
4933 memcpy(rp.uuid, quality_report_uuid, 16);
4934 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4935 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4936
4937 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4938 &rp, sizeof(rp));
4939
4940 if (changed)
4941 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4942
4943 unlock_quality_report:
4944 hci_req_sync_unlock(hdev);
4945 return err;
4946 }
4947
set_offload_codec_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4948 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4949 struct mgmt_cp_set_exp_feature *cp,
4950 u16 data_len)
4951 {
4952 bool val, changed;
4953 int err;
4954 struct mgmt_rp_set_exp_feature rp;
4955
4956 /* Command requires to use a valid controller index */
4957 if (!hdev)
4958 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4959 MGMT_OP_SET_EXP_FEATURE,
4960 MGMT_STATUS_INVALID_INDEX);
4961
4962 /* Parameters are limited to a single octet */
4963 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4964 return mgmt_cmd_status(sk, hdev->id,
4965 MGMT_OP_SET_EXP_FEATURE,
4966 MGMT_STATUS_INVALID_PARAMS);
4967
4968 /* Only boolean on/off is supported */
4969 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4970 return mgmt_cmd_status(sk, hdev->id,
4971 MGMT_OP_SET_EXP_FEATURE,
4972 MGMT_STATUS_INVALID_PARAMS);
4973
4974 val = !!cp->param[0];
4975 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4976
4977 if (!hdev->get_data_path_id) {
4978 return mgmt_cmd_status(sk, hdev->id,
4979 MGMT_OP_SET_EXP_FEATURE,
4980 MGMT_STATUS_NOT_SUPPORTED);
4981 }
4982
4983 if (changed) {
4984 if (val)
4985 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4986 else
4987 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4988 }
4989
4990 bt_dev_info(hdev, "offload codecs enable %d changed %d",
4991 val, changed);
4992
4993 memcpy(rp.uuid, offload_codecs_uuid, 16);
4994 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4995 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4996 err = mgmt_cmd_complete(sk, hdev->id,
4997 MGMT_OP_SET_EXP_FEATURE, 0,
4998 &rp, sizeof(rp));
4999
5000 if (changed)
5001 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
5002
5003 return err;
5004 }
5005
set_le_simultaneous_roles_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)5006 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
5007 struct mgmt_cp_set_exp_feature *cp,
5008 u16 data_len)
5009 {
5010 bool val, changed;
5011 int err;
5012 struct mgmt_rp_set_exp_feature rp;
5013
5014 /* Command requires to use a valid controller index */
5015 if (!hdev)
5016 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5017 MGMT_OP_SET_EXP_FEATURE,
5018 MGMT_STATUS_INVALID_INDEX);
5019
5020 /* Parameters are limited to a single octet */
5021 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
5022 return mgmt_cmd_status(sk, hdev->id,
5023 MGMT_OP_SET_EXP_FEATURE,
5024 MGMT_STATUS_INVALID_PARAMS);
5025
5026 /* Only boolean on/off is supported */
5027 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
5028 return mgmt_cmd_status(sk, hdev->id,
5029 MGMT_OP_SET_EXP_FEATURE,
5030 MGMT_STATUS_INVALID_PARAMS);
5031
5032 val = !!cp->param[0];
5033 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
5034
5035 if (!hci_dev_le_state_simultaneous(hdev)) {
5036 return mgmt_cmd_status(sk, hdev->id,
5037 MGMT_OP_SET_EXP_FEATURE,
5038 MGMT_STATUS_NOT_SUPPORTED);
5039 }
5040
5041 if (changed) {
5042 if (val)
5043 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
5044 else
5045 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
5046 }
5047
5048 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
5049 val, changed);
5050
5051 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
5052 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5053 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5054 err = mgmt_cmd_complete(sk, hdev->id,
5055 MGMT_OP_SET_EXP_FEATURE, 0,
5056 &rp, sizeof(rp));
5057
5058 if (changed)
5059 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
5060
5061 return err;
5062 }
5063
5064 #ifdef CONFIG_BT_LE
set_iso_socket_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)5065 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
5066 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
5067 {
5068 struct mgmt_rp_set_exp_feature rp;
5069 bool val, changed = false;
5070 int err;
5071
5072 /* Command requires to use the non-controller index */
5073 if (hdev)
5074 return mgmt_cmd_status(sk, hdev->id,
5075 MGMT_OP_SET_EXP_FEATURE,
5076 MGMT_STATUS_INVALID_INDEX);
5077
5078 /* Parameters are limited to a single octet */
5079 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
5080 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5081 MGMT_OP_SET_EXP_FEATURE,
5082 MGMT_STATUS_INVALID_PARAMS);
5083
5084 /* Only boolean on/off is supported */
5085 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
5086 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5087 MGMT_OP_SET_EXP_FEATURE,
5088 MGMT_STATUS_INVALID_PARAMS);
5089
5090 val = cp->param[0] ? true : false;
5091 if (val)
5092 err = iso_init();
5093 else
5094 err = iso_exit();
5095
5096 if (!err)
5097 changed = true;
5098
5099 memcpy(rp.uuid, iso_socket_uuid, 16);
5100 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5101
5102 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5103
5104 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
5105 MGMT_OP_SET_EXP_FEATURE, 0,
5106 &rp, sizeof(rp));
5107
5108 if (changed)
5109 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
5110
5111 return err;
5112 }
5113 #endif
5114
5115 static const struct mgmt_exp_feature {
5116 const u8 *uuid;
5117 int (*set_func)(struct sock *sk, struct hci_dev *hdev,
5118 struct mgmt_cp_set_exp_feature *cp, u16 data_len);
5119 } exp_features[] = {
5120 EXP_FEAT(ZERO_KEY, set_zero_key_func),
5121 #ifdef CONFIG_BT_FEATURE_DEBUG
5122 EXP_FEAT(debug_uuid, set_debug_func),
5123 #endif
5124 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5125 EXP_FEAT(quality_report_uuid, set_quality_report_func),
5126 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5127 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5128 #ifdef CONFIG_BT_LE
5129 EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5130 #endif
5131
5132 /* end with a null feature */
5133 EXP_FEAT(NULL, NULL)
5134 };
5135
set_exp_feature(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5136 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5137 void *data, u16 data_len)
5138 {
5139 struct mgmt_cp_set_exp_feature *cp = data;
5140 size_t i = 0;
5141
5142 bt_dev_dbg(hdev, "sock %p", sk);
5143
5144 for (i = 0; exp_features[i].uuid; i++) {
5145 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5146 return exp_features[i].set_func(sk, hdev, cp, data_len);
5147 }
5148
5149 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5150 MGMT_OP_SET_EXP_FEATURE,
5151 MGMT_STATUS_NOT_SUPPORTED);
5152 }
5153
get_device_flags(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5154 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5155 u16 data_len)
5156 {
5157 struct mgmt_cp_get_device_flags *cp = data;
5158 struct mgmt_rp_get_device_flags rp;
5159 struct bdaddr_list_with_flags *br_params;
5160 struct hci_conn_params *params;
5161 u32 supported_flags;
5162 u32 current_flags = 0;
5163 u8 status = MGMT_STATUS_INVALID_PARAMS;
5164
5165 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5166 &cp->addr.bdaddr, cp->addr.type);
5167
5168 hci_dev_lock(hdev);
5169
5170 supported_flags = hdev->conn_flags;
5171
5172 memset(&rp, 0, sizeof(rp));
5173
5174 if (cp->addr.type == BDADDR_BREDR) {
5175 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5176 &cp->addr.bdaddr,
5177 cp->addr.type);
5178 if (!br_params)
5179 goto done;
5180
5181 current_flags = br_params->flags;
5182 } else {
5183 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5184 le_addr_type(cp->addr.type));
5185 if (!params)
5186 goto done;
5187
5188 current_flags = params->flags;
5189 }
5190
5191 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5192 rp.addr.type = cp->addr.type;
5193 rp.supported_flags = cpu_to_le32(supported_flags);
5194 rp.current_flags = cpu_to_le32(current_flags);
5195
5196 status = MGMT_STATUS_SUCCESS;
5197
5198 done:
5199 hci_dev_unlock(hdev);
5200
5201 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5202 &rp, sizeof(rp));
5203 }
5204
device_flags_changed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u32 supported_flags,u32 current_flags)5205 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5206 bdaddr_t *bdaddr, u8 bdaddr_type,
5207 u32 supported_flags, u32 current_flags)
5208 {
5209 struct mgmt_ev_device_flags_changed ev;
5210
5211 bacpy(&ev.addr.bdaddr, bdaddr);
5212 ev.addr.type = bdaddr_type;
5213 ev.supported_flags = cpu_to_le32(supported_flags);
5214 ev.current_flags = cpu_to_le32(current_flags);
5215
5216 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5217 }
5218
is_connected(struct hci_dev * hdev,bdaddr_t * addr,u8 type)5219 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5220 {
5221 struct hci_conn *conn;
5222
5223 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5224 if (!conn)
5225 return false;
5226
5227 if (conn->dst_type != type)
5228 return false;
5229
5230 if (conn->state != BT_CONNECTED)
5231 return false;
5232
5233 return true;
5234 }
5235
5236 /* This function requires the caller holds hdev->lock */
hci_conn_params_set(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,u8 auto_connect)5237 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev,
5238 bdaddr_t *addr, u8 addr_type,
5239 u8 auto_connect)
5240 {
5241 struct hci_conn_params *params;
5242
5243 params = hci_conn_params_add(hdev, addr, addr_type);
5244 if (!params)
5245 return NULL;
5246
5247 if (params->auto_connect == auto_connect)
5248 return params;
5249
5250 hci_pend_le_list_del_init(params);
5251
5252 switch (auto_connect) {
5253 case HCI_AUTO_CONN_DISABLED:
5254 case HCI_AUTO_CONN_LINK_LOSS:
5255 /* If auto connect is being disabled when we're trying to
5256 * connect to device, keep connecting.
5257 */
5258 if (params->explicit_connect)
5259 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5260 break;
5261 case HCI_AUTO_CONN_REPORT:
5262 if (params->explicit_connect)
5263 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5264 else
5265 hci_pend_le_list_add(params, &hdev->pend_le_reports);
5266 break;
5267 case HCI_AUTO_CONN_DIRECT:
5268 case HCI_AUTO_CONN_ALWAYS:
5269 if (!is_connected(hdev, addr, addr_type))
5270 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5271 break;
5272 }
5273
5274 params->auto_connect = auto_connect;
5275
5276 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
5277 addr, addr_type, auto_connect);
5278
5279 return params;
5280 }
5281
set_device_flags(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5282 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5283 u16 len)
5284 {
5285 struct mgmt_cp_set_device_flags *cp = data;
5286 struct bdaddr_list_with_flags *br_params;
5287 struct hci_conn_params *params;
5288 u8 status = MGMT_STATUS_INVALID_PARAMS;
5289 u32 supported_flags;
5290 u32 current_flags = __le32_to_cpu(cp->current_flags);
5291
5292 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5293 &cp->addr.bdaddr, cp->addr.type, current_flags);
5294
5295 // We should take hci_dev_lock() early, I think.. conn_flags can change
5296 supported_flags = hdev->conn_flags;
5297
5298 if ((supported_flags | current_flags) != supported_flags) {
5299 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5300 current_flags, supported_flags);
5301 goto done;
5302 }
5303
5304 hci_dev_lock(hdev);
5305
5306 if (cp->addr.type == BDADDR_BREDR) {
5307 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5308 &cp->addr.bdaddr,
5309 cp->addr.type);
5310
5311 if (br_params) {
5312 br_params->flags = current_flags;
5313 status = MGMT_STATUS_SUCCESS;
5314 } else {
5315 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5316 &cp->addr.bdaddr, cp->addr.type);
5317 }
5318
5319 goto unlock;
5320 }
5321
5322 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5323 le_addr_type(cp->addr.type));
5324 if (!params) {
5325 /* Create a new hci_conn_params if it doesn't exist */
5326 params = hci_conn_params_set(hdev, &cp->addr.bdaddr,
5327 le_addr_type(cp->addr.type),
5328 HCI_AUTO_CONN_DISABLED);
5329 if (!params) {
5330 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5331 &cp->addr.bdaddr,
5332 le_addr_type(cp->addr.type));
5333 goto unlock;
5334 }
5335 }
5336
5337 supported_flags = hdev->conn_flags;
5338
5339 if ((supported_flags | current_flags) != supported_flags) {
5340 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5341 current_flags, supported_flags);
5342 goto unlock;
5343 }
5344
5345 WRITE_ONCE(params->flags, current_flags);
5346 status = MGMT_STATUS_SUCCESS;
5347
5348 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5349 * has been set.
5350 */
5351 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5352 hci_update_passive_scan(hdev);
5353
5354 unlock:
5355 hci_dev_unlock(hdev);
5356
5357 done:
5358 if (status == MGMT_STATUS_SUCCESS)
5359 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5360 supported_flags, current_flags);
5361
5362 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5363 &cp->addr, sizeof(cp->addr));
5364 }
5365
mgmt_adv_monitor_added(struct sock * sk,struct hci_dev * hdev,u16 handle)5366 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5367 u16 handle)
5368 {
5369 struct mgmt_ev_adv_monitor_added ev;
5370
5371 ev.monitor_handle = cpu_to_le16(handle);
5372
5373 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5374 }
5375
mgmt_adv_monitor_removed(struct sock * sk,struct hci_dev * hdev,__le16 handle)5376 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
5377 __le16 handle)
5378 {
5379 struct mgmt_ev_adv_monitor_removed ev;
5380
5381 ev.monitor_handle = handle;
5382
5383 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
5384 }
5385
read_adv_mon_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5386 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5387 void *data, u16 len)
5388 {
5389 struct adv_monitor *monitor = NULL;
5390 struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5391 int handle, err;
5392 size_t rp_size = 0;
5393 __u32 supported = 0;
5394 __u32 enabled = 0;
5395 __u16 num_handles = 0;
5396 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5397
5398 BT_DBG("request for %s", hdev->name);
5399
5400 hci_dev_lock(hdev);
5401
5402 if (msft_monitor_supported(hdev))
5403 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5404
5405 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5406 handles[num_handles++] = monitor->handle;
5407
5408 hci_dev_unlock(hdev);
5409
5410 rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5411 rp = kmalloc(rp_size, GFP_KERNEL);
5412 if (!rp)
5413 return -ENOMEM;
5414
5415 /* All supported features are currently enabled */
5416 enabled = supported;
5417
5418 rp->supported_features = cpu_to_le32(supported);
5419 rp->enabled_features = cpu_to_le32(enabled);
5420 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5421 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5422 rp->num_handles = cpu_to_le16(num_handles);
5423 if (num_handles)
5424 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5425
5426 err = mgmt_cmd_complete(sk, hdev->id,
5427 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5428 MGMT_STATUS_SUCCESS, rp, rp_size);
5429
5430 kfree(rp);
5431
5432 return err;
5433 }
5434
mgmt_add_adv_patterns_monitor_complete(struct hci_dev * hdev,void * data,int status)5435 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5436 void *data, int status)
5437 {
5438 struct mgmt_rp_add_adv_patterns_monitor rp;
5439 struct mgmt_pending_cmd *cmd = data;
5440 struct adv_monitor *monitor;
5441
5442 /* This is likely the result of hdev being closed and mgmt_index_removed
5443 * is attempting to clean up any pending command so
5444 * hci_adv_monitors_clear is about to be called which will take care of
5445 * freeing the adv_monitor instances.
5446 */
5447 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
5448 return;
5449
5450 monitor = cmd->user_data;
5451
5452 hci_dev_lock(hdev);
5453
5454 rp.monitor_handle = cpu_to_le16(monitor->handle);
5455
5456 if (!status) {
5457 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5458 hdev->adv_monitors_cnt++;
5459 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5460 monitor->state = ADV_MONITOR_STATE_REGISTERED;
5461 hci_update_passive_scan(hdev);
5462 } else {
5463 hci_free_adv_monitor(hdev, monitor);
5464 }
5465
5466 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
5467 mgmt_status(status), &rp, sizeof(rp));
5468 mgmt_pending_free(cmd);
5469
5470 hci_dev_unlock(hdev);
5471 bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5472 rp.monitor_handle, status);
5473 }
5474
mgmt_add_adv_patterns_monitor_sync(struct hci_dev * hdev,void * data)5475 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5476 {
5477 struct mgmt_pending_cmd *cmd = data;
5478 struct adv_monitor *mon;
5479
5480 mutex_lock(&hdev->mgmt_pending_lock);
5481
5482 if (!__mgmt_pending_listed(hdev, cmd)) {
5483 mutex_unlock(&hdev->mgmt_pending_lock);
5484 return -ECANCELED;
5485 }
5486
5487 mon = cmd->user_data;
5488
5489 mutex_unlock(&hdev->mgmt_pending_lock);
5490
5491 return hci_add_adv_monitor(hdev, mon);
5492 }
5493
__add_adv_patterns_monitor(struct sock * sk,struct hci_dev * hdev,struct adv_monitor * m,u8 status,void * data,u16 len,u16 op)5494 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5495 struct adv_monitor *m, u8 status,
5496 void *data, u16 len, u16 op)
5497 {
5498 struct mgmt_pending_cmd *cmd;
5499 int err;
5500
5501 hci_dev_lock(hdev);
5502
5503 if (status)
5504 goto unlock;
5505
5506 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5507 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5508 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5509 status = MGMT_STATUS_BUSY;
5510 goto unlock;
5511 }
5512
5513 cmd = mgmt_pending_add(sk, op, hdev, data, len);
5514 if (!cmd) {
5515 status = MGMT_STATUS_NO_RESOURCES;
5516 goto unlock;
5517 }
5518
5519 cmd->user_data = m;
5520 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5521 mgmt_add_adv_patterns_monitor_complete);
5522 if (err) {
5523 if (err == -ENOMEM)
5524 status = MGMT_STATUS_NO_RESOURCES;
5525 else
5526 status = MGMT_STATUS_FAILED;
5527
5528 goto unlock;
5529 }
5530
5531 hci_dev_unlock(hdev);
5532
5533 return 0;
5534
5535 unlock:
5536 hci_free_adv_monitor(hdev, m);
5537 hci_dev_unlock(hdev);
5538 return mgmt_cmd_status(sk, hdev->id, op, status);
5539 }
5540
parse_adv_monitor_rssi(struct adv_monitor * m,struct mgmt_adv_rssi_thresholds * rssi)5541 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5542 struct mgmt_adv_rssi_thresholds *rssi)
5543 {
5544 if (rssi) {
5545 m->rssi.low_threshold = rssi->low_threshold;
5546 m->rssi.low_threshold_timeout =
5547 __le16_to_cpu(rssi->low_threshold_timeout);
5548 m->rssi.high_threshold = rssi->high_threshold;
5549 m->rssi.high_threshold_timeout =
5550 __le16_to_cpu(rssi->high_threshold_timeout);
5551 m->rssi.sampling_period = rssi->sampling_period;
5552 } else {
5553 /* Default values. These numbers are the least constricting
5554 * parameters for MSFT API to work, so it behaves as if there
5555 * are no rssi parameter to consider. May need to be changed
5556 * if other API are to be supported.
5557 */
5558 m->rssi.low_threshold = -127;
5559 m->rssi.low_threshold_timeout = 60;
5560 m->rssi.high_threshold = -127;
5561 m->rssi.high_threshold_timeout = 0;
5562 m->rssi.sampling_period = 0;
5563 }
5564 }
5565
parse_adv_monitor_pattern(struct adv_monitor * m,u8 pattern_count,struct mgmt_adv_pattern * patterns)5566 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5567 struct mgmt_adv_pattern *patterns)
5568 {
5569 u8 offset = 0, length = 0;
5570 struct adv_pattern *p = NULL;
5571 int i;
5572
5573 for (i = 0; i < pattern_count; i++) {
5574 offset = patterns[i].offset;
5575 length = patterns[i].length;
5576 if (offset >= HCI_MAX_AD_LENGTH ||
5577 length > HCI_MAX_AD_LENGTH ||
5578 (offset + length) > HCI_MAX_AD_LENGTH)
5579 return MGMT_STATUS_INVALID_PARAMS;
5580
5581 p = kmalloc_obj(*p);
5582 if (!p)
5583 return MGMT_STATUS_NO_RESOURCES;
5584
5585 p->ad_type = patterns[i].ad_type;
5586 p->offset = patterns[i].offset;
5587 p->length = patterns[i].length;
5588 memcpy(p->value, patterns[i].value, p->length);
5589
5590 INIT_LIST_HEAD(&p->list);
5591 list_add(&p->list, &m->patterns);
5592 }
5593
5594 return MGMT_STATUS_SUCCESS;
5595 }
5596
add_adv_patterns_monitor(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5597 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5598 void *data, u16 len)
5599 {
5600 struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5601 struct adv_monitor *m = NULL;
5602 u8 status = MGMT_STATUS_SUCCESS;
5603 size_t expected_size = sizeof(*cp);
5604
5605 BT_DBG("request for %s", hdev->name);
5606
5607 if (len <= sizeof(*cp)) {
5608 status = MGMT_STATUS_INVALID_PARAMS;
5609 goto done;
5610 }
5611
5612 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5613 if (len != expected_size) {
5614 status = MGMT_STATUS_INVALID_PARAMS;
5615 goto done;
5616 }
5617
5618 m = kzalloc_obj(*m);
5619 if (!m) {
5620 status = MGMT_STATUS_NO_RESOURCES;
5621 goto done;
5622 }
5623
5624 INIT_LIST_HEAD(&m->patterns);
5625
5626 parse_adv_monitor_rssi(m, NULL);
5627 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5628
5629 done:
5630 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5631 MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5632 }
5633
add_adv_patterns_monitor_rssi(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5634 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5635 void *data, u16 len)
5636 {
5637 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5638 struct adv_monitor *m = NULL;
5639 u8 status = MGMT_STATUS_SUCCESS;
5640 size_t expected_size = sizeof(*cp);
5641
5642 BT_DBG("request for %s", hdev->name);
5643
5644 if (len <= sizeof(*cp)) {
5645 status = MGMT_STATUS_INVALID_PARAMS;
5646 goto done;
5647 }
5648
5649 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5650 if (len != expected_size) {
5651 status = MGMT_STATUS_INVALID_PARAMS;
5652 goto done;
5653 }
5654
5655 m = kzalloc_obj(*m);
5656 if (!m) {
5657 status = MGMT_STATUS_NO_RESOURCES;
5658 goto done;
5659 }
5660
5661 INIT_LIST_HEAD(&m->patterns);
5662
5663 parse_adv_monitor_rssi(m, &cp->rssi);
5664 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5665
5666 done:
5667 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5668 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5669 }
5670
mgmt_remove_adv_monitor_complete(struct hci_dev * hdev,void * data,int status)5671 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5672 void *data, int status)
5673 {
5674 struct mgmt_rp_remove_adv_monitor rp;
5675 struct mgmt_pending_cmd *cmd = data;
5676 struct mgmt_cp_remove_adv_monitor *cp;
5677
5678 if (status == -ECANCELED)
5679 return;
5680
5681 hci_dev_lock(hdev);
5682
5683 cp = cmd->param;
5684
5685 rp.monitor_handle = cp->monitor_handle;
5686
5687 if (!status) {
5688 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle);
5689 hci_update_passive_scan(hdev);
5690 }
5691
5692 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
5693 mgmt_status(status), &rp, sizeof(rp));
5694 mgmt_pending_free(cmd);
5695
5696 hci_dev_unlock(hdev);
5697 bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5698 rp.monitor_handle, status);
5699 }
5700
mgmt_remove_adv_monitor_sync(struct hci_dev * hdev,void * data)5701 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5702 {
5703 struct mgmt_pending_cmd *cmd = data;
5704 struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5705 u16 handle = __le16_to_cpu(cp->monitor_handle);
5706
5707 if (!handle)
5708 return hci_remove_all_adv_monitor(hdev);
5709
5710 return hci_remove_single_adv_monitor(hdev, handle);
5711 }
5712
remove_adv_monitor(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5713 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5714 void *data, u16 len)
5715 {
5716 struct mgmt_pending_cmd *cmd;
5717 int err, status;
5718
5719 hci_dev_lock(hdev);
5720
5721 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5722 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5723 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5724 status = MGMT_STATUS_BUSY;
5725 goto unlock;
5726 }
5727
5728 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5729 if (!cmd) {
5730 status = MGMT_STATUS_NO_RESOURCES;
5731 goto unlock;
5732 }
5733
5734 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd,
5735 mgmt_remove_adv_monitor_complete);
5736
5737 if (err) {
5738 mgmt_pending_free(cmd);
5739
5740 if (err == -ENOMEM)
5741 status = MGMT_STATUS_NO_RESOURCES;
5742 else
5743 status = MGMT_STATUS_FAILED;
5744
5745 goto unlock;
5746 }
5747
5748 hci_dev_unlock(hdev);
5749
5750 return 0;
5751
5752 unlock:
5753 hci_dev_unlock(hdev);
5754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5755 status);
5756 }
5757
read_local_oob_data_complete(struct hci_dev * hdev,void * data,int err)5758 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data,
5759 int err)
5760 {
5761 struct mgmt_rp_read_local_oob_data mgmt_rp;
5762 size_t rp_size = sizeof(mgmt_rp);
5763 struct mgmt_pending_cmd *cmd = data;
5764 struct sk_buff *skb = cmd->skb;
5765 u8 status = mgmt_status(err);
5766
5767 if (!status) {
5768 if (!skb)
5769 status = MGMT_STATUS_FAILED;
5770 else if (IS_ERR(skb))
5771 status = mgmt_status(PTR_ERR(skb));
5772 else
5773 status = mgmt_status(skb->data[0]);
5774 }
5775
5776 bt_dev_dbg(hdev, "status %d", status);
5777
5778 if (status) {
5779 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5780 status);
5781 goto remove;
5782 }
5783
5784 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5785
5786 if (!bredr_sc_enabled(hdev)) {
5787 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5788
5789 if (skb->len < sizeof(*rp)) {
5790 mgmt_cmd_status(cmd->sk, hdev->id,
5791 MGMT_OP_READ_LOCAL_OOB_DATA,
5792 MGMT_STATUS_FAILED);
5793 goto remove;
5794 }
5795
5796 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5797 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5798
5799 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5800 } else {
5801 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5802
5803 if (skb->len < sizeof(*rp)) {
5804 mgmt_cmd_status(cmd->sk, hdev->id,
5805 MGMT_OP_READ_LOCAL_OOB_DATA,
5806 MGMT_STATUS_FAILED);
5807 goto remove;
5808 }
5809
5810 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5811 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5812
5813 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5814 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5815 }
5816
5817 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5818 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5819
5820 remove:
5821 if (skb && !IS_ERR(skb))
5822 kfree_skb(skb);
5823
5824 mgmt_pending_free(cmd);
5825 }
5826
read_local_oob_data_sync(struct hci_dev * hdev,void * data)5827 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5828 {
5829 struct mgmt_pending_cmd *cmd = data;
5830
5831 if (bredr_sc_enabled(hdev))
5832 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5833 else
5834 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5835
5836 if (IS_ERR(cmd->skb))
5837 return PTR_ERR(cmd->skb);
5838 else
5839 return 0;
5840 }
5841
read_local_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5842 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5843 void *data, u16 data_len)
5844 {
5845 struct mgmt_pending_cmd *cmd;
5846 int err;
5847
5848 bt_dev_dbg(hdev, "sock %p", sk);
5849
5850 hci_dev_lock(hdev);
5851
5852 if (!hdev_is_powered(hdev)) {
5853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5854 MGMT_STATUS_NOT_POWERED);
5855 goto unlock;
5856 }
5857
5858 if (!lmp_ssp_capable(hdev)) {
5859 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5860 MGMT_STATUS_NOT_SUPPORTED);
5861 goto unlock;
5862 }
5863
5864 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5865 if (!cmd)
5866 err = -ENOMEM;
5867 else
5868 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5869 read_local_oob_data_complete);
5870
5871 if (err < 0) {
5872 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5873 MGMT_STATUS_FAILED);
5874
5875 if (cmd)
5876 mgmt_pending_free(cmd);
5877 }
5878
5879 unlock:
5880 hci_dev_unlock(hdev);
5881 return err;
5882 }
5883
add_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5884 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5885 void *data, u16 len)
5886 {
5887 struct mgmt_addr_info *addr = data;
5888 int err;
5889
5890 bt_dev_dbg(hdev, "sock %p", sk);
5891
5892 if (!bdaddr_type_is_valid(addr->type))
5893 return mgmt_cmd_complete(sk, hdev->id,
5894 MGMT_OP_ADD_REMOTE_OOB_DATA,
5895 MGMT_STATUS_INVALID_PARAMS,
5896 addr, sizeof(*addr));
5897
5898 hci_dev_lock(hdev);
5899
5900 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5901 struct mgmt_cp_add_remote_oob_data *cp = data;
5902 u8 status;
5903
5904 if (cp->addr.type != BDADDR_BREDR) {
5905 err = mgmt_cmd_complete(sk, hdev->id,
5906 MGMT_OP_ADD_REMOTE_OOB_DATA,
5907 MGMT_STATUS_INVALID_PARAMS,
5908 &cp->addr, sizeof(cp->addr));
5909 goto unlock;
5910 }
5911
5912 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5913 cp->addr.type, cp->hash,
5914 cp->rand, NULL, NULL);
5915 if (err < 0)
5916 status = MGMT_STATUS_FAILED;
5917 else
5918 status = MGMT_STATUS_SUCCESS;
5919
5920 err = mgmt_cmd_complete(sk, hdev->id,
5921 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5922 &cp->addr, sizeof(cp->addr));
5923 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5924 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5925 u8 *rand192, *hash192, *rand256, *hash256;
5926 u8 status;
5927
5928 if (bdaddr_type_is_le(cp->addr.type)) {
5929 /* Enforce zero-valued 192-bit parameters as
5930 * long as legacy SMP OOB isn't implemented.
5931 */
5932 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5933 memcmp(cp->hash192, ZERO_KEY, 16)) {
5934 err = mgmt_cmd_complete(sk, hdev->id,
5935 MGMT_OP_ADD_REMOTE_OOB_DATA,
5936 MGMT_STATUS_INVALID_PARAMS,
5937 addr, sizeof(*addr));
5938 goto unlock;
5939 }
5940
5941 rand192 = NULL;
5942 hash192 = NULL;
5943 } else {
5944 /* In case one of the P-192 values is set to zero,
5945 * then just disable OOB data for P-192.
5946 */
5947 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5948 !memcmp(cp->hash192, ZERO_KEY, 16)) {
5949 rand192 = NULL;
5950 hash192 = NULL;
5951 } else {
5952 rand192 = cp->rand192;
5953 hash192 = cp->hash192;
5954 }
5955 }
5956
5957 /* In case one of the P-256 values is set to zero, then just
5958 * disable OOB data for P-256.
5959 */
5960 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5961 !memcmp(cp->hash256, ZERO_KEY, 16)) {
5962 rand256 = NULL;
5963 hash256 = NULL;
5964 } else {
5965 rand256 = cp->rand256;
5966 hash256 = cp->hash256;
5967 }
5968
5969 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5970 cp->addr.type, hash192, rand192,
5971 hash256, rand256);
5972 if (err < 0)
5973 status = MGMT_STATUS_FAILED;
5974 else
5975 status = MGMT_STATUS_SUCCESS;
5976
5977 err = mgmt_cmd_complete(sk, hdev->id,
5978 MGMT_OP_ADD_REMOTE_OOB_DATA,
5979 status, &cp->addr, sizeof(cp->addr));
5980 } else {
5981 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5982 len);
5983 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5984 MGMT_STATUS_INVALID_PARAMS);
5985 }
5986
5987 unlock:
5988 hci_dev_unlock(hdev);
5989 return err;
5990 }
5991
remove_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5992 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5993 void *data, u16 len)
5994 {
5995 struct mgmt_cp_remove_remote_oob_data *cp = data;
5996 u8 status;
5997 int err;
5998
5999 bt_dev_dbg(hdev, "sock %p", sk);
6000
6001 if (cp->addr.type != BDADDR_BREDR)
6002 return mgmt_cmd_complete(sk, hdev->id,
6003 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
6004 MGMT_STATUS_INVALID_PARAMS,
6005 &cp->addr, sizeof(cp->addr));
6006
6007 hci_dev_lock(hdev);
6008
6009 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6010 hci_remote_oob_data_clear(hdev);
6011 status = MGMT_STATUS_SUCCESS;
6012 goto done;
6013 }
6014
6015 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
6016 if (err < 0)
6017 status = MGMT_STATUS_INVALID_PARAMS;
6018 else
6019 status = MGMT_STATUS_SUCCESS;
6020
6021 done:
6022 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
6023 status, &cp->addr, sizeof(cp->addr));
6024
6025 hci_dev_unlock(hdev);
6026 return err;
6027 }
6028
discovery_type_is_valid(struct hci_dev * hdev,uint8_t type,uint8_t * mgmt_status)6029 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
6030 uint8_t *mgmt_status)
6031 {
6032 switch (type) {
6033 case DISCOV_TYPE_LE:
6034 *mgmt_status = mgmt_le_support(hdev);
6035 if (*mgmt_status)
6036 return false;
6037 break;
6038 case DISCOV_TYPE_INTERLEAVED:
6039 *mgmt_status = mgmt_le_support(hdev);
6040 if (*mgmt_status)
6041 return false;
6042 fallthrough;
6043 case DISCOV_TYPE_BREDR:
6044 *mgmt_status = mgmt_bredr_support(hdev);
6045 if (*mgmt_status)
6046 return false;
6047 break;
6048 default:
6049 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
6050 return false;
6051 }
6052
6053 return true;
6054 }
6055
start_discovery_complete(struct hci_dev * hdev,void * data,int err)6056 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
6057 {
6058 struct mgmt_pending_cmd *cmd = data;
6059
6060 bt_dev_dbg(hdev, "err %d", err);
6061
6062 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
6063 return;
6064
6065 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
6066 cmd->param, 1);
6067 mgmt_pending_free(cmd);
6068
6069 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
6070 DISCOVERY_FINDING);
6071 }
6072
start_discovery_sync(struct hci_dev * hdev,void * data)6073 static int start_discovery_sync(struct hci_dev *hdev, void *data)
6074 {
6075 if (!mgmt_pending_listed(hdev, data))
6076 return -ECANCELED;
6077
6078 return hci_start_discovery_sync(hdev);
6079 }
6080
start_discovery_internal(struct sock * sk,struct hci_dev * hdev,u16 op,void * data,u16 len)6081 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
6082 u16 op, void *data, u16 len)
6083 {
6084 struct mgmt_cp_start_discovery *cp = data;
6085 struct mgmt_pending_cmd *cmd;
6086 u8 status;
6087 int err;
6088
6089 bt_dev_dbg(hdev, "sock %p", sk);
6090
6091 hci_dev_lock(hdev);
6092
6093 if (!hdev_is_powered(hdev)) {
6094 err = mgmt_cmd_complete(sk, hdev->id, op,
6095 MGMT_STATUS_NOT_POWERED,
6096 &cp->type, sizeof(cp->type));
6097 goto failed;
6098 }
6099
6100 if (hdev->discovery.state != DISCOVERY_STOPPED ||
6101 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6102 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
6103 &cp->type, sizeof(cp->type));
6104 goto failed;
6105 }
6106
6107 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6108 err = mgmt_cmd_complete(sk, hdev->id, op, status,
6109 &cp->type, sizeof(cp->type));
6110 goto failed;
6111 }
6112
6113 /* Can't start discovery when it is paused */
6114 if (hdev->discovery_paused) {
6115 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
6116 &cp->type, sizeof(cp->type));
6117 goto failed;
6118 }
6119
6120 /* Clear the discovery filter first to free any previously
6121 * allocated memory for the UUID list.
6122 */
6123 hci_discovery_filter_clear(hdev);
6124
6125 hdev->discovery.type = cp->type;
6126 hdev->discovery.report_invalid_rssi = false;
6127 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
6128 hdev->discovery.limited = true;
6129 else
6130 hdev->discovery.limited = false;
6131
6132 cmd = mgmt_pending_add(sk, op, hdev, data, len);
6133 if (!cmd) {
6134 err = -ENOMEM;
6135 goto failed;
6136 }
6137
6138 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6139 start_discovery_complete);
6140 if (err < 0) {
6141 mgmt_pending_remove(cmd);
6142 goto failed;
6143 }
6144
6145 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6146
6147 failed:
6148 hci_dev_unlock(hdev);
6149 return err;
6150 }
6151
start_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6152 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
6153 void *data, u16 len)
6154 {
6155 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
6156 data, len);
6157 }
6158
start_limited_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6159 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
6160 void *data, u16 len)
6161 {
6162 return start_discovery_internal(sk, hdev,
6163 MGMT_OP_START_LIMITED_DISCOVERY,
6164 data, len);
6165 }
6166
start_service_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6167 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
6168 void *data, u16 len)
6169 {
6170 struct mgmt_cp_start_service_discovery *cp = data;
6171 struct mgmt_pending_cmd *cmd;
6172 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
6173 u16 uuid_count, expected_len;
6174 u8 status;
6175 int err;
6176
6177 bt_dev_dbg(hdev, "sock %p", sk);
6178
6179 hci_dev_lock(hdev);
6180
6181 if (!hdev_is_powered(hdev)) {
6182 err = mgmt_cmd_complete(sk, hdev->id,
6183 MGMT_OP_START_SERVICE_DISCOVERY,
6184 MGMT_STATUS_NOT_POWERED,
6185 &cp->type, sizeof(cp->type));
6186 goto failed;
6187 }
6188
6189 if (hdev->discovery.state != DISCOVERY_STOPPED ||
6190 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6191 err = mgmt_cmd_complete(sk, hdev->id,
6192 MGMT_OP_START_SERVICE_DISCOVERY,
6193 MGMT_STATUS_BUSY, &cp->type,
6194 sizeof(cp->type));
6195 goto failed;
6196 }
6197
6198 if (hdev->discovery_paused) {
6199 err = mgmt_cmd_complete(sk, hdev->id,
6200 MGMT_OP_START_SERVICE_DISCOVERY,
6201 MGMT_STATUS_BUSY, &cp->type,
6202 sizeof(cp->type));
6203 goto failed;
6204 }
6205
6206 uuid_count = __le16_to_cpu(cp->uuid_count);
6207 if (uuid_count > max_uuid_count) {
6208 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6209 uuid_count);
6210 err = mgmt_cmd_complete(sk, hdev->id,
6211 MGMT_OP_START_SERVICE_DISCOVERY,
6212 MGMT_STATUS_INVALID_PARAMS, &cp->type,
6213 sizeof(cp->type));
6214 goto failed;
6215 }
6216
6217 expected_len = sizeof(*cp) + uuid_count * 16;
6218 if (expected_len != len) {
6219 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6220 expected_len, len);
6221 err = mgmt_cmd_complete(sk, hdev->id,
6222 MGMT_OP_START_SERVICE_DISCOVERY,
6223 MGMT_STATUS_INVALID_PARAMS, &cp->type,
6224 sizeof(cp->type));
6225 goto failed;
6226 }
6227
6228 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6229 err = mgmt_cmd_complete(sk, hdev->id,
6230 MGMT_OP_START_SERVICE_DISCOVERY,
6231 status, &cp->type, sizeof(cp->type));
6232 goto failed;
6233 }
6234
6235 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6236 hdev, data, len);
6237 if (!cmd) {
6238 err = -ENOMEM;
6239 goto failed;
6240 }
6241
6242 /* Clear the discovery filter first to free any previously
6243 * allocated memory for the UUID list.
6244 */
6245 hci_discovery_filter_clear(hdev);
6246
6247 hdev->discovery.result_filtering = true;
6248 hdev->discovery.type = cp->type;
6249 hdev->discovery.rssi = cp->rssi;
6250 hdev->discovery.uuid_count = uuid_count;
6251
6252 if (uuid_count > 0) {
6253 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
6254 GFP_KERNEL);
6255 if (!hdev->discovery.uuids) {
6256 err = mgmt_cmd_complete(sk, hdev->id,
6257 MGMT_OP_START_SERVICE_DISCOVERY,
6258 MGMT_STATUS_FAILED,
6259 &cp->type, sizeof(cp->type));
6260 mgmt_pending_remove(cmd);
6261 goto failed;
6262 }
6263 }
6264
6265 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6266 start_discovery_complete);
6267 if (err < 0) {
6268 mgmt_pending_remove(cmd);
6269 goto failed;
6270 }
6271
6272 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6273
6274 failed:
6275 hci_dev_unlock(hdev);
6276 return err;
6277 }
6278
stop_discovery_complete(struct hci_dev * hdev,void * data,int err)6279 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6280 {
6281 struct mgmt_pending_cmd *cmd = data;
6282
6283 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
6284 return;
6285
6286 bt_dev_dbg(hdev, "err %d", err);
6287
6288 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
6289 cmd->param, 1);
6290 mgmt_pending_free(cmd);
6291
6292 if (!err)
6293 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6294 }
6295
stop_discovery_sync(struct hci_dev * hdev,void * data)6296 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6297 {
6298 if (!mgmt_pending_listed(hdev, data))
6299 return -ECANCELED;
6300
6301 return hci_stop_discovery_sync(hdev);
6302 }
6303
stop_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6304 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6305 u16 len)
6306 {
6307 struct mgmt_cp_stop_discovery *mgmt_cp = data;
6308 struct mgmt_pending_cmd *cmd;
6309 int err;
6310
6311 bt_dev_dbg(hdev, "sock %p", sk);
6312
6313 hci_dev_lock(hdev);
6314
6315 if (!hci_discovery_active(hdev)) {
6316 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6317 MGMT_STATUS_REJECTED, &mgmt_cp->type,
6318 sizeof(mgmt_cp->type));
6319 goto unlock;
6320 }
6321
6322 if (hdev->discovery.type != mgmt_cp->type) {
6323 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6324 MGMT_STATUS_INVALID_PARAMS,
6325 &mgmt_cp->type, sizeof(mgmt_cp->type));
6326 goto unlock;
6327 }
6328
6329 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6330 if (!cmd) {
6331 err = -ENOMEM;
6332 goto unlock;
6333 }
6334
6335 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6336 stop_discovery_complete);
6337 if (err < 0) {
6338 mgmt_pending_remove(cmd);
6339 goto unlock;
6340 }
6341
6342 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6343
6344 unlock:
6345 hci_dev_unlock(hdev);
6346 return err;
6347 }
6348
confirm_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6349 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6350 u16 len)
6351 {
6352 struct mgmt_cp_confirm_name *cp = data;
6353 struct inquiry_entry *e;
6354 int err;
6355
6356 bt_dev_dbg(hdev, "sock %p", sk);
6357
6358 hci_dev_lock(hdev);
6359
6360 if (!hci_discovery_active(hdev)) {
6361 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6362 MGMT_STATUS_FAILED, &cp->addr,
6363 sizeof(cp->addr));
6364 goto failed;
6365 }
6366
6367 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6368 if (!e) {
6369 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6370 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6371 sizeof(cp->addr));
6372 goto failed;
6373 }
6374
6375 if (cp->name_known) {
6376 e->name_state = NAME_KNOWN;
6377 list_del(&e->list);
6378 } else {
6379 e->name_state = NAME_NEEDED;
6380 hci_inquiry_cache_update_resolve(hdev, e);
6381 }
6382
6383 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6384 &cp->addr, sizeof(cp->addr));
6385
6386 failed:
6387 hci_dev_unlock(hdev);
6388 return err;
6389 }
6390
block_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6391 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6392 u16 len)
6393 {
6394 struct mgmt_cp_block_device *cp = data;
6395 u8 status;
6396 int err;
6397
6398 bt_dev_dbg(hdev, "sock %p", sk);
6399
6400 if (!bdaddr_type_is_valid(cp->addr.type))
6401 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6402 MGMT_STATUS_INVALID_PARAMS,
6403 &cp->addr, sizeof(cp->addr));
6404
6405 hci_dev_lock(hdev);
6406
6407 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6408 cp->addr.type);
6409 if (err < 0) {
6410 status = MGMT_STATUS_FAILED;
6411 goto done;
6412 }
6413
6414 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6415 sk);
6416 status = MGMT_STATUS_SUCCESS;
6417
6418 done:
6419 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6420 &cp->addr, sizeof(cp->addr));
6421
6422 hci_dev_unlock(hdev);
6423
6424 return err;
6425 }
6426
unblock_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6427 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6428 u16 len)
6429 {
6430 struct mgmt_cp_unblock_device *cp = data;
6431 u8 status;
6432 int err;
6433
6434 bt_dev_dbg(hdev, "sock %p", sk);
6435
6436 if (!bdaddr_type_is_valid(cp->addr.type))
6437 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6438 MGMT_STATUS_INVALID_PARAMS,
6439 &cp->addr, sizeof(cp->addr));
6440
6441 hci_dev_lock(hdev);
6442
6443 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6444 cp->addr.type);
6445 if (err < 0) {
6446 status = MGMT_STATUS_INVALID_PARAMS;
6447 goto done;
6448 }
6449
6450 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6451 sk);
6452 status = MGMT_STATUS_SUCCESS;
6453
6454 done:
6455 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6456 &cp->addr, sizeof(cp->addr));
6457
6458 hci_dev_unlock(hdev);
6459
6460 return err;
6461 }
6462
set_device_id_sync(struct hci_dev * hdev,void * data)6463 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6464 {
6465 return hci_update_eir_sync(hdev);
6466 }
6467
set_device_id(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6468 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6469 u16 len)
6470 {
6471 struct mgmt_cp_set_device_id *cp = data;
6472 int err;
6473 __u16 source;
6474
6475 bt_dev_dbg(hdev, "sock %p", sk);
6476
6477 source = __le16_to_cpu(cp->source);
6478
6479 if (source > 0x0002)
6480 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6481 MGMT_STATUS_INVALID_PARAMS);
6482
6483 hci_dev_lock(hdev);
6484
6485 hdev->devid_source = source;
6486 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6487 hdev->devid_product = __le16_to_cpu(cp->product);
6488 hdev->devid_version = __le16_to_cpu(cp->version);
6489
6490 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6491 NULL, 0);
6492
6493 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6494
6495 hci_dev_unlock(hdev);
6496
6497 return err;
6498 }
6499
enable_advertising_instance(struct hci_dev * hdev,int err)6500 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6501 {
6502 if (err)
6503 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6504 else
6505 bt_dev_dbg(hdev, "status %d", err);
6506 }
6507
set_advertising_complete(struct hci_dev * hdev,void * data,int err)6508 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6509 {
6510 struct mgmt_pending_cmd *cmd = data;
6511 struct cmd_lookup match = { NULL, hdev };
6512 u8 instance;
6513 struct adv_info *adv_instance;
6514 u8 status = mgmt_status(err);
6515
6516 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
6517 return;
6518
6519 if (status) {
6520 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
6521 mgmt_pending_free(cmd);
6522 return;
6523 }
6524
6525 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6526 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6527 else
6528 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6529
6530 settings_rsp(cmd, &match);
6531 mgmt_pending_free(cmd);
6532
6533 new_settings(hdev, match.sk);
6534
6535 if (match.sk)
6536 sock_put(match.sk);
6537
6538 /* If "Set Advertising" was just disabled and instance advertising was
6539 * set up earlier, then re-enable multi-instance advertising.
6540 */
6541 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6542 list_empty(&hdev->adv_instances))
6543 return;
6544
6545 instance = hdev->cur_adv_instance;
6546 if (!instance) {
6547 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6548 struct adv_info, list);
6549 if (!adv_instance)
6550 return;
6551
6552 instance = adv_instance->instance;
6553 }
6554
6555 err = hci_schedule_adv_instance_sync(hdev, instance, true);
6556
6557 enable_advertising_instance(hdev, err);
6558 }
6559
set_adv_sync(struct hci_dev * hdev,void * data)6560 static int set_adv_sync(struct hci_dev *hdev, void *data)
6561 {
6562 struct mgmt_pending_cmd *cmd = data;
6563 struct mgmt_mode cp;
6564 u8 val;
6565
6566 mutex_lock(&hdev->mgmt_pending_lock);
6567
6568 if (!__mgmt_pending_listed(hdev, cmd)) {
6569 mutex_unlock(&hdev->mgmt_pending_lock);
6570 return -ECANCELED;
6571 }
6572
6573 memcpy(&cp, cmd->param, sizeof(cp));
6574
6575 mutex_unlock(&hdev->mgmt_pending_lock);
6576
6577 val = !!cp.val;
6578
6579 if (cp.val == 0x02)
6580 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6581 else
6582 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6583
6584 cancel_adv_timeout(hdev);
6585
6586 if (val) {
6587 /* Switch to instance "0" for the Set Advertising setting.
6588 * We cannot use update_[adv|scan_rsp]_data() here as the
6589 * HCI_ADVERTISING flag is not yet set.
6590 */
6591 hdev->cur_adv_instance = 0x00;
6592
6593 if (ext_adv_capable(hdev)) {
6594 hci_start_ext_adv_sync(hdev, 0x00);
6595 } else {
6596 hci_update_adv_data_sync(hdev, 0x00);
6597 hci_update_scan_rsp_data_sync(hdev, 0x00);
6598 hci_enable_advertising_sync(hdev);
6599 }
6600 } else {
6601 hci_disable_advertising_sync(hdev);
6602 }
6603
6604 return 0;
6605 }
6606
set_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6607 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6608 u16 len)
6609 {
6610 struct mgmt_mode *cp = data;
6611 struct mgmt_pending_cmd *cmd;
6612 u8 val, status;
6613 int err;
6614
6615 bt_dev_dbg(hdev, "sock %p", sk);
6616
6617 status = mgmt_le_support(hdev);
6618 if (status)
6619 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6620 status);
6621
6622 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6623 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6624 MGMT_STATUS_INVALID_PARAMS);
6625
6626 if (hdev->advertising_paused)
6627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6628 MGMT_STATUS_BUSY);
6629
6630 hci_dev_lock(hdev);
6631
6632 val = !!cp->val;
6633
6634 /* The following conditions are ones which mean that we should
6635 * not do any HCI communication but directly send a mgmt
6636 * response to user space (after toggling the flag if
6637 * necessary).
6638 */
6639 if (!hdev_is_powered(hdev) ||
6640 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6641 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6642 hci_dev_test_flag(hdev, HCI_MESH) ||
6643 hci_conn_num(hdev, LE_LINK) > 0 ||
6644 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6645 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6646 bool changed;
6647
6648 if (cp->val) {
6649 hdev->cur_adv_instance = 0x00;
6650 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6651 if (cp->val == 0x02)
6652 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6653 else
6654 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6655 } else {
6656 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6657 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6658 }
6659
6660 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6661 if (err < 0)
6662 goto unlock;
6663
6664 if (changed)
6665 err = new_settings(hdev, sk);
6666
6667 goto unlock;
6668 }
6669
6670 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6671 pending_find(MGMT_OP_SET_LE, hdev)) {
6672 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6673 MGMT_STATUS_BUSY);
6674 goto unlock;
6675 }
6676
6677 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6678 if (!cmd)
6679 err = -ENOMEM;
6680 else
6681 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6682 set_advertising_complete);
6683
6684 if (err < 0 && cmd)
6685 mgmt_pending_remove(cmd);
6686
6687 unlock:
6688 hci_dev_unlock(hdev);
6689 return err;
6690 }
6691
set_static_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6692 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6693 void *data, u16 len)
6694 {
6695 struct mgmt_cp_set_static_address *cp = data;
6696 int err;
6697
6698 bt_dev_dbg(hdev, "sock %p", sk);
6699
6700 if (!lmp_le_capable(hdev))
6701 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6702 MGMT_STATUS_NOT_SUPPORTED);
6703
6704 if (hdev_is_powered(hdev))
6705 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6706 MGMT_STATUS_REJECTED);
6707
6708 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6709 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6710 return mgmt_cmd_status(sk, hdev->id,
6711 MGMT_OP_SET_STATIC_ADDRESS,
6712 MGMT_STATUS_INVALID_PARAMS);
6713
6714 /* Two most significant bits shall be set */
6715 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6716 return mgmt_cmd_status(sk, hdev->id,
6717 MGMT_OP_SET_STATIC_ADDRESS,
6718 MGMT_STATUS_INVALID_PARAMS);
6719 }
6720
6721 hci_dev_lock(hdev);
6722
6723 bacpy(&hdev->static_addr, &cp->bdaddr);
6724
6725 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6726 if (err < 0)
6727 goto unlock;
6728
6729 err = new_settings(hdev, sk);
6730
6731 unlock:
6732 hci_dev_unlock(hdev);
6733 return err;
6734 }
6735
set_scan_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6736 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6737 void *data, u16 len)
6738 {
6739 struct mgmt_cp_set_scan_params *cp = data;
6740 __u16 interval, window;
6741 int err;
6742
6743 bt_dev_dbg(hdev, "sock %p", sk);
6744
6745 if (!lmp_le_capable(hdev))
6746 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6747 MGMT_STATUS_NOT_SUPPORTED);
6748
6749 /* Keep allowed ranges in sync with set_mesh() */
6750 interval = __le16_to_cpu(cp->interval);
6751
6752 if (interval < 0x0004 || interval > 0x4000)
6753 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6754 MGMT_STATUS_INVALID_PARAMS);
6755
6756 window = __le16_to_cpu(cp->window);
6757
6758 if (window < 0x0004 || window > 0x4000)
6759 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6760 MGMT_STATUS_INVALID_PARAMS);
6761
6762 if (window > interval)
6763 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6764 MGMT_STATUS_INVALID_PARAMS);
6765
6766 hci_dev_lock(hdev);
6767
6768 hdev->le_scan_interval = interval;
6769 hdev->le_scan_window = window;
6770
6771 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6772 NULL, 0);
6773
6774 /* If background scan is running, restart it so new parameters are
6775 * loaded.
6776 */
6777 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6778 hdev->discovery.state == DISCOVERY_STOPPED)
6779 hci_update_passive_scan(hdev);
6780
6781 hci_dev_unlock(hdev);
6782
6783 return err;
6784 }
6785
fast_connectable_complete(struct hci_dev * hdev,void * data,int err)6786 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6787 {
6788 struct mgmt_pending_cmd *cmd = data;
6789
6790 bt_dev_dbg(hdev, "err %d", err);
6791
6792 if (err) {
6793 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6794 mgmt_status(err));
6795 } else {
6796 struct mgmt_mode *cp = cmd->param;
6797
6798 if (cp->val)
6799 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6800 else
6801 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6802
6803 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6804 new_settings(hdev, cmd->sk);
6805 }
6806
6807 mgmt_pending_free(cmd);
6808 }
6809
write_fast_connectable_sync(struct hci_dev * hdev,void * data)6810 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6811 {
6812 struct mgmt_pending_cmd *cmd = data;
6813 struct mgmt_mode *cp = cmd->param;
6814
6815 return hci_write_fast_connectable_sync(hdev, cp->val);
6816 }
6817
set_fast_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6818 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6819 void *data, u16 len)
6820 {
6821 struct mgmt_mode *cp = data;
6822 struct mgmt_pending_cmd *cmd;
6823 int err;
6824
6825 bt_dev_dbg(hdev, "sock %p", sk);
6826
6827 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6828 hdev->hci_ver < BLUETOOTH_VER_1_2)
6829 return mgmt_cmd_status(sk, hdev->id,
6830 MGMT_OP_SET_FAST_CONNECTABLE,
6831 MGMT_STATUS_NOT_SUPPORTED);
6832
6833 if (cp->val != 0x00 && cp->val != 0x01)
6834 return mgmt_cmd_status(sk, hdev->id,
6835 MGMT_OP_SET_FAST_CONNECTABLE,
6836 MGMT_STATUS_INVALID_PARAMS);
6837
6838 hci_dev_lock(hdev);
6839
6840 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6841 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6842 goto unlock;
6843 }
6844
6845 if (!hdev_is_powered(hdev)) {
6846 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6847 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6848 new_settings(hdev, sk);
6849 goto unlock;
6850 }
6851
6852 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6853 len);
6854 if (!cmd)
6855 err = -ENOMEM;
6856 else
6857 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6858 fast_connectable_complete);
6859
6860 if (err < 0) {
6861 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6862 MGMT_STATUS_FAILED);
6863
6864 if (cmd)
6865 mgmt_pending_free(cmd);
6866 }
6867
6868 unlock:
6869 hci_dev_unlock(hdev);
6870
6871 return err;
6872 }
6873
set_bredr_complete(struct hci_dev * hdev,void * data,int err)6874 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6875 {
6876 struct mgmt_pending_cmd *cmd = data;
6877
6878 bt_dev_dbg(hdev, "err %d", err);
6879
6880 if (err) {
6881 u8 mgmt_err = mgmt_status(err);
6882
6883 /* We need to restore the flag if related HCI commands
6884 * failed.
6885 */
6886 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6887
6888 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
6889 } else {
6890 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6891 new_settings(hdev, cmd->sk);
6892 }
6893
6894 mgmt_pending_free(cmd);
6895 }
6896
set_bredr_sync(struct hci_dev * hdev,void * data)6897 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6898 {
6899 int status;
6900
6901 status = hci_write_fast_connectable_sync(hdev, false);
6902
6903 if (!status)
6904 status = hci_update_scan_sync(hdev);
6905
6906 /* Since only the advertising data flags will change, there
6907 * is no need to update the scan response data.
6908 */
6909 if (!status)
6910 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6911
6912 return status;
6913 }
6914
set_bredr(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6915 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6916 {
6917 struct mgmt_mode *cp = data;
6918 struct mgmt_pending_cmd *cmd;
6919 int err;
6920
6921 bt_dev_dbg(hdev, "sock %p", sk);
6922
6923 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6924 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6925 MGMT_STATUS_NOT_SUPPORTED);
6926
6927 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6929 MGMT_STATUS_REJECTED);
6930
6931 if (cp->val != 0x00 && cp->val != 0x01)
6932 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6933 MGMT_STATUS_INVALID_PARAMS);
6934
6935 hci_dev_lock(hdev);
6936
6937 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6938 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6939 goto unlock;
6940 }
6941
6942 if (!hdev_is_powered(hdev)) {
6943 if (!cp->val) {
6944 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6945 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6946 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6947 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6948 }
6949
6950 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6951
6952 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6953 if (err < 0)
6954 goto unlock;
6955
6956 err = new_settings(hdev, sk);
6957 goto unlock;
6958 }
6959
6960 /* Reject disabling when powered on */
6961 if (!cp->val) {
6962 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6963 MGMT_STATUS_REJECTED);
6964 goto unlock;
6965 } else {
6966 /* When configuring a dual-mode controller to operate
6967 * with LE only and using a static address, then switching
6968 * BR/EDR back on is not allowed.
6969 *
6970 * Dual-mode controllers shall operate with the public
6971 * address as its identity address for BR/EDR and LE. So
6972 * reject the attempt to create an invalid configuration.
6973 *
6974 * The same restrictions applies when secure connections
6975 * has been enabled. For BR/EDR this is a controller feature
6976 * while for LE it is a host stack feature. This means that
6977 * switching BR/EDR back on when secure connections has been
6978 * enabled is not a supported transaction.
6979 */
6980 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6981 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6982 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6983 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6984 MGMT_STATUS_REJECTED);
6985 goto unlock;
6986 }
6987 }
6988
6989 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6990 if (!cmd)
6991 err = -ENOMEM;
6992 else
6993 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6994 set_bredr_complete);
6995
6996 if (err < 0) {
6997 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6998 MGMT_STATUS_FAILED);
6999 if (cmd)
7000 mgmt_pending_free(cmd);
7001
7002 goto unlock;
7003 }
7004
7005 /* We need to flip the bit already here so that
7006 * hci_req_update_adv_data generates the correct flags.
7007 */
7008 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
7009
7010 unlock:
7011 hci_dev_unlock(hdev);
7012 return err;
7013 }
7014
set_secure_conn_complete(struct hci_dev * hdev,void * data,int err)7015 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
7016 {
7017 struct mgmt_pending_cmd *cmd = data;
7018 struct mgmt_mode *cp;
7019
7020 bt_dev_dbg(hdev, "err %d", err);
7021
7022 if (err) {
7023 u8 mgmt_err = mgmt_status(err);
7024
7025 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
7026 goto done;
7027 }
7028
7029 cp = cmd->param;
7030
7031 switch (cp->val) {
7032 case 0x00:
7033 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
7034 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7035 break;
7036 case 0x01:
7037 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7038 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7039 break;
7040 case 0x02:
7041 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7042 hci_dev_set_flag(hdev, HCI_SC_ONLY);
7043 break;
7044 }
7045
7046 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
7047 new_settings(hdev, cmd->sk);
7048
7049 done:
7050 mgmt_pending_free(cmd);
7051 }
7052
set_secure_conn_sync(struct hci_dev * hdev,void * data)7053 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
7054 {
7055 struct mgmt_pending_cmd *cmd = data;
7056 struct mgmt_mode *cp = cmd->param;
7057 u8 val = !!cp->val;
7058
7059 /* Force write of val */
7060 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7061
7062 return hci_write_sc_support_sync(hdev, val);
7063 }
7064
set_secure_conn(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7065 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
7066 void *data, u16 len)
7067 {
7068 struct mgmt_mode *cp = data;
7069 struct mgmt_pending_cmd *cmd;
7070 u8 val;
7071 int err;
7072
7073 bt_dev_dbg(hdev, "sock %p", sk);
7074
7075 if (!lmp_sc_capable(hdev) &&
7076 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
7077 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7078 MGMT_STATUS_NOT_SUPPORTED);
7079
7080 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7081 lmp_sc_capable(hdev) &&
7082 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
7083 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7084 MGMT_STATUS_REJECTED);
7085
7086 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
7087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7088 MGMT_STATUS_INVALID_PARAMS);
7089
7090 hci_dev_lock(hdev);
7091
7092 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
7093 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7094 bool changed;
7095
7096 if (cp->val) {
7097 changed = !hci_dev_test_and_set_flag(hdev,
7098 HCI_SC_ENABLED);
7099 if (cp->val == 0x02)
7100 hci_dev_set_flag(hdev, HCI_SC_ONLY);
7101 else
7102 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7103 } else {
7104 changed = hci_dev_test_and_clear_flag(hdev,
7105 HCI_SC_ENABLED);
7106 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7107 }
7108
7109 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
7110 if (err < 0)
7111 goto failed;
7112
7113 if (changed)
7114 err = new_settings(hdev, sk);
7115
7116 goto failed;
7117 }
7118
7119 val = !!cp->val;
7120
7121 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7122 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7123 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
7124 goto failed;
7125 }
7126
7127 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
7128 if (!cmd)
7129 err = -ENOMEM;
7130 else
7131 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
7132 set_secure_conn_complete);
7133
7134 if (err < 0) {
7135 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7136 MGMT_STATUS_FAILED);
7137 if (cmd)
7138 mgmt_pending_free(cmd);
7139 }
7140
7141 failed:
7142 hci_dev_unlock(hdev);
7143 return err;
7144 }
7145
set_debug_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7146 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
7147 void *data, u16 len)
7148 {
7149 struct mgmt_mode *cp = data;
7150 bool changed, use_changed;
7151 int err;
7152
7153 bt_dev_dbg(hdev, "sock %p", sk);
7154
7155 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
7156 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
7157 MGMT_STATUS_INVALID_PARAMS);
7158
7159 hci_dev_lock(hdev);
7160
7161 if (cp->val)
7162 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
7163 else
7164 changed = hci_dev_test_and_clear_flag(hdev,
7165 HCI_KEEP_DEBUG_KEYS);
7166
7167 if (cp->val == 0x02)
7168 use_changed = !hci_dev_test_and_set_flag(hdev,
7169 HCI_USE_DEBUG_KEYS);
7170 else
7171 use_changed = hci_dev_test_and_clear_flag(hdev,
7172 HCI_USE_DEBUG_KEYS);
7173
7174 if (hdev_is_powered(hdev) && use_changed &&
7175 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7176 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
7177 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7178 sizeof(mode), &mode);
7179 }
7180
7181 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7182 if (err < 0)
7183 goto unlock;
7184
7185 if (changed)
7186 err = new_settings(hdev, sk);
7187
7188 unlock:
7189 hci_dev_unlock(hdev);
7190 return err;
7191 }
7192
set_privacy(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7193 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7194 u16 len)
7195 {
7196 struct mgmt_cp_set_privacy *cp = cp_data;
7197 bool changed;
7198 int err;
7199
7200 bt_dev_dbg(hdev, "sock %p", sk);
7201
7202 if (!lmp_le_capable(hdev))
7203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7204 MGMT_STATUS_NOT_SUPPORTED);
7205
7206 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7208 MGMT_STATUS_INVALID_PARAMS);
7209
7210 if (hdev_is_powered(hdev))
7211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7212 MGMT_STATUS_REJECTED);
7213
7214 hci_dev_lock(hdev);
7215
7216 /* If user space supports this command it is also expected to
7217 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7218 */
7219 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7220
7221 if (cp->privacy) {
7222 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7223 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7224 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7225 hci_adv_instances_set_rpa_expired(hdev, true);
7226 if (cp->privacy == 0x02)
7227 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7228 else
7229 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7230 } else {
7231 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7232 memset(hdev->irk, 0, sizeof(hdev->irk));
7233 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7234 hci_adv_instances_set_rpa_expired(hdev, false);
7235 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7236 }
7237
7238 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7239 if (err < 0)
7240 goto unlock;
7241
7242 if (changed)
7243 err = new_settings(hdev, sk);
7244
7245 unlock:
7246 hci_dev_unlock(hdev);
7247 return err;
7248 }
7249
irk_is_valid(struct mgmt_irk_info * irk)7250 static bool irk_is_valid(struct mgmt_irk_info *irk)
7251 {
7252 switch (irk->addr.type) {
7253 case BDADDR_LE_PUBLIC:
7254 return true;
7255
7256 case BDADDR_LE_RANDOM:
7257 /* Two most significant bits shall be set */
7258 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7259 return false;
7260 return true;
7261 }
7262
7263 return false;
7264 }
7265
load_irks(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7266 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7267 u16 len)
7268 {
7269 struct mgmt_cp_load_irks *cp = cp_data;
7270 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7271 sizeof(struct mgmt_irk_info));
7272 u16 irk_count, expected_len;
7273 int i, err;
7274
7275 bt_dev_dbg(hdev, "sock %p", sk);
7276
7277 if (!lmp_le_capable(hdev))
7278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7279 MGMT_STATUS_NOT_SUPPORTED);
7280
7281 irk_count = __le16_to_cpu(cp->irk_count);
7282 if (irk_count > max_irk_count) {
7283 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7284 irk_count);
7285 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7286 MGMT_STATUS_INVALID_PARAMS);
7287 }
7288
7289 expected_len = struct_size(cp, irks, irk_count);
7290 if (expected_len != len) {
7291 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7292 expected_len, len);
7293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7294 MGMT_STATUS_INVALID_PARAMS);
7295 }
7296
7297 bt_dev_dbg(hdev, "irk_count %u", irk_count);
7298
7299 for (i = 0; i < irk_count; i++) {
7300 struct mgmt_irk_info *key = &cp->irks[i];
7301
7302 if (!irk_is_valid(key))
7303 return mgmt_cmd_status(sk, hdev->id,
7304 MGMT_OP_LOAD_IRKS,
7305 MGMT_STATUS_INVALID_PARAMS);
7306 }
7307
7308 hci_dev_lock(hdev);
7309
7310 hci_smp_irks_clear(hdev);
7311
7312 for (i = 0; i < irk_count; i++) {
7313 struct mgmt_irk_info *irk = &cp->irks[i];
7314
7315 if (hci_is_blocked_key(hdev,
7316 HCI_BLOCKED_KEY_TYPE_IRK,
7317 irk->val)) {
7318 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7319 &irk->addr.bdaddr);
7320 continue;
7321 }
7322
7323 hci_add_irk(hdev, &irk->addr.bdaddr,
7324 le_addr_type(irk->addr.type), irk->val,
7325 BDADDR_ANY);
7326 }
7327
7328 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7329
7330 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7331
7332 hci_dev_unlock(hdev);
7333
7334 return err;
7335 }
7336
ltk_is_valid(struct mgmt_ltk_info * key)7337 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7338 {
7339 if (key->initiator != 0x00 && key->initiator != 0x01)
7340 return false;
7341
7342 if (key->enc_size > sizeof(key->val))
7343 return false;
7344
7345 switch (key->addr.type) {
7346 case BDADDR_LE_PUBLIC:
7347 return true;
7348
7349 case BDADDR_LE_RANDOM:
7350 /* Two most significant bits shall be set */
7351 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7352 return false;
7353 return true;
7354 }
7355
7356 return false;
7357 }
7358
load_long_term_keys(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7359 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7360 void *cp_data, u16 len)
7361 {
7362 struct mgmt_cp_load_long_term_keys *cp = cp_data;
7363 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7364 sizeof(struct mgmt_ltk_info));
7365 u16 key_count, expected_len;
7366 int i, err;
7367
7368 bt_dev_dbg(hdev, "sock %p", sk);
7369
7370 if (!lmp_le_capable(hdev))
7371 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7372 MGMT_STATUS_NOT_SUPPORTED);
7373
7374 key_count = __le16_to_cpu(cp->key_count);
7375 if (key_count > max_key_count) {
7376 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7377 key_count);
7378 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7379 MGMT_STATUS_INVALID_PARAMS);
7380 }
7381
7382 expected_len = struct_size(cp, keys, key_count);
7383 if (expected_len != len) {
7384 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7385 expected_len, len);
7386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7387 MGMT_STATUS_INVALID_PARAMS);
7388 }
7389
7390 bt_dev_dbg(hdev, "key_count %u", key_count);
7391
7392 hci_dev_lock(hdev);
7393
7394 hci_smp_ltks_clear(hdev);
7395
7396 for (i = 0; i < key_count; i++) {
7397 struct mgmt_ltk_info *key = &cp->keys[i];
7398 u8 type, authenticated;
7399
7400 if (hci_is_blocked_key(hdev,
7401 HCI_BLOCKED_KEY_TYPE_LTK,
7402 key->val)) {
7403 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7404 &key->addr.bdaddr);
7405 continue;
7406 }
7407
7408 if (!ltk_is_valid(key)) {
7409 bt_dev_warn(hdev, "Invalid LTK for %pMR",
7410 &key->addr.bdaddr);
7411 continue;
7412 }
7413
7414 switch (key->type) {
7415 case MGMT_LTK_UNAUTHENTICATED:
7416 authenticated = 0x00;
7417 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7418 break;
7419 case MGMT_LTK_AUTHENTICATED:
7420 authenticated = 0x01;
7421 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7422 break;
7423 case MGMT_LTK_P256_UNAUTH:
7424 authenticated = 0x00;
7425 type = SMP_LTK_P256;
7426 break;
7427 case MGMT_LTK_P256_AUTH:
7428 authenticated = 0x01;
7429 type = SMP_LTK_P256;
7430 break;
7431 case MGMT_LTK_P256_DEBUG:
7432 authenticated = 0x00;
7433 type = SMP_LTK_P256_DEBUG;
7434 fallthrough;
7435 default:
7436 continue;
7437 }
7438
7439 hci_add_ltk(hdev, &key->addr.bdaddr,
7440 le_addr_type(key->addr.type), type, authenticated,
7441 key->val, key->enc_size, key->ediv, key->rand);
7442 }
7443
7444 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7445 NULL, 0);
7446
7447 hci_dev_unlock(hdev);
7448
7449 return err;
7450 }
7451
get_conn_info_complete(struct hci_dev * hdev,void * data,int err)7452 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7453 {
7454 struct mgmt_pending_cmd *cmd = data;
7455 struct hci_conn *conn = cmd->user_data;
7456 struct mgmt_cp_get_conn_info *cp = cmd->param;
7457 struct mgmt_rp_get_conn_info rp;
7458 u8 status;
7459
7460 bt_dev_dbg(hdev, "err %d", err);
7461
7462 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
7463
7464 status = mgmt_status(err);
7465 if (status == MGMT_STATUS_SUCCESS) {
7466 rp.rssi = conn->rssi;
7467 rp.tx_power = conn->tx_power;
7468 rp.max_tx_power = conn->max_tx_power;
7469 } else {
7470 rp.rssi = HCI_RSSI_INVALID;
7471 rp.tx_power = HCI_TX_POWER_INVALID;
7472 rp.max_tx_power = HCI_TX_POWER_INVALID;
7473 }
7474
7475 if (conn)
7476 hci_conn_put(conn);
7477
7478 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status,
7479 &rp, sizeof(rp));
7480
7481 mgmt_pending_free(cmd);
7482 }
7483
get_conn_info_sync(struct hci_dev * hdev,void * data)7484 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7485 {
7486 struct mgmt_pending_cmd *cmd = data;
7487 struct mgmt_cp_get_conn_info *cp = cmd->param;
7488 struct hci_conn *conn;
7489 int err;
7490 __le16 handle;
7491
7492 hci_dev_lock(hdev);
7493
7494 /* Make sure we are still connected */
7495 if (cp->addr.type == BDADDR_BREDR)
7496 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7497 &cp->addr.bdaddr);
7498 else
7499 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7500
7501 if (!conn || conn->state != BT_CONNECTED) {
7502 hci_dev_unlock(hdev);
7503 return MGMT_STATUS_NOT_CONNECTED;
7504 }
7505
7506 cmd->user_data = hci_conn_get(conn);
7507 handle = cpu_to_le16(conn->handle);
7508
7509 hci_dev_unlock(hdev);
7510
7511 /* Refresh RSSI each time */
7512 err = hci_read_rssi_sync(hdev, handle);
7513
7514 /* For LE links TX power does not change thus we don't need to
7515 * query for it once value is known.
7516 */
7517 if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7518 conn->tx_power == HCI_TX_POWER_INVALID))
7519 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7520
7521 /* Max TX power needs to be read only once per connection */
7522 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7523 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7524
7525 return err;
7526 }
7527
get_conn_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7528 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7529 u16 len)
7530 {
7531 struct mgmt_cp_get_conn_info *cp = data;
7532 struct mgmt_rp_get_conn_info rp;
7533 struct hci_conn *conn;
7534 unsigned long conn_info_age;
7535 int err = 0;
7536
7537 bt_dev_dbg(hdev, "sock %p", sk);
7538
7539 memset(&rp, 0, sizeof(rp));
7540 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7541 rp.addr.type = cp->addr.type;
7542
7543 if (!bdaddr_type_is_valid(cp->addr.type))
7544 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7545 MGMT_STATUS_INVALID_PARAMS,
7546 &rp, sizeof(rp));
7547
7548 hci_dev_lock(hdev);
7549
7550 if (!hdev_is_powered(hdev)) {
7551 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7552 MGMT_STATUS_NOT_POWERED, &rp,
7553 sizeof(rp));
7554 goto unlock;
7555 }
7556
7557 if (cp->addr.type == BDADDR_BREDR)
7558 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7559 &cp->addr.bdaddr);
7560 else
7561 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7562
7563 if (!conn || conn->state != BT_CONNECTED) {
7564 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7565 MGMT_STATUS_NOT_CONNECTED, &rp,
7566 sizeof(rp));
7567 goto unlock;
7568 }
7569
7570 /* To avoid client trying to guess when to poll again for information we
7571 * calculate conn info age as random value between min/max set in hdev.
7572 */
7573 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7574 hdev->conn_info_max_age - 1);
7575
7576 /* Query controller to refresh cached values if they are too old or were
7577 * never read.
7578 */
7579 if (time_after(jiffies, conn->conn_info_timestamp +
7580 msecs_to_jiffies(conn_info_age)) ||
7581 !conn->conn_info_timestamp) {
7582 struct mgmt_pending_cmd *cmd;
7583
7584 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7585 len);
7586 if (!cmd) {
7587 err = -ENOMEM;
7588 } else {
7589 err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7590 cmd, get_conn_info_complete);
7591 }
7592
7593 if (err < 0) {
7594 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7595 MGMT_STATUS_FAILED, &rp, sizeof(rp));
7596
7597 if (cmd)
7598 mgmt_pending_free(cmd);
7599
7600 goto unlock;
7601 }
7602
7603 conn->conn_info_timestamp = jiffies;
7604 } else {
7605 /* Cache is valid, just reply with values cached in hci_conn */
7606 rp.rssi = conn->rssi;
7607 rp.tx_power = conn->tx_power;
7608 rp.max_tx_power = conn->max_tx_power;
7609
7610 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7611 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7612 }
7613
7614 unlock:
7615 hci_dev_unlock(hdev);
7616 return err;
7617 }
7618
get_clock_info_complete(struct hci_dev * hdev,void * data,int err)7619 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7620 {
7621 struct mgmt_pending_cmd *cmd = data;
7622 struct mgmt_cp_get_clock_info *cp = cmd->param;
7623 struct mgmt_rp_get_clock_info rp;
7624 struct hci_conn *conn = cmd->user_data;
7625 u8 status = mgmt_status(err);
7626
7627 bt_dev_dbg(hdev, "err %d", err);
7628
7629 memset(&rp, 0, sizeof(rp));
7630 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7631 rp.addr.type = cp->addr.type;
7632
7633 if (err)
7634 goto complete;
7635
7636 rp.local_clock = cpu_to_le32(hdev->clock);
7637
7638 if (conn) {
7639 rp.piconet_clock = cpu_to_le32(conn->clock);
7640 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7641 }
7642
7643 complete:
7644 if (conn)
7645 hci_conn_put(conn);
7646
7647 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp,
7648 sizeof(rp));
7649
7650 mgmt_pending_free(cmd);
7651 }
7652
get_clock_info_sync(struct hci_dev * hdev,void * data)7653 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7654 {
7655 struct mgmt_pending_cmd *cmd = data;
7656 struct mgmt_cp_get_clock_info *cp = cmd->param;
7657 struct hci_cp_read_clock hci_cp;
7658 struct hci_conn *conn;
7659
7660 memset(&hci_cp, 0, sizeof(hci_cp));
7661 hci_read_clock_sync(hdev, &hci_cp);
7662
7663 hci_dev_lock(hdev);
7664
7665 /* Make sure connection still exists */
7666 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7667 if (!conn || conn->state != BT_CONNECTED) {
7668 hci_dev_unlock(hdev);
7669 return MGMT_STATUS_NOT_CONNECTED;
7670 }
7671
7672 cmd->user_data = hci_conn_get(conn);
7673 hci_cp.handle = cpu_to_le16(conn->handle);
7674 hci_cp.which = 0x01; /* Piconet clock */
7675
7676 hci_dev_unlock(hdev);
7677
7678 return hci_read_clock_sync(hdev, &hci_cp);
7679 }
7680
get_clock_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7681 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7682 u16 len)
7683 {
7684 struct mgmt_cp_get_clock_info *cp = data;
7685 struct mgmt_rp_get_clock_info rp;
7686 struct mgmt_pending_cmd *cmd;
7687 struct hci_conn *conn;
7688 int err;
7689
7690 bt_dev_dbg(hdev, "sock %p", sk);
7691
7692 memset(&rp, 0, sizeof(rp));
7693 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7694 rp.addr.type = cp->addr.type;
7695
7696 if (cp->addr.type != BDADDR_BREDR)
7697 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7698 MGMT_STATUS_INVALID_PARAMS,
7699 &rp, sizeof(rp));
7700
7701 hci_dev_lock(hdev);
7702
7703 if (!hdev_is_powered(hdev)) {
7704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7705 MGMT_STATUS_NOT_POWERED, &rp,
7706 sizeof(rp));
7707 goto unlock;
7708 }
7709
7710 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7711 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7712 &cp->addr.bdaddr);
7713 if (!conn || conn->state != BT_CONNECTED) {
7714 err = mgmt_cmd_complete(sk, hdev->id,
7715 MGMT_OP_GET_CLOCK_INFO,
7716 MGMT_STATUS_NOT_CONNECTED,
7717 &rp, sizeof(rp));
7718 goto unlock;
7719 }
7720 } else {
7721 conn = NULL;
7722 }
7723
7724 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7725 if (!cmd)
7726 err = -ENOMEM;
7727 else
7728 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7729 get_clock_info_complete);
7730
7731 if (err < 0) {
7732 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7733 MGMT_STATUS_FAILED, &rp, sizeof(rp));
7734
7735 if (cmd)
7736 mgmt_pending_free(cmd);
7737 }
7738
7739
7740 unlock:
7741 hci_dev_unlock(hdev);
7742 return err;
7743 }
7744
device_added(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type,u8 action)7745 static void device_added(struct sock *sk, struct hci_dev *hdev,
7746 bdaddr_t *bdaddr, u8 type, u8 action)
7747 {
7748 struct mgmt_ev_device_added ev;
7749
7750 bacpy(&ev.addr.bdaddr, bdaddr);
7751 ev.addr.type = type;
7752 ev.action = action;
7753
7754 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7755 }
7756
add_device_complete(struct hci_dev * hdev,void * data,int err)7757 static void add_device_complete(struct hci_dev *hdev, void *data, int err)
7758 {
7759 struct mgmt_pending_cmd *cmd = data;
7760 struct mgmt_cp_add_device *cp = cmd->param;
7761
7762 if (!err) {
7763 struct hci_conn_params *params;
7764
7765 hci_dev_lock(hdev);
7766
7767 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7768 le_addr_type(cp->addr.type));
7769
7770 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type,
7771 cp->action);
7772 device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
7773 cp->addr.type, hdev->conn_flags,
7774 params ? params->flags : 0);
7775 hci_dev_unlock(hdev);
7776 }
7777
7778 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
7779 mgmt_status(err), &cp->addr, sizeof(cp->addr));
7780 mgmt_pending_free(cmd);
7781 }
7782
add_device_sync(struct hci_dev * hdev,void * data)7783 static int add_device_sync(struct hci_dev *hdev, void *data)
7784 {
7785 return hci_update_passive_scan_sync(hdev);
7786 }
7787
add_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7788 static int add_device(struct sock *sk, struct hci_dev *hdev,
7789 void *data, u16 len)
7790 {
7791 struct mgmt_pending_cmd *cmd;
7792 struct mgmt_cp_add_device *cp = data;
7793 u8 auto_conn, addr_type;
7794 struct hci_conn_params *params;
7795 int err;
7796 u32 current_flags = 0;
7797 u32 supported_flags;
7798
7799 bt_dev_dbg(hdev, "sock %p", sk);
7800
7801 if (!bdaddr_type_is_valid(cp->addr.type) ||
7802 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7803 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7804 MGMT_STATUS_INVALID_PARAMS,
7805 &cp->addr, sizeof(cp->addr));
7806
7807 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7808 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7809 MGMT_STATUS_INVALID_PARAMS,
7810 &cp->addr, sizeof(cp->addr));
7811
7812 hci_dev_lock(hdev);
7813
7814 if (cp->addr.type == BDADDR_BREDR) {
7815 /* Only incoming connections action is supported for now */
7816 if (cp->action != 0x01) {
7817 err = mgmt_cmd_complete(sk, hdev->id,
7818 MGMT_OP_ADD_DEVICE,
7819 MGMT_STATUS_INVALID_PARAMS,
7820 &cp->addr, sizeof(cp->addr));
7821 goto unlock;
7822 }
7823
7824 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7825 &cp->addr.bdaddr,
7826 cp->addr.type, 0);
7827 if (err)
7828 goto unlock;
7829
7830 hci_update_scan(hdev);
7831
7832 goto added;
7833 }
7834
7835 addr_type = le_addr_type(cp->addr.type);
7836
7837 if (cp->action == 0x02)
7838 auto_conn = HCI_AUTO_CONN_ALWAYS;
7839 else if (cp->action == 0x01)
7840 auto_conn = HCI_AUTO_CONN_DIRECT;
7841 else
7842 auto_conn = HCI_AUTO_CONN_REPORT;
7843
7844 /* Kernel internally uses conn_params with resolvable private
7845 * address, but Add Device allows only identity addresses.
7846 * Make sure it is enforced before calling
7847 * hci_conn_params_lookup.
7848 */
7849 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7850 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7851 MGMT_STATUS_INVALID_PARAMS,
7852 &cp->addr, sizeof(cp->addr));
7853 goto unlock;
7854 }
7855
7856 /* If the connection parameters don't exist for this device,
7857 * they will be created and configured with defaults.
7858 */
7859 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7860 auto_conn);
7861 if (!params) {
7862 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7863 MGMT_STATUS_FAILED, &cp->addr,
7864 sizeof(cp->addr));
7865 goto unlock;
7866 }
7867
7868 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
7869 if (!cmd) {
7870 err = -ENOMEM;
7871 goto unlock;
7872 }
7873
7874 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd,
7875 add_device_complete);
7876 if (err < 0) {
7877 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7878 MGMT_STATUS_FAILED, &cp->addr,
7879 sizeof(cp->addr));
7880 mgmt_pending_free(cmd);
7881 }
7882
7883 goto unlock;
7884
7885 added:
7886 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7887 supported_flags = hdev->conn_flags;
7888 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7889 supported_flags, current_flags);
7890
7891 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7892 MGMT_STATUS_SUCCESS, &cp->addr,
7893 sizeof(cp->addr));
7894
7895 unlock:
7896 hci_dev_unlock(hdev);
7897 return err;
7898 }
7899
device_removed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)7900 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7901 bdaddr_t *bdaddr, u8 type)
7902 {
7903 struct mgmt_ev_device_removed ev;
7904
7905 bacpy(&ev.addr.bdaddr, bdaddr);
7906 ev.addr.type = type;
7907
7908 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7909 }
7910
remove_device_sync(struct hci_dev * hdev,void * data)7911 static int remove_device_sync(struct hci_dev *hdev, void *data)
7912 {
7913 return hci_update_passive_scan_sync(hdev);
7914 }
7915
remove_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7916 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7917 void *data, u16 len)
7918 {
7919 struct mgmt_cp_remove_device *cp = data;
7920 int err;
7921
7922 bt_dev_dbg(hdev, "sock %p", sk);
7923
7924 hci_dev_lock(hdev);
7925
7926 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7927 struct hci_conn_params *params;
7928 u8 addr_type;
7929
7930 if (!bdaddr_type_is_valid(cp->addr.type)) {
7931 err = mgmt_cmd_complete(sk, hdev->id,
7932 MGMT_OP_REMOVE_DEVICE,
7933 MGMT_STATUS_INVALID_PARAMS,
7934 &cp->addr, sizeof(cp->addr));
7935 goto unlock;
7936 }
7937
7938 if (cp->addr.type == BDADDR_BREDR) {
7939 err = hci_bdaddr_list_del(&hdev->accept_list,
7940 &cp->addr.bdaddr,
7941 cp->addr.type);
7942 if (err) {
7943 err = mgmt_cmd_complete(sk, hdev->id,
7944 MGMT_OP_REMOVE_DEVICE,
7945 MGMT_STATUS_INVALID_PARAMS,
7946 &cp->addr,
7947 sizeof(cp->addr));
7948 goto unlock;
7949 }
7950
7951 hci_update_scan(hdev);
7952
7953 device_removed(sk, hdev, &cp->addr.bdaddr,
7954 cp->addr.type);
7955 goto complete;
7956 }
7957
7958 addr_type = le_addr_type(cp->addr.type);
7959
7960 /* Kernel internally uses conn_params with resolvable private
7961 * address, but Remove Device allows only identity addresses.
7962 * Make sure it is enforced before calling
7963 * hci_conn_params_lookup.
7964 */
7965 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7966 err = mgmt_cmd_complete(sk, hdev->id,
7967 MGMT_OP_REMOVE_DEVICE,
7968 MGMT_STATUS_INVALID_PARAMS,
7969 &cp->addr, sizeof(cp->addr));
7970 goto unlock;
7971 }
7972
7973 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7974 addr_type);
7975 if (!params) {
7976 err = mgmt_cmd_complete(sk, hdev->id,
7977 MGMT_OP_REMOVE_DEVICE,
7978 MGMT_STATUS_INVALID_PARAMS,
7979 &cp->addr, sizeof(cp->addr));
7980 goto unlock;
7981 }
7982
7983 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7984 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7985 err = mgmt_cmd_complete(sk, hdev->id,
7986 MGMT_OP_REMOVE_DEVICE,
7987 MGMT_STATUS_INVALID_PARAMS,
7988 &cp->addr, sizeof(cp->addr));
7989 goto unlock;
7990 }
7991
7992 hci_conn_params_free(params);
7993
7994 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7995 } else {
7996 struct hci_conn_params *p, *tmp;
7997 struct bdaddr_list *b, *btmp;
7998
7999 if (cp->addr.type) {
8000 err = mgmt_cmd_complete(sk, hdev->id,
8001 MGMT_OP_REMOVE_DEVICE,
8002 MGMT_STATUS_INVALID_PARAMS,
8003 &cp->addr, sizeof(cp->addr));
8004 goto unlock;
8005 }
8006
8007 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8008 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8009 list_del(&b->list);
8010 kfree(b);
8011 }
8012
8013 hci_update_scan(hdev);
8014
8015 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8016 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8017 continue;
8018 device_removed(sk, hdev, &p->addr, p->addr_type);
8019 if (p->explicit_connect) {
8020 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8021 continue;
8022 }
8023 hci_conn_params_free(p);
8024 }
8025
8026 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8027 }
8028
8029 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
8030
8031 complete:
8032 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8033 MGMT_STATUS_SUCCESS, &cp->addr,
8034 sizeof(cp->addr));
8035 unlock:
8036 hci_dev_unlock(hdev);
8037 return err;
8038 }
8039
conn_update_sync(struct hci_dev * hdev,void * data)8040 static int conn_update_sync(struct hci_dev *hdev, void *data)
8041 {
8042 struct hci_conn *conn = data;
8043 struct hci_conn_params *params;
8044 struct hci_conn_params local = {};
8045
8046 hci_dev_lock(hdev);
8047
8048 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER)
8049 goto cancel;
8050
8051 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
8052 if (!params)
8053 goto cancel;
8054
8055 local.conn_min_interval = params->conn_min_interval;
8056 local.conn_max_interval = params->conn_max_interval;
8057 local.conn_latency = params->conn_latency;
8058 local.supervision_timeout = params->supervision_timeout;
8059
8060 hci_dev_unlock(hdev);
8061
8062 return hci_le_conn_update_sync(hdev, conn, &local);
8063
8064 cancel:
8065 hci_dev_unlock(hdev);
8066 return -ECANCELED;
8067 }
8068
conn_update_sync_destroy(struct hci_dev * hdev,void * data,int err)8069 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err)
8070 {
8071 hci_conn_put(data);
8072 }
8073
load_conn_param(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8074 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8075 u16 len)
8076 {
8077 struct mgmt_cp_load_conn_param *cp = data;
8078 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8079 sizeof(struct mgmt_conn_param));
8080 u16 param_count, expected_len;
8081 int i;
8082
8083 if (!lmp_le_capable(hdev))
8084 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8085 MGMT_STATUS_NOT_SUPPORTED);
8086
8087 param_count = __le16_to_cpu(cp->param_count);
8088 if (param_count > max_param_count) {
8089 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8090 param_count);
8091 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8092 MGMT_STATUS_INVALID_PARAMS);
8093 }
8094
8095 expected_len = struct_size(cp, params, param_count);
8096 if (expected_len != len) {
8097 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8098 expected_len, len);
8099 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8100 MGMT_STATUS_INVALID_PARAMS);
8101 }
8102
8103 bt_dev_dbg(hdev, "param_count %u", param_count);
8104
8105 hci_dev_lock(hdev);
8106
8107 if (param_count > 1)
8108 hci_conn_params_clear_disabled(hdev);
8109
8110 for (i = 0; i < param_count; i++) {
8111 struct mgmt_conn_param *param = &cp->params[i];
8112 struct hci_conn_params *hci_param;
8113 u16 min, max, latency, timeout;
8114 bool update = false;
8115 u8 addr_type;
8116
8117 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr,
8118 param->addr.type);
8119
8120 if (param->addr.type == BDADDR_LE_PUBLIC) {
8121 addr_type = ADDR_LE_DEV_PUBLIC;
8122 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8123 addr_type = ADDR_LE_DEV_RANDOM;
8124 } else {
8125 bt_dev_err(hdev, "ignoring invalid connection parameters");
8126 continue;
8127 }
8128
8129 min = le16_to_cpu(param->min_interval);
8130 max = le16_to_cpu(param->max_interval);
8131 latency = le16_to_cpu(param->latency);
8132 timeout = le16_to_cpu(param->timeout);
8133
8134 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8135 min, max, latency, timeout);
8136
8137 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8138 bt_dev_err(hdev, "ignoring invalid connection parameters");
8139 continue;
8140 }
8141
8142 /* Detect when the loading is for an existing parameter then
8143 * attempt to trigger the connection update procedure.
8144 */
8145 if (!i && param_count == 1) {
8146 hci_param = hci_conn_params_lookup(hdev,
8147 ¶m->addr.bdaddr,
8148 addr_type);
8149 if (hci_param)
8150 update = true;
8151 else
8152 hci_conn_params_clear_disabled(hdev);
8153 }
8154
8155 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
8156 addr_type);
8157 if (!hci_param) {
8158 bt_dev_err(hdev, "failed to add connection parameters");
8159 continue;
8160 }
8161
8162 hci_param->conn_min_interval = min;
8163 hci_param->conn_max_interval = max;
8164 hci_param->conn_latency = latency;
8165 hci_param->supervision_timeout = timeout;
8166
8167 /* Check if we need to trigger a connection update */
8168 if (update) {
8169 struct hci_conn *conn;
8170
8171 /* Lookup for existing connection as central and check
8172 * if parameters match and if they don't then trigger
8173 * a connection update.
8174 */
8175 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr,
8176 addr_type);
8177 if (conn && conn->role == HCI_ROLE_MASTER &&
8178 (conn->le_conn_min_interval != min ||
8179 conn->le_conn_max_interval != max ||
8180 conn->le_conn_latency != latency ||
8181 conn->le_supv_timeout != timeout)) {
8182 hci_conn_get(conn);
8183 if (hci_cmd_sync_queue(hdev, conn_update_sync,
8184 conn,
8185 conn_update_sync_destroy) < 0)
8186 hci_conn_put(conn);
8187 }
8188 }
8189 }
8190
8191 hci_dev_unlock(hdev);
8192
8193 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8194 NULL, 0);
8195 }
8196
load_conn_subrate(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8197 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data,
8198 u16 len)
8199 {
8200 struct mgmt_cp_load_conn_subrate *cp = data;
8201 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8202 sizeof(struct mgmt_conn_subrate));
8203 u16 param_count, expected_len;
8204 int i;
8205
8206 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev))
8207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8208 MGMT_STATUS_NOT_SUPPORTED);
8209
8210 param_count = __le16_to_cpu(cp->param_count);
8211 if (param_count > max_param_count) {
8212 bt_dev_err(hdev, "too big param_count value %u", param_count);
8213 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8214 MGMT_STATUS_INVALID_PARAMS);
8215 }
8216
8217 expected_len = struct_size(cp, params, param_count);
8218 if (expected_len != len) {
8219 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
8220 expected_len, len);
8221 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8222 MGMT_STATUS_INVALID_PARAMS);
8223 }
8224
8225 bt_dev_dbg(hdev, "param_count %u", param_count);
8226
8227 hci_dev_lock(hdev);
8228
8229 for (i = 0; i < param_count; i++) {
8230 struct mgmt_conn_subrate *param = &cp->params[i];
8231 struct hci_conn_params *hci_param;
8232 u16 min, max, subrate_min, subrate_max;
8233 u16 max_latency, cont_num, supv_timeout;
8234 u8 addr_type;
8235
8236 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)",
8237 ¶m->addr.bdaddr, param->addr.type);
8238
8239 if (param->addr.type == BDADDR_LE_PUBLIC) {
8240 addr_type = ADDR_LE_DEV_PUBLIC;
8241 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8242 addr_type = ADDR_LE_DEV_RANDOM;
8243 } else {
8244 bt_dev_err(hdev, "ignoring invalid connection subrate parameters");
8245 continue;
8246 }
8247
8248 min = le16_to_cpu(param->min_interval);
8249 max = le16_to_cpu(param->max_interval);
8250 subrate_min = le16_to_cpu(param->subrate_min);
8251 subrate_max = le16_to_cpu(param->subrate_max);
8252 max_latency = le16_to_cpu(param->max_latency);
8253 cont_num = le16_to_cpu(param->cont_num);
8254 supv_timeout = le16_to_cpu(param->supv_timeout);
8255
8256 /* Validate the parameters before storing them. Reject
8257 * logically inconsistent values instead of forwarding them to
8258 * the controller.
8259 */
8260 if (min > max || subrate_min > subrate_max ||
8261 subrate_min < 1 || supv_timeout < 1) {
8262 bt_dev_err(hdev, "ignoring invalid connection subrate parameters");
8263 continue;
8264 }
8265
8266 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
8267 addr_type);
8268 if (!hci_param) {
8269 bt_dev_err(hdev, "failed to add connection parameters");
8270 continue;
8271 }
8272
8273 hci_param->rate_min_interval = min;
8274 hci_param->rate_max_interval = max;
8275 hci_param->subrate_min = subrate_min;
8276 hci_param->subrate_max = subrate_max;
8277 hci_param->max_latency = max_latency;
8278 hci_param->cont_num = cont_num;
8279 hci_param->rate_supv_timeout = supv_timeout;
8280
8281 /* If the device is connected as central check if the
8282 * connection rate parameters need to be updated.
8283 */
8284 if (!i && param_count == 1) {
8285 struct hci_conn *conn;
8286
8287 conn = hci_conn_hash_lookup_le(hdev,
8288 &hci_param->addr,
8289 addr_type);
8290 if (conn && conn->state == BT_CONNECTED &&
8291 conn->role == HCI_ROLE_MASTER &&
8292 (conn->le_rate_interval < min ||
8293 conn->le_rate_interval > max ||
8294 conn->le_subrate < subrate_min ||
8295 conn->le_subrate > subrate_max ||
8296 conn->le_rate_latency != max_latency ||
8297 conn->le_cont_num != cont_num ||
8298 conn->le_rate_supv_timeout != supv_timeout))
8299 hci_le_conn_rate_request(hdev, conn);
8300 }
8301 }
8302
8303 hci_dev_unlock(hdev);
8304
8305 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0,
8306 NULL, 0);
8307 }
8308
set_external_config(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8309 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8310 void *data, u16 len)
8311 {
8312 struct mgmt_cp_set_external_config *cp = data;
8313 bool changed;
8314 int err;
8315
8316 bt_dev_dbg(hdev, "sock %p", sk);
8317
8318 if (hdev_is_powered(hdev))
8319 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8320 MGMT_STATUS_REJECTED);
8321
8322 if (cp->config != 0x00 && cp->config != 0x01)
8323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8324 MGMT_STATUS_INVALID_PARAMS);
8325
8326 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG))
8327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8328 MGMT_STATUS_NOT_SUPPORTED);
8329
8330 hci_dev_lock(hdev);
8331
8332 if (cp->config)
8333 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8334 else
8335 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8336
8337 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8338 if (err < 0)
8339 goto unlock;
8340
8341 if (!changed)
8342 goto unlock;
8343
8344 err = new_options(hdev, sk);
8345
8346 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8347 mgmt_index_removed(hdev);
8348
8349 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8350 hci_dev_set_flag(hdev, HCI_CONFIG);
8351 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8352
8353 queue_work(hdev->req_workqueue, &hdev->power_on);
8354 } else {
8355 set_bit(HCI_RAW, &hdev->flags);
8356 mgmt_index_added(hdev);
8357 }
8358 }
8359
8360 unlock:
8361 hci_dev_unlock(hdev);
8362 return err;
8363 }
8364
set_public_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8365 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8366 void *data, u16 len)
8367 {
8368 struct mgmt_cp_set_public_address *cp = data;
8369 bool changed;
8370 int err;
8371
8372 bt_dev_dbg(hdev, "sock %p", sk);
8373
8374 if (hdev_is_powered(hdev))
8375 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8376 MGMT_STATUS_REJECTED);
8377
8378 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8380 MGMT_STATUS_INVALID_PARAMS);
8381
8382 if (!hdev->set_bdaddr)
8383 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8384 MGMT_STATUS_NOT_SUPPORTED);
8385
8386 hci_dev_lock(hdev);
8387
8388 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8389 bacpy(&hdev->public_addr, &cp->bdaddr);
8390
8391 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8392 if (err < 0)
8393 goto unlock;
8394
8395 if (!changed)
8396 goto unlock;
8397
8398 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8399 err = new_options(hdev, sk);
8400
8401 if (is_configured(hdev)) {
8402 mgmt_index_removed(hdev);
8403
8404 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8405
8406 hci_dev_set_flag(hdev, HCI_CONFIG);
8407 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8408
8409 queue_work(hdev->req_workqueue, &hdev->power_on);
8410 }
8411
8412 unlock:
8413 hci_dev_unlock(hdev);
8414 return err;
8415 }
8416
read_local_oob_ext_data_complete(struct hci_dev * hdev,void * data,int err)8417 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8418 int err)
8419 {
8420 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8421 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8422 u8 *h192, *r192, *h256, *r256;
8423 struct mgmt_pending_cmd *cmd = data;
8424 struct sk_buff *skb = cmd->skb;
8425 u8 status = mgmt_status(err);
8426 u16 eir_len;
8427
8428 if (!status) {
8429 if (!skb)
8430 status = MGMT_STATUS_FAILED;
8431 else if (IS_ERR(skb))
8432 status = mgmt_status(PTR_ERR(skb));
8433 else
8434 status = mgmt_status(skb->data[0]);
8435 }
8436
8437 bt_dev_dbg(hdev, "status %u", status);
8438
8439 mgmt_cp = cmd->param;
8440
8441 if (status) {
8442 status = mgmt_status(status);
8443 eir_len = 0;
8444
8445 h192 = NULL;
8446 r192 = NULL;
8447 h256 = NULL;
8448 r256 = NULL;
8449 } else if (!bredr_sc_enabled(hdev)) {
8450 struct hci_rp_read_local_oob_data *rp;
8451
8452 if (skb->len != sizeof(*rp)) {
8453 status = MGMT_STATUS_FAILED;
8454 eir_len = 0;
8455 } else {
8456 status = MGMT_STATUS_SUCCESS;
8457 rp = (void *)skb->data;
8458
8459 eir_len = 5 + 18 + 18;
8460 h192 = rp->hash;
8461 r192 = rp->rand;
8462 h256 = NULL;
8463 r256 = NULL;
8464 }
8465 } else {
8466 struct hci_rp_read_local_oob_ext_data *rp;
8467
8468 if (skb->len != sizeof(*rp)) {
8469 status = MGMT_STATUS_FAILED;
8470 eir_len = 0;
8471 } else {
8472 status = MGMT_STATUS_SUCCESS;
8473 rp = (void *)skb->data;
8474
8475 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8476 eir_len = 5 + 18 + 18;
8477 h192 = NULL;
8478 r192 = NULL;
8479 } else {
8480 eir_len = 5 + 18 + 18 + 18 + 18;
8481 h192 = rp->hash192;
8482 r192 = rp->rand192;
8483 }
8484
8485 h256 = rp->hash256;
8486 r256 = rp->rand256;
8487 }
8488 }
8489
8490 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8491 if (!mgmt_rp)
8492 goto done;
8493
8494 if (eir_len == 0)
8495 goto send_rsp;
8496
8497 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8498 hdev->dev_class, 3);
8499
8500 if (h192 && r192) {
8501 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8502 EIR_SSP_HASH_C192, h192, 16);
8503 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8504 EIR_SSP_RAND_R192, r192, 16);
8505 }
8506
8507 if (h256 && r256) {
8508 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8509 EIR_SSP_HASH_C256, h256, 16);
8510 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8511 EIR_SSP_RAND_R256, r256, 16);
8512 }
8513
8514 send_rsp:
8515 mgmt_rp->type = mgmt_cp->type;
8516 mgmt_rp->eir_len = cpu_to_le16(eir_len);
8517
8518 err = mgmt_cmd_complete(cmd->sk, hdev->id,
8519 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8520 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8521 if (err < 0 || status)
8522 goto done;
8523
8524 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8525
8526 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8527 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8528 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8529 done:
8530 if (skb && !IS_ERR(skb))
8531 kfree_skb(skb);
8532
8533 kfree(mgmt_rp);
8534 mgmt_pending_free(cmd);
8535 }
8536
read_local_ssp_oob_req(struct hci_dev * hdev,struct sock * sk,struct mgmt_cp_read_local_oob_ext_data * cp)8537 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8538 struct mgmt_cp_read_local_oob_ext_data *cp)
8539 {
8540 struct mgmt_pending_cmd *cmd;
8541 int err;
8542
8543 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8544 cp, sizeof(*cp));
8545 if (!cmd)
8546 return -ENOMEM;
8547
8548 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8549 read_local_oob_ext_data_complete);
8550
8551 if (err < 0) {
8552 mgmt_pending_remove(cmd);
8553 return err;
8554 }
8555
8556 return 0;
8557 }
8558
read_local_oob_ext_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8559 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8560 void *data, u16 data_len)
8561 {
8562 struct mgmt_cp_read_local_oob_ext_data *cp = data;
8563 struct mgmt_rp_read_local_oob_ext_data *rp;
8564 size_t rp_len;
8565 u16 eir_len;
8566 u8 status, flags, role, addr[7], hash[16], rand[16];
8567 int err;
8568
8569 bt_dev_dbg(hdev, "sock %p", sk);
8570
8571 if (hdev_is_powered(hdev)) {
8572 switch (cp->type) {
8573 case BIT(BDADDR_BREDR):
8574 status = mgmt_bredr_support(hdev);
8575 if (status)
8576 eir_len = 0;
8577 else
8578 eir_len = 5;
8579 break;
8580 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8581 status = mgmt_le_support(hdev);
8582 if (status)
8583 eir_len = 0;
8584 else
8585 eir_len = 9 + 3 + 18 + 18 + 3;
8586 break;
8587 default:
8588 status = MGMT_STATUS_INVALID_PARAMS;
8589 eir_len = 0;
8590 break;
8591 }
8592 } else {
8593 status = MGMT_STATUS_NOT_POWERED;
8594 eir_len = 0;
8595 }
8596
8597 rp_len = sizeof(*rp) + eir_len;
8598 rp = kmalloc(rp_len, GFP_ATOMIC);
8599 if (!rp)
8600 return -ENOMEM;
8601
8602 if (!status && !lmp_ssp_capable(hdev)) {
8603 status = MGMT_STATUS_NOT_SUPPORTED;
8604 eir_len = 0;
8605 }
8606
8607 if (status)
8608 goto complete;
8609
8610 hci_dev_lock(hdev);
8611
8612 eir_len = 0;
8613 switch (cp->type) {
8614 case BIT(BDADDR_BREDR):
8615 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8616 err = read_local_ssp_oob_req(hdev, sk, cp);
8617 hci_dev_unlock(hdev);
8618 if (!err)
8619 goto done;
8620
8621 status = MGMT_STATUS_FAILED;
8622 goto complete;
8623 } else {
8624 eir_len = eir_append_data(rp->eir, eir_len,
8625 EIR_CLASS_OF_DEV,
8626 hdev->dev_class, 3);
8627 }
8628 break;
8629 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8630 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8631 smp_generate_oob(hdev, hash, rand) < 0) {
8632 hci_dev_unlock(hdev);
8633 status = MGMT_STATUS_FAILED;
8634 goto complete;
8635 }
8636
8637 /* This should return the active RPA, but since the RPA
8638 * is only programmed on demand, it is really hard to fill
8639 * this in at the moment. For now disallow retrieving
8640 * local out-of-band data when privacy is in use.
8641 *
8642 * Returning the identity address will not help here since
8643 * pairing happens before the identity resolving key is
8644 * known and thus the connection establishment happens
8645 * based on the RPA and not the identity address.
8646 */
8647 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8648 hci_dev_unlock(hdev);
8649 status = MGMT_STATUS_REJECTED;
8650 goto complete;
8651 }
8652
8653 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8654 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8655 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8656 bacmp(&hdev->static_addr, BDADDR_ANY))) {
8657 memcpy(addr, &hdev->static_addr, 6);
8658 addr[6] = 0x01;
8659 } else {
8660 memcpy(addr, &hdev->bdaddr, 6);
8661 addr[6] = 0x00;
8662 }
8663
8664 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8665 addr, sizeof(addr));
8666
8667 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8668 role = 0x02;
8669 else
8670 role = 0x01;
8671
8672 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8673 &role, sizeof(role));
8674
8675 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8676 eir_len = eir_append_data(rp->eir, eir_len,
8677 EIR_LE_SC_CONFIRM,
8678 hash, sizeof(hash));
8679
8680 eir_len = eir_append_data(rp->eir, eir_len,
8681 EIR_LE_SC_RANDOM,
8682 rand, sizeof(rand));
8683 }
8684
8685 flags = mgmt_get_adv_discov_flags(hdev);
8686
8687 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8688 flags |= LE_AD_NO_BREDR;
8689
8690 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8691 &flags, sizeof(flags));
8692 break;
8693 }
8694
8695 hci_dev_unlock(hdev);
8696
8697 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8698
8699 status = MGMT_STATUS_SUCCESS;
8700
8701 complete:
8702 rp->type = cp->type;
8703 rp->eir_len = cpu_to_le16(eir_len);
8704
8705 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8706 status, rp, sizeof(*rp) + eir_len);
8707 if (err < 0 || status)
8708 goto done;
8709
8710 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8711 rp, sizeof(*rp) + eir_len,
8712 HCI_MGMT_OOB_DATA_EVENTS, sk);
8713
8714 done:
8715 kfree(rp);
8716
8717 return err;
8718 }
8719
get_supported_adv_flags(struct hci_dev * hdev)8720 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8721 {
8722 u32 flags = 0;
8723
8724 flags |= MGMT_ADV_FLAG_CONNECTABLE;
8725 flags |= MGMT_ADV_FLAG_DISCOV;
8726 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8727 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8728 flags |= MGMT_ADV_FLAG_APPEARANCE;
8729 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8730 flags |= MGMT_ADV_PARAM_DURATION;
8731 flags |= MGMT_ADV_PARAM_TIMEOUT;
8732 flags |= MGMT_ADV_PARAM_INTERVALS;
8733 flags |= MGMT_ADV_PARAM_TX_POWER;
8734 flags |= MGMT_ADV_PARAM_SCAN_RSP;
8735
8736 /* In extended adv TX_POWER returned from Set Adv Param
8737 * will be always valid.
8738 */
8739 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8740 flags |= MGMT_ADV_FLAG_TX_POWER;
8741
8742 if (ext_adv_capable(hdev)) {
8743 flags |= MGMT_ADV_FLAG_SEC_1M;
8744 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8745 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8746
8747 if (le_2m_capable(hdev))
8748 flags |= MGMT_ADV_FLAG_SEC_2M;
8749
8750 if (le_coded_capable(hdev))
8751 flags |= MGMT_ADV_FLAG_SEC_CODED;
8752 }
8753
8754 return flags;
8755 }
8756
read_adv_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8757 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8758 void *data, u16 data_len)
8759 {
8760 struct mgmt_rp_read_adv_features *rp;
8761 size_t rp_len;
8762 int err;
8763 struct adv_info *adv_instance;
8764 u32 supported_flags;
8765 u8 *instance;
8766
8767 bt_dev_dbg(hdev, "sock %p", sk);
8768
8769 if (!lmp_le_capable(hdev))
8770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8771 MGMT_STATUS_REJECTED);
8772
8773 hci_dev_lock(hdev);
8774
8775 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8776 rp = kmalloc(rp_len, GFP_ATOMIC);
8777 if (!rp) {
8778 hci_dev_unlock(hdev);
8779 return -ENOMEM;
8780 }
8781
8782 supported_flags = get_supported_adv_flags(hdev);
8783
8784 rp->supported_flags = cpu_to_le32(supported_flags);
8785 rp->max_adv_data_len = max_adv_len(hdev);
8786 rp->max_scan_rsp_len = max_adv_len(hdev);
8787 rp->max_instances = hdev->le_num_of_adv_sets;
8788 rp->num_instances = hdev->adv_instance_cnt;
8789
8790 instance = rp->instance;
8791 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8792 /* Only instances 1-le_num_of_adv_sets are externally visible */
8793 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8794 *instance = adv_instance->instance;
8795 instance++;
8796 } else {
8797 rp->num_instances--;
8798 rp_len--;
8799 }
8800 }
8801
8802 hci_dev_unlock(hdev);
8803
8804 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8805 MGMT_STATUS_SUCCESS, rp, rp_len);
8806
8807 kfree(rp);
8808
8809 return err;
8810 }
8811
calculate_name_len(struct hci_dev * hdev)8812 static u8 calculate_name_len(struct hci_dev *hdev)
8813 {
8814 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
8815
8816 return eir_append_local_name(hdev, buf, 0);
8817 }
8818
tlv_data_max_len(struct hci_dev * hdev,u32 adv_flags,bool is_adv_data)8819 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8820 bool is_adv_data)
8821 {
8822 u8 max_len = max_adv_len(hdev);
8823
8824 if (is_adv_data) {
8825 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8826 MGMT_ADV_FLAG_LIMITED_DISCOV |
8827 MGMT_ADV_FLAG_MANAGED_FLAGS))
8828 max_len -= 3;
8829
8830 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8831 max_len -= 3;
8832 } else {
8833 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8834 max_len -= calculate_name_len(hdev);
8835
8836 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8837 max_len -= 4;
8838 }
8839
8840 return max_len;
8841 }
8842
flags_managed(u32 adv_flags)8843 static bool flags_managed(u32 adv_flags)
8844 {
8845 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8846 MGMT_ADV_FLAG_LIMITED_DISCOV |
8847 MGMT_ADV_FLAG_MANAGED_FLAGS);
8848 }
8849
tx_power_managed(u32 adv_flags)8850 static bool tx_power_managed(u32 adv_flags)
8851 {
8852 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8853 }
8854
name_managed(u32 adv_flags)8855 static bool name_managed(u32 adv_flags)
8856 {
8857 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8858 }
8859
appearance_managed(u32 adv_flags)8860 static bool appearance_managed(u32 adv_flags)
8861 {
8862 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8863 }
8864
tlv_data_is_valid(struct hci_dev * hdev,u32 adv_flags,u8 * data,u8 len,bool is_adv_data)8865 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8866 u8 len, bool is_adv_data)
8867 {
8868 int i, cur_len;
8869 u8 max_len;
8870
8871 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8872
8873 if (len > max_len)
8874 return false;
8875
8876 /* Make sure that the data is correctly formatted. */
8877 for (i = 0; i < len; i += (cur_len + 1)) {
8878 cur_len = data[i];
8879
8880 if (!cur_len)
8881 continue;
8882
8883 /* If the current field length would exceed the total data
8884 * length, then it's invalid.
8885 */
8886 if (i + cur_len >= len)
8887 return false;
8888
8889 if (data[i + 1] == EIR_FLAGS &&
8890 (!is_adv_data || flags_managed(adv_flags)))
8891 return false;
8892
8893 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8894 return false;
8895
8896 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8897 return false;
8898
8899 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8900 return false;
8901
8902 if (data[i + 1] == EIR_APPEARANCE &&
8903 appearance_managed(adv_flags))
8904 return false;
8905 }
8906
8907 return true;
8908 }
8909
requested_adv_flags_are_valid(struct hci_dev * hdev,u32 adv_flags)8910 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8911 {
8912 u32 supported_flags, phy_flags;
8913
8914 /* The current implementation only supports a subset of the specified
8915 * flags. Also need to check mutual exclusiveness of sec flags.
8916 */
8917 supported_flags = get_supported_adv_flags(hdev);
8918 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8919 if (adv_flags & ~supported_flags ||
8920 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8921 return false;
8922
8923 return true;
8924 }
8925
adv_busy(struct hci_dev * hdev)8926 static bool adv_busy(struct hci_dev *hdev)
8927 {
8928 return pending_find(MGMT_OP_SET_LE, hdev);
8929 }
8930
add_adv_complete(struct hci_dev * hdev,struct sock * sk,u8 instance,int err)8931 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8932 int err)
8933 {
8934 struct adv_info *adv, *n;
8935
8936 bt_dev_dbg(hdev, "err %d", err);
8937
8938 hci_dev_lock(hdev);
8939
8940 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8941 u8 instance;
8942
8943 if (!adv->pending)
8944 continue;
8945
8946 if (!err) {
8947 adv->pending = false;
8948 continue;
8949 }
8950
8951 instance = adv->instance;
8952
8953 if (hdev->cur_adv_instance == instance)
8954 cancel_adv_timeout(hdev);
8955
8956 hci_remove_adv_instance(hdev, instance);
8957 mgmt_advertising_removed(sk, hdev, instance);
8958 }
8959
8960 hci_dev_unlock(hdev);
8961 }
8962
add_advertising_complete(struct hci_dev * hdev,void * data,int err)8963 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8964 {
8965 struct mgmt_pending_cmd *cmd = data;
8966 struct mgmt_cp_add_advertising *cp = cmd->param;
8967 struct mgmt_rp_add_advertising rp;
8968
8969 memset(&rp, 0, sizeof(rp));
8970
8971 rp.instance = cp->instance;
8972
8973 if (err)
8974 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
8975 mgmt_status(err));
8976 else
8977 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
8978 mgmt_status(err), &rp, sizeof(rp));
8979
8980 add_adv_complete(hdev, cmd->sk, cp->instance, err);
8981
8982 mgmt_pending_free(cmd);
8983 }
8984
add_advertising_sync(struct hci_dev * hdev,void * data)8985 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8986 {
8987 struct mgmt_pending_cmd *cmd = data;
8988 struct mgmt_cp_add_advertising *cp = cmd->param;
8989
8990 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8991 }
8992
add_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8993 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8994 void *data, u16 data_len)
8995 {
8996 struct mgmt_cp_add_advertising *cp = data;
8997 struct mgmt_rp_add_advertising rp;
8998 u32 flags;
8999 u8 status;
9000 u16 timeout, duration;
9001 unsigned int prev_instance_cnt;
9002 u8 schedule_instance = 0;
9003 struct adv_info *adv, *next_instance;
9004 int err;
9005 struct mgmt_pending_cmd *cmd;
9006
9007 bt_dev_dbg(hdev, "sock %p", sk);
9008
9009 status = mgmt_le_support(hdev);
9010 if (status)
9011 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9012 status);
9013
9014 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9016 MGMT_STATUS_INVALID_PARAMS);
9017
9018 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9019 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9020 MGMT_STATUS_INVALID_PARAMS);
9021
9022 flags = __le32_to_cpu(cp->flags);
9023 timeout = __le16_to_cpu(cp->timeout);
9024 duration = __le16_to_cpu(cp->duration);
9025
9026 if (!requested_adv_flags_are_valid(hdev, flags))
9027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9028 MGMT_STATUS_INVALID_PARAMS);
9029
9030 hci_dev_lock(hdev);
9031
9032 if (timeout && !hdev_is_powered(hdev)) {
9033 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9034 MGMT_STATUS_REJECTED);
9035 goto unlock;
9036 }
9037
9038 if (adv_busy(hdev)) {
9039 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9040 MGMT_STATUS_BUSY);
9041 goto unlock;
9042 }
9043
9044 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9045 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9046 cp->scan_rsp_len, false)) {
9047 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9048 MGMT_STATUS_INVALID_PARAMS);
9049 goto unlock;
9050 }
9051
9052 prev_instance_cnt = hdev->adv_instance_cnt;
9053
9054 adv = hci_add_adv_instance(hdev, cp->instance, flags,
9055 cp->adv_data_len, cp->data,
9056 cp->scan_rsp_len,
9057 cp->data + cp->adv_data_len,
9058 timeout, duration,
9059 HCI_ADV_TX_POWER_NO_PREFERENCE,
9060 hdev->le_adv_min_interval,
9061 hdev->le_adv_max_interval, 0);
9062 if (IS_ERR(adv)) {
9063 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9064 MGMT_STATUS_FAILED);
9065 goto unlock;
9066 }
9067
9068 /* Only trigger an advertising added event if a new instance was
9069 * actually added.
9070 */
9071 if (hdev->adv_instance_cnt > prev_instance_cnt)
9072 mgmt_advertising_added(sk, hdev, cp->instance);
9073
9074 if (hdev->cur_adv_instance == cp->instance) {
9075 /* If the currently advertised instance is being changed then
9076 * cancel the current advertising and schedule the next
9077 * instance. If there is only one instance then the overridden
9078 * advertising data will be visible right away.
9079 */
9080 cancel_adv_timeout(hdev);
9081
9082 next_instance = hci_get_next_instance(hdev, cp->instance);
9083 if (next_instance)
9084 schedule_instance = next_instance->instance;
9085 } else if (!hdev->adv_instance_timeout) {
9086 /* Immediately advertise the new instance if no other
9087 * instance is currently being advertised.
9088 */
9089 schedule_instance = cp->instance;
9090 }
9091
9092 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9093 * there is no instance to be advertised then we have no HCI
9094 * communication to make. Simply return.
9095 */
9096 if (!hdev_is_powered(hdev) ||
9097 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9098 !schedule_instance) {
9099 rp.instance = cp->instance;
9100 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9101 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9102 goto unlock;
9103 }
9104
9105 /* We're good to go, update advertising data, parameters, and start
9106 * advertising.
9107 */
9108 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9109 data_len);
9110 if (!cmd) {
9111 err = -ENOMEM;
9112 goto unlock;
9113 }
9114
9115 cp->instance = schedule_instance;
9116
9117 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
9118 add_advertising_complete);
9119 if (err < 0)
9120 mgmt_pending_free(cmd);
9121
9122 unlock:
9123 hci_dev_unlock(hdev);
9124
9125 return err;
9126 }
9127
add_ext_adv_params_complete(struct hci_dev * hdev,void * data,int err)9128 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
9129 int err)
9130 {
9131 struct mgmt_pending_cmd *cmd = data;
9132 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9133 struct mgmt_rp_add_ext_adv_params rp;
9134 struct adv_info *adv;
9135 u32 flags;
9136
9137 BT_DBG("%s", hdev->name);
9138
9139 hci_dev_lock(hdev);
9140
9141 adv = hci_find_adv_instance(hdev, cp->instance);
9142 if (!adv)
9143 goto unlock;
9144
9145 rp.instance = cp->instance;
9146 rp.tx_power = adv->tx_power;
9147
9148 /* While we're at it, inform userspace of the available space for this
9149 * advertisement, given the flags that will be used.
9150 */
9151 flags = __le32_to_cpu(cp->flags);
9152 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9153 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9154
9155 if (err) {
9156 /* If this advertisement was previously advertising and we
9157 * failed to update it, we signal that it has been removed and
9158 * delete its structure
9159 */
9160 if (!adv->pending)
9161 mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9162
9163 hci_remove_adv_instance(hdev, cp->instance);
9164
9165 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9166 mgmt_status(err));
9167 } else {
9168 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9169 mgmt_status(err), &rp, sizeof(rp));
9170 }
9171
9172 unlock:
9173 mgmt_pending_free(cmd);
9174
9175 hci_dev_unlock(hdev);
9176 }
9177
add_ext_adv_params_sync(struct hci_dev * hdev,void * data)9178 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
9179 {
9180 struct mgmt_pending_cmd *cmd = data;
9181 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9182
9183 return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
9184 }
9185
add_ext_adv_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9186 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9187 void *data, u16 data_len)
9188 {
9189 struct mgmt_cp_add_ext_adv_params *cp = data;
9190 struct mgmt_rp_add_ext_adv_params rp;
9191 struct mgmt_pending_cmd *cmd = NULL;
9192 struct adv_info *adv;
9193 u32 flags, min_interval, max_interval;
9194 u16 timeout, duration;
9195 u8 status;
9196 s8 tx_power;
9197 int err;
9198
9199 BT_DBG("%s", hdev->name);
9200
9201 status = mgmt_le_support(hdev);
9202 if (status)
9203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9204 status);
9205
9206 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9208 MGMT_STATUS_INVALID_PARAMS);
9209
9210 /* The purpose of breaking add_advertising into two separate MGMT calls
9211 * for params and data is to allow more parameters to be added to this
9212 * structure in the future. For this reason, we verify that we have the
9213 * bare minimum structure we know of when the interface was defined. Any
9214 * extra parameters we don't know about will be ignored in this request.
9215 */
9216 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9218 MGMT_STATUS_INVALID_PARAMS);
9219
9220 flags = __le32_to_cpu(cp->flags);
9221
9222 if (!requested_adv_flags_are_valid(hdev, flags))
9223 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9224 MGMT_STATUS_INVALID_PARAMS);
9225
9226 hci_dev_lock(hdev);
9227
9228 /* In new interface, we require that we are powered to register */
9229 if (!hdev_is_powered(hdev)) {
9230 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9231 MGMT_STATUS_REJECTED);
9232 goto unlock;
9233 }
9234
9235 if (adv_busy(hdev)) {
9236 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9237 MGMT_STATUS_BUSY);
9238 goto unlock;
9239 }
9240
9241 /* Parse defined parameters from request, use defaults otherwise */
9242 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9243 __le16_to_cpu(cp->timeout) : 0;
9244
9245 duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9246 __le16_to_cpu(cp->duration) :
9247 hdev->def_multi_adv_rotation_duration;
9248
9249 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9250 __le32_to_cpu(cp->min_interval) :
9251 hdev->le_adv_min_interval;
9252
9253 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9254 __le32_to_cpu(cp->max_interval) :
9255 hdev->le_adv_max_interval;
9256
9257 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9258 cp->tx_power :
9259 HCI_ADV_TX_POWER_NO_PREFERENCE;
9260
9261 /* Create advertising instance with no advertising or response data */
9262 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
9263 timeout, duration, tx_power, min_interval,
9264 max_interval, 0);
9265
9266 if (IS_ERR(adv)) {
9267 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9268 MGMT_STATUS_FAILED);
9269 goto unlock;
9270 }
9271
9272 /* Submit request for advertising params if ext adv available */
9273 if (ext_adv_capable(hdev)) {
9274 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
9275 data, data_len);
9276 if (!cmd) {
9277 err = -ENOMEM;
9278 hci_remove_adv_instance(hdev, cp->instance);
9279 goto unlock;
9280 }
9281
9282 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
9283 add_ext_adv_params_complete);
9284 if (err < 0)
9285 mgmt_pending_free(cmd);
9286 } else {
9287 rp.instance = cp->instance;
9288 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9289 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9290 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9291 err = mgmt_cmd_complete(sk, hdev->id,
9292 MGMT_OP_ADD_EXT_ADV_PARAMS,
9293 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9294 }
9295
9296 unlock:
9297 hci_dev_unlock(hdev);
9298
9299 return err;
9300 }
9301
add_ext_adv_data_complete(struct hci_dev * hdev,void * data,int err)9302 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
9303 {
9304 struct mgmt_pending_cmd *cmd = data;
9305 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
9306 struct mgmt_rp_add_advertising rp;
9307
9308 add_adv_complete(hdev, cmd->sk, cp->instance, err);
9309
9310 memset(&rp, 0, sizeof(rp));
9311
9312 rp.instance = cp->instance;
9313
9314 if (err)
9315 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9316 mgmt_status(err));
9317 else
9318 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9319 mgmt_status(err), &rp, sizeof(rp));
9320
9321 mgmt_pending_free(cmd);
9322 }
9323
add_ext_adv_data_sync(struct hci_dev * hdev,void * data)9324 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
9325 {
9326 struct mgmt_pending_cmd *cmd = data;
9327 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
9328 int err;
9329
9330 if (ext_adv_capable(hdev)) {
9331 err = hci_update_adv_data_sync(hdev, cp->instance);
9332 if (err)
9333 return err;
9334
9335 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
9336 if (err)
9337 return err;
9338
9339 return hci_enable_ext_advertising_sync(hdev, cp->instance);
9340 }
9341
9342 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
9343 }
9344
add_ext_adv_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9345 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9346 u16 data_len)
9347 {
9348 struct mgmt_cp_add_ext_adv_data *cp = data;
9349 struct mgmt_rp_add_ext_adv_data rp;
9350 u8 schedule_instance = 0;
9351 struct adv_info *next_instance;
9352 struct adv_info *adv_instance;
9353 int err = 0;
9354 struct mgmt_pending_cmd *cmd;
9355 u16 expected_len;
9356
9357 BT_DBG("%s", hdev->name);
9358
9359 expected_len = struct_size(cp, data, cp->adv_data_len +
9360 cp->scan_rsp_len);
9361 if (expected_len > data_len)
9362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9363 MGMT_STATUS_INVALID_PARAMS);
9364
9365 hci_dev_lock(hdev);
9366
9367 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9368
9369 if (!adv_instance) {
9370 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9371 MGMT_STATUS_INVALID_PARAMS);
9372 goto unlock;
9373 }
9374
9375 /* In new interface, we require that we are powered to register */
9376 if (!hdev_is_powered(hdev)) {
9377 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9378 MGMT_STATUS_REJECTED);
9379 goto clear_new_instance;
9380 }
9381
9382 if (adv_busy(hdev)) {
9383 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9384 MGMT_STATUS_BUSY);
9385 goto clear_new_instance;
9386 }
9387
9388 /* Validate new data */
9389 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9390 cp->adv_data_len, true) ||
9391 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9392 cp->adv_data_len, cp->scan_rsp_len, false)) {
9393 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9394 MGMT_STATUS_INVALID_PARAMS);
9395 goto clear_new_instance;
9396 }
9397
9398 /* Set the data in the advertising instance */
9399 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9400 cp->data, cp->scan_rsp_len,
9401 cp->data + cp->adv_data_len);
9402
9403 /* If using software rotation, determine next instance to use */
9404 if (hdev->cur_adv_instance == cp->instance) {
9405 /* If the currently advertised instance is being changed
9406 * then cancel the current advertising and schedule the
9407 * next instance. If there is only one instance then the
9408 * overridden advertising data will be visible right
9409 * away
9410 */
9411 cancel_adv_timeout(hdev);
9412
9413 next_instance = hci_get_next_instance(hdev, cp->instance);
9414 if (next_instance)
9415 schedule_instance = next_instance->instance;
9416 } else if (!hdev->adv_instance_timeout) {
9417 /* Immediately advertise the new instance if no other
9418 * instance is currently being advertised.
9419 */
9420 schedule_instance = cp->instance;
9421 }
9422
9423 /* If the HCI_ADVERTISING flag is set or there is no instance to
9424 * be advertised then we have no HCI communication to make.
9425 * Simply return.
9426 */
9427 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9428 if (adv_instance->pending) {
9429 mgmt_advertising_added(sk, hdev, cp->instance);
9430 adv_instance->pending = false;
9431 }
9432 rp.instance = cp->instance;
9433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9434 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9435 goto unlock;
9436 }
9437
9438 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9439 data_len);
9440 if (!cmd) {
9441 err = -ENOMEM;
9442 goto clear_new_instance;
9443 }
9444
9445 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9446 add_ext_adv_data_complete);
9447 if (err < 0) {
9448 mgmt_pending_free(cmd);
9449 goto clear_new_instance;
9450 }
9451
9452 /* We were successful in updating data, so trigger advertising_added
9453 * event if this is an instance that wasn't previously advertising. If
9454 * a failure occurs in the requests we initiated, we will remove the
9455 * instance again in add_advertising_complete
9456 */
9457 if (adv_instance->pending)
9458 mgmt_advertising_added(sk, hdev, cp->instance);
9459
9460 goto unlock;
9461
9462 clear_new_instance:
9463 hci_remove_adv_instance(hdev, cp->instance);
9464
9465 unlock:
9466 hci_dev_unlock(hdev);
9467
9468 return err;
9469 }
9470
remove_advertising_complete(struct hci_dev * hdev,void * data,int err)9471 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9472 int err)
9473 {
9474 struct mgmt_pending_cmd *cmd = data;
9475 struct mgmt_cp_remove_advertising *cp = cmd->param;
9476 struct mgmt_rp_remove_advertising rp;
9477
9478 bt_dev_dbg(hdev, "err %d", err);
9479
9480 memset(&rp, 0, sizeof(rp));
9481 rp.instance = cp->instance;
9482
9483 if (err)
9484 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9485 mgmt_status(err));
9486 else
9487 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9488 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9489
9490 mgmt_pending_free(cmd);
9491 }
9492
remove_advertising_sync(struct hci_dev * hdev,void * data)9493 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9494 {
9495 struct mgmt_pending_cmd *cmd = data;
9496 struct mgmt_cp_remove_advertising *cp = cmd->param;
9497 int err;
9498
9499 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9500 if (err)
9501 return err;
9502
9503 if (list_empty(&hdev->adv_instances))
9504 err = hci_disable_advertising_sync(hdev);
9505
9506 return err;
9507 }
9508
remove_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9509 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9510 void *data, u16 data_len)
9511 {
9512 struct mgmt_cp_remove_advertising *cp = data;
9513 struct mgmt_pending_cmd *cmd;
9514 int err;
9515
9516 bt_dev_dbg(hdev, "sock %p", sk);
9517
9518 hci_dev_lock(hdev);
9519
9520 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9521 err = mgmt_cmd_status(sk, hdev->id,
9522 MGMT_OP_REMOVE_ADVERTISING,
9523 MGMT_STATUS_INVALID_PARAMS);
9524 goto unlock;
9525 }
9526
9527 if (pending_find(MGMT_OP_SET_LE, hdev)) {
9528 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9529 MGMT_STATUS_BUSY);
9530 goto unlock;
9531 }
9532
9533 if (list_empty(&hdev->adv_instances)) {
9534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9535 MGMT_STATUS_INVALID_PARAMS);
9536 goto unlock;
9537 }
9538
9539 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9540 data_len);
9541 if (!cmd) {
9542 err = -ENOMEM;
9543 goto unlock;
9544 }
9545
9546 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9547 remove_advertising_complete);
9548 if (err < 0)
9549 mgmt_pending_free(cmd);
9550
9551 unlock:
9552 hci_dev_unlock(hdev);
9553
9554 return err;
9555 }
9556
get_adv_size_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9557 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9558 void *data, u16 data_len)
9559 {
9560 struct mgmt_cp_get_adv_size_info *cp = data;
9561 struct mgmt_rp_get_adv_size_info rp;
9562 u32 flags, supported_flags;
9563
9564 bt_dev_dbg(hdev, "sock %p", sk);
9565
9566 if (!lmp_le_capable(hdev))
9567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9568 MGMT_STATUS_REJECTED);
9569
9570 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9571 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9572 MGMT_STATUS_INVALID_PARAMS);
9573
9574 flags = __le32_to_cpu(cp->flags);
9575
9576 /* The current implementation only supports a subset of the specified
9577 * flags.
9578 */
9579 supported_flags = get_supported_adv_flags(hdev);
9580 if (flags & ~supported_flags)
9581 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9582 MGMT_STATUS_INVALID_PARAMS);
9583
9584 rp.instance = cp->instance;
9585 rp.flags = cp->flags;
9586 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9587 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9588
9589 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9590 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9591 }
9592
9593 static const struct hci_mgmt_handler mgmt_handlers[] = {
9594 { NULL }, /* 0x0000 (no command) */
9595 { read_version, MGMT_READ_VERSION_SIZE,
9596 HCI_MGMT_NO_HDEV |
9597 HCI_MGMT_UNTRUSTED },
9598 { read_commands, MGMT_READ_COMMANDS_SIZE,
9599 HCI_MGMT_NO_HDEV |
9600 HCI_MGMT_UNTRUSTED },
9601 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
9602 HCI_MGMT_NO_HDEV |
9603 HCI_MGMT_UNTRUSTED },
9604 { read_controller_info, MGMT_READ_INFO_SIZE,
9605 HCI_MGMT_UNTRUSTED },
9606 { set_powered, MGMT_SETTING_SIZE },
9607 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
9608 { set_connectable, MGMT_SETTING_SIZE },
9609 { set_fast_connectable, MGMT_SETTING_SIZE },
9610 { set_bondable, MGMT_SETTING_SIZE },
9611 { set_link_security, MGMT_SETTING_SIZE },
9612 { set_ssp, MGMT_SETTING_SIZE },
9613 { set_hs, MGMT_SETTING_SIZE },
9614 { set_le, MGMT_SETTING_SIZE },
9615 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
9616 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
9617 { add_uuid, MGMT_ADD_UUID_SIZE },
9618 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
9619 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
9620 HCI_MGMT_VAR_LEN },
9621 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9622 HCI_MGMT_VAR_LEN },
9623 { disconnect, MGMT_DISCONNECT_SIZE },
9624 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
9625 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
9626 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
9627 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
9628 { pair_device, MGMT_PAIR_DEVICE_SIZE },
9629 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
9630 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
9631 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
9632 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9633 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
9634 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9635 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
9636 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9637 HCI_MGMT_VAR_LEN },
9638 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9639 { start_discovery, MGMT_START_DISCOVERY_SIZE },
9640 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
9641 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
9642 { block_device, MGMT_BLOCK_DEVICE_SIZE },
9643 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
9644 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
9645 { set_advertising, MGMT_SETTING_SIZE },
9646 { set_bredr, MGMT_SETTING_SIZE },
9647 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
9648 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
9649 { set_secure_conn, MGMT_SETTING_SIZE },
9650 { set_debug_keys, MGMT_SETTING_SIZE },
9651 { set_privacy, MGMT_SET_PRIVACY_SIZE },
9652 { load_irks, MGMT_LOAD_IRKS_SIZE,
9653 HCI_MGMT_VAR_LEN },
9654 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
9655 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
9656 { add_device, MGMT_ADD_DEVICE_SIZE },
9657 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
9658 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
9659 HCI_MGMT_VAR_LEN },
9660 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9661 HCI_MGMT_NO_HDEV |
9662 HCI_MGMT_UNTRUSTED },
9663 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
9664 HCI_MGMT_UNCONFIGURED |
9665 HCI_MGMT_UNTRUSTED },
9666 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
9667 HCI_MGMT_UNCONFIGURED },
9668 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
9669 HCI_MGMT_UNCONFIGURED },
9670 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9671 HCI_MGMT_VAR_LEN },
9672 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9673 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
9674 HCI_MGMT_NO_HDEV |
9675 HCI_MGMT_UNTRUSTED },
9676 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
9677 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
9678 HCI_MGMT_VAR_LEN },
9679 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
9680 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
9681 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9682 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9683 HCI_MGMT_UNTRUSTED },
9684 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
9685 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
9686 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
9687 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9688 HCI_MGMT_VAR_LEN },
9689 { set_wideband_speech, MGMT_SETTING_SIZE },
9690 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE,
9691 HCI_MGMT_UNTRUSTED },
9692 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE,
9693 HCI_MGMT_UNTRUSTED |
9694 HCI_MGMT_HDEV_OPTIONAL },
9695 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE,
9696 HCI_MGMT_VAR_LEN |
9697 HCI_MGMT_HDEV_OPTIONAL },
9698 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9699 HCI_MGMT_UNTRUSTED },
9700 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9701 HCI_MGMT_VAR_LEN },
9702 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9703 HCI_MGMT_UNTRUSTED },
9704 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9705 HCI_MGMT_VAR_LEN },
9706 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE },
9707 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE },
9708 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9709 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9710 HCI_MGMT_VAR_LEN },
9711 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE },
9712 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9713 HCI_MGMT_VAR_LEN },
9714 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE,
9715 HCI_MGMT_VAR_LEN },
9716 { add_adv_patterns_monitor_rssi,
9717 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9718 HCI_MGMT_VAR_LEN },
9719 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE,
9720 HCI_MGMT_VAR_LEN },
9721 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE },
9722 { mesh_send, MGMT_MESH_SEND_SIZE,
9723 HCI_MGMT_VAR_LEN },
9724 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE },
9725 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN },
9726 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE,
9727 HCI_MGMT_VAR_LEN },
9728 };
9729
mgmt_index_added(struct hci_dev * hdev)9730 void mgmt_index_added(struct hci_dev *hdev)
9731 {
9732 struct mgmt_ev_ext_index ev;
9733
9734 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE))
9735 return;
9736
9737 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9738 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0,
9739 HCI_MGMT_UNCONF_INDEX_EVENTS);
9740 ev.type = 0x01;
9741 } else {
9742 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9743 HCI_MGMT_INDEX_EVENTS);
9744 ev.type = 0x00;
9745 }
9746
9747 ev.bus = hdev->bus;
9748
9749 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9750 HCI_MGMT_EXT_INDEX_EVENTS);
9751 }
9752
mgmt_index_removed(struct hci_dev * hdev)9753 void mgmt_index_removed(struct hci_dev *hdev)
9754 {
9755 struct mgmt_ev_ext_index ev;
9756 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX };
9757
9758 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE))
9759 return;
9760
9761 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);
9762
9763 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9764 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
9765 HCI_MGMT_UNCONF_INDEX_EVENTS);
9766 ev.type = 0x01;
9767 } else {
9768 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9769 HCI_MGMT_INDEX_EVENTS);
9770 ev.type = 0x00;
9771 }
9772
9773 ev.bus = hdev->bus;
9774
9775 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9776 HCI_MGMT_EXT_INDEX_EVENTS);
9777
9778 /* Cancel any remaining timed work */
9779 if (!hci_dev_test_flag(hdev, HCI_MGMT))
9780 return;
9781 cancel_delayed_work_sync(&hdev->discov_off);
9782 cancel_delayed_work_sync(&hdev->service_cache);
9783 cancel_delayed_work_sync(&hdev->rpa_expired);
9784 cancel_delayed_work_sync(&hdev->mesh_send_done);
9785 }
9786
mgmt_power_on(struct hci_dev * hdev,int err)9787 void mgmt_power_on(struct hci_dev *hdev, int err)
9788 {
9789 struct cmd_lookup match = { NULL, hdev };
9790
9791 bt_dev_dbg(hdev, "err %d", err);
9792
9793 hci_dev_lock(hdev);
9794
9795 if (!err) {
9796 restart_le_actions(hdev);
9797 hci_update_passive_scan(hdev);
9798 }
9799
9800 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,
9801 &match);
9802
9803 new_settings(hdev, match.sk);
9804
9805 if (match.sk)
9806 sock_put(match.sk);
9807
9808 hci_dev_unlock(hdev);
9809 }
9810
__mgmt_power_off(struct hci_dev * hdev)9811 void __mgmt_power_off(struct hci_dev *hdev)
9812 {
9813 struct cmd_lookup match = { NULL, hdev };
9814 u8 zero_cod[] = { 0, 0, 0 };
9815
9816 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,
9817 &match);
9818
9819 /* If the power off is because of hdev unregistration let
9820 * use the appropriate INVALID_INDEX status. Otherwise use
9821 * NOT_POWERED. We cover both scenarios here since later in
9822 * mgmt_index_removed() any hci_conn callbacks will have already
9823 * been triggered, potentially causing misleading DISCONNECTED
9824 * status responses.
9825 */
9826 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9827 match.mgmt_status = MGMT_STATUS_INVALID_INDEX;
9828 else
9829 match.mgmt_status = MGMT_STATUS_NOT_POWERED;
9830
9831 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);
9832
9833 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9834 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9835 zero_cod, sizeof(zero_cod),
9836 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9837 ext_info_changed(hdev, NULL);
9838 }
9839
9840 new_settings(hdev, match.sk);
9841
9842 if (match.sk)
9843 sock_put(match.sk);
9844 }
9845
mgmt_set_powered_failed(struct hci_dev * hdev,int err)9846 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9847 {
9848 struct mgmt_pending_cmd *cmd;
9849 u8 status;
9850
9851 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9852 if (!cmd)
9853 return;
9854
9855 if (err == -ERFKILL)
9856 status = MGMT_STATUS_RFKILLED;
9857 else
9858 status = MGMT_STATUS_FAILED;
9859
9860 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9861
9862 mgmt_pending_remove(cmd);
9863 }
9864
mgmt_new_link_key(struct hci_dev * hdev,struct link_key * key,bool persistent)9865 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9866 bool persistent)
9867 {
9868 struct mgmt_ev_new_link_key ev;
9869
9870 memset(&ev, 0, sizeof(ev));
9871
9872 ev.store_hint = persistent;
9873 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9874 ev.key.addr.type = BDADDR_BREDR;
9875 ev.key.type = key->type;
9876 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9877 ev.key.pin_len = key->pin_len;
9878
9879 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9880 }
9881
mgmt_ltk_type(struct smp_ltk * ltk)9882 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9883 {
9884 switch (ltk->type) {
9885 case SMP_LTK:
9886 case SMP_LTK_RESPONDER:
9887 if (ltk->authenticated)
9888 return MGMT_LTK_AUTHENTICATED;
9889 return MGMT_LTK_UNAUTHENTICATED;
9890 case SMP_LTK_P256:
9891 if (ltk->authenticated)
9892 return MGMT_LTK_P256_AUTH;
9893 return MGMT_LTK_P256_UNAUTH;
9894 case SMP_LTK_P256_DEBUG:
9895 return MGMT_LTK_P256_DEBUG;
9896 }
9897
9898 return MGMT_LTK_UNAUTHENTICATED;
9899 }
9900
mgmt_new_ltk(struct hci_dev * hdev,struct smp_ltk * key,bool persistent)9901 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9902 {
9903 struct mgmt_ev_new_long_term_key ev;
9904
9905 memset(&ev, 0, sizeof(ev));
9906
9907 /* Devices using resolvable or non-resolvable random addresses
9908 * without providing an identity resolving key don't require
9909 * to store long term keys. Their addresses will change the
9910 * next time around.
9911 *
9912 * Only when a remote device provides an identity address
9913 * make sure the long term key is stored. If the remote
9914 * identity is known, the long term keys are internally
9915 * mapped to the identity address. So allow static random
9916 * and public addresses here.
9917 */
9918 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9919 (key->bdaddr.b[5] & 0xc0) != 0xc0)
9920 ev.store_hint = 0x00;
9921 else
9922 ev.store_hint = persistent;
9923
9924 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9925 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9926 ev.key.type = mgmt_ltk_type(key);
9927 ev.key.enc_size = key->enc_size;
9928 ev.key.ediv = key->ediv;
9929 ev.key.rand = key->rand;
9930
9931 if (key->type == SMP_LTK)
9932 ev.key.initiator = 1;
9933
9934 /* Make sure we copy only the significant bytes based on the
9935 * encryption key size, and set the rest of the value to zeroes.
9936 */
9937 memcpy(ev.key.val, key->val, key->enc_size);
9938 memset(ev.key.val + key->enc_size, 0,
9939 sizeof(ev.key.val) - key->enc_size);
9940
9941 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9942 }
9943
mgmt_new_irk(struct hci_dev * hdev,struct smp_irk * irk,bool persistent)9944 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9945 {
9946 struct mgmt_ev_new_irk ev;
9947
9948 memset(&ev, 0, sizeof(ev));
9949
9950 ev.store_hint = persistent;
9951
9952 bacpy(&ev.rpa, &irk->rpa);
9953 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9954 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9955 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9956
9957 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9958 }
9959
mgmt_new_csrk(struct hci_dev * hdev,struct smp_csrk * csrk,bool persistent)9960 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9961 bool persistent)
9962 {
9963 struct mgmt_ev_new_csrk ev;
9964
9965 memset(&ev, 0, sizeof(ev));
9966
9967 /* Devices using resolvable or non-resolvable random addresses
9968 * without providing an identity resolving key don't require
9969 * to store signature resolving keys. Their addresses will change
9970 * the next time around.
9971 *
9972 * Only when a remote device provides an identity address
9973 * make sure the signature resolving key is stored. So allow
9974 * static random and public addresses here.
9975 */
9976 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9977 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9978 ev.store_hint = 0x00;
9979 else
9980 ev.store_hint = persistent;
9981
9982 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9983 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9984 ev.key.type = csrk->type;
9985 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9986
9987 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9988 }
9989
mgmt_new_conn_param(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 store_hint,u16 min_interval,u16 max_interval,u16 latency,u16 timeout)9990 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9991 u8 bdaddr_type, u8 store_hint, u16 min_interval,
9992 u16 max_interval, u16 latency, u16 timeout)
9993 {
9994 struct mgmt_ev_new_conn_param ev;
9995
9996 if (!hci_is_identity_address(bdaddr, bdaddr_type))
9997 return;
9998
9999 memset(&ev, 0, sizeof(ev));
10000 bacpy(&ev.addr.bdaddr, bdaddr);
10001 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10002 ev.store_hint = store_hint;
10003 ev.min_interval = cpu_to_le16(min_interval);
10004 ev.max_interval = cpu_to_le16(max_interval);
10005 ev.latency = cpu_to_le16(latency);
10006 ev.timeout = cpu_to_le16(timeout);
10007
10008 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10009 }
10010
mgmt_device_connected(struct hci_dev * hdev,struct hci_conn * conn,u8 * name,u8 name_len)10011 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10012 u8 *name, u8 name_len)
10013 {
10014 struct sk_buff *skb;
10015 struct mgmt_ev_device_connected *ev;
10016 u16 eir_len = 0;
10017 u32 flags = 0;
10018
10019 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
10020 return;
10021
10022 /* allocate buff for LE or BR/EDR adv */
10023 if (conn->le_adv_data_len > 0)
10024 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10025 sizeof(*ev) + conn->le_adv_data_len);
10026 else
10027 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10028 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
10029 eir_precalc_len(sizeof(conn->dev_class)));
10030
10031 if (!skb)
10032 return;
10033
10034 ev = skb_put(skb, sizeof(*ev));
10035 bacpy(&ev->addr.bdaddr, &conn->dst);
10036 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10037
10038 if (conn->out)
10039 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10040
10041 ev->flags = __cpu_to_le32(flags);
10042
10043 /* We must ensure that the EIR Data fields are ordered and
10044 * unique. Keep it simple for now and avoid the problem by not
10045 * adding any BR/EDR data to the LE adv.
10046 */
10047 if (conn->le_adv_data_len > 0) {
10048 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
10049 eir_len = conn->le_adv_data_len;
10050 } else {
10051 if (name)
10052 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10053
10054 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
10055 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
10056 conn->dev_class, sizeof(conn->dev_class));
10057 }
10058
10059 ev->eir_len = cpu_to_le16(eir_len);
10060
10061 mgmt_event_skb(skb, NULL);
10062 }
10063
unpair_device_rsp(struct mgmt_pending_cmd * cmd,void * data)10064 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10065 {
10066 struct hci_dev *hdev = data;
10067 struct mgmt_cp_unpair_device *cp = cmd->param;
10068
10069 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10070
10071 cmd->cmd_complete(cmd, 0);
10072 }
10073
mgmt_powering_down(struct hci_dev * hdev)10074 bool mgmt_powering_down(struct hci_dev *hdev)
10075 {
10076 struct mgmt_pending_cmd *cmd;
10077 struct mgmt_mode *cp;
10078
10079 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10080 return true;
10081
10082 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10083 if (!cmd)
10084 return false;
10085
10086 cp = cmd->param;
10087 if (!cp->val)
10088 return true;
10089
10090 return false;
10091 }
10092
hci_to_mgmt_reason(u8 err)10093 u8 hci_to_mgmt_reason(u8 err)
10094 {
10095 switch (err) {
10096 case HCI_ERROR_CONNECTION_TIMEOUT:
10097 return MGMT_DEV_DISCONN_TIMEOUT;
10098 case HCI_ERROR_REMOTE_USER_TERM:
10099 case HCI_ERROR_REMOTE_LOW_RESOURCES:
10100 case HCI_ERROR_REMOTE_POWER_OFF:
10101 return MGMT_DEV_DISCONN_REMOTE;
10102 case HCI_ERROR_LOCAL_HOST_TERM:
10103 return MGMT_DEV_DISCONN_LOCAL_HOST;
10104 default:
10105 return MGMT_DEV_DISCONN_UNKNOWN;
10106 }
10107 }
10108
mgmt_device_disconnected(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 reason,bool mgmt_connected)10109 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10110 u8 link_type, u8 addr_type, u8 reason,
10111 bool mgmt_connected)
10112 {
10113 struct mgmt_ev_device_disconnected ev;
10114 struct sock *sk = NULL;
10115
10116 if (!mgmt_connected)
10117 return;
10118
10119 if (link_type != ACL_LINK &&
10120 link_type != LE_LINK &&
10121 link_type != BIS_LINK)
10122 return;
10123
10124 bacpy(&ev.addr.bdaddr, bdaddr);
10125 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10126 ev.reason = reason;
10127
10128 /* Report disconnects due to suspend */
10129 if (hdev->suspended)
10130 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10131
10132 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10133
10134 if (sk)
10135 sock_put(sk);
10136 }
10137
mgmt_disconnect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10138 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10139 u8 link_type, u8 addr_type, u8 status)
10140 {
10141 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10142 struct mgmt_cp_disconnect *cp;
10143 struct mgmt_pending_cmd *cmd;
10144
10145 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true,
10146 unpair_device_rsp, hdev);
10147
10148 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10149 if (!cmd)
10150 return;
10151
10152 cp = cmd->param;
10153
10154 if (bacmp(bdaddr, &cp->addr.bdaddr))
10155 return;
10156
10157 if (cp->addr.type != bdaddr_type)
10158 return;
10159
10160 cmd->cmd_complete(cmd, mgmt_status(status));
10161 mgmt_pending_remove(cmd);
10162 }
10163
mgmt_connect_failed(struct hci_dev * hdev,struct hci_conn * conn,u8 status)10164 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status)
10165 {
10166 struct mgmt_ev_connect_failed ev;
10167
10168 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
10169 mgmt_device_disconnected(hdev, &conn->dst, conn->type,
10170 conn->dst_type,
10171 hci_to_mgmt_reason(status), true);
10172 return;
10173 }
10174
10175 bacpy(&ev.addr.bdaddr, &conn->dst);
10176 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10177 ev.status = mgmt_status(status);
10178
10179 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10180 }
10181
mgmt_pin_code_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 secure)10182 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10183 {
10184 struct mgmt_ev_pin_code_request ev;
10185
10186 bacpy(&ev.addr.bdaddr, bdaddr);
10187 ev.addr.type = BDADDR_BREDR;
10188 ev.secure = secure;
10189
10190 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10191 }
10192
mgmt_pin_code_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)10193 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10194 u8 status)
10195 {
10196 struct mgmt_pending_cmd *cmd;
10197
10198 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10199 if (!cmd)
10200 return;
10201
10202 cmd->cmd_complete(cmd, mgmt_status(status));
10203 mgmt_pending_remove(cmd);
10204 }
10205
mgmt_pin_code_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)10206 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10207 u8 status)
10208 {
10209 struct mgmt_pending_cmd *cmd;
10210
10211 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10212 if (!cmd)
10213 return;
10214
10215 cmd->cmd_complete(cmd, mgmt_status(status));
10216 mgmt_pending_remove(cmd);
10217 }
10218
mgmt_user_confirm_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 value,u8 confirm_hint)10219 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10220 u8 link_type, u8 addr_type, u32 value,
10221 u8 confirm_hint)
10222 {
10223 struct mgmt_ev_user_confirm_request ev;
10224
10225 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10226
10227 bacpy(&ev.addr.bdaddr, bdaddr);
10228 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10229 ev.confirm_hint = confirm_hint;
10230 ev.value = cpu_to_le32(value);
10231
10232 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10233 NULL);
10234 }
10235
mgmt_user_passkey_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type)10236 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10237 u8 link_type, u8 addr_type)
10238 {
10239 struct mgmt_ev_user_passkey_request ev;
10240
10241 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10242
10243 bacpy(&ev.addr.bdaddr, bdaddr);
10244 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10245
10246 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10247 NULL);
10248 }
10249
user_pairing_resp_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status,u8 opcode)10250 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10251 u8 link_type, u8 addr_type, u8 status,
10252 u8 opcode)
10253 {
10254 struct mgmt_pending_cmd *cmd;
10255
10256 cmd = pending_find(opcode, hdev);
10257 if (!cmd)
10258 return -ENOENT;
10259
10260 cmd->cmd_complete(cmd, mgmt_status(status));
10261 mgmt_pending_remove(cmd);
10262
10263 return 0;
10264 }
10265
mgmt_user_confirm_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10266 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10267 u8 link_type, u8 addr_type, u8 status)
10268 {
10269 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10270 status, MGMT_OP_USER_CONFIRM_REPLY);
10271 }
10272
mgmt_user_confirm_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10273 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10274 u8 link_type, u8 addr_type, u8 status)
10275 {
10276 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10277 status,
10278 MGMT_OP_USER_CONFIRM_NEG_REPLY);
10279 }
10280
mgmt_user_passkey_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10281 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10282 u8 link_type, u8 addr_type, u8 status)
10283 {
10284 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10285 status, MGMT_OP_USER_PASSKEY_REPLY);
10286 }
10287
mgmt_user_passkey_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10288 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10289 u8 link_type, u8 addr_type, u8 status)
10290 {
10291 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10292 status,
10293 MGMT_OP_USER_PASSKEY_NEG_REPLY);
10294 }
10295
mgmt_user_passkey_notify(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 passkey,u8 entered)10296 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10297 u8 link_type, u8 addr_type, u32 passkey,
10298 u8 entered)
10299 {
10300 struct mgmt_ev_passkey_notify ev;
10301
10302 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10303
10304 bacpy(&ev.addr.bdaddr, bdaddr);
10305 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10306 ev.passkey = __cpu_to_le32(passkey);
10307 ev.entered = entered;
10308
10309 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10310 }
10311
mgmt_auth_failed(struct hci_conn * conn,u8 hci_status)10312 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10313 {
10314 struct mgmt_ev_auth_failed ev;
10315 struct mgmt_pending_cmd *cmd;
10316 u8 status = mgmt_status(hci_status);
10317
10318 bacpy(&ev.addr.bdaddr, &conn->dst);
10319 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10320 ev.status = status;
10321
10322 cmd = remove_pairing(conn);
10323
10324 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10325 cmd ? cmd->sk : NULL);
10326
10327 if (cmd) {
10328 cmd->cmd_complete(cmd, status);
10329 mgmt_pending_free(cmd);
10330 }
10331 }
10332
mgmt_auth_enable_complete(struct hci_dev * hdev,u8 status)10333 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10334 {
10335 struct cmd_lookup match = { NULL, hdev };
10336 bool changed;
10337
10338 if (status) {
10339 u8 mgmt_err = mgmt_status(status);
10340 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,
10341 cmd_status_rsp, &mgmt_err);
10342 return;
10343 }
10344
10345 if (test_bit(HCI_AUTH, &hdev->flags))
10346 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10347 else
10348 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10349
10350 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,
10351 settings_rsp, &match);
10352
10353 if (changed)
10354 new_settings(hdev, match.sk);
10355
10356 if (match.sk)
10357 sock_put(match.sk);
10358 }
10359
sk_lookup(struct mgmt_pending_cmd * cmd,void * data)10360 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10361 {
10362 struct cmd_lookup *match = data;
10363
10364 if (match->sk == NULL) {
10365 match->sk = cmd->sk;
10366 sock_hold(match->sk);
10367 }
10368 }
10369
mgmt_set_class_of_dev_complete(struct hci_dev * hdev,u8 * dev_class,u8 status)10370 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10371 u8 status)
10372 {
10373 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10374
10375 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup,
10376 &match);
10377 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup,
10378 &match);
10379 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup,
10380 &match);
10381
10382 if (!status) {
10383 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10384 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10385 ext_info_changed(hdev, NULL);
10386 }
10387
10388 if (match.sk)
10389 sock_put(match.sk);
10390 }
10391
mgmt_set_local_name_complete(struct hci_dev * hdev,u8 * name,u8 status)10392 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10393 {
10394 struct mgmt_cp_set_local_name ev;
10395 struct mgmt_pending_cmd *cmd;
10396
10397 if (status)
10398 return;
10399
10400 memset(&ev, 0, sizeof(ev));
10401 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10402 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10403
10404 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10405 if (!cmd) {
10406 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10407
10408 /* If this is a HCI command related to powering on the
10409 * HCI dev don't send any mgmt signals.
10410 */
10411 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10412 return;
10413
10414 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10415 return;
10416 }
10417
10418 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10419 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10420 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10421 }
10422
has_uuid(u8 * uuid,u16 uuid_count,u8 (* uuids)[16])10423 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10424 {
10425 int i;
10426
10427 for (i = 0; i < uuid_count; i++) {
10428 if (!memcmp(uuid, uuids[i], 16))
10429 return true;
10430 }
10431
10432 return false;
10433 }
10434
eir_has_uuids(u8 * eir,u16 eir_len,u16 uuid_count,u8 (* uuids)[16])10435 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10436 {
10437 u16 parsed = 0;
10438
10439 while (parsed < eir_len) {
10440 u8 field_len = eir[0];
10441 u8 uuid[16];
10442 int i;
10443
10444 if (field_len == 0)
10445 break;
10446
10447 if (eir_len - parsed < field_len + 1)
10448 break;
10449
10450 switch (eir[1]) {
10451 case EIR_UUID16_ALL:
10452 case EIR_UUID16_SOME:
10453 for (i = 0; i + 3 <= field_len; i += 2) {
10454 memcpy(uuid, bluetooth_base_uuid, 16);
10455 uuid[13] = eir[i + 3];
10456 uuid[12] = eir[i + 2];
10457 if (has_uuid(uuid, uuid_count, uuids))
10458 return true;
10459 }
10460 break;
10461 case EIR_UUID32_ALL:
10462 case EIR_UUID32_SOME:
10463 for (i = 0; i + 5 <= field_len; i += 4) {
10464 memcpy(uuid, bluetooth_base_uuid, 16);
10465 uuid[15] = eir[i + 5];
10466 uuid[14] = eir[i + 4];
10467 uuid[13] = eir[i + 3];
10468 uuid[12] = eir[i + 2];
10469 if (has_uuid(uuid, uuid_count, uuids))
10470 return true;
10471 }
10472 break;
10473 case EIR_UUID128_ALL:
10474 case EIR_UUID128_SOME:
10475 for (i = 0; i + 17 <= field_len; i += 16) {
10476 memcpy(uuid, eir + i + 2, 16);
10477 if (has_uuid(uuid, uuid_count, uuids))
10478 return true;
10479 }
10480 break;
10481 }
10482
10483 parsed += field_len + 1;
10484 eir += field_len + 1;
10485 }
10486
10487 return false;
10488 }
10489
is_filter_match(struct hci_dev * hdev,s8 rssi,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)10490 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10491 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10492 {
10493 /* If a RSSI threshold has been specified, and
10494 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10495 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10496 * is set, let it through for further processing, as we might need to
10497 * restart the scan.
10498 *
10499 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10500 * the results are also dropped.
10501 */
10502 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10503 (rssi == HCI_RSSI_INVALID ||
10504 (rssi < hdev->discovery.rssi &&
10505 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER))))
10506 return false;
10507
10508 if (hdev->discovery.uuid_count != 0) {
10509 /* If a list of UUIDs is provided in filter, results with no
10510 * matching UUID should be dropped.
10511 */
10512 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10513 hdev->discovery.uuids) &&
10514 !eir_has_uuids(scan_rsp, scan_rsp_len,
10515 hdev->discovery.uuid_count,
10516 hdev->discovery.uuids))
10517 return false;
10518 }
10519
10520 /* If duplicate filtering does not report RSSI changes, then restart
10521 * scanning to ensure updated result with updated RSSI values.
10522 */
10523 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) {
10524 /* Validate RSSI value against the RSSI threshold once more. */
10525 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10526 rssi < hdev->discovery.rssi)
10527 return false;
10528 }
10529
10530 return true;
10531 }
10532
mgmt_adv_monitor_device_lost(struct hci_dev * hdev,u16 handle,bdaddr_t * bdaddr,u8 addr_type)10533 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10534 bdaddr_t *bdaddr, u8 addr_type)
10535 {
10536 struct mgmt_ev_adv_monitor_device_lost ev;
10537
10538 ev.monitor_handle = cpu_to_le16(handle);
10539 bacpy(&ev.addr.bdaddr, bdaddr);
10540 ev.addr.type = addr_type;
10541
10542 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10543 NULL);
10544 }
10545
mgmt_send_adv_monitor_device_found(struct hci_dev * hdev,struct sk_buff * skb,struct sock * skip_sk,u16 handle)10546 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10547 struct sk_buff *skb,
10548 struct sock *skip_sk,
10549 u16 handle)
10550 {
10551 struct sk_buff *advmon_skb;
10552 size_t advmon_skb_len;
10553 __le16 *monitor_handle;
10554
10555 if (!skb)
10556 return;
10557
10558 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10559 sizeof(struct mgmt_ev_device_found)) + skb->len;
10560 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10561 advmon_skb_len);
10562 if (!advmon_skb)
10563 return;
10564
10565 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10566 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10567 * store monitor_handle of the matched monitor.
10568 */
10569 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10570 *monitor_handle = cpu_to_le16(handle);
10571 skb_put_data(advmon_skb, skb->data, skb->len);
10572
10573 mgmt_event_skb(advmon_skb, skip_sk);
10574 }
10575
mgmt_adv_monitor_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,bool report_device,struct sk_buff * skb,struct sock * skip_sk)10576 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10577 bdaddr_t *bdaddr, bool report_device,
10578 struct sk_buff *skb,
10579 struct sock *skip_sk)
10580 {
10581 struct monitored_device *dev, *tmp;
10582 bool matched = false;
10583 bool notified = false;
10584
10585 /* We have received the Advertisement Report because:
10586 * 1. the kernel has initiated active discovery
10587 * 2. if not, we have pend_le_reports > 0 in which case we are doing
10588 * passive scanning
10589 * 3. if none of the above is true, we have one or more active
10590 * Advertisement Monitor
10591 *
10592 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10593 * and report ONLY one advertisement per device for the matched Monitor
10594 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10595 *
10596 * For case 3, since we are not active scanning and all advertisements
10597 * received are due to a matched Advertisement Monitor, report all
10598 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10599 */
10600 if (report_device && !hdev->advmon_pend_notify) {
10601 mgmt_event_skb(skb, skip_sk);
10602 return;
10603 }
10604
10605 hdev->advmon_pend_notify = false;
10606
10607 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10608 if (!bacmp(&dev->bdaddr, bdaddr)) {
10609 matched = true;
10610
10611 if (!dev->notified) {
10612 mgmt_send_adv_monitor_device_found(hdev, skb,
10613 skip_sk,
10614 dev->handle);
10615 notified = true;
10616 dev->notified = true;
10617 }
10618 }
10619
10620 if (!dev->notified)
10621 hdev->advmon_pend_notify = true;
10622 }
10623
10624 if (!report_device &&
10625 ((matched && !notified) || !msft_monitor_supported(hdev))) {
10626 /* Handle 0 indicates that we are not active scanning and this
10627 * is a subsequent advertisement report for an already matched
10628 * Advertisement Monitor or the controller offloading support
10629 * is not available.
10630 */
10631 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10632 }
10633
10634 if (report_device)
10635 mgmt_event_skb(skb, skip_sk);
10636 else
10637 kfree_skb(skb);
10638 }
10639
mesh_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len,u64 instant)10640 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10641 u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10642 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10643 u64 instant)
10644 {
10645 struct sk_buff *skb;
10646 struct mgmt_ev_mesh_device_found *ev;
10647 int i, j;
10648
10649 if (!hdev->mesh_ad_types[0])
10650 goto accepted;
10651
10652 /* Scan for requested AD types */
10653 if (eir_len > 0) {
10654 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10655 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10656 if (!hdev->mesh_ad_types[j])
10657 break;
10658
10659 if (hdev->mesh_ad_types[j] == eir[i + 1])
10660 goto accepted;
10661 }
10662 }
10663 }
10664
10665 if (scan_rsp_len > 0) {
10666 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10667 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10668 if (!hdev->mesh_ad_types[j])
10669 break;
10670
10671 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10672 goto accepted;
10673 }
10674 }
10675 }
10676
10677 return;
10678
10679 accepted:
10680 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10681 sizeof(*ev) + eir_len + scan_rsp_len);
10682 if (!skb)
10683 return;
10684
10685 ev = skb_put(skb, sizeof(*ev));
10686
10687 bacpy(&ev->addr.bdaddr, bdaddr);
10688 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10689 ev->rssi = rssi;
10690 ev->flags = cpu_to_le32(flags);
10691 ev->instant = cpu_to_le64(instant);
10692
10693 if (eir_len > 0)
10694 /* Copy EIR or advertising data into event */
10695 skb_put_data(skb, eir, eir_len);
10696
10697 if (scan_rsp_len > 0)
10698 /* Append scan response data to event */
10699 skb_put_data(skb, scan_rsp, scan_rsp_len);
10700
10701 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10702
10703 mgmt_event_skb(skb, NULL);
10704 }
10705
mgmt_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 * dev_class,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len,u64 instant)10706 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10707 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10708 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10709 u64 instant)
10710 {
10711 struct sk_buff *skb;
10712 struct mgmt_ev_device_found *ev;
10713 bool report_device = hci_discovery_active(hdev);
10714
10715 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10716 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10717 eir, eir_len, scan_rsp, scan_rsp_len,
10718 instant);
10719
10720 /* Don't send events for a non-kernel initiated discovery. With
10721 * LE one exception is if we have pend_le_reports > 0 in which
10722 * case we're doing passive scanning and want these events.
10723 */
10724 if (!hci_discovery_active(hdev)) {
10725 if (link_type == ACL_LINK)
10726 return;
10727 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10728 report_device = true;
10729 else if (!hci_is_adv_monitoring(hdev))
10730 return;
10731 }
10732
10733 if (hdev->discovery.result_filtering) {
10734 /* We are using service discovery */
10735 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10736 scan_rsp_len))
10737 return;
10738 }
10739
10740 if (hdev->discovery.limited) {
10741 /* Check for limited discoverable bit */
10742 if (dev_class) {
10743 if (!(dev_class[1] & 0x20))
10744 return;
10745 } else {
10746 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10747 if (!flags || !(flags[0] & LE_AD_LIMITED))
10748 return;
10749 }
10750 }
10751
10752 /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10753 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10754 sizeof(*ev) + eir_len + scan_rsp_len + 5);
10755 if (!skb)
10756 return;
10757
10758 ev = skb_put(skb, sizeof(*ev));
10759
10760 /* In case of device discovery with BR/EDR devices (pre 1.2), the
10761 * RSSI value was reported as 0 when not available. This behavior
10762 * is kept when using device discovery. This is required for full
10763 * backwards compatibility with the API.
10764 *
10765 * However when using service discovery, the value 127 will be
10766 * returned when the RSSI is not available.
10767 */
10768 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10769 link_type == ACL_LINK)
10770 rssi = 0;
10771
10772 bacpy(&ev->addr.bdaddr, bdaddr);
10773 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10774 ev->rssi = rssi;
10775 ev->flags = cpu_to_le32(flags);
10776
10777 if (eir_len > 0)
10778 /* Copy EIR or advertising data into event */
10779 skb_put_data(skb, eir, eir_len);
10780
10781 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10782 u8 eir_cod[5];
10783
10784 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10785 dev_class, 3);
10786 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10787 }
10788
10789 if (scan_rsp_len > 0)
10790 /* Append scan response data to event */
10791 skb_put_data(skb, scan_rsp, scan_rsp_len);
10792
10793 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10794
10795 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10796 }
10797
mgmt_remote_name(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,s8 rssi,u8 * name,u8 name_len)10798 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10799 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10800 {
10801 struct sk_buff *skb;
10802 struct mgmt_ev_device_found *ev;
10803 u16 eir_len = 0;
10804 u32 flags = 0;
10805
10806 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10807 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10808 if (!skb)
10809 return;
10810
10811 ev = skb_put(skb, sizeof(*ev));
10812 bacpy(&ev->addr.bdaddr, bdaddr);
10813 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10814 ev->rssi = rssi;
10815
10816 if (name)
10817 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10818 else
10819 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10820
10821 ev->eir_len = cpu_to_le16(eir_len);
10822 ev->flags = cpu_to_le32(flags);
10823
10824 mgmt_event_skb(skb, NULL);
10825 }
10826
mgmt_discovering(struct hci_dev * hdev,u8 discovering)10827 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10828 {
10829 struct mgmt_ev_discovering ev;
10830
10831 bt_dev_dbg(hdev, "discovering %u", discovering);
10832
10833 memset(&ev, 0, sizeof(ev));
10834 ev.type = hdev->discovery.type;
10835 ev.discovering = discovering;
10836
10837 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10838 }
10839
mgmt_suspending(struct hci_dev * hdev,u8 state)10840 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10841 {
10842 struct mgmt_ev_controller_suspend ev;
10843
10844 ev.suspend_state = state;
10845 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10846 }
10847
mgmt_resuming(struct hci_dev * hdev,u8 reason,bdaddr_t * bdaddr,u8 addr_type)10848 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10849 u8 addr_type)
10850 {
10851 struct mgmt_ev_controller_resume ev;
10852
10853 ev.wake_reason = reason;
10854 if (bdaddr) {
10855 bacpy(&ev.addr.bdaddr, bdaddr);
10856 ev.addr.type = addr_type;
10857 } else {
10858 memset(&ev.addr, 0, sizeof(ev.addr));
10859 }
10860
10861 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10862 }
10863
10864 static struct hci_mgmt_chan chan = {
10865 .channel = HCI_CHANNEL_CONTROL,
10866 .handler_count = ARRAY_SIZE(mgmt_handlers),
10867 .handlers = mgmt_handlers,
10868 .hdev_init = mgmt_init_hdev,
10869 };
10870
mgmt_init(void)10871 int mgmt_init(void)
10872 {
10873 return hci_mgmt_chan_register(&chan);
10874 }
10875
mgmt_conn_subrate_notify(struct hci_dev * hdev,struct hci_conn * conn,u8 status)10876 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn,
10877 u8 status)
10878 {
10879 struct mgmt_ev_conn_subrate ev;
10880
10881 bacpy(&ev.addr.bdaddr, &conn->dst);
10882 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10883 ev.status = mgmt_status(status);
10884 ev.interval = cpu_to_le16(conn->le_rate_interval);
10885 ev.subrate = cpu_to_le16(conn->le_subrate);
10886 ev.latency = cpu_to_le16(conn->le_rate_latency);
10887 ev.cont_num = cpu_to_le16(conn->le_cont_num);
10888 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout);
10889
10890 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL);
10891 }
10892
mgmt_exit(void)10893 void mgmt_exit(void)
10894 {
10895 hci_mgmt_chan_unregister(&chan);
10896 }
10897
mgmt_cleanup(struct sock * sk)10898 void mgmt_cleanup(struct sock *sk)
10899 {
10900 struct mgmt_mesh_tx *mesh_tx;
10901 struct hci_dev *hdev;
10902
10903 read_lock(&hci_dev_list_lock);
10904
10905 list_for_each_entry(hdev, &hci_dev_list, list) {
10906 do {
10907 mesh_tx = mgmt_mesh_next(hdev, sk);
10908
10909 if (mesh_tx)
10910 mesh_send_complete(hdev, mesh_tx, true);
10911 } while (mesh_tx);
10912 }
10913
10914 read_unlock(&hci_dev_list_lock);
10915 }
10916