1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 BlueZ - Bluetooth protocol stack for Linux
4
5 Copyright (C) 2010 Nokia Corporation
6 Copyright (C) 2011-2012 Intel Corporation
7
8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16
17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19 SOFTWARE IS DISCLAIMED.
20 */
21
22 /* Bluetooth HCI Management interface */
23
24 #include <linux/module.h>
25 #include <linux/unaligned.h>
26
27 #include <net/bluetooth/bluetooth.h>
28 #include <net/bluetooth/hci_core.h>
29 #include <net/bluetooth/hci_sock.h>
30 #include <net/bluetooth/l2cap.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "smp.h"
34 #include "mgmt_util.h"
35 #include "mgmt_config.h"
36 #include "msft.h"
37 #include "eir.h"
38 #include "aosp.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 23
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 MGMT_OP_GET_PHY_CONFIGURATION,
110 MGMT_OP_SET_PHY_CONFIGURATION,
111 MGMT_OP_SET_BLOCKED_KEYS,
112 MGMT_OP_SET_WIDEBAND_SPEECH,
113 MGMT_OP_READ_CONTROLLER_CAP,
114 MGMT_OP_READ_EXP_FEATURES_INFO,
115 MGMT_OP_SET_EXP_FEATURE,
116 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
117 MGMT_OP_SET_DEF_SYSTEM_CONFIG,
118 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
119 MGMT_OP_SET_DEF_RUNTIME_CONFIG,
120 MGMT_OP_GET_DEVICE_FLAGS,
121 MGMT_OP_SET_DEVICE_FLAGS,
122 MGMT_OP_READ_ADV_MONITOR_FEATURES,
123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
124 MGMT_OP_REMOVE_ADV_MONITOR,
125 MGMT_OP_ADD_EXT_ADV_PARAMS,
126 MGMT_OP_ADD_EXT_ADV_DATA,
127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI,
128 MGMT_OP_SET_MESH_RECEIVER,
129 MGMT_OP_MESH_READ_FEATURES,
130 MGMT_OP_MESH_SEND,
131 MGMT_OP_MESH_SEND_CANCEL,
132 MGMT_OP_HCI_CMD_SYNC,
133 };
134
135 static const u16 mgmt_events[] = {
136 MGMT_EV_CONTROLLER_ERROR,
137 MGMT_EV_INDEX_ADDED,
138 MGMT_EV_INDEX_REMOVED,
139 MGMT_EV_NEW_SETTINGS,
140 MGMT_EV_CLASS_OF_DEV_CHANGED,
141 MGMT_EV_LOCAL_NAME_CHANGED,
142 MGMT_EV_NEW_LINK_KEY,
143 MGMT_EV_NEW_LONG_TERM_KEY,
144 MGMT_EV_DEVICE_CONNECTED,
145 MGMT_EV_DEVICE_DISCONNECTED,
146 MGMT_EV_CONNECT_FAILED,
147 MGMT_EV_PIN_CODE_REQUEST,
148 MGMT_EV_USER_CONFIRM_REQUEST,
149 MGMT_EV_USER_PASSKEY_REQUEST,
150 MGMT_EV_AUTH_FAILED,
151 MGMT_EV_DEVICE_FOUND,
152 MGMT_EV_DISCOVERING,
153 MGMT_EV_DEVICE_BLOCKED,
154 MGMT_EV_DEVICE_UNBLOCKED,
155 MGMT_EV_DEVICE_UNPAIRED,
156 MGMT_EV_PASSKEY_NOTIFY,
157 MGMT_EV_NEW_IRK,
158 MGMT_EV_NEW_CSRK,
159 MGMT_EV_DEVICE_ADDED,
160 MGMT_EV_DEVICE_REMOVED,
161 MGMT_EV_NEW_CONN_PARAM,
162 MGMT_EV_UNCONF_INDEX_ADDED,
163 MGMT_EV_UNCONF_INDEX_REMOVED,
164 MGMT_EV_NEW_CONFIG_OPTIONS,
165 MGMT_EV_EXT_INDEX_ADDED,
166 MGMT_EV_EXT_INDEX_REMOVED,
167 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
168 MGMT_EV_ADVERTISING_ADDED,
169 MGMT_EV_ADVERTISING_REMOVED,
170 MGMT_EV_EXT_INFO_CHANGED,
171 MGMT_EV_PHY_CONFIGURATION_CHANGED,
172 MGMT_EV_EXP_FEATURE_CHANGED,
173 MGMT_EV_DEVICE_FLAGS_CHANGED,
174 MGMT_EV_ADV_MONITOR_ADDED,
175 MGMT_EV_ADV_MONITOR_REMOVED,
176 MGMT_EV_CONTROLLER_SUSPEND,
177 MGMT_EV_CONTROLLER_RESUME,
178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
179 MGMT_EV_ADV_MONITOR_DEVICE_LOST,
180 };
181
182 static const u16 mgmt_untrusted_commands[] = {
183 MGMT_OP_READ_INDEX_LIST,
184 MGMT_OP_READ_INFO,
185 MGMT_OP_READ_UNCONF_INDEX_LIST,
186 MGMT_OP_READ_CONFIG_INFO,
187 MGMT_OP_READ_EXT_INDEX_LIST,
188 MGMT_OP_READ_EXT_INFO,
189 MGMT_OP_READ_CONTROLLER_CAP,
190 MGMT_OP_READ_EXP_FEATURES_INFO,
191 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
192 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
193 };
194
195 static const u16 mgmt_untrusted_events[] = {
196 MGMT_EV_INDEX_ADDED,
197 MGMT_EV_INDEX_REMOVED,
198 MGMT_EV_NEW_SETTINGS,
199 MGMT_EV_CLASS_OF_DEV_CHANGED,
200 MGMT_EV_LOCAL_NAME_CHANGED,
201 MGMT_EV_UNCONF_INDEX_ADDED,
202 MGMT_EV_UNCONF_INDEX_REMOVED,
203 MGMT_EV_NEW_CONFIG_OPTIONS,
204 MGMT_EV_EXT_INDEX_ADDED,
205 MGMT_EV_EXT_INDEX_REMOVED,
206 MGMT_EV_EXT_INFO_CHANGED,
207 MGMT_EV_EXP_FEATURE_CHANGED,
208 };
209
210 #define CACHE_TIMEOUT secs_to_jiffies(2)
211
212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
213 "\x00\x00\x00\x00\x00\x00\x00\x00"
214
215 /* HCI to MGMT error code conversion table */
216 static const u8 mgmt_status_table[] = {
217 MGMT_STATUS_SUCCESS,
218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
220 MGMT_STATUS_FAILED, /* Hardware Failure */
221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
229 MGMT_STATUS_BUSY, /* Command Disallowed */
230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
231 MGMT_STATUS_REJECTED, /* Rejected Security */
232 MGMT_STATUS_REJECTED, /* Rejected Personal */
233 MGMT_STATUS_TIMEOUT, /* Host Timeout */
234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
240 MGMT_STATUS_BUSY, /* Repeated Attempts */
241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
248 MGMT_STATUS_FAILED, /* Unspecified Error */
249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
255 MGMT_STATUS_FAILED, /* Unit Link Key Used */
256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
257 MGMT_STATUS_TIMEOUT, /* Instant Passed */
258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
259 MGMT_STATUS_FAILED, /* Transaction Collision */
260 MGMT_STATUS_FAILED, /* Reserved for future use */
261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
262 MGMT_STATUS_REJECTED, /* QoS Rejected */
263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
264 MGMT_STATUS_REJECTED, /* Insufficient Security */
265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
266 MGMT_STATUS_FAILED, /* Reserved for future use */
267 MGMT_STATUS_BUSY, /* Role Switch Pending */
268 MGMT_STATUS_FAILED, /* Reserved for future use */
269 MGMT_STATUS_FAILED, /* Slot Violation */
270 MGMT_STATUS_FAILED, /* Role Switch Failed */
271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
273 MGMT_STATUS_BUSY, /* Host Busy Pairing */
274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
275 MGMT_STATUS_BUSY, /* Controller Busy */
276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
281 };
282
mgmt_errno_status(int err)283 static u8 mgmt_errno_status(int err)
284 {
285 switch (err) {
286 case 0:
287 return MGMT_STATUS_SUCCESS;
288 case -EPERM:
289 return MGMT_STATUS_REJECTED;
290 case -EINVAL:
291 return MGMT_STATUS_INVALID_PARAMS;
292 case -EOPNOTSUPP:
293 return MGMT_STATUS_NOT_SUPPORTED;
294 case -EBUSY:
295 return MGMT_STATUS_BUSY;
296 case -ETIMEDOUT:
297 return MGMT_STATUS_AUTH_FAILED;
298 case -ENOMEM:
299 return MGMT_STATUS_NO_RESOURCES;
300 case -EISCONN:
301 return MGMT_STATUS_ALREADY_CONNECTED;
302 case -ENOTCONN:
303 return MGMT_STATUS_DISCONNECTED;
304 }
305
306 return MGMT_STATUS_FAILED;
307 }
308
mgmt_status(int err)309 static u8 mgmt_status(int err)
310 {
311 if (err < 0)
312 return mgmt_errno_status(err);
313
314 if (err < ARRAY_SIZE(mgmt_status_table))
315 return mgmt_status_table[err];
316
317 return MGMT_STATUS_FAILED;
318 }
319
mgmt_index_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag)320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
321 u16 len, int flag)
322 {
323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
324 flag, NULL);
325 }
326
mgmt_limited_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag,struct sock * skip_sk)327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
328 u16 len, int flag, struct sock *skip_sk)
329 {
330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
331 flag, skip_sk);
332 }
333
mgmt_event(u16 event,struct hci_dev * hdev,void * data,u16 len,struct sock * skip_sk)334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
335 struct sock *skip_sk)
336 {
337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
338 HCI_SOCK_TRUSTED, skip_sk);
339 }
340
mgmt_event_skb(struct sk_buff * skb,struct sock * skip_sk)341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk)
342 {
343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED,
344 skip_sk);
345 }
346
le_addr_type(u8 mgmt_addr_type)347 static u8 le_addr_type(u8 mgmt_addr_type)
348 {
349 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
350 return ADDR_LE_DEV_PUBLIC;
351 else
352 return ADDR_LE_DEV_RANDOM;
353 }
354
mgmt_fill_version_info(void * ver)355 void mgmt_fill_version_info(void *ver)
356 {
357 struct mgmt_rp_read_version *rp = ver;
358
359 rp->version = MGMT_VERSION;
360 rp->revision = cpu_to_le16(MGMT_REVISION);
361 }
362
read_version(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
364 u16 data_len)
365 {
366 struct mgmt_rp_read_version rp;
367
368 bt_dev_dbg(hdev, "sock %p", sk);
369
370 mgmt_fill_version_info(&rp);
371
372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
373 &rp, sizeof(rp));
374 }
375
read_commands(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
377 u16 data_len)
378 {
379 struct mgmt_rp_read_commands *rp;
380 u16 num_commands, num_events;
381 size_t rp_size;
382 int i, err;
383
384 bt_dev_dbg(hdev, "sock %p", sk);
385
386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
387 num_commands = ARRAY_SIZE(mgmt_commands);
388 num_events = ARRAY_SIZE(mgmt_events);
389 } else {
390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
391 num_events = ARRAY_SIZE(mgmt_untrusted_events);
392 }
393
394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
395
396 rp = kmalloc(rp_size, GFP_KERNEL);
397 if (!rp)
398 return -ENOMEM;
399
400 rp->num_commands = cpu_to_le16(num_commands);
401 rp->num_events = cpu_to_le16(num_events);
402
403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
404 __le16 *opcode = rp->opcodes;
405
406 for (i = 0; i < num_commands; i++, opcode++)
407 put_unaligned_le16(mgmt_commands[i], opcode);
408
409 for (i = 0; i < num_events; i++, opcode++)
410 put_unaligned_le16(mgmt_events[i], opcode);
411 } else {
412 __le16 *opcode = rp->opcodes;
413
414 for (i = 0; i < num_commands; i++, opcode++)
415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
416
417 for (i = 0; i < num_events; i++, opcode++)
418 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
419 }
420
421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
422 rp, rp_size);
423 kfree(rp);
424
425 return err;
426 }
427
read_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
429 u16 data_len)
430 {
431 struct mgmt_rp_read_index_list *rp;
432 struct hci_dev *d;
433 size_t rp_len;
434 u16 count;
435 int err;
436
437 bt_dev_dbg(hdev, "sock %p", sk);
438
439 read_lock(&hci_dev_list_lock);
440
441 count = 0;
442 list_for_each_entry(d, &hci_dev_list, list) {
443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED))
444 count++;
445 }
446
447 rp_len = sizeof(*rp) + (2 * count);
448 rp = kmalloc(rp_len, GFP_ATOMIC);
449 if (!rp) {
450 read_unlock(&hci_dev_list_lock);
451 return -ENOMEM;
452 }
453
454 count = 0;
455 list_for_each_entry(d, &hci_dev_list, list) {
456 if (hci_dev_test_flag(d, HCI_SETUP) ||
457 hci_dev_test_flag(d, HCI_CONFIG) ||
458 hci_dev_test_flag(d, HCI_USER_CHANNEL))
459 continue;
460
461 /* Devices marked as raw-only are neither configured
462 * nor unconfigured controllers.
463 */
464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
465 continue;
466
467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
468 rp->index[count++] = cpu_to_le16(d->id);
469 bt_dev_dbg(hdev, "Added hci%u", d->id);
470 }
471 }
472
473 rp->num_controllers = cpu_to_le16(count);
474 rp_len = sizeof(*rp) + (2 * count);
475
476 read_unlock(&hci_dev_list_lock);
477
478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
479 0, rp, rp_len);
480
481 kfree(rp);
482
483 return err;
484 }
485
read_unconf_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
487 void *data, u16 data_len)
488 {
489 struct mgmt_rp_read_unconf_index_list *rp;
490 struct hci_dev *d;
491 size_t rp_len;
492 u16 count;
493 int err;
494
495 bt_dev_dbg(hdev, "sock %p", sk);
496
497 read_lock(&hci_dev_list_lock);
498
499 count = 0;
500 list_for_each_entry(d, &hci_dev_list, list) {
501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
502 count++;
503 }
504
505 rp_len = sizeof(*rp) + (2 * count);
506 rp = kmalloc(rp_len, GFP_ATOMIC);
507 if (!rp) {
508 read_unlock(&hci_dev_list_lock);
509 return -ENOMEM;
510 }
511
512 count = 0;
513 list_for_each_entry(d, &hci_dev_list, list) {
514 if (hci_dev_test_flag(d, HCI_SETUP) ||
515 hci_dev_test_flag(d, HCI_CONFIG) ||
516 hci_dev_test_flag(d, HCI_USER_CHANNEL))
517 continue;
518
519 /* Devices marked as raw-only are neither configured
520 * nor unconfigured controllers.
521 */
522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
523 continue;
524
525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
526 rp->index[count++] = cpu_to_le16(d->id);
527 bt_dev_dbg(hdev, "Added hci%u", d->id);
528 }
529 }
530
531 rp->num_controllers = cpu_to_le16(count);
532 rp_len = sizeof(*rp) + (2 * count);
533
534 read_unlock(&hci_dev_list_lock);
535
536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
538
539 kfree(rp);
540
541 return err;
542 }
543
read_ext_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
545 void *data, u16 data_len)
546 {
547 struct mgmt_rp_read_ext_index_list *rp;
548 struct hci_dev *d;
549 u16 count;
550 int err;
551
552 bt_dev_dbg(hdev, "sock %p", sk);
553
554 read_lock(&hci_dev_list_lock);
555
556 count = 0;
557 list_for_each_entry(d, &hci_dev_list, list)
558 count++;
559
560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC);
561 if (!rp) {
562 read_unlock(&hci_dev_list_lock);
563 return -ENOMEM;
564 }
565
566 count = 0;
567 list_for_each_entry(d, &hci_dev_list, list) {
568 if (hci_dev_test_flag(d, HCI_SETUP) ||
569 hci_dev_test_flag(d, HCI_CONFIG) ||
570 hci_dev_test_flag(d, HCI_USER_CHANNEL))
571 continue;
572
573 /* Devices marked as raw-only are neither configured
574 * nor unconfigured controllers.
575 */
576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE))
577 continue;
578
579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
580 rp->entry[count].type = 0x01;
581 else
582 rp->entry[count].type = 0x00;
583
584 rp->entry[count].bus = d->bus;
585 rp->entry[count++].index = cpu_to_le16(d->id);
586 bt_dev_dbg(hdev, "Added hci%u", d->id);
587 }
588
589 rp->num_controllers = cpu_to_le16(count);
590
591 read_unlock(&hci_dev_list_lock);
592
593 /* If this command is called at least once, then all the
594 * default index and unconfigured index events are disabled
595 * and from now on only extended index events are used.
596 */
597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
600
601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
603 struct_size(rp, entry, count));
604
605 kfree(rp);
606
607 return err;
608 }
609
is_configured(struct hci_dev * hdev)610 static bool is_configured(struct hci_dev *hdev)
611 {
612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) &&
613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
614 return false;
615
616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) ||
617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) &&
618 !bacmp(&hdev->public_addr, BDADDR_ANY))
619 return false;
620
621 return true;
622 }
623
get_missing_options(struct hci_dev * hdev)624 static __le32 get_missing_options(struct hci_dev *hdev)
625 {
626 u32 options = 0;
627
628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) &&
629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
630 options |= MGMT_OPTION_EXTERNAL_CONFIG;
631
632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) ||
633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) &&
634 !bacmp(&hdev->public_addr, BDADDR_ANY))
635 options |= MGMT_OPTION_PUBLIC_ADDRESS;
636
637 return cpu_to_le32(options);
638 }
639
new_options(struct hci_dev * hdev,struct sock * skip)640 static int new_options(struct hci_dev *hdev, struct sock *skip)
641 {
642 __le32 options = get_missing_options(hdev);
643
644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
646 }
647
send_options_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
649 {
650 __le32 options = get_missing_options(hdev);
651
652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
653 sizeof(options));
654 }
655
read_config_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)656 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
657 void *data, u16 data_len)
658 {
659 struct mgmt_rp_read_config_info rp;
660 u32 options = 0;
661
662 bt_dev_dbg(hdev, "sock %p", sk);
663
664 hci_dev_lock(hdev);
665
666 memset(&rp, 0, sizeof(rp));
667 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
668
669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG))
670 options |= MGMT_OPTION_EXTERNAL_CONFIG;
671
672 if (hdev->set_bdaddr)
673 options |= MGMT_OPTION_PUBLIC_ADDRESS;
674
675 rp.supported_options = cpu_to_le32(options);
676 rp.missing_options = get_missing_options(hdev);
677
678 hci_dev_unlock(hdev);
679
680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
681 &rp, sizeof(rp));
682 }
683
get_supported_phys(struct hci_dev * hdev)684 static u32 get_supported_phys(struct hci_dev *hdev)
685 {
686 u32 supported_phys = 0;
687
688 if (lmp_bredr_capable(hdev)) {
689 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
690
691 if (hdev->features[0][0] & LMP_3SLOT)
692 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
693
694 if (hdev->features[0][0] & LMP_5SLOT)
695 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
696
697 if (lmp_edr_2m_capable(hdev)) {
698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
699
700 if (lmp_edr_3slot_capable(hdev))
701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
702
703 if (lmp_edr_5slot_capable(hdev))
704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
705
706 if (lmp_edr_3m_capable(hdev)) {
707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
708
709 if (lmp_edr_3slot_capable(hdev))
710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
711
712 if (lmp_edr_5slot_capable(hdev))
713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
714 }
715 }
716 }
717
718 if (lmp_le_capable(hdev)) {
719 supported_phys |= MGMT_PHY_LE_1M_TX;
720 supported_phys |= MGMT_PHY_LE_1M_RX;
721
722 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
723 supported_phys |= MGMT_PHY_LE_2M_TX;
724 supported_phys |= MGMT_PHY_LE_2M_RX;
725 }
726
727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
728 supported_phys |= MGMT_PHY_LE_CODED_TX;
729 supported_phys |= MGMT_PHY_LE_CODED_RX;
730 }
731 }
732
733 return supported_phys;
734 }
735
get_selected_phys(struct hci_dev * hdev)736 static u32 get_selected_phys(struct hci_dev *hdev)
737 {
738 u32 selected_phys = 0;
739
740 if (lmp_bredr_capable(hdev)) {
741 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
742
743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
744 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
745
746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
747 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
748
749 if (lmp_edr_2m_capable(hdev)) {
750 if (!(hdev->pkt_type & HCI_2DH1))
751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
752
753 if (lmp_edr_3slot_capable(hdev) &&
754 !(hdev->pkt_type & HCI_2DH3))
755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
756
757 if (lmp_edr_5slot_capable(hdev) &&
758 !(hdev->pkt_type & HCI_2DH5))
759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
760
761 if (lmp_edr_3m_capable(hdev)) {
762 if (!(hdev->pkt_type & HCI_3DH1))
763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
764
765 if (lmp_edr_3slot_capable(hdev) &&
766 !(hdev->pkt_type & HCI_3DH3))
767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
768
769 if (lmp_edr_5slot_capable(hdev) &&
770 !(hdev->pkt_type & HCI_3DH5))
771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
772 }
773 }
774 }
775
776 if (lmp_le_capable(hdev)) {
777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
778 selected_phys |= MGMT_PHY_LE_1M_TX;
779
780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
781 selected_phys |= MGMT_PHY_LE_1M_RX;
782
783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
784 selected_phys |= MGMT_PHY_LE_2M_TX;
785
786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
787 selected_phys |= MGMT_PHY_LE_2M_RX;
788
789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
790 selected_phys |= MGMT_PHY_LE_CODED_TX;
791
792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
793 selected_phys |= MGMT_PHY_LE_CODED_RX;
794 }
795
796 return selected_phys;
797 }
798
get_configurable_phys(struct hci_dev * hdev)799 static u32 get_configurable_phys(struct hci_dev *hdev)
800 {
801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
803 }
804
get_supported_settings(struct hci_dev * hdev)805 static u32 get_supported_settings(struct hci_dev *hdev)
806 {
807 u32 settings = 0;
808
809 settings |= MGMT_SETTING_POWERED;
810 settings |= MGMT_SETTING_BONDABLE;
811 settings |= MGMT_SETTING_DEBUG_KEYS;
812 settings |= MGMT_SETTING_CONNECTABLE;
813 settings |= MGMT_SETTING_DISCOVERABLE;
814
815 if (lmp_bredr_capable(hdev)) {
816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
817 settings |= MGMT_SETTING_FAST_CONNECTABLE;
818 settings |= MGMT_SETTING_BREDR;
819 settings |= MGMT_SETTING_LINK_SECURITY;
820
821 if (lmp_ssp_capable(hdev)) {
822 settings |= MGMT_SETTING_SSP;
823 }
824
825 if (lmp_sc_capable(hdev))
826 settings |= MGMT_SETTING_SECURE_CONN;
827
828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED))
829 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
830 }
831
832 if (lmp_le_capable(hdev)) {
833 settings |= MGMT_SETTING_LE;
834 settings |= MGMT_SETTING_SECURE_CONN;
835 settings |= MGMT_SETTING_PRIVACY;
836 settings |= MGMT_SETTING_STATIC_ADDRESS;
837 settings |= MGMT_SETTING_ADVERTISING;
838 }
839
840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr)
841 settings |= MGMT_SETTING_CONFIGURATION;
842
843 if (cis_central_capable(hdev))
844 settings |= MGMT_SETTING_CIS_CENTRAL;
845
846 if (cis_peripheral_capable(hdev))
847 settings |= MGMT_SETTING_CIS_PERIPHERAL;
848
849 if (bis_capable(hdev))
850 settings |= MGMT_SETTING_ISO_BROADCASTER;
851
852 if (sync_recv_capable(hdev))
853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
854
855 if (ll_privacy_capable(hdev))
856 settings |= MGMT_SETTING_LL_PRIVACY;
857
858 if (past_sender_capable(hdev))
859 settings |= MGMT_SETTING_PAST_SENDER;
860
861 if (past_receiver_capable(hdev))
862 settings |= MGMT_SETTING_PAST_RECEIVER;
863
864 if (le_sci_capable(hdev))
865 settings |= MGMT_SETTING_SCI;
866
867 settings |= MGMT_SETTING_PHY_CONFIGURATION;
868
869 return settings;
870 }
871
get_current_settings(struct hci_dev * hdev)872 static u32 get_current_settings(struct hci_dev *hdev)
873 {
874 u32 settings = 0;
875
876 if (hdev_is_powered(hdev))
877 settings |= MGMT_SETTING_POWERED;
878
879 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
880 settings |= MGMT_SETTING_CONNECTABLE;
881
882 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
883 settings |= MGMT_SETTING_FAST_CONNECTABLE;
884
885 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
886 settings |= MGMT_SETTING_DISCOVERABLE;
887
888 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
889 settings |= MGMT_SETTING_BONDABLE;
890
891 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
892 settings |= MGMT_SETTING_BREDR;
893
894 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
895 settings |= MGMT_SETTING_LE;
896
897 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
898 settings |= MGMT_SETTING_LINK_SECURITY;
899
900 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
901 settings |= MGMT_SETTING_SSP;
902
903 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
904 settings |= MGMT_SETTING_ADVERTISING;
905
906 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
907 settings |= MGMT_SETTING_SECURE_CONN;
908
909 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
910 settings |= MGMT_SETTING_DEBUG_KEYS;
911
912 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
913 settings |= MGMT_SETTING_PRIVACY;
914
915 /* The current setting for static address has two purposes. The
916 * first is to indicate if the static address will be used and
917 * the second is to indicate if it is actually set.
918 *
919 * This means if the static address is not configured, this flag
920 * will never be set. If the address is configured, then if the
921 * address is actually used decides if the flag is set or not.
922 *
923 * For single mode LE only controllers and dual-mode controllers
924 * with BR/EDR disabled, the existence of the static address will
925 * be evaluated.
926 */
927 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
928 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
929 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
930 if (bacmp(&hdev->static_addr, BDADDR_ANY))
931 settings |= MGMT_SETTING_STATIC_ADDRESS;
932 }
933
934 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
935 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
936
937 if (cis_central_enabled(hdev))
938 settings |= MGMT_SETTING_CIS_CENTRAL;
939
940 if (cis_peripheral_enabled(hdev))
941 settings |= MGMT_SETTING_CIS_PERIPHERAL;
942
943 if (bis_enabled(hdev))
944 settings |= MGMT_SETTING_ISO_BROADCASTER;
945
946 if (sync_recv_enabled(hdev))
947 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER;
948
949 if (ll_privacy_enabled(hdev))
950 settings |= MGMT_SETTING_LL_PRIVACY;
951
952 if (past_sender_enabled(hdev))
953 settings |= MGMT_SETTING_PAST_SENDER;
954
955 if (past_receiver_enabled(hdev))
956 settings |= MGMT_SETTING_PAST_RECEIVER;
957
958 if (le_sci_enabled(hdev))
959 settings |= MGMT_SETTING_SCI;
960
961 return settings;
962 }
963
pending_find(u16 opcode,struct hci_dev * hdev)964 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
965 {
966 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
967 }
968
mgmt_get_adv_discov_flags(struct hci_dev * hdev)969 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
970 {
971 struct mgmt_pending_cmd *cmd;
972
973 /* If there's a pending mgmt command the flags will not yet have
974 * their final values, so check for this first.
975 */
976 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
977 if (cmd) {
978 struct mgmt_mode *cp = cmd->param;
979 if (cp->val == 0x01)
980 return LE_AD_GENERAL;
981 else if (cp->val == 0x02)
982 return LE_AD_LIMITED;
983 } else {
984 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
985 return LE_AD_LIMITED;
986 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
987 return LE_AD_GENERAL;
988 }
989
990 return 0;
991 }
992
mgmt_get_connectable(struct hci_dev * hdev)993 bool mgmt_get_connectable(struct hci_dev *hdev)
994 {
995 struct mgmt_pending_cmd *cmd;
996
997 /* If there's a pending mgmt command the flag will not yet have
998 * it's final value, so check for this first.
999 */
1000 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1001 if (cmd) {
1002 struct mgmt_mode *cp = cmd->param;
1003
1004 return cp->val;
1005 }
1006
1007 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
1008 }
1009
service_cache_sync(struct hci_dev * hdev,void * data)1010 static int service_cache_sync(struct hci_dev *hdev, void *data)
1011 {
1012 hci_update_eir_sync(hdev);
1013 hci_update_class_sync(hdev);
1014
1015 return 0;
1016 }
1017
service_cache_off(struct work_struct * work)1018 static void service_cache_off(struct work_struct *work)
1019 {
1020 struct hci_dev *hdev = container_of(work, struct hci_dev,
1021 service_cache.work);
1022
1023 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1024 return;
1025
1026 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL);
1027 }
1028
rpa_expired_sync(struct hci_dev * hdev,void * data)1029 static int rpa_expired_sync(struct hci_dev *hdev, void *data)
1030 {
1031 /* The generation of a new RPA and programming it into the
1032 * controller happens in the hci_req_enable_advertising()
1033 * function.
1034 */
1035 if (ext_adv_capable(hdev))
1036 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance);
1037 else
1038 return hci_enable_advertising_sync(hdev);
1039 }
1040
rpa_expired(struct work_struct * work)1041 static void rpa_expired(struct work_struct *work)
1042 {
1043 struct hci_dev *hdev = container_of(work, struct hci_dev,
1044 rpa_expired.work);
1045
1046 bt_dev_dbg(hdev, "");
1047
1048 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1049
1050 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
1051 return;
1052
1053 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL);
1054 }
1055
1056 static int set_discoverable_sync(struct hci_dev *hdev, void *data);
1057
discov_off(struct work_struct * work)1058 static void discov_off(struct work_struct *work)
1059 {
1060 struct hci_dev *hdev = container_of(work, struct hci_dev,
1061 discov_off.work);
1062
1063 bt_dev_dbg(hdev, "");
1064
1065 hci_dev_lock(hdev);
1066
1067 /* When discoverable timeout triggers, then just make sure
1068 * the limited discoverable flag is cleared. Even in the case
1069 * of a timeout triggered from general discoverable, it is
1070 * safe to unconditionally clear the flag.
1071 */
1072 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1073 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1074 hdev->discov_timeout = 0;
1075
1076 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL);
1077
1078 mgmt_new_settings(hdev);
1079
1080 hci_dev_unlock(hdev);
1081 }
1082
1083 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev);
1084
mesh_send_complete(struct hci_dev * hdev,struct mgmt_mesh_tx * mesh_tx,bool silent)1085 static void mesh_send_complete(struct hci_dev *hdev,
1086 struct mgmt_mesh_tx *mesh_tx, bool silent)
1087 {
1088 u8 handle = mesh_tx->handle;
1089
1090 if (!silent)
1091 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle,
1092 sizeof(handle), NULL);
1093
1094 mgmt_mesh_remove(mesh_tx);
1095 }
1096
mesh_send_done_sync(struct hci_dev * hdev,void * data)1097 static int mesh_send_done_sync(struct hci_dev *hdev, void *data)
1098 {
1099 struct mgmt_mesh_tx *mesh_tx;
1100
1101 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
1102 if (list_empty(&hdev->adv_instances))
1103 hci_disable_advertising_sync(hdev);
1104 mesh_tx = mgmt_mesh_next(hdev, NULL);
1105
1106 if (mesh_tx)
1107 mesh_send_complete(hdev, mesh_tx, false);
1108
1109 return 0;
1110 }
1111
1112 static int mesh_send_sync(struct hci_dev *hdev, void *data);
1113 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err);
mesh_next(struct hci_dev * hdev,void * data,int err)1114 static void mesh_next(struct hci_dev *hdev, void *data, int err)
1115 {
1116 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL);
1117
1118 if (!mesh_tx)
1119 return;
1120
1121 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
1122 mesh_send_start_complete);
1123
1124 if (err < 0)
1125 mesh_send_complete(hdev, mesh_tx, false);
1126 else
1127 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
1128 }
1129
mesh_send_done(struct work_struct * work)1130 static void mesh_send_done(struct work_struct *work)
1131 {
1132 struct hci_dev *hdev = container_of(work, struct hci_dev,
1133 mesh_send_done.work);
1134
1135 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING))
1136 return;
1137
1138 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next);
1139 }
1140
mgmt_init_hdev(struct sock * sk,struct hci_dev * hdev)1141 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1142 {
1143 if (hci_dev_test_flag(hdev, HCI_MGMT))
1144 return;
1145
1146 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION);
1147
1148 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
1149 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1150 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1151 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done);
1152
1153 /* Non-mgmt controlled devices get this bit set
1154 * implicitly so that pairing works for them, however
1155 * for mgmt we require user-space to explicitly enable
1156 * it
1157 */
1158 hci_dev_clear_flag(hdev, HCI_BONDABLE);
1159
1160 hci_dev_set_flag(hdev, HCI_MGMT);
1161 }
1162
read_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1163 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1164 void *data, u16 data_len)
1165 {
1166 struct mgmt_rp_read_info rp;
1167
1168 bt_dev_dbg(hdev, "sock %p", sk);
1169
1170 hci_dev_lock(hdev);
1171
1172 memset(&rp, 0, sizeof(rp));
1173
1174 bacpy(&rp.bdaddr, &hdev->bdaddr);
1175
1176 rp.version = hdev->hci_ver;
1177 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1178
1179 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1180 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1181
1182 memcpy(rp.dev_class, hdev->dev_class, 3);
1183
1184 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1185 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1186
1187 hci_dev_unlock(hdev);
1188
1189 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1190 sizeof(rp));
1191 }
1192
append_eir_data_to_buf(struct hci_dev * hdev,u8 * eir)1193 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1194 {
1195 u16 eir_len = 0;
1196 size_t name_len;
1197
1198 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1199 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1200 hdev->dev_class, 3);
1201
1202 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1203 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1204 hdev->appearance);
1205
1206 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
1207 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1208 hdev->dev_name, name_len);
1209
1210 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
1211 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1212 hdev->short_name, name_len);
1213
1214 return eir_len;
1215 }
1216
read_ext_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1217 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1218 void *data, u16 data_len)
1219 {
1220 char buf[512];
1221 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1222 u16 eir_len;
1223
1224 bt_dev_dbg(hdev, "sock %p", sk);
1225
1226 memset(&buf, 0, sizeof(buf));
1227
1228 hci_dev_lock(hdev);
1229
1230 bacpy(&rp->bdaddr, &hdev->bdaddr);
1231
1232 rp->version = hdev->hci_ver;
1233 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1234
1235 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1236 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1237
1238
1239 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1240 rp->eir_len = cpu_to_le16(eir_len);
1241
1242 hci_dev_unlock(hdev);
1243
1244 /* If this command is called at least once, then the events
1245 * for class of device and local name changes are disabled
1246 * and only the new extended controller information event
1247 * is used.
1248 */
1249 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1250 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1251 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1252
1253 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1254 sizeof(*rp) + eir_len);
1255 }
1256
ext_info_changed(struct hci_dev * hdev,struct sock * skip)1257 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1258 {
1259 char buf[512];
1260 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1261 u16 eir_len;
1262
1263 memset(buf, 0, sizeof(buf));
1264
1265 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1266 ev->eir_len = cpu_to_le16(eir_len);
1267
1268 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1269 sizeof(*ev) + eir_len,
1270 HCI_MGMT_EXT_INFO_EVENTS, skip);
1271 }
1272
send_settings_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)1273 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1274 {
1275 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1276
1277 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1278 sizeof(settings));
1279 }
1280
mgmt_advertising_added(struct sock * sk,struct hci_dev * hdev,u8 instance)1281 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1282 {
1283 struct mgmt_ev_advertising_added ev;
1284
1285 ev.instance = instance;
1286
1287 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1288 }
1289
mgmt_advertising_removed(struct sock * sk,struct hci_dev * hdev,u8 instance)1290 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1291 u8 instance)
1292 {
1293 struct mgmt_ev_advertising_removed ev;
1294
1295 ev.instance = instance;
1296
1297 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1298 }
1299
cancel_adv_timeout(struct hci_dev * hdev)1300 static void cancel_adv_timeout(struct hci_dev *hdev)
1301 {
1302 if (hdev->adv_instance_timeout) {
1303 hdev->adv_instance_timeout = 0;
1304 cancel_delayed_work(&hdev->adv_instance_expire);
1305 }
1306 }
1307
1308 /* This function requires the caller holds hdev->lock */
restart_le_actions(struct hci_dev * hdev)1309 static void restart_le_actions(struct hci_dev *hdev)
1310 {
1311 struct hci_conn_params *p;
1312
1313 list_for_each_entry(p, &hdev->le_conn_params, list) {
1314 /* Needed for AUTO_OFF case where might not "really"
1315 * have been powered off.
1316 */
1317 hci_pend_le_list_del_init(p);
1318
1319 switch (p->auto_connect) {
1320 case HCI_AUTO_CONN_DIRECT:
1321 case HCI_AUTO_CONN_ALWAYS:
1322 hci_pend_le_list_add(p, &hdev->pend_le_conns);
1323 break;
1324 case HCI_AUTO_CONN_REPORT:
1325 hci_pend_le_list_add(p, &hdev->pend_le_reports);
1326 break;
1327 default:
1328 break;
1329 }
1330 }
1331 }
1332
new_settings(struct hci_dev * hdev,struct sock * skip)1333 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1334 {
1335 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1336
1337 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1338 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1339 }
1340
mgmt_set_powered_complete(struct hci_dev * hdev,void * data,int err)1341 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
1342 {
1343 struct mgmt_pending_cmd *cmd = data;
1344 struct mgmt_mode *cp;
1345
1346 /* Make sure cmd still outstanding. */
1347 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1348 return;
1349
1350 cp = cmd->param;
1351
1352 bt_dev_dbg(hdev, "err %d", err);
1353
1354 if (!err) {
1355 if (cp->val) {
1356 hci_dev_lock(hdev);
1357 restart_le_actions(hdev);
1358 hci_update_passive_scan(hdev);
1359 hci_dev_unlock(hdev);
1360 }
1361
1362 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
1363
1364 /* Only call new_setting for power on as power off is deferred
1365 * to hdev->power_off work which does call hci_dev_do_close.
1366 */
1367 if (cp->val)
1368 new_settings(hdev, cmd->sk);
1369 } else {
1370 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED,
1371 mgmt_status(err));
1372 }
1373
1374 mgmt_pending_free(cmd);
1375 }
1376
set_powered_sync(struct hci_dev * hdev,void * data)1377 static int set_powered_sync(struct hci_dev *hdev, void *data)
1378 {
1379 struct mgmt_pending_cmd *cmd = data;
1380 struct mgmt_mode cp;
1381
1382 mutex_lock(&hdev->mgmt_pending_lock);
1383
1384 /* Make sure cmd still outstanding. */
1385 if (!__mgmt_pending_listed(hdev, cmd)) {
1386 mutex_unlock(&hdev->mgmt_pending_lock);
1387 return -ECANCELED;
1388 }
1389
1390 memcpy(&cp, cmd->param, sizeof(cp));
1391
1392 mutex_unlock(&hdev->mgmt_pending_lock);
1393
1394 BT_DBG("%s", hdev->name);
1395
1396 return hci_set_powered_sync(hdev, cp.val);
1397 }
1398
set_powered(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1399 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1400 u16 len)
1401 {
1402 struct mgmt_mode *cp = data;
1403 struct mgmt_pending_cmd *cmd;
1404 int err;
1405
1406 bt_dev_dbg(hdev, "sock %p", sk);
1407
1408 if (cp->val != 0x00 && cp->val != 0x01)
1409 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1410 MGMT_STATUS_INVALID_PARAMS);
1411
1412 hci_dev_lock(hdev);
1413
1414 if (!cp->val) {
1415 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) {
1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1417 MGMT_STATUS_BUSY);
1418 goto failed;
1419 }
1420 }
1421
1422 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1423 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1424 MGMT_STATUS_BUSY);
1425 goto failed;
1426 }
1427
1428 if (!!cp->val == hdev_is_powered(hdev)) {
1429 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1430 goto failed;
1431 }
1432
1433 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1434 if (!cmd) {
1435 err = -ENOMEM;
1436 goto failed;
1437 }
1438
1439 /* Cancel potentially blocking sync operation before power off */
1440 if (cp->val == 0x00) {
1441 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
1442 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
1443 mgmt_set_powered_complete);
1444 } else {
1445 /* Use hci_cmd_sync_submit since hdev might not be running */
1446 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd,
1447 mgmt_set_powered_complete);
1448 }
1449
1450 if (err < 0)
1451 mgmt_pending_remove(cmd);
1452
1453 failed:
1454 hci_dev_unlock(hdev);
1455 return err;
1456 }
1457
mgmt_new_settings(struct hci_dev * hdev)1458 int mgmt_new_settings(struct hci_dev *hdev)
1459 {
1460 return new_settings(hdev, NULL);
1461 }
1462
1463 struct cmd_lookup {
1464 struct sock *sk;
1465 struct hci_dev *hdev;
1466 u8 mgmt_status;
1467 };
1468
settings_rsp(struct mgmt_pending_cmd * cmd,void * data)1469 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1470 {
1471 struct cmd_lookup *match = data;
1472
1473 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1474
1475 if (match->sk == NULL) {
1476 match->sk = cmd->sk;
1477 sock_hold(match->sk);
1478 }
1479 }
1480
cmd_status_rsp(struct mgmt_pending_cmd * cmd,void * data)1481 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1482 {
1483 u8 *status = data;
1484
1485 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status);
1486 }
1487
cmd_complete_rsp(struct mgmt_pending_cmd * cmd,void * data)1488 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1489 {
1490 struct cmd_lookup *match = data;
1491
1492 /* dequeue cmd_sync entries using cmd as data as that is about to be
1493 * removed/freed.
1494 */
1495 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL);
1496
1497 if (cmd->cmd_complete) {
1498 cmd->cmd_complete(cmd, match->mgmt_status);
1499 return;
1500 }
1501
1502 cmd_status_rsp(cmd, data);
1503 }
1504
generic_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1505 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1506 {
1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,
1508 cmd->param, cmd->param_len);
1509 }
1510
addr_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1511 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1512 {
1513 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status,
1514 cmd->param, sizeof(struct mgmt_addr_info));
1515 }
1516
mgmt_bredr_support(struct hci_dev * hdev)1517 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1518 {
1519 if (!lmp_bredr_capable(hdev))
1520 return MGMT_STATUS_NOT_SUPPORTED;
1521 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1522 return MGMT_STATUS_REJECTED;
1523 else
1524 return MGMT_STATUS_SUCCESS;
1525 }
1526
mgmt_le_support(struct hci_dev * hdev)1527 static u8 mgmt_le_support(struct hci_dev *hdev)
1528 {
1529 if (!lmp_le_capable(hdev))
1530 return MGMT_STATUS_NOT_SUPPORTED;
1531 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1532 return MGMT_STATUS_REJECTED;
1533 else
1534 return MGMT_STATUS_SUCCESS;
1535 }
1536
mgmt_set_discoverable_complete(struct hci_dev * hdev,void * data,int err)1537 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
1538 int err)
1539 {
1540 struct mgmt_pending_cmd *cmd = data;
1541
1542 bt_dev_dbg(hdev, "err %d", err);
1543
1544 /* Make sure cmd still outstanding. */
1545 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1546 return;
1547
1548 hci_dev_lock(hdev);
1549
1550 if (err) {
1551 u8 mgmt_err = mgmt_status(err);
1552 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1553 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1554 goto done;
1555 }
1556
1557 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1558 hdev->discov_timeout > 0) {
1559 int to = secs_to_jiffies(hdev->discov_timeout);
1560 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1561 }
1562
1563 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1564 new_settings(hdev, cmd->sk);
1565
1566 done:
1567 mgmt_pending_free(cmd);
1568 hci_dev_unlock(hdev);
1569 }
1570
set_discoverable_sync(struct hci_dev * hdev,void * data)1571 static int set_discoverable_sync(struct hci_dev *hdev, void *data)
1572 {
1573 if (!mgmt_pending_listed(hdev, data))
1574 return -ECANCELED;
1575
1576 BT_DBG("%s", hdev->name);
1577
1578 return hci_update_discoverable_sync(hdev);
1579 }
1580
set_discoverable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1581 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1582 u16 len)
1583 {
1584 struct mgmt_cp_set_discoverable *cp = data;
1585 struct mgmt_pending_cmd *cmd;
1586 u16 timeout;
1587 int err;
1588
1589 bt_dev_dbg(hdev, "sock %p", sk);
1590
1591 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1592 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1594 MGMT_STATUS_REJECTED);
1595
1596 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1597 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1598 MGMT_STATUS_INVALID_PARAMS);
1599
1600 timeout = __le16_to_cpu(cp->timeout);
1601
1602 /* Disabling discoverable requires that no timeout is set,
1603 * and enabling limited discoverable requires a timeout.
1604 */
1605 if ((cp->val == 0x00 && timeout > 0) ||
1606 (cp->val == 0x02 && timeout == 0))
1607 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1608 MGMT_STATUS_INVALID_PARAMS);
1609
1610 hci_dev_lock(hdev);
1611
1612 if (!hdev_is_powered(hdev) && timeout > 0) {
1613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1614 MGMT_STATUS_NOT_POWERED);
1615 goto failed;
1616 }
1617
1618 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1619 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1621 MGMT_STATUS_BUSY);
1622 goto failed;
1623 }
1624
1625 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1627 MGMT_STATUS_REJECTED);
1628 goto failed;
1629 }
1630
1631 if (hdev->advertising_paused) {
1632 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1633 MGMT_STATUS_BUSY);
1634 goto failed;
1635 }
1636
1637 if (!hdev_is_powered(hdev)) {
1638 bool changed = false;
1639
1640 /* Setting limited discoverable when powered off is
1641 * not a valid operation since it requires a timeout
1642 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1643 */
1644 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1645 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1646 changed = true;
1647 }
1648
1649 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1650 if (err < 0)
1651 goto failed;
1652
1653 if (changed)
1654 err = new_settings(hdev, sk);
1655
1656 goto failed;
1657 }
1658
1659 /* If the current mode is the same, then just update the timeout
1660 * value with the new value. And if only the timeout gets updated,
1661 * then no need for any HCI transactions.
1662 */
1663 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1664 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1665 HCI_LIMITED_DISCOVERABLE)) {
1666 cancel_delayed_work(&hdev->discov_off);
1667 hdev->discov_timeout = timeout;
1668
1669 if (cp->val && hdev->discov_timeout > 0) {
1670 int to = secs_to_jiffies(hdev->discov_timeout);
1671 queue_delayed_work(hdev->req_workqueue,
1672 &hdev->discov_off, to);
1673 }
1674
1675 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1676 goto failed;
1677 }
1678
1679 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1680 if (!cmd) {
1681 err = -ENOMEM;
1682 goto failed;
1683 }
1684
1685 /* Cancel any potential discoverable timeout that might be
1686 * still active and store new timeout value. The arming of
1687 * the timeout happens in the complete handler.
1688 */
1689 cancel_delayed_work(&hdev->discov_off);
1690 hdev->discov_timeout = timeout;
1691
1692 if (cp->val)
1693 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1694 else
1695 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1696
1697 /* Limited discoverable mode */
1698 if (cp->val == 0x02)
1699 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1700 else
1701 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1702
1703 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd,
1704 mgmt_set_discoverable_complete);
1705
1706 if (err < 0)
1707 mgmt_pending_remove(cmd);
1708
1709 failed:
1710 hci_dev_unlock(hdev);
1711 return err;
1712 }
1713
mgmt_set_connectable_complete(struct hci_dev * hdev,void * data,int err)1714 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
1715 int err)
1716 {
1717 struct mgmt_pending_cmd *cmd = data;
1718
1719 bt_dev_dbg(hdev, "err %d", err);
1720
1721 /* Make sure cmd still outstanding. */
1722 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1723 return;
1724
1725 hci_dev_lock(hdev);
1726
1727 if (err) {
1728 u8 mgmt_err = mgmt_status(err);
1729 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1730 goto done;
1731 }
1732
1733 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1734 new_settings(hdev, cmd->sk);
1735
1736 done:
1737 mgmt_pending_free(cmd);
1738
1739 hci_dev_unlock(hdev);
1740 }
1741
set_connectable_update_settings(struct hci_dev * hdev,struct sock * sk,u8 val)1742 static int set_connectable_update_settings(struct hci_dev *hdev,
1743 struct sock *sk, u8 val)
1744 {
1745 bool changed = false;
1746 int err;
1747
1748 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1749 changed = true;
1750
1751 if (val) {
1752 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1753 } else {
1754 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1755 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1756 }
1757
1758 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1759 if (err < 0)
1760 return err;
1761
1762 if (changed) {
1763 hci_update_scan(hdev);
1764 hci_update_passive_scan(hdev);
1765 return new_settings(hdev, sk);
1766 }
1767
1768 return 0;
1769 }
1770
set_connectable_sync(struct hci_dev * hdev,void * data)1771 static int set_connectable_sync(struct hci_dev *hdev, void *data)
1772 {
1773 if (!mgmt_pending_listed(hdev, data))
1774 return -ECANCELED;
1775
1776 BT_DBG("%s", hdev->name);
1777
1778 return hci_update_connectable_sync(hdev);
1779 }
1780
set_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1781 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1782 u16 len)
1783 {
1784 struct mgmt_mode *cp = data;
1785 struct mgmt_pending_cmd *cmd;
1786 int err;
1787
1788 bt_dev_dbg(hdev, "sock %p", sk);
1789
1790 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1791 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1793 MGMT_STATUS_REJECTED);
1794
1795 if (cp->val != 0x00 && cp->val != 0x01)
1796 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1797 MGMT_STATUS_INVALID_PARAMS);
1798
1799 hci_dev_lock(hdev);
1800
1801 if (!hdev_is_powered(hdev)) {
1802 err = set_connectable_update_settings(hdev, sk, cp->val);
1803 goto failed;
1804 }
1805
1806 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1807 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1808 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1809 MGMT_STATUS_BUSY);
1810 goto failed;
1811 }
1812
1813 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1814 if (!cmd) {
1815 err = -ENOMEM;
1816 goto failed;
1817 }
1818
1819 if (cp->val) {
1820 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1821 } else {
1822 if (hdev->discov_timeout > 0)
1823 cancel_delayed_work(&hdev->discov_off);
1824
1825 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1826 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1827 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1828 }
1829
1830 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd,
1831 mgmt_set_connectable_complete);
1832
1833 if (err < 0)
1834 mgmt_pending_remove(cmd);
1835
1836 failed:
1837 hci_dev_unlock(hdev);
1838 return err;
1839 }
1840
set_bondable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1841 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1842 u16 len)
1843 {
1844 struct mgmt_mode *cp = data;
1845 bool changed;
1846 int err;
1847
1848 bt_dev_dbg(hdev, "sock %p", sk);
1849
1850 if (cp->val != 0x00 && cp->val != 0x01)
1851 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1852 MGMT_STATUS_INVALID_PARAMS);
1853
1854 hci_dev_lock(hdev);
1855
1856 if (cp->val)
1857 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1858 else
1859 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1860
1861 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1862 if (err < 0)
1863 goto unlock;
1864
1865 if (changed) {
1866 /* In limited privacy mode the change of bondable mode
1867 * may affect the local advertising address.
1868 */
1869 hci_update_discoverable(hdev);
1870
1871 err = new_settings(hdev, sk);
1872 }
1873
1874 unlock:
1875 hci_dev_unlock(hdev);
1876 return err;
1877 }
1878
set_link_security(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1879 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1880 u16 len)
1881 {
1882 struct mgmt_mode *cp = data;
1883 struct mgmt_pending_cmd *cmd;
1884 u8 val, status;
1885 int err;
1886
1887 bt_dev_dbg(hdev, "sock %p", sk);
1888
1889 status = mgmt_bredr_support(hdev);
1890 if (status)
1891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1892 status);
1893
1894 if (cp->val != 0x00 && cp->val != 0x01)
1895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1896 MGMT_STATUS_INVALID_PARAMS);
1897
1898 hci_dev_lock(hdev);
1899
1900 if (!hdev_is_powered(hdev)) {
1901 bool changed = false;
1902
1903 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1904 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1905 changed = true;
1906 }
1907
1908 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1909 if (err < 0)
1910 goto failed;
1911
1912 if (changed)
1913 err = new_settings(hdev, sk);
1914
1915 goto failed;
1916 }
1917
1918 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1919 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1920 MGMT_STATUS_BUSY);
1921 goto failed;
1922 }
1923
1924 val = !!cp->val;
1925
1926 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1927 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1928 goto failed;
1929 }
1930
1931 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1932 if (!cmd) {
1933 err = -ENOMEM;
1934 goto failed;
1935 }
1936
1937 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1938 if (err < 0) {
1939 mgmt_pending_remove(cmd);
1940 goto failed;
1941 }
1942
1943 failed:
1944 hci_dev_unlock(hdev);
1945 return err;
1946 }
1947
set_ssp_complete(struct hci_dev * hdev,void * data,int err)1948 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
1949 {
1950 struct cmd_lookup match = { NULL, hdev };
1951 struct mgmt_pending_cmd *cmd = data;
1952 struct mgmt_mode *cp;
1953 u8 enable;
1954 bool changed;
1955
1956 /* Make sure cmd still outstanding. */
1957 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
1958 return;
1959
1960 cp = cmd->param;
1961 enable = cp->val;
1962
1963 if (err) {
1964 u8 mgmt_err = mgmt_status(err);
1965
1966 if (enable && hci_dev_test_and_clear_flag(hdev,
1967 HCI_SSP_ENABLED)) {
1968 new_settings(hdev, NULL);
1969 }
1970
1971 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1972 mgmt_pending_free(cmd);
1973 return;
1974 }
1975
1976 if (enable) {
1977 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
1978 } else {
1979 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
1980 }
1981
1982 settings_rsp(cmd, &match);
1983
1984 if (changed)
1985 new_settings(hdev, match.sk);
1986
1987 if (match.sk)
1988 sock_put(match.sk);
1989
1990 hci_update_eir_sync(hdev);
1991 mgmt_pending_free(cmd);
1992 }
1993
set_ssp_sync(struct hci_dev * hdev,void * data)1994 static int set_ssp_sync(struct hci_dev *hdev, void *data)
1995 {
1996 struct mgmt_pending_cmd *cmd = data;
1997 struct mgmt_mode cp;
1998 bool changed = false;
1999 int err;
2000
2001 mutex_lock(&hdev->mgmt_pending_lock);
2002
2003 if (!__mgmt_pending_listed(hdev, cmd)) {
2004 mutex_unlock(&hdev->mgmt_pending_lock);
2005 return -ECANCELED;
2006 }
2007
2008 memcpy(&cp, cmd->param, sizeof(cp));
2009
2010 mutex_unlock(&hdev->mgmt_pending_lock);
2011
2012 if (cp.val)
2013 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
2014
2015 err = hci_write_ssp_mode_sync(hdev, cp.val);
2016
2017 if (!err && changed)
2018 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
2019
2020 return err;
2021 }
2022
set_ssp(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2023 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2024 {
2025 struct mgmt_mode *cp = data;
2026 struct mgmt_pending_cmd *cmd;
2027 u8 status;
2028 int err;
2029
2030 bt_dev_dbg(hdev, "sock %p", sk);
2031
2032 status = mgmt_bredr_support(hdev);
2033 if (status)
2034 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2035
2036 if (!lmp_ssp_capable(hdev))
2037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2038 MGMT_STATUS_NOT_SUPPORTED);
2039
2040 if (cp->val != 0x00 && cp->val != 0x01)
2041 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2042 MGMT_STATUS_INVALID_PARAMS);
2043
2044 hci_dev_lock(hdev);
2045
2046 if (!hdev_is_powered(hdev)) {
2047 bool changed;
2048
2049 if (cp->val) {
2050 changed = !hci_dev_test_and_set_flag(hdev,
2051 HCI_SSP_ENABLED);
2052 } else {
2053 changed = hci_dev_test_and_clear_flag(hdev,
2054 HCI_SSP_ENABLED);
2055 }
2056
2057 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2058 if (err < 0)
2059 goto failed;
2060
2061 if (changed)
2062 err = new_settings(hdev, sk);
2063
2064 goto failed;
2065 }
2066
2067 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
2068 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2069 MGMT_STATUS_BUSY);
2070 goto failed;
2071 }
2072
2073 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2074 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2075 goto failed;
2076 }
2077
2078 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2079 if (!cmd)
2080 err = -ENOMEM;
2081 else
2082 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd,
2083 set_ssp_complete);
2084
2085 if (err < 0) {
2086 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2087 MGMT_STATUS_FAILED);
2088
2089 if (cmd)
2090 mgmt_pending_remove(cmd);
2091 }
2092
2093 failed:
2094 hci_dev_unlock(hdev);
2095 return err;
2096 }
2097
set_hs(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2098 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2099 {
2100 bt_dev_dbg(hdev, "sock %p", sk);
2101
2102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2103 MGMT_STATUS_NOT_SUPPORTED);
2104 }
2105
set_le_complete(struct hci_dev * hdev,void * data,int err)2106 static void set_le_complete(struct hci_dev *hdev, void *data, int err)
2107 {
2108 struct mgmt_pending_cmd *cmd = data;
2109 struct cmd_lookup match = { NULL, hdev };
2110 u8 status = mgmt_status(err);
2111
2112 bt_dev_dbg(hdev, "err %d", err);
2113
2114 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
2115 return;
2116
2117 if (status) {
2118 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
2119 goto done;
2120 }
2121
2122 settings_rsp(cmd, &match);
2123
2124 new_settings(hdev, match.sk);
2125
2126 if (match.sk)
2127 sock_put(match.sk);
2128
2129 done:
2130 mgmt_pending_free(cmd);
2131 }
2132
set_le_sync(struct hci_dev * hdev,void * data)2133 static int set_le_sync(struct hci_dev *hdev, void *data)
2134 {
2135 struct mgmt_pending_cmd *cmd = data;
2136 struct mgmt_mode cp;
2137 u8 val;
2138 int err;
2139
2140 mutex_lock(&hdev->mgmt_pending_lock);
2141
2142 if (!__mgmt_pending_listed(hdev, cmd)) {
2143 mutex_unlock(&hdev->mgmt_pending_lock);
2144 return -ECANCELED;
2145 }
2146
2147 memcpy(&cp, cmd->param, sizeof(cp));
2148 val = !!cp.val;
2149
2150 mutex_unlock(&hdev->mgmt_pending_lock);
2151
2152 if (!val) {
2153 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
2154
2155 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2156 hci_disable_advertising_sync(hdev);
2157
2158 if (ext_adv_capable(hdev))
2159 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk);
2160 } else {
2161 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2162 }
2163
2164 err = hci_write_le_host_supported_sync(hdev, val, 0);
2165
2166 /* Make sure the controller has a good default for
2167 * advertising data. Restrict the update to when LE
2168 * has actually been enabled. During power on, the
2169 * update in powered_update_hci will take care of it.
2170 */
2171 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2172 if (ext_adv_capable(hdev)) {
2173 int status;
2174
2175 status = hci_setup_ext_adv_instance_sync(hdev, 0x00);
2176 if (!status)
2177 hci_update_scan_rsp_data_sync(hdev, 0x00);
2178 } else {
2179 hci_update_adv_data_sync(hdev, 0x00);
2180 hci_update_scan_rsp_data_sync(hdev, 0x00);
2181 }
2182
2183 hci_update_passive_scan(hdev);
2184 }
2185
2186 return err;
2187 }
2188
set_mesh_complete(struct hci_dev * hdev,void * data,int err)2189 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
2190 {
2191 struct mgmt_pending_cmd *cmd = data;
2192 u8 status = mgmt_status(err);
2193 struct sock *sk;
2194
2195 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
2196 return;
2197
2198 sk = cmd->sk;
2199
2200 if (status) {
2201 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status);
2202 goto done;
2203 }
2204
2205 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0);
2206
2207 done:
2208 mgmt_pending_free(cmd);
2209 }
2210
set_mesh_sync(struct hci_dev * hdev,void * data)2211 static int set_mesh_sync(struct hci_dev *hdev, void *data)
2212 {
2213 struct mgmt_pending_cmd *cmd = data;
2214 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types,
2215 sizeof(hdev->mesh_ad_types));
2216 size_t len;
2217
2218 mutex_lock(&hdev->mgmt_pending_lock);
2219
2220 if (!__mgmt_pending_listed(hdev, cmd)) {
2221 mutex_unlock(&hdev->mgmt_pending_lock);
2222 return -ECANCELED;
2223 }
2224
2225 len = cmd->param_len;
2226 memcpy(cp, cmd->param, min(__struct_size(cp), len));
2227
2228 mutex_unlock(&hdev->mgmt_pending_lock);
2229
2230 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
2231
2232 if (cp->enable)
2233 hci_dev_set_flag(hdev, HCI_MESH);
2234 else
2235 hci_dev_clear_flag(hdev, HCI_MESH);
2236
2237 hdev->le_scan_interval = __le16_to_cpu(cp->period);
2238 hdev->le_scan_window = __le16_to_cpu(cp->window);
2239
2240 len -= sizeof(struct mgmt_cp_set_mesh);
2241
2242 /* If filters don't fit, forward all adv pkts */
2243 if (len <= sizeof(hdev->mesh_ad_types))
2244 memcpy(hdev->mesh_ad_types, cp->ad_types, len);
2245
2246 hci_update_passive_scan_sync(hdev);
2247 return 0;
2248 }
2249
set_mesh(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2250 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2251 {
2252 struct mgmt_cp_set_mesh *cp = data;
2253 struct mgmt_pending_cmd *cmd;
2254 __u16 period, window;
2255 int err = 0;
2256
2257 bt_dev_dbg(hdev, "sock %p", sk);
2258
2259 if (!lmp_le_capable(hdev) ||
2260 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2262 MGMT_STATUS_NOT_SUPPORTED);
2263
2264 if (cp->enable != 0x00 && cp->enable != 0x01)
2265 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2266 MGMT_STATUS_INVALID_PARAMS);
2267
2268 /* Keep allowed ranges in sync with set_scan_params() */
2269 period = __le16_to_cpu(cp->period);
2270
2271 if (period < 0x0004 || period > 0x4000)
2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2273 MGMT_STATUS_INVALID_PARAMS);
2274
2275 window = __le16_to_cpu(cp->window);
2276
2277 if (window < 0x0004 || window > 0x4000)
2278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2279 MGMT_STATUS_INVALID_PARAMS);
2280
2281 if (window > period)
2282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2283 MGMT_STATUS_INVALID_PARAMS);
2284
2285 hci_dev_lock(hdev);
2286
2287 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len);
2288 if (!cmd)
2289 err = -ENOMEM;
2290 else
2291 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd,
2292 set_mesh_complete);
2293
2294 if (err < 0) {
2295 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER,
2296 MGMT_STATUS_FAILED);
2297
2298 if (cmd)
2299 mgmt_pending_remove(cmd);
2300 }
2301
2302 hci_dev_unlock(hdev);
2303 return err;
2304 }
2305
mesh_send_start_complete(struct hci_dev * hdev,void * data,int err)2306 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err)
2307 {
2308 struct mgmt_mesh_tx *mesh_tx = data;
2309 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2310 unsigned long mesh_send_interval;
2311 u8 mgmt_err = mgmt_status(err);
2312
2313 /* Report any errors here, but don't report completion */
2314
2315 if (mgmt_err) {
2316 hci_dev_clear_flag(hdev, HCI_MESH_SENDING);
2317 /* Send Complete Error Code for handle */
2318 mesh_send_complete(hdev, mesh_tx, false);
2319 return;
2320 }
2321
2322 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25);
2323 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done,
2324 mesh_send_interval);
2325 }
2326
mesh_send_sync(struct hci_dev * hdev,void * data)2327 static int mesh_send_sync(struct hci_dev *hdev, void *data)
2328 {
2329 struct mgmt_mesh_tx *mesh_tx = data;
2330 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param;
2331 struct adv_info *adv, *next_instance;
2332 u8 instance = hdev->le_num_of_adv_sets + 1;
2333 u16 timeout, duration;
2334 int err = 0;
2335
2336 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt)
2337 return MGMT_STATUS_BUSY;
2338
2339 timeout = 1000;
2340 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval);
2341 adv = hci_add_adv_instance(hdev, instance, 0,
2342 send->adv_data_len, send->adv_data,
2343 0, NULL,
2344 timeout, duration,
2345 HCI_ADV_TX_POWER_NO_PREFERENCE,
2346 hdev->le_adv_min_interval,
2347 hdev->le_adv_max_interval,
2348 mesh_tx->handle);
2349
2350 if (!IS_ERR(adv))
2351 mesh_tx->instance = instance;
2352 else
2353 err = PTR_ERR(adv);
2354
2355 if (hdev->cur_adv_instance == instance) {
2356 /* If the currently advertised instance is being changed then
2357 * cancel the current advertising and schedule the next
2358 * instance. If there is only one instance then the overridden
2359 * advertising data will be visible right away.
2360 */
2361 cancel_adv_timeout(hdev);
2362
2363 next_instance = hci_get_next_instance(hdev, instance);
2364 if (next_instance)
2365 instance = next_instance->instance;
2366 else
2367 instance = 0;
2368 } else if (hdev->adv_instance_timeout) {
2369 /* Immediately advertise the new instance if no other, or
2370 * let it go naturally from queue if ADV is already happening
2371 */
2372 instance = 0;
2373 }
2374
2375 if (instance)
2376 return hci_schedule_adv_instance_sync(hdev, instance, true);
2377
2378 return err;
2379 }
2380
send_count(struct mgmt_mesh_tx * mesh_tx,void * data)2381 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data)
2382 {
2383 struct mgmt_rp_mesh_read_features *rp = data;
2384
2385 if (rp->used_handles >= rp->max_handles)
2386 return;
2387
2388 rp->handles[rp->used_handles++] = mesh_tx->handle;
2389 }
2390
mesh_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2391 static int mesh_features(struct sock *sk, struct hci_dev *hdev,
2392 void *data, u16 len)
2393 {
2394 struct mgmt_rp_mesh_read_features rp;
2395
2396 if (!lmp_le_capable(hdev) ||
2397 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2398 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES,
2399 MGMT_STATUS_NOT_SUPPORTED);
2400
2401 memset(&rp, 0, sizeof(rp));
2402 rp.index = cpu_to_le16(hdev->id);
2403 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2404 rp.max_handles = MESH_HANDLES_MAX;
2405
2406 hci_dev_lock(hdev);
2407
2408 if (rp.max_handles)
2409 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2410
2411 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp,
2412 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX);
2413
2414 hci_dev_unlock(hdev);
2415 return 0;
2416 }
2417
send_cancel(struct hci_dev * hdev,void * data)2418 static int send_cancel(struct hci_dev *hdev, void *data)
2419 {
2420 struct mgmt_pending_cmd *cmd = data;
2421 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param;
2422 struct mgmt_mesh_tx *mesh_tx;
2423
2424 if (!cancel->handle) {
2425 do {
2426 mesh_tx = mgmt_mesh_next(hdev, cmd->sk);
2427
2428 if (mesh_tx)
2429 mesh_send_complete(hdev, mesh_tx, false);
2430 } while (mesh_tx);
2431 } else {
2432 mesh_tx = mgmt_mesh_find(hdev, cancel->handle);
2433
2434 if (mesh_tx && mesh_tx->sk == cmd->sk)
2435 mesh_send_complete(hdev, mesh_tx, false);
2436 }
2437
2438 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2439 0, NULL, 0);
2440
2441 return 0;
2442 }
2443
send_cancel_destroy(struct hci_dev * hdev,void * data,int err)2444 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err)
2445 {
2446 mgmt_pending_free(data);
2447 }
2448
mesh_send_cancel(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2449 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev,
2450 void *data, u16 len)
2451 {
2452 struct mgmt_pending_cmd *cmd;
2453 int err;
2454
2455 if (!lmp_le_capable(hdev) ||
2456 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2458 MGMT_STATUS_NOT_SUPPORTED);
2459
2460 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2462 MGMT_STATUS_REJECTED);
2463
2464 hci_dev_lock(hdev);
2465 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len);
2466 if (!cmd)
2467 err = -ENOMEM;
2468 else
2469 err = hci_cmd_sync_queue(hdev, send_cancel, cmd,
2470 send_cancel_destroy);
2471
2472 if (err < 0) {
2473 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL,
2474 MGMT_STATUS_FAILED);
2475
2476 if (cmd)
2477 mgmt_pending_free(cmd);
2478 }
2479
2480 hci_dev_unlock(hdev);
2481 return err;
2482 }
2483
mesh_send(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2484 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2485 {
2486 struct mgmt_mesh_tx *mesh_tx;
2487 struct mgmt_cp_mesh_send *send = data;
2488 struct mgmt_rp_mesh_read_features rp;
2489 u16 expected_len;
2490 bool sending;
2491 int err = 0;
2492
2493 if (!lmp_le_capable(hdev) ||
2494 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
2495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2496 MGMT_STATUS_NOT_SUPPORTED);
2497 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2498 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2499 MGMT_STATUS_REJECTED);
2500
2501 if (!send->adv_data_len || send->adv_data_len > 31)
2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2503 MGMT_STATUS_REJECTED);
2504
2505 expected_len = struct_size(send, adv_data, send->adv_data_len);
2506 if (expected_len != len)
2507 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2508 MGMT_STATUS_INVALID_PARAMS);
2509
2510 hci_dev_lock(hdev);
2511
2512 memset(&rp, 0, sizeof(rp));
2513 rp.max_handles = MESH_HANDLES_MAX;
2514
2515 mgmt_mesh_foreach(hdev, send_count, &rp, sk);
2516
2517 if (rp.max_handles <= rp.used_handles) {
2518 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2519 MGMT_STATUS_BUSY);
2520 goto done;
2521 }
2522
2523 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING);
2524 mesh_tx = mgmt_mesh_add(sk, hdev, send, len);
2525
2526 if (!mesh_tx)
2527 err = -ENOMEM;
2528 else if (!sending)
2529 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx,
2530 mesh_send_start_complete);
2531
2532 if (err < 0) {
2533 bt_dev_err(hdev, "Send Mesh Failed %d", err);
2534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND,
2535 MGMT_STATUS_FAILED);
2536
2537 if (mesh_tx) {
2538 if (sending)
2539 mgmt_mesh_remove(mesh_tx);
2540 }
2541 } else {
2542 hci_dev_set_flag(hdev, HCI_MESH_SENDING);
2543
2544 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0,
2545 &mesh_tx->handle, 1);
2546 }
2547
2548 done:
2549 hci_dev_unlock(hdev);
2550 return err;
2551 }
2552
set_le(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2553 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2554 {
2555 struct mgmt_mode *cp = data;
2556 struct mgmt_pending_cmd *cmd;
2557 int err;
2558 u8 val, enabled;
2559
2560 bt_dev_dbg(hdev, "sock %p", sk);
2561
2562 if (!lmp_le_capable(hdev))
2563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2564 MGMT_STATUS_NOT_SUPPORTED);
2565
2566 if (cp->val != 0x00 && cp->val != 0x01)
2567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2568 MGMT_STATUS_INVALID_PARAMS);
2569
2570 /* Bluetooth single mode LE only controllers or dual-mode
2571 * controllers configured as LE only devices, do not allow
2572 * switching LE off. These have either LE enabled explicitly
2573 * or BR/EDR has been previously switched off.
2574 *
2575 * When trying to enable an already enabled LE, then gracefully
2576 * send a positive response. Trying to disable it however will
2577 * result into rejection.
2578 */
2579 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2580 if (cp->val == 0x01)
2581 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2582
2583 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2584 MGMT_STATUS_REJECTED);
2585 }
2586
2587 hci_dev_lock(hdev);
2588
2589 val = !!cp->val;
2590 enabled = lmp_host_le_capable(hdev);
2591
2592 if (!hdev_is_powered(hdev) || val == enabled) {
2593 bool changed = false;
2594
2595 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2596 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
2597 changed = true;
2598 }
2599
2600 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2601 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2602 changed = true;
2603 }
2604
2605 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2606 if (err < 0)
2607 goto unlock;
2608
2609 if (changed)
2610 err = new_settings(hdev, sk);
2611
2612 goto unlock;
2613 }
2614
2615 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2616 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2618 MGMT_STATUS_BUSY);
2619 goto unlock;
2620 }
2621
2622 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2623 if (!cmd)
2624 err = -ENOMEM;
2625 else
2626 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd,
2627 set_le_complete);
2628
2629 if (err < 0) {
2630 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2631 MGMT_STATUS_FAILED);
2632
2633 if (cmd)
2634 mgmt_pending_remove(cmd);
2635 }
2636
2637 unlock:
2638 hci_dev_unlock(hdev);
2639 return err;
2640 }
2641
send_hci_cmd_sync(struct hci_dev * hdev,void * data)2642 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data)
2643 {
2644 struct mgmt_pending_cmd *cmd = data;
2645 struct mgmt_cp_hci_cmd_sync *cp = cmd->param;
2646 struct sk_buff *skb;
2647
2648 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode),
2649 le16_to_cpu(cp->params_len), cp->params,
2650 cp->event, cp->timeout ?
2651 secs_to_jiffies(cp->timeout) :
2652 HCI_CMD_TIMEOUT);
2653 if (IS_ERR(skb)) {
2654 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2655 mgmt_status(PTR_ERR(skb)));
2656 return 0;
2657 }
2658
2659 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0,
2660 skb->data, skb->len);
2661
2662 kfree_skb(skb);
2663
2664 return 0;
2665 }
2666
send_hci_cmd_sync_destroy(struct hci_dev * hdev,void * data,int err)2667 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err)
2668 {
2669 mgmt_pending_free(data);
2670 }
2671
mgmt_hci_cmd_sync(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2672 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev,
2673 void *data, u16 len)
2674 {
2675 struct mgmt_cp_hci_cmd_sync *cp = data;
2676 struct mgmt_pending_cmd *cmd;
2677 int err;
2678
2679 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) +
2680 le16_to_cpu(cp->params_len)))
2681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2682 MGMT_STATUS_INVALID_PARAMS);
2683
2684 /* The HCI command header carries the parameter length in a u8, a
2685 * larger value would be truncated there while the parameters are
2686 * still appended to the frame in full.
2687 */
2688 if (le16_to_cpu(cp->params_len) > U8_MAX)
2689 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2690 MGMT_STATUS_INVALID_PARAMS);
2691
2692 hci_dev_lock(hdev);
2693 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len);
2694 if (!cmd)
2695 err = -ENOMEM;
2696 else
2697 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd,
2698 send_hci_cmd_sync_destroy);
2699
2700 if (err < 0) {
2701 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC,
2702 MGMT_STATUS_FAILED);
2703
2704 if (cmd)
2705 mgmt_pending_free(cmd);
2706 }
2707
2708 hci_dev_unlock(hdev);
2709 return err;
2710 }
2711
2712 /* This is a helper function to test for pending mgmt commands that can
2713 * cause CoD or EIR HCI commands. We can only allow one such pending
2714 * mgmt command at a time since otherwise we cannot easily track what
2715 * the current values are, will be, and based on that calculate if a new
2716 * HCI command needs to be sent and if yes with what value.
2717 */
pending_eir_or_class(struct hci_dev * hdev)2718 static bool pending_eir_or_class(struct hci_dev *hdev)
2719 {
2720 struct mgmt_pending_cmd *cmd;
2721 bool pending = false;
2722
2723 mutex_lock(&hdev->mgmt_pending_lock);
2724
2725 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2726 switch (cmd->opcode) {
2727 case MGMT_OP_ADD_UUID:
2728 case MGMT_OP_REMOVE_UUID:
2729 case MGMT_OP_SET_DEV_CLASS:
2730 case MGMT_OP_SET_LOCAL_NAME:
2731 case MGMT_OP_SET_POWERED:
2732 pending = true;
2733 break;
2734 }
2735
2736 if (pending)
2737 break;
2738 }
2739
2740 mutex_unlock(&hdev->mgmt_pending_lock);
2741
2742 return pending;
2743 }
2744
2745 static const u8 bluetooth_base_uuid[] = {
2746 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2747 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2748 };
2749
get_uuid_size(const u8 * uuid)2750 static u8 get_uuid_size(const u8 *uuid)
2751 {
2752 u32 val;
2753
2754 if (memcmp(uuid, bluetooth_base_uuid, 12))
2755 return 128;
2756
2757 val = get_unaligned_le32(&uuid[12]);
2758 if (val > 0xffff)
2759 return 32;
2760
2761 return 16;
2762 }
2763
mgmt_class_complete(struct hci_dev * hdev,void * data,int err)2764 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err)
2765 {
2766 struct mgmt_pending_cmd *cmd = data;
2767
2768 bt_dev_dbg(hdev, "err %d", err);
2769
2770 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
2771 mgmt_status(err), hdev->dev_class, 3);
2772
2773 mgmt_pending_free(cmd);
2774 }
2775
add_uuid_sync(struct hci_dev * hdev,void * data)2776 static int add_uuid_sync(struct hci_dev *hdev, void *data)
2777 {
2778 int err;
2779
2780 err = hci_update_class_sync(hdev);
2781 if (err)
2782 return err;
2783
2784 return hci_update_eir_sync(hdev);
2785 }
2786
add_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2787 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2788 {
2789 struct mgmt_cp_add_uuid *cp = data;
2790 struct mgmt_pending_cmd *cmd;
2791 struct bt_uuid *uuid;
2792 int err;
2793
2794 bt_dev_dbg(hdev, "sock %p", sk);
2795
2796 hci_dev_lock(hdev);
2797
2798 if (pending_eir_or_class(hdev)) {
2799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2800 MGMT_STATUS_BUSY);
2801 goto failed;
2802 }
2803
2804 uuid = kmalloc_obj(*uuid);
2805 if (!uuid) {
2806 err = -ENOMEM;
2807 goto failed;
2808 }
2809
2810 memcpy(uuid->uuid, cp->uuid, 16);
2811 uuid->svc_hint = cp->svc_hint;
2812 uuid->size = get_uuid_size(cp->uuid);
2813
2814 list_add_tail(&uuid->list, &hdev->uuids);
2815
2816 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2817 if (!cmd) {
2818 err = -ENOMEM;
2819 goto failed;
2820 }
2821
2822 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use
2823 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2824 */
2825 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd,
2826 mgmt_class_complete);
2827 if (err < 0) {
2828 mgmt_pending_free(cmd);
2829 goto failed;
2830 }
2831
2832 failed:
2833 hci_dev_unlock(hdev);
2834 return err;
2835 }
2836
enable_service_cache(struct hci_dev * hdev)2837 static bool enable_service_cache(struct hci_dev *hdev)
2838 {
2839 if (!hdev_is_powered(hdev))
2840 return false;
2841
2842 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2843 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2844 CACHE_TIMEOUT);
2845 return true;
2846 }
2847
2848 return false;
2849 }
2850
remove_uuid_sync(struct hci_dev * hdev,void * data)2851 static int remove_uuid_sync(struct hci_dev *hdev, void *data)
2852 {
2853 int err;
2854
2855 err = hci_update_class_sync(hdev);
2856 if (err)
2857 return err;
2858
2859 return hci_update_eir_sync(hdev);
2860 }
2861
remove_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2862 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2863 u16 len)
2864 {
2865 struct mgmt_cp_remove_uuid *cp = data;
2866 struct mgmt_pending_cmd *cmd;
2867 struct bt_uuid *match, *tmp;
2868 static const u8 bt_uuid_any[] = {
2869 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
2870 };
2871 int err, found;
2872
2873 bt_dev_dbg(hdev, "sock %p", sk);
2874
2875 hci_dev_lock(hdev);
2876
2877 if (pending_eir_or_class(hdev)) {
2878 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2879 MGMT_STATUS_BUSY);
2880 goto unlock;
2881 }
2882
2883 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2884 hci_uuids_clear(hdev);
2885
2886 if (enable_service_cache(hdev)) {
2887 err = mgmt_cmd_complete(sk, hdev->id,
2888 MGMT_OP_REMOVE_UUID,
2889 0, hdev->dev_class, 3);
2890 goto unlock;
2891 }
2892
2893 goto update_class;
2894 }
2895
2896 found = 0;
2897
2898 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2899 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2900 continue;
2901
2902 list_del(&match->list);
2903 kfree(match);
2904 found++;
2905 }
2906
2907 if (found == 0) {
2908 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2909 MGMT_STATUS_INVALID_PARAMS);
2910 goto unlock;
2911 }
2912
2913 update_class:
2914 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2915 if (!cmd) {
2916 err = -ENOMEM;
2917 goto unlock;
2918 }
2919
2920 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use
2921 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2922 */
2923 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd,
2924 mgmt_class_complete);
2925 if (err < 0)
2926 mgmt_pending_free(cmd);
2927
2928 unlock:
2929 hci_dev_unlock(hdev);
2930 return err;
2931 }
2932
set_class_sync(struct hci_dev * hdev,void * data)2933 static int set_class_sync(struct hci_dev *hdev, void *data)
2934 {
2935 int err = 0;
2936
2937 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2938 cancel_delayed_work_sync(&hdev->service_cache);
2939 err = hci_update_eir_sync(hdev);
2940 }
2941
2942 if (err)
2943 return err;
2944
2945 return hci_update_class_sync(hdev);
2946 }
2947
set_dev_class(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2948 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2949 u16 len)
2950 {
2951 struct mgmt_cp_set_dev_class *cp = data;
2952 struct mgmt_pending_cmd *cmd;
2953 int err;
2954
2955 bt_dev_dbg(hdev, "sock %p", sk);
2956
2957 if (!lmp_bredr_capable(hdev))
2958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2959 MGMT_STATUS_NOT_SUPPORTED);
2960
2961 hci_dev_lock(hdev);
2962
2963 if (pending_eir_or_class(hdev)) {
2964 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2965 MGMT_STATUS_BUSY);
2966 goto unlock;
2967 }
2968
2969 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2970 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2971 MGMT_STATUS_INVALID_PARAMS);
2972 goto unlock;
2973 }
2974
2975 hdev->major_class = cp->major;
2976 hdev->minor_class = cp->minor;
2977
2978 if (!hdev_is_powered(hdev)) {
2979 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2980 hdev->dev_class, 3);
2981 goto unlock;
2982 }
2983
2984 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2985 if (!cmd) {
2986 err = -ENOMEM;
2987 goto unlock;
2988 }
2989
2990 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use
2991 * hci_cmd_sync_submit instead of hci_cmd_sync_queue.
2992 */
2993 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd,
2994 mgmt_class_complete);
2995 if (err < 0)
2996 mgmt_pending_free(cmd);
2997
2998 unlock:
2999 hci_dev_unlock(hdev);
3000 return err;
3001 }
3002
load_link_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3003 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3004 u16 len)
3005 {
3006 struct mgmt_cp_load_link_keys *cp = data;
3007 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
3008 sizeof(struct mgmt_link_key_info));
3009 u16 key_count, expected_len;
3010 bool changed;
3011 int i;
3012
3013 bt_dev_dbg(hdev, "sock %p", sk);
3014
3015 if (!lmp_bredr_capable(hdev))
3016 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3017 MGMT_STATUS_NOT_SUPPORTED);
3018
3019 key_count = __le16_to_cpu(cp->key_count);
3020 if (key_count > max_key_count) {
3021 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
3022 key_count);
3023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3024 MGMT_STATUS_INVALID_PARAMS);
3025 }
3026
3027 expected_len = struct_size(cp, keys, key_count);
3028 if (expected_len != len) {
3029 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
3030 expected_len, len);
3031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3032 MGMT_STATUS_INVALID_PARAMS);
3033 }
3034
3035 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
3036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
3037 MGMT_STATUS_INVALID_PARAMS);
3038
3039 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
3040 key_count);
3041
3042 hci_dev_lock(hdev);
3043
3044 hci_link_keys_clear(hdev);
3045
3046 if (cp->debug_keys)
3047 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
3048 else
3049 changed = hci_dev_test_and_clear_flag(hdev,
3050 HCI_KEEP_DEBUG_KEYS);
3051
3052 if (changed)
3053 new_settings(hdev, NULL);
3054
3055 for (i = 0; i < key_count; i++) {
3056 struct mgmt_link_key_info *key = &cp->keys[i];
3057
3058 if (hci_is_blocked_key(hdev,
3059 HCI_BLOCKED_KEY_TYPE_LINKKEY,
3060 key->val)) {
3061 bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
3062 &key->addr.bdaddr);
3063 continue;
3064 }
3065
3066 if (key->addr.type != BDADDR_BREDR) {
3067 bt_dev_warn(hdev,
3068 "Invalid link address type %u for %pMR",
3069 key->addr.type, &key->addr.bdaddr);
3070 continue;
3071 }
3072
3073 if (key->type > 0x08) {
3074 bt_dev_warn(hdev, "Invalid link key type %u for %pMR",
3075 key->type, &key->addr.bdaddr);
3076 continue;
3077 }
3078
3079 /* Always ignore debug keys and require a new pairing if
3080 * the user wants to use them.
3081 */
3082 if (key->type == HCI_LK_DEBUG_COMBINATION)
3083 continue;
3084
3085 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3086 key->type, key->pin_len, NULL);
3087 }
3088
3089 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
3090
3091 hci_dev_unlock(hdev);
3092
3093 return 0;
3094 }
3095
device_unpaired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,struct sock * skip_sk)3096 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
3097 u8 addr_type, struct sock *skip_sk)
3098 {
3099 struct mgmt_ev_device_unpaired ev;
3100
3101 bacpy(&ev.addr.bdaddr, bdaddr);
3102 ev.addr.type = addr_type;
3103
3104 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
3105 skip_sk);
3106 }
3107
unpair_device_complete(struct hci_dev * hdev,void * data,int err)3108 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err)
3109 {
3110 struct mgmt_pending_cmd *cmd = data;
3111 struct mgmt_cp_unpair_device *cp = cmd->param;
3112
3113 if (!err)
3114 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3115
3116 cmd->cmd_complete(cmd, err);
3117 mgmt_pending_free(cmd);
3118 }
3119
unpair_device_sync(struct hci_dev * hdev,void * data)3120 static int unpair_device_sync(struct hci_dev *hdev, void *data)
3121 {
3122 struct mgmt_pending_cmd *cmd = data;
3123 struct mgmt_cp_unpair_device *cp = cmd->param;
3124 struct hci_conn *conn;
3125
3126 hci_dev_lock(hdev);
3127
3128 if (cp->addr.type == BDADDR_BREDR)
3129 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3130 &cp->addr.bdaddr);
3131 else
3132 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3133 le_addr_type(cp->addr.type));
3134
3135 if (conn)
3136 hci_conn_get(conn);
3137
3138 hci_dev_unlock(hdev);
3139
3140 if (!conn)
3141 return 0;
3142
3143 /* Disregard any possible error since the likes of hci_abort_conn_sync
3144 * will clean up the connection no matter the error.
3145 */
3146 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3147 hci_conn_put(conn);
3148
3149 return 0;
3150 }
3151
unpair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3152 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3153 u16 len)
3154 {
3155 struct mgmt_cp_unpair_device *cp = data;
3156 struct mgmt_rp_unpair_device rp;
3157 struct hci_conn_params *params;
3158 struct mgmt_pending_cmd *cmd;
3159 struct hci_conn *conn;
3160 u8 addr_type;
3161 int err;
3162
3163 memset(&rp, 0, sizeof(rp));
3164 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3165 rp.addr.type = cp->addr.type;
3166
3167 if (!bdaddr_type_is_valid(cp->addr.type))
3168 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3169 MGMT_STATUS_INVALID_PARAMS,
3170 &rp, sizeof(rp));
3171
3172 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
3173 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3174 MGMT_STATUS_INVALID_PARAMS,
3175 &rp, sizeof(rp));
3176
3177 hci_dev_lock(hdev);
3178
3179 if (!hdev_is_powered(hdev)) {
3180 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3181 MGMT_STATUS_NOT_POWERED, &rp,
3182 sizeof(rp));
3183 goto unlock;
3184 }
3185
3186 if (cp->addr.type == BDADDR_BREDR) {
3187 /* If disconnection is requested, then look up the
3188 * connection. If the remote device is connected, it
3189 * will be later used to terminate the link.
3190 *
3191 * Setting it to NULL explicitly will cause no
3192 * termination of the link.
3193 */
3194 if (cp->disconnect)
3195 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3196 &cp->addr.bdaddr);
3197 else
3198 conn = NULL;
3199
3200 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
3201 if (err < 0) {
3202 err = mgmt_cmd_complete(sk, hdev->id,
3203 MGMT_OP_UNPAIR_DEVICE,
3204 MGMT_STATUS_NOT_PAIRED, &rp,
3205 sizeof(rp));
3206 goto unlock;
3207 }
3208
3209 goto done;
3210 }
3211
3212 /* LE address type */
3213 addr_type = le_addr_type(cp->addr.type);
3214
3215 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
3216 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
3217 if (err < 0) {
3218 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3219 MGMT_STATUS_NOT_PAIRED, &rp,
3220 sizeof(rp));
3221 goto unlock;
3222 }
3223
3224 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
3225 if (!conn) {
3226 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
3227 goto done;
3228 }
3229
3230
3231 /* Defer clearing up the connection parameters until closing to
3232 * give a chance of keeping them if a repairing happens.
3233 */
3234 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3235
3236 /* Disable auto-connection parameters if present */
3237 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
3238 if (params) {
3239 if (params->explicit_connect)
3240 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3241 else
3242 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3243 }
3244
3245 /* If disconnection is not requested, then clear the connection
3246 * variable so that the link is not terminated.
3247 */
3248 if (!cp->disconnect)
3249 conn = NULL;
3250
3251 done:
3252 /* If the connection variable is set, then termination of the
3253 * link is requested.
3254 */
3255 if (!conn) {
3256 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3257 &rp, sizeof(rp));
3258 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
3259 goto unlock;
3260 }
3261
3262 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
3263 sizeof(*cp));
3264 if (!cmd) {
3265 err = -ENOMEM;
3266 goto unlock;
3267 }
3268
3269 cmd->cmd_complete = addr_cmd_complete;
3270
3271 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd,
3272 unpair_device_complete);
3273 if (err < 0)
3274 mgmt_pending_free(cmd);
3275
3276 unlock:
3277 hci_dev_unlock(hdev);
3278 return err;
3279 }
3280
disconnect_complete(struct hci_dev * hdev,void * data,int err)3281 static void disconnect_complete(struct hci_dev *hdev, void *data, int err)
3282 {
3283 struct mgmt_pending_cmd *cmd = data;
3284
3285 cmd->cmd_complete(cmd, mgmt_status(err));
3286 mgmt_pending_free(cmd);
3287 }
3288
disconnect_sync(struct hci_dev * hdev,void * data)3289 static int disconnect_sync(struct hci_dev *hdev, void *data)
3290 {
3291 struct mgmt_pending_cmd *cmd = data;
3292 struct mgmt_cp_disconnect *cp = cmd->param;
3293 struct hci_conn *conn;
3294
3295 hci_dev_lock(hdev);
3296
3297 if (cp->addr.type == BDADDR_BREDR)
3298 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3299 &cp->addr.bdaddr);
3300 else
3301 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3302 le_addr_type(cp->addr.type));
3303
3304 if (conn)
3305 hci_conn_get(conn);
3306
3307 hci_dev_unlock(hdev);
3308
3309 if (!conn)
3310 return -ENOTCONN;
3311
3312 /* Disregard any possible error since the likes of hci_abort_conn_sync
3313 * will clean up the connection no matter the error.
3314 */
3315 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3316 hci_conn_put(conn);
3317
3318 return 0;
3319 }
3320
disconnect(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3321 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
3322 u16 len)
3323 {
3324 struct mgmt_cp_disconnect *cp = data;
3325 struct mgmt_rp_disconnect rp;
3326 struct mgmt_pending_cmd *cmd;
3327 int err;
3328
3329 bt_dev_dbg(hdev, "sock %p", sk);
3330
3331 memset(&rp, 0, sizeof(rp));
3332 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3333 rp.addr.type = cp->addr.type;
3334
3335 if (!bdaddr_type_is_valid(cp->addr.type))
3336 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3337 MGMT_STATUS_INVALID_PARAMS,
3338 &rp, sizeof(rp));
3339
3340 hci_dev_lock(hdev);
3341
3342 if (!test_bit(HCI_UP, &hdev->flags)) {
3343 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3344 MGMT_STATUS_NOT_POWERED, &rp,
3345 sizeof(rp));
3346 goto failed;
3347 }
3348
3349 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len);
3350 if (!cmd) {
3351 err = -ENOMEM;
3352 goto failed;
3353 }
3354
3355 cmd->cmd_complete = generic_cmd_complete;
3356
3357 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd,
3358 disconnect_complete);
3359 if (err < 0)
3360 mgmt_pending_free(cmd);
3361
3362 failed:
3363 hci_dev_unlock(hdev);
3364 return err;
3365 }
3366
link_to_bdaddr(u8 link_type,u8 addr_type)3367 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
3368 {
3369 switch (link_type) {
3370 case CIS_LINK:
3371 case BIS_LINK:
3372 case PA_LINK:
3373 case LE_LINK:
3374 switch (addr_type) {
3375 case ADDR_LE_DEV_PUBLIC:
3376 return BDADDR_LE_PUBLIC;
3377
3378 default:
3379 /* Fallback to LE Random address type */
3380 return BDADDR_LE_RANDOM;
3381 }
3382
3383 default:
3384 /* Fallback to BR/EDR type */
3385 return BDADDR_BREDR;
3386 }
3387 }
3388
get_connections(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)3389 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3390 u16 data_len)
3391 {
3392 struct mgmt_rp_get_connections *rp;
3393 struct hci_conn *c;
3394 int err;
3395 u16 i;
3396
3397 bt_dev_dbg(hdev, "sock %p", sk);
3398
3399 hci_dev_lock(hdev);
3400
3401 if (!hdev_is_powered(hdev)) {
3402 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3403 MGMT_STATUS_NOT_POWERED);
3404 goto unlock;
3405 }
3406
3407 i = 0;
3408 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3409 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3410 i++;
3411 }
3412
3413 rp = kmalloc_flex(*rp, addr, i);
3414 if (!rp) {
3415 err = -ENOMEM;
3416 goto unlock;
3417 }
3418
3419 i = 0;
3420 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3421 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3422 continue;
3423 bacpy(&rp->addr[i].bdaddr, &c->dst);
3424 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
3425 if (c->type == SCO_LINK || c->type == ESCO_LINK)
3426 continue;
3427 i++;
3428 }
3429
3430 rp->conn_count = cpu_to_le16(i);
3431
3432 /* Recalculate length in case of filtered SCO connections, etc */
3433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3434 struct_size(rp, addr, i));
3435
3436 kfree(rp);
3437
3438 unlock:
3439 hci_dev_unlock(hdev);
3440 return err;
3441 }
3442
send_pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_pin_code_neg_reply * cp)3443 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3444 struct mgmt_cp_pin_code_neg_reply *cp)
3445 {
3446 struct mgmt_pending_cmd *cmd;
3447 int err;
3448
3449 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
3450 sizeof(*cp));
3451 if (!cmd)
3452 return -ENOMEM;
3453
3454 cmd->cmd_complete = addr_cmd_complete;
3455
3456 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3457 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
3458 if (err < 0)
3459 mgmt_pending_remove(cmd);
3460
3461 return err;
3462 }
3463
pin_code_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3464 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3465 u16 len)
3466 {
3467 struct hci_conn *conn;
3468 struct mgmt_cp_pin_code_reply *cp = data;
3469 struct hci_cp_pin_code_reply reply;
3470 struct mgmt_pending_cmd *cmd;
3471 int err;
3472
3473 bt_dev_dbg(hdev, "sock %p", sk);
3474
3475 hci_dev_lock(hdev);
3476
3477 if (!hdev_is_powered(hdev)) {
3478 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3479 MGMT_STATUS_NOT_POWERED);
3480 goto failed;
3481 }
3482
3483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3484 if (!conn) {
3485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3486 MGMT_STATUS_NOT_CONNECTED);
3487 goto failed;
3488 }
3489
3490 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3491 struct mgmt_cp_pin_code_neg_reply ncp;
3492
3493 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3494
3495 bt_dev_err(hdev, "PIN code is not 16 bytes long");
3496
3497 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3498 if (err >= 0)
3499 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3500 MGMT_STATUS_INVALID_PARAMS);
3501
3502 goto failed;
3503 }
3504
3505 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3506 if (!cmd) {
3507 err = -ENOMEM;
3508 goto failed;
3509 }
3510
3511 cmd->cmd_complete = addr_cmd_complete;
3512
3513 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3514 reply.pin_len = cp->pin_len;
3515 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3516
3517 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3518 if (err < 0)
3519 mgmt_pending_remove(cmd);
3520
3521 failed:
3522 hci_dev_unlock(hdev);
3523 return err;
3524 }
3525
set_io_capability(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3526 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3527 u16 len)
3528 {
3529 struct mgmt_cp_set_io_capability *cp = data;
3530
3531 bt_dev_dbg(hdev, "sock %p", sk);
3532
3533 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3535 MGMT_STATUS_INVALID_PARAMS);
3536
3537 hci_dev_lock(hdev);
3538
3539 hdev->io_capability = cp->io_capability;
3540
3541 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
3542
3543 hci_dev_unlock(hdev);
3544
3545 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3546 NULL, 0);
3547 }
3548
remove_pairing(struct hci_conn * conn)3549 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn)
3550 {
3551 struct hci_dev *hdev = conn->hdev;
3552 struct mgmt_pending_cmd *cmd;
3553
3554 mutex_lock(&hdev->mgmt_pending_lock);
3555
3556 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3557 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3558 continue;
3559
3560 if (cmd->user_data != conn)
3561 continue;
3562
3563 list_del(&cmd->list);
3564 mutex_unlock(&hdev->mgmt_pending_lock);
3565 return cmd;
3566 }
3567
3568 mutex_unlock(&hdev->mgmt_pending_lock);
3569
3570 return NULL;
3571 }
3572
remove_pairing_by_addr(struct hci_dev * hdev,bdaddr_t * bdaddr)3573 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev,
3574 bdaddr_t *bdaddr)
3575 {
3576 struct mgmt_pending_cmd *cmd;
3577 struct hci_conn *conn;
3578
3579 mutex_lock(&hdev->mgmt_pending_lock);
3580
3581 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3582 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3583 continue;
3584
3585 conn = cmd->user_data;
3586 if (bacmp(bdaddr, &conn->dst) != 0)
3587 continue;
3588
3589 list_del(&cmd->list);
3590 mutex_unlock(&hdev->mgmt_pending_lock);
3591 return cmd;
3592 }
3593
3594 mutex_unlock(&hdev->mgmt_pending_lock);
3595
3596 return NULL;
3597 }
3598
pairing_complete(struct mgmt_pending_cmd * cmd,u8 status)3599 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
3600 {
3601 struct mgmt_rp_pair_device rp;
3602 struct hci_conn *conn = cmd->user_data;
3603 int err;
3604
3605 bacpy(&rp.addr.bdaddr, &conn->dst);
3606 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3607
3608 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE,
3609 status, &rp, sizeof(rp));
3610
3611 /* So we don't get further callbacks for this connection */
3612 conn->connect_cfm_cb = NULL;
3613 conn->security_cfm_cb = NULL;
3614 conn->disconn_cfm_cb = NULL;
3615
3616 hci_conn_drop(conn);
3617
3618 /* The device is paired so there is no need to remove
3619 * its connection parameters anymore.
3620 */
3621 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3622
3623 hci_conn_put(conn);
3624
3625 return err;
3626 }
3627
mgmt_smp_complete(struct hci_conn * conn,bool complete)3628 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3629 {
3630 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3631 struct mgmt_pending_cmd *cmd;
3632
3633 cmd = remove_pairing(conn);
3634 if (cmd) {
3635 cmd->cmd_complete(cmd, status);
3636 mgmt_pending_free(cmd);
3637 }
3638 }
3639
pairing_complete_cb(struct hci_conn * conn,u8 status)3640 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3641 {
3642 struct mgmt_pending_cmd *cmd;
3643
3644 BT_DBG("status %u", status);
3645
3646 cmd = remove_pairing(conn);
3647 if (!cmd) {
3648 BT_DBG("Unable to find a pending command");
3649 return;
3650 }
3651
3652 cmd->cmd_complete(cmd, mgmt_status(status));
3653 mgmt_pending_free(cmd);
3654 }
3655
le_pairing_complete_cb(struct hci_conn * conn,u8 status)3656 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3657 {
3658 struct mgmt_pending_cmd *cmd;
3659
3660 BT_DBG("status %u", status);
3661
3662 if (!status)
3663 return;
3664
3665 cmd = remove_pairing(conn);
3666 if (!cmd) {
3667 BT_DBG("Unable to find a pending command");
3668 return;
3669 }
3670
3671 cmd->cmd_complete(cmd, mgmt_status(status));
3672 mgmt_pending_free(cmd);
3673 }
3674
pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3675 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3676 u16 len)
3677 {
3678 struct mgmt_cp_pair_device *cp = data;
3679 struct mgmt_rp_pair_device rp;
3680 struct mgmt_pending_cmd *cmd;
3681 u8 sec_level, auth_type;
3682 struct hci_conn *conn;
3683 int err;
3684
3685 bt_dev_dbg(hdev, "sock %p", sk);
3686
3687 memset(&rp, 0, sizeof(rp));
3688 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3689 rp.addr.type = cp->addr.type;
3690
3691 if (!bdaddr_type_is_valid(cp->addr.type))
3692 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3693 MGMT_STATUS_INVALID_PARAMS,
3694 &rp, sizeof(rp));
3695
3696 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3697 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3698 MGMT_STATUS_INVALID_PARAMS,
3699 &rp, sizeof(rp));
3700
3701 hci_dev_lock(hdev);
3702
3703 if (!hdev_is_powered(hdev)) {
3704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3705 MGMT_STATUS_NOT_POWERED, &rp,
3706 sizeof(rp));
3707 goto unlock;
3708 }
3709
3710 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3712 MGMT_STATUS_ALREADY_PAIRED, &rp,
3713 sizeof(rp));
3714 goto unlock;
3715 }
3716
3717 sec_level = BT_SECURITY_MEDIUM;
3718 auth_type = HCI_AT_DEDICATED_BONDING;
3719
3720 if (cp->addr.type == BDADDR_BREDR) {
3721 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3722 auth_type, CONN_REASON_PAIR_DEVICE,
3723 HCI_ACL_CONN_TIMEOUT);
3724 } else {
3725 u8 addr_type = le_addr_type(cp->addr.type);
3726 struct hci_conn_params *p;
3727
3728 /* When pairing a new device, it is expected to remember
3729 * this device for future connections. Adding the connection
3730 * parameter information ahead of time allows tracking
3731 * of the peripheral preferred values and will speed up any
3732 * further connection establishment.
3733 *
3734 * If connection parameters already exist, then they
3735 * will be kept and this function does nothing.
3736 */
3737 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3738 if (!p) {
3739 err = -EIO;
3740 goto unlock;
3741 }
3742
3743 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3744 p->auto_connect = HCI_AUTO_CONN_DISABLED;
3745
3746 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
3747 sec_level, HCI_LE_CONN_TIMEOUT,
3748 CONN_REASON_PAIR_DEVICE);
3749 }
3750
3751 if (IS_ERR(conn)) {
3752 int status;
3753
3754 if (PTR_ERR(conn) == -EBUSY)
3755 status = MGMT_STATUS_BUSY;
3756 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3757 status = MGMT_STATUS_NOT_SUPPORTED;
3758 else if (PTR_ERR(conn) == -ECONNREFUSED)
3759 status = MGMT_STATUS_REJECTED;
3760 else
3761 status = MGMT_STATUS_CONNECT_FAILED;
3762
3763 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3764 status, &rp, sizeof(rp));
3765 goto unlock;
3766 }
3767
3768 if (conn->connect_cfm_cb) {
3769 hci_conn_drop(conn);
3770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3771 MGMT_STATUS_BUSY, &rp, sizeof(rp));
3772 goto unlock;
3773 }
3774
3775 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3776 if (!cmd) {
3777 err = -ENOMEM;
3778 hci_conn_drop(conn);
3779 goto unlock;
3780 }
3781
3782 cmd->cmd_complete = pairing_complete;
3783
3784 /* For LE, just connecting isn't a proof that the pairing finished */
3785 if (cp->addr.type == BDADDR_BREDR) {
3786 conn->connect_cfm_cb = pairing_complete_cb;
3787 conn->security_cfm_cb = pairing_complete_cb;
3788 conn->disconn_cfm_cb = pairing_complete_cb;
3789 } else {
3790 conn->connect_cfm_cb = le_pairing_complete_cb;
3791 conn->security_cfm_cb = le_pairing_complete_cb;
3792 conn->disconn_cfm_cb = le_pairing_complete_cb;
3793 }
3794
3795 conn->io_capability = cp->io_cap;
3796 cmd->user_data = hci_conn_get(conn);
3797
3798 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3799 hci_conn_security(conn, sec_level, auth_type, true)) {
3800 cmd->cmd_complete(cmd, 0);
3801 mgmt_pending_remove(cmd);
3802 }
3803
3804 err = 0;
3805
3806 unlock:
3807 hci_dev_unlock(hdev);
3808 return err;
3809 }
3810
cancel_pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3811 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3812 u16 len)
3813 {
3814 struct mgmt_addr_info *addr = data;
3815 struct mgmt_pending_cmd *cmd;
3816 struct hci_conn *conn;
3817 int err;
3818
3819 bt_dev_dbg(hdev, "sock %p", sk);
3820
3821 hci_dev_lock(hdev);
3822
3823 if (!hdev_is_powered(hdev)) {
3824 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3825 MGMT_STATUS_NOT_POWERED);
3826 goto unlock;
3827 }
3828
3829 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr);
3830 if (!cmd) {
3831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3832 MGMT_STATUS_INVALID_PARAMS);
3833 goto unlock;
3834 }
3835
3836 conn = hci_conn_get(cmd->user_data);
3837
3838 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3839 mgmt_pending_free(cmd);
3840
3841 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3842 addr, sizeof(*addr));
3843
3844 /* Since user doesn't want to proceed with the connection, abort any
3845 * ongoing pairing and then terminate the link if it was created
3846 * because of the pair device action.
3847 */
3848 if (addr->type == BDADDR_BREDR)
3849 hci_remove_link_key(hdev, &addr->bdaddr);
3850 else
3851 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3852 le_addr_type(addr->type));
3853
3854 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3855 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3856
3857 hci_conn_put(conn);
3858
3859 unlock:
3860 hci_dev_unlock(hdev);
3861 return err;
3862 }
3863
user_pairing_resp(struct sock * sk,struct hci_dev * hdev,struct mgmt_addr_info * addr,u16 mgmt_op,u16 hci_op,__le32 passkey)3864 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3865 struct mgmt_addr_info *addr, u16 mgmt_op,
3866 u16 hci_op, __le32 passkey)
3867 {
3868 struct mgmt_pending_cmd *cmd;
3869 struct hci_conn *conn;
3870 int err;
3871
3872 hci_dev_lock(hdev);
3873
3874 if (!hdev_is_powered(hdev)) {
3875 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3876 MGMT_STATUS_NOT_POWERED, addr,
3877 sizeof(*addr));
3878 goto done;
3879 }
3880
3881 if (addr->type == BDADDR_BREDR)
3882 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3883 else
3884 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3885 le_addr_type(addr->type));
3886
3887 if (!conn) {
3888 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3889 MGMT_STATUS_NOT_CONNECTED, addr,
3890 sizeof(*addr));
3891 goto done;
3892 }
3893
3894 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3895 lockdep_assert_held(&conn->hdev->lock);
3896
3897 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3898 if (!err)
3899 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3900 MGMT_STATUS_SUCCESS, addr,
3901 sizeof(*addr));
3902 else
3903 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3904 MGMT_STATUS_FAILED, addr,
3905 sizeof(*addr));
3906
3907 goto done;
3908 }
3909
3910 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3911 if (!cmd) {
3912 err = -ENOMEM;
3913 goto done;
3914 }
3915
3916 cmd->cmd_complete = addr_cmd_complete;
3917
3918 /* Continue with pairing via HCI */
3919 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3920 struct hci_cp_user_passkey_reply cp;
3921
3922 bacpy(&cp.bdaddr, &addr->bdaddr);
3923 cp.passkey = passkey;
3924 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3925 } else
3926 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3927 &addr->bdaddr);
3928
3929 if (err < 0)
3930 mgmt_pending_remove(cmd);
3931
3932 done:
3933 hci_dev_unlock(hdev);
3934 return err;
3935 }
3936
pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3937 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3938 void *data, u16 len)
3939 {
3940 struct mgmt_cp_pin_code_neg_reply *cp = data;
3941
3942 bt_dev_dbg(hdev, "sock %p", sk);
3943
3944 return user_pairing_resp(sk, hdev, &cp->addr,
3945 MGMT_OP_PIN_CODE_NEG_REPLY,
3946 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3947 }
3948
user_confirm_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3949 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3950 u16 len)
3951 {
3952 struct mgmt_cp_user_confirm_reply *cp = data;
3953
3954 bt_dev_dbg(hdev, "sock %p", sk);
3955
3956 if (len != sizeof(*cp))
3957 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3958 MGMT_STATUS_INVALID_PARAMS);
3959
3960 return user_pairing_resp(sk, hdev, &cp->addr,
3961 MGMT_OP_USER_CONFIRM_REPLY,
3962 HCI_OP_USER_CONFIRM_REPLY, 0);
3963 }
3964
user_confirm_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3965 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3966 void *data, u16 len)
3967 {
3968 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3969
3970 bt_dev_dbg(hdev, "sock %p", sk);
3971
3972 return user_pairing_resp(sk, hdev, &cp->addr,
3973 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3974 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3975 }
3976
user_passkey_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3977 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3978 u16 len)
3979 {
3980 struct mgmt_cp_user_passkey_reply *cp = data;
3981
3982 bt_dev_dbg(hdev, "sock %p", sk);
3983
3984 return user_pairing_resp(sk, hdev, &cp->addr,
3985 MGMT_OP_USER_PASSKEY_REPLY,
3986 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3987 }
3988
user_passkey_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3989 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3990 void *data, u16 len)
3991 {
3992 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3993
3994 bt_dev_dbg(hdev, "sock %p", sk);
3995
3996 return user_pairing_resp(sk, hdev, &cp->addr,
3997 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3998 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3999 }
4000
adv_expire_sync(struct hci_dev * hdev,u32 flags)4001 static int adv_expire_sync(struct hci_dev *hdev, u32 flags)
4002 {
4003 struct adv_info *adv_instance;
4004
4005 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
4006 if (!adv_instance)
4007 return 0;
4008
4009 /* stop if current instance doesn't need to be changed */
4010 if (!(adv_instance->flags & flags))
4011 return 0;
4012
4013 cancel_adv_timeout(hdev);
4014
4015 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
4016 if (!adv_instance)
4017 return 0;
4018
4019 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true);
4020
4021 return 0;
4022 }
4023
name_changed_sync(struct hci_dev * hdev,void * data)4024 static int name_changed_sync(struct hci_dev *hdev, void *data)
4025 {
4026 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
4027 }
4028
set_name_complete(struct hci_dev * hdev,void * data,int err)4029 static void set_name_complete(struct hci_dev *hdev, void *data, int err)
4030 {
4031 struct mgmt_pending_cmd *cmd = data;
4032 struct mgmt_cp_set_local_name *cp;
4033 u8 status = mgmt_status(err);
4034
4035 bt_dev_dbg(hdev, "err %d", err);
4036
4037 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
4038 return;
4039
4040 cp = cmd->param;
4041
4042 if (status) {
4043 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4044 status);
4045 } else {
4046 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4047 cp, sizeof(*cp));
4048
4049 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4050 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
4051 }
4052
4053 mgmt_pending_free(cmd);
4054 }
4055
set_name_sync(struct hci_dev * hdev,void * data)4056 static int set_name_sync(struct hci_dev *hdev, void *data)
4057 {
4058 struct mgmt_pending_cmd *cmd = data;
4059 struct mgmt_cp_set_local_name cp;
4060
4061 mutex_lock(&hdev->mgmt_pending_lock);
4062
4063 if (!__mgmt_pending_listed(hdev, cmd)) {
4064 mutex_unlock(&hdev->mgmt_pending_lock);
4065 return -ECANCELED;
4066 }
4067
4068 memcpy(&cp, cmd->param, sizeof(cp));
4069
4070 mutex_unlock(&hdev->mgmt_pending_lock);
4071
4072 if (lmp_bredr_capable(hdev)) {
4073 hci_update_name_sync(hdev, cp.name);
4074 hci_update_eir_sync(hdev);
4075 }
4076
4077 /* The name is stored in the scan response data and so
4078 * no need to update the advertising data here.
4079 */
4080 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
4081 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance);
4082
4083 return 0;
4084 }
4085
set_local_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4086 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
4087 u16 len)
4088 {
4089 struct mgmt_cp_set_local_name *cp = data;
4090 struct mgmt_pending_cmd *cmd;
4091 int err;
4092
4093 bt_dev_dbg(hdev, "sock %p", sk);
4094
4095 hci_dev_lock(hdev);
4096
4097 /* If the old values are the same as the new ones just return a
4098 * direct command complete event.
4099 */
4100 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
4101 !memcmp(hdev->short_name, cp->short_name,
4102 sizeof(hdev->short_name))) {
4103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4104 data, len);
4105 goto failed;
4106 }
4107
4108 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) {
4109 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4110 MGMT_STATUS_BUSY);
4111 goto failed;
4112 }
4113
4114 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
4115
4116 if (!hdev_is_powered(hdev)) {
4117 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
4118
4119 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
4120 data, len);
4121 if (err < 0)
4122 goto failed;
4123
4124 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
4125 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
4126 ext_info_changed(hdev, sk);
4127
4128 goto failed;
4129 }
4130
4131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
4132 if (!cmd)
4133 err = -ENOMEM;
4134 else
4135 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd,
4136 set_name_complete);
4137
4138 if (err < 0) {
4139 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
4140 MGMT_STATUS_FAILED);
4141
4142 if (cmd)
4143 mgmt_pending_remove(cmd);
4144
4145 goto failed;
4146 }
4147
4148 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
4149
4150 failed:
4151 hci_dev_unlock(hdev);
4152 return err;
4153 }
4154
appearance_changed_sync(struct hci_dev * hdev,void * data)4155 static int appearance_changed_sync(struct hci_dev *hdev, void *data)
4156 {
4157 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE);
4158 }
4159
set_appearance(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4160 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
4161 u16 len)
4162 {
4163 struct mgmt_cp_set_appearance *cp = data;
4164 u16 appearance;
4165 int err;
4166
4167 bt_dev_dbg(hdev, "sock %p", sk);
4168
4169 if (!lmp_le_capable(hdev))
4170 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
4171 MGMT_STATUS_NOT_SUPPORTED);
4172
4173 appearance = le16_to_cpu(cp->appearance);
4174
4175 hci_dev_lock(hdev);
4176
4177 if (hdev->appearance != appearance) {
4178 hdev->appearance = appearance;
4179
4180 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4181 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL,
4182 NULL);
4183
4184 ext_info_changed(hdev, sk);
4185 }
4186
4187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
4188 0);
4189
4190 hci_dev_unlock(hdev);
4191
4192 return err;
4193 }
4194
get_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4195 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4196 void *data, u16 len)
4197 {
4198 struct mgmt_rp_get_phy_configuration rp;
4199
4200 bt_dev_dbg(hdev, "sock %p", sk);
4201
4202 hci_dev_lock(hdev);
4203
4204 memset(&rp, 0, sizeof(rp));
4205
4206 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
4207 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
4208 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
4209
4210 hci_dev_unlock(hdev);
4211
4212 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
4213 &rp, sizeof(rp));
4214 }
4215
mgmt_phy_configuration_changed(struct hci_dev * hdev,struct sock * skip)4216 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
4217 {
4218 struct mgmt_ev_phy_configuration_changed ev;
4219
4220 memset(&ev, 0, sizeof(ev));
4221
4222 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
4223
4224 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
4225 sizeof(ev), skip);
4226 }
4227
set_default_phy_complete(struct hci_dev * hdev,void * data,int err)4228 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
4229 {
4230 struct mgmt_pending_cmd *cmd = data;
4231 struct sk_buff *skb;
4232 u8 status = mgmt_status(err);
4233
4234 skb = cmd->skb;
4235
4236 if (!status) {
4237 if (!skb)
4238 status = MGMT_STATUS_FAILED;
4239 else if (IS_ERR(skb))
4240 status = mgmt_status(PTR_ERR(skb));
4241 else
4242 status = mgmt_status(skb->data[0]);
4243 }
4244
4245 bt_dev_dbg(hdev, "status %d", status);
4246
4247 if (status) {
4248 mgmt_cmd_status(cmd->sk, hdev->id,
4249 MGMT_OP_SET_PHY_CONFIGURATION, status);
4250 } else {
4251 mgmt_cmd_complete(cmd->sk, hdev->id,
4252 MGMT_OP_SET_PHY_CONFIGURATION, 0,
4253 NULL, 0);
4254
4255 mgmt_phy_configuration_changed(hdev, cmd->sk);
4256 }
4257
4258 if (skb && !IS_ERR(skb))
4259 kfree_skb(skb);
4260
4261 mgmt_pending_free(cmd);
4262 }
4263
set_default_phy_sync(struct hci_dev * hdev,void * data)4264 static int set_default_phy_sync(struct hci_dev *hdev, void *data)
4265 {
4266 struct mgmt_pending_cmd *cmd = data;
4267 struct mgmt_cp_set_phy_configuration *cp = cmd->param;
4268 struct hci_cp_le_set_default_phy cp_phy;
4269 u32 selected_phys;
4270
4271 selected_phys = __le32_to_cpu(cp->selected_phys);
4272
4273 memset(&cp_phy, 0, sizeof(cp_phy));
4274
4275 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
4276 cp_phy.all_phys |= 0x01;
4277
4278 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
4279 cp_phy.all_phys |= 0x02;
4280
4281 if (selected_phys & MGMT_PHY_LE_1M_TX)
4282 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
4283
4284 if (selected_phys & MGMT_PHY_LE_2M_TX)
4285 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
4286
4287 if (selected_phys & MGMT_PHY_LE_CODED_TX)
4288 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
4289
4290 if (selected_phys & MGMT_PHY_LE_1M_RX)
4291 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
4292
4293 if (selected_phys & MGMT_PHY_LE_2M_RX)
4294 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
4295
4296 if (selected_phys & MGMT_PHY_LE_CODED_RX)
4297 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
4298
4299 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4300 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT);
4301
4302 return 0;
4303 }
4304
set_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4305 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
4306 void *data, u16 len)
4307 {
4308 struct mgmt_cp_set_phy_configuration *cp = data;
4309 struct mgmt_pending_cmd *cmd;
4310 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
4311 u16 pkt_type = (HCI_DH1 | HCI_DM1);
4312 bool changed = false;
4313 int err;
4314
4315 bt_dev_dbg(hdev, "sock %p", sk);
4316
4317 configurable_phys = get_configurable_phys(hdev);
4318 supported_phys = get_supported_phys(hdev);
4319 selected_phys = __le32_to_cpu(cp->selected_phys);
4320
4321 if (selected_phys & ~supported_phys)
4322 return mgmt_cmd_status(sk, hdev->id,
4323 MGMT_OP_SET_PHY_CONFIGURATION,
4324 MGMT_STATUS_INVALID_PARAMS);
4325
4326 unconfigure_phys = supported_phys & ~configurable_phys;
4327
4328 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
4329 return mgmt_cmd_status(sk, hdev->id,
4330 MGMT_OP_SET_PHY_CONFIGURATION,
4331 MGMT_STATUS_INVALID_PARAMS);
4332
4333 if (selected_phys == get_selected_phys(hdev))
4334 return mgmt_cmd_complete(sk, hdev->id,
4335 MGMT_OP_SET_PHY_CONFIGURATION,
4336 0, NULL, 0);
4337
4338 hci_dev_lock(hdev);
4339
4340 if (!hdev_is_powered(hdev)) {
4341 err = mgmt_cmd_status(sk, hdev->id,
4342 MGMT_OP_SET_PHY_CONFIGURATION,
4343 MGMT_STATUS_REJECTED);
4344 goto unlock;
4345 }
4346
4347 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
4348 err = mgmt_cmd_status(sk, hdev->id,
4349 MGMT_OP_SET_PHY_CONFIGURATION,
4350 MGMT_STATUS_BUSY);
4351 goto unlock;
4352 }
4353
4354 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
4355 pkt_type |= (HCI_DH3 | HCI_DM3);
4356 else
4357 pkt_type &= ~(HCI_DH3 | HCI_DM3);
4358
4359 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
4360 pkt_type |= (HCI_DH5 | HCI_DM5);
4361 else
4362 pkt_type &= ~(HCI_DH5 | HCI_DM5);
4363
4364 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
4365 pkt_type &= ~HCI_2DH1;
4366 else
4367 pkt_type |= HCI_2DH1;
4368
4369 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
4370 pkt_type &= ~HCI_2DH3;
4371 else
4372 pkt_type |= HCI_2DH3;
4373
4374 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
4375 pkt_type &= ~HCI_2DH5;
4376 else
4377 pkt_type |= HCI_2DH5;
4378
4379 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
4380 pkt_type &= ~HCI_3DH1;
4381 else
4382 pkt_type |= HCI_3DH1;
4383
4384 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
4385 pkt_type &= ~HCI_3DH3;
4386 else
4387 pkt_type |= HCI_3DH3;
4388
4389 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
4390 pkt_type &= ~HCI_3DH5;
4391 else
4392 pkt_type |= HCI_3DH5;
4393
4394 if (pkt_type != hdev->pkt_type) {
4395 hdev->pkt_type = pkt_type;
4396 changed = true;
4397 }
4398
4399 if ((selected_phys & MGMT_PHY_LE_MASK) ==
4400 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
4401 if (changed)
4402 mgmt_phy_configuration_changed(hdev, sk);
4403
4404 err = mgmt_cmd_complete(sk, hdev->id,
4405 MGMT_OP_SET_PHY_CONFIGURATION,
4406 0, NULL, 0);
4407
4408 goto unlock;
4409 }
4410
4411 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
4412 len);
4413 if (!cmd)
4414 err = -ENOMEM;
4415 else
4416 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd,
4417 set_default_phy_complete);
4418
4419 if (err < 0) {
4420 err = mgmt_cmd_status(sk, hdev->id,
4421 MGMT_OP_SET_PHY_CONFIGURATION,
4422 MGMT_STATUS_FAILED);
4423
4424 if (cmd)
4425 mgmt_pending_remove(cmd);
4426 }
4427
4428 unlock:
4429 hci_dev_unlock(hdev);
4430
4431 return err;
4432 }
4433
set_blocked_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4434 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
4435 u16 len)
4436 {
4437 int err = MGMT_STATUS_SUCCESS;
4438 struct mgmt_cp_set_blocked_keys *keys = data;
4439 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
4440 sizeof(struct mgmt_blocked_key_info));
4441 u16 key_count, expected_len;
4442 int i;
4443
4444 bt_dev_dbg(hdev, "sock %p", sk);
4445
4446 key_count = __le16_to_cpu(keys->key_count);
4447 if (key_count > max_key_count) {
4448 bt_dev_err(hdev, "too big key_count value %u", key_count);
4449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4450 MGMT_STATUS_INVALID_PARAMS);
4451 }
4452
4453 expected_len = struct_size(keys, keys, key_count);
4454 if (expected_len != len) {
4455 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
4456 expected_len, len);
4457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4458 MGMT_STATUS_INVALID_PARAMS);
4459 }
4460
4461 hci_dev_lock(hdev);
4462
4463 hci_blocked_keys_clear(hdev);
4464
4465 for (i = 0; i < key_count; ++i) {
4466 struct blocked_key *b = kzalloc_obj(*b);
4467
4468 if (!b) {
4469 err = MGMT_STATUS_NO_RESOURCES;
4470 break;
4471 }
4472
4473 b->type = keys->keys[i].type;
4474 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
4475 list_add_rcu(&b->list, &hdev->blocked_keys);
4476 }
4477 hci_dev_unlock(hdev);
4478
4479 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
4480 err, NULL, 0);
4481 }
4482
set_wideband_speech(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4483 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
4484 void *data, u16 len)
4485 {
4486 struct mgmt_mode *cp = data;
4487 int err;
4488 bool changed = false;
4489
4490 bt_dev_dbg(hdev, "sock %p", sk);
4491
4492 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED))
4493 return mgmt_cmd_status(sk, hdev->id,
4494 MGMT_OP_SET_WIDEBAND_SPEECH,
4495 MGMT_STATUS_NOT_SUPPORTED);
4496
4497 if (cp->val != 0x00 && cp->val != 0x01)
4498 return mgmt_cmd_status(sk, hdev->id,
4499 MGMT_OP_SET_WIDEBAND_SPEECH,
4500 MGMT_STATUS_INVALID_PARAMS);
4501
4502 hci_dev_lock(hdev);
4503
4504 if (hdev_is_powered(hdev) &&
4505 !!cp->val != hci_dev_test_flag(hdev,
4506 HCI_WIDEBAND_SPEECH_ENABLED)) {
4507 err = mgmt_cmd_status(sk, hdev->id,
4508 MGMT_OP_SET_WIDEBAND_SPEECH,
4509 MGMT_STATUS_REJECTED);
4510 goto unlock;
4511 }
4512
4513 if (cp->val)
4514 changed = !hci_dev_test_and_set_flag(hdev,
4515 HCI_WIDEBAND_SPEECH_ENABLED);
4516 else
4517 changed = hci_dev_test_and_clear_flag(hdev,
4518 HCI_WIDEBAND_SPEECH_ENABLED);
4519
4520 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
4521 if (err < 0)
4522 goto unlock;
4523
4524 if (changed)
4525 err = new_settings(hdev, sk);
4526
4527 unlock:
4528 hci_dev_unlock(hdev);
4529 return err;
4530 }
4531
read_controller_cap(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)4532 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
4533 void *data, u16 data_len)
4534 {
4535 char buf[20];
4536 struct mgmt_rp_read_controller_cap *rp = (void *)buf;
4537 u16 cap_len = 0;
4538 u8 flags = 0;
4539 u8 tx_power_range[2];
4540
4541 bt_dev_dbg(hdev, "sock %p", sk);
4542
4543 memset(&buf, 0, sizeof(buf));
4544
4545 hci_dev_lock(hdev);
4546
4547 /* When the Read Simple Pairing Options command is supported, then
4548 * the remote public key validation is supported.
4549 *
4550 * Alternatively, when Microsoft extensions are available, they can
4551 * indicate support for public key validation as well.
4552 */
4553 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev))
4554 flags |= 0x01; /* Remote public key validation (BR/EDR) */
4555
4556 flags |= 0x02; /* Remote public key validation (LE) */
4557
4558 /* When the Read Encryption Key Size command is supported, then the
4559 * encryption key size is enforced.
4560 */
4561 if (hdev->commands[20] & 0x10)
4562 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */
4563
4564 flags |= 0x08; /* Encryption key size enforcement (LE) */
4565
4566 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
4567 &flags, 1);
4568
4569 /* When the Read Simple Pairing Options command is supported, then
4570 * also max encryption key size information is provided.
4571 */
4572 if (hdev->commands[41] & 0x08)
4573 cap_len = eir_append_le16(rp->cap, cap_len,
4574 MGMT_CAP_MAX_ENC_KEY_SIZE,
4575 hdev->max_enc_key_size);
4576
4577 cap_len = eir_append_le16(rp->cap, cap_len,
4578 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
4579 SMP_MAX_ENC_KEY_SIZE);
4580
4581 /* Append the min/max LE tx power parameters if we were able to fetch
4582 * it from the controller
4583 */
4584 if (hdev->commands[38] & 0x80) {
4585 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
4586 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
4587 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
4588 tx_power_range, 2);
4589 }
4590
4591 rp->cap_len = cpu_to_le16(cap_len);
4592
4593 hci_dev_unlock(hdev);
4594
4595 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
4596 rp, sizeof(*rp) + cap_len);
4597 }
4598
4599 #ifdef CONFIG_BT_FEATURE_DEBUG
4600 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
4601 static const u8 debug_uuid[16] = {
4602 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
4603 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
4604 };
4605 #endif
4606
4607 /* 330859bc-7506-492d-9370-9a6f0614037f */
4608 static const u8 quality_report_uuid[16] = {
4609 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93,
4610 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33,
4611 };
4612
4613 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */
4614 static const u8 offload_codecs_uuid[16] = {
4615 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88,
4616 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6,
4617 };
4618
4619 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
4620 static const u8 le_simultaneous_roles_uuid[16] = {
4621 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
4622 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
4623 };
4624
4625 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */
4626 static const u8 iso_socket_uuid[16] = {
4627 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98,
4628 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f,
4629 };
4630
4631 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */
4632 static const u8 mgmt_mesh_uuid[16] = {
4633 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf,
4634 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c,
4635 };
4636
read_exp_features_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)4637 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
4638 void *data, u16 data_len)
4639 {
4640 struct mgmt_rp_read_exp_features_info *rp;
4641 size_t len;
4642 u16 idx = 0;
4643 u32 flags;
4644 int status;
4645
4646 bt_dev_dbg(hdev, "sock %p", sk);
4647
4648 /* Enough space for 7 features */
4649 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7);
4650 rp = kzalloc(len, GFP_KERNEL);
4651 if (!rp)
4652 return -ENOMEM;
4653
4654 #ifdef CONFIG_BT_FEATURE_DEBUG
4655 flags = bt_dbg_get() ? BIT(0) : 0;
4656
4657 memcpy(rp->features[idx].uuid, debug_uuid, 16);
4658 rp->features[idx].flags = cpu_to_le32(flags);
4659 idx++;
4660 #endif
4661
4662 if (hdev && hci_dev_le_state_simultaneous(hdev)) {
4663 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4664 flags = BIT(0);
4665 else
4666 flags = 0;
4667
4668 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16);
4669 rp->features[idx].flags = cpu_to_le32(flags);
4670 idx++;
4671 }
4672
4673 if (hdev && (aosp_has_quality_report(hdev) ||
4674 hdev->set_quality_report)) {
4675 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT))
4676 flags = BIT(0);
4677 else
4678 flags = 0;
4679
4680 memcpy(rp->features[idx].uuid, quality_report_uuid, 16);
4681 rp->features[idx].flags = cpu_to_le32(flags);
4682 idx++;
4683 }
4684
4685 if (hdev && hdev->get_data_path_id) {
4686 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED))
4687 flags = BIT(0);
4688 else
4689 flags = 0;
4690
4691 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16);
4692 rp->features[idx].flags = cpu_to_le32(flags);
4693 idx++;
4694 }
4695
4696 if (IS_ENABLED(CONFIG_BT_LE)) {
4697 flags = iso_inited() ? BIT(0) : 0;
4698 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16);
4699 rp->features[idx].flags = cpu_to_le32(flags);
4700 idx++;
4701 }
4702
4703 if (hdev && lmp_le_capable(hdev)) {
4704 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL))
4705 flags = BIT(0);
4706 else
4707 flags = 0;
4708
4709 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16);
4710 rp->features[idx].flags = cpu_to_le32(flags);
4711 idx++;
4712 }
4713
4714 rp->feature_count = cpu_to_le16(idx);
4715
4716 /* After reading the experimental features information, enable
4717 * the events to update client on any future change.
4718 */
4719 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4720
4721 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4722 MGMT_OP_READ_EXP_FEATURES_INFO,
4723 0, rp, sizeof(*rp) + (20 * idx));
4724
4725 kfree(rp);
4726 return status;
4727 }
4728
exp_feature_changed(struct hci_dev * hdev,const u8 * uuid,bool enabled,struct sock * skip)4729 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid,
4730 bool enabled, struct sock *skip)
4731 {
4732 struct mgmt_ev_exp_feature_changed ev;
4733
4734 memset(&ev, 0, sizeof(ev));
4735 memcpy(ev.uuid, uuid, 16);
4736 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
4737
4738 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
4739 &ev, sizeof(ev),
4740 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
4741 }
4742
4743 #define EXP_FEAT(_uuid, _set_func) \
4744 { \
4745 .uuid = _uuid, \
4746 .set_func = _set_func, \
4747 }
4748
4749 /* The zero key uuid is special. Multiple exp features are set through it. */
set_zero_key_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4750 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev,
4751 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4752 {
4753 struct mgmt_rp_set_exp_feature rp;
4754
4755 memset(rp.uuid, 0, 16);
4756 rp.flags = cpu_to_le32(0);
4757
4758 #ifdef CONFIG_BT_FEATURE_DEBUG
4759 if (!hdev) {
4760 bool changed = bt_dbg_get();
4761
4762 bt_dbg_set(false);
4763
4764 if (changed)
4765 exp_feature_changed(NULL, ZERO_KEY, false, sk);
4766 }
4767 #endif
4768
4769 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4770
4771 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4772 MGMT_OP_SET_EXP_FEATURE, 0,
4773 &rp, sizeof(rp));
4774 }
4775
4776 #ifdef CONFIG_BT_FEATURE_DEBUG
set_debug_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4777 static int set_debug_func(struct sock *sk, struct hci_dev *hdev,
4778 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4779 {
4780 struct mgmt_rp_set_exp_feature rp;
4781
4782 bool val, changed;
4783 int err;
4784
4785 /* Command requires to use the non-controller index */
4786 if (hdev)
4787 return mgmt_cmd_status(sk, hdev->id,
4788 MGMT_OP_SET_EXP_FEATURE,
4789 MGMT_STATUS_INVALID_INDEX);
4790
4791 /* Parameters are limited to a single octet */
4792 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4793 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4794 MGMT_OP_SET_EXP_FEATURE,
4795 MGMT_STATUS_INVALID_PARAMS);
4796
4797 /* Only boolean on/off is supported */
4798 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4799 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4800 MGMT_OP_SET_EXP_FEATURE,
4801 MGMT_STATUS_INVALID_PARAMS);
4802
4803 val = !!cp->param[0];
4804 changed = val ? !bt_dbg_get() : bt_dbg_get();
4805 bt_dbg_set(val);
4806
4807 memcpy(rp.uuid, debug_uuid, 16);
4808 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4809
4810 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4811
4812 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
4813 MGMT_OP_SET_EXP_FEATURE, 0,
4814 &rp, sizeof(rp));
4815
4816 if (changed)
4817 exp_feature_changed(hdev, debug_uuid, val, sk);
4818
4819 return err;
4820 }
4821 #endif
4822
set_mgmt_mesh_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4823 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev,
4824 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
4825 {
4826 struct mgmt_rp_set_exp_feature rp;
4827 bool val, changed;
4828 int err;
4829
4830 /* Command requires to use the controller index */
4831 if (!hdev)
4832 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4833 MGMT_OP_SET_EXP_FEATURE,
4834 MGMT_STATUS_INVALID_INDEX);
4835
4836 /* Parameters are limited to a single octet */
4837 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4838 return mgmt_cmd_status(sk, hdev->id,
4839 MGMT_OP_SET_EXP_FEATURE,
4840 MGMT_STATUS_INVALID_PARAMS);
4841
4842 /* Only boolean on/off is supported */
4843 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4844 return mgmt_cmd_status(sk, hdev->id,
4845 MGMT_OP_SET_EXP_FEATURE,
4846 MGMT_STATUS_INVALID_PARAMS);
4847
4848 val = !!cp->param[0];
4849
4850 if (val) {
4851 changed = !hci_dev_test_and_set_flag(hdev,
4852 HCI_MESH_EXPERIMENTAL);
4853 } else {
4854 hci_dev_clear_flag(hdev, HCI_MESH);
4855 changed = hci_dev_test_and_clear_flag(hdev,
4856 HCI_MESH_EXPERIMENTAL);
4857 }
4858
4859 memcpy(rp.uuid, mgmt_mesh_uuid, 16);
4860 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4861
4862 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4863
4864 err = mgmt_cmd_complete(sk, hdev->id,
4865 MGMT_OP_SET_EXP_FEATURE, 0,
4866 &rp, sizeof(rp));
4867
4868 if (changed)
4869 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk);
4870
4871 return err;
4872 }
4873
set_quality_report_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4874 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev,
4875 struct mgmt_cp_set_exp_feature *cp,
4876 u16 data_len)
4877 {
4878 struct mgmt_rp_set_exp_feature rp;
4879 bool val, changed;
4880 int err;
4881
4882 /* Command requires to use a valid controller index */
4883 if (!hdev)
4884 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4885 MGMT_OP_SET_EXP_FEATURE,
4886 MGMT_STATUS_INVALID_INDEX);
4887
4888 /* Parameters are limited to a single octet */
4889 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4890 return mgmt_cmd_status(sk, hdev->id,
4891 MGMT_OP_SET_EXP_FEATURE,
4892 MGMT_STATUS_INVALID_PARAMS);
4893
4894 /* Only boolean on/off is supported */
4895 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4896 return mgmt_cmd_status(sk, hdev->id,
4897 MGMT_OP_SET_EXP_FEATURE,
4898 MGMT_STATUS_INVALID_PARAMS);
4899
4900 hci_req_sync_lock(hdev);
4901
4902 val = !!cp->param[0];
4903 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT));
4904
4905 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) {
4906 err = mgmt_cmd_status(sk, hdev->id,
4907 MGMT_OP_SET_EXP_FEATURE,
4908 MGMT_STATUS_NOT_SUPPORTED);
4909 goto unlock_quality_report;
4910 }
4911
4912 if (changed) {
4913 if (hdev->set_quality_report)
4914 err = hdev->set_quality_report(hdev, val);
4915 else
4916 err = aosp_set_quality_report(hdev, val);
4917
4918 if (err) {
4919 err = mgmt_cmd_status(sk, hdev->id,
4920 MGMT_OP_SET_EXP_FEATURE,
4921 MGMT_STATUS_FAILED);
4922 goto unlock_quality_report;
4923 }
4924
4925 if (val)
4926 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT);
4927 else
4928 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
4929 }
4930
4931 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed);
4932
4933 memcpy(rp.uuid, quality_report_uuid, 16);
4934 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4935 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4936
4937 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0,
4938 &rp, sizeof(rp));
4939
4940 if (changed)
4941 exp_feature_changed(hdev, quality_report_uuid, val, sk);
4942
4943 unlock_quality_report:
4944 hci_req_sync_unlock(hdev);
4945 return err;
4946 }
4947
set_offload_codec_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)4948 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev,
4949 struct mgmt_cp_set_exp_feature *cp,
4950 u16 data_len)
4951 {
4952 bool val, changed;
4953 int err;
4954 struct mgmt_rp_set_exp_feature rp;
4955
4956 /* Command requires to use a valid controller index */
4957 if (!hdev)
4958 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
4959 MGMT_OP_SET_EXP_FEATURE,
4960 MGMT_STATUS_INVALID_INDEX);
4961
4962 /* Parameters are limited to a single octet */
4963 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
4964 return mgmt_cmd_status(sk, hdev->id,
4965 MGMT_OP_SET_EXP_FEATURE,
4966 MGMT_STATUS_INVALID_PARAMS);
4967
4968 /* Only boolean on/off is supported */
4969 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
4970 return mgmt_cmd_status(sk, hdev->id,
4971 MGMT_OP_SET_EXP_FEATURE,
4972 MGMT_STATUS_INVALID_PARAMS);
4973
4974 val = !!cp->param[0];
4975 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED));
4976
4977 if (!hdev->get_data_path_id) {
4978 return mgmt_cmd_status(sk, hdev->id,
4979 MGMT_OP_SET_EXP_FEATURE,
4980 MGMT_STATUS_NOT_SUPPORTED);
4981 }
4982
4983 if (changed) {
4984 if (val)
4985 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4986 else
4987 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED);
4988 }
4989
4990 bt_dev_info(hdev, "offload codecs enable %d changed %d",
4991 val, changed);
4992
4993 memcpy(rp.uuid, offload_codecs_uuid, 16);
4994 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
4995 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4996 err = mgmt_cmd_complete(sk, hdev->id,
4997 MGMT_OP_SET_EXP_FEATURE, 0,
4998 &rp, sizeof(rp));
4999
5000 if (changed)
5001 exp_feature_changed(hdev, offload_codecs_uuid, val, sk);
5002
5003 return err;
5004 }
5005
set_le_simultaneous_roles_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)5006 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev,
5007 struct mgmt_cp_set_exp_feature *cp,
5008 u16 data_len)
5009 {
5010 bool val, changed;
5011 int err;
5012 struct mgmt_rp_set_exp_feature rp;
5013
5014 /* Command requires to use a valid controller index */
5015 if (!hdev)
5016 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5017 MGMT_OP_SET_EXP_FEATURE,
5018 MGMT_STATUS_INVALID_INDEX);
5019
5020 /* Parameters are limited to a single octet */
5021 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
5022 return mgmt_cmd_status(sk, hdev->id,
5023 MGMT_OP_SET_EXP_FEATURE,
5024 MGMT_STATUS_INVALID_PARAMS);
5025
5026 /* Only boolean on/off is supported */
5027 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
5028 return mgmt_cmd_status(sk, hdev->id,
5029 MGMT_OP_SET_EXP_FEATURE,
5030 MGMT_STATUS_INVALID_PARAMS);
5031
5032 val = !!cp->param[0];
5033 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES));
5034
5035 if (!hci_dev_le_state_simultaneous(hdev)) {
5036 return mgmt_cmd_status(sk, hdev->id,
5037 MGMT_OP_SET_EXP_FEATURE,
5038 MGMT_STATUS_NOT_SUPPORTED);
5039 }
5040
5041 if (changed) {
5042 if (val)
5043 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
5044 else
5045 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES);
5046 }
5047
5048 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d",
5049 val, changed);
5050
5051 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16);
5052 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5053 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5054 err = mgmt_cmd_complete(sk, hdev->id,
5055 MGMT_OP_SET_EXP_FEATURE, 0,
5056 &rp, sizeof(rp));
5057
5058 if (changed)
5059 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk);
5060
5061 return err;
5062 }
5063
5064 #ifdef CONFIG_BT_LE
set_iso_socket_func(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_set_exp_feature * cp,u16 data_len)5065 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev,
5066 struct mgmt_cp_set_exp_feature *cp, u16 data_len)
5067 {
5068 struct mgmt_rp_set_exp_feature rp;
5069 bool val, changed = false;
5070 int err;
5071
5072 /* Command requires to use the non-controller index */
5073 if (hdev)
5074 return mgmt_cmd_status(sk, hdev->id,
5075 MGMT_OP_SET_EXP_FEATURE,
5076 MGMT_STATUS_INVALID_INDEX);
5077
5078 /* Parameters are limited to a single octet */
5079 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
5080 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5081 MGMT_OP_SET_EXP_FEATURE,
5082 MGMT_STATUS_INVALID_PARAMS);
5083
5084 /* Only boolean on/off is supported */
5085 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
5086 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
5087 MGMT_OP_SET_EXP_FEATURE,
5088 MGMT_STATUS_INVALID_PARAMS);
5089
5090 val = cp->param[0] ? true : false;
5091 if (val)
5092 err = iso_init();
5093 else
5094 err = iso_exit();
5095
5096 if (!err)
5097 changed = true;
5098
5099 memcpy(rp.uuid, iso_socket_uuid, 16);
5100 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
5101
5102 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
5103
5104 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
5105 MGMT_OP_SET_EXP_FEATURE, 0,
5106 &rp, sizeof(rp));
5107
5108 if (changed)
5109 exp_feature_changed(hdev, iso_socket_uuid, val, sk);
5110
5111 return err;
5112 }
5113 #endif
5114
5115 static const struct mgmt_exp_feature {
5116 const u8 *uuid;
5117 int (*set_func)(struct sock *sk, struct hci_dev *hdev,
5118 struct mgmt_cp_set_exp_feature *cp, u16 data_len);
5119 } exp_features[] = {
5120 EXP_FEAT(ZERO_KEY, set_zero_key_func),
5121 #ifdef CONFIG_BT_FEATURE_DEBUG
5122 EXP_FEAT(debug_uuid, set_debug_func),
5123 #endif
5124 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func),
5125 EXP_FEAT(quality_report_uuid, set_quality_report_func),
5126 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func),
5127 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func),
5128 #ifdef CONFIG_BT_LE
5129 EXP_FEAT(iso_socket_uuid, set_iso_socket_func),
5130 #endif
5131
5132 /* end with a null feature */
5133 EXP_FEAT(NULL, NULL)
5134 };
5135
set_exp_feature(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5136 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
5137 void *data, u16 data_len)
5138 {
5139 struct mgmt_cp_set_exp_feature *cp = data;
5140 size_t i = 0;
5141
5142 bt_dev_dbg(hdev, "sock %p", sk);
5143
5144 for (i = 0; exp_features[i].uuid; i++) {
5145 if (!memcmp(cp->uuid, exp_features[i].uuid, 16))
5146 return exp_features[i].set_func(sk, hdev, cp, data_len);
5147 }
5148
5149 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
5150 MGMT_OP_SET_EXP_FEATURE,
5151 MGMT_STATUS_NOT_SUPPORTED);
5152 }
5153
get_device_flags(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5154 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5155 u16 data_len)
5156 {
5157 struct mgmt_cp_get_device_flags *cp = data;
5158 struct mgmt_rp_get_device_flags rp;
5159 struct bdaddr_list_with_flags *br_params;
5160 struct hci_conn_params *params;
5161 u32 supported_flags;
5162 u32 current_flags = 0;
5163 u8 status = MGMT_STATUS_INVALID_PARAMS;
5164
5165 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
5166 &cp->addr.bdaddr, cp->addr.type);
5167
5168 hci_dev_lock(hdev);
5169
5170 supported_flags = hdev->conn_flags;
5171
5172 memset(&rp, 0, sizeof(rp));
5173
5174 if (cp->addr.type == BDADDR_BREDR) {
5175 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5176 &cp->addr.bdaddr,
5177 cp->addr.type);
5178 if (!br_params)
5179 goto done;
5180
5181 current_flags = br_params->flags;
5182 } else {
5183 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5184 le_addr_type(cp->addr.type));
5185 if (!params)
5186 goto done;
5187
5188 current_flags = params->flags;
5189 }
5190
5191 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5192 rp.addr.type = cp->addr.type;
5193 rp.supported_flags = cpu_to_le32(supported_flags);
5194 rp.current_flags = cpu_to_le32(current_flags);
5195
5196 status = MGMT_STATUS_SUCCESS;
5197
5198 done:
5199 hci_dev_unlock(hdev);
5200
5201 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
5202 &rp, sizeof(rp));
5203 }
5204
device_flags_changed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u32 supported_flags,u32 current_flags)5205 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
5206 bdaddr_t *bdaddr, u8 bdaddr_type,
5207 u32 supported_flags, u32 current_flags)
5208 {
5209 struct mgmt_ev_device_flags_changed ev;
5210
5211 bacpy(&ev.addr.bdaddr, bdaddr);
5212 ev.addr.type = bdaddr_type;
5213 ev.supported_flags = cpu_to_le32(supported_flags);
5214 ev.current_flags = cpu_to_le32(current_flags);
5215
5216 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
5217 }
5218
is_connected(struct hci_dev * hdev,bdaddr_t * addr,u8 type)5219 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5220 {
5221 struct hci_conn *conn;
5222
5223 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5224 if (!conn)
5225 return false;
5226
5227 if (conn->dst_type != type)
5228 return false;
5229
5230 if (conn->state != BT_CONNECTED)
5231 return false;
5232
5233 return true;
5234 }
5235
5236 /* This function requires the caller holds hdev->lock */
hci_conn_params_set(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,u8 auto_connect)5237 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev,
5238 bdaddr_t *addr, u8 addr_type,
5239 u8 auto_connect)
5240 {
5241 struct hci_conn_params *params;
5242
5243 params = hci_conn_params_add(hdev, addr, addr_type);
5244 if (!params)
5245 return NULL;
5246
5247 if (params->auto_connect == auto_connect)
5248 return params;
5249
5250 hci_pend_le_list_del_init(params);
5251
5252 switch (auto_connect) {
5253 case HCI_AUTO_CONN_DISABLED:
5254 case HCI_AUTO_CONN_LINK_LOSS:
5255 /* If auto connect is being disabled when we're trying to
5256 * connect to device, keep connecting.
5257 */
5258 if (params->explicit_connect)
5259 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5260 break;
5261 case HCI_AUTO_CONN_REPORT:
5262 if (params->explicit_connect)
5263 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5264 else
5265 hci_pend_le_list_add(params, &hdev->pend_le_reports);
5266 break;
5267 case HCI_AUTO_CONN_DIRECT:
5268 case HCI_AUTO_CONN_ALWAYS:
5269 if (!is_connected(hdev, addr, addr_type))
5270 hci_pend_le_list_add(params, &hdev->pend_le_conns);
5271 break;
5272 }
5273
5274 params->auto_connect = auto_connect;
5275
5276 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
5277 addr, addr_type, auto_connect);
5278
5279 return params;
5280 }
5281
set_device_flags(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5282 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
5283 u16 len)
5284 {
5285 struct mgmt_cp_set_device_flags *cp = data;
5286 struct bdaddr_list_with_flags *br_params;
5287 struct hci_conn_params *params;
5288 u8 status = MGMT_STATUS_INVALID_PARAMS;
5289 u32 supported_flags;
5290 u32 current_flags = __le32_to_cpu(cp->current_flags);
5291
5292 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
5293 &cp->addr.bdaddr, cp->addr.type, current_flags);
5294
5295 // We should take hci_dev_lock() early, I think.. conn_flags can change
5296 supported_flags = hdev->conn_flags;
5297
5298 if ((supported_flags | current_flags) != supported_flags) {
5299 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5300 current_flags, supported_flags);
5301 goto done;
5302 }
5303
5304 hci_dev_lock(hdev);
5305
5306 if (cp->addr.type == BDADDR_BREDR) {
5307 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
5308 &cp->addr.bdaddr,
5309 cp->addr.type);
5310
5311 if (br_params) {
5312 br_params->flags = current_flags;
5313 status = MGMT_STATUS_SUCCESS;
5314 } else {
5315 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
5316 &cp->addr.bdaddr, cp->addr.type);
5317 }
5318
5319 goto unlock;
5320 }
5321
5322 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5323 le_addr_type(cp->addr.type));
5324 if (!params) {
5325 /* Create a new hci_conn_params if it doesn't exist */
5326 params = hci_conn_params_set(hdev, &cp->addr.bdaddr,
5327 le_addr_type(cp->addr.type),
5328 HCI_AUTO_CONN_DISABLED);
5329 if (!params) {
5330 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
5331 &cp->addr.bdaddr,
5332 le_addr_type(cp->addr.type));
5333 goto unlock;
5334 }
5335 }
5336
5337 supported_flags = hdev->conn_flags;
5338
5339 if ((supported_flags | current_flags) != supported_flags) {
5340 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
5341 current_flags, supported_flags);
5342 goto unlock;
5343 }
5344
5345 WRITE_ONCE(params->flags, current_flags);
5346 status = MGMT_STATUS_SUCCESS;
5347
5348 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY
5349 * has been set.
5350 */
5351 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)
5352 hci_update_passive_scan(hdev);
5353
5354 unlock:
5355 hci_dev_unlock(hdev);
5356
5357 done:
5358 if (status == MGMT_STATUS_SUCCESS)
5359 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
5360 supported_flags, current_flags);
5361
5362 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
5363 &cp->addr, sizeof(cp->addr));
5364 }
5365
mgmt_adv_monitor_added(struct sock * sk,struct hci_dev * hdev,u16 handle)5366 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
5367 u16 handle)
5368 {
5369 struct mgmt_ev_adv_monitor_added ev;
5370
5371 ev.monitor_handle = cpu_to_le16(handle);
5372
5373 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
5374 }
5375
mgmt_adv_monitor_removed(struct sock * sk,struct hci_dev * hdev,__le16 handle)5376 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
5377 __le16 handle)
5378 {
5379 struct mgmt_ev_adv_monitor_removed ev;
5380
5381 ev.monitor_handle = handle;
5382
5383 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
5384 }
5385
read_adv_mon_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5386 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
5387 void *data, u16 len)
5388 {
5389 struct adv_monitor *monitor = NULL;
5390 struct mgmt_rp_read_adv_monitor_features *rp = NULL;
5391 int handle, err;
5392 size_t rp_size = 0;
5393 __u32 supported = 0;
5394 __u32 enabled = 0;
5395 __u16 num_handles = 0;
5396 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
5397
5398 BT_DBG("request for %s", hdev->name);
5399
5400 hci_dev_lock(hdev);
5401
5402 if (msft_monitor_supported(hdev))
5403 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
5404
5405 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
5406 handles[num_handles++] = monitor->handle;
5407
5408 hci_dev_unlock(hdev);
5409
5410 rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
5411 rp = kmalloc(rp_size, GFP_KERNEL);
5412 if (!rp)
5413 return -ENOMEM;
5414
5415 /* All supported features are currently enabled */
5416 enabled = supported;
5417
5418 rp->supported_features = cpu_to_le32(supported);
5419 rp->enabled_features = cpu_to_le32(enabled);
5420 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
5421 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
5422 rp->num_handles = cpu_to_le16(num_handles);
5423 if (num_handles)
5424 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
5425
5426 err = mgmt_cmd_complete(sk, hdev->id,
5427 MGMT_OP_READ_ADV_MONITOR_FEATURES,
5428 MGMT_STATUS_SUCCESS, rp, rp_size);
5429
5430 kfree(rp);
5431
5432 return err;
5433 }
5434
mgmt_add_adv_patterns_monitor_complete(struct hci_dev * hdev,void * data,int status)5435 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
5436 void *data, int status)
5437 {
5438 struct mgmt_rp_add_adv_patterns_monitor rp;
5439 struct mgmt_pending_cmd *cmd = data;
5440 struct adv_monitor *monitor;
5441
5442 /* This is likely the result of hdev being closed and mgmt_index_removed
5443 * is attempting to clean up any pending command so
5444 * hci_adv_monitors_clear is about to be called which will take care of
5445 * freeing the adv_monitor instances.
5446 */
5447 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
5448 return;
5449
5450 monitor = cmd->user_data;
5451
5452 hci_dev_lock(hdev);
5453
5454 rp.monitor_handle = cpu_to_le16(monitor->handle);
5455
5456 if (!status) {
5457 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle);
5458 hdev->adv_monitors_cnt++;
5459 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED)
5460 monitor->state = ADV_MONITOR_STATE_REGISTERED;
5461 hci_update_passive_scan(hdev);
5462 } else {
5463 hci_free_adv_monitor(hdev, monitor);
5464 }
5465
5466 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
5467 mgmt_status(status), &rp, sizeof(rp));
5468 mgmt_pending_free(cmd);
5469
5470 hci_dev_unlock(hdev);
5471 bt_dev_dbg(hdev, "add monitor %d complete, status %d",
5472 rp.monitor_handle, status);
5473 }
5474
mgmt_add_adv_patterns_monitor_sync(struct hci_dev * hdev,void * data)5475 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
5476 {
5477 struct mgmt_pending_cmd *cmd = data;
5478 struct adv_monitor *mon;
5479
5480 mutex_lock(&hdev->mgmt_pending_lock);
5481
5482 if (!__mgmt_pending_listed(hdev, cmd)) {
5483 mutex_unlock(&hdev->mgmt_pending_lock);
5484 return -ECANCELED;
5485 }
5486
5487 mon = cmd->user_data;
5488
5489 mutex_unlock(&hdev->mgmt_pending_lock);
5490
5491 return hci_add_adv_monitor(hdev, mon);
5492 }
5493
__add_adv_patterns_monitor(struct sock * sk,struct hci_dev * hdev,struct adv_monitor * m,u8 status,void * data,u16 len,u16 op)5494 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5495 struct adv_monitor *m, u8 status,
5496 void *data, u16 len, u16 op)
5497 {
5498 struct mgmt_pending_cmd *cmd;
5499 int err;
5500
5501 hci_dev_lock(hdev);
5502
5503 if (status)
5504 goto unlock;
5505
5506 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5507 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5508 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5509 status = MGMT_STATUS_BUSY;
5510 goto unlock;
5511 }
5512
5513 cmd = mgmt_pending_add(sk, op, hdev, data, len);
5514 if (!cmd) {
5515 status = MGMT_STATUS_NO_RESOURCES;
5516 goto unlock;
5517 }
5518
5519 cmd->user_data = m;
5520 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd,
5521 mgmt_add_adv_patterns_monitor_complete);
5522 if (err) {
5523 if (err == -ENOMEM)
5524 status = MGMT_STATUS_NO_RESOURCES;
5525 else
5526 status = MGMT_STATUS_FAILED;
5527
5528 goto unlock;
5529 }
5530
5531 hci_dev_unlock(hdev);
5532
5533 return 0;
5534
5535 unlock:
5536 hci_free_adv_monitor(hdev, m);
5537 hci_dev_unlock(hdev);
5538 return mgmt_cmd_status(sk, hdev->id, op, status);
5539 }
5540
parse_adv_monitor_rssi(struct adv_monitor * m,struct mgmt_adv_rssi_thresholds * rssi)5541 static void parse_adv_monitor_rssi(struct adv_monitor *m,
5542 struct mgmt_adv_rssi_thresholds *rssi)
5543 {
5544 if (rssi) {
5545 m->rssi.low_threshold = rssi->low_threshold;
5546 m->rssi.low_threshold_timeout =
5547 __le16_to_cpu(rssi->low_threshold_timeout);
5548 m->rssi.high_threshold = rssi->high_threshold;
5549 m->rssi.high_threshold_timeout =
5550 __le16_to_cpu(rssi->high_threshold_timeout);
5551 m->rssi.sampling_period = rssi->sampling_period;
5552 } else {
5553 /* Default values. These numbers are the least constricting
5554 * parameters for MSFT API to work, so it behaves as if there
5555 * are no rssi parameter to consider. May need to be changed
5556 * if other API are to be supported.
5557 */
5558 m->rssi.low_threshold = -127;
5559 m->rssi.low_threshold_timeout = 60;
5560 m->rssi.high_threshold = -127;
5561 m->rssi.high_threshold_timeout = 0;
5562 m->rssi.sampling_period = 0;
5563 }
5564 }
5565
parse_adv_monitor_pattern(struct adv_monitor * m,u8 pattern_count,struct mgmt_adv_pattern * patterns)5566 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count,
5567 struct mgmt_adv_pattern *patterns)
5568 {
5569 u8 offset = 0, length = 0;
5570 struct adv_pattern *p = NULL;
5571 int i;
5572
5573 for (i = 0; i < pattern_count; i++) {
5574 offset = patterns[i].offset;
5575 length = patterns[i].length;
5576 if (offset >= HCI_MAX_AD_LENGTH ||
5577 length > HCI_MAX_AD_LENGTH ||
5578 (offset + length) > HCI_MAX_AD_LENGTH)
5579 return MGMT_STATUS_INVALID_PARAMS;
5580
5581 p = kmalloc_obj(*p);
5582 if (!p)
5583 return MGMT_STATUS_NO_RESOURCES;
5584
5585 p->ad_type = patterns[i].ad_type;
5586 p->offset = patterns[i].offset;
5587 p->length = patterns[i].length;
5588 memcpy(p->value, patterns[i].value, p->length);
5589
5590 INIT_LIST_HEAD(&p->list);
5591 list_add(&p->list, &m->patterns);
5592 }
5593
5594 return MGMT_STATUS_SUCCESS;
5595 }
5596
add_adv_patterns_monitor(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5597 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
5598 void *data, u16 len)
5599 {
5600 struct mgmt_cp_add_adv_patterns_monitor *cp = data;
5601 struct adv_monitor *m = NULL;
5602 u8 status = MGMT_STATUS_SUCCESS;
5603 size_t expected_size = sizeof(*cp);
5604
5605 BT_DBG("request for %s", hdev->name);
5606
5607 if (len <= sizeof(*cp)) {
5608 status = MGMT_STATUS_INVALID_PARAMS;
5609 goto done;
5610 }
5611
5612 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5613 if (len != expected_size) {
5614 status = MGMT_STATUS_INVALID_PARAMS;
5615 goto done;
5616 }
5617
5618 m = kzalloc_obj(*m);
5619 if (!m) {
5620 status = MGMT_STATUS_NO_RESOURCES;
5621 goto done;
5622 }
5623
5624 INIT_LIST_HEAD(&m->patterns);
5625
5626 parse_adv_monitor_rssi(m, NULL);
5627 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5628
5629 done:
5630 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5631 MGMT_OP_ADD_ADV_PATTERNS_MONITOR);
5632 }
5633
add_adv_patterns_monitor_rssi(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5634 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev,
5635 void *data, u16 len)
5636 {
5637 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data;
5638 struct adv_monitor *m = NULL;
5639 u8 status = MGMT_STATUS_SUCCESS;
5640 size_t expected_size = sizeof(*cp);
5641
5642 BT_DBG("request for %s", hdev->name);
5643
5644 if (len <= sizeof(*cp)) {
5645 status = MGMT_STATUS_INVALID_PARAMS;
5646 goto done;
5647 }
5648
5649 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern);
5650 if (len != expected_size) {
5651 status = MGMT_STATUS_INVALID_PARAMS;
5652 goto done;
5653 }
5654
5655 m = kzalloc_obj(*m);
5656 if (!m) {
5657 status = MGMT_STATUS_NO_RESOURCES;
5658 goto done;
5659 }
5660
5661 INIT_LIST_HEAD(&m->patterns);
5662
5663 parse_adv_monitor_rssi(m, &cp->rssi);
5664 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns);
5665
5666 done:
5667 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len,
5668 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI);
5669 }
5670
mgmt_remove_adv_monitor_complete(struct hci_dev * hdev,void * data,int status)5671 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
5672 void *data, int status)
5673 {
5674 struct mgmt_rp_remove_adv_monitor rp;
5675 struct mgmt_pending_cmd *cmd = data;
5676 struct mgmt_cp_remove_adv_monitor *cp;
5677
5678 if (status == -ECANCELED)
5679 return;
5680
5681 hci_dev_lock(hdev);
5682
5683 cp = cmd->param;
5684
5685 rp.monitor_handle = cp->monitor_handle;
5686
5687 if (!status) {
5688 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle);
5689 hci_update_passive_scan(hdev);
5690 }
5691
5692 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
5693 mgmt_status(status), &rp, sizeof(rp));
5694 mgmt_pending_free(cmd);
5695
5696 hci_dev_unlock(hdev);
5697 bt_dev_dbg(hdev, "remove monitor %d complete, status %d",
5698 rp.monitor_handle, status);
5699 }
5700
mgmt_remove_adv_monitor_sync(struct hci_dev * hdev,void * data)5701 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
5702 {
5703 struct mgmt_pending_cmd *cmd = data;
5704 struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
5705 u16 handle = __le16_to_cpu(cp->monitor_handle);
5706
5707 if (!handle)
5708 return hci_remove_all_adv_monitor(hdev);
5709
5710 return hci_remove_single_adv_monitor(hdev, handle);
5711 }
5712
remove_adv_monitor(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5713 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
5714 void *data, u16 len)
5715 {
5716 struct mgmt_pending_cmd *cmd;
5717 int err, status;
5718
5719 hci_dev_lock(hdev);
5720
5721 if (pending_find(MGMT_OP_SET_LE, hdev) ||
5722 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) ||
5723 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) {
5724 status = MGMT_STATUS_BUSY;
5725 goto unlock;
5726 }
5727
5728 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len);
5729 if (!cmd) {
5730 status = MGMT_STATUS_NO_RESOURCES;
5731 goto unlock;
5732 }
5733
5734 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd,
5735 mgmt_remove_adv_monitor_complete);
5736
5737 if (err) {
5738 mgmt_pending_free(cmd);
5739
5740 if (err == -ENOMEM)
5741 status = MGMT_STATUS_NO_RESOURCES;
5742 else
5743 status = MGMT_STATUS_FAILED;
5744
5745 goto unlock;
5746 }
5747
5748 hci_dev_unlock(hdev);
5749
5750 return 0;
5751
5752 unlock:
5753 hci_dev_unlock(hdev);
5754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
5755 status);
5756 }
5757
read_local_oob_data_complete(struct hci_dev * hdev,void * data,int err)5758 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data,
5759 int err)
5760 {
5761 struct mgmt_rp_read_local_oob_data mgmt_rp;
5762 size_t rp_size = sizeof(mgmt_rp);
5763 struct mgmt_pending_cmd *cmd = data;
5764 struct sk_buff *skb = cmd->skb;
5765 u8 status = mgmt_status(err);
5766
5767 if (!status) {
5768 if (!skb)
5769 status = MGMT_STATUS_FAILED;
5770 else if (IS_ERR(skb))
5771 status = mgmt_status(PTR_ERR(skb));
5772 else
5773 status = mgmt_status(skb->data[0]);
5774 }
5775
5776 bt_dev_dbg(hdev, "status %d", status);
5777
5778 if (status) {
5779 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5780 status);
5781 goto remove;
5782 }
5783
5784 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
5785
5786 if (!bredr_sc_enabled(hdev)) {
5787 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
5788
5789 if (skb->len < sizeof(*rp)) {
5790 mgmt_cmd_status(cmd->sk, hdev->id,
5791 MGMT_OP_READ_LOCAL_OOB_DATA,
5792 MGMT_STATUS_FAILED);
5793 goto remove;
5794 }
5795
5796 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
5797 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
5798
5799 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
5800 } else {
5801 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
5802
5803 if (skb->len < sizeof(*rp)) {
5804 mgmt_cmd_status(cmd->sk, hdev->id,
5805 MGMT_OP_READ_LOCAL_OOB_DATA,
5806 MGMT_STATUS_FAILED);
5807 goto remove;
5808 }
5809
5810 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
5811 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
5812
5813 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
5814 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
5815 }
5816
5817 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5818 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
5819
5820 remove:
5821 if (skb && !IS_ERR(skb))
5822 kfree_skb(skb);
5823
5824 mgmt_pending_free(cmd);
5825 }
5826
read_local_oob_data_sync(struct hci_dev * hdev,void * data)5827 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data)
5828 {
5829 struct mgmt_pending_cmd *cmd = data;
5830
5831 if (bredr_sc_enabled(hdev))
5832 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk);
5833 else
5834 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk);
5835
5836 if (IS_ERR(cmd->skb))
5837 return PTR_ERR(cmd->skb);
5838 else
5839 return 0;
5840 }
5841
read_local_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)5842 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
5843 void *data, u16 data_len)
5844 {
5845 struct mgmt_pending_cmd *cmd;
5846 int err;
5847
5848 bt_dev_dbg(hdev, "sock %p", sk);
5849
5850 hci_dev_lock(hdev);
5851
5852 if (!hdev_is_powered(hdev)) {
5853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5854 MGMT_STATUS_NOT_POWERED);
5855 goto unlock;
5856 }
5857
5858 if (!lmp_ssp_capable(hdev)) {
5859 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5860 MGMT_STATUS_NOT_SUPPORTED);
5861 goto unlock;
5862 }
5863
5864 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
5865 if (!cmd)
5866 err = -ENOMEM;
5867 else
5868 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
5869 read_local_oob_data_complete);
5870
5871 if (err < 0) {
5872 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5873 MGMT_STATUS_FAILED);
5874
5875 if (cmd)
5876 mgmt_pending_free(cmd);
5877 }
5878
5879 unlock:
5880 hci_dev_unlock(hdev);
5881 return err;
5882 }
5883
add_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5884 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5885 void *data, u16 len)
5886 {
5887 struct mgmt_addr_info *addr = data;
5888 int err;
5889
5890 bt_dev_dbg(hdev, "sock %p", sk);
5891
5892 if (!bdaddr_type_is_valid(addr->type))
5893 return mgmt_cmd_complete(sk, hdev->id,
5894 MGMT_OP_ADD_REMOTE_OOB_DATA,
5895 MGMT_STATUS_INVALID_PARAMS,
5896 addr, sizeof(*addr));
5897
5898 hci_dev_lock(hdev);
5899
5900 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
5901 struct mgmt_cp_add_remote_oob_data *cp = data;
5902 u8 status;
5903
5904 if (cp->addr.type != BDADDR_BREDR) {
5905 err = mgmt_cmd_complete(sk, hdev->id,
5906 MGMT_OP_ADD_REMOTE_OOB_DATA,
5907 MGMT_STATUS_INVALID_PARAMS,
5908 &cp->addr, sizeof(cp->addr));
5909 goto unlock;
5910 }
5911
5912 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5913 cp->addr.type, cp->hash,
5914 cp->rand, NULL, NULL);
5915 if (err < 0)
5916 status = MGMT_STATUS_FAILED;
5917 else
5918 status = MGMT_STATUS_SUCCESS;
5919
5920 err = mgmt_cmd_complete(sk, hdev->id,
5921 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
5922 &cp->addr, sizeof(cp->addr));
5923 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
5924 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
5925 u8 *rand192, *hash192, *rand256, *hash256;
5926 u8 status;
5927
5928 if (bdaddr_type_is_le(cp->addr.type)) {
5929 /* Enforce zero-valued 192-bit parameters as
5930 * long as legacy SMP OOB isn't implemented.
5931 */
5932 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
5933 memcmp(cp->hash192, ZERO_KEY, 16)) {
5934 err = mgmt_cmd_complete(sk, hdev->id,
5935 MGMT_OP_ADD_REMOTE_OOB_DATA,
5936 MGMT_STATUS_INVALID_PARAMS,
5937 addr, sizeof(*addr));
5938 goto unlock;
5939 }
5940
5941 rand192 = NULL;
5942 hash192 = NULL;
5943 } else {
5944 /* In case one of the P-192 values is set to zero,
5945 * then just disable OOB data for P-192.
5946 */
5947 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
5948 !memcmp(cp->hash192, ZERO_KEY, 16)) {
5949 rand192 = NULL;
5950 hash192 = NULL;
5951 } else {
5952 rand192 = cp->rand192;
5953 hash192 = cp->hash192;
5954 }
5955 }
5956
5957 /* In case one of the P-256 values is set to zero, then just
5958 * disable OOB data for P-256.
5959 */
5960 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
5961 !memcmp(cp->hash256, ZERO_KEY, 16)) {
5962 rand256 = NULL;
5963 hash256 = NULL;
5964 } else {
5965 rand256 = cp->rand256;
5966 hash256 = cp->hash256;
5967 }
5968
5969 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
5970 cp->addr.type, hash192, rand192,
5971 hash256, rand256);
5972 if (err < 0)
5973 status = MGMT_STATUS_FAILED;
5974 else
5975 status = MGMT_STATUS_SUCCESS;
5976
5977 err = mgmt_cmd_complete(sk, hdev->id,
5978 MGMT_OP_ADD_REMOTE_OOB_DATA,
5979 status, &cp->addr, sizeof(cp->addr));
5980 } else {
5981 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
5982 len);
5983 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
5984 MGMT_STATUS_INVALID_PARAMS);
5985 }
5986
5987 unlock:
5988 hci_dev_unlock(hdev);
5989 return err;
5990 }
5991
remove_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5992 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
5993 void *data, u16 len)
5994 {
5995 struct mgmt_cp_remove_remote_oob_data *cp = data;
5996 u8 status;
5997 int err;
5998
5999 bt_dev_dbg(hdev, "sock %p", sk);
6000
6001 if (cp->addr.type != BDADDR_BREDR)
6002 return mgmt_cmd_complete(sk, hdev->id,
6003 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
6004 MGMT_STATUS_INVALID_PARAMS,
6005 &cp->addr, sizeof(cp->addr));
6006
6007 hci_dev_lock(hdev);
6008
6009 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6010 hci_remote_oob_data_clear(hdev);
6011 status = MGMT_STATUS_SUCCESS;
6012 goto done;
6013 }
6014
6015 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
6016 if (err < 0)
6017 status = MGMT_STATUS_INVALID_PARAMS;
6018 else
6019 status = MGMT_STATUS_SUCCESS;
6020
6021 done:
6022 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
6023 status, &cp->addr, sizeof(cp->addr));
6024
6025 hci_dev_unlock(hdev);
6026 return err;
6027 }
6028
discovery_type_is_valid(struct hci_dev * hdev,uint8_t type,uint8_t * mgmt_status)6029 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
6030 uint8_t *mgmt_status)
6031 {
6032 switch (type) {
6033 case DISCOV_TYPE_LE:
6034 *mgmt_status = mgmt_le_support(hdev);
6035 if (*mgmt_status)
6036 return false;
6037 break;
6038 case DISCOV_TYPE_INTERLEAVED:
6039 *mgmt_status = mgmt_le_support(hdev);
6040 if (*mgmt_status)
6041 return false;
6042 fallthrough;
6043 case DISCOV_TYPE_BREDR:
6044 *mgmt_status = mgmt_bredr_support(hdev);
6045 if (*mgmt_status)
6046 return false;
6047 break;
6048 default:
6049 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
6050 return false;
6051 }
6052
6053 return true;
6054 }
6055
start_discovery_complete(struct hci_dev * hdev,void * data,int err)6056 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
6057 {
6058 struct mgmt_pending_cmd *cmd = data;
6059
6060 bt_dev_dbg(hdev, "err %d", err);
6061
6062 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
6063 return;
6064
6065 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
6066 cmd->param, 1);
6067 mgmt_pending_free(cmd);
6068
6069 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
6070 DISCOVERY_FINDING);
6071 }
6072
start_discovery_sync(struct hci_dev * hdev,void * data)6073 static int start_discovery_sync(struct hci_dev *hdev, void *data)
6074 {
6075 if (!mgmt_pending_listed(hdev, data))
6076 return -ECANCELED;
6077
6078 return hci_start_discovery_sync(hdev);
6079 }
6080
start_discovery_internal(struct sock * sk,struct hci_dev * hdev,u16 op,void * data,u16 len)6081 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
6082 u16 op, void *data, u16 len)
6083 {
6084 struct mgmt_cp_start_discovery *cp = data;
6085 struct mgmt_pending_cmd *cmd;
6086 u8 status;
6087 int err;
6088
6089 bt_dev_dbg(hdev, "sock %p", sk);
6090
6091 hci_dev_lock(hdev);
6092
6093 if (!hdev_is_powered(hdev)) {
6094 err = mgmt_cmd_complete(sk, hdev->id, op,
6095 MGMT_STATUS_NOT_POWERED,
6096 &cp->type, sizeof(cp->type));
6097 goto failed;
6098 }
6099
6100 if (hdev->discovery.state != DISCOVERY_STOPPED ||
6101 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6102 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
6103 &cp->type, sizeof(cp->type));
6104 goto failed;
6105 }
6106
6107 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6108 err = mgmt_cmd_complete(sk, hdev->id, op, status,
6109 &cp->type, sizeof(cp->type));
6110 goto failed;
6111 }
6112
6113 /* Can't start discovery when it is paused */
6114 if (hdev->discovery_paused) {
6115 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
6116 &cp->type, sizeof(cp->type));
6117 goto failed;
6118 }
6119
6120 /* Clear the discovery filter first to free any previously
6121 * allocated memory for the UUID list.
6122 */
6123 hci_discovery_filter_clear(hdev);
6124
6125 hdev->discovery.type = cp->type;
6126 hdev->discovery.report_invalid_rssi = false;
6127 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
6128 hdev->discovery.limited = true;
6129 else
6130 hdev->discovery.limited = false;
6131
6132 cmd = mgmt_pending_add(sk, op, hdev, data, len);
6133 if (!cmd) {
6134 err = -ENOMEM;
6135 goto failed;
6136 }
6137
6138 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6139 start_discovery_complete);
6140 if (err < 0) {
6141 mgmt_pending_remove(cmd);
6142 goto failed;
6143 }
6144
6145 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6146
6147 failed:
6148 hci_dev_unlock(hdev);
6149 return err;
6150 }
6151
start_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6152 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
6153 void *data, u16 len)
6154 {
6155 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
6156 data, len);
6157 }
6158
start_limited_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6159 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
6160 void *data, u16 len)
6161 {
6162 return start_discovery_internal(sk, hdev,
6163 MGMT_OP_START_LIMITED_DISCOVERY,
6164 data, len);
6165 }
6166
start_service_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6167 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
6168 void *data, u16 len)
6169 {
6170 struct mgmt_cp_start_service_discovery *cp = data;
6171 struct mgmt_pending_cmd *cmd;
6172 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
6173 u16 uuid_count, expected_len;
6174 u8 (*uuids)[16] = NULL;
6175 u8 status;
6176 int err;
6177
6178 bt_dev_dbg(hdev, "sock %p", sk);
6179
6180 hci_dev_lock(hdev);
6181
6182 if (!hdev_is_powered(hdev)) {
6183 err = mgmt_cmd_complete(sk, hdev->id,
6184 MGMT_OP_START_SERVICE_DISCOVERY,
6185 MGMT_STATUS_NOT_POWERED,
6186 &cp->type, sizeof(cp->type));
6187 goto failed;
6188 }
6189
6190 if (hdev->discovery.state != DISCOVERY_STOPPED ||
6191 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
6192 err = mgmt_cmd_complete(sk, hdev->id,
6193 MGMT_OP_START_SERVICE_DISCOVERY,
6194 MGMT_STATUS_BUSY, &cp->type,
6195 sizeof(cp->type));
6196 goto failed;
6197 }
6198
6199 if (hdev->discovery_paused) {
6200 err = mgmt_cmd_complete(sk, hdev->id,
6201 MGMT_OP_START_SERVICE_DISCOVERY,
6202 MGMT_STATUS_BUSY, &cp->type,
6203 sizeof(cp->type));
6204 goto failed;
6205 }
6206
6207 uuid_count = __le16_to_cpu(cp->uuid_count);
6208 if (uuid_count > max_uuid_count) {
6209 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
6210 uuid_count);
6211 err = mgmt_cmd_complete(sk, hdev->id,
6212 MGMT_OP_START_SERVICE_DISCOVERY,
6213 MGMT_STATUS_INVALID_PARAMS, &cp->type,
6214 sizeof(cp->type));
6215 goto failed;
6216 }
6217
6218 expected_len = sizeof(*cp) + uuid_count * 16;
6219 if (expected_len != len) {
6220 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
6221 expected_len, len);
6222 err = mgmt_cmd_complete(sk, hdev->id,
6223 MGMT_OP_START_SERVICE_DISCOVERY,
6224 MGMT_STATUS_INVALID_PARAMS, &cp->type,
6225 sizeof(cp->type));
6226 goto failed;
6227 }
6228
6229 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
6230 err = mgmt_cmd_complete(sk, hdev->id,
6231 MGMT_OP_START_SERVICE_DISCOVERY,
6232 status, &cp->type, sizeof(cp->type));
6233 goto failed;
6234 }
6235
6236 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
6237 hdev, data, len);
6238 if (!cmd) {
6239 err = -ENOMEM;
6240 goto failed;
6241 }
6242
6243 /* Clear the discovery filter first to free any previously
6244 * allocated memory for the UUID list.
6245 */
6246 hci_discovery_filter_clear(hdev);
6247
6248 hdev->discovery.result_filtering = true;
6249 hdev->discovery.type = cp->type;
6250 hdev->discovery.rssi = cp->rssi;
6251
6252 if (uuid_count > 0) {
6253 uuids = kmemdup(cp->uuids, uuid_count * sizeof(*uuids), GFP_KERNEL);
6254 if (!uuids) {
6255 err = mgmt_cmd_complete(sk, hdev->id,
6256 MGMT_OP_START_SERVICE_DISCOVERY,
6257 MGMT_STATUS_FAILED,
6258 &cp->type, sizeof(cp->type));
6259 mgmt_pending_remove(cmd);
6260 goto failed;
6261 }
6262 }
6263
6264 spin_lock(&hdev->discovery.lock);
6265 hdev->discovery.uuids = uuids;
6266 hdev->discovery.uuid_count = uuid_count;
6267 spin_unlock(&hdev->discovery.lock);
6268
6269 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd,
6270 start_discovery_complete);
6271 if (err < 0) {
6272 mgmt_pending_remove(cmd);
6273 goto failed;
6274 }
6275
6276 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6277
6278 failed:
6279 hci_dev_unlock(hdev);
6280 return err;
6281 }
6282
stop_discovery_complete(struct hci_dev * hdev,void * data,int err)6283 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
6284 {
6285 struct mgmt_pending_cmd *cmd = data;
6286
6287 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
6288 return;
6289
6290 bt_dev_dbg(hdev, "err %d", err);
6291
6292 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
6293 cmd->param, 1);
6294 mgmt_pending_free(cmd);
6295
6296 if (!err)
6297 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6298 }
6299
stop_discovery_sync(struct hci_dev * hdev,void * data)6300 static int stop_discovery_sync(struct hci_dev *hdev, void *data)
6301 {
6302 if (!mgmt_pending_listed(hdev, data))
6303 return -ECANCELED;
6304
6305 return hci_stop_discovery_sync(hdev);
6306 }
6307
stop_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6308 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
6309 u16 len)
6310 {
6311 struct mgmt_cp_stop_discovery *mgmt_cp = data;
6312 struct mgmt_pending_cmd *cmd;
6313 int err;
6314
6315 bt_dev_dbg(hdev, "sock %p", sk);
6316
6317 hci_dev_lock(hdev);
6318
6319 if (!hci_discovery_active(hdev)) {
6320 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6321 MGMT_STATUS_REJECTED, &mgmt_cp->type,
6322 sizeof(mgmt_cp->type));
6323 goto unlock;
6324 }
6325
6326 if (hdev->discovery.type != mgmt_cp->type) {
6327 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
6328 MGMT_STATUS_INVALID_PARAMS,
6329 &mgmt_cp->type, sizeof(mgmt_cp->type));
6330 goto unlock;
6331 }
6332
6333 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
6334 if (!cmd) {
6335 err = -ENOMEM;
6336 goto unlock;
6337 }
6338
6339 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd,
6340 stop_discovery_complete);
6341 if (err < 0) {
6342 mgmt_pending_remove(cmd);
6343 goto unlock;
6344 }
6345
6346 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
6347
6348 unlock:
6349 hci_dev_unlock(hdev);
6350 return err;
6351 }
6352
confirm_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6353 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
6354 u16 len)
6355 {
6356 struct mgmt_cp_confirm_name *cp = data;
6357 struct inquiry_entry *e;
6358 int err;
6359
6360 bt_dev_dbg(hdev, "sock %p", sk);
6361
6362 hci_dev_lock(hdev);
6363
6364 if (!hci_discovery_active(hdev)) {
6365 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6366 MGMT_STATUS_FAILED, &cp->addr,
6367 sizeof(cp->addr));
6368 goto failed;
6369 }
6370
6371 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
6372 if (!e) {
6373 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
6374 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
6375 sizeof(cp->addr));
6376 goto failed;
6377 }
6378
6379 if (cp->name_known) {
6380 e->name_state = NAME_KNOWN;
6381 list_del(&e->list);
6382 } else {
6383 e->name_state = NAME_NEEDED;
6384 hci_inquiry_cache_update_resolve(hdev, e);
6385 }
6386
6387 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
6388 &cp->addr, sizeof(cp->addr));
6389
6390 failed:
6391 hci_dev_unlock(hdev);
6392 return err;
6393 }
6394
block_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6395 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
6396 u16 len)
6397 {
6398 struct mgmt_cp_block_device *cp = data;
6399 u8 status;
6400 int err;
6401
6402 bt_dev_dbg(hdev, "sock %p", sk);
6403
6404 if (!bdaddr_type_is_valid(cp->addr.type))
6405 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
6406 MGMT_STATUS_INVALID_PARAMS,
6407 &cp->addr, sizeof(cp->addr));
6408
6409 hci_dev_lock(hdev);
6410
6411 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr,
6412 cp->addr.type);
6413 if (err < 0) {
6414 status = MGMT_STATUS_FAILED;
6415 goto done;
6416 }
6417
6418 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6419 sk);
6420 status = MGMT_STATUS_SUCCESS;
6421
6422 done:
6423 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
6424 &cp->addr, sizeof(cp->addr));
6425
6426 hci_dev_unlock(hdev);
6427
6428 return err;
6429 }
6430
unblock_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6431 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
6432 u16 len)
6433 {
6434 struct mgmt_cp_unblock_device *cp = data;
6435 u8 status;
6436 int err;
6437
6438 bt_dev_dbg(hdev, "sock %p", sk);
6439
6440 if (!bdaddr_type_is_valid(cp->addr.type))
6441 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
6442 MGMT_STATUS_INVALID_PARAMS,
6443 &cp->addr, sizeof(cp->addr));
6444
6445 hci_dev_lock(hdev);
6446
6447 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr,
6448 cp->addr.type);
6449 if (err < 0) {
6450 status = MGMT_STATUS_INVALID_PARAMS;
6451 goto done;
6452 }
6453
6454 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
6455 sk);
6456 status = MGMT_STATUS_SUCCESS;
6457
6458 done:
6459 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
6460 &cp->addr, sizeof(cp->addr));
6461
6462 hci_dev_unlock(hdev);
6463
6464 return err;
6465 }
6466
set_device_id_sync(struct hci_dev * hdev,void * data)6467 static int set_device_id_sync(struct hci_dev *hdev, void *data)
6468 {
6469 return hci_update_eir_sync(hdev);
6470 }
6471
set_device_id(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6472 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
6473 u16 len)
6474 {
6475 struct mgmt_cp_set_device_id *cp = data;
6476 int err;
6477 __u16 source;
6478
6479 bt_dev_dbg(hdev, "sock %p", sk);
6480
6481 source = __le16_to_cpu(cp->source);
6482
6483 if (source > 0x0002)
6484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
6485 MGMT_STATUS_INVALID_PARAMS);
6486
6487 hci_dev_lock(hdev);
6488
6489 hdev->devid_source = source;
6490 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
6491 hdev->devid_product = __le16_to_cpu(cp->product);
6492 hdev->devid_version = __le16_to_cpu(cp->version);
6493
6494 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
6495 NULL, 0);
6496
6497 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL);
6498
6499 hci_dev_unlock(hdev);
6500
6501 return err;
6502 }
6503
enable_advertising_instance(struct hci_dev * hdev,int err)6504 static void enable_advertising_instance(struct hci_dev *hdev, int err)
6505 {
6506 if (err)
6507 bt_dev_err(hdev, "failed to re-configure advertising %d", err);
6508 else
6509 bt_dev_dbg(hdev, "status %d", err);
6510 }
6511
set_advertising_complete(struct hci_dev * hdev,void * data,int err)6512 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
6513 {
6514 struct mgmt_pending_cmd *cmd = data;
6515 struct cmd_lookup match = { NULL, hdev };
6516 u8 instance;
6517 struct adv_info *adv_instance;
6518 u8 status = mgmt_status(err);
6519
6520 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
6521 return;
6522
6523 if (status) {
6524 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
6525 mgmt_pending_free(cmd);
6526 return;
6527 }
6528
6529 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
6530 hci_dev_set_flag(hdev, HCI_ADVERTISING);
6531 else
6532 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6533
6534 settings_rsp(cmd, &match);
6535 mgmt_pending_free(cmd);
6536
6537 new_settings(hdev, match.sk);
6538
6539 if (match.sk)
6540 sock_put(match.sk);
6541
6542 /* If "Set Advertising" was just disabled and instance advertising was
6543 * set up earlier, then re-enable multi-instance advertising.
6544 */
6545 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6546 list_empty(&hdev->adv_instances))
6547 return;
6548
6549 instance = hdev->cur_adv_instance;
6550 if (!instance) {
6551 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
6552 struct adv_info, list);
6553 if (!adv_instance)
6554 return;
6555
6556 instance = adv_instance->instance;
6557 }
6558
6559 err = hci_schedule_adv_instance_sync(hdev, instance, true);
6560
6561 enable_advertising_instance(hdev, err);
6562 }
6563
set_adv_sync(struct hci_dev * hdev,void * data)6564 static int set_adv_sync(struct hci_dev *hdev, void *data)
6565 {
6566 struct mgmt_pending_cmd *cmd = data;
6567 struct mgmt_mode cp;
6568 u8 val;
6569
6570 mutex_lock(&hdev->mgmt_pending_lock);
6571
6572 if (!__mgmt_pending_listed(hdev, cmd)) {
6573 mutex_unlock(&hdev->mgmt_pending_lock);
6574 return -ECANCELED;
6575 }
6576
6577 memcpy(&cp, cmd->param, sizeof(cp));
6578
6579 mutex_unlock(&hdev->mgmt_pending_lock);
6580
6581 val = !!cp.val;
6582
6583 if (cp.val == 0x02)
6584 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6585 else
6586 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6587
6588 cancel_adv_timeout(hdev);
6589
6590 if (val) {
6591 /* Switch to instance "0" for the Set Advertising setting.
6592 * We cannot use update_[adv|scan_rsp]_data() here as the
6593 * HCI_ADVERTISING flag is not yet set.
6594 */
6595 hdev->cur_adv_instance = 0x00;
6596
6597 if (ext_adv_capable(hdev)) {
6598 hci_start_ext_adv_sync(hdev, 0x00);
6599 } else {
6600 hci_update_adv_data_sync(hdev, 0x00);
6601 hci_update_scan_rsp_data_sync(hdev, 0x00);
6602 hci_enable_advertising_sync(hdev);
6603 }
6604 } else {
6605 hci_disable_advertising_sync(hdev);
6606 }
6607
6608 return 0;
6609 }
6610
set_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6611 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
6612 u16 len)
6613 {
6614 struct mgmt_mode *cp = data;
6615 struct mgmt_pending_cmd *cmd;
6616 u8 val, status;
6617 int err;
6618
6619 bt_dev_dbg(hdev, "sock %p", sk);
6620
6621 status = mgmt_le_support(hdev);
6622 if (status)
6623 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6624 status);
6625
6626 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
6627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6628 MGMT_STATUS_INVALID_PARAMS);
6629
6630 if (hdev->advertising_paused)
6631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6632 MGMT_STATUS_BUSY);
6633
6634 hci_dev_lock(hdev);
6635
6636 val = !!cp->val;
6637
6638 /* The following conditions are ones which mean that we should
6639 * not do any HCI communication but directly send a mgmt
6640 * response to user space (after toggling the flag if
6641 * necessary).
6642 */
6643 if (!hdev_is_powered(hdev) ||
6644 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
6645 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
6646 hci_dev_test_flag(hdev, HCI_MESH) ||
6647 hci_conn_num(hdev, LE_LINK) > 0 ||
6648 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6649 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
6650 bool changed;
6651
6652 if (cp->val) {
6653 hdev->cur_adv_instance = 0x00;
6654 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
6655 if (cp->val == 0x02)
6656 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6657 else
6658 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6659 } else {
6660 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
6661 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
6662 }
6663
6664 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
6665 if (err < 0)
6666 goto unlock;
6667
6668 if (changed)
6669 err = new_settings(hdev, sk);
6670
6671 goto unlock;
6672 }
6673
6674 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
6675 pending_find(MGMT_OP_SET_LE, hdev)) {
6676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
6677 MGMT_STATUS_BUSY);
6678 goto unlock;
6679 }
6680
6681 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
6682 if (!cmd)
6683 err = -ENOMEM;
6684 else
6685 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd,
6686 set_advertising_complete);
6687
6688 if (err < 0 && cmd)
6689 mgmt_pending_remove(cmd);
6690
6691 unlock:
6692 hci_dev_unlock(hdev);
6693 return err;
6694 }
6695
set_static_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6696 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
6697 void *data, u16 len)
6698 {
6699 struct mgmt_cp_set_static_address *cp = data;
6700 int err;
6701
6702 bt_dev_dbg(hdev, "sock %p", sk);
6703
6704 if (!lmp_le_capable(hdev))
6705 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6706 MGMT_STATUS_NOT_SUPPORTED);
6707
6708 if (hdev_is_powered(hdev))
6709 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
6710 MGMT_STATUS_REJECTED);
6711
6712 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
6713 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
6714 return mgmt_cmd_status(sk, hdev->id,
6715 MGMT_OP_SET_STATIC_ADDRESS,
6716 MGMT_STATUS_INVALID_PARAMS);
6717
6718 /* Two most significant bits shall be set */
6719 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
6720 return mgmt_cmd_status(sk, hdev->id,
6721 MGMT_OP_SET_STATIC_ADDRESS,
6722 MGMT_STATUS_INVALID_PARAMS);
6723 }
6724
6725 hci_dev_lock(hdev);
6726
6727 bacpy(&hdev->static_addr, &cp->bdaddr);
6728
6729 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
6730 if (err < 0)
6731 goto unlock;
6732
6733 err = new_settings(hdev, sk);
6734
6735 unlock:
6736 hci_dev_unlock(hdev);
6737 return err;
6738 }
6739
set_scan_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6740 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
6741 void *data, u16 len)
6742 {
6743 struct mgmt_cp_set_scan_params *cp = data;
6744 __u16 interval, window;
6745 int err;
6746
6747 bt_dev_dbg(hdev, "sock %p", sk);
6748
6749 if (!lmp_le_capable(hdev))
6750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6751 MGMT_STATUS_NOT_SUPPORTED);
6752
6753 /* Keep allowed ranges in sync with set_mesh() */
6754 interval = __le16_to_cpu(cp->interval);
6755
6756 if (interval < 0x0004 || interval > 0x4000)
6757 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6758 MGMT_STATUS_INVALID_PARAMS);
6759
6760 window = __le16_to_cpu(cp->window);
6761
6762 if (window < 0x0004 || window > 0x4000)
6763 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6764 MGMT_STATUS_INVALID_PARAMS);
6765
6766 if (window > interval)
6767 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
6768 MGMT_STATUS_INVALID_PARAMS);
6769
6770 hci_dev_lock(hdev);
6771
6772 hdev->le_scan_interval = interval;
6773 hdev->le_scan_window = window;
6774
6775 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
6776 NULL, 0);
6777
6778 /* If background scan is running, restart it so new parameters are
6779 * loaded.
6780 */
6781 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6782 hdev->discovery.state == DISCOVERY_STOPPED)
6783 hci_update_passive_scan(hdev);
6784
6785 hci_dev_unlock(hdev);
6786
6787 return err;
6788 }
6789
fast_connectable_complete(struct hci_dev * hdev,void * data,int err)6790 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err)
6791 {
6792 struct mgmt_pending_cmd *cmd = data;
6793
6794 bt_dev_dbg(hdev, "err %d", err);
6795
6796 if (err) {
6797 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6798 mgmt_status(err));
6799 } else {
6800 struct mgmt_mode *cp = cmd->param;
6801
6802 if (cp->val)
6803 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
6804 else
6805 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6806
6807 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6808 new_settings(hdev, cmd->sk);
6809 }
6810
6811 mgmt_pending_free(cmd);
6812 }
6813
write_fast_connectable_sync(struct hci_dev * hdev,void * data)6814 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data)
6815 {
6816 struct mgmt_pending_cmd *cmd = data;
6817 struct mgmt_mode *cp = cmd->param;
6818
6819 return hci_write_fast_connectable_sync(hdev, cp->val);
6820 }
6821
set_fast_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6822 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
6823 void *data, u16 len)
6824 {
6825 struct mgmt_mode *cp = data;
6826 struct mgmt_pending_cmd *cmd;
6827 int err;
6828
6829 bt_dev_dbg(hdev, "sock %p", sk);
6830
6831 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
6832 hdev->hci_ver < BLUETOOTH_VER_1_2)
6833 return mgmt_cmd_status(sk, hdev->id,
6834 MGMT_OP_SET_FAST_CONNECTABLE,
6835 MGMT_STATUS_NOT_SUPPORTED);
6836
6837 if (cp->val != 0x00 && cp->val != 0x01)
6838 return mgmt_cmd_status(sk, hdev->id,
6839 MGMT_OP_SET_FAST_CONNECTABLE,
6840 MGMT_STATUS_INVALID_PARAMS);
6841
6842 hci_dev_lock(hdev);
6843
6844 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
6845 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6846 goto unlock;
6847 }
6848
6849 if (!hdev_is_powered(hdev)) {
6850 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
6851 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
6852 new_settings(hdev, sk);
6853 goto unlock;
6854 }
6855
6856 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data,
6857 len);
6858 if (!cmd)
6859 err = -ENOMEM;
6860 else
6861 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd,
6862 fast_connectable_complete);
6863
6864 if (err < 0) {
6865 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
6866 MGMT_STATUS_FAILED);
6867
6868 if (cmd)
6869 mgmt_pending_free(cmd);
6870 }
6871
6872 unlock:
6873 hci_dev_unlock(hdev);
6874
6875 return err;
6876 }
6877
set_bredr_complete(struct hci_dev * hdev,void * data,int err)6878 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err)
6879 {
6880 struct mgmt_pending_cmd *cmd = data;
6881
6882 bt_dev_dbg(hdev, "err %d", err);
6883
6884 if (err) {
6885 u8 mgmt_err = mgmt_status(err);
6886
6887 /* We need to restore the flag if related HCI commands
6888 * failed.
6889 */
6890 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
6891
6892 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
6893 } else {
6894 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
6895 new_settings(hdev, cmd->sk);
6896 }
6897
6898 mgmt_pending_free(cmd);
6899 }
6900
set_bredr_sync(struct hci_dev * hdev,void * data)6901 static int set_bredr_sync(struct hci_dev *hdev, void *data)
6902 {
6903 int status;
6904
6905 status = hci_write_fast_connectable_sync(hdev, false);
6906
6907 if (!status)
6908 status = hci_update_scan_sync(hdev);
6909
6910 /* Since only the advertising data flags will change, there
6911 * is no need to update the scan response data.
6912 */
6913 if (!status)
6914 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
6915
6916 return status;
6917 }
6918
set_bredr(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)6919 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6920 {
6921 struct mgmt_mode *cp = data;
6922 struct mgmt_pending_cmd *cmd;
6923 int err;
6924
6925 bt_dev_dbg(hdev, "sock %p", sk);
6926
6927 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
6928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6929 MGMT_STATUS_NOT_SUPPORTED);
6930
6931 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
6932 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6933 MGMT_STATUS_REJECTED);
6934
6935 if (cp->val != 0x00 && cp->val != 0x01)
6936 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6937 MGMT_STATUS_INVALID_PARAMS);
6938
6939 hci_dev_lock(hdev);
6940
6941 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
6942 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6943 goto unlock;
6944 }
6945
6946 if (!hdev_is_powered(hdev)) {
6947 if (!cp->val) {
6948 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
6949 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
6950 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
6951 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
6952 }
6953
6954 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
6955
6956 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
6957 if (err < 0)
6958 goto unlock;
6959
6960 err = new_settings(hdev, sk);
6961 goto unlock;
6962 }
6963
6964 /* Reject disabling when powered on */
6965 if (!cp->val) {
6966 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6967 MGMT_STATUS_REJECTED);
6968 goto unlock;
6969 } else {
6970 /* When configuring a dual-mode controller to operate
6971 * with LE only and using a static address, then switching
6972 * BR/EDR back on is not allowed.
6973 *
6974 * Dual-mode controllers shall operate with the public
6975 * address as its identity address for BR/EDR and LE. So
6976 * reject the attempt to create an invalid configuration.
6977 *
6978 * The same restrictions applies when secure connections
6979 * has been enabled. For BR/EDR this is a controller feature
6980 * while for LE it is a host stack feature. This means that
6981 * switching BR/EDR back on when secure connections has been
6982 * enabled is not a supported transaction.
6983 */
6984 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6985 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
6986 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
6987 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
6988 MGMT_STATUS_REJECTED);
6989 goto unlock;
6990 }
6991 }
6992
6993 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len);
6994 if (!cmd)
6995 err = -ENOMEM;
6996 else
6997 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd,
6998 set_bredr_complete);
6999
7000 if (err < 0) {
7001 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
7002 MGMT_STATUS_FAILED);
7003 if (cmd)
7004 mgmt_pending_free(cmd);
7005
7006 goto unlock;
7007 }
7008
7009 /* We need to flip the bit already here so that
7010 * hci_req_update_adv_data generates the correct flags.
7011 */
7012 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
7013
7014 unlock:
7015 hci_dev_unlock(hdev);
7016 return err;
7017 }
7018
set_secure_conn_complete(struct hci_dev * hdev,void * data,int err)7019 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err)
7020 {
7021 struct mgmt_pending_cmd *cmd = data;
7022 struct mgmt_mode *cp;
7023
7024 bt_dev_dbg(hdev, "err %d", err);
7025
7026 if (err) {
7027 u8 mgmt_err = mgmt_status(err);
7028
7029 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
7030 goto done;
7031 }
7032
7033 cp = cmd->param;
7034
7035 switch (cp->val) {
7036 case 0x00:
7037 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
7038 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7039 break;
7040 case 0x01:
7041 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7042 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7043 break;
7044 case 0x02:
7045 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7046 hci_dev_set_flag(hdev, HCI_SC_ONLY);
7047 break;
7048 }
7049
7050 send_settings_rsp(cmd->sk, cmd->opcode, hdev);
7051 new_settings(hdev, cmd->sk);
7052
7053 done:
7054 mgmt_pending_free(cmd);
7055 }
7056
set_secure_conn_sync(struct hci_dev * hdev,void * data)7057 static int set_secure_conn_sync(struct hci_dev *hdev, void *data)
7058 {
7059 struct mgmt_pending_cmd *cmd = data;
7060 struct mgmt_mode *cp = cmd->param;
7061 u8 val = !!cp->val;
7062
7063 /* Force write of val */
7064 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
7065
7066 return hci_write_sc_support_sync(hdev, val);
7067 }
7068
set_secure_conn(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7069 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
7070 void *data, u16 len)
7071 {
7072 struct mgmt_mode *cp = data;
7073 struct mgmt_pending_cmd *cmd;
7074 u8 val;
7075 int err;
7076
7077 bt_dev_dbg(hdev, "sock %p", sk);
7078
7079 if (!lmp_sc_capable(hdev) &&
7080 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
7081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7082 MGMT_STATUS_NOT_SUPPORTED);
7083
7084 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7085 lmp_sc_capable(hdev) &&
7086 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
7087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7088 MGMT_STATUS_REJECTED);
7089
7090 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
7091 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7092 MGMT_STATUS_INVALID_PARAMS);
7093
7094 hci_dev_lock(hdev);
7095
7096 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
7097 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
7098 bool changed;
7099
7100 if (cp->val) {
7101 changed = !hci_dev_test_and_set_flag(hdev,
7102 HCI_SC_ENABLED);
7103 if (cp->val == 0x02)
7104 hci_dev_set_flag(hdev, HCI_SC_ONLY);
7105 else
7106 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7107 } else {
7108 changed = hci_dev_test_and_clear_flag(hdev,
7109 HCI_SC_ENABLED);
7110 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
7111 }
7112
7113 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
7114 if (err < 0)
7115 goto failed;
7116
7117 if (changed)
7118 err = new_settings(hdev, sk);
7119
7120 goto failed;
7121 }
7122
7123 val = !!cp->val;
7124
7125 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7126 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
7127 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
7128 goto failed;
7129 }
7130
7131 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
7132 if (!cmd)
7133 err = -ENOMEM;
7134 else
7135 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd,
7136 set_secure_conn_complete);
7137
7138 if (err < 0) {
7139 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
7140 MGMT_STATUS_FAILED);
7141 if (cmd)
7142 mgmt_pending_free(cmd);
7143 }
7144
7145 failed:
7146 hci_dev_unlock(hdev);
7147 return err;
7148 }
7149
set_debug_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7150 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
7151 void *data, u16 len)
7152 {
7153 struct mgmt_mode *cp = data;
7154 bool changed, use_changed;
7155 int err;
7156
7157 bt_dev_dbg(hdev, "sock %p", sk);
7158
7159 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
7160 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
7161 MGMT_STATUS_INVALID_PARAMS);
7162
7163 hci_dev_lock(hdev);
7164
7165 if (cp->val)
7166 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
7167 else
7168 changed = hci_dev_test_and_clear_flag(hdev,
7169 HCI_KEEP_DEBUG_KEYS);
7170
7171 if (cp->val == 0x02)
7172 use_changed = !hci_dev_test_and_set_flag(hdev,
7173 HCI_USE_DEBUG_KEYS);
7174 else
7175 use_changed = hci_dev_test_and_clear_flag(hdev,
7176 HCI_USE_DEBUG_KEYS);
7177
7178 if (hdev_is_powered(hdev) && use_changed &&
7179 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7180 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
7181 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
7182 sizeof(mode), &mode);
7183 }
7184
7185 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
7186 if (err < 0)
7187 goto unlock;
7188
7189 if (changed)
7190 err = new_settings(hdev, sk);
7191
7192 unlock:
7193 hci_dev_unlock(hdev);
7194 return err;
7195 }
7196
set_privacy(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7197 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7198 u16 len)
7199 {
7200 struct mgmt_cp_set_privacy *cp = cp_data;
7201 bool changed;
7202 int err;
7203
7204 bt_dev_dbg(hdev, "sock %p", sk);
7205
7206 if (!lmp_le_capable(hdev))
7207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7208 MGMT_STATUS_NOT_SUPPORTED);
7209
7210 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
7211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7212 MGMT_STATUS_INVALID_PARAMS);
7213
7214 if (hdev_is_powered(hdev))
7215 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
7216 MGMT_STATUS_REJECTED);
7217
7218 hci_dev_lock(hdev);
7219
7220 /* If user space supports this command it is also expected to
7221 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
7222 */
7223 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7224
7225 if (cp->privacy) {
7226 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
7227 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
7228 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7229 hci_adv_instances_set_rpa_expired(hdev, true);
7230 if (cp->privacy == 0x02)
7231 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
7232 else
7233 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7234 } else {
7235 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
7236 memset(hdev->irk, 0, sizeof(hdev->irk));
7237 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
7238 hci_adv_instances_set_rpa_expired(hdev, false);
7239 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
7240 }
7241
7242 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
7243 if (err < 0)
7244 goto unlock;
7245
7246 if (changed)
7247 err = new_settings(hdev, sk);
7248
7249 unlock:
7250 hci_dev_unlock(hdev);
7251 return err;
7252 }
7253
irk_is_valid(struct mgmt_irk_info * irk)7254 static bool irk_is_valid(struct mgmt_irk_info *irk)
7255 {
7256 switch (irk->addr.type) {
7257 case BDADDR_LE_PUBLIC:
7258 return true;
7259
7260 case BDADDR_LE_RANDOM:
7261 /* Two most significant bits shall be set */
7262 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7263 return false;
7264 return true;
7265 }
7266
7267 return false;
7268 }
7269
load_irks(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7270 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
7271 u16 len)
7272 {
7273 struct mgmt_cp_load_irks *cp = cp_data;
7274 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
7275 sizeof(struct mgmt_irk_info));
7276 u16 irk_count, expected_len;
7277 int i, err;
7278
7279 bt_dev_dbg(hdev, "sock %p", sk);
7280
7281 if (!lmp_le_capable(hdev))
7282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7283 MGMT_STATUS_NOT_SUPPORTED);
7284
7285 irk_count = __le16_to_cpu(cp->irk_count);
7286 if (irk_count > max_irk_count) {
7287 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
7288 irk_count);
7289 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7290 MGMT_STATUS_INVALID_PARAMS);
7291 }
7292
7293 expected_len = struct_size(cp, irks, irk_count);
7294 if (expected_len != len) {
7295 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
7296 expected_len, len);
7297 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
7298 MGMT_STATUS_INVALID_PARAMS);
7299 }
7300
7301 bt_dev_dbg(hdev, "irk_count %u", irk_count);
7302
7303 for (i = 0; i < irk_count; i++) {
7304 struct mgmt_irk_info *key = &cp->irks[i];
7305
7306 if (!irk_is_valid(key))
7307 return mgmt_cmd_status(sk, hdev->id,
7308 MGMT_OP_LOAD_IRKS,
7309 MGMT_STATUS_INVALID_PARAMS);
7310 }
7311
7312 hci_dev_lock(hdev);
7313
7314 hci_smp_irks_clear(hdev);
7315
7316 for (i = 0; i < irk_count; i++) {
7317 struct mgmt_irk_info *irk = &cp->irks[i];
7318
7319 if (hci_is_blocked_key(hdev,
7320 HCI_BLOCKED_KEY_TYPE_IRK,
7321 irk->val)) {
7322 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
7323 &irk->addr.bdaddr);
7324 continue;
7325 }
7326
7327 hci_add_irk(hdev, &irk->addr.bdaddr,
7328 le_addr_type(irk->addr.type), irk->val,
7329 BDADDR_ANY);
7330 }
7331
7332 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
7333
7334 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
7335
7336 hci_dev_unlock(hdev);
7337
7338 return err;
7339 }
7340
ltk_is_valid(struct mgmt_ltk_info * key)7341 static bool ltk_is_valid(struct mgmt_ltk_info *key)
7342 {
7343 if (key->initiator != 0x00 && key->initiator != 0x01)
7344 return false;
7345
7346 if (key->enc_size > sizeof(key->val))
7347 return false;
7348
7349 switch (key->addr.type) {
7350 case BDADDR_LE_PUBLIC:
7351 return true;
7352
7353 case BDADDR_LE_RANDOM:
7354 /* Two most significant bits shall be set */
7355 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
7356 return false;
7357 return true;
7358 }
7359
7360 return false;
7361 }
7362
load_long_term_keys(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)7363 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
7364 void *cp_data, u16 len)
7365 {
7366 struct mgmt_cp_load_long_term_keys *cp = cp_data;
7367 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
7368 sizeof(struct mgmt_ltk_info));
7369 u16 key_count, expected_len;
7370 int i, err;
7371
7372 bt_dev_dbg(hdev, "sock %p", sk);
7373
7374 if (!lmp_le_capable(hdev))
7375 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7376 MGMT_STATUS_NOT_SUPPORTED);
7377
7378 key_count = __le16_to_cpu(cp->key_count);
7379 if (key_count > max_key_count) {
7380 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
7381 key_count);
7382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7383 MGMT_STATUS_INVALID_PARAMS);
7384 }
7385
7386 expected_len = struct_size(cp, keys, key_count);
7387 if (expected_len != len) {
7388 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
7389 expected_len, len);
7390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
7391 MGMT_STATUS_INVALID_PARAMS);
7392 }
7393
7394 bt_dev_dbg(hdev, "key_count %u", key_count);
7395
7396 hci_dev_lock(hdev);
7397
7398 hci_smp_ltks_clear(hdev);
7399
7400 for (i = 0; i < key_count; i++) {
7401 struct mgmt_ltk_info *key = &cp->keys[i];
7402 u8 type, authenticated;
7403
7404 if (hci_is_blocked_key(hdev,
7405 HCI_BLOCKED_KEY_TYPE_LTK,
7406 key->val)) {
7407 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
7408 &key->addr.bdaddr);
7409 continue;
7410 }
7411
7412 if (!ltk_is_valid(key)) {
7413 bt_dev_warn(hdev, "Invalid LTK for %pMR",
7414 &key->addr.bdaddr);
7415 continue;
7416 }
7417
7418 switch (key->type) {
7419 case MGMT_LTK_UNAUTHENTICATED:
7420 authenticated = 0x00;
7421 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7422 break;
7423 case MGMT_LTK_AUTHENTICATED:
7424 authenticated = 0x01;
7425 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER;
7426 break;
7427 case MGMT_LTK_P256_UNAUTH:
7428 authenticated = 0x00;
7429 type = SMP_LTK_P256;
7430 break;
7431 case MGMT_LTK_P256_AUTH:
7432 authenticated = 0x01;
7433 type = SMP_LTK_P256;
7434 break;
7435 case MGMT_LTK_P256_DEBUG:
7436 authenticated = 0x00;
7437 type = SMP_LTK_P256_DEBUG;
7438 fallthrough;
7439 default:
7440 continue;
7441 }
7442
7443 hci_add_ltk(hdev, &key->addr.bdaddr,
7444 le_addr_type(key->addr.type), type, authenticated,
7445 key->val, key->enc_size, key->ediv, key->rand);
7446 }
7447
7448 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
7449 NULL, 0);
7450
7451 hci_dev_unlock(hdev);
7452
7453 return err;
7454 }
7455
get_conn_info_complete(struct hci_dev * hdev,void * data,int err)7456 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)
7457 {
7458 struct mgmt_pending_cmd *cmd = data;
7459 struct hci_conn *conn = cmd->user_data;
7460 struct mgmt_cp_get_conn_info *cp = cmd->param;
7461 struct mgmt_rp_get_conn_info rp;
7462 u8 status;
7463
7464 bt_dev_dbg(hdev, "err %d", err);
7465
7466 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
7467
7468 status = mgmt_status(err);
7469 if (status == MGMT_STATUS_SUCCESS) {
7470 rp.rssi = conn->rssi;
7471 rp.tx_power = conn->tx_power;
7472 rp.max_tx_power = conn->max_tx_power;
7473 } else {
7474 rp.rssi = HCI_RSSI_INVALID;
7475 rp.tx_power = HCI_TX_POWER_INVALID;
7476 rp.max_tx_power = HCI_TX_POWER_INVALID;
7477 }
7478
7479 if (conn)
7480 hci_conn_put(conn);
7481
7482 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status,
7483 &rp, sizeof(rp));
7484
7485 mgmt_pending_free(cmd);
7486 }
7487
get_conn_info_sync(struct hci_dev * hdev,void * data)7488 static int get_conn_info_sync(struct hci_dev *hdev, void *data)
7489 {
7490 struct mgmt_pending_cmd *cmd = data;
7491 struct mgmt_cp_get_conn_info *cp = cmd->param;
7492 struct hci_conn *conn;
7493 int err;
7494 __le16 handle;
7495
7496 hci_dev_lock(hdev);
7497
7498 /* Make sure we are still connected */
7499 if (cp->addr.type == BDADDR_BREDR)
7500 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7501 &cp->addr.bdaddr);
7502 else
7503 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7504
7505 if (!conn || conn->state != BT_CONNECTED) {
7506 hci_dev_unlock(hdev);
7507 return MGMT_STATUS_NOT_CONNECTED;
7508 }
7509
7510 cmd->user_data = hci_conn_get(conn);
7511 handle = cpu_to_le16(conn->handle);
7512
7513 hci_dev_unlock(hdev);
7514
7515 /* Refresh RSSI each time */
7516 err = hci_read_rssi_sync(hdev, handle);
7517
7518 /* For LE links TX power does not change thus we don't need to
7519 * query for it once value is known.
7520 */
7521 if (!err && (!bdaddr_type_is_le(cp->addr.type) ||
7522 conn->tx_power == HCI_TX_POWER_INVALID))
7523 err = hci_read_tx_power_sync(hdev, handle, 0x00);
7524
7525 /* Max TX power needs to be read only once per connection */
7526 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID)
7527 err = hci_read_tx_power_sync(hdev, handle, 0x01);
7528
7529 return err;
7530 }
7531
get_conn_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7532 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
7533 u16 len)
7534 {
7535 struct mgmt_cp_get_conn_info *cp = data;
7536 struct mgmt_rp_get_conn_info rp;
7537 struct hci_conn *conn;
7538 unsigned long conn_info_age;
7539 int err = 0;
7540
7541 bt_dev_dbg(hdev, "sock %p", sk);
7542
7543 memset(&rp, 0, sizeof(rp));
7544 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7545 rp.addr.type = cp->addr.type;
7546
7547 if (!bdaddr_type_is_valid(cp->addr.type))
7548 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7549 MGMT_STATUS_INVALID_PARAMS,
7550 &rp, sizeof(rp));
7551
7552 hci_dev_lock(hdev);
7553
7554 if (!hdev_is_powered(hdev)) {
7555 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7556 MGMT_STATUS_NOT_POWERED, &rp,
7557 sizeof(rp));
7558 goto unlock;
7559 }
7560
7561 if (cp->addr.type == BDADDR_BREDR)
7562 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7563 &cp->addr.bdaddr);
7564 else
7565 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
7566
7567 if (!conn || conn->state != BT_CONNECTED) {
7568 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7569 MGMT_STATUS_NOT_CONNECTED, &rp,
7570 sizeof(rp));
7571 goto unlock;
7572 }
7573
7574 /* To avoid client trying to guess when to poll again for information we
7575 * calculate conn info age as random value between min/max set in hdev.
7576 */
7577 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age,
7578 hdev->conn_info_max_age - 1);
7579
7580 /* Query controller to refresh cached values if they are too old or were
7581 * never read.
7582 */
7583 if (time_after(jiffies, conn->conn_info_timestamp +
7584 msecs_to_jiffies(conn_info_age)) ||
7585 !conn->conn_info_timestamp) {
7586 struct mgmt_pending_cmd *cmd;
7587
7588 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data,
7589 len);
7590 if (!cmd) {
7591 err = -ENOMEM;
7592 } else {
7593 err = hci_cmd_sync_queue(hdev, get_conn_info_sync,
7594 cmd, get_conn_info_complete);
7595 }
7596
7597 if (err < 0) {
7598 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7599 MGMT_STATUS_FAILED, &rp, sizeof(rp));
7600
7601 if (cmd)
7602 mgmt_pending_free(cmd);
7603
7604 goto unlock;
7605 }
7606
7607 conn->conn_info_timestamp = jiffies;
7608 } else {
7609 /* Cache is valid, just reply with values cached in hci_conn */
7610 rp.rssi = conn->rssi;
7611 rp.tx_power = conn->tx_power;
7612 rp.max_tx_power = conn->max_tx_power;
7613
7614 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
7615 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7616 }
7617
7618 unlock:
7619 hci_dev_unlock(hdev);
7620 return err;
7621 }
7622
get_clock_info_complete(struct hci_dev * hdev,void * data,int err)7623 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err)
7624 {
7625 struct mgmt_pending_cmd *cmd = data;
7626 struct mgmt_cp_get_clock_info *cp = cmd->param;
7627 struct mgmt_rp_get_clock_info rp;
7628 struct hci_conn *conn = cmd->user_data;
7629 u8 status = mgmt_status(err);
7630
7631 bt_dev_dbg(hdev, "err %d", err);
7632
7633 memset(&rp, 0, sizeof(rp));
7634 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7635 rp.addr.type = cp->addr.type;
7636
7637 if (err)
7638 goto complete;
7639
7640 rp.local_clock = cpu_to_le32(hdev->clock);
7641
7642 if (conn) {
7643 rp.piconet_clock = cpu_to_le32(conn->clock);
7644 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
7645 }
7646
7647 complete:
7648 if (conn)
7649 hci_conn_put(conn);
7650
7651 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp,
7652 sizeof(rp));
7653
7654 mgmt_pending_free(cmd);
7655 }
7656
get_clock_info_sync(struct hci_dev * hdev,void * data)7657 static int get_clock_info_sync(struct hci_dev *hdev, void *data)
7658 {
7659 struct mgmt_pending_cmd *cmd = data;
7660 struct mgmt_cp_get_clock_info *cp = cmd->param;
7661 struct hci_cp_read_clock hci_cp;
7662 struct hci_conn *conn;
7663
7664 memset(&hci_cp, 0, sizeof(hci_cp));
7665 hci_read_clock_sync(hdev, &hci_cp);
7666
7667 hci_dev_lock(hdev);
7668
7669 /* Make sure connection still exists */
7670 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
7671 if (!conn || conn->state != BT_CONNECTED) {
7672 hci_dev_unlock(hdev);
7673 return MGMT_STATUS_NOT_CONNECTED;
7674 }
7675
7676 cmd->user_data = hci_conn_get(conn);
7677 hci_cp.handle = cpu_to_le16(conn->handle);
7678 hci_cp.which = 0x01; /* Piconet clock */
7679
7680 hci_dev_unlock(hdev);
7681
7682 return hci_read_clock_sync(hdev, &hci_cp);
7683 }
7684
get_clock_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7685 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
7686 u16 len)
7687 {
7688 struct mgmt_cp_get_clock_info *cp = data;
7689 struct mgmt_rp_get_clock_info rp;
7690 struct mgmt_pending_cmd *cmd;
7691 struct hci_conn *conn;
7692 int err;
7693
7694 bt_dev_dbg(hdev, "sock %p", sk);
7695
7696 memset(&rp, 0, sizeof(rp));
7697 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
7698 rp.addr.type = cp->addr.type;
7699
7700 if (cp->addr.type != BDADDR_BREDR)
7701 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7702 MGMT_STATUS_INVALID_PARAMS,
7703 &rp, sizeof(rp));
7704
7705 hci_dev_lock(hdev);
7706
7707 if (!hdev_is_powered(hdev)) {
7708 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7709 MGMT_STATUS_NOT_POWERED, &rp,
7710 sizeof(rp));
7711 goto unlock;
7712 }
7713
7714 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7715 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
7716 &cp->addr.bdaddr);
7717 if (!conn || conn->state != BT_CONNECTED) {
7718 err = mgmt_cmd_complete(sk, hdev->id,
7719 MGMT_OP_GET_CLOCK_INFO,
7720 MGMT_STATUS_NOT_CONNECTED,
7721 &rp, sizeof(rp));
7722 goto unlock;
7723 }
7724 } else {
7725 conn = NULL;
7726 }
7727
7728 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
7729 if (!cmd)
7730 err = -ENOMEM;
7731 else
7732 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd,
7733 get_clock_info_complete);
7734
7735 if (err < 0) {
7736 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
7737 MGMT_STATUS_FAILED, &rp, sizeof(rp));
7738
7739 if (cmd)
7740 mgmt_pending_free(cmd);
7741 }
7742
7743
7744 unlock:
7745 hci_dev_unlock(hdev);
7746 return err;
7747 }
7748
device_added(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type,u8 action)7749 static void device_added(struct sock *sk, struct hci_dev *hdev,
7750 bdaddr_t *bdaddr, u8 type, u8 action)
7751 {
7752 struct mgmt_ev_device_added ev;
7753
7754 bacpy(&ev.addr.bdaddr, bdaddr);
7755 ev.addr.type = type;
7756 ev.action = action;
7757
7758 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
7759 }
7760
add_device_complete(struct hci_dev * hdev,void * data,int err)7761 static void add_device_complete(struct hci_dev *hdev, void *data, int err)
7762 {
7763 struct mgmt_pending_cmd *cmd = data;
7764 struct mgmt_cp_add_device *cp = cmd->param;
7765
7766 if (!err) {
7767 struct hci_conn_params *params;
7768
7769 hci_dev_lock(hdev);
7770
7771 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7772 le_addr_type(cp->addr.type));
7773
7774 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type,
7775 cp->action);
7776 device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
7777 cp->addr.type, hdev->conn_flags,
7778 params ? params->flags : 0);
7779 hci_dev_unlock(hdev);
7780 }
7781
7782 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE,
7783 mgmt_status(err), &cp->addr, sizeof(cp->addr));
7784 mgmt_pending_free(cmd);
7785 }
7786
add_device_sync(struct hci_dev * hdev,void * data)7787 static int add_device_sync(struct hci_dev *hdev, void *data)
7788 {
7789 return hci_update_passive_scan_sync(hdev);
7790 }
7791
add_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7792 static int add_device(struct sock *sk, struct hci_dev *hdev,
7793 void *data, u16 len)
7794 {
7795 struct mgmt_pending_cmd *cmd;
7796 struct mgmt_cp_add_device *cp = data;
7797 u8 auto_conn, addr_type;
7798 struct hci_conn_params *params;
7799 int err;
7800 u32 current_flags = 0;
7801 u32 supported_flags;
7802
7803 bt_dev_dbg(hdev, "sock %p", sk);
7804
7805 if (!bdaddr_type_is_valid(cp->addr.type) ||
7806 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
7807 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7808 MGMT_STATUS_INVALID_PARAMS,
7809 &cp->addr, sizeof(cp->addr));
7810
7811 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
7812 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7813 MGMT_STATUS_INVALID_PARAMS,
7814 &cp->addr, sizeof(cp->addr));
7815
7816 hci_dev_lock(hdev);
7817
7818 if (cp->addr.type == BDADDR_BREDR) {
7819 /* Only incoming connections action is supported for now */
7820 if (cp->action != 0x01) {
7821 err = mgmt_cmd_complete(sk, hdev->id,
7822 MGMT_OP_ADD_DEVICE,
7823 MGMT_STATUS_INVALID_PARAMS,
7824 &cp->addr, sizeof(cp->addr));
7825 goto unlock;
7826 }
7827
7828 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list,
7829 &cp->addr.bdaddr,
7830 cp->addr.type, 0);
7831 if (err)
7832 goto unlock;
7833
7834 hci_update_scan(hdev);
7835
7836 goto added;
7837 }
7838
7839 addr_type = le_addr_type(cp->addr.type);
7840
7841 if (cp->action == 0x02)
7842 auto_conn = HCI_AUTO_CONN_ALWAYS;
7843 else if (cp->action == 0x01)
7844 auto_conn = HCI_AUTO_CONN_DIRECT;
7845 else
7846 auto_conn = HCI_AUTO_CONN_REPORT;
7847
7848 /* Kernel internally uses conn_params with resolvable private
7849 * address, but Add Device allows only identity addresses.
7850 * Make sure it is enforced before calling
7851 * hci_conn_params_lookup.
7852 */
7853 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7854 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7855 MGMT_STATUS_INVALID_PARAMS,
7856 &cp->addr, sizeof(cp->addr));
7857 goto unlock;
7858 }
7859
7860 /* If the connection parameters don't exist for this device,
7861 * they will be created and configured with defaults.
7862 */
7863 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
7864 auto_conn);
7865 if (!params) {
7866 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7867 MGMT_STATUS_FAILED, &cp->addr,
7868 sizeof(cp->addr));
7869 goto unlock;
7870 }
7871
7872 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
7873 if (!cmd) {
7874 err = -ENOMEM;
7875 goto unlock;
7876 }
7877
7878 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd,
7879 add_device_complete);
7880 if (err < 0) {
7881 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7882 MGMT_STATUS_FAILED, &cp->addr,
7883 sizeof(cp->addr));
7884 mgmt_pending_free(cmd);
7885 }
7886
7887 goto unlock;
7888
7889 added:
7890 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
7891 supported_flags = hdev->conn_flags;
7892 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
7893 supported_flags, current_flags);
7894
7895 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
7896 MGMT_STATUS_SUCCESS, &cp->addr,
7897 sizeof(cp->addr));
7898
7899 unlock:
7900 hci_dev_unlock(hdev);
7901 return err;
7902 }
7903
device_removed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)7904 static void device_removed(struct sock *sk, struct hci_dev *hdev,
7905 bdaddr_t *bdaddr, u8 type)
7906 {
7907 struct mgmt_ev_device_removed ev;
7908
7909 bacpy(&ev.addr.bdaddr, bdaddr);
7910 ev.addr.type = type;
7911
7912 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
7913 }
7914
remove_device_sync(struct hci_dev * hdev,void * data)7915 static int remove_device_sync(struct hci_dev *hdev, void *data)
7916 {
7917 return hci_update_passive_scan_sync(hdev);
7918 }
7919
remove_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)7920 static int remove_device(struct sock *sk, struct hci_dev *hdev,
7921 void *data, u16 len)
7922 {
7923 struct mgmt_cp_remove_device *cp = data;
7924 int err;
7925
7926 bt_dev_dbg(hdev, "sock %p", sk);
7927
7928 hci_dev_lock(hdev);
7929
7930 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
7931 struct hci_conn_params *params;
7932 u8 addr_type;
7933
7934 if (!bdaddr_type_is_valid(cp->addr.type)) {
7935 err = mgmt_cmd_complete(sk, hdev->id,
7936 MGMT_OP_REMOVE_DEVICE,
7937 MGMT_STATUS_INVALID_PARAMS,
7938 &cp->addr, sizeof(cp->addr));
7939 goto unlock;
7940 }
7941
7942 if (cp->addr.type == BDADDR_BREDR) {
7943 err = hci_bdaddr_list_del(&hdev->accept_list,
7944 &cp->addr.bdaddr,
7945 cp->addr.type);
7946 if (err) {
7947 err = mgmt_cmd_complete(sk, hdev->id,
7948 MGMT_OP_REMOVE_DEVICE,
7949 MGMT_STATUS_INVALID_PARAMS,
7950 &cp->addr,
7951 sizeof(cp->addr));
7952 goto unlock;
7953 }
7954
7955 hci_update_scan(hdev);
7956
7957 device_removed(sk, hdev, &cp->addr.bdaddr,
7958 cp->addr.type);
7959 goto complete;
7960 }
7961
7962 addr_type = le_addr_type(cp->addr.type);
7963
7964 /* Kernel internally uses conn_params with resolvable private
7965 * address, but Remove Device allows only identity addresses.
7966 * Make sure it is enforced before calling
7967 * hci_conn_params_lookup.
7968 */
7969 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
7970 err = mgmt_cmd_complete(sk, hdev->id,
7971 MGMT_OP_REMOVE_DEVICE,
7972 MGMT_STATUS_INVALID_PARAMS,
7973 &cp->addr, sizeof(cp->addr));
7974 goto unlock;
7975 }
7976
7977 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
7978 addr_type);
7979 if (!params) {
7980 err = mgmt_cmd_complete(sk, hdev->id,
7981 MGMT_OP_REMOVE_DEVICE,
7982 MGMT_STATUS_INVALID_PARAMS,
7983 &cp->addr, sizeof(cp->addr));
7984 goto unlock;
7985 }
7986
7987 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
7988 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
7989 err = mgmt_cmd_complete(sk, hdev->id,
7990 MGMT_OP_REMOVE_DEVICE,
7991 MGMT_STATUS_INVALID_PARAMS,
7992 &cp->addr, sizeof(cp->addr));
7993 goto unlock;
7994 }
7995
7996 hci_conn_params_free(params);
7997
7998 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
7999 } else {
8000 struct hci_conn_params *p, *tmp;
8001 struct bdaddr_list *b, *btmp;
8002
8003 if (cp->addr.type) {
8004 err = mgmt_cmd_complete(sk, hdev->id,
8005 MGMT_OP_REMOVE_DEVICE,
8006 MGMT_STATUS_INVALID_PARAMS,
8007 &cp->addr, sizeof(cp->addr));
8008 goto unlock;
8009 }
8010
8011 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) {
8012 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
8013 list_del(&b->list);
8014 kfree(b);
8015 }
8016
8017 hci_update_scan(hdev);
8018
8019 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
8020 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
8021 continue;
8022 device_removed(sk, hdev, &p->addr, p->addr_type);
8023 if (p->explicit_connect) {
8024 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
8025 continue;
8026 }
8027 hci_conn_params_free(p);
8028 }
8029
8030 bt_dev_dbg(hdev, "All LE connection parameters were removed");
8031 }
8032
8033 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL);
8034
8035 complete:
8036 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
8037 MGMT_STATUS_SUCCESS, &cp->addr,
8038 sizeof(cp->addr));
8039 unlock:
8040 hci_dev_unlock(hdev);
8041 return err;
8042 }
8043
conn_update_sync(struct hci_dev * hdev,void * data)8044 static int conn_update_sync(struct hci_dev *hdev, void *data)
8045 {
8046 struct hci_conn *conn = data;
8047 struct hci_conn_params *params;
8048 struct hci_conn_params local = {};
8049
8050 hci_dev_lock(hdev);
8051
8052 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER)
8053 goto cancel;
8054
8055 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
8056 if (!params)
8057 goto cancel;
8058
8059 local.conn_min_interval = params->conn_min_interval;
8060 local.conn_max_interval = params->conn_max_interval;
8061 local.conn_latency = params->conn_latency;
8062 local.supervision_timeout = params->supervision_timeout;
8063
8064 hci_dev_unlock(hdev);
8065
8066 return hci_le_conn_update_sync(hdev, conn, &local);
8067
8068 cancel:
8069 hci_dev_unlock(hdev);
8070 return -ECANCELED;
8071 }
8072
conn_update_sync_destroy(struct hci_dev * hdev,void * data,int err)8073 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err)
8074 {
8075 hci_conn_put(data);
8076 }
8077
load_conn_param(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8078 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
8079 u16 len)
8080 {
8081 struct mgmt_cp_load_conn_param *cp = data;
8082 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8083 sizeof(struct mgmt_conn_param));
8084 u16 param_count, expected_len;
8085 int i;
8086
8087 if (!lmp_le_capable(hdev))
8088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8089 MGMT_STATUS_NOT_SUPPORTED);
8090
8091 param_count = __le16_to_cpu(cp->param_count);
8092 if (param_count > max_param_count) {
8093 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
8094 param_count);
8095 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8096 MGMT_STATUS_INVALID_PARAMS);
8097 }
8098
8099 expected_len = struct_size(cp, params, param_count);
8100 if (expected_len != len) {
8101 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
8102 expected_len, len);
8103 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
8104 MGMT_STATUS_INVALID_PARAMS);
8105 }
8106
8107 bt_dev_dbg(hdev, "param_count %u", param_count);
8108
8109 hci_dev_lock(hdev);
8110
8111 if (param_count > 1)
8112 hci_conn_params_clear_disabled(hdev);
8113
8114 for (i = 0; i < param_count; i++) {
8115 struct mgmt_conn_param *param = &cp->params[i];
8116 struct hci_conn_params *hci_param;
8117 u16 min, max, latency, timeout;
8118 bool update = false;
8119 u8 addr_type;
8120
8121 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr,
8122 param->addr.type);
8123
8124 if (param->addr.type == BDADDR_LE_PUBLIC) {
8125 addr_type = ADDR_LE_DEV_PUBLIC;
8126 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8127 addr_type = ADDR_LE_DEV_RANDOM;
8128 } else {
8129 bt_dev_err(hdev, "ignoring invalid connection parameters");
8130 continue;
8131 }
8132
8133 min = le16_to_cpu(param->min_interval);
8134 max = le16_to_cpu(param->max_interval);
8135 latency = le16_to_cpu(param->latency);
8136 timeout = le16_to_cpu(param->timeout);
8137
8138 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
8139 min, max, latency, timeout);
8140
8141 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
8142 bt_dev_err(hdev, "ignoring invalid connection parameters");
8143 continue;
8144 }
8145
8146 /* Detect when the loading is for an existing parameter then
8147 * attempt to trigger the connection update procedure.
8148 */
8149 if (!i && param_count == 1) {
8150 hci_param = hci_conn_params_lookup(hdev,
8151 ¶m->addr.bdaddr,
8152 addr_type);
8153 if (hci_param)
8154 update = true;
8155 else
8156 hci_conn_params_clear_disabled(hdev);
8157 }
8158
8159 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
8160 addr_type);
8161 if (!hci_param) {
8162 bt_dev_err(hdev, "failed to add connection parameters");
8163 continue;
8164 }
8165
8166 hci_param->conn_min_interval = min;
8167 hci_param->conn_max_interval = max;
8168 hci_param->conn_latency = latency;
8169 hci_param->supervision_timeout = timeout;
8170
8171 /* Check if we need to trigger a connection update */
8172 if (update) {
8173 struct hci_conn *conn;
8174
8175 /* Lookup for existing connection as central and check
8176 * if parameters match and if they don't then trigger
8177 * a connection update.
8178 */
8179 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr,
8180 addr_type);
8181 if (conn && conn->role == HCI_ROLE_MASTER &&
8182 (conn->le_conn_min_interval != min ||
8183 conn->le_conn_max_interval != max ||
8184 conn->le_conn_latency != latency ||
8185 conn->le_supv_timeout != timeout)) {
8186 hci_conn_get(conn);
8187 if (hci_cmd_sync_queue(hdev, conn_update_sync,
8188 conn,
8189 conn_update_sync_destroy) < 0)
8190 hci_conn_put(conn);
8191 }
8192 }
8193 }
8194
8195 hci_dev_unlock(hdev);
8196
8197 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
8198 NULL, 0);
8199 }
8200
load_conn_subrate(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8201 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data,
8202 u16 len)
8203 {
8204 struct mgmt_cp_load_conn_subrate *cp = data;
8205 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
8206 sizeof(struct mgmt_conn_subrate));
8207 u16 param_count, expected_len;
8208 int i;
8209
8210 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev))
8211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8212 MGMT_STATUS_NOT_SUPPORTED);
8213
8214 param_count = __le16_to_cpu(cp->param_count);
8215 if (param_count > max_param_count) {
8216 bt_dev_err(hdev, "too big param_count value %u", param_count);
8217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8218 MGMT_STATUS_INVALID_PARAMS);
8219 }
8220
8221 expected_len = struct_size(cp, params, param_count);
8222 if (expected_len != len) {
8223 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
8224 expected_len, len);
8225 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE,
8226 MGMT_STATUS_INVALID_PARAMS);
8227 }
8228
8229 bt_dev_dbg(hdev, "param_count %u", param_count);
8230
8231 hci_dev_lock(hdev);
8232
8233 for (i = 0; i < param_count; i++) {
8234 struct mgmt_conn_subrate *param = &cp->params[i];
8235 struct hci_conn_params *hci_param;
8236 u16 min, max, subrate_min, subrate_max;
8237 u16 max_latency, cont_num, supv_timeout;
8238 u8 addr_type;
8239
8240 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)",
8241 ¶m->addr.bdaddr, param->addr.type);
8242
8243 if (param->addr.type == BDADDR_LE_PUBLIC) {
8244 addr_type = ADDR_LE_DEV_PUBLIC;
8245 } else if (param->addr.type == BDADDR_LE_RANDOM) {
8246 addr_type = ADDR_LE_DEV_RANDOM;
8247 } else {
8248 bt_dev_err(hdev, "ignoring invalid connection subrate parameters");
8249 continue;
8250 }
8251
8252 min = le16_to_cpu(param->min_interval);
8253 max = le16_to_cpu(param->max_interval);
8254 subrate_min = le16_to_cpu(param->subrate_min);
8255 subrate_max = le16_to_cpu(param->subrate_max);
8256 max_latency = le16_to_cpu(param->max_latency);
8257 cont_num = le16_to_cpu(param->cont_num);
8258 supv_timeout = le16_to_cpu(param->supv_timeout);
8259
8260 /* Validate the parameters before storing them. Reject
8261 * logically inconsistent values instead of forwarding them to
8262 * the controller.
8263 */
8264 if (min > max || subrate_min > subrate_max ||
8265 subrate_min < 1 || supv_timeout < 1) {
8266 bt_dev_err(hdev, "ignoring invalid connection subrate parameters");
8267 continue;
8268 }
8269
8270 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
8271 addr_type);
8272 if (!hci_param) {
8273 bt_dev_err(hdev, "failed to add connection parameters");
8274 continue;
8275 }
8276
8277 hci_param->rate_min_interval = min;
8278 hci_param->rate_max_interval = max;
8279 hci_param->subrate_min = subrate_min;
8280 hci_param->subrate_max = subrate_max;
8281 hci_param->max_latency = max_latency;
8282 hci_param->cont_num = cont_num;
8283 hci_param->rate_supv_timeout = supv_timeout;
8284
8285 /* If the device is connected as central check if the
8286 * connection rate parameters need to be updated.
8287 */
8288 if (!i && param_count == 1) {
8289 struct hci_conn *conn;
8290
8291 conn = hci_conn_hash_lookup_le(hdev,
8292 &hci_param->addr,
8293 addr_type);
8294 if (conn && conn->state == BT_CONNECTED &&
8295 conn->role == HCI_ROLE_MASTER &&
8296 (conn->le_rate_interval < min ||
8297 conn->le_rate_interval > max ||
8298 conn->le_subrate < subrate_min ||
8299 conn->le_subrate > subrate_max ||
8300 conn->le_rate_latency != max_latency ||
8301 conn->le_cont_num != cont_num ||
8302 conn->le_rate_supv_timeout != supv_timeout))
8303 hci_le_conn_rate_request(hdev, conn);
8304 }
8305 }
8306
8307 hci_dev_unlock(hdev);
8308
8309 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0,
8310 NULL, 0);
8311 }
8312
set_external_config(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8313 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
8314 void *data, u16 len)
8315 {
8316 struct mgmt_cp_set_external_config *cp = data;
8317 bool changed;
8318 int err;
8319
8320 bt_dev_dbg(hdev, "sock %p", sk);
8321
8322 if (hdev_is_powered(hdev))
8323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8324 MGMT_STATUS_REJECTED);
8325
8326 if (cp->config != 0x00 && cp->config != 0x01)
8327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8328 MGMT_STATUS_INVALID_PARAMS);
8329
8330 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG))
8331 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
8332 MGMT_STATUS_NOT_SUPPORTED);
8333
8334 hci_dev_lock(hdev);
8335
8336 if (cp->config)
8337 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
8338 else
8339 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
8340
8341 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
8342 if (err < 0)
8343 goto unlock;
8344
8345 if (!changed)
8346 goto unlock;
8347
8348 err = new_options(hdev, sk);
8349
8350 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
8351 mgmt_index_removed(hdev);
8352
8353 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
8354 hci_dev_set_flag(hdev, HCI_CONFIG);
8355 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8356
8357 queue_work(hdev->req_workqueue, &hdev->power_on);
8358 } else {
8359 set_bit(HCI_RAW, &hdev->flags);
8360 mgmt_index_added(hdev);
8361 }
8362 }
8363
8364 unlock:
8365 hci_dev_unlock(hdev);
8366 return err;
8367 }
8368
set_public_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)8369 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
8370 void *data, u16 len)
8371 {
8372 struct mgmt_cp_set_public_address *cp = data;
8373 bool changed;
8374 int err;
8375
8376 bt_dev_dbg(hdev, "sock %p", sk);
8377
8378 if (hdev_is_powered(hdev))
8379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8380 MGMT_STATUS_REJECTED);
8381
8382 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
8383 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8384 MGMT_STATUS_INVALID_PARAMS);
8385
8386 if (!hdev->set_bdaddr)
8387 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
8388 MGMT_STATUS_NOT_SUPPORTED);
8389
8390 hci_dev_lock(hdev);
8391
8392 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
8393 bacpy(&hdev->public_addr, &cp->bdaddr);
8394
8395 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
8396 if (err < 0)
8397 goto unlock;
8398
8399 if (!changed)
8400 goto unlock;
8401
8402 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
8403 err = new_options(hdev, sk);
8404
8405 if (is_configured(hdev)) {
8406 mgmt_index_removed(hdev);
8407
8408 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
8409
8410 hci_dev_set_flag(hdev, HCI_CONFIG);
8411 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
8412
8413 queue_work(hdev->req_workqueue, &hdev->power_on);
8414 }
8415
8416 unlock:
8417 hci_dev_unlock(hdev);
8418 return err;
8419 }
8420
read_local_oob_ext_data_complete(struct hci_dev * hdev,void * data,int err)8421 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
8422 int err)
8423 {
8424 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
8425 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
8426 u8 *h192, *r192, *h256, *r256;
8427 struct mgmt_pending_cmd *cmd = data;
8428 struct sk_buff *skb = cmd->skb;
8429 u8 status = mgmt_status(err);
8430 u16 eir_len;
8431
8432 if (!status) {
8433 if (!skb)
8434 status = MGMT_STATUS_FAILED;
8435 else if (IS_ERR(skb))
8436 status = mgmt_status(PTR_ERR(skb));
8437 else
8438 status = mgmt_status(skb->data[0]);
8439 }
8440
8441 bt_dev_dbg(hdev, "status %u", status);
8442
8443 mgmt_cp = cmd->param;
8444
8445 if (status) {
8446 status = mgmt_status(status);
8447 eir_len = 0;
8448
8449 h192 = NULL;
8450 r192 = NULL;
8451 h256 = NULL;
8452 r256 = NULL;
8453 } else if (!bredr_sc_enabled(hdev)) {
8454 struct hci_rp_read_local_oob_data *rp;
8455
8456 if (skb->len != sizeof(*rp)) {
8457 status = MGMT_STATUS_FAILED;
8458 eir_len = 0;
8459 } else {
8460 status = MGMT_STATUS_SUCCESS;
8461 rp = (void *)skb->data;
8462
8463 eir_len = 5 + 18 + 18;
8464 h192 = rp->hash;
8465 r192 = rp->rand;
8466 h256 = NULL;
8467 r256 = NULL;
8468 }
8469 } else {
8470 struct hci_rp_read_local_oob_ext_data *rp;
8471
8472 if (skb->len != sizeof(*rp)) {
8473 status = MGMT_STATUS_FAILED;
8474 eir_len = 0;
8475 } else {
8476 status = MGMT_STATUS_SUCCESS;
8477 rp = (void *)skb->data;
8478
8479 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
8480 eir_len = 5 + 18 + 18;
8481 h192 = NULL;
8482 r192 = NULL;
8483 } else {
8484 eir_len = 5 + 18 + 18 + 18 + 18;
8485 h192 = rp->hash192;
8486 r192 = rp->rand192;
8487 }
8488
8489 h256 = rp->hash256;
8490 r256 = rp->rand256;
8491 }
8492 }
8493
8494 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
8495 if (!mgmt_rp)
8496 goto done;
8497
8498 if (eir_len == 0)
8499 goto send_rsp;
8500
8501 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
8502 hdev->dev_class, 3);
8503
8504 if (h192 && r192) {
8505 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8506 EIR_SSP_HASH_C192, h192, 16);
8507 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8508 EIR_SSP_RAND_R192, r192, 16);
8509 }
8510
8511 if (h256 && r256) {
8512 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8513 EIR_SSP_HASH_C256, h256, 16);
8514 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
8515 EIR_SSP_RAND_R256, r256, 16);
8516 }
8517
8518 send_rsp:
8519 mgmt_rp->type = mgmt_cp->type;
8520 mgmt_rp->eir_len = cpu_to_le16(eir_len);
8521
8522 err = mgmt_cmd_complete(cmd->sk, hdev->id,
8523 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
8524 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
8525 if (err < 0 || status)
8526 goto done;
8527
8528 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
8529
8530 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8531 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
8532 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
8533 done:
8534 if (skb && !IS_ERR(skb))
8535 kfree_skb(skb);
8536
8537 kfree(mgmt_rp);
8538 mgmt_pending_free(cmd);
8539 }
8540
read_local_ssp_oob_req(struct hci_dev * hdev,struct sock * sk,struct mgmt_cp_read_local_oob_ext_data * cp)8541 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
8542 struct mgmt_cp_read_local_oob_ext_data *cp)
8543 {
8544 struct mgmt_pending_cmd *cmd;
8545 int err;
8546
8547 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
8548 cp, sizeof(*cp));
8549 if (!cmd)
8550 return -ENOMEM;
8551
8552 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd,
8553 read_local_oob_ext_data_complete);
8554
8555 if (err < 0) {
8556 mgmt_pending_remove(cmd);
8557 return err;
8558 }
8559
8560 return 0;
8561 }
8562
read_local_oob_ext_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8563 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
8564 void *data, u16 data_len)
8565 {
8566 struct mgmt_cp_read_local_oob_ext_data *cp = data;
8567 struct mgmt_rp_read_local_oob_ext_data *rp;
8568 size_t rp_len;
8569 u16 eir_len;
8570 u8 status, flags, role, addr[7], hash[16], rand[16];
8571 int err;
8572
8573 bt_dev_dbg(hdev, "sock %p", sk);
8574
8575 if (hdev_is_powered(hdev)) {
8576 switch (cp->type) {
8577 case BIT(BDADDR_BREDR):
8578 status = mgmt_bredr_support(hdev);
8579 if (status)
8580 eir_len = 0;
8581 else
8582 eir_len = 5;
8583 break;
8584 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8585 status = mgmt_le_support(hdev);
8586 if (status)
8587 eir_len = 0;
8588 else
8589 eir_len = 9 + 3 + 18 + 18 + 3;
8590 break;
8591 default:
8592 status = MGMT_STATUS_INVALID_PARAMS;
8593 eir_len = 0;
8594 break;
8595 }
8596 } else {
8597 status = MGMT_STATUS_NOT_POWERED;
8598 eir_len = 0;
8599 }
8600
8601 rp_len = sizeof(*rp) + eir_len;
8602 rp = kmalloc(rp_len, GFP_ATOMIC);
8603 if (!rp)
8604 return -ENOMEM;
8605
8606 if (!status && !lmp_ssp_capable(hdev)) {
8607 status = MGMT_STATUS_NOT_SUPPORTED;
8608 eir_len = 0;
8609 }
8610
8611 if (status)
8612 goto complete;
8613
8614 hci_dev_lock(hdev);
8615
8616 eir_len = 0;
8617 switch (cp->type) {
8618 case BIT(BDADDR_BREDR):
8619 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8620 err = read_local_ssp_oob_req(hdev, sk, cp);
8621 hci_dev_unlock(hdev);
8622 if (!err)
8623 goto done;
8624
8625 status = MGMT_STATUS_FAILED;
8626 goto complete;
8627 } else {
8628 eir_len = eir_append_data(rp->eir, eir_len,
8629 EIR_CLASS_OF_DEV,
8630 hdev->dev_class, 3);
8631 }
8632 break;
8633 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
8634 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
8635 smp_generate_oob(hdev, hash, rand) < 0) {
8636 hci_dev_unlock(hdev);
8637 status = MGMT_STATUS_FAILED;
8638 goto complete;
8639 }
8640
8641 /* This should return the active RPA, but since the RPA
8642 * is only programmed on demand, it is really hard to fill
8643 * this in at the moment. For now disallow retrieving
8644 * local out-of-band data when privacy is in use.
8645 *
8646 * Returning the identity address will not help here since
8647 * pairing happens before the identity resolving key is
8648 * known and thus the connection establishment happens
8649 * based on the RPA and not the identity address.
8650 */
8651 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
8652 hci_dev_unlock(hdev);
8653 status = MGMT_STATUS_REJECTED;
8654 goto complete;
8655 }
8656
8657 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
8658 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
8659 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
8660 bacmp(&hdev->static_addr, BDADDR_ANY))) {
8661 memcpy(addr, &hdev->static_addr, 6);
8662 addr[6] = 0x01;
8663 } else {
8664 memcpy(addr, &hdev->bdaddr, 6);
8665 addr[6] = 0x00;
8666 }
8667
8668 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
8669 addr, sizeof(addr));
8670
8671 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
8672 role = 0x02;
8673 else
8674 role = 0x01;
8675
8676 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
8677 &role, sizeof(role));
8678
8679 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
8680 eir_len = eir_append_data(rp->eir, eir_len,
8681 EIR_LE_SC_CONFIRM,
8682 hash, sizeof(hash));
8683
8684 eir_len = eir_append_data(rp->eir, eir_len,
8685 EIR_LE_SC_RANDOM,
8686 rand, sizeof(rand));
8687 }
8688
8689 flags = mgmt_get_adv_discov_flags(hdev);
8690
8691 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
8692 flags |= LE_AD_NO_BREDR;
8693
8694 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
8695 &flags, sizeof(flags));
8696 break;
8697 }
8698
8699 hci_dev_unlock(hdev);
8700
8701 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
8702
8703 status = MGMT_STATUS_SUCCESS;
8704
8705 complete:
8706 rp->type = cp->type;
8707 rp->eir_len = cpu_to_le16(eir_len);
8708
8709 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
8710 status, rp, sizeof(*rp) + eir_len);
8711 if (err < 0 || status)
8712 goto done;
8713
8714 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
8715 rp, sizeof(*rp) + eir_len,
8716 HCI_MGMT_OOB_DATA_EVENTS, sk);
8717
8718 done:
8719 kfree(rp);
8720
8721 return err;
8722 }
8723
get_supported_adv_flags(struct hci_dev * hdev)8724 static u32 get_supported_adv_flags(struct hci_dev *hdev)
8725 {
8726 u32 flags = 0;
8727
8728 flags |= MGMT_ADV_FLAG_CONNECTABLE;
8729 flags |= MGMT_ADV_FLAG_DISCOV;
8730 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
8731 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
8732 flags |= MGMT_ADV_FLAG_APPEARANCE;
8733 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
8734 flags |= MGMT_ADV_PARAM_DURATION;
8735 flags |= MGMT_ADV_PARAM_TIMEOUT;
8736 flags |= MGMT_ADV_PARAM_INTERVALS;
8737 flags |= MGMT_ADV_PARAM_TX_POWER;
8738 flags |= MGMT_ADV_PARAM_SCAN_RSP;
8739
8740 /* In extended adv TX_POWER returned from Set Adv Param
8741 * will be always valid.
8742 */
8743 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev))
8744 flags |= MGMT_ADV_FLAG_TX_POWER;
8745
8746 if (ext_adv_capable(hdev)) {
8747 flags |= MGMT_ADV_FLAG_SEC_1M;
8748 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
8749 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
8750
8751 if (le_2m_capable(hdev))
8752 flags |= MGMT_ADV_FLAG_SEC_2M;
8753
8754 if (le_coded_capable(hdev))
8755 flags |= MGMT_ADV_FLAG_SEC_CODED;
8756 }
8757
8758 return flags;
8759 }
8760
read_adv_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8761 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
8762 void *data, u16 data_len)
8763 {
8764 struct mgmt_rp_read_adv_features *rp;
8765 size_t rp_len;
8766 int err;
8767 struct adv_info *adv_instance;
8768 u32 supported_flags;
8769 u8 *instance;
8770
8771 bt_dev_dbg(hdev, "sock %p", sk);
8772
8773 if (!lmp_le_capable(hdev))
8774 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8775 MGMT_STATUS_REJECTED);
8776
8777 hci_dev_lock(hdev);
8778
8779 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
8780 rp = kmalloc(rp_len, GFP_ATOMIC);
8781 if (!rp) {
8782 hci_dev_unlock(hdev);
8783 return -ENOMEM;
8784 }
8785
8786 supported_flags = get_supported_adv_flags(hdev);
8787
8788 rp->supported_flags = cpu_to_le32(supported_flags);
8789 rp->max_adv_data_len = max_adv_len(hdev);
8790 rp->max_scan_rsp_len = max_adv_len(hdev);
8791 rp->max_instances = hdev->le_num_of_adv_sets;
8792 rp->num_instances = hdev->adv_instance_cnt;
8793
8794 instance = rp->instance;
8795 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
8796 /* Only instances 1-le_num_of_adv_sets are externally visible */
8797 if (adv_instance->instance <= hdev->adv_instance_cnt) {
8798 *instance = adv_instance->instance;
8799 instance++;
8800 } else {
8801 rp->num_instances--;
8802 rp_len--;
8803 }
8804 }
8805
8806 hci_dev_unlock(hdev);
8807
8808 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
8809 MGMT_STATUS_SUCCESS, rp, rp_len);
8810
8811 kfree(rp);
8812
8813 return err;
8814 }
8815
calculate_name_len(struct hci_dev * hdev)8816 static u8 calculate_name_len(struct hci_dev *hdev)
8817 {
8818 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
8819
8820 return eir_append_local_name(hdev, buf, 0);
8821 }
8822
tlv_data_max_len(struct hci_dev * hdev,u32 adv_flags,bool is_adv_data)8823 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
8824 bool is_adv_data)
8825 {
8826 u8 max_len = max_adv_len(hdev);
8827
8828 if (is_adv_data) {
8829 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
8830 MGMT_ADV_FLAG_LIMITED_DISCOV |
8831 MGMT_ADV_FLAG_MANAGED_FLAGS))
8832 max_len -= 3;
8833
8834 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
8835 max_len -= 3;
8836 } else {
8837 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
8838 max_len -= calculate_name_len(hdev);
8839
8840 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
8841 max_len -= 4;
8842 }
8843
8844 return max_len;
8845 }
8846
flags_managed(u32 adv_flags)8847 static bool flags_managed(u32 adv_flags)
8848 {
8849 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
8850 MGMT_ADV_FLAG_LIMITED_DISCOV |
8851 MGMT_ADV_FLAG_MANAGED_FLAGS);
8852 }
8853
tx_power_managed(u32 adv_flags)8854 static bool tx_power_managed(u32 adv_flags)
8855 {
8856 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
8857 }
8858
name_managed(u32 adv_flags)8859 static bool name_managed(u32 adv_flags)
8860 {
8861 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
8862 }
8863
appearance_managed(u32 adv_flags)8864 static bool appearance_managed(u32 adv_flags)
8865 {
8866 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
8867 }
8868
tlv_data_is_valid(struct hci_dev * hdev,u32 adv_flags,u8 * data,u8 len,bool is_adv_data)8869 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
8870 u8 len, bool is_adv_data)
8871 {
8872 int i, cur_len;
8873 u8 max_len;
8874
8875 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
8876
8877 if (len > max_len)
8878 return false;
8879
8880 /* Make sure that the data is correctly formatted. */
8881 for (i = 0; i < len; i += (cur_len + 1)) {
8882 cur_len = data[i];
8883
8884 if (!cur_len)
8885 continue;
8886
8887 /* If the current field length would exceed the total data
8888 * length, then it's invalid.
8889 */
8890 if (i + cur_len >= len)
8891 return false;
8892
8893 if (data[i + 1] == EIR_FLAGS &&
8894 (!is_adv_data || flags_managed(adv_flags)))
8895 return false;
8896
8897 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
8898 return false;
8899
8900 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
8901 return false;
8902
8903 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
8904 return false;
8905
8906 if (data[i + 1] == EIR_APPEARANCE &&
8907 appearance_managed(adv_flags))
8908 return false;
8909 }
8910
8911 return true;
8912 }
8913
requested_adv_flags_are_valid(struct hci_dev * hdev,u32 adv_flags)8914 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
8915 {
8916 u32 supported_flags, phy_flags;
8917
8918 /* The current implementation only supports a subset of the specified
8919 * flags. Also need to check mutual exclusiveness of sec flags.
8920 */
8921 supported_flags = get_supported_adv_flags(hdev);
8922 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
8923 if (adv_flags & ~supported_flags ||
8924 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
8925 return false;
8926
8927 return true;
8928 }
8929
adv_busy(struct hci_dev * hdev)8930 static bool adv_busy(struct hci_dev *hdev)
8931 {
8932 return pending_find(MGMT_OP_SET_LE, hdev);
8933 }
8934
add_adv_complete(struct hci_dev * hdev,struct sock * sk,u8 instance,int err)8935 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance,
8936 int err)
8937 {
8938 struct adv_info *adv, *n;
8939
8940 bt_dev_dbg(hdev, "err %d", err);
8941
8942 hci_dev_lock(hdev);
8943
8944 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
8945 u8 instance;
8946
8947 if (!adv->pending)
8948 continue;
8949
8950 if (!err) {
8951 adv->pending = false;
8952 continue;
8953 }
8954
8955 instance = adv->instance;
8956
8957 if (hdev->cur_adv_instance == instance)
8958 cancel_adv_timeout(hdev);
8959
8960 hci_remove_adv_instance(hdev, instance);
8961 mgmt_advertising_removed(sk, hdev, instance);
8962 }
8963
8964 hci_dev_unlock(hdev);
8965 }
8966
add_advertising_complete(struct hci_dev * hdev,void * data,int err)8967 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err)
8968 {
8969 struct mgmt_pending_cmd *cmd = data;
8970 struct mgmt_cp_add_advertising *cp = cmd->param;
8971 struct mgmt_rp_add_advertising rp;
8972
8973 memset(&rp, 0, sizeof(rp));
8974
8975 rp.instance = cp->instance;
8976
8977 if (err)
8978 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
8979 mgmt_status(err));
8980 else
8981 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
8982 mgmt_status(err), &rp, sizeof(rp));
8983
8984 add_adv_complete(hdev, cmd->sk, cp->instance, err);
8985
8986 mgmt_pending_free(cmd);
8987 }
8988
add_advertising_sync(struct hci_dev * hdev,void * data)8989 static int add_advertising_sync(struct hci_dev *hdev, void *data)
8990 {
8991 struct mgmt_pending_cmd *cmd = data;
8992 struct mgmt_cp_add_advertising *cp = cmd->param;
8993
8994 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
8995 }
8996
add_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)8997 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
8998 void *data, u16 data_len)
8999 {
9000 struct mgmt_cp_add_advertising *cp = data;
9001 struct mgmt_rp_add_advertising rp;
9002 u32 flags;
9003 u8 status;
9004 u16 timeout, duration;
9005 unsigned int prev_instance_cnt;
9006 u8 schedule_instance = 0;
9007 struct adv_info *adv, *next_instance;
9008 int err;
9009 struct mgmt_pending_cmd *cmd;
9010
9011 bt_dev_dbg(hdev, "sock %p", sk);
9012
9013 status = mgmt_le_support(hdev);
9014 if (status)
9015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9016 status);
9017
9018 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9019 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9020 MGMT_STATUS_INVALID_PARAMS);
9021
9022 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
9023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9024 MGMT_STATUS_INVALID_PARAMS);
9025
9026 flags = __le32_to_cpu(cp->flags);
9027 timeout = __le16_to_cpu(cp->timeout);
9028 duration = __le16_to_cpu(cp->duration);
9029
9030 if (!requested_adv_flags_are_valid(hdev, flags))
9031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9032 MGMT_STATUS_INVALID_PARAMS);
9033
9034 hci_dev_lock(hdev);
9035
9036 if (timeout && !hdev_is_powered(hdev)) {
9037 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9038 MGMT_STATUS_REJECTED);
9039 goto unlock;
9040 }
9041
9042 if (adv_busy(hdev)) {
9043 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9044 MGMT_STATUS_BUSY);
9045 goto unlock;
9046 }
9047
9048 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
9049 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
9050 cp->scan_rsp_len, false)) {
9051 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9052 MGMT_STATUS_INVALID_PARAMS);
9053 goto unlock;
9054 }
9055
9056 prev_instance_cnt = hdev->adv_instance_cnt;
9057
9058 adv = hci_add_adv_instance(hdev, cp->instance, flags,
9059 cp->adv_data_len, cp->data,
9060 cp->scan_rsp_len,
9061 cp->data + cp->adv_data_len,
9062 timeout, duration,
9063 HCI_ADV_TX_POWER_NO_PREFERENCE,
9064 hdev->le_adv_min_interval,
9065 hdev->le_adv_max_interval, 0);
9066 if (IS_ERR(adv)) {
9067 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9068 MGMT_STATUS_FAILED);
9069 goto unlock;
9070 }
9071
9072 /* Only trigger an advertising added event if a new instance was
9073 * actually added.
9074 */
9075 if (hdev->adv_instance_cnt > prev_instance_cnt)
9076 mgmt_advertising_added(sk, hdev, cp->instance);
9077
9078 if (hdev->cur_adv_instance == cp->instance) {
9079 /* If the currently advertised instance is being changed then
9080 * cancel the current advertising and schedule the next
9081 * instance. If there is only one instance then the overridden
9082 * advertising data will be visible right away.
9083 */
9084 cancel_adv_timeout(hdev);
9085
9086 next_instance = hci_get_next_instance(hdev, cp->instance);
9087 if (next_instance)
9088 schedule_instance = next_instance->instance;
9089 } else if (!hdev->adv_instance_timeout) {
9090 /* Immediately advertise the new instance if no other
9091 * instance is currently being advertised.
9092 */
9093 schedule_instance = cp->instance;
9094 }
9095
9096 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
9097 * there is no instance to be advertised then we have no HCI
9098 * communication to make. Simply return.
9099 */
9100 if (!hdev_is_powered(hdev) ||
9101 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
9102 !schedule_instance) {
9103 rp.instance = cp->instance;
9104 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
9105 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9106 goto unlock;
9107 }
9108
9109 /* We're good to go, update advertising data, parameters, and start
9110 * advertising.
9111 */
9112 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
9113 data_len);
9114 if (!cmd) {
9115 err = -ENOMEM;
9116 goto unlock;
9117 }
9118
9119 cp->instance = schedule_instance;
9120
9121 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd,
9122 add_advertising_complete);
9123 if (err < 0)
9124 mgmt_pending_free(cmd);
9125
9126 unlock:
9127 hci_dev_unlock(hdev);
9128
9129 return err;
9130 }
9131
add_ext_adv_params_complete(struct hci_dev * hdev,void * data,int err)9132 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data,
9133 int err)
9134 {
9135 struct mgmt_pending_cmd *cmd = data;
9136 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9137 struct mgmt_rp_add_ext_adv_params rp;
9138 struct adv_info *adv;
9139 u32 flags;
9140
9141 BT_DBG("%s", hdev->name);
9142
9143 hci_dev_lock(hdev);
9144
9145 adv = hci_find_adv_instance(hdev, cp->instance);
9146 if (!adv)
9147 goto unlock;
9148
9149 rp.instance = cp->instance;
9150 rp.tx_power = adv->tx_power;
9151
9152 /* While we're at it, inform userspace of the available space for this
9153 * advertisement, given the flags that will be used.
9154 */
9155 flags = __le32_to_cpu(cp->flags);
9156 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9157 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9158
9159 if (err) {
9160 /* If this advertisement was previously advertising and we
9161 * failed to update it, we signal that it has been removed and
9162 * delete its structure
9163 */
9164 if (!adv->pending)
9165 mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
9166
9167 hci_remove_adv_instance(hdev, cp->instance);
9168
9169 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9170 mgmt_status(err));
9171 } else {
9172 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9173 mgmt_status(err), &rp, sizeof(rp));
9174 }
9175
9176 unlock:
9177 mgmt_pending_free(cmd);
9178
9179 hci_dev_unlock(hdev);
9180 }
9181
add_ext_adv_params_sync(struct hci_dev * hdev,void * data)9182 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data)
9183 {
9184 struct mgmt_pending_cmd *cmd = data;
9185 struct mgmt_cp_add_ext_adv_params *cp = cmd->param;
9186
9187 return hci_setup_ext_adv_instance_sync(hdev, cp->instance);
9188 }
9189
add_ext_adv_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9190 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
9191 void *data, u16 data_len)
9192 {
9193 struct mgmt_cp_add_ext_adv_params *cp = data;
9194 struct mgmt_rp_add_ext_adv_params rp;
9195 struct mgmt_pending_cmd *cmd = NULL;
9196 struct adv_info *adv;
9197 u32 flags, min_interval, max_interval;
9198 u16 timeout, duration;
9199 u8 status;
9200 s8 tx_power;
9201 int err;
9202
9203 BT_DBG("%s", hdev->name);
9204
9205 status = mgmt_le_support(hdev);
9206 if (status)
9207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9208 status);
9209
9210 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9212 MGMT_STATUS_INVALID_PARAMS);
9213
9214 /* The purpose of breaking add_advertising into two separate MGMT calls
9215 * for params and data is to allow more parameters to be added to this
9216 * structure in the future. For this reason, we verify that we have the
9217 * bare minimum structure we know of when the interface was defined. Any
9218 * extra parameters we don't know about will be ignored in this request.
9219 */
9220 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
9221 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9222 MGMT_STATUS_INVALID_PARAMS);
9223
9224 flags = __le32_to_cpu(cp->flags);
9225
9226 if (!requested_adv_flags_are_valid(hdev, flags))
9227 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9228 MGMT_STATUS_INVALID_PARAMS);
9229
9230 hci_dev_lock(hdev);
9231
9232 /* In new interface, we require that we are powered to register */
9233 if (!hdev_is_powered(hdev)) {
9234 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9235 MGMT_STATUS_REJECTED);
9236 goto unlock;
9237 }
9238
9239 if (adv_busy(hdev)) {
9240 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9241 MGMT_STATUS_BUSY);
9242 goto unlock;
9243 }
9244
9245 /* Parse defined parameters from request, use defaults otherwise */
9246 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
9247 __le16_to_cpu(cp->timeout) : 0;
9248
9249 duration = (flags & MGMT_ADV_PARAM_DURATION) ?
9250 __le16_to_cpu(cp->duration) :
9251 hdev->def_multi_adv_rotation_duration;
9252
9253 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9254 __le32_to_cpu(cp->min_interval) :
9255 hdev->le_adv_min_interval;
9256
9257 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
9258 __le32_to_cpu(cp->max_interval) :
9259 hdev->le_adv_max_interval;
9260
9261 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
9262 cp->tx_power :
9263 HCI_ADV_TX_POWER_NO_PREFERENCE;
9264
9265 /* Create advertising instance with no advertising or response data */
9266 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL,
9267 timeout, duration, tx_power, min_interval,
9268 max_interval, 0);
9269
9270 if (IS_ERR(adv)) {
9271 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
9272 MGMT_STATUS_FAILED);
9273 goto unlock;
9274 }
9275
9276 /* Submit request for advertising params if ext adv available */
9277 if (ext_adv_capable(hdev)) {
9278 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev,
9279 data, data_len);
9280 if (!cmd) {
9281 err = -ENOMEM;
9282 hci_remove_adv_instance(hdev, cp->instance);
9283 goto unlock;
9284 }
9285
9286 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd,
9287 add_ext_adv_params_complete);
9288 if (err < 0)
9289 mgmt_pending_free(cmd);
9290 } else {
9291 rp.instance = cp->instance;
9292 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
9293 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9294 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9295 err = mgmt_cmd_complete(sk, hdev->id,
9296 MGMT_OP_ADD_EXT_ADV_PARAMS,
9297 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9298 }
9299
9300 unlock:
9301 hci_dev_unlock(hdev);
9302
9303 return err;
9304 }
9305
add_ext_adv_data_complete(struct hci_dev * hdev,void * data,int err)9306 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err)
9307 {
9308 struct mgmt_pending_cmd *cmd = data;
9309 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
9310 struct mgmt_rp_add_advertising rp;
9311
9312 add_adv_complete(hdev, cmd->sk, cp->instance, err);
9313
9314 memset(&rp, 0, sizeof(rp));
9315
9316 rp.instance = cp->instance;
9317
9318 if (err)
9319 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9320 mgmt_status(err));
9321 else
9322 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9323 mgmt_status(err), &rp, sizeof(rp));
9324
9325 mgmt_pending_free(cmd);
9326 }
9327
add_ext_adv_data_sync(struct hci_dev * hdev,void * data)9328 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data)
9329 {
9330 struct mgmt_pending_cmd *cmd = data;
9331 struct mgmt_cp_add_ext_adv_data *cp = cmd->param;
9332 int err;
9333
9334 if (ext_adv_capable(hdev)) {
9335 err = hci_update_adv_data_sync(hdev, cp->instance);
9336 if (err)
9337 return err;
9338
9339 err = hci_update_scan_rsp_data_sync(hdev, cp->instance);
9340 if (err)
9341 return err;
9342
9343 return hci_enable_ext_advertising_sync(hdev, cp->instance);
9344 }
9345
9346 return hci_schedule_adv_instance_sync(hdev, cp->instance, true);
9347 }
9348
add_ext_adv_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9349 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
9350 u16 data_len)
9351 {
9352 struct mgmt_cp_add_ext_adv_data *cp = data;
9353 struct mgmt_rp_add_ext_adv_data rp;
9354 u8 schedule_instance = 0;
9355 struct adv_info *next_instance;
9356 struct adv_info *adv_instance;
9357 int err = 0;
9358 struct mgmt_pending_cmd *cmd;
9359 u16 expected_len;
9360
9361 BT_DBG("%s", hdev->name);
9362
9363 expected_len = struct_size(cp, data, cp->adv_data_len +
9364 cp->scan_rsp_len);
9365 if (expected_len > data_len)
9366 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9367 MGMT_STATUS_INVALID_PARAMS);
9368
9369 hci_dev_lock(hdev);
9370
9371 adv_instance = hci_find_adv_instance(hdev, cp->instance);
9372
9373 if (!adv_instance) {
9374 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9375 MGMT_STATUS_INVALID_PARAMS);
9376 goto unlock;
9377 }
9378
9379 /* In new interface, we require that we are powered to register */
9380 if (!hdev_is_powered(hdev)) {
9381 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9382 MGMT_STATUS_REJECTED);
9383 goto clear_new_instance;
9384 }
9385
9386 if (adv_busy(hdev)) {
9387 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9388 MGMT_STATUS_BUSY);
9389 goto clear_new_instance;
9390 }
9391
9392 /* Validate new data */
9393 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
9394 cp->adv_data_len, true) ||
9395 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
9396 cp->adv_data_len, cp->scan_rsp_len, false)) {
9397 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9398 MGMT_STATUS_INVALID_PARAMS);
9399 goto clear_new_instance;
9400 }
9401
9402 /* Set the data in the advertising instance */
9403 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
9404 cp->data, cp->scan_rsp_len,
9405 cp->data + cp->adv_data_len);
9406
9407 /* If using software rotation, determine next instance to use */
9408 if (hdev->cur_adv_instance == cp->instance) {
9409 /* If the currently advertised instance is being changed
9410 * then cancel the current advertising and schedule the
9411 * next instance. If there is only one instance then the
9412 * overridden advertising data will be visible right
9413 * away
9414 */
9415 cancel_adv_timeout(hdev);
9416
9417 next_instance = hci_get_next_instance(hdev, cp->instance);
9418 if (next_instance)
9419 schedule_instance = next_instance->instance;
9420 } else if (!hdev->adv_instance_timeout) {
9421 /* Immediately advertise the new instance if no other
9422 * instance is currently being advertised.
9423 */
9424 schedule_instance = cp->instance;
9425 }
9426
9427 /* If the HCI_ADVERTISING flag is set or there is no instance to
9428 * be advertised then we have no HCI communication to make.
9429 * Simply return.
9430 */
9431 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) {
9432 if (adv_instance->pending) {
9433 mgmt_advertising_added(sk, hdev, cp->instance);
9434 adv_instance->pending = false;
9435 }
9436 rp.instance = cp->instance;
9437 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
9438 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9439 goto unlock;
9440 }
9441
9442 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
9443 data_len);
9444 if (!cmd) {
9445 err = -ENOMEM;
9446 goto clear_new_instance;
9447 }
9448
9449 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd,
9450 add_ext_adv_data_complete);
9451 if (err < 0) {
9452 mgmt_pending_free(cmd);
9453 goto clear_new_instance;
9454 }
9455
9456 /* We were successful in updating data, so trigger advertising_added
9457 * event if this is an instance that wasn't previously advertising. If
9458 * a failure occurs in the requests we initiated, we will remove the
9459 * instance again in add_advertising_complete
9460 */
9461 if (adv_instance->pending)
9462 mgmt_advertising_added(sk, hdev, cp->instance);
9463
9464 goto unlock;
9465
9466 clear_new_instance:
9467 hci_remove_adv_instance(hdev, cp->instance);
9468
9469 unlock:
9470 hci_dev_unlock(hdev);
9471
9472 return err;
9473 }
9474
remove_advertising_complete(struct hci_dev * hdev,void * data,int err)9475 static void remove_advertising_complete(struct hci_dev *hdev, void *data,
9476 int err)
9477 {
9478 struct mgmt_pending_cmd *cmd = data;
9479 struct mgmt_cp_remove_advertising *cp = cmd->param;
9480 struct mgmt_rp_remove_advertising rp;
9481
9482 bt_dev_dbg(hdev, "err %d", err);
9483
9484 memset(&rp, 0, sizeof(rp));
9485 rp.instance = cp->instance;
9486
9487 if (err)
9488 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode,
9489 mgmt_status(err));
9490 else
9491 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode,
9492 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9493
9494 mgmt_pending_free(cmd);
9495 }
9496
remove_advertising_sync(struct hci_dev * hdev,void * data)9497 static int remove_advertising_sync(struct hci_dev *hdev, void *data)
9498 {
9499 struct mgmt_pending_cmd *cmd = data;
9500 struct mgmt_cp_remove_advertising *cp = cmd->param;
9501 int err;
9502
9503 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true);
9504 if (err)
9505 return err;
9506
9507 if (list_empty(&hdev->adv_instances))
9508 err = hci_disable_advertising_sync(hdev);
9509
9510 return err;
9511 }
9512
remove_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9513 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
9514 void *data, u16 data_len)
9515 {
9516 struct mgmt_cp_remove_advertising *cp = data;
9517 struct mgmt_pending_cmd *cmd;
9518 int err;
9519
9520 bt_dev_dbg(hdev, "sock %p", sk);
9521
9522 hci_dev_lock(hdev);
9523
9524 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
9525 err = mgmt_cmd_status(sk, hdev->id,
9526 MGMT_OP_REMOVE_ADVERTISING,
9527 MGMT_STATUS_INVALID_PARAMS);
9528 goto unlock;
9529 }
9530
9531 if (pending_find(MGMT_OP_SET_LE, hdev)) {
9532 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9533 MGMT_STATUS_BUSY);
9534 goto unlock;
9535 }
9536
9537 if (list_empty(&hdev->adv_instances)) {
9538 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
9539 MGMT_STATUS_INVALID_PARAMS);
9540 goto unlock;
9541 }
9542
9543 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
9544 data_len);
9545 if (!cmd) {
9546 err = -ENOMEM;
9547 goto unlock;
9548 }
9549
9550 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd,
9551 remove_advertising_complete);
9552 if (err < 0)
9553 mgmt_pending_free(cmd);
9554
9555 unlock:
9556 hci_dev_unlock(hdev);
9557
9558 return err;
9559 }
9560
get_adv_size_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)9561 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
9562 void *data, u16 data_len)
9563 {
9564 struct mgmt_cp_get_adv_size_info *cp = data;
9565 struct mgmt_rp_get_adv_size_info rp;
9566 u32 flags, supported_flags;
9567
9568 bt_dev_dbg(hdev, "sock %p", sk);
9569
9570 if (!lmp_le_capable(hdev))
9571 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9572 MGMT_STATUS_REJECTED);
9573
9574 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
9575 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9576 MGMT_STATUS_INVALID_PARAMS);
9577
9578 flags = __le32_to_cpu(cp->flags);
9579
9580 /* The current implementation only supports a subset of the specified
9581 * flags.
9582 */
9583 supported_flags = get_supported_adv_flags(hdev);
9584 if (flags & ~supported_flags)
9585 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9586 MGMT_STATUS_INVALID_PARAMS);
9587
9588 rp.instance = cp->instance;
9589 rp.flags = cp->flags;
9590 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
9591 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
9592
9593 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
9594 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
9595 }
9596
9597 static const struct hci_mgmt_handler mgmt_handlers[] = {
9598 { NULL }, /* 0x0000 (no command) */
9599 { read_version, MGMT_READ_VERSION_SIZE,
9600 HCI_MGMT_NO_HDEV |
9601 HCI_MGMT_UNTRUSTED },
9602 { read_commands, MGMT_READ_COMMANDS_SIZE,
9603 HCI_MGMT_NO_HDEV |
9604 HCI_MGMT_UNTRUSTED },
9605 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
9606 HCI_MGMT_NO_HDEV |
9607 HCI_MGMT_UNTRUSTED },
9608 { read_controller_info, MGMT_READ_INFO_SIZE,
9609 HCI_MGMT_UNTRUSTED },
9610 { set_powered, MGMT_SETTING_SIZE },
9611 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
9612 { set_connectable, MGMT_SETTING_SIZE },
9613 { set_fast_connectable, MGMT_SETTING_SIZE },
9614 { set_bondable, MGMT_SETTING_SIZE },
9615 { set_link_security, MGMT_SETTING_SIZE },
9616 { set_ssp, MGMT_SETTING_SIZE },
9617 { set_hs, MGMT_SETTING_SIZE },
9618 { set_le, MGMT_SETTING_SIZE },
9619 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
9620 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
9621 { add_uuid, MGMT_ADD_UUID_SIZE },
9622 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
9623 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
9624 HCI_MGMT_VAR_LEN },
9625 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
9626 HCI_MGMT_VAR_LEN },
9627 { disconnect, MGMT_DISCONNECT_SIZE },
9628 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
9629 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
9630 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
9631 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
9632 { pair_device, MGMT_PAIR_DEVICE_SIZE },
9633 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
9634 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
9635 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
9636 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
9637 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
9638 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
9639 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
9640 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
9641 HCI_MGMT_VAR_LEN },
9642 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
9643 { start_discovery, MGMT_START_DISCOVERY_SIZE },
9644 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
9645 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
9646 { block_device, MGMT_BLOCK_DEVICE_SIZE },
9647 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
9648 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
9649 { set_advertising, MGMT_SETTING_SIZE },
9650 { set_bredr, MGMT_SETTING_SIZE },
9651 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
9652 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
9653 { set_secure_conn, MGMT_SETTING_SIZE },
9654 { set_debug_keys, MGMT_SETTING_SIZE },
9655 { set_privacy, MGMT_SET_PRIVACY_SIZE },
9656 { load_irks, MGMT_LOAD_IRKS_SIZE,
9657 HCI_MGMT_VAR_LEN },
9658 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
9659 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
9660 { add_device, MGMT_ADD_DEVICE_SIZE },
9661 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
9662 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
9663 HCI_MGMT_VAR_LEN },
9664 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
9665 HCI_MGMT_NO_HDEV |
9666 HCI_MGMT_UNTRUSTED },
9667 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
9668 HCI_MGMT_UNCONFIGURED |
9669 HCI_MGMT_UNTRUSTED },
9670 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
9671 HCI_MGMT_UNCONFIGURED },
9672 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
9673 HCI_MGMT_UNCONFIGURED },
9674 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
9675 HCI_MGMT_VAR_LEN },
9676 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
9677 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
9678 HCI_MGMT_NO_HDEV |
9679 HCI_MGMT_UNTRUSTED },
9680 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
9681 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
9682 HCI_MGMT_VAR_LEN },
9683 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
9684 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
9685 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
9686 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
9687 HCI_MGMT_UNTRUSTED },
9688 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
9689 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
9690 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
9691 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE,
9692 HCI_MGMT_VAR_LEN },
9693 { set_wideband_speech, MGMT_SETTING_SIZE },
9694 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE,
9695 HCI_MGMT_UNTRUSTED },
9696 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE,
9697 HCI_MGMT_UNTRUSTED |
9698 HCI_MGMT_HDEV_OPTIONAL },
9699 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE,
9700 HCI_MGMT_VAR_LEN |
9701 HCI_MGMT_HDEV_OPTIONAL },
9702 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
9703 HCI_MGMT_UNTRUSTED },
9704 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
9705 HCI_MGMT_VAR_LEN },
9706 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
9707 HCI_MGMT_UNTRUSTED },
9708 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
9709 HCI_MGMT_VAR_LEN },
9710 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE },
9711 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE },
9712 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
9713 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
9714 HCI_MGMT_VAR_LEN },
9715 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE },
9716 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
9717 HCI_MGMT_VAR_LEN },
9718 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE,
9719 HCI_MGMT_VAR_LEN },
9720 { add_adv_patterns_monitor_rssi,
9721 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE,
9722 HCI_MGMT_VAR_LEN },
9723 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE,
9724 HCI_MGMT_VAR_LEN },
9725 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE },
9726 { mesh_send, MGMT_MESH_SEND_SIZE,
9727 HCI_MGMT_VAR_LEN },
9728 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE },
9729 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN },
9730 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE,
9731 HCI_MGMT_VAR_LEN },
9732 };
9733
mgmt_index_added(struct hci_dev * hdev)9734 void mgmt_index_added(struct hci_dev *hdev)
9735 {
9736 struct mgmt_ev_ext_index ev;
9737
9738 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE))
9739 return;
9740
9741 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9742 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0,
9743 HCI_MGMT_UNCONF_INDEX_EVENTS);
9744 ev.type = 0x01;
9745 } else {
9746 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
9747 HCI_MGMT_INDEX_EVENTS);
9748 ev.type = 0x00;
9749 }
9750
9751 ev.bus = hdev->bus;
9752
9753 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
9754 HCI_MGMT_EXT_INDEX_EVENTS);
9755 }
9756
mgmt_index_removed(struct hci_dev * hdev)9757 void mgmt_index_removed(struct hci_dev *hdev)
9758 {
9759 struct mgmt_ev_ext_index ev;
9760 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX };
9761
9762 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE))
9763 return;
9764
9765 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);
9766
9767 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
9768 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0,
9769 HCI_MGMT_UNCONF_INDEX_EVENTS);
9770 ev.type = 0x01;
9771 } else {
9772 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
9773 HCI_MGMT_INDEX_EVENTS);
9774 ev.type = 0x00;
9775 }
9776
9777 ev.bus = hdev->bus;
9778
9779 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
9780 HCI_MGMT_EXT_INDEX_EVENTS);
9781
9782 /* Cancel any remaining timed work */
9783 if (!hci_dev_test_flag(hdev, HCI_MGMT))
9784 return;
9785 cancel_delayed_work_sync(&hdev->discov_off);
9786 cancel_delayed_work_sync(&hdev->service_cache);
9787 cancel_delayed_work_sync(&hdev->rpa_expired);
9788 cancel_delayed_work_sync(&hdev->mesh_send_done);
9789 }
9790
mgmt_power_on(struct hci_dev * hdev,int err)9791 void mgmt_power_on(struct hci_dev *hdev, int err)
9792 {
9793 struct cmd_lookup match = { NULL, hdev };
9794
9795 bt_dev_dbg(hdev, "err %d", err);
9796
9797 hci_dev_lock(hdev);
9798
9799 if (!err) {
9800 restart_le_actions(hdev);
9801 hci_update_passive_scan(hdev);
9802 }
9803
9804 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,
9805 &match);
9806
9807 new_settings(hdev, match.sk);
9808
9809 if (match.sk)
9810 sock_put(match.sk);
9811
9812 hci_dev_unlock(hdev);
9813 }
9814
__mgmt_power_off(struct hci_dev * hdev)9815 void __mgmt_power_off(struct hci_dev *hdev)
9816 {
9817 struct cmd_lookup match = { NULL, hdev };
9818 u8 zero_cod[] = { 0, 0, 0 };
9819
9820 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp,
9821 &match);
9822
9823 /* If the power off is because of hdev unregistration let
9824 * use the appropriate INVALID_INDEX status. Otherwise use
9825 * NOT_POWERED. We cover both scenarios here since later in
9826 * mgmt_index_removed() any hci_conn callbacks will have already
9827 * been triggered, potentially causing misleading DISCONNECTED
9828 * status responses.
9829 */
9830 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9831 match.mgmt_status = MGMT_STATUS_INVALID_INDEX;
9832 else
9833 match.mgmt_status = MGMT_STATUS_NOT_POWERED;
9834
9835 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match);
9836
9837 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
9838 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
9839 zero_cod, sizeof(zero_cod),
9840 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
9841 ext_info_changed(hdev, NULL);
9842 }
9843
9844 new_settings(hdev, match.sk);
9845
9846 if (match.sk)
9847 sock_put(match.sk);
9848 }
9849
mgmt_set_powered_failed(struct hci_dev * hdev,int err)9850 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
9851 {
9852 struct mgmt_pending_cmd *cmd;
9853 u8 status;
9854
9855 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
9856 if (!cmd)
9857 return;
9858
9859 if (err == -ERFKILL)
9860 status = MGMT_STATUS_RFKILLED;
9861 else
9862 status = MGMT_STATUS_FAILED;
9863
9864 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
9865
9866 mgmt_pending_remove(cmd);
9867 }
9868
mgmt_new_link_key(struct hci_dev * hdev,struct link_key * key,bool persistent)9869 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
9870 bool persistent)
9871 {
9872 struct mgmt_ev_new_link_key ev;
9873
9874 memset(&ev, 0, sizeof(ev));
9875
9876 ev.store_hint = persistent;
9877 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9878 ev.key.addr.type = BDADDR_BREDR;
9879 ev.key.type = key->type;
9880 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
9881 ev.key.pin_len = key->pin_len;
9882
9883 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
9884 }
9885
mgmt_ltk_type(struct smp_ltk * ltk)9886 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
9887 {
9888 switch (ltk->type) {
9889 case SMP_LTK:
9890 case SMP_LTK_RESPONDER:
9891 if (ltk->authenticated)
9892 return MGMT_LTK_AUTHENTICATED;
9893 return MGMT_LTK_UNAUTHENTICATED;
9894 case SMP_LTK_P256:
9895 if (ltk->authenticated)
9896 return MGMT_LTK_P256_AUTH;
9897 return MGMT_LTK_P256_UNAUTH;
9898 case SMP_LTK_P256_DEBUG:
9899 return MGMT_LTK_P256_DEBUG;
9900 }
9901
9902 return MGMT_LTK_UNAUTHENTICATED;
9903 }
9904
mgmt_new_ltk(struct hci_dev * hdev,struct smp_ltk * key,bool persistent)9905 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
9906 {
9907 struct mgmt_ev_new_long_term_key ev;
9908
9909 memset(&ev, 0, sizeof(ev));
9910
9911 /* Devices using resolvable or non-resolvable random addresses
9912 * without providing an identity resolving key don't require
9913 * to store long term keys. Their addresses will change the
9914 * next time around.
9915 *
9916 * Only when a remote device provides an identity address
9917 * make sure the long term key is stored. If the remote
9918 * identity is known, the long term keys are internally
9919 * mapped to the identity address. So allow static random
9920 * and public addresses here.
9921 */
9922 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9923 (key->bdaddr.b[5] & 0xc0) != 0xc0)
9924 ev.store_hint = 0x00;
9925 else
9926 ev.store_hint = persistent;
9927
9928 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
9929 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
9930 ev.key.type = mgmt_ltk_type(key);
9931 ev.key.enc_size = key->enc_size;
9932 ev.key.ediv = key->ediv;
9933 ev.key.rand = key->rand;
9934
9935 if (key->type == SMP_LTK)
9936 ev.key.initiator = 1;
9937
9938 /* Make sure we copy only the significant bytes based on the
9939 * encryption key size, and set the rest of the value to zeroes.
9940 */
9941 memcpy(ev.key.val, key->val, key->enc_size);
9942 memset(ev.key.val + key->enc_size, 0,
9943 sizeof(ev.key.val) - key->enc_size);
9944
9945 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
9946 }
9947
mgmt_new_irk(struct hci_dev * hdev,struct smp_irk * irk,bool persistent)9948 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
9949 {
9950 struct mgmt_ev_new_irk ev;
9951
9952 memset(&ev, 0, sizeof(ev));
9953
9954 ev.store_hint = persistent;
9955
9956 bacpy(&ev.rpa, &irk->rpa);
9957 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
9958 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
9959 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
9960
9961 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
9962 }
9963
mgmt_new_csrk(struct hci_dev * hdev,struct smp_csrk * csrk,bool persistent)9964 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
9965 bool persistent)
9966 {
9967 struct mgmt_ev_new_csrk ev;
9968
9969 memset(&ev, 0, sizeof(ev));
9970
9971 /* Devices using resolvable or non-resolvable random addresses
9972 * without providing an identity resolving key don't require
9973 * to store signature resolving keys. Their addresses will change
9974 * the next time around.
9975 *
9976 * Only when a remote device provides an identity address
9977 * make sure the signature resolving key is stored. So allow
9978 * static random and public addresses here.
9979 */
9980 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
9981 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
9982 ev.store_hint = 0x00;
9983 else
9984 ev.store_hint = persistent;
9985
9986 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
9987 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
9988 ev.key.type = csrk->type;
9989 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
9990
9991 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
9992 }
9993
mgmt_new_conn_param(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 store_hint,u16 min_interval,u16 max_interval,u16 latency,u16 timeout)9994 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
9995 u8 bdaddr_type, u8 store_hint, u16 min_interval,
9996 u16 max_interval, u16 latency, u16 timeout)
9997 {
9998 struct mgmt_ev_new_conn_param ev;
9999
10000 if (!hci_is_identity_address(bdaddr, bdaddr_type))
10001 return;
10002
10003 memset(&ev, 0, sizeof(ev));
10004 bacpy(&ev.addr.bdaddr, bdaddr);
10005 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
10006 ev.store_hint = store_hint;
10007 ev.min_interval = cpu_to_le16(min_interval);
10008 ev.max_interval = cpu_to_le16(max_interval);
10009 ev.latency = cpu_to_le16(latency);
10010 ev.timeout = cpu_to_le16(timeout);
10011
10012 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
10013 }
10014
mgmt_device_connected(struct hci_dev * hdev,struct hci_conn * conn,u8 * name,u8 name_len)10015 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
10016 u8 *name, u8 name_len)
10017 {
10018 struct sk_buff *skb;
10019 struct mgmt_ev_device_connected *ev;
10020 u16 eir_len = 0;
10021 u32 flags = 0;
10022
10023 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
10024 return;
10025
10026 /* allocate buff for LE or BR/EDR adv */
10027 if (conn->le_adv_data_len > 0)
10028 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10029 sizeof(*ev) + conn->le_adv_data_len);
10030 else
10031 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
10032 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) +
10033 eir_precalc_len(sizeof(conn->dev_class)));
10034
10035 if (!skb)
10036 return;
10037
10038 ev = skb_put(skb, sizeof(*ev));
10039 bacpy(&ev->addr.bdaddr, &conn->dst);
10040 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10041
10042 if (conn->out)
10043 flags |= MGMT_DEV_FOUND_INITIATED_CONN;
10044
10045 ev->flags = __cpu_to_le32(flags);
10046
10047 /* We must ensure that the EIR Data fields are ordered and
10048 * unique. Keep it simple for now and avoid the problem by not
10049 * adding any BR/EDR data to the LE adv.
10050 */
10051 if (conn->le_adv_data_len > 0) {
10052 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len);
10053 eir_len = conn->le_adv_data_len;
10054 } else {
10055 if (name)
10056 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10057
10058 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class)))
10059 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV,
10060 conn->dev_class, sizeof(conn->dev_class));
10061 }
10062
10063 ev->eir_len = cpu_to_le16(eir_len);
10064
10065 mgmt_event_skb(skb, NULL);
10066 }
10067
unpair_device_rsp(struct mgmt_pending_cmd * cmd,void * data)10068 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
10069 {
10070 struct hci_dev *hdev = data;
10071 struct mgmt_cp_unpair_device *cp = cmd->param;
10072
10073 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
10074
10075 cmd->cmd_complete(cmd, 0);
10076 }
10077
mgmt_powering_down(struct hci_dev * hdev)10078 bool mgmt_powering_down(struct hci_dev *hdev)
10079 {
10080 struct mgmt_pending_cmd *cmd;
10081 struct mgmt_mode *cp;
10082
10083 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10084 return true;
10085
10086 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
10087 if (!cmd)
10088 return false;
10089
10090 cp = cmd->param;
10091 if (!cp->val)
10092 return true;
10093
10094 return false;
10095 }
10096
hci_to_mgmt_reason(u8 err)10097 u8 hci_to_mgmt_reason(u8 err)
10098 {
10099 switch (err) {
10100 case HCI_ERROR_CONNECTION_TIMEOUT:
10101 return MGMT_DEV_DISCONN_TIMEOUT;
10102 case HCI_ERROR_REMOTE_USER_TERM:
10103 case HCI_ERROR_REMOTE_LOW_RESOURCES:
10104 case HCI_ERROR_REMOTE_POWER_OFF:
10105 return MGMT_DEV_DISCONN_REMOTE;
10106 case HCI_ERROR_LOCAL_HOST_TERM:
10107 return MGMT_DEV_DISCONN_LOCAL_HOST;
10108 default:
10109 return MGMT_DEV_DISCONN_UNKNOWN;
10110 }
10111 }
10112
mgmt_device_disconnected(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 reason,bool mgmt_connected)10113 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
10114 u8 link_type, u8 addr_type, u8 reason,
10115 bool mgmt_connected)
10116 {
10117 struct mgmt_ev_device_disconnected ev;
10118 struct sock *sk = NULL;
10119
10120 if (!mgmt_connected)
10121 return;
10122
10123 if (link_type != ACL_LINK &&
10124 link_type != LE_LINK &&
10125 link_type != BIS_LINK)
10126 return;
10127
10128 bacpy(&ev.addr.bdaddr, bdaddr);
10129 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10130 ev.reason = reason;
10131
10132 /* Report disconnects due to suspend */
10133 if (hdev->suspended)
10134 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
10135
10136 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
10137
10138 if (sk)
10139 sock_put(sk);
10140 }
10141
mgmt_disconnect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10142 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
10143 u8 link_type, u8 addr_type, u8 status)
10144 {
10145 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
10146 struct mgmt_cp_disconnect *cp;
10147 struct mgmt_pending_cmd *cmd;
10148
10149 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true,
10150 unpair_device_rsp, hdev);
10151
10152 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
10153 if (!cmd)
10154 return;
10155
10156 cp = cmd->param;
10157
10158 if (bacmp(bdaddr, &cp->addr.bdaddr))
10159 return;
10160
10161 if (cp->addr.type != bdaddr_type)
10162 return;
10163
10164 cmd->cmd_complete(cmd, mgmt_status(status));
10165 mgmt_pending_remove(cmd);
10166 }
10167
mgmt_connect_failed(struct hci_dev * hdev,struct hci_conn * conn,u8 status)10168 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status)
10169 {
10170 struct mgmt_ev_connect_failed ev;
10171
10172 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
10173 mgmt_device_disconnected(hdev, &conn->dst, conn->type,
10174 conn->dst_type,
10175 hci_to_mgmt_reason(status), true);
10176 return;
10177 }
10178
10179 bacpy(&ev.addr.bdaddr, &conn->dst);
10180 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10181 ev.status = mgmt_status(status);
10182
10183 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
10184 }
10185
mgmt_pin_code_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 secure)10186 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
10187 {
10188 struct mgmt_ev_pin_code_request ev;
10189
10190 bacpy(&ev.addr.bdaddr, bdaddr);
10191 ev.addr.type = BDADDR_BREDR;
10192 ev.secure = secure;
10193
10194 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
10195 }
10196
mgmt_pin_code_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)10197 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10198 u8 status)
10199 {
10200 struct mgmt_pending_cmd *cmd;
10201
10202 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
10203 if (!cmd)
10204 return;
10205
10206 cmd->cmd_complete(cmd, mgmt_status(status));
10207 mgmt_pending_remove(cmd);
10208 }
10209
mgmt_pin_code_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)10210 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10211 u8 status)
10212 {
10213 struct mgmt_pending_cmd *cmd;
10214
10215 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
10216 if (!cmd)
10217 return;
10218
10219 cmd->cmd_complete(cmd, mgmt_status(status));
10220 mgmt_pending_remove(cmd);
10221 }
10222
mgmt_user_confirm_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 value,u8 confirm_hint)10223 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10224 u8 link_type, u8 addr_type, u32 value,
10225 u8 confirm_hint)
10226 {
10227 struct mgmt_ev_user_confirm_request ev;
10228
10229 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10230
10231 bacpy(&ev.addr.bdaddr, bdaddr);
10232 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10233 ev.confirm_hint = confirm_hint;
10234 ev.value = cpu_to_le32(value);
10235
10236 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
10237 NULL);
10238 }
10239
mgmt_user_passkey_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type)10240 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
10241 u8 link_type, u8 addr_type)
10242 {
10243 struct mgmt_ev_user_passkey_request ev;
10244
10245 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10246
10247 bacpy(&ev.addr.bdaddr, bdaddr);
10248 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10249
10250 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
10251 NULL);
10252 }
10253
user_pairing_resp_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status,u8 opcode)10254 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10255 u8 link_type, u8 addr_type, u8 status,
10256 u8 opcode)
10257 {
10258 struct mgmt_pending_cmd *cmd;
10259
10260 cmd = pending_find(opcode, hdev);
10261 if (!cmd)
10262 return -ENOENT;
10263
10264 cmd->cmd_complete(cmd, mgmt_status(status));
10265 mgmt_pending_remove(cmd);
10266
10267 return 0;
10268 }
10269
mgmt_user_confirm_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10270 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10271 u8 link_type, u8 addr_type, u8 status)
10272 {
10273 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10274 status, MGMT_OP_USER_CONFIRM_REPLY);
10275 }
10276
mgmt_user_confirm_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10277 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10278 u8 link_type, u8 addr_type, u8 status)
10279 {
10280 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10281 status,
10282 MGMT_OP_USER_CONFIRM_NEG_REPLY);
10283 }
10284
mgmt_user_passkey_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10285 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10286 u8 link_type, u8 addr_type, u8 status)
10287 {
10288 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10289 status, MGMT_OP_USER_PASSKEY_REPLY);
10290 }
10291
mgmt_user_passkey_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)10292 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
10293 u8 link_type, u8 addr_type, u8 status)
10294 {
10295 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
10296 status,
10297 MGMT_OP_USER_PASSKEY_NEG_REPLY);
10298 }
10299
mgmt_user_passkey_notify(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 passkey,u8 entered)10300 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
10301 u8 link_type, u8 addr_type, u32 passkey,
10302 u8 entered)
10303 {
10304 struct mgmt_ev_passkey_notify ev;
10305
10306 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
10307
10308 bacpy(&ev.addr.bdaddr, bdaddr);
10309 ev.addr.type = link_to_bdaddr(link_type, addr_type);
10310 ev.passkey = __cpu_to_le32(passkey);
10311 ev.entered = entered;
10312
10313 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
10314 }
10315
mgmt_auth_failed(struct hci_conn * conn,u8 hci_status)10316 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
10317 {
10318 struct mgmt_ev_auth_failed ev;
10319 struct mgmt_pending_cmd *cmd;
10320 u8 status = mgmt_status(hci_status);
10321
10322 bacpy(&ev.addr.bdaddr, &conn->dst);
10323 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10324 ev.status = status;
10325
10326 cmd = remove_pairing(conn);
10327
10328 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
10329 cmd ? cmd->sk : NULL);
10330
10331 if (cmd) {
10332 cmd->cmd_complete(cmd, status);
10333 mgmt_pending_free(cmd);
10334 }
10335 }
10336
mgmt_auth_enable_complete(struct hci_dev * hdev,u8 status)10337 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
10338 {
10339 struct cmd_lookup match = { NULL, hdev };
10340 bool changed;
10341
10342 if (status) {
10343 u8 mgmt_err = mgmt_status(status);
10344 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,
10345 cmd_status_rsp, &mgmt_err);
10346 return;
10347 }
10348
10349 if (test_bit(HCI_AUTH, &hdev->flags))
10350 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
10351 else
10352 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
10353
10354 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true,
10355 settings_rsp, &match);
10356
10357 if (changed)
10358 new_settings(hdev, match.sk);
10359
10360 if (match.sk)
10361 sock_put(match.sk);
10362 }
10363
sk_lookup(struct mgmt_pending_cmd * cmd,void * data)10364 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
10365 {
10366 struct cmd_lookup *match = data;
10367
10368 if (match->sk == NULL) {
10369 match->sk = cmd->sk;
10370 sock_hold(match->sk);
10371 }
10372 }
10373
mgmt_set_class_of_dev_complete(struct hci_dev * hdev,u8 * dev_class,u8 status)10374 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
10375 u8 status)
10376 {
10377 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
10378
10379 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup,
10380 &match);
10381 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup,
10382 &match);
10383 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup,
10384 &match);
10385
10386 if (!status) {
10387 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
10388 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
10389 ext_info_changed(hdev, NULL);
10390 }
10391
10392 if (match.sk)
10393 sock_put(match.sk);
10394 }
10395
mgmt_set_local_name_complete(struct hci_dev * hdev,u8 * name,u8 status)10396 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
10397 {
10398 struct mgmt_cp_set_local_name ev;
10399 struct mgmt_pending_cmd *cmd;
10400
10401 if (status)
10402 return;
10403
10404 memset(&ev, 0, sizeof(ev));
10405 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
10406 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
10407
10408 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
10409 if (!cmd) {
10410 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
10411
10412 /* If this is a HCI command related to powering on the
10413 * HCI dev don't send any mgmt signals.
10414 */
10415 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN))
10416 return;
10417
10418 if (pending_find(MGMT_OP_SET_POWERED, hdev))
10419 return;
10420 }
10421
10422 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
10423 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
10424 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
10425 }
10426
has_uuid(u8 * uuid,u16 uuid_count,u8 (* uuids)[16])10427 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
10428 {
10429 int i;
10430
10431 for (i = 0; i < uuid_count; i++) {
10432 if (!memcmp(uuid, uuids[i], 16))
10433 return true;
10434 }
10435
10436 return false;
10437 }
10438
eir_has_uuids(u8 * eir,u16 eir_len,u16 uuid_count,u8 (* uuids)[16])10439 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
10440 {
10441 u16 parsed = 0;
10442
10443 while (parsed < eir_len) {
10444 u8 field_len = eir[0];
10445 u8 uuid[16];
10446 int i;
10447
10448 if (field_len == 0)
10449 break;
10450
10451 if (eir_len - parsed < field_len + 1)
10452 break;
10453
10454 switch (eir[1]) {
10455 case EIR_UUID16_ALL:
10456 case EIR_UUID16_SOME:
10457 for (i = 0; i + 3 <= field_len; i += 2) {
10458 memcpy(uuid, bluetooth_base_uuid, 16);
10459 uuid[13] = eir[i + 3];
10460 uuid[12] = eir[i + 2];
10461 if (has_uuid(uuid, uuid_count, uuids))
10462 return true;
10463 }
10464 break;
10465 case EIR_UUID32_ALL:
10466 case EIR_UUID32_SOME:
10467 for (i = 0; i + 5 <= field_len; i += 4) {
10468 memcpy(uuid, bluetooth_base_uuid, 16);
10469 uuid[15] = eir[i + 5];
10470 uuid[14] = eir[i + 4];
10471 uuid[13] = eir[i + 3];
10472 uuid[12] = eir[i + 2];
10473 if (has_uuid(uuid, uuid_count, uuids))
10474 return true;
10475 }
10476 break;
10477 case EIR_UUID128_ALL:
10478 case EIR_UUID128_SOME:
10479 for (i = 0; i + 17 <= field_len; i += 16) {
10480 memcpy(uuid, eir + i + 2, 16);
10481 if (has_uuid(uuid, uuid_count, uuids))
10482 return true;
10483 }
10484 break;
10485 }
10486
10487 parsed += field_len + 1;
10488 eir += field_len + 1;
10489 }
10490
10491 return false;
10492 }
10493
is_filter_match(struct hci_dev * hdev,s8 rssi,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)10494 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
10495 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
10496 {
10497 /* If a RSSI threshold has been specified, and
10498 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
10499 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
10500 * is set, let it through for further processing, as we might need to
10501 * restart the scan.
10502 *
10503 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
10504 * the results are also dropped.
10505 */
10506 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10507 (rssi == HCI_RSSI_INVALID ||
10508 (rssi < hdev->discovery.rssi &&
10509 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER))))
10510 return false;
10511
10512 spin_lock(&hdev->discovery.lock);
10513 if (hdev->discovery.uuid_count != 0) {
10514 /* If a list of UUIDs is provided in filter, results with no
10515 * matching UUID should be dropped.
10516 */
10517 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
10518 hdev->discovery.uuids) &&
10519 !eir_has_uuids(scan_rsp, scan_rsp_len,
10520 hdev->discovery.uuid_count,
10521 hdev->discovery.uuids)) {
10522 spin_unlock(&hdev->discovery.lock);
10523 return false;
10524 }
10525 }
10526 spin_unlock(&hdev->discovery.lock);
10527
10528 /* If duplicate filtering does not report RSSI changes, then restart
10529 * scanning to ensure updated result with updated RSSI values.
10530 */
10531 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) {
10532 /* Validate RSSI value against the RSSI threshold once more. */
10533 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
10534 rssi < hdev->discovery.rssi)
10535 return false;
10536 }
10537
10538 return true;
10539 }
10540
mgmt_adv_monitor_device_lost(struct hci_dev * hdev,u16 handle,bdaddr_t * bdaddr,u8 addr_type)10541 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
10542 bdaddr_t *bdaddr, u8 addr_type)
10543 {
10544 struct mgmt_ev_adv_monitor_device_lost ev;
10545
10546 ev.monitor_handle = cpu_to_le16(handle);
10547 bacpy(&ev.addr.bdaddr, bdaddr);
10548 ev.addr.type = addr_type;
10549
10550 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev),
10551 NULL);
10552 }
10553
mgmt_send_adv_monitor_device_found(struct hci_dev * hdev,struct sk_buff * skb,struct sock * skip_sk,u16 handle)10554 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev,
10555 struct sk_buff *skb,
10556 struct sock *skip_sk,
10557 u16 handle)
10558 {
10559 struct sk_buff *advmon_skb;
10560 size_t advmon_skb_len;
10561 __le16 *monitor_handle;
10562
10563 if (!skb)
10564 return;
10565
10566 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) -
10567 sizeof(struct mgmt_ev_device_found)) + skb->len;
10568 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND,
10569 advmon_skb_len);
10570 if (!advmon_skb)
10571 return;
10572
10573 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except
10574 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and
10575 * store monitor_handle of the matched monitor.
10576 */
10577 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle));
10578 *monitor_handle = cpu_to_le16(handle);
10579 skb_put_data(advmon_skb, skb->data, skb->len);
10580
10581 mgmt_event_skb(advmon_skb, skip_sk);
10582 }
10583
mgmt_adv_monitor_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,bool report_device,struct sk_buff * skb,struct sock * skip_sk)10584 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev,
10585 bdaddr_t *bdaddr, bool report_device,
10586 struct sk_buff *skb,
10587 struct sock *skip_sk)
10588 {
10589 struct monitored_device *dev, *tmp;
10590 bool matched = false;
10591 bool notified = false;
10592
10593 /* We have received the Advertisement Report because:
10594 * 1. the kernel has initiated active discovery
10595 * 2. if not, we have pend_le_reports > 0 in which case we are doing
10596 * passive scanning
10597 * 3. if none of the above is true, we have one or more active
10598 * Advertisement Monitor
10599 *
10600 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND
10601 * and report ONLY one advertisement per device for the matched Monitor
10602 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10603 *
10604 * For case 3, since we are not active scanning and all advertisements
10605 * received are due to a matched Advertisement Monitor, report all
10606 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event.
10607 */
10608 if (report_device && !hdev->advmon_pend_notify) {
10609 mgmt_event_skb(skb, skip_sk);
10610 return;
10611 }
10612
10613 hdev->advmon_pend_notify = false;
10614
10615 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) {
10616 if (!bacmp(&dev->bdaddr, bdaddr)) {
10617 matched = true;
10618
10619 if (!dev->notified) {
10620 mgmt_send_adv_monitor_device_found(hdev, skb,
10621 skip_sk,
10622 dev->handle);
10623 notified = true;
10624 dev->notified = true;
10625 }
10626 }
10627
10628 if (!dev->notified)
10629 hdev->advmon_pend_notify = true;
10630 }
10631
10632 if (!report_device &&
10633 ((matched && !notified) || !msft_monitor_supported(hdev))) {
10634 /* Handle 0 indicates that we are not active scanning and this
10635 * is a subsequent advertisement report for an already matched
10636 * Advertisement Monitor or the controller offloading support
10637 * is not available.
10638 */
10639 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0);
10640 }
10641
10642 if (report_device)
10643 mgmt_event_skb(skb, skip_sk);
10644 else
10645 kfree_skb(skb);
10646 }
10647
mesh_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len,u64 instant)10648 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr,
10649 u8 addr_type, s8 rssi, u32 flags, u8 *eir,
10650 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10651 u64 instant)
10652 {
10653 struct sk_buff *skb;
10654 struct mgmt_ev_mesh_device_found *ev;
10655 int i, j;
10656
10657 if (!hdev->mesh_ad_types[0])
10658 goto accepted;
10659
10660 /* Scan for requested AD types */
10661 if (eir_len > 0) {
10662 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) {
10663 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10664 if (!hdev->mesh_ad_types[j])
10665 break;
10666
10667 if (hdev->mesh_ad_types[j] == eir[i + 1])
10668 goto accepted;
10669 }
10670 }
10671 }
10672
10673 if (scan_rsp_len > 0) {
10674 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) {
10675 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) {
10676 if (!hdev->mesh_ad_types[j])
10677 break;
10678
10679 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1])
10680 goto accepted;
10681 }
10682 }
10683 }
10684
10685 return;
10686
10687 accepted:
10688 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND,
10689 sizeof(*ev) + eir_len + scan_rsp_len);
10690 if (!skb)
10691 return;
10692
10693 ev = skb_put(skb, sizeof(*ev));
10694
10695 bacpy(&ev->addr.bdaddr, bdaddr);
10696 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type);
10697 ev->rssi = rssi;
10698 ev->flags = cpu_to_le32(flags);
10699 ev->instant = cpu_to_le64(instant);
10700
10701 if (eir_len > 0)
10702 /* Copy EIR or advertising data into event */
10703 skb_put_data(skb, eir, eir_len);
10704
10705 if (scan_rsp_len > 0)
10706 /* Append scan response data to event */
10707 skb_put_data(skb, scan_rsp, scan_rsp_len);
10708
10709 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10710
10711 mgmt_event_skb(skb, NULL);
10712 }
10713
mgmt_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 * dev_class,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len,u64 instant)10714 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10715 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
10716 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len,
10717 u64 instant)
10718 {
10719 struct sk_buff *skb;
10720 struct mgmt_ev_device_found *ev;
10721 bool report_device = hci_discovery_active(hdev);
10722
10723 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK)
10724 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags,
10725 eir, eir_len, scan_rsp, scan_rsp_len,
10726 instant);
10727
10728 /* Don't send events for a non-kernel initiated discovery. With
10729 * LE one exception is if we have pend_le_reports > 0 in which
10730 * case we're doing passive scanning and want these events.
10731 */
10732 if (!hci_discovery_active(hdev)) {
10733 if (link_type == ACL_LINK)
10734 return;
10735 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports))
10736 report_device = true;
10737 else if (!hci_is_adv_monitoring(hdev))
10738 return;
10739 }
10740
10741 if (hdev->discovery.result_filtering) {
10742 /* We are using service discovery */
10743 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
10744 scan_rsp_len))
10745 return;
10746 }
10747
10748 if (hdev->discovery.limited) {
10749 /* Check for limited discoverable bit */
10750 if (dev_class) {
10751 if (!(dev_class[1] & 0x20))
10752 return;
10753 } else {
10754 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
10755 if (!flags || !(flags[0] & LE_AD_LIMITED))
10756 return;
10757 }
10758 }
10759
10760 /* Allocate skb. The 5 extra bytes are for the potential CoD field */
10761 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10762 sizeof(*ev) + eir_len + scan_rsp_len + 5);
10763 if (!skb)
10764 return;
10765
10766 ev = skb_put(skb, sizeof(*ev));
10767
10768 /* In case of device discovery with BR/EDR devices (pre 1.2), the
10769 * RSSI value was reported as 0 when not available. This behavior
10770 * is kept when using device discovery. This is required for full
10771 * backwards compatibility with the API.
10772 *
10773 * However when using service discovery, the value 127 will be
10774 * returned when the RSSI is not available.
10775 */
10776 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
10777 link_type == ACL_LINK)
10778 rssi = 0;
10779
10780 bacpy(&ev->addr.bdaddr, bdaddr);
10781 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10782 ev->rssi = rssi;
10783 ev->flags = cpu_to_le32(flags);
10784
10785 if (eir_len > 0)
10786 /* Copy EIR or advertising data into event */
10787 skb_put_data(skb, eir, eir_len);
10788
10789 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) {
10790 u8 eir_cod[5];
10791
10792 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV,
10793 dev_class, 3);
10794 skb_put_data(skb, eir_cod, sizeof(eir_cod));
10795 }
10796
10797 if (scan_rsp_len > 0)
10798 /* Append scan response data to event */
10799 skb_put_data(skb, scan_rsp, scan_rsp_len);
10800
10801 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
10802
10803 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL);
10804 }
10805
mgmt_remote_name(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,s8 rssi,u8 * name,u8 name_len)10806 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
10807 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
10808 {
10809 struct sk_buff *skb;
10810 struct mgmt_ev_device_found *ev;
10811 u16 eir_len = 0;
10812 u32 flags = 0;
10813
10814 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
10815 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
10816 if (!skb)
10817 return;
10818
10819 ev = skb_put(skb, sizeof(*ev));
10820 bacpy(&ev->addr.bdaddr, bdaddr);
10821 ev->addr.type = link_to_bdaddr(link_type, addr_type);
10822 ev->rssi = rssi;
10823
10824 if (name)
10825 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len);
10826 else
10827 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED;
10828
10829 ev->eir_len = cpu_to_le16(eir_len);
10830 ev->flags = cpu_to_le32(flags);
10831
10832 mgmt_event_skb(skb, NULL);
10833 }
10834
mgmt_discovering(struct hci_dev * hdev,u8 discovering)10835 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
10836 {
10837 struct mgmt_ev_discovering ev;
10838
10839 bt_dev_dbg(hdev, "discovering %u", discovering);
10840
10841 memset(&ev, 0, sizeof(ev));
10842 ev.type = hdev->discovery.type;
10843 ev.discovering = discovering;
10844
10845 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
10846 }
10847
mgmt_suspending(struct hci_dev * hdev,u8 state)10848 void mgmt_suspending(struct hci_dev *hdev, u8 state)
10849 {
10850 struct mgmt_ev_controller_suspend ev;
10851
10852 ev.suspend_state = state;
10853 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
10854 }
10855
mgmt_resuming(struct hci_dev * hdev,u8 reason,bdaddr_t * bdaddr,u8 addr_type)10856 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
10857 u8 addr_type)
10858 {
10859 struct mgmt_ev_controller_resume ev;
10860
10861 ev.wake_reason = reason;
10862 if (bdaddr) {
10863 bacpy(&ev.addr.bdaddr, bdaddr);
10864 ev.addr.type = addr_type;
10865 } else {
10866 memset(&ev.addr, 0, sizeof(ev.addr));
10867 }
10868
10869 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
10870 }
10871
10872 static struct hci_mgmt_chan chan = {
10873 .channel = HCI_CHANNEL_CONTROL,
10874 .handler_count = ARRAY_SIZE(mgmt_handlers),
10875 .handlers = mgmt_handlers,
10876 .hdev_init = mgmt_init_hdev,
10877 };
10878
mgmt_init(void)10879 int mgmt_init(void)
10880 {
10881 return hci_mgmt_chan_register(&chan);
10882 }
10883
mgmt_conn_subrate_notify(struct hci_dev * hdev,struct hci_conn * conn,u8 status)10884 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn,
10885 u8 status)
10886 {
10887 struct mgmt_ev_conn_subrate ev;
10888
10889 bacpy(&ev.addr.bdaddr, &conn->dst);
10890 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
10891 ev.status = mgmt_status(status);
10892 ev.interval = cpu_to_le16(conn->le_rate_interval);
10893 ev.subrate = cpu_to_le16(conn->le_subrate);
10894 ev.latency = cpu_to_le16(conn->le_rate_latency);
10895 ev.cont_num = cpu_to_le16(conn->le_cont_num);
10896 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout);
10897
10898 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL);
10899 }
10900
mgmt_exit(void)10901 void mgmt_exit(void)
10902 {
10903 hci_mgmt_chan_unregister(&chan);
10904 }
10905
mgmt_cleanup(struct sock * sk)10906 void mgmt_cleanup(struct sock *sk)
10907 {
10908 struct mgmt_mesh_tx *mesh_tx;
10909 struct hci_dev *hdev;
10910
10911 read_lock(&hci_dev_list_lock);
10912
10913 list_for_each_entry(hdev, &hci_dev_list, list) {
10914 do {
10915 mesh_tx = mgmt_mesh_next(hdev, sk);
10916
10917 if (mesh_tx)
10918 mesh_send_complete(hdev, mesh_tx, true);
10919 } while (mesh_tx);
10920 }
10921
10922 read_unlock(&hci_dev_list_lock);
10923 }
10924