?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge tag 'iommu-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
[linux/fpc-iii.git] / net / bluetooth / mgmt.c
blobfa0f7a4a1d2fc8a5422a1407bc63407f6ccdb338
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39 #include "mgmt_config.h"
40 #include "msft.h"
41
42 #define MGMT_VERSION 1
43 #define MGMT_REVISION 19
44
45 static const u16 mgmt_commands[] = {
46 MGMT_OP_READ_INDEX_LIST,
47 MGMT_OP_READ_INFO,
48 MGMT_OP_SET_POWERED,
49 MGMT_OP_SET_DISCOVERABLE,
50 MGMT_OP_SET_CONNECTABLE,
51 MGMT_OP_SET_FAST_CONNECTABLE,
52 MGMT_OP_SET_BONDABLE,
53 MGMT_OP_SET_LINK_SECURITY,
54 MGMT_OP_SET_SSP,
55 MGMT_OP_SET_HS,
56 MGMT_OP_SET_LE,
57 MGMT_OP_SET_DEV_CLASS,
58 MGMT_OP_SET_LOCAL_NAME,
59 MGMT_OP_ADD_UUID,
60 MGMT_OP_REMOVE_UUID,
61 MGMT_OP_LOAD_LINK_KEYS,
62 MGMT_OP_LOAD_LONG_TERM_KEYS,
63 MGMT_OP_DISCONNECT,
64 MGMT_OP_GET_CONNECTIONS,
65 MGMT_OP_PIN_CODE_REPLY,
66 MGMT_OP_PIN_CODE_NEG_REPLY,
67 MGMT_OP_SET_IO_CAPABILITY,
68 MGMT_OP_PAIR_DEVICE,
69 MGMT_OP_CANCEL_PAIR_DEVICE,
70 MGMT_OP_UNPAIR_DEVICE,
71 MGMT_OP_USER_CONFIRM_REPLY,
72 MGMT_OP_USER_CONFIRM_NEG_REPLY,
73 MGMT_OP_USER_PASSKEY_REPLY,
74 MGMT_OP_USER_PASSKEY_NEG_REPLY,
75 MGMT_OP_READ_LOCAL_OOB_DATA,
76 MGMT_OP_ADD_REMOTE_OOB_DATA,
77 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
78 MGMT_OP_START_DISCOVERY,
79 MGMT_OP_STOP_DISCOVERY,
80 MGMT_OP_CONFIRM_NAME,
81 MGMT_OP_BLOCK_DEVICE,
82 MGMT_OP_UNBLOCK_DEVICE,
83 MGMT_OP_SET_DEVICE_ID,
84 MGMT_OP_SET_ADVERTISING,
85 MGMT_OP_SET_BREDR,
86 MGMT_OP_SET_STATIC_ADDRESS,
87 MGMT_OP_SET_SCAN_PARAMS,
88 MGMT_OP_SET_SECURE_CONN,
89 MGMT_OP_SET_DEBUG_KEYS,
90 MGMT_OP_SET_PRIVACY,
91 MGMT_OP_LOAD_IRKS,
92 MGMT_OP_GET_CONN_INFO,
93 MGMT_OP_GET_CLOCK_INFO,
94 MGMT_OP_ADD_DEVICE,
95 MGMT_OP_REMOVE_DEVICE,
96 MGMT_OP_LOAD_CONN_PARAM,
97 MGMT_OP_READ_UNCONF_INDEX_LIST,
98 MGMT_OP_READ_CONFIG_INFO,
99 MGMT_OP_SET_EXTERNAL_CONFIG,
100 MGMT_OP_SET_PUBLIC_ADDRESS,
101 MGMT_OP_START_SERVICE_DISCOVERY,
102 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
103 MGMT_OP_READ_EXT_INDEX_LIST,
104 MGMT_OP_READ_ADV_FEATURES,
105 MGMT_OP_ADD_ADVERTISING,
106 MGMT_OP_REMOVE_ADVERTISING,
107 MGMT_OP_GET_ADV_SIZE_INFO,
108 MGMT_OP_START_LIMITED_DISCOVERY,
109 MGMT_OP_READ_EXT_INFO,
110 MGMT_OP_SET_APPEARANCE,
111 MGMT_OP_SET_BLOCKED_KEYS,
112 MGMT_OP_SET_WIDEBAND_SPEECH,
113 MGMT_OP_READ_CONTROLLER_CAP,
114 MGMT_OP_READ_EXP_FEATURES_INFO,
115 MGMT_OP_SET_EXP_FEATURE,
116 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
117 MGMT_OP_SET_DEF_SYSTEM_CONFIG,
118 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
119 MGMT_OP_SET_DEF_RUNTIME_CONFIG,
120 MGMT_OP_GET_DEVICE_FLAGS,
121 MGMT_OP_SET_DEVICE_FLAGS,
122 MGMT_OP_READ_ADV_MONITOR_FEATURES,
123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
124 MGMT_OP_REMOVE_ADV_MONITOR,
125 MGMT_OP_ADD_EXT_ADV_PARAMS,
126 MGMT_OP_ADD_EXT_ADV_DATA,
127 };
128
129 static const u16 mgmt_events[] = {
130 MGMT_EV_CONTROLLER_ERROR,
131 MGMT_EV_INDEX_ADDED,
132 MGMT_EV_INDEX_REMOVED,
133 MGMT_EV_NEW_SETTINGS,
134 MGMT_EV_CLASS_OF_DEV_CHANGED,
135 MGMT_EV_LOCAL_NAME_CHANGED,
136 MGMT_EV_NEW_LINK_KEY,
137 MGMT_EV_NEW_LONG_TERM_KEY,
138 MGMT_EV_DEVICE_CONNECTED,
139 MGMT_EV_DEVICE_DISCONNECTED,
140 MGMT_EV_CONNECT_FAILED,
141 MGMT_EV_PIN_CODE_REQUEST,
142 MGMT_EV_USER_CONFIRM_REQUEST,
143 MGMT_EV_USER_PASSKEY_REQUEST,
144 MGMT_EV_AUTH_FAILED,
145 MGMT_EV_DEVICE_FOUND,
146 MGMT_EV_DISCOVERING,
147 MGMT_EV_DEVICE_BLOCKED,
148 MGMT_EV_DEVICE_UNBLOCKED,
149 MGMT_EV_DEVICE_UNPAIRED,
150 MGMT_EV_PASSKEY_NOTIFY,
151 MGMT_EV_NEW_IRK,
152 MGMT_EV_NEW_CSRK,
153 MGMT_EV_DEVICE_ADDED,
154 MGMT_EV_DEVICE_REMOVED,
155 MGMT_EV_NEW_CONN_PARAM,
156 MGMT_EV_UNCONF_INDEX_ADDED,
157 MGMT_EV_UNCONF_INDEX_REMOVED,
158 MGMT_EV_NEW_CONFIG_OPTIONS,
159 MGMT_EV_EXT_INDEX_ADDED,
160 MGMT_EV_EXT_INDEX_REMOVED,
161 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
162 MGMT_EV_ADVERTISING_ADDED,
163 MGMT_EV_ADVERTISING_REMOVED,
164 MGMT_EV_EXT_INFO_CHANGED,
165 MGMT_EV_PHY_CONFIGURATION_CHANGED,
166 MGMT_EV_EXP_FEATURE_CHANGED,
167 MGMT_EV_DEVICE_FLAGS_CHANGED,
168 MGMT_EV_CONTROLLER_SUSPEND,
169 MGMT_EV_CONTROLLER_RESUME,
170 };
171
172 static const u16 mgmt_untrusted_commands[] = {
173 MGMT_OP_READ_INDEX_LIST,
174 MGMT_OP_READ_INFO,
175 MGMT_OP_READ_UNCONF_INDEX_LIST,
176 MGMT_OP_READ_CONFIG_INFO,
177 MGMT_OP_READ_EXT_INDEX_LIST,
178 MGMT_OP_READ_EXT_INFO,
179 MGMT_OP_READ_CONTROLLER_CAP,
180 MGMT_OP_READ_EXP_FEATURES_INFO,
181 MGMT_OP_READ_DEF_SYSTEM_CONFIG,
182 MGMT_OP_READ_DEF_RUNTIME_CONFIG,
183 };
184
185 static const u16 mgmt_untrusted_events[] = {
186 MGMT_EV_INDEX_ADDED,
187 MGMT_EV_INDEX_REMOVED,
188 MGMT_EV_NEW_SETTINGS,
189 MGMT_EV_CLASS_OF_DEV_CHANGED,
190 MGMT_EV_LOCAL_NAME_CHANGED,
191 MGMT_EV_UNCONF_INDEX_ADDED,
192 MGMT_EV_UNCONF_INDEX_REMOVED,
193 MGMT_EV_NEW_CONFIG_OPTIONS,
194 MGMT_EV_EXT_INDEX_ADDED,
195 MGMT_EV_EXT_INDEX_REMOVED,
196 MGMT_EV_EXT_INFO_CHANGED,
197 MGMT_EV_EXP_FEATURE_CHANGED,
198 MGMT_EV_ADV_MONITOR_ADDED,
199 MGMT_EV_ADV_MONITOR_REMOVED,
200 };
201
202 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
203
204 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
205 "\x00\x00\x00\x00\x00\x00\x00\x00"
206
207 /* HCI to MGMT error code conversion table */
208 static const u8 mgmt_status_table[] = {
209 MGMT_STATUS_SUCCESS,
210 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
211 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
212 MGMT_STATUS_FAILED, /* Hardware Failure */
213 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
214 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
215 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
216 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
217 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
218 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
219 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
220 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
221 MGMT_STATUS_BUSY, /* Command Disallowed */
222 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
223 MGMT_STATUS_REJECTED, /* Rejected Security */
224 MGMT_STATUS_REJECTED, /* Rejected Personal */
225 MGMT_STATUS_TIMEOUT, /* Host Timeout */
226 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
227 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
228 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
229 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
230 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
231 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
232 MGMT_STATUS_BUSY, /* Repeated Attempts */
233 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
234 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
235 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
236 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
237 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
238 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
239 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
240 MGMT_STATUS_FAILED, /* Unspecified Error */
241 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
242 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
243 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
244 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
245 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
246 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
247 MGMT_STATUS_FAILED, /* Unit Link Key Used */
248 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
249 MGMT_STATUS_TIMEOUT, /* Instant Passed */
250 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
251 MGMT_STATUS_FAILED, /* Transaction Collision */
252 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
253 MGMT_STATUS_REJECTED, /* QoS Rejected */
254 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
255 MGMT_STATUS_REJECTED, /* Insufficient Security */
256 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
257 MGMT_STATUS_BUSY, /* Role Switch Pending */
258 MGMT_STATUS_FAILED, /* Slot Violation */
259 MGMT_STATUS_FAILED, /* Role Switch Failed */
260 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
261 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
262 MGMT_STATUS_BUSY, /* Host Busy Pairing */
263 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
264 MGMT_STATUS_BUSY, /* Controller Busy */
265 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
266 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
267 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
268 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
269 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
270 };
271
272 static u8 mgmt_status(u8 hci_status)
273 {
274 if (hci_status < ARRAY_SIZE(mgmt_status_table))
275 return mgmt_status_table[hci_status];
276
277 return MGMT_STATUS_FAILED;
278 }
279
280 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
281 u16 len, int flag)
282 {
283 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
284 flag, NULL);
285 }
286
287 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
288 u16 len, int flag, struct sock *skip_sk)
289 {
290 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
291 flag, skip_sk);
292 }
293
294 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
295 struct sock *skip_sk)
296 {
297 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
298 HCI_SOCK_TRUSTED, skip_sk);
299 }
300
301 static u8 le_addr_type(u8 mgmt_addr_type)
302 {
303 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
304 return ADDR_LE_DEV_PUBLIC;
305 else
306 return ADDR_LE_DEV_RANDOM;
307 }
308
309 void mgmt_fill_version_info(void *ver)
310 {
311 struct mgmt_rp_read_version *rp = ver;
312
313 rp->version = MGMT_VERSION;
314 rp->revision = cpu_to_le16(MGMT_REVISION);
315 }
316
317 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
318 u16 data_len)
319 {
320 struct mgmt_rp_read_version rp;
321
322 bt_dev_dbg(hdev, "sock %p", sk);
323
324 mgmt_fill_version_info(&rp);
325
326 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
327 &rp, sizeof(rp));
328 }
329
330 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
331 u16 data_len)
332 {
333 struct mgmt_rp_read_commands *rp;
334 u16 num_commands, num_events;
335 size_t rp_size;
336 int i, err;
337
338 bt_dev_dbg(hdev, "sock %p", sk);
339
340 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
341 num_commands = ARRAY_SIZE(mgmt_commands);
342 num_events = ARRAY_SIZE(mgmt_events);
343 } else {
344 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
345 num_events = ARRAY_SIZE(mgmt_untrusted_events);
346 }
347
348 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
349
350 rp = kmalloc(rp_size, GFP_KERNEL);
351 if (!rp)
352 return -ENOMEM;
353
354 rp->num_commands = cpu_to_le16(num_commands);
355 rp->num_events = cpu_to_le16(num_events);
356
357 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
358 __le16 *opcode = rp->opcodes;
359
360 for (i = 0; i < num_commands; i++, opcode++)
361 put_unaligned_le16(mgmt_commands[i], opcode);
362
363 for (i = 0; i < num_events; i++, opcode++)
364 put_unaligned_le16(mgmt_events[i], opcode);
365 } else {
366 __le16 *opcode = rp->opcodes;
367
368 for (i = 0; i < num_commands; i++, opcode++)
369 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
370
371 for (i = 0; i < num_events; i++, opcode++)
372 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
373 }
374
375 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
376 rp, rp_size);
377 kfree(rp);
378
379 return err;
380 }
381
382 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
383 u16 data_len)
384 {
385 struct mgmt_rp_read_index_list *rp;
386 struct hci_dev *d;
387 size_t rp_len;
388 u16 count;
389 int err;
390
391 bt_dev_dbg(hdev, "sock %p", sk);
392
393 read_lock(&hci_dev_list_lock);
394
395 count = 0;
396 list_for_each_entry(d, &hci_dev_list, list) {
397 if (d->dev_type == HCI_PRIMARY &&
398 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
399 count++;
400 }
401
402 rp_len = sizeof(*rp) + (2 * count);
403 rp = kmalloc(rp_len, GFP_ATOMIC);
404 if (!rp) {
405 read_unlock(&hci_dev_list_lock);
406 return -ENOMEM;
407 }
408
409 count = 0;
410 list_for_each_entry(d, &hci_dev_list, list) {
411 if (hci_dev_test_flag(d, HCI_SETUP) ||
412 hci_dev_test_flag(d, HCI_CONFIG) ||
413 hci_dev_test_flag(d, HCI_USER_CHANNEL))
414 continue;
415
416 /* Devices marked as raw-only are neither configured
417 * nor unconfigured controllers.
418 */
419 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
420 continue;
421
422 if (d->dev_type == HCI_PRIMARY &&
423 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
424 rp->index[count++] = cpu_to_le16(d->id);
425 bt_dev_dbg(hdev, "Added hci%u", d->id);
426 }
427 }
428
429 rp->num_controllers = cpu_to_le16(count);
430 rp_len = sizeof(*rp) + (2 * count);
431
432 read_unlock(&hci_dev_list_lock);
433
434 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
435 0, rp, rp_len);
436
437 kfree(rp);
438
439 return err;
440 }
441
442 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
443 void *data, u16 data_len)
444 {
445 struct mgmt_rp_read_unconf_index_list *rp;
446 struct hci_dev *d;
447 size_t rp_len;
448 u16 count;
449 int err;
450
451 bt_dev_dbg(hdev, "sock %p", sk);
452
453 read_lock(&hci_dev_list_lock);
454
455 count = 0;
456 list_for_each_entry(d, &hci_dev_list, list) {
457 if (d->dev_type == HCI_PRIMARY &&
458 hci_dev_test_flag(d, HCI_UNCONFIGURED))
459 count++;
460 }
461
462 rp_len = sizeof(*rp) + (2 * count);
463 rp = kmalloc(rp_len, GFP_ATOMIC);
464 if (!rp) {
465 read_unlock(&hci_dev_list_lock);
466 return -ENOMEM;
467 }
468
469 count = 0;
470 list_for_each_entry(d, &hci_dev_list, list) {
471 if (hci_dev_test_flag(d, HCI_SETUP) ||
472 hci_dev_test_flag(d, HCI_CONFIG) ||
473 hci_dev_test_flag(d, HCI_USER_CHANNEL))
474 continue;
475
476 /* Devices marked as raw-only are neither configured
477 * nor unconfigured controllers.
478 */
479 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
480 continue;
481
482 if (d->dev_type == HCI_PRIMARY &&
483 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
484 rp->index[count++] = cpu_to_le16(d->id);
485 bt_dev_dbg(hdev, "Added hci%u", d->id);
486 }
487 }
488
489 rp->num_controllers = cpu_to_le16(count);
490 rp_len = sizeof(*rp) + (2 * count);
491
492 read_unlock(&hci_dev_list_lock);
493
494 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
495 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
496
497 kfree(rp);
498
499 return err;
500 }
501
502 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
503 void *data, u16 data_len)
504 {
505 struct mgmt_rp_read_ext_index_list *rp;
506 struct hci_dev *d;
507 u16 count;
508 int err;
509
510 bt_dev_dbg(hdev, "sock %p", sk);
511
512 read_lock(&hci_dev_list_lock);
513
514 count = 0;
515 list_for_each_entry(d, &hci_dev_list, list) {
516 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
517 count++;
518 }
519
520 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
521 if (!rp) {
522 read_unlock(&hci_dev_list_lock);
523 return -ENOMEM;
524 }
525
526 count = 0;
527 list_for_each_entry(d, &hci_dev_list, list) {
528 if (hci_dev_test_flag(d, HCI_SETUP) ||
529 hci_dev_test_flag(d, HCI_CONFIG) ||
530 hci_dev_test_flag(d, HCI_USER_CHANNEL))
531 continue;
532
533 /* Devices marked as raw-only are neither configured
534 * nor unconfigured controllers.
535 */
536 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
537 continue;
538
539 if (d->dev_type == HCI_PRIMARY) {
540 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
541 rp->entry[count].type = 0x01;
542 else
543 rp->entry[count].type = 0x00;
544 } else if (d->dev_type == HCI_AMP) {
545 rp->entry[count].type = 0x02;
546 } else {
547 continue;
548 }
549
550 rp->entry[count].bus = d->bus;
551 rp->entry[count++].index = cpu_to_le16(d->id);
552 bt_dev_dbg(hdev, "Added hci%u", d->id);
553 }
554
555 rp->num_controllers = cpu_to_le16(count);
556
557 read_unlock(&hci_dev_list_lock);
558
559 /* If this command is called at least once, then all the
560 * default index and unconfigured index events are disabled
561 * and from now on only extended index events are used.
562 */
563 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
564 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
565 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
566
567 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
568 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
569 struct_size(rp, entry, count));
570
571 kfree(rp);
572
573 return err;
574 }
575
576 static bool is_configured(struct hci_dev *hdev)
577 {
578 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
579 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
580 return false;
581
582 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
583 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
584 !bacmp(&hdev->public_addr, BDADDR_ANY))
585 return false;
586
587 return true;
588 }
589
590 static __le32 get_missing_options(struct hci_dev *hdev)
591 {
592 u32 options = 0;
593
594 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
595 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
596 options |= MGMT_OPTION_EXTERNAL_CONFIG;
597
598 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
599 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
600 !bacmp(&hdev->public_addr, BDADDR_ANY))
601 options |= MGMT_OPTION_PUBLIC_ADDRESS;
602
603 return cpu_to_le32(options);
604 }
605
606 static int new_options(struct hci_dev *hdev, struct sock *skip)
607 {
608 __le32 options = get_missing_options(hdev);
609
610 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
611 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
612 }
613
614 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
615 {
616 __le32 options = get_missing_options(hdev);
617
618 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
619 sizeof(options));
620 }
621
622 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
623 void *data, u16 data_len)
624 {
625 struct mgmt_rp_read_config_info rp;
626 u32 options = 0;
627
628 bt_dev_dbg(hdev, "sock %p", sk);
629
630 hci_dev_lock(hdev);
631
632 memset(&rp, 0, sizeof(rp));
633 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
634
635 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
636 options |= MGMT_OPTION_EXTERNAL_CONFIG;
637
638 if (hdev->set_bdaddr)
639 options |= MGMT_OPTION_PUBLIC_ADDRESS;
640
641 rp.supported_options = cpu_to_le32(options);
642 rp.missing_options = get_missing_options(hdev);
643
644 hci_dev_unlock(hdev);
645
646 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
647 &rp, sizeof(rp));
648 }
649
650 static u32 get_supported_phys(struct hci_dev *hdev)
651 {
652 u32 supported_phys = 0;
653
654 if (lmp_bredr_capable(hdev)) {
655 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
656
657 if (hdev->features[0][0] & LMP_3SLOT)
658 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
659
660 if (hdev->features[0][0] & LMP_5SLOT)
661 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
662
663 if (lmp_edr_2m_capable(hdev)) {
664 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
665
666 if (lmp_edr_3slot_capable(hdev))
667 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
668
669 if (lmp_edr_5slot_capable(hdev))
670 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
671
672 if (lmp_edr_3m_capable(hdev)) {
673 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
674
675 if (lmp_edr_3slot_capable(hdev))
676 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
677
678 if (lmp_edr_5slot_capable(hdev))
679 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
680 }
681 }
682 }
683
684 if (lmp_le_capable(hdev)) {
685 supported_phys |= MGMT_PHY_LE_1M_TX;
686 supported_phys |= MGMT_PHY_LE_1M_RX;
687
688 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
689 supported_phys |= MGMT_PHY_LE_2M_TX;
690 supported_phys |= MGMT_PHY_LE_2M_RX;
691 }
692
693 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
694 supported_phys |= MGMT_PHY_LE_CODED_TX;
695 supported_phys |= MGMT_PHY_LE_CODED_RX;
696 }
697 }
698
699 return supported_phys;
700 }
701
702 static u32 get_selected_phys(struct hci_dev *hdev)
703 {
704 u32 selected_phys = 0;
705
706 if (lmp_bredr_capable(hdev)) {
707 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
708
709 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
710 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
711
712 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
713 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
714
715 if (lmp_edr_2m_capable(hdev)) {
716 if (!(hdev->pkt_type & HCI_2DH1))
717 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
718
719 if (lmp_edr_3slot_capable(hdev) &&
720 !(hdev->pkt_type & HCI_2DH3))
721 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
722
723 if (lmp_edr_5slot_capable(hdev) &&
724 !(hdev->pkt_type & HCI_2DH5))
725 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
726
727 if (lmp_edr_3m_capable(hdev)) {
728 if (!(hdev->pkt_type & HCI_3DH1))
729 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
730
731 if (lmp_edr_3slot_capable(hdev) &&
732 !(hdev->pkt_type & HCI_3DH3))
733 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
734
735 if (lmp_edr_5slot_capable(hdev) &&
736 !(hdev->pkt_type & HCI_3DH5))
737 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
738 }
739 }
740 }
741
742 if (lmp_le_capable(hdev)) {
743 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
744 selected_phys |= MGMT_PHY_LE_1M_TX;
745
746 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
747 selected_phys |= MGMT_PHY_LE_1M_RX;
748
749 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
750 selected_phys |= MGMT_PHY_LE_2M_TX;
751
752 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
753 selected_phys |= MGMT_PHY_LE_2M_RX;
754
755 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
756 selected_phys |= MGMT_PHY_LE_CODED_TX;
757
758 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
759 selected_phys |= MGMT_PHY_LE_CODED_RX;
760 }
761
762 return selected_phys;
763 }
764
765 static u32 get_configurable_phys(struct hci_dev *hdev)
766 {
767 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
768 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
769 }
770
771 static u32 get_supported_settings(struct hci_dev *hdev)
772 {
773 u32 settings = 0;
774
775 settings |= MGMT_SETTING_POWERED;
776 settings |= MGMT_SETTING_BONDABLE;
777 settings |= MGMT_SETTING_DEBUG_KEYS;
778 settings |= MGMT_SETTING_CONNECTABLE;
779 settings |= MGMT_SETTING_DISCOVERABLE;
780
781 if (lmp_bredr_capable(hdev)) {
782 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
783 settings |= MGMT_SETTING_FAST_CONNECTABLE;
784 settings |= MGMT_SETTING_BREDR;
785 settings |= MGMT_SETTING_LINK_SECURITY;
786
787 if (lmp_ssp_capable(hdev)) {
788 settings |= MGMT_SETTING_SSP;
789 if (IS_ENABLED(CONFIG_BT_HS))
790 settings |= MGMT_SETTING_HS;
791 }
792
793 if (lmp_sc_capable(hdev))
794 settings |= MGMT_SETTING_SECURE_CONN;
795
796 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
797 &hdev->quirks))
798 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
799 }
800
801 if (lmp_le_capable(hdev)) {
802 settings |= MGMT_SETTING_LE;
803 settings |= MGMT_SETTING_SECURE_CONN;
804 settings |= MGMT_SETTING_PRIVACY;
805 settings |= MGMT_SETTING_STATIC_ADDRESS;
806
807 /* When the experimental feature for LL Privacy support is
808 * enabled, then advertising is no longer supported.
809 */
810 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
811 settings |= MGMT_SETTING_ADVERTISING;
812 }
813
814 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
815 hdev->set_bdaddr)
816 settings |= MGMT_SETTING_CONFIGURATION;
817
818 settings |= MGMT_SETTING_PHY_CONFIGURATION;
819
820 return settings;
821 }
822
823 static u32 get_current_settings(struct hci_dev *hdev)
824 {
825 u32 settings = 0;
826
827 if (hdev_is_powered(hdev))
828 settings |= MGMT_SETTING_POWERED;
829
830 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
831 settings |= MGMT_SETTING_CONNECTABLE;
832
833 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
834 settings |= MGMT_SETTING_FAST_CONNECTABLE;
835
836 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
837 settings |= MGMT_SETTING_DISCOVERABLE;
838
839 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
840 settings |= MGMT_SETTING_BONDABLE;
841
842 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
843 settings |= MGMT_SETTING_BREDR;
844
845 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
846 settings |= MGMT_SETTING_LE;
847
848 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
849 settings |= MGMT_SETTING_LINK_SECURITY;
850
851 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
852 settings |= MGMT_SETTING_SSP;
853
854 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
855 settings |= MGMT_SETTING_HS;
856
857 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
858 settings |= MGMT_SETTING_ADVERTISING;
859
860 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
861 settings |= MGMT_SETTING_SECURE_CONN;
862
863 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
864 settings |= MGMT_SETTING_DEBUG_KEYS;
865
866 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
867 settings |= MGMT_SETTING_PRIVACY;
868
869 /* The current setting for static address has two purposes. The
870 * first is to indicate if the static address will be used and
871 * the second is to indicate if it is actually set.
872 *
873 * This means if the static address is not configured, this flag
874 * will never be set. If the address is configured, then if the
875 * address is actually used decides if the flag is set or not.
876 *
877 * For single mode LE only controllers and dual-mode controllers
878 * with BR/EDR disabled, the existence of the static address will
879 * be evaluated.
880 */
881 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
882 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
883 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
884 if (bacmp(&hdev->static_addr, BDADDR_ANY))
885 settings |= MGMT_SETTING_STATIC_ADDRESS;
886 }
887
888 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
889 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
890
891 return settings;
892 }
893
894 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
895 {
896 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
897 }
898
899 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
900 struct hci_dev *hdev,
901 const void *data)
902 {
903 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
904 }
905
906 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
907 {
908 struct mgmt_pending_cmd *cmd;
909
910 /* If there's a pending mgmt command the flags will not yet have
911 * their final values, so check for this first.
912 */
913 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
914 if (cmd) {
915 struct mgmt_mode *cp = cmd->param;
916 if (cp->val == 0x01)
917 return LE_AD_GENERAL;
918 else if (cp->val == 0x02)
919 return LE_AD_LIMITED;
920 } else {
921 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
922 return LE_AD_LIMITED;
923 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
924 return LE_AD_GENERAL;
925 }
926
927 return 0;
928 }
929
930 bool mgmt_get_connectable(struct hci_dev *hdev)
931 {
932 struct mgmt_pending_cmd *cmd;
933
934 /* If there's a pending mgmt command the flag will not yet have
935 * it's final value, so check for this first.
936 */
937 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
938 if (cmd) {
939 struct mgmt_mode *cp = cmd->param;
940
941 return cp->val;
942 }
943
944 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
945 }
946
947 static void service_cache_off(struct work_struct *work)
948 {
949 struct hci_dev *hdev = container_of(work, struct hci_dev,
950 service_cache.work);
951 struct hci_request req;
952
953 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
954 return;
955
956 hci_req_init(&req, hdev);
957
958 hci_dev_lock(hdev);
959
960 __hci_req_update_eir(&req);
961 __hci_req_update_class(&req);
962
963 hci_dev_unlock(hdev);
964
965 hci_req_run(&req, NULL);
966 }
967
968 static void rpa_expired(struct work_struct *work)
969 {
970 struct hci_dev *hdev = container_of(work, struct hci_dev,
971 rpa_expired.work);
972 struct hci_request req;
973
974 bt_dev_dbg(hdev, "");
975
976 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
977
978 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
979 return;
980
981 /* The generation of a new RPA and programming it into the
982 * controller happens in the hci_req_enable_advertising()
983 * function.
984 */
985 hci_req_init(&req, hdev);
986 if (ext_adv_capable(hdev))
987 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
988 else
989 __hci_req_enable_advertising(&req);
990 hci_req_run(&req, NULL);
991 }
992
993 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
994 {
995 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
996 return;
997
998 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
999 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1000
1001 /* Non-mgmt controlled devices get this bit set
1002 * implicitly so that pairing works for them, however
1003 * for mgmt we require user-space to explicitly enable
1004 * it
1005 */
1006 hci_dev_clear_flag(hdev, HCI_BONDABLE);
1007 }
1008
1009 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1010 void *data, u16 data_len)
1011 {
1012 struct mgmt_rp_read_info rp;
1013
1014 bt_dev_dbg(hdev, "sock %p", sk);
1015
1016 hci_dev_lock(hdev);
1017
1018 memset(&rp, 0, sizeof(rp));
1019
1020 bacpy(&rp.bdaddr, &hdev->bdaddr);
1021
1022 rp.version = hdev->hci_ver;
1023 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1024
1025 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1026 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1027
1028 memcpy(rp.dev_class, hdev->dev_class, 3);
1029
1030 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1031 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1032
1033 hci_dev_unlock(hdev);
1034
1035 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1036 sizeof(rp));
1037 }
1038
1039 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1040 {
1041 u16 eir_len = 0;
1042 size_t name_len;
1043
1044 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1045 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1046 hdev->dev_class, 3);
1047
1048 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1049 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1050 hdev->appearance);
1051
1052 name_len = strlen(hdev->dev_name);
1053 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1054 hdev->dev_name, name_len);
1055
1056 name_len = strlen(hdev->short_name);
1057 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1058 hdev->short_name, name_len);
1059
1060 return eir_len;
1061 }
1062
1063 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1064 void *data, u16 data_len)
1065 {
1066 char buf[512];
1067 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1068 u16 eir_len;
1069
1070 bt_dev_dbg(hdev, "sock %p", sk);
1071
1072 memset(&buf, 0, sizeof(buf));
1073
1074 hci_dev_lock(hdev);
1075
1076 bacpy(&rp->bdaddr, &hdev->bdaddr);
1077
1078 rp->version = hdev->hci_ver;
1079 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1080
1081 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1082 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1083
1084
1085 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1086 rp->eir_len = cpu_to_le16(eir_len);
1087
1088 hci_dev_unlock(hdev);
1089
1090 /* If this command is called at least once, then the events
1091 * for class of device and local name changes are disabled
1092 * and only the new extended controller information event
1093 * is used.
1094 */
1095 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1096 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1097 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1098
1099 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1100 sizeof(*rp) + eir_len);
1101 }
1102
1103 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1104 {
1105 char buf[512];
1106 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1107 u16 eir_len;
1108
1109 memset(buf, 0, sizeof(buf));
1110
1111 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1112 ev->eir_len = cpu_to_le16(eir_len);
1113
1114 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1115 sizeof(*ev) + eir_len,
1116 HCI_MGMT_EXT_INFO_EVENTS, skip);
1117 }
1118
1119 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1120 {
1121 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1122
1123 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1124 sizeof(settings));
1125 }
1126
1127 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1128 {
1129 bt_dev_dbg(hdev, "status 0x%02x", status);
1130
1131 if (hci_conn_count(hdev) == 0) {
1132 cancel_delayed_work(&hdev->power_off);
1133 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1134 }
1135 }
1136
1137 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1138 {
1139 struct mgmt_ev_advertising_added ev;
1140
1141 ev.instance = instance;
1142
1143 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1144 }
1145
1146 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1147 u8 instance)
1148 {
1149 struct mgmt_ev_advertising_removed ev;
1150
1151 ev.instance = instance;
1152
1153 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1154 }
1155
1156 static void cancel_adv_timeout(struct hci_dev *hdev)
1157 {
1158 if (hdev->adv_instance_timeout) {
1159 hdev->adv_instance_timeout = 0;
1160 cancel_delayed_work(&hdev->adv_instance_expire);
1161 }
1162 }
1163
1164 static int clean_up_hci_state(struct hci_dev *hdev)
1165 {
1166 struct hci_request req;
1167 struct hci_conn *conn;
1168 bool discov_stopped;
1169 int err;
1170
1171 hci_req_init(&req, hdev);
1172
1173 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1174 test_bit(HCI_PSCAN, &hdev->flags)) {
1175 u8 scan = 0x00;
1176 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1177 }
1178
1179 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1180
1181 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1182 __hci_req_disable_advertising(&req);
1183
1184 discov_stopped = hci_req_stop_discovery(&req);
1185
1186 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1187 /* 0x15 == Terminated due to Power Off */
1188 __hci_abort_conn(&req, conn, 0x15);
1189 }
1190
1191 err = hci_req_run(&req, clean_up_hci_complete);
1192 if (!err && discov_stopped)
1193 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1194
1195 return err;
1196 }
1197
1198 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1199 u16 len)
1200 {
1201 struct mgmt_mode *cp = data;
1202 struct mgmt_pending_cmd *cmd;
1203 int err;
1204
1205 bt_dev_dbg(hdev, "sock %p", sk);
1206
1207 if (cp->val != 0x00 && cp->val != 0x01)
1208 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1209 MGMT_STATUS_INVALID_PARAMS);
1210
1211 hci_dev_lock(hdev);
1212
1213 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1214 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1215 MGMT_STATUS_BUSY);
1216 goto failed;
1217 }
1218
1219 if (!!cp->val == hdev_is_powered(hdev)) {
1220 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1221 goto failed;
1222 }
1223
1224 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1225 if (!cmd) {
1226 err = -ENOMEM;
1227 goto failed;
1228 }
1229
1230 if (cp->val) {
1231 queue_work(hdev->req_workqueue, &hdev->power_on);
1232 err = 0;
1233 } else {
1234 /* Disconnect connections, stop scans, etc */
1235 err = clean_up_hci_state(hdev);
1236 if (!err)
1237 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1238 HCI_POWER_OFF_TIMEOUT);
1239
1240 /* ENODATA means there were no HCI commands queued */
1241 if (err == -ENODATA) {
1242 cancel_delayed_work(&hdev->power_off);
1243 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1244 err = 0;
1245 }
1246 }
1247
1248 failed:
1249 hci_dev_unlock(hdev);
1250 return err;
1251 }
1252
1253 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1254 {
1255 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1256
1257 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1258 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1259 }
1260
1261 int mgmt_new_settings(struct hci_dev *hdev)
1262 {
1263 return new_settings(hdev, NULL);
1264 }
1265
1266 struct cmd_lookup {
1267 struct sock *sk;
1268 struct hci_dev *hdev;
1269 u8 mgmt_status;
1270 };
1271
1272 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1273 {
1274 struct cmd_lookup *match = data;
1275
1276 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1277
1278 list_del(&cmd->list);
1279
1280 if (match->sk == NULL) {
1281 match->sk = cmd->sk;
1282 sock_hold(match->sk);
1283 }
1284
1285 mgmt_pending_free(cmd);
1286 }
1287
1288 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1289 {
1290 u8 *status = data;
1291
1292 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1293 mgmt_pending_remove(cmd);
1294 }
1295
1296 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1297 {
1298 if (cmd->cmd_complete) {
1299 u8 *status = data;
1300
1301 cmd->cmd_complete(cmd, *status);
1302 mgmt_pending_remove(cmd);
1303
1304 return;
1305 }
1306
1307 cmd_status_rsp(cmd, data);
1308 }
1309
1310 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1311 {
1312 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1313 cmd->param, cmd->param_len);
1314 }
1315
1316 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1317 {
1318 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1319 cmd->param, sizeof(struct mgmt_addr_info));
1320 }
1321
1322 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1323 {
1324 if (!lmp_bredr_capable(hdev))
1325 return MGMT_STATUS_NOT_SUPPORTED;
1326 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1327 return MGMT_STATUS_REJECTED;
1328 else
1329 return MGMT_STATUS_SUCCESS;
1330 }
1331
1332 static u8 mgmt_le_support(struct hci_dev *hdev)
1333 {
1334 if (!lmp_le_capable(hdev))
1335 return MGMT_STATUS_NOT_SUPPORTED;
1336 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1337 return MGMT_STATUS_REJECTED;
1338 else
1339 return MGMT_STATUS_SUCCESS;
1340 }
1341
1342 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1343 {
1344 struct mgmt_pending_cmd *cmd;
1345
1346 bt_dev_dbg(hdev, "status 0x%02x", status);
1347
1348 hci_dev_lock(hdev);
1349
1350 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1351 if (!cmd)
1352 goto unlock;
1353
1354 if (status) {
1355 u8 mgmt_err = mgmt_status(status);
1356 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1357 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1358 goto remove_cmd;
1359 }
1360
1361 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1362 hdev->discov_timeout > 0) {
1363 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1364 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1365 }
1366
1367 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1368 new_settings(hdev, cmd->sk);
1369
1370 remove_cmd:
1371 mgmt_pending_remove(cmd);
1372
1373 unlock:
1374 hci_dev_unlock(hdev);
1375 }
1376
1377 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1378 u16 len)
1379 {
1380 struct mgmt_cp_set_discoverable *cp = data;
1381 struct mgmt_pending_cmd *cmd;
1382 u16 timeout;
1383 int err;
1384
1385 bt_dev_dbg(hdev, "sock %p", sk);
1386
1387 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1388 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1389 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1390 MGMT_STATUS_REJECTED);
1391
1392 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1393 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1394 MGMT_STATUS_INVALID_PARAMS);
1395
1396 timeout = __le16_to_cpu(cp->timeout);
1397
1398 /* Disabling discoverable requires that no timeout is set,
1399 * and enabling limited discoverable requires a timeout.
1400 */
1401 if ((cp->val == 0x00 && timeout > 0) ||
1402 (cp->val == 0x02 && timeout == 0))
1403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1404 MGMT_STATUS_INVALID_PARAMS);
1405
1406 hci_dev_lock(hdev);
1407
1408 if (!hdev_is_powered(hdev) && timeout > 0) {
1409 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1410 MGMT_STATUS_NOT_POWERED);
1411 goto failed;
1412 }
1413
1414 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1415 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1417 MGMT_STATUS_BUSY);
1418 goto failed;
1419 }
1420
1421 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1422 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1423 MGMT_STATUS_REJECTED);
1424 goto failed;
1425 }
1426
1427 if (hdev->advertising_paused) {
1428 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1429 MGMT_STATUS_BUSY);
1430 goto failed;
1431 }
1432
1433 if (!hdev_is_powered(hdev)) {
1434 bool changed = false;
1435
1436 /* Setting limited discoverable when powered off is
1437 * not a valid operation since it requires a timeout
1438 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1439 */
1440 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1441 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1442 changed = true;
1443 }
1444
1445 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1446 if (err < 0)
1447 goto failed;
1448
1449 if (changed)
1450 err = new_settings(hdev, sk);
1451
1452 goto failed;
1453 }
1454
1455 /* If the current mode is the same, then just update the timeout
1456 * value with the new value. And if only the timeout gets updated,
1457 * then no need for any HCI transactions.
1458 */
1459 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1460 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1461 HCI_LIMITED_DISCOVERABLE)) {
1462 cancel_delayed_work(&hdev->discov_off);
1463 hdev->discov_timeout = timeout;
1464
1465 if (cp->val && hdev->discov_timeout > 0) {
1466 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1467 queue_delayed_work(hdev->req_workqueue,
1468 &hdev->discov_off, to);
1469 }
1470
1471 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1472 goto failed;
1473 }
1474
1475 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1476 if (!cmd) {
1477 err = -ENOMEM;
1478 goto failed;
1479 }
1480
1481 /* Cancel any potential discoverable timeout that might be
1482 * still active and store new timeout value. The arming of
1483 * the timeout happens in the complete handler.
1484 */
1485 cancel_delayed_work(&hdev->discov_off);
1486 hdev->discov_timeout = timeout;
1487
1488 if (cp->val)
1489 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1490 else
1491 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1492
1493 /* Limited discoverable mode */
1494 if (cp->val == 0x02)
1495 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1496 else
1497 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1498
1499 queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1500 err = 0;
1501
1502 failed:
1503 hci_dev_unlock(hdev);
1504 return err;
1505 }
1506
1507 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1508 {
1509 struct mgmt_pending_cmd *cmd;
1510
1511 bt_dev_dbg(hdev, "status 0x%02x", status);
1512
1513 hci_dev_lock(hdev);
1514
1515 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1516 if (!cmd)
1517 goto unlock;
1518
1519 if (status) {
1520 u8 mgmt_err = mgmt_status(status);
1521 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1522 goto remove_cmd;
1523 }
1524
1525 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1526 new_settings(hdev, cmd->sk);
1527
1528 remove_cmd:
1529 mgmt_pending_remove(cmd);
1530
1531 unlock:
1532 hci_dev_unlock(hdev);
1533 }
1534
1535 static int set_connectable_update_settings(struct hci_dev *hdev,
1536 struct sock *sk, u8 val)
1537 {
1538 bool changed = false;
1539 int err;
1540
1541 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1542 changed = true;
1543
1544 if (val) {
1545 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1546 } else {
1547 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1548 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1549 }
1550
1551 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1552 if (err < 0)
1553 return err;
1554
1555 if (changed) {
1556 hci_req_update_scan(hdev);
1557 hci_update_background_scan(hdev);
1558 return new_settings(hdev, sk);
1559 }
1560
1561 return 0;
1562 }
1563
1564 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1565 u16 len)
1566 {
1567 struct mgmt_mode *cp = data;
1568 struct mgmt_pending_cmd *cmd;
1569 int err;
1570
1571 bt_dev_dbg(hdev, "sock %p", sk);
1572
1573 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1574 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1575 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1576 MGMT_STATUS_REJECTED);
1577
1578 if (cp->val != 0x00 && cp->val != 0x01)
1579 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1580 MGMT_STATUS_INVALID_PARAMS);
1581
1582 hci_dev_lock(hdev);
1583
1584 if (!hdev_is_powered(hdev)) {
1585 err = set_connectable_update_settings(hdev, sk, cp->val);
1586 goto failed;
1587 }
1588
1589 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1590 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1591 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1592 MGMT_STATUS_BUSY);
1593 goto failed;
1594 }
1595
1596 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1597 if (!cmd) {
1598 err = -ENOMEM;
1599 goto failed;
1600 }
1601
1602 if (cp->val) {
1603 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1604 } else {
1605 if (hdev->discov_timeout > 0)
1606 cancel_delayed_work(&hdev->discov_off);
1607
1608 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1609 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1610 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1611 }
1612
1613 queue_work(hdev->req_workqueue, &hdev->connectable_update);
1614 err = 0;
1615
1616 failed:
1617 hci_dev_unlock(hdev);
1618 return err;
1619 }
1620
1621 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1622 u16 len)
1623 {
1624 struct mgmt_mode *cp = data;
1625 bool changed;
1626 int err;
1627
1628 bt_dev_dbg(hdev, "sock %p", sk);
1629
1630 if (cp->val != 0x00 && cp->val != 0x01)
1631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1632 MGMT_STATUS_INVALID_PARAMS);
1633
1634 hci_dev_lock(hdev);
1635
1636 if (cp->val)
1637 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1638 else
1639 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1640
1641 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1642 if (err < 0)
1643 goto unlock;
1644
1645 if (changed) {
1646 /* In limited privacy mode the change of bondable mode
1647 * may affect the local advertising address.
1648 */
1649 if (hdev_is_powered(hdev) &&
1650 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1651 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1652 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1653 queue_work(hdev->req_workqueue,
1654 &hdev->discoverable_update);
1655
1656 err = new_settings(hdev, sk);
1657 }
1658
1659 unlock:
1660 hci_dev_unlock(hdev);
1661 return err;
1662 }
1663
1664 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1665 u16 len)
1666 {
1667 struct mgmt_mode *cp = data;
1668 struct mgmt_pending_cmd *cmd;
1669 u8 val, status;
1670 int err;
1671
1672 bt_dev_dbg(hdev, "sock %p", sk);
1673
1674 status = mgmt_bredr_support(hdev);
1675 if (status)
1676 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1677 status);
1678
1679 if (cp->val != 0x00 && cp->val != 0x01)
1680 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1681 MGMT_STATUS_INVALID_PARAMS);
1682
1683 hci_dev_lock(hdev);
1684
1685 if (!hdev_is_powered(hdev)) {
1686 bool changed = false;
1687
1688 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1689 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1690 changed = true;
1691 }
1692
1693 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1694 if (err < 0)
1695 goto failed;
1696
1697 if (changed)
1698 err = new_settings(hdev, sk);
1699
1700 goto failed;
1701 }
1702
1703 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1704 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1705 MGMT_STATUS_BUSY);
1706 goto failed;
1707 }
1708
1709 val = !!cp->val;
1710
1711 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1712 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1713 goto failed;
1714 }
1715
1716 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1717 if (!cmd) {
1718 err = -ENOMEM;
1719 goto failed;
1720 }
1721
1722 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1723 if (err < 0) {
1724 mgmt_pending_remove(cmd);
1725 goto failed;
1726 }
1727
1728 failed:
1729 hci_dev_unlock(hdev);
1730 return err;
1731 }
1732
1733 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1734 {
1735 struct mgmt_mode *cp = data;
1736 struct mgmt_pending_cmd *cmd;
1737 u8 status;
1738 int err;
1739
1740 bt_dev_dbg(hdev, "sock %p", sk);
1741
1742 status = mgmt_bredr_support(hdev);
1743 if (status)
1744 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1745
1746 if (!lmp_ssp_capable(hdev))
1747 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1748 MGMT_STATUS_NOT_SUPPORTED);
1749
1750 if (cp->val != 0x00 && cp->val != 0x01)
1751 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1752 MGMT_STATUS_INVALID_PARAMS);
1753
1754 hci_dev_lock(hdev);
1755
1756 if (!hdev_is_powered(hdev)) {
1757 bool changed;
1758
1759 if (cp->val) {
1760 changed = !hci_dev_test_and_set_flag(hdev,
1761 HCI_SSP_ENABLED);
1762 } else {
1763 changed = hci_dev_test_and_clear_flag(hdev,
1764 HCI_SSP_ENABLED);
1765 if (!changed)
1766 changed = hci_dev_test_and_clear_flag(hdev,
1767 HCI_HS_ENABLED);
1768 else
1769 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1770 }
1771
1772 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1773 if (err < 0)
1774 goto failed;
1775
1776 if (changed)
1777 err = new_settings(hdev, sk);
1778
1779 goto failed;
1780 }
1781
1782 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1783 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1784 MGMT_STATUS_BUSY);
1785 goto failed;
1786 }
1787
1788 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1789 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1790 goto failed;
1791 }
1792
1793 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1794 if (!cmd) {
1795 err = -ENOMEM;
1796 goto failed;
1797 }
1798
1799 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1800 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1801 sizeof(cp->val), &cp->val);
1802
1803 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1804 if (err < 0) {
1805 mgmt_pending_remove(cmd);
1806 goto failed;
1807 }
1808
1809 failed:
1810 hci_dev_unlock(hdev);
1811 return err;
1812 }
1813
1814 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1815 {
1816 struct mgmt_mode *cp = data;
1817 bool changed;
1818 u8 status;
1819 int err;
1820
1821 bt_dev_dbg(hdev, "sock %p", sk);
1822
1823 if (!IS_ENABLED(CONFIG_BT_HS))
1824 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1825 MGMT_STATUS_NOT_SUPPORTED);
1826
1827 status = mgmt_bredr_support(hdev);
1828 if (status)
1829 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1830
1831 if (!lmp_ssp_capable(hdev))
1832 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1833 MGMT_STATUS_NOT_SUPPORTED);
1834
1835 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1836 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1837 MGMT_STATUS_REJECTED);
1838
1839 if (cp->val != 0x00 && cp->val != 0x01)
1840 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1841 MGMT_STATUS_INVALID_PARAMS);
1842
1843 hci_dev_lock(hdev);
1844
1845 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1846 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1847 MGMT_STATUS_BUSY);
1848 goto unlock;
1849 }
1850
1851 if (cp->val) {
1852 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1853 } else {
1854 if (hdev_is_powered(hdev)) {
1855 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1856 MGMT_STATUS_REJECTED);
1857 goto unlock;
1858 }
1859
1860 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1861 }
1862
1863 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1864 if (err < 0)
1865 goto unlock;
1866
1867 if (changed)
1868 err = new_settings(hdev, sk);
1869
1870 unlock:
1871 hci_dev_unlock(hdev);
1872 return err;
1873 }
1874
1875 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1876 {
1877 struct cmd_lookup match = { NULL, hdev };
1878
1879 hci_dev_lock(hdev);
1880
1881 if (status) {
1882 u8 mgmt_err = mgmt_status(status);
1883
1884 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1885 &mgmt_err);
1886 goto unlock;
1887 }
1888
1889 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1890
1891 new_settings(hdev, match.sk);
1892
1893 if (match.sk)
1894 sock_put(match.sk);
1895
1896 /* Make sure the controller has a good default for
1897 * advertising data. Restrict the update to when LE
1898 * has actually been enabled. During power on, the
1899 * update in powered_update_hci will take care of it.
1900 */
1901 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1902 struct hci_request req;
1903 hci_req_init(&req, hdev);
1904 if (ext_adv_capable(hdev)) {
1905 int err;
1906
1907 err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1908 if (!err)
1909 __hci_req_update_scan_rsp_data(&req, 0x00);
1910 } else {
1911 __hci_req_update_adv_data(&req, 0x00);
1912 __hci_req_update_scan_rsp_data(&req, 0x00);
1913 }
1914 hci_req_run(&req, NULL);
1915 hci_update_background_scan(hdev);
1916 }
1917
1918 unlock:
1919 hci_dev_unlock(hdev);
1920 }
1921
1922 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1923 {
1924 struct mgmt_mode *cp = data;
1925 struct hci_cp_write_le_host_supported hci_cp;
1926 struct mgmt_pending_cmd *cmd;
1927 struct hci_request req;
1928 int err;
1929 u8 val, enabled;
1930
1931 bt_dev_dbg(hdev, "sock %p", sk);
1932
1933 if (!lmp_le_capable(hdev))
1934 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1935 MGMT_STATUS_NOT_SUPPORTED);
1936
1937 if (cp->val != 0x00 && cp->val != 0x01)
1938 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939 MGMT_STATUS_INVALID_PARAMS);
1940
1941 /* Bluetooth single mode LE only controllers or dual-mode
1942 * controllers configured as LE only devices, do not allow
1943 * switching LE off. These have either LE enabled explicitly
1944 * or BR/EDR has been previously switched off.
1945 *
1946 * When trying to enable an already enabled LE, then gracefully
1947 * send a positive response. Trying to disable it however will
1948 * result into rejection.
1949 */
1950 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1951 if (cp->val == 0x01)
1952 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1953
1954 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1955 MGMT_STATUS_REJECTED);
1956 }
1957
1958 hci_dev_lock(hdev);
1959
1960 val = !!cp->val;
1961 enabled = lmp_host_le_capable(hdev);
1962
1963 if (!val)
1964 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1965
1966 if (!hdev_is_powered(hdev) || val == enabled) {
1967 bool changed = false;
1968
1969 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1970 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1971 changed = true;
1972 }
1973
1974 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1975 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1976 changed = true;
1977 }
1978
1979 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1980 if (err < 0)
1981 goto unlock;
1982
1983 if (changed)
1984 err = new_settings(hdev, sk);
1985
1986 goto unlock;
1987 }
1988
1989 if (pending_find(MGMT_OP_SET_LE, hdev) ||
1990 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1991 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1992 MGMT_STATUS_BUSY);
1993 goto unlock;
1994 }
1995
1996 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1997 if (!cmd) {
1998 err = -ENOMEM;
1999 goto unlock;
2000 }
2001
2002 hci_req_init(&req, hdev);
2003
2004 memset(&hci_cp, 0, sizeof(hci_cp));
2005
2006 if (val) {
2007 hci_cp.le = val;
2008 hci_cp.simul = 0x00;
2009 } else {
2010 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
2011 __hci_req_disable_advertising(&req);
2012
2013 if (ext_adv_capable(hdev))
2014 __hci_req_clear_ext_adv_sets(&req);
2015 }
2016
2017 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2018 &hci_cp);
2019
2020 err = hci_req_run(&req, le_enable_complete);
2021 if (err < 0)
2022 mgmt_pending_remove(cmd);
2023
2024 unlock:
2025 hci_dev_unlock(hdev);
2026 return err;
2027 }
2028
2029 /* This is a helper function to test for pending mgmt commands that can
2030 * cause CoD or EIR HCI commands. We can only allow one such pending
2031 * mgmt command at a time since otherwise we cannot easily track what
2032 * the current values are, will be, and based on that calculate if a new
2033 * HCI command needs to be sent and if yes with what value.
2034 */
2035 static bool pending_eir_or_class(struct hci_dev *hdev)
2036 {
2037 struct mgmt_pending_cmd *cmd;
2038
2039 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2040 switch (cmd->opcode) {
2041 case MGMT_OP_ADD_UUID:
2042 case MGMT_OP_REMOVE_UUID:
2043 case MGMT_OP_SET_DEV_CLASS:
2044 case MGMT_OP_SET_POWERED:
2045 return true;
2046 }
2047 }
2048
2049 return false;
2050 }
2051
2052 static const u8 bluetooth_base_uuid[] = {
2053 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2054 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2055 };
2056
2057 static u8 get_uuid_size(const u8 *uuid)
2058 {
2059 u32 val;
2060
2061 if (memcmp(uuid, bluetooth_base_uuid, 12))
2062 return 128;
2063
2064 val = get_unaligned_le32(&uuid[12]);
2065 if (val > 0xffff)
2066 return 32;
2067
2068 return 16;
2069 }
2070
2071 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2072 {
2073 struct mgmt_pending_cmd *cmd;
2074
2075 hci_dev_lock(hdev);
2076
2077 cmd = pending_find(mgmt_op, hdev);
2078 if (!cmd)
2079 goto unlock;
2080
2081 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2082 mgmt_status(status), hdev->dev_class, 3);
2083
2084 mgmt_pending_remove(cmd);
2085
2086 unlock:
2087 hci_dev_unlock(hdev);
2088 }
2089
2090 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2091 {
2092 bt_dev_dbg(hdev, "status 0x%02x", status);
2093
2094 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2095 }
2096
2097 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2098 {
2099 struct mgmt_cp_add_uuid *cp = data;
2100 struct mgmt_pending_cmd *cmd;
2101 struct hci_request req;
2102 struct bt_uuid *uuid;
2103 int err;
2104
2105 bt_dev_dbg(hdev, "sock %p", sk);
2106
2107 hci_dev_lock(hdev);
2108
2109 if (pending_eir_or_class(hdev)) {
2110 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2111 MGMT_STATUS_BUSY);
2112 goto failed;
2113 }
2114
2115 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2116 if (!uuid) {
2117 err = -ENOMEM;
2118 goto failed;
2119 }
2120
2121 memcpy(uuid->uuid, cp->uuid, 16);
2122 uuid->svc_hint = cp->svc_hint;
2123 uuid->size = get_uuid_size(cp->uuid);
2124
2125 list_add_tail(&uuid->list, &hdev->uuids);
2126
2127 hci_req_init(&req, hdev);
2128
2129 __hci_req_update_class(&req);
2130 __hci_req_update_eir(&req);
2131
2132 err = hci_req_run(&req, add_uuid_complete);
2133 if (err < 0) {
2134 if (err != -ENODATA)
2135 goto failed;
2136
2137 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2138 hdev->dev_class, 3);
2139 goto failed;
2140 }
2141
2142 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2143 if (!cmd) {
2144 err = -ENOMEM;
2145 goto failed;
2146 }
2147
2148 err = 0;
2149
2150 failed:
2151 hci_dev_unlock(hdev);
2152 return err;
2153 }
2154
2155 static bool enable_service_cache(struct hci_dev *hdev)
2156 {
2157 if (!hdev_is_powered(hdev))
2158 return false;
2159
2160 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2161 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2162 CACHE_TIMEOUT);
2163 return true;
2164 }
2165
2166 return false;
2167 }
2168
2169 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2170 {
2171 bt_dev_dbg(hdev, "status 0x%02x", status);
2172
2173 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2174 }
2175
2176 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2177 u16 len)
2178 {
2179 struct mgmt_cp_remove_uuid *cp = data;
2180 struct mgmt_pending_cmd *cmd;
2181 struct bt_uuid *match, *tmp;
2182 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2183 struct hci_request req;
2184 int err, found;
2185
2186 bt_dev_dbg(hdev, "sock %p", sk);
2187
2188 hci_dev_lock(hdev);
2189
2190 if (pending_eir_or_class(hdev)) {
2191 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2192 MGMT_STATUS_BUSY);
2193 goto unlock;
2194 }
2195
2196 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2197 hci_uuids_clear(hdev);
2198
2199 if (enable_service_cache(hdev)) {
2200 err = mgmt_cmd_complete(sk, hdev->id,
2201 MGMT_OP_REMOVE_UUID,
2202 0, hdev->dev_class, 3);
2203 goto unlock;
2204 }
2205
2206 goto update_class;
2207 }
2208
2209 found = 0;
2210
2211 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2212 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2213 continue;
2214
2215 list_del(&match->list);
2216 kfree(match);
2217 found++;
2218 }
2219
2220 if (found == 0) {
2221 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2222 MGMT_STATUS_INVALID_PARAMS);
2223 goto unlock;
2224 }
2225
2226 update_class:
2227 hci_req_init(&req, hdev);
2228
2229 __hci_req_update_class(&req);
2230 __hci_req_update_eir(&req);
2231
2232 err = hci_req_run(&req, remove_uuid_complete);
2233 if (err < 0) {
2234 if (err != -ENODATA)
2235 goto unlock;
2236
2237 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2238 hdev->dev_class, 3);
2239 goto unlock;
2240 }
2241
2242 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2243 if (!cmd) {
2244 err = -ENOMEM;
2245 goto unlock;
2246 }
2247
2248 err = 0;
2249
2250 unlock:
2251 hci_dev_unlock(hdev);
2252 return err;
2253 }
2254
2255 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2256 {
2257 bt_dev_dbg(hdev, "status 0x%02x", status);
2258
2259 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2260 }
2261
2262 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2263 u16 len)
2264 {
2265 struct mgmt_cp_set_dev_class *cp = data;
2266 struct mgmt_pending_cmd *cmd;
2267 struct hci_request req;
2268 int err;
2269
2270 bt_dev_dbg(hdev, "sock %p", sk);
2271
2272 if (!lmp_bredr_capable(hdev))
2273 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2274 MGMT_STATUS_NOT_SUPPORTED);
2275
2276 hci_dev_lock(hdev);
2277
2278 if (pending_eir_or_class(hdev)) {
2279 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2280 MGMT_STATUS_BUSY);
2281 goto unlock;
2282 }
2283
2284 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2285 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2286 MGMT_STATUS_INVALID_PARAMS);
2287 goto unlock;
2288 }
2289
2290 hdev->major_class = cp->major;
2291 hdev->minor_class = cp->minor;
2292
2293 if (!hdev_is_powered(hdev)) {
2294 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2295 hdev->dev_class, 3);
2296 goto unlock;
2297 }
2298
2299 hci_req_init(&req, hdev);
2300
2301 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2302 hci_dev_unlock(hdev);
2303 cancel_delayed_work_sync(&hdev->service_cache);
2304 hci_dev_lock(hdev);
2305 __hci_req_update_eir(&req);
2306 }
2307
2308 __hci_req_update_class(&req);
2309
2310 err = hci_req_run(&req, set_class_complete);
2311 if (err < 0) {
2312 if (err != -ENODATA)
2313 goto unlock;
2314
2315 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2316 hdev->dev_class, 3);
2317 goto unlock;
2318 }
2319
2320 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2321 if (!cmd) {
2322 err = -ENOMEM;
2323 goto unlock;
2324 }
2325
2326 err = 0;
2327
2328 unlock:
2329 hci_dev_unlock(hdev);
2330 return err;
2331 }
2332
2333 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2334 u16 len)
2335 {
2336 struct mgmt_cp_load_link_keys *cp = data;
2337 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2338 sizeof(struct mgmt_link_key_info));
2339 u16 key_count, expected_len;
2340 bool changed;
2341 int i;
2342
2343 bt_dev_dbg(hdev, "sock %p", sk);
2344
2345 if (!lmp_bredr_capable(hdev))
2346 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2347 MGMT_STATUS_NOT_SUPPORTED);
2348
2349 key_count = __le16_to_cpu(cp->key_count);
2350 if (key_count > max_key_count) {
2351 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2352 key_count);
2353 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2354 MGMT_STATUS_INVALID_PARAMS);
2355 }
2356
2357 expected_len = struct_size(cp, keys, key_count);
2358 if (expected_len != len) {
2359 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2360 expected_len, len);
2361 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2362 MGMT_STATUS_INVALID_PARAMS);
2363 }
2364
2365 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2366 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2367 MGMT_STATUS_INVALID_PARAMS);
2368
2369 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys,
2370 key_count);
2371
2372 for (i = 0; i < key_count; i++) {
2373 struct mgmt_link_key_info *key = &cp->keys[i];
2374
2375 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2376 return mgmt_cmd_status(sk, hdev->id,
2377 MGMT_OP_LOAD_LINK_KEYS,
2378 MGMT_STATUS_INVALID_PARAMS);
2379 }
2380
2381 hci_dev_lock(hdev);
2382
2383 hci_link_keys_clear(hdev);
2384
2385 if (cp->debug_keys)
2386 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2387 else
2388 changed = hci_dev_test_and_clear_flag(hdev,
2389 HCI_KEEP_DEBUG_KEYS);
2390
2391 if (changed)
2392 new_settings(hdev, NULL);
2393
2394 for (i = 0; i < key_count; i++) {
2395 struct mgmt_link_key_info *key = &cp->keys[i];
2396
2397 if (hci_is_blocked_key(hdev,
2398 HCI_BLOCKED_KEY_TYPE_LINKKEY,
2399 key->val)) {
2400 bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2401 &key->addr.bdaddr);
2402 continue;
2403 }
2404
2405 /* Always ignore debug keys and require a new pairing if
2406 * the user wants to use them.
2407 */
2408 if (key->type == HCI_LK_DEBUG_COMBINATION)
2409 continue;
2410
2411 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2412 key->type, key->pin_len, NULL);
2413 }
2414
2415 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2416
2417 hci_dev_unlock(hdev);
2418
2419 return 0;
2420 }
2421
2422 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2423 u8 addr_type, struct sock *skip_sk)
2424 {
2425 struct mgmt_ev_device_unpaired ev;
2426
2427 bacpy(&ev.addr.bdaddr, bdaddr);
2428 ev.addr.type = addr_type;
2429
2430 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2431 skip_sk);
2432 }
2433
2434 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2435 u16 len)
2436 {
2437 struct mgmt_cp_unpair_device *cp = data;
2438 struct mgmt_rp_unpair_device rp;
2439 struct hci_conn_params *params;
2440 struct mgmt_pending_cmd *cmd;
2441 struct hci_conn *conn;
2442 u8 addr_type;
2443 int err;
2444
2445 memset(&rp, 0, sizeof(rp));
2446 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2447 rp.addr.type = cp->addr.type;
2448
2449 if (!bdaddr_type_is_valid(cp->addr.type))
2450 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2451 MGMT_STATUS_INVALID_PARAMS,
2452 &rp, sizeof(rp));
2453
2454 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2455 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2456 MGMT_STATUS_INVALID_PARAMS,
2457 &rp, sizeof(rp));
2458
2459 hci_dev_lock(hdev);
2460
2461 if (!hdev_is_powered(hdev)) {
2462 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2463 MGMT_STATUS_NOT_POWERED, &rp,
2464 sizeof(rp));
2465 goto unlock;
2466 }
2467
2468 if (cp->addr.type == BDADDR_BREDR) {
2469 /* If disconnection is requested, then look up the
2470 * connection. If the remote device is connected, it
2471 * will be later used to terminate the link.
2472 *
2473 * Setting it to NULL explicitly will cause no
2474 * termination of the link.
2475 */
2476 if (cp->disconnect)
2477 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2478 &cp->addr.bdaddr);
2479 else
2480 conn = NULL;
2481
2482 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2483 if (err < 0) {
2484 err = mgmt_cmd_complete(sk, hdev->id,
2485 MGMT_OP_UNPAIR_DEVICE,
2486 MGMT_STATUS_NOT_PAIRED, &rp,
2487 sizeof(rp));
2488 goto unlock;
2489 }
2490
2491 goto done;
2492 }
2493
2494 /* LE address type */
2495 addr_type = le_addr_type(cp->addr.type);
2496
2497 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2498 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2499 if (err < 0) {
2500 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2501 MGMT_STATUS_NOT_PAIRED, &rp,
2502 sizeof(rp));
2503 goto unlock;
2504 }
2505
2506 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2507 if (!conn) {
2508 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2509 goto done;
2510 }
2511
2512
2513 /* Defer clearing up the connection parameters until closing to
2514 * give a chance of keeping them if a repairing happens.
2515 */
2516 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2517
2518 /* Disable auto-connection parameters if present */
2519 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2520 if (params) {
2521 if (params->explicit_connect)
2522 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2523 else
2524 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2525 }
2526
2527 /* If disconnection is not requested, then clear the connection
2528 * variable so that the link is not terminated.
2529 */
2530 if (!cp->disconnect)
2531 conn = NULL;
2532
2533 done:
2534 /* If the connection variable is set, then termination of the
2535 * link is requested.
2536 */
2537 if (!conn) {
2538 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2539 &rp, sizeof(rp));
2540 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2541 goto unlock;
2542 }
2543
2544 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2545 sizeof(*cp));
2546 if (!cmd) {
2547 err = -ENOMEM;
2548 goto unlock;
2549 }
2550
2551 cmd->cmd_complete = addr_cmd_complete;
2552
2553 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2554 if (err < 0)
2555 mgmt_pending_remove(cmd);
2556
2557 unlock:
2558 hci_dev_unlock(hdev);
2559 return err;
2560 }
2561
2562 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2563 u16 len)
2564 {
2565 struct mgmt_cp_disconnect *cp = data;
2566 struct mgmt_rp_disconnect rp;
2567 struct mgmt_pending_cmd *cmd;
2568 struct hci_conn *conn;
2569 int err;
2570
2571 bt_dev_dbg(hdev, "sock %p", sk);
2572
2573 memset(&rp, 0, sizeof(rp));
2574 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2575 rp.addr.type = cp->addr.type;
2576
2577 if (!bdaddr_type_is_valid(cp->addr.type))
2578 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2579 MGMT_STATUS_INVALID_PARAMS,
2580 &rp, sizeof(rp));
2581
2582 hci_dev_lock(hdev);
2583
2584 if (!test_bit(HCI_UP, &hdev->flags)) {
2585 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2586 MGMT_STATUS_NOT_POWERED, &rp,
2587 sizeof(rp));
2588 goto failed;
2589 }
2590
2591 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2592 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2593 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2594 goto failed;
2595 }
2596
2597 if (cp->addr.type == BDADDR_BREDR)
2598 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2599 &cp->addr.bdaddr);
2600 else
2601 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2602 le_addr_type(cp->addr.type));
2603
2604 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2605 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2606 MGMT_STATUS_NOT_CONNECTED, &rp,
2607 sizeof(rp));
2608 goto failed;
2609 }
2610
2611 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2612 if (!cmd) {
2613 err = -ENOMEM;
2614 goto failed;
2615 }
2616
2617 cmd->cmd_complete = generic_cmd_complete;
2618
2619 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2620 if (err < 0)
2621 mgmt_pending_remove(cmd);
2622
2623 failed:
2624 hci_dev_unlock(hdev);
2625 return err;
2626 }
2627
2628 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2629 {
2630 switch (link_type) {
2631 case LE_LINK:
2632 switch (addr_type) {
2633 case ADDR_LE_DEV_PUBLIC:
2634 return BDADDR_LE_PUBLIC;
2635
2636 default:
2637 /* Fallback to LE Random address type */
2638 return BDADDR_LE_RANDOM;
2639 }
2640
2641 default:
2642 /* Fallback to BR/EDR type */
2643 return BDADDR_BREDR;
2644 }
2645 }
2646
2647 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2648 u16 data_len)
2649 {
2650 struct mgmt_rp_get_connections *rp;
2651 struct hci_conn *c;
2652 int err;
2653 u16 i;
2654
2655 bt_dev_dbg(hdev, "sock %p", sk);
2656
2657 hci_dev_lock(hdev);
2658
2659 if (!hdev_is_powered(hdev)) {
2660 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2661 MGMT_STATUS_NOT_POWERED);
2662 goto unlock;
2663 }
2664
2665 i = 0;
2666 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2667 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2668 i++;
2669 }
2670
2671 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2672 if (!rp) {
2673 err = -ENOMEM;
2674 goto unlock;
2675 }
2676
2677 i = 0;
2678 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2679 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2680 continue;
2681 bacpy(&rp->addr[i].bdaddr, &c->dst);
2682 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2683 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2684 continue;
2685 i++;
2686 }
2687
2688 rp->conn_count = cpu_to_le16(i);
2689
2690 /* Recalculate length in case of filtered SCO connections, etc */
2691 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2692 struct_size(rp, addr, i));
2693
2694 kfree(rp);
2695
2696 unlock:
2697 hci_dev_unlock(hdev);
2698 return err;
2699 }
2700
2701 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2702 struct mgmt_cp_pin_code_neg_reply *cp)
2703 {
2704 struct mgmt_pending_cmd *cmd;
2705 int err;
2706
2707 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2708 sizeof(*cp));
2709 if (!cmd)
2710 return -ENOMEM;
2711
2712 cmd->cmd_complete = addr_cmd_complete;
2713
2714 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2715 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2716 if (err < 0)
2717 mgmt_pending_remove(cmd);
2718
2719 return err;
2720 }
2721
2722 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2723 u16 len)
2724 {
2725 struct hci_conn *conn;
2726 struct mgmt_cp_pin_code_reply *cp = data;
2727 struct hci_cp_pin_code_reply reply;
2728 struct mgmt_pending_cmd *cmd;
2729 int err;
2730
2731 bt_dev_dbg(hdev, "sock %p", sk);
2732
2733 hci_dev_lock(hdev);
2734
2735 if (!hdev_is_powered(hdev)) {
2736 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2737 MGMT_STATUS_NOT_POWERED);
2738 goto failed;
2739 }
2740
2741 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2742 if (!conn) {
2743 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2744 MGMT_STATUS_NOT_CONNECTED);
2745 goto failed;
2746 }
2747
2748 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2749 struct mgmt_cp_pin_code_neg_reply ncp;
2750
2751 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2752
2753 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2754
2755 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2756 if (err >= 0)
2757 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2758 MGMT_STATUS_INVALID_PARAMS);
2759
2760 goto failed;
2761 }
2762
2763 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2764 if (!cmd) {
2765 err = -ENOMEM;
2766 goto failed;
2767 }
2768
2769 cmd->cmd_complete = addr_cmd_complete;
2770
2771 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2772 reply.pin_len = cp->pin_len;
2773 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2774
2775 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2776 if (err < 0)
2777 mgmt_pending_remove(cmd);
2778
2779 failed:
2780 hci_dev_unlock(hdev);
2781 return err;
2782 }
2783
2784 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2785 u16 len)
2786 {
2787 struct mgmt_cp_set_io_capability *cp = data;
2788
2789 bt_dev_dbg(hdev, "sock %p", sk);
2790
2791 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2793 MGMT_STATUS_INVALID_PARAMS);
2794
2795 hci_dev_lock(hdev);
2796
2797 hdev->io_capability = cp->io_capability;
2798
2799 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability);
2800
2801 hci_dev_unlock(hdev);
2802
2803 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2804 NULL, 0);
2805 }
2806
2807 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2808 {
2809 struct hci_dev *hdev = conn->hdev;
2810 struct mgmt_pending_cmd *cmd;
2811
2812 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2813 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2814 continue;
2815
2816 if (cmd->user_data != conn)
2817 continue;
2818
2819 return cmd;
2820 }
2821
2822 return NULL;
2823 }
2824
2825 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2826 {
2827 struct mgmt_rp_pair_device rp;
2828 struct hci_conn *conn = cmd->user_data;
2829 int err;
2830
2831 bacpy(&rp.addr.bdaddr, &conn->dst);
2832 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2833
2834 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2835 status, &rp, sizeof(rp));
2836
2837 /* So we don't get further callbacks for this connection */
2838 conn->connect_cfm_cb = NULL;
2839 conn->security_cfm_cb = NULL;
2840 conn->disconn_cfm_cb = NULL;
2841
2842 hci_conn_drop(conn);
2843
2844 /* The device is paired so there is no need to remove
2845 * its connection parameters anymore.
2846 */
2847 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2848
2849 hci_conn_put(conn);
2850
2851 return err;
2852 }
2853
2854 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2855 {
2856 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2857 struct mgmt_pending_cmd *cmd;
2858
2859 cmd = find_pairing(conn);
2860 if (cmd) {
2861 cmd->cmd_complete(cmd, status);
2862 mgmt_pending_remove(cmd);
2863 }
2864 }
2865
2866 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2867 {
2868 struct mgmt_pending_cmd *cmd;
2869
2870 BT_DBG("status %u", status);
2871
2872 cmd = find_pairing(conn);
2873 if (!cmd) {
2874 BT_DBG("Unable to find a pending command");
2875 return;
2876 }
2877
2878 cmd->cmd_complete(cmd, mgmt_status(status));
2879 mgmt_pending_remove(cmd);
2880 }
2881
2882 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2883 {
2884 struct mgmt_pending_cmd *cmd;
2885
2886 BT_DBG("status %u", status);
2887
2888 if (!status)
2889 return;
2890
2891 cmd = find_pairing(conn);
2892 if (!cmd) {
2893 BT_DBG("Unable to find a pending command");
2894 return;
2895 }
2896
2897 cmd->cmd_complete(cmd, mgmt_status(status));
2898 mgmt_pending_remove(cmd);
2899 }
2900
2901 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2902 u16 len)
2903 {
2904 struct mgmt_cp_pair_device *cp = data;
2905 struct mgmt_rp_pair_device rp;
2906 struct mgmt_pending_cmd *cmd;
2907 u8 sec_level, auth_type;
2908 struct hci_conn *conn;
2909 int err;
2910
2911 bt_dev_dbg(hdev, "sock %p", sk);
2912
2913 memset(&rp, 0, sizeof(rp));
2914 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2915 rp.addr.type = cp->addr.type;
2916
2917 if (!bdaddr_type_is_valid(cp->addr.type))
2918 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2919 MGMT_STATUS_INVALID_PARAMS,
2920 &rp, sizeof(rp));
2921
2922 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2923 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2924 MGMT_STATUS_INVALID_PARAMS,
2925 &rp, sizeof(rp));
2926
2927 hci_dev_lock(hdev);
2928
2929 if (!hdev_is_powered(hdev)) {
2930 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2931 MGMT_STATUS_NOT_POWERED, &rp,
2932 sizeof(rp));
2933 goto unlock;
2934 }
2935
2936 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2937 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2938 MGMT_STATUS_ALREADY_PAIRED, &rp,
2939 sizeof(rp));
2940 goto unlock;
2941 }
2942
2943 sec_level = BT_SECURITY_MEDIUM;
2944 auth_type = HCI_AT_DEDICATED_BONDING;
2945
2946 if (cp->addr.type == BDADDR_BREDR) {
2947 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2948 auth_type, CONN_REASON_PAIR_DEVICE);
2949 } else {
2950 u8 addr_type = le_addr_type(cp->addr.type);
2951 struct hci_conn_params *p;
2952
2953 /* When pairing a new device, it is expected to remember
2954 * this device for future connections. Adding the connection
2955 * parameter information ahead of time allows tracking
2956 * of the slave preferred values and will speed up any
2957 * further connection establishment.
2958 *
2959 * If connection parameters already exist, then they
2960 * will be kept and this function does nothing.
2961 */
2962 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2963
2964 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2965 p->auto_connect = HCI_AUTO_CONN_DISABLED;
2966
2967 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type,
2968 sec_level, HCI_LE_CONN_TIMEOUT,
2969 CONN_REASON_PAIR_DEVICE);
2970 }
2971
2972 if (IS_ERR(conn)) {
2973 int status;
2974
2975 if (PTR_ERR(conn) == -EBUSY)
2976 status = MGMT_STATUS_BUSY;
2977 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2978 status = MGMT_STATUS_NOT_SUPPORTED;
2979 else if (PTR_ERR(conn) == -ECONNREFUSED)
2980 status = MGMT_STATUS_REJECTED;
2981 else
2982 status = MGMT_STATUS_CONNECT_FAILED;
2983
2984 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2985 status, &rp, sizeof(rp));
2986 goto unlock;
2987 }
2988
2989 if (conn->connect_cfm_cb) {
2990 hci_conn_drop(conn);
2991 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2992 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2993 goto unlock;
2994 }
2995
2996 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2997 if (!cmd) {
2998 err = -ENOMEM;
2999 hci_conn_drop(conn);
3000 goto unlock;
3001 }
3002
3003 cmd->cmd_complete = pairing_complete;
3004
3005 /* For LE, just connecting isn't a proof that the pairing finished */
3006 if (cp->addr.type == BDADDR_BREDR) {
3007 conn->connect_cfm_cb = pairing_complete_cb;
3008 conn->security_cfm_cb = pairing_complete_cb;
3009 conn->disconn_cfm_cb = pairing_complete_cb;
3010 } else {
3011 conn->connect_cfm_cb = le_pairing_complete_cb;
3012 conn->security_cfm_cb = le_pairing_complete_cb;
3013 conn->disconn_cfm_cb = le_pairing_complete_cb;
3014 }
3015
3016 conn->io_capability = cp->io_cap;
3017 cmd->user_data = hci_conn_get(conn);
3018
3019 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3020 hci_conn_security(conn, sec_level, auth_type, true)) {
3021 cmd->cmd_complete(cmd, 0);
3022 mgmt_pending_remove(cmd);
3023 }
3024
3025 err = 0;
3026
3027 unlock:
3028 hci_dev_unlock(hdev);
3029 return err;
3030 }
3031
3032 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3033 u16 len)
3034 {
3035 struct mgmt_addr_info *addr = data;
3036 struct mgmt_pending_cmd *cmd;
3037 struct hci_conn *conn;
3038 int err;
3039
3040 bt_dev_dbg(hdev, "sock %p", sk);
3041
3042 hci_dev_lock(hdev);
3043
3044 if (!hdev_is_powered(hdev)) {
3045 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3046 MGMT_STATUS_NOT_POWERED);
3047 goto unlock;
3048 }
3049
3050 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3051 if (!cmd) {
3052 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3053 MGMT_STATUS_INVALID_PARAMS);
3054 goto unlock;
3055 }
3056
3057 conn = cmd->user_data;
3058
3059 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3060 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3061 MGMT_STATUS_INVALID_PARAMS);
3062 goto unlock;
3063 }
3064
3065 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3066 mgmt_pending_remove(cmd);
3067
3068 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3069 addr, sizeof(*addr));
3070
3071 /* Since user doesn't want to proceed with the connection, abort any
3072 * ongoing pairing and then terminate the link if it was created
3073 * because of the pair device action.
3074 */
3075 if (addr->type == BDADDR_BREDR)
3076 hci_remove_link_key(hdev, &addr->bdaddr);
3077 else
3078 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr,
3079 le_addr_type(addr->type));
3080
3081 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE)
3082 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
3083
3084 unlock:
3085 hci_dev_unlock(hdev);
3086 return err;
3087 }
3088
3089 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3090 struct mgmt_addr_info *addr, u16 mgmt_op,
3091 u16 hci_op, __le32 passkey)
3092 {
3093 struct mgmt_pending_cmd *cmd;
3094 struct hci_conn *conn;
3095 int err;
3096
3097 hci_dev_lock(hdev);
3098
3099 if (!hdev_is_powered(hdev)) {
3100 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3101 MGMT_STATUS_NOT_POWERED, addr,
3102 sizeof(*addr));
3103 goto done;
3104 }
3105
3106 if (addr->type == BDADDR_BREDR)
3107 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3108 else
3109 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3110 le_addr_type(addr->type));
3111
3112 if (!conn) {
3113 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3114 MGMT_STATUS_NOT_CONNECTED, addr,
3115 sizeof(*addr));
3116 goto done;
3117 }
3118
3119 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3120 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3121 if (!err)
3122 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3123 MGMT_STATUS_SUCCESS, addr,
3124 sizeof(*addr));
3125 else
3126 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3127 MGMT_STATUS_FAILED, addr,
3128 sizeof(*addr));
3129
3130 goto done;
3131 }
3132
3133 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3134 if (!cmd) {
3135 err = -ENOMEM;
3136 goto done;
3137 }
3138
3139 cmd->cmd_complete = addr_cmd_complete;
3140
3141 /* Continue with pairing via HCI */
3142 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3143 struct hci_cp_user_passkey_reply cp;
3144
3145 bacpy(&cp.bdaddr, &addr->bdaddr);
3146 cp.passkey = passkey;
3147 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3148 } else
3149 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3150 &addr->bdaddr);
3151
3152 if (err < 0)
3153 mgmt_pending_remove(cmd);
3154
3155 done:
3156 hci_dev_unlock(hdev);
3157 return err;
3158 }
3159
3160 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3161 void *data, u16 len)
3162 {
3163 struct mgmt_cp_pin_code_neg_reply *cp = data;
3164
3165 bt_dev_dbg(hdev, "sock %p", sk);
3166
3167 return user_pairing_resp(sk, hdev, &cp->addr,
3168 MGMT_OP_PIN_CODE_NEG_REPLY,
3169 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3170 }
3171
3172 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3173 u16 len)
3174 {
3175 struct mgmt_cp_user_confirm_reply *cp = data;
3176
3177 bt_dev_dbg(hdev, "sock %p", sk);
3178
3179 if (len != sizeof(*cp))
3180 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3181 MGMT_STATUS_INVALID_PARAMS);
3182
3183 return user_pairing_resp(sk, hdev, &cp->addr,
3184 MGMT_OP_USER_CONFIRM_REPLY,
3185 HCI_OP_USER_CONFIRM_REPLY, 0);
3186 }
3187
3188 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3189 void *data, u16 len)
3190 {
3191 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3192
3193 bt_dev_dbg(hdev, "sock %p", sk);
3194
3195 return user_pairing_resp(sk, hdev, &cp->addr,
3196 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3197 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3198 }
3199
3200 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3201 u16 len)
3202 {
3203 struct mgmt_cp_user_passkey_reply *cp = data;
3204
3205 bt_dev_dbg(hdev, "sock %p", sk);
3206
3207 return user_pairing_resp(sk, hdev, &cp->addr,
3208 MGMT_OP_USER_PASSKEY_REPLY,
3209 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3210 }
3211
3212 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3213 void *data, u16 len)
3214 {
3215 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3216
3217 bt_dev_dbg(hdev, "sock %p", sk);
3218
3219 return user_pairing_resp(sk, hdev, &cp->addr,
3220 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3221 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3222 }
3223
3224 static void adv_expire(struct hci_dev *hdev, u32 flags)
3225 {
3226 struct adv_info *adv_instance;
3227 struct hci_request req;
3228 int err;
3229
3230 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3231 if (!adv_instance)
3232 return;
3233
3234 /* stop if current instance doesn't need to be changed */
3235 if (!(adv_instance->flags & flags))
3236 return;
3237
3238 cancel_adv_timeout(hdev);
3239
3240 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3241 if (!adv_instance)
3242 return;
3243
3244 hci_req_init(&req, hdev);
3245 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3246 true);
3247 if (err)
3248 return;
3249
3250 hci_req_run(&req, NULL);
3251 }
3252
3253 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3254 {
3255 struct mgmt_cp_set_local_name *cp;
3256 struct mgmt_pending_cmd *cmd;
3257
3258 bt_dev_dbg(hdev, "status 0x%02x", status);
3259
3260 hci_dev_lock(hdev);
3261
3262 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3263 if (!cmd)
3264 goto unlock;
3265
3266 cp = cmd->param;
3267
3268 if (status) {
3269 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3270 mgmt_status(status));
3271 } else {
3272 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3273 cp, sizeof(*cp));
3274
3275 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3276 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3277 }
3278
3279 mgmt_pending_remove(cmd);
3280
3281 unlock:
3282 hci_dev_unlock(hdev);
3283 }
3284
3285 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3286 u16 len)
3287 {
3288 struct mgmt_cp_set_local_name *cp = data;
3289 struct mgmt_pending_cmd *cmd;
3290 struct hci_request req;
3291 int err;
3292
3293 bt_dev_dbg(hdev, "sock %p", sk);
3294
3295 hci_dev_lock(hdev);
3296
3297 /* If the old values are the same as the new ones just return a
3298 * direct command complete event.
3299 */
3300 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3301 !memcmp(hdev->short_name, cp->short_name,
3302 sizeof(hdev->short_name))) {
3303 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3304 data, len);
3305 goto failed;
3306 }
3307
3308 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3309
3310 if (!hdev_is_powered(hdev)) {
3311 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3312
3313 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3314 data, len);
3315 if (err < 0)
3316 goto failed;
3317
3318 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3319 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3320 ext_info_changed(hdev, sk);
3321
3322 goto failed;
3323 }
3324
3325 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3326 if (!cmd) {
3327 err = -ENOMEM;
3328 goto failed;
3329 }
3330
3331 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3332
3333 hci_req_init(&req, hdev);
3334
3335 if (lmp_bredr_capable(hdev)) {
3336 __hci_req_update_name(&req);
3337 __hci_req_update_eir(&req);
3338 }
3339
3340 /* The name is stored in the scan response data and so
3341 * no need to udpate the advertising data here.
3342 */
3343 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3344 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3345
3346 err = hci_req_run(&req, set_name_complete);
3347 if (err < 0)
3348 mgmt_pending_remove(cmd);
3349
3350 failed:
3351 hci_dev_unlock(hdev);
3352 return err;
3353 }
3354
3355 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3356 u16 len)
3357 {
3358 struct mgmt_cp_set_appearance *cp = data;
3359 u16 appearance;
3360 int err;
3361
3362 bt_dev_dbg(hdev, "sock %p", sk);
3363
3364 if (!lmp_le_capable(hdev))
3365 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3366 MGMT_STATUS_NOT_SUPPORTED);
3367
3368 appearance = le16_to_cpu(cp->appearance);
3369
3370 hci_dev_lock(hdev);
3371
3372 if (hdev->appearance != appearance) {
3373 hdev->appearance = appearance;
3374
3375 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3376 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3377
3378 ext_info_changed(hdev, sk);
3379 }
3380
3381 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3382 0);
3383
3384 hci_dev_unlock(hdev);
3385
3386 return err;
3387 }
3388
3389 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3390 void *data, u16 len)
3391 {
3392 struct mgmt_rp_get_phy_configuration rp;
3393
3394 bt_dev_dbg(hdev, "sock %p", sk);
3395
3396 hci_dev_lock(hdev);
3397
3398 memset(&rp, 0, sizeof(rp));
3399
3400 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3401 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3402 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3403
3404 hci_dev_unlock(hdev);
3405
3406 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3407 &rp, sizeof(rp));
3408 }
3409
3410 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3411 {
3412 struct mgmt_ev_phy_configuration_changed ev;
3413
3414 memset(&ev, 0, sizeof(ev));
3415
3416 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3417
3418 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3419 sizeof(ev), skip);
3420 }
3421
3422 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3423 u16 opcode, struct sk_buff *skb)
3424 {
3425 struct mgmt_pending_cmd *cmd;
3426
3427 bt_dev_dbg(hdev, "status 0x%02x", status);
3428
3429 hci_dev_lock(hdev);
3430
3431 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3432 if (!cmd)
3433 goto unlock;
3434
3435 if (status) {
3436 mgmt_cmd_status(cmd->sk, hdev->id,
3437 MGMT_OP_SET_PHY_CONFIGURATION,
3438 mgmt_status(status));
3439 } else {
3440 mgmt_cmd_complete(cmd->sk, hdev->id,
3441 MGMT_OP_SET_PHY_CONFIGURATION, 0,
3442 NULL, 0);
3443
3444 mgmt_phy_configuration_changed(hdev, cmd->sk);
3445 }
3446
3447 mgmt_pending_remove(cmd);
3448
3449 unlock:
3450 hci_dev_unlock(hdev);
3451 }
3452
3453 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3454 void *data, u16 len)
3455 {
3456 struct mgmt_cp_set_phy_configuration *cp = data;
3457 struct hci_cp_le_set_default_phy cp_phy;
3458 struct mgmt_pending_cmd *cmd;
3459 struct hci_request req;
3460 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3461 u16 pkt_type = (HCI_DH1 | HCI_DM1);
3462 bool changed = false;
3463 int err;
3464
3465 bt_dev_dbg(hdev, "sock %p", sk);
3466
3467 configurable_phys = get_configurable_phys(hdev);
3468 supported_phys = get_supported_phys(hdev);
3469 selected_phys = __le32_to_cpu(cp->selected_phys);
3470
3471 if (selected_phys & ~supported_phys)
3472 return mgmt_cmd_status(sk, hdev->id,
3473 MGMT_OP_SET_PHY_CONFIGURATION,
3474 MGMT_STATUS_INVALID_PARAMS);
3475
3476 unconfigure_phys = supported_phys & ~configurable_phys;
3477
3478 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3479 return mgmt_cmd_status(sk, hdev->id,
3480 MGMT_OP_SET_PHY_CONFIGURATION,
3481 MGMT_STATUS_INVALID_PARAMS);
3482
3483 if (selected_phys == get_selected_phys(hdev))
3484 return mgmt_cmd_complete(sk, hdev->id,
3485 MGMT_OP_SET_PHY_CONFIGURATION,
3486 0, NULL, 0);
3487
3488 hci_dev_lock(hdev);
3489
3490 if (!hdev_is_powered(hdev)) {
3491 err = mgmt_cmd_status(sk, hdev->id,
3492 MGMT_OP_SET_PHY_CONFIGURATION,
3493 MGMT_STATUS_REJECTED);
3494 goto unlock;
3495 }
3496
3497 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3498 err = mgmt_cmd_status(sk, hdev->id,
3499 MGMT_OP_SET_PHY_CONFIGURATION,
3500 MGMT_STATUS_BUSY);
3501 goto unlock;
3502 }
3503
3504 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3505 pkt_type |= (HCI_DH3 | HCI_DM3);
3506 else
3507 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3508
3509 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3510 pkt_type |= (HCI_DH5 | HCI_DM5);
3511 else
3512 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3513
3514 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3515 pkt_type &= ~HCI_2DH1;
3516 else
3517 pkt_type |= HCI_2DH1;
3518
3519 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3520 pkt_type &= ~HCI_2DH3;
3521 else
3522 pkt_type |= HCI_2DH3;
3523
3524 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3525 pkt_type &= ~HCI_2DH5;
3526 else
3527 pkt_type |= HCI_2DH5;
3528
3529 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3530 pkt_type &= ~HCI_3DH1;
3531 else
3532 pkt_type |= HCI_3DH1;
3533
3534 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3535 pkt_type &= ~HCI_3DH3;
3536 else
3537 pkt_type |= HCI_3DH3;
3538
3539 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3540 pkt_type &= ~HCI_3DH5;
3541 else
3542 pkt_type |= HCI_3DH5;
3543
3544 if (pkt_type != hdev->pkt_type) {
3545 hdev->pkt_type = pkt_type;
3546 changed = true;
3547 }
3548
3549 if ((selected_phys & MGMT_PHY_LE_MASK) ==
3550 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3551 if (changed)
3552 mgmt_phy_configuration_changed(hdev, sk);
3553
3554 err = mgmt_cmd_complete(sk, hdev->id,
3555 MGMT_OP_SET_PHY_CONFIGURATION,
3556 0, NULL, 0);
3557
3558 goto unlock;
3559 }
3560
3561 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3562 len);
3563 if (!cmd) {
3564 err = -ENOMEM;
3565 goto unlock;
3566 }
3567
3568 hci_req_init(&req, hdev);
3569
3570 memset(&cp_phy, 0, sizeof(cp_phy));
3571
3572 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3573 cp_phy.all_phys |= 0x01;
3574
3575 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3576 cp_phy.all_phys |= 0x02;
3577
3578 if (selected_phys & MGMT_PHY_LE_1M_TX)
3579 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3580
3581 if (selected_phys & MGMT_PHY_LE_2M_TX)
3582 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3583
3584 if (selected_phys & MGMT_PHY_LE_CODED_TX)
3585 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3586
3587 if (selected_phys & MGMT_PHY_LE_1M_RX)
3588 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3589
3590 if (selected_phys & MGMT_PHY_LE_2M_RX)
3591 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3592
3593 if (selected_phys & MGMT_PHY_LE_CODED_RX)
3594 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3595
3596 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3597
3598 err = hci_req_run_skb(&req, set_default_phy_complete);
3599 if (err < 0)
3600 mgmt_pending_remove(cmd);
3601
3602 unlock:
3603 hci_dev_unlock(hdev);
3604
3605 return err;
3606 }
3607
3608 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3609 u16 len)
3610 {
3611 int err = MGMT_STATUS_SUCCESS;
3612 struct mgmt_cp_set_blocked_keys *keys = data;
3613 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3614 sizeof(struct mgmt_blocked_key_info));
3615 u16 key_count, expected_len;
3616 int i;
3617
3618 bt_dev_dbg(hdev, "sock %p", sk);
3619
3620 key_count = __le16_to_cpu(keys->key_count);
3621 if (key_count > max_key_count) {
3622 bt_dev_err(hdev, "too big key_count value %u", key_count);
3623 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3624 MGMT_STATUS_INVALID_PARAMS);
3625 }
3626
3627 expected_len = struct_size(keys, keys, key_count);
3628 if (expected_len != len) {
3629 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3630 expected_len, len);
3631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3632 MGMT_STATUS_INVALID_PARAMS);
3633 }
3634
3635 hci_dev_lock(hdev);
3636
3637 hci_blocked_keys_clear(hdev);
3638
3639 for (i = 0; i < keys->key_count; ++i) {
3640 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3641
3642 if (!b) {
3643 err = MGMT_STATUS_NO_RESOURCES;
3644 break;
3645 }
3646
3647 b->type = keys->keys[i].type;
3648 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3649 list_add_rcu(&b->list, &hdev->blocked_keys);
3650 }
3651 hci_dev_unlock(hdev);
3652
3653 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3654 err, NULL, 0);
3655 }
3656
3657 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3658 void *data, u16 len)
3659 {
3660 struct mgmt_mode *cp = data;
3661 int err;
3662 bool changed = false;
3663
3664 bt_dev_dbg(hdev, "sock %p", sk);
3665
3666 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3667 return mgmt_cmd_status(sk, hdev->id,
3668 MGMT_OP_SET_WIDEBAND_SPEECH,
3669 MGMT_STATUS_NOT_SUPPORTED);
3670
3671 if (cp->val != 0x00 && cp->val != 0x01)
3672 return mgmt_cmd_status(sk, hdev->id,
3673 MGMT_OP_SET_WIDEBAND_SPEECH,
3674 MGMT_STATUS_INVALID_PARAMS);
3675
3676 hci_dev_lock(hdev);
3677
3678 if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3679 err = mgmt_cmd_status(sk, hdev->id,
3680 MGMT_OP_SET_WIDEBAND_SPEECH,
3681 MGMT_STATUS_BUSY);
3682 goto unlock;
3683 }
3684
3685 if (hdev_is_powered(hdev) &&
3686 !!cp->val != hci_dev_test_flag(hdev,
3687 HCI_WIDEBAND_SPEECH_ENABLED)) {
3688 err = mgmt_cmd_status(sk, hdev->id,
3689 MGMT_OP_SET_WIDEBAND_SPEECH,
3690 MGMT_STATUS_REJECTED);
3691 goto unlock;
3692 }
3693
3694 if (cp->val)
3695 changed = !hci_dev_test_and_set_flag(hdev,
3696 HCI_WIDEBAND_SPEECH_ENABLED);
3697 else
3698 changed = hci_dev_test_and_clear_flag(hdev,
3699 HCI_WIDEBAND_SPEECH_ENABLED);
3700
3701 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3702 if (err < 0)
3703 goto unlock;
3704
3705 if (changed)
3706 err = new_settings(hdev, sk);
3707
3708 unlock:
3709 hci_dev_unlock(hdev);
3710 return err;
3711 }
3712
3713 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev,
3714 void *data, u16 data_len)
3715 {
3716 char buf[20];
3717 struct mgmt_rp_read_controller_cap *rp = (void *)buf;
3718 u16 cap_len = 0;
3719 u8 flags = 0;
3720 u8 tx_power_range[2];
3721
3722 bt_dev_dbg(hdev, "sock %p", sk);
3723
3724 memset(&buf, 0, sizeof(buf));
3725
3726 hci_dev_lock(hdev);
3727
3728 /* When the Read Simple Pairing Options command is supported, then
3729 * the remote public key validation is supported.
3730 */
3731 if (hdev->commands[41] & 0x08)
3732 flags |= 0x01; /* Remote public key validation (BR/EDR) */
3733
3734 flags |= 0x02; /* Remote public key validation (LE) */
3735
3736 /* When the Read Encryption Key Size command is supported, then the
3737 * encryption key size is enforced.
3738 */
3739 if (hdev->commands[20] & 0x10)
3740 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */
3741
3742 flags |= 0x08; /* Encryption key size enforcement (LE) */
3743
3744 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS,
3745 &flags, 1);
3746
3747 /* When the Read Simple Pairing Options command is supported, then
3748 * also max encryption key size information is provided.
3749 */
3750 if (hdev->commands[41] & 0x08)
3751 cap_len = eir_append_le16(rp->cap, cap_len,
3752 MGMT_CAP_MAX_ENC_KEY_SIZE,
3753 hdev->max_enc_key_size);
3754
3755 cap_len = eir_append_le16(rp->cap, cap_len,
3756 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE,
3757 SMP_MAX_ENC_KEY_SIZE);
3758
3759 /* Append the min/max LE tx power parameters if we were able to fetch
3760 * it from the controller
3761 */
3762 if (hdev->commands[38] & 0x80) {
3763 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1);
3764 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1);
3765 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR,
3766 tx_power_range, 2);
3767 }
3768
3769 rp->cap_len = cpu_to_le16(cap_len);
3770
3771 hci_dev_unlock(hdev);
3772
3773 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0,
3774 rp, sizeof(*rp) + cap_len);
3775 }
3776
3777 #ifdef CONFIG_BT_FEATURE_DEBUG
3778 /* d4992530-b9ec-469f-ab01-6c481c47da1c */
3779 static const u8 debug_uuid[16] = {
3780 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab,
3781 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4,
3782 };
3783 #endif
3784
3785 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */
3786 static const u8 simult_central_periph_uuid[16] = {
3787 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92,
3788 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67,
3789 };
3790
3791 /* 15c0a148-c273-11ea-b3de-0242ac130004 */
3792 static const u8 rpa_resolution_uuid[16] = {
3793 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3,
3794 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15,
3795 };
3796
3797 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev,
3798 void *data, u16 data_len)
3799 {
3800 char buf[62]; /* Enough space for 3 features */
3801 struct mgmt_rp_read_exp_features_info *rp = (void *)buf;
3802 u16 idx = 0;
3803 u32 flags;
3804
3805 bt_dev_dbg(hdev, "sock %p", sk);
3806
3807 memset(&buf, 0, sizeof(buf));
3808
3809 #ifdef CONFIG_BT_FEATURE_DEBUG
3810 if (!hdev) {
3811 flags = bt_dbg_get() ? BIT(0) : 0;
3812
3813 memcpy(rp->features[idx].uuid, debug_uuid, 16);
3814 rp->features[idx].flags = cpu_to_le32(flags);
3815 idx++;
3816 }
3817 #endif
3818
3819 if (hdev) {
3820 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) &&
3821 (hdev->le_states[4] & 0x08) && /* Central */
3822 (hdev->le_states[4] & 0x40) && /* Peripheral */
3823 (hdev->le_states[3] & 0x10)) /* Simultaneous */
3824 flags = BIT(0);
3825 else
3826 flags = 0;
3827
3828 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16);
3829 rp->features[idx].flags = cpu_to_le32(flags);
3830 idx++;
3831 }
3832
3833 if (hdev && use_ll_privacy(hdev)) {
3834 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
3835 flags = BIT(0) | BIT(1);
3836 else
3837 flags = BIT(1);
3838
3839 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16);
3840 rp->features[idx].flags = cpu_to_le32(flags);
3841 idx++;
3842 }
3843
3844 rp->feature_count = cpu_to_le16(idx);
3845
3846 /* After reading the experimental features information, enable
3847 * the events to update client on any future change.
3848 */
3849 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3850
3851 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3852 MGMT_OP_READ_EXP_FEATURES_INFO,
3853 0, rp, sizeof(*rp) + (20 * idx));
3854 }
3855
3856 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev,
3857 struct sock *skip)
3858 {
3859 struct mgmt_ev_exp_feature_changed ev;
3860
3861 memset(&ev, 0, sizeof(ev));
3862 memcpy(ev.uuid, rpa_resolution_uuid, 16);
3863 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1));
3864
3865 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev,
3866 &ev, sizeof(ev),
3867 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3868
3869 }
3870
3871 #ifdef CONFIG_BT_FEATURE_DEBUG
3872 static int exp_debug_feature_changed(bool enabled, struct sock *skip)
3873 {
3874 struct mgmt_ev_exp_feature_changed ev;
3875
3876 memset(&ev, 0, sizeof(ev));
3877 memcpy(ev.uuid, debug_uuid, 16);
3878 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0);
3879
3880 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL,
3881 &ev, sizeof(ev),
3882 HCI_MGMT_EXP_FEATURE_EVENTS, skip);
3883 }
3884 #endif
3885
3886 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev,
3887 void *data, u16 data_len)
3888 {
3889 struct mgmt_cp_set_exp_feature *cp = data;
3890 struct mgmt_rp_set_exp_feature rp;
3891
3892 bt_dev_dbg(hdev, "sock %p", sk);
3893
3894 if (!memcmp(cp->uuid, ZERO_KEY, 16)) {
3895 memset(rp.uuid, 0, 16);
3896 rp.flags = cpu_to_le32(0);
3897
3898 #ifdef CONFIG_BT_FEATURE_DEBUG
3899 if (!hdev) {
3900 bool changed = bt_dbg_get();
3901
3902 bt_dbg_set(false);
3903
3904 if (changed)
3905 exp_debug_feature_changed(false, sk);
3906 }
3907 #endif
3908
3909 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) {
3910 bool changed = hci_dev_test_flag(hdev,
3911 HCI_ENABLE_LL_PRIVACY);
3912
3913 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
3914
3915 if (changed)
3916 exp_ll_privacy_feature_changed(false, hdev, sk);
3917 }
3918
3919 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3920
3921 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
3922 MGMT_OP_SET_EXP_FEATURE, 0,
3923 &rp, sizeof(rp));
3924 }
3925
3926 #ifdef CONFIG_BT_FEATURE_DEBUG
3927 if (!memcmp(cp->uuid, debug_uuid, 16)) {
3928 bool val, changed;
3929 int err;
3930
3931 /* Command requires to use the non-controller index */
3932 if (hdev)
3933 return mgmt_cmd_status(sk, hdev->id,
3934 MGMT_OP_SET_EXP_FEATURE,
3935 MGMT_STATUS_INVALID_INDEX);
3936
3937 /* Parameters are limited to a single octet */
3938 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3939 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3940 MGMT_OP_SET_EXP_FEATURE,
3941 MGMT_STATUS_INVALID_PARAMS);
3942
3943 /* Only boolean on/off is supported */
3944 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3945 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3946 MGMT_OP_SET_EXP_FEATURE,
3947 MGMT_STATUS_INVALID_PARAMS);
3948
3949 val = !!cp->param[0];
3950 changed = val ? !bt_dbg_get() : bt_dbg_get();
3951 bt_dbg_set(val);
3952
3953 memcpy(rp.uuid, debug_uuid, 16);
3954 rp.flags = cpu_to_le32(val ? BIT(0) : 0);
3955
3956 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
3957
3958 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
3959 MGMT_OP_SET_EXP_FEATURE, 0,
3960 &rp, sizeof(rp));
3961
3962 if (changed)
3963 exp_debug_feature_changed(val, sk);
3964
3965 return err;
3966 }
3967 #endif
3968
3969 if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) {
3970 bool val, changed;
3971 int err;
3972 u32 flags;
3973
3974 /* Command requires to use the controller index */
3975 if (!hdev)
3976 return mgmt_cmd_status(sk, MGMT_INDEX_NONE,
3977 MGMT_OP_SET_EXP_FEATURE,
3978 MGMT_STATUS_INVALID_INDEX);
3979
3980 /* Changes can only be made when controller is powered down */
3981 if (hdev_is_powered(hdev))
3982 return mgmt_cmd_status(sk, hdev->id,
3983 MGMT_OP_SET_EXP_FEATURE,
3984 MGMT_STATUS_NOT_POWERED);
3985
3986 /* Parameters are limited to a single octet */
3987 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1)
3988 return mgmt_cmd_status(sk, hdev->id,
3989 MGMT_OP_SET_EXP_FEATURE,
3990 MGMT_STATUS_INVALID_PARAMS);
3991
3992 /* Only boolean on/off is supported */
3993 if (cp->param[0] != 0x00 && cp->param[0] != 0x01)
3994 return mgmt_cmd_status(sk, hdev->id,
3995 MGMT_OP_SET_EXP_FEATURE,
3996 MGMT_STATUS_INVALID_PARAMS);
3997
3998 val = !!cp->param[0];
3999
4000 if (val) {
4001 changed = !hci_dev_test_flag(hdev,
4002 HCI_ENABLE_LL_PRIVACY);
4003 hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4004 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4005
4006 /* Enable LL privacy + supported settings changed */
4007 flags = BIT(0) | BIT(1);
4008 } else {
4009 changed = hci_dev_test_flag(hdev,
4010 HCI_ENABLE_LL_PRIVACY);
4011 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY);
4012
4013 /* Disable LL privacy + supported settings changed */
4014 flags = BIT(1);
4015 }
4016
4017 memcpy(rp.uuid, rpa_resolution_uuid, 16);
4018 rp.flags = cpu_to_le32(flags);
4019
4020 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS);
4021
4022 err = mgmt_cmd_complete(sk, hdev->id,
4023 MGMT_OP_SET_EXP_FEATURE, 0,
4024 &rp, sizeof(rp));
4025
4026 if (changed)
4027 exp_ll_privacy_feature_changed(val, hdev, sk);
4028
4029 return err;
4030 }
4031
4032 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE,
4033 MGMT_OP_SET_EXP_FEATURE,
4034 MGMT_STATUS_NOT_SUPPORTED);
4035 }
4036
4037 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1)
4038
4039 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4040 u16 data_len)
4041 {
4042 struct mgmt_cp_get_device_flags *cp = data;
4043 struct mgmt_rp_get_device_flags rp;
4044 struct bdaddr_list_with_flags *br_params;
4045 struct hci_conn_params *params;
4046 u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4047 u32 current_flags = 0;
4048 u8 status = MGMT_STATUS_INVALID_PARAMS;
4049
4050 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n",
4051 &cp->addr.bdaddr, cp->addr.type);
4052
4053 hci_dev_lock(hdev);
4054
4055 if (cp->addr.type == BDADDR_BREDR) {
4056 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4057 &cp->addr.bdaddr,
4058 cp->addr.type);
4059 if (!br_params)
4060 goto done;
4061
4062 current_flags = br_params->current_flags;
4063 } else {
4064 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4065 le_addr_type(cp->addr.type));
4066
4067 if (!params)
4068 goto done;
4069
4070 current_flags = params->current_flags;
4071 }
4072
4073 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4074 rp.addr.type = cp->addr.type;
4075 rp.supported_flags = cpu_to_le32(supported_flags);
4076 rp.current_flags = cpu_to_le32(current_flags);
4077
4078 status = MGMT_STATUS_SUCCESS;
4079
4080 done:
4081 hci_dev_unlock(hdev);
4082
4083 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status,
4084 &rp, sizeof(rp));
4085 }
4086
4087 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev,
4088 bdaddr_t *bdaddr, u8 bdaddr_type,
4089 u32 supported_flags, u32 current_flags)
4090 {
4091 struct mgmt_ev_device_flags_changed ev;
4092
4093 bacpy(&ev.addr.bdaddr, bdaddr);
4094 ev.addr.type = bdaddr_type;
4095 ev.supported_flags = cpu_to_le32(supported_flags);
4096 ev.current_flags = cpu_to_le32(current_flags);
4097
4098 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk);
4099 }
4100
4101 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data,
4102 u16 len)
4103 {
4104 struct mgmt_cp_set_device_flags *cp = data;
4105 struct bdaddr_list_with_flags *br_params;
4106 struct hci_conn_params *params;
4107 u8 status = MGMT_STATUS_INVALID_PARAMS;
4108 u32 supported_flags = SUPPORTED_DEVICE_FLAGS();
4109 u32 current_flags = __le32_to_cpu(cp->current_flags);
4110
4111 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x",
4112 &cp->addr.bdaddr, cp->addr.type,
4113 __le32_to_cpu(current_flags));
4114
4115 if ((supported_flags | current_flags) != supported_flags) {
4116 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)",
4117 current_flags, supported_flags);
4118 goto done;
4119 }
4120
4121 hci_dev_lock(hdev);
4122
4123 if (cp->addr.type == BDADDR_BREDR) {
4124 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
4125 &cp->addr.bdaddr,
4126 cp->addr.type);
4127
4128 if (br_params) {
4129 br_params->current_flags = current_flags;
4130 status = MGMT_STATUS_SUCCESS;
4131 } else {
4132 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)",
4133 &cp->addr.bdaddr, cp->addr.type);
4134 }
4135 } else {
4136 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
4137 le_addr_type(cp->addr.type));
4138 if (params) {
4139 params->current_flags = current_flags;
4140 status = MGMT_STATUS_SUCCESS;
4141 } else {
4142 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)",
4143 &cp->addr.bdaddr,
4144 le_addr_type(cp->addr.type));
4145 }
4146 }
4147
4148 done:
4149 hci_dev_unlock(hdev);
4150
4151 if (status == MGMT_STATUS_SUCCESS)
4152 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
4153 supported_flags, current_flags);
4154
4155 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status,
4156 &cp->addr, sizeof(cp->addr));
4157 }
4158
4159 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev,
4160 u16 handle)
4161 {
4162 struct mgmt_ev_adv_monitor_added ev;
4163
4164 ev.monitor_handle = cpu_to_le16(handle);
4165
4166 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk);
4167 }
4168
4169 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev,
4170 u16 handle)
4171 {
4172 struct mgmt_ev_adv_monitor_added ev;
4173
4174 ev.monitor_handle = cpu_to_le16(handle);
4175
4176 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk);
4177 }
4178
4179 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev,
4180 void *data, u16 len)
4181 {
4182 struct adv_monitor *monitor = NULL;
4183 struct mgmt_rp_read_adv_monitor_features *rp = NULL;
4184 int handle, err;
4185 size_t rp_size = 0;
4186 __u32 supported = 0;
4187 __u16 num_handles = 0;
4188 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES];
4189
4190 BT_DBG("request for %s", hdev->name);
4191
4192 hci_dev_lock(hdev);
4193
4194 if (msft_get_features(hdev) & MSFT_FEATURE_MASK_LE_ADV_MONITOR)
4195 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS;
4196
4197 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) {
4198 handles[num_handles++] = monitor->handle;
4199 }
4200
4201 hci_dev_unlock(hdev);
4202
4203 rp_size = sizeof(*rp) + (num_handles * sizeof(u16));
4204 rp = kmalloc(rp_size, GFP_KERNEL);
4205 if (!rp)
4206 return -ENOMEM;
4207
4208 /* Once controller-based monitoring is in place, the enabled_features
4209 * should reflect the use.
4210 */
4211 rp->supported_features = cpu_to_le32(supported);
4212 rp->enabled_features = 0;
4213 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES);
4214 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS;
4215 rp->num_handles = cpu_to_le16(num_handles);
4216 if (num_handles)
4217 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16)));
4218
4219 err = mgmt_cmd_complete(sk, hdev->id,
4220 MGMT_OP_READ_ADV_MONITOR_FEATURES,
4221 MGMT_STATUS_SUCCESS, rp, rp_size);
4222
4223 kfree(rp);
4224
4225 return err;
4226 }
4227
4228 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
4229 void *data, u16 len)
4230 {
4231 struct mgmt_cp_add_adv_patterns_monitor *cp = data;
4232 struct mgmt_rp_add_adv_patterns_monitor rp;
4233 struct adv_monitor *m = NULL;
4234 struct adv_pattern *p = NULL;
4235 unsigned int mp_cnt = 0, prev_adv_monitors_cnt;
4236 __u8 cp_ofst = 0, cp_len = 0;
4237 int err, i;
4238
4239 BT_DBG("request for %s", hdev->name);
4240
4241 if (len <= sizeof(*cp) || cp->pattern_count == 0) {
4242 err = mgmt_cmd_status(sk, hdev->id,
4243 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4244 MGMT_STATUS_INVALID_PARAMS);
4245 goto failed;
4246 }
4247
4248 m = kmalloc(sizeof(*m), GFP_KERNEL);
4249 if (!m) {
4250 err = -ENOMEM;
4251 goto failed;
4252 }
4253
4254 INIT_LIST_HEAD(&m->patterns);
4255 m->active = false;
4256
4257 for (i = 0; i < cp->pattern_count; i++) {
4258 if (++mp_cnt > HCI_MAX_ADV_MONITOR_NUM_PATTERNS) {
4259 err = mgmt_cmd_status(sk, hdev->id,
4260 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4261 MGMT_STATUS_INVALID_PARAMS);
4262 goto failed;
4263 }
4264
4265 cp_ofst = cp->patterns[i].offset;
4266 cp_len = cp->patterns[i].length;
4267 if (cp_ofst >= HCI_MAX_AD_LENGTH ||
4268 cp_len > HCI_MAX_AD_LENGTH ||
4269 (cp_ofst + cp_len) > HCI_MAX_AD_LENGTH) {
4270 err = mgmt_cmd_status(sk, hdev->id,
4271 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4272 MGMT_STATUS_INVALID_PARAMS);
4273 goto failed;
4274 }
4275
4276 p = kmalloc(sizeof(*p), GFP_KERNEL);
4277 if (!p) {
4278 err = -ENOMEM;
4279 goto failed;
4280 }
4281
4282 p->ad_type = cp->patterns[i].ad_type;
4283 p->offset = cp->patterns[i].offset;
4284 p->length = cp->patterns[i].length;
4285 memcpy(p->value, cp->patterns[i].value, p->length);
4286
4287 INIT_LIST_HEAD(&p->list);
4288 list_add(&p->list, &m->patterns);
4289 }
4290
4291 if (mp_cnt != cp->pattern_count) {
4292 err = mgmt_cmd_status(sk, hdev->id,
4293 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4294 MGMT_STATUS_INVALID_PARAMS);
4295 goto failed;
4296 }
4297
4298 hci_dev_lock(hdev);
4299
4300 prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4301
4302 err = hci_add_adv_monitor(hdev, m);
4303 if (err) {
4304 if (err == -ENOSPC) {
4305 mgmt_cmd_status(sk, hdev->id,
4306 MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4307 MGMT_STATUS_NO_RESOURCES);
4308 }
4309 goto unlock;
4310 }
4311
4312 if (hdev->adv_monitors_cnt > prev_adv_monitors_cnt)
4313 mgmt_adv_monitor_added(sk, hdev, m->handle);
4314
4315 hci_dev_unlock(hdev);
4316
4317 rp.monitor_handle = cpu_to_le16(m->handle);
4318
4319 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADV_PATTERNS_MONITOR,
4320 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4321
4322 unlock:
4323 hci_dev_unlock(hdev);
4324
4325 failed:
4326 hci_free_adv_monitor(m);
4327 return err;
4328 }
4329
4330 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
4331 void *data, u16 len)
4332 {
4333 struct mgmt_cp_remove_adv_monitor *cp = data;
4334 struct mgmt_rp_remove_adv_monitor rp;
4335 unsigned int prev_adv_monitors_cnt;
4336 u16 handle;
4337 int err;
4338
4339 BT_DBG("request for %s", hdev->name);
4340
4341 hci_dev_lock(hdev);
4342
4343 handle = __le16_to_cpu(cp->monitor_handle);
4344 prev_adv_monitors_cnt = hdev->adv_monitors_cnt;
4345
4346 err = hci_remove_adv_monitor(hdev, handle);
4347 if (err == -ENOENT) {
4348 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4349 MGMT_STATUS_INVALID_INDEX);
4350 goto unlock;
4351 }
4352
4353 if (hdev->adv_monitors_cnt < prev_adv_monitors_cnt)
4354 mgmt_adv_monitor_removed(sk, hdev, handle);
4355
4356 hci_dev_unlock(hdev);
4357
4358 rp.monitor_handle = cp->monitor_handle;
4359
4360 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR,
4361 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4362
4363 unlock:
4364 hci_dev_unlock(hdev);
4365 return err;
4366 }
4367
4368 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
4369 u16 opcode, struct sk_buff *skb)
4370 {
4371 struct mgmt_rp_read_local_oob_data mgmt_rp;
4372 size_t rp_size = sizeof(mgmt_rp);
4373 struct mgmt_pending_cmd *cmd;
4374
4375 bt_dev_dbg(hdev, "status %u", status);
4376
4377 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4378 if (!cmd)
4379 return;
4380
4381 if (status || !skb) {
4382 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4383 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
4384 goto remove;
4385 }
4386
4387 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
4388
4389 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
4390 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
4391
4392 if (skb->len < sizeof(*rp)) {
4393 mgmt_cmd_status(cmd->sk, hdev->id,
4394 MGMT_OP_READ_LOCAL_OOB_DATA,
4395 MGMT_STATUS_FAILED);
4396 goto remove;
4397 }
4398
4399 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
4400 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
4401
4402 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
4403 } else {
4404 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
4405
4406 if (skb->len < sizeof(*rp)) {
4407 mgmt_cmd_status(cmd->sk, hdev->id,
4408 MGMT_OP_READ_LOCAL_OOB_DATA,
4409 MGMT_STATUS_FAILED);
4410 goto remove;
4411 }
4412
4413 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
4414 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
4415
4416 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
4417 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
4418 }
4419
4420 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4421 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
4422
4423 remove:
4424 mgmt_pending_remove(cmd);
4425 }
4426
4427 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
4428 void *data, u16 data_len)
4429 {
4430 struct mgmt_pending_cmd *cmd;
4431 struct hci_request req;
4432 int err;
4433
4434 bt_dev_dbg(hdev, "sock %p", sk);
4435
4436 hci_dev_lock(hdev);
4437
4438 if (!hdev_is_powered(hdev)) {
4439 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4440 MGMT_STATUS_NOT_POWERED);
4441 goto unlock;
4442 }
4443
4444 if (!lmp_ssp_capable(hdev)) {
4445 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4446 MGMT_STATUS_NOT_SUPPORTED);
4447 goto unlock;
4448 }
4449
4450 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
4451 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4452 MGMT_STATUS_BUSY);
4453 goto unlock;
4454 }
4455
4456 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
4457 if (!cmd) {
4458 err = -ENOMEM;
4459 goto unlock;
4460 }
4461
4462 hci_req_init(&req, hdev);
4463
4464 if (bredr_sc_enabled(hdev))
4465 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4466 else
4467 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4468
4469 err = hci_req_run_skb(&req, read_local_oob_data_complete);
4470 if (err < 0)
4471 mgmt_pending_remove(cmd);
4472
4473 unlock:
4474 hci_dev_unlock(hdev);
4475 return err;
4476 }
4477
4478 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4479 void *data, u16 len)
4480 {
4481 struct mgmt_addr_info *addr = data;
4482 int err;
4483
4484 bt_dev_dbg(hdev, "sock %p", sk);
4485
4486 if (!bdaddr_type_is_valid(addr->type))
4487 return mgmt_cmd_complete(sk, hdev->id,
4488 MGMT_OP_ADD_REMOTE_OOB_DATA,
4489 MGMT_STATUS_INVALID_PARAMS,
4490 addr, sizeof(*addr));
4491
4492 hci_dev_lock(hdev);
4493
4494 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4495 struct mgmt_cp_add_remote_oob_data *cp = data;
4496 u8 status;
4497
4498 if (cp->addr.type != BDADDR_BREDR) {
4499 err = mgmt_cmd_complete(sk, hdev->id,
4500 MGMT_OP_ADD_REMOTE_OOB_DATA,
4501 MGMT_STATUS_INVALID_PARAMS,
4502 &cp->addr, sizeof(cp->addr));
4503 goto unlock;
4504 }
4505
4506 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4507 cp->addr.type, cp->hash,
4508 cp->rand, NULL, NULL);
4509 if (err < 0)
4510 status = MGMT_STATUS_FAILED;
4511 else
4512 status = MGMT_STATUS_SUCCESS;
4513
4514 err = mgmt_cmd_complete(sk, hdev->id,
4515 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4516 &cp->addr, sizeof(cp->addr));
4517 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4518 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
4519 u8 *rand192, *hash192, *rand256, *hash256;
4520 u8 status;
4521
4522 if (bdaddr_type_is_le(cp->addr.type)) {
4523 /* Enforce zero-valued 192-bit parameters as
4524 * long as legacy SMP OOB isn't implemented.
4525 */
4526 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4527 memcmp(cp->hash192, ZERO_KEY, 16)) {
4528 err = mgmt_cmd_complete(sk, hdev->id,
4529 MGMT_OP_ADD_REMOTE_OOB_DATA,
4530 MGMT_STATUS_INVALID_PARAMS,
4531 addr, sizeof(*addr));
4532 goto unlock;
4533 }
4534
4535 rand192 = NULL;
4536 hash192 = NULL;
4537 } else {
4538 /* In case one of the P-192 values is set to zero,
4539 * then just disable OOB data for P-192.
4540 */
4541 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4542 !memcmp(cp->hash192, ZERO_KEY, 16)) {
4543 rand192 = NULL;
4544 hash192 = NULL;
4545 } else {
4546 rand192 = cp->rand192;
4547 hash192 = cp->hash192;
4548 }
4549 }
4550
4551 /* In case one of the P-256 values is set to zero, then just
4552 * disable OOB data for P-256.
4553 */
4554 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4555 !memcmp(cp->hash256, ZERO_KEY, 16)) {
4556 rand256 = NULL;
4557 hash256 = NULL;
4558 } else {
4559 rand256 = cp->rand256;
4560 hash256 = cp->hash256;
4561 }
4562
4563 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
4564 cp->addr.type, hash192, rand192,
4565 hash256, rand256);
4566 if (err < 0)
4567 status = MGMT_STATUS_FAILED;
4568 else
4569 status = MGMT_STATUS_SUCCESS;
4570
4571 err = mgmt_cmd_complete(sk, hdev->id,
4572 MGMT_OP_ADD_REMOTE_OOB_DATA,
4573 status, &cp->addr, sizeof(cp->addr));
4574 } else {
4575 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
4576 len);
4577 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4578 MGMT_STATUS_INVALID_PARAMS);
4579 }
4580
4581 unlock:
4582 hci_dev_unlock(hdev);
4583 return err;
4584 }
4585
4586 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
4587 void *data, u16 len)
4588 {
4589 struct mgmt_cp_remove_remote_oob_data *cp = data;
4590 u8 status;
4591 int err;
4592
4593 bt_dev_dbg(hdev, "sock %p", sk);
4594
4595 if (cp->addr.type != BDADDR_BREDR)
4596 return mgmt_cmd_complete(sk, hdev->id,
4597 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4598 MGMT_STATUS_INVALID_PARAMS,
4599 &cp->addr, sizeof(cp->addr));
4600
4601 hci_dev_lock(hdev);
4602
4603 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4604 hci_remote_oob_data_clear(hdev);
4605 status = MGMT_STATUS_SUCCESS;
4606 goto done;
4607 }
4608
4609 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
4610 if (err < 0)
4611 status = MGMT_STATUS_INVALID_PARAMS;
4612 else
4613 status = MGMT_STATUS_SUCCESS;
4614
4615 done:
4616 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4617 status, &cp->addr, sizeof(cp->addr));
4618
4619 hci_dev_unlock(hdev);
4620 return err;
4621 }
4622
4623 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
4624 {
4625 struct mgmt_pending_cmd *cmd;
4626
4627 bt_dev_dbg(hdev, "status %d", status);
4628
4629 hci_dev_lock(hdev);
4630
4631 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
4632 if (!cmd)
4633 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
4634
4635 if (!cmd)
4636 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
4637
4638 if (cmd) {
4639 cmd->cmd_complete(cmd, mgmt_status(status));
4640 mgmt_pending_remove(cmd);
4641 }
4642
4643 hci_dev_unlock(hdev);
4644
4645 /* Handle suspend notifier */
4646 if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
4647 hdev->suspend_tasks)) {
4648 bt_dev_dbg(hdev, "Unpaused discovery");
4649 wake_up(&hdev->suspend_wait_q);
4650 }
4651 }
4652
4653 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
4654 uint8_t *mgmt_status)
4655 {
4656 switch (type) {
4657 case DISCOV_TYPE_LE:
4658 *mgmt_status = mgmt_le_support(hdev);
4659 if (*mgmt_status)
4660 return false;
4661 break;
4662 case DISCOV_TYPE_INTERLEAVED:
4663 *mgmt_status = mgmt_le_support(hdev);
4664 if (*mgmt_status)
4665 return false;
4666 fallthrough;
4667 case DISCOV_TYPE_BREDR:
4668 *mgmt_status = mgmt_bredr_support(hdev);
4669 if (*mgmt_status)
4670 return false;
4671 break;
4672 default:
4673 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
4674 return false;
4675 }
4676
4677 return true;
4678 }
4679
4680 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
4681 u16 op, void *data, u16 len)
4682 {
4683 struct mgmt_cp_start_discovery *cp = data;
4684 struct mgmt_pending_cmd *cmd;
4685 u8 status;
4686 int err;
4687
4688 bt_dev_dbg(hdev, "sock %p", sk);
4689
4690 hci_dev_lock(hdev);
4691
4692 if (!hdev_is_powered(hdev)) {
4693 err = mgmt_cmd_complete(sk, hdev->id, op,
4694 MGMT_STATUS_NOT_POWERED,
4695 &cp->type, sizeof(cp->type));
4696 goto failed;
4697 }
4698
4699 if (hdev->discovery.state != DISCOVERY_STOPPED ||
4700 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4701 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4702 &cp->type, sizeof(cp->type));
4703 goto failed;
4704 }
4705
4706 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4707 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4708 &cp->type, sizeof(cp->type));
4709 goto failed;
4710 }
4711
4712 /* Can't start discovery when it is paused */
4713 if (hdev->discovery_paused) {
4714 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4715 &cp->type, sizeof(cp->type));
4716 goto failed;
4717 }
4718
4719 /* Clear the discovery filter first to free any previously
4720 * allocated memory for the UUID list.
4721 */
4722 hci_discovery_filter_clear(hdev);
4723
4724 hdev->discovery.type = cp->type;
4725 hdev->discovery.report_invalid_rssi = false;
4726 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4727 hdev->discovery.limited = true;
4728 else
4729 hdev->discovery.limited = false;
4730
4731 cmd = mgmt_pending_add(sk, op, hdev, data, len);
4732 if (!cmd) {
4733 err = -ENOMEM;
4734 goto failed;
4735 }
4736
4737 cmd->cmd_complete = generic_cmd_complete;
4738
4739 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4740 queue_work(hdev->req_workqueue, &hdev->discov_update);
4741 err = 0;
4742
4743 failed:
4744 hci_dev_unlock(hdev);
4745 return err;
4746 }
4747
4748 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4749 void *data, u16 len)
4750 {
4751 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4752 data, len);
4753 }
4754
4755 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4756 void *data, u16 len)
4757 {
4758 return start_discovery_internal(sk, hdev,
4759 MGMT_OP_START_LIMITED_DISCOVERY,
4760 data, len);
4761 }
4762
4763 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4764 u8 status)
4765 {
4766 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4767 cmd->param, 1);
4768 }
4769
4770 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4771 void *data, u16 len)
4772 {
4773 struct mgmt_cp_start_service_discovery *cp = data;
4774 struct mgmt_pending_cmd *cmd;
4775 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4776 u16 uuid_count, expected_len;
4777 u8 status;
4778 int err;
4779
4780 bt_dev_dbg(hdev, "sock %p", sk);
4781
4782 hci_dev_lock(hdev);
4783
4784 if (!hdev_is_powered(hdev)) {
4785 err = mgmt_cmd_complete(sk, hdev->id,
4786 MGMT_OP_START_SERVICE_DISCOVERY,
4787 MGMT_STATUS_NOT_POWERED,
4788 &cp->type, sizeof(cp->type));
4789 goto failed;
4790 }
4791
4792 if (hdev->discovery.state != DISCOVERY_STOPPED ||
4793 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4794 err = mgmt_cmd_complete(sk, hdev->id,
4795 MGMT_OP_START_SERVICE_DISCOVERY,
4796 MGMT_STATUS_BUSY, &cp->type,
4797 sizeof(cp->type));
4798 goto failed;
4799 }
4800
4801 uuid_count = __le16_to_cpu(cp->uuid_count);
4802 if (uuid_count > max_uuid_count) {
4803 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
4804 uuid_count);
4805 err = mgmt_cmd_complete(sk, hdev->id,
4806 MGMT_OP_START_SERVICE_DISCOVERY,
4807 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4808 sizeof(cp->type));
4809 goto failed;
4810 }
4811
4812 expected_len = sizeof(*cp) + uuid_count * 16;
4813 if (expected_len != len) {
4814 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
4815 expected_len, len);
4816 err = mgmt_cmd_complete(sk, hdev->id,
4817 MGMT_OP_START_SERVICE_DISCOVERY,
4818 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4819 sizeof(cp->type));
4820 goto failed;
4821 }
4822
4823 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4824 err = mgmt_cmd_complete(sk, hdev->id,
4825 MGMT_OP_START_SERVICE_DISCOVERY,
4826 status, &cp->type, sizeof(cp->type));
4827 goto failed;
4828 }
4829
4830 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4831 hdev, data, len);
4832 if (!cmd) {
4833 err = -ENOMEM;
4834 goto failed;
4835 }
4836
4837 cmd->cmd_complete = service_discovery_cmd_complete;
4838
4839 /* Clear the discovery filter first to free any previously
4840 * allocated memory for the UUID list.
4841 */
4842 hci_discovery_filter_clear(hdev);
4843
4844 hdev->discovery.result_filtering = true;
4845 hdev->discovery.type = cp->type;
4846 hdev->discovery.rssi = cp->rssi;
4847 hdev->discovery.uuid_count = uuid_count;
4848
4849 if (uuid_count > 0) {
4850 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4851 GFP_KERNEL);
4852 if (!hdev->discovery.uuids) {
4853 err = mgmt_cmd_complete(sk, hdev->id,
4854 MGMT_OP_START_SERVICE_DISCOVERY,
4855 MGMT_STATUS_FAILED,
4856 &cp->type, sizeof(cp->type));
4857 mgmt_pending_remove(cmd);
4858 goto failed;
4859 }
4860 }
4861
4862 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4863 queue_work(hdev->req_workqueue, &hdev->discov_update);
4864 err = 0;
4865
4866 failed:
4867 hci_dev_unlock(hdev);
4868 return err;
4869 }
4870
4871 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4872 {
4873 struct mgmt_pending_cmd *cmd;
4874
4875 bt_dev_dbg(hdev, "status %d", status);
4876
4877 hci_dev_lock(hdev);
4878
4879 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4880 if (cmd) {
4881 cmd->cmd_complete(cmd, mgmt_status(status));
4882 mgmt_pending_remove(cmd);
4883 }
4884
4885 hci_dev_unlock(hdev);
4886
4887 /* Handle suspend notifier */
4888 if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
4889 bt_dev_dbg(hdev, "Paused discovery");
4890 wake_up(&hdev->suspend_wait_q);
4891 }
4892 }
4893
4894 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4895 u16 len)
4896 {
4897 struct mgmt_cp_stop_discovery *mgmt_cp = data;
4898 struct mgmt_pending_cmd *cmd;
4899 int err;
4900
4901 bt_dev_dbg(hdev, "sock %p", sk);
4902
4903 hci_dev_lock(hdev);
4904
4905 if (!hci_discovery_active(hdev)) {
4906 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4907 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4908 sizeof(mgmt_cp->type));
4909 goto unlock;
4910 }
4911
4912 if (hdev->discovery.type != mgmt_cp->type) {
4913 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4914 MGMT_STATUS_INVALID_PARAMS,
4915 &mgmt_cp->type, sizeof(mgmt_cp->type));
4916 goto unlock;
4917 }
4918
4919 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4920 if (!cmd) {
4921 err = -ENOMEM;
4922 goto unlock;
4923 }
4924
4925 cmd->cmd_complete = generic_cmd_complete;
4926
4927 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4928 queue_work(hdev->req_workqueue, &hdev->discov_update);
4929 err = 0;
4930
4931 unlock:
4932 hci_dev_unlock(hdev);
4933 return err;
4934 }
4935
4936 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4937 u16 len)
4938 {
4939 struct mgmt_cp_confirm_name *cp = data;
4940 struct inquiry_entry *e;
4941 int err;
4942
4943 bt_dev_dbg(hdev, "sock %p", sk);
4944
4945 hci_dev_lock(hdev);
4946
4947 if (!hci_discovery_active(hdev)) {
4948 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4949 MGMT_STATUS_FAILED, &cp->addr,
4950 sizeof(cp->addr));
4951 goto failed;
4952 }
4953
4954 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4955 if (!e) {
4956 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4957 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4958 sizeof(cp->addr));
4959 goto failed;
4960 }
4961
4962 if (cp->name_known) {
4963 e->name_state = NAME_KNOWN;
4964 list_del(&e->list);
4965 } else {
4966 e->name_state = NAME_NEEDED;
4967 hci_inquiry_cache_update_resolve(hdev, e);
4968 }
4969
4970 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4971 &cp->addr, sizeof(cp->addr));
4972
4973 failed:
4974 hci_dev_unlock(hdev);
4975 return err;
4976 }
4977
4978 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4979 u16 len)
4980 {
4981 struct mgmt_cp_block_device *cp = data;
4982 u8 status;
4983 int err;
4984
4985 bt_dev_dbg(hdev, "sock %p", sk);
4986
4987 if (!bdaddr_type_is_valid(cp->addr.type))
4988 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4989 MGMT_STATUS_INVALID_PARAMS,
4990 &cp->addr, sizeof(cp->addr));
4991
4992 hci_dev_lock(hdev);
4993
4994 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4995 cp->addr.type);
4996 if (err < 0) {
4997 status = MGMT_STATUS_FAILED;
4998 goto done;
4999 }
5000
5001 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5002 sk);
5003 status = MGMT_STATUS_SUCCESS;
5004
5005 done:
5006 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
5007 &cp->addr, sizeof(cp->addr));
5008
5009 hci_dev_unlock(hdev);
5010
5011 return err;
5012 }
5013
5014 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
5015 u16 len)
5016 {
5017 struct mgmt_cp_unblock_device *cp = data;
5018 u8 status;
5019 int err;
5020
5021 bt_dev_dbg(hdev, "sock %p", sk);
5022
5023 if (!bdaddr_type_is_valid(cp->addr.type))
5024 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
5025 MGMT_STATUS_INVALID_PARAMS,
5026 &cp->addr, sizeof(cp->addr));
5027
5028 hci_dev_lock(hdev);
5029
5030 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
5031 cp->addr.type);
5032 if (err < 0) {
5033 status = MGMT_STATUS_INVALID_PARAMS;
5034 goto done;
5035 }
5036
5037 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
5038 sk);
5039 status = MGMT_STATUS_SUCCESS;
5040
5041 done:
5042 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
5043 &cp->addr, sizeof(cp->addr));
5044
5045 hci_dev_unlock(hdev);
5046
5047 return err;
5048 }
5049
5050 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
5051 u16 len)
5052 {
5053 struct mgmt_cp_set_device_id *cp = data;
5054 struct hci_request req;
5055 int err;
5056 __u16 source;
5057
5058 bt_dev_dbg(hdev, "sock %p", sk);
5059
5060 source = __le16_to_cpu(cp->source);
5061
5062 if (source > 0x0002)
5063 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
5064 MGMT_STATUS_INVALID_PARAMS);
5065
5066 hci_dev_lock(hdev);
5067
5068 hdev->devid_source = source;
5069 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
5070 hdev->devid_product = __le16_to_cpu(cp->product);
5071 hdev->devid_version = __le16_to_cpu(cp->version);
5072
5073 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
5074 NULL, 0);
5075
5076 hci_req_init(&req, hdev);
5077 __hci_req_update_eir(&req);
5078 hci_req_run(&req, NULL);
5079
5080 hci_dev_unlock(hdev);
5081
5082 return err;
5083 }
5084
5085 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
5086 u16 opcode)
5087 {
5088 bt_dev_dbg(hdev, "status %d", status);
5089 }
5090
5091 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
5092 u16 opcode)
5093 {
5094 struct cmd_lookup match = { NULL, hdev };
5095 struct hci_request req;
5096 u8 instance;
5097 struct adv_info *adv_instance;
5098 int err;
5099
5100 hci_dev_lock(hdev);
5101
5102 if (status) {
5103 u8 mgmt_err = mgmt_status(status);
5104
5105 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
5106 cmd_status_rsp, &mgmt_err);
5107 goto unlock;
5108 }
5109
5110 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
5111 hci_dev_set_flag(hdev, HCI_ADVERTISING);
5112 else
5113 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
5114
5115 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
5116 &match);
5117
5118 new_settings(hdev, match.sk);
5119
5120 if (match.sk)
5121 sock_put(match.sk);
5122
5123 /* Handle suspend notifier */
5124 if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
5125 hdev->suspend_tasks)) {
5126 bt_dev_dbg(hdev, "Paused advertising");
5127 wake_up(&hdev->suspend_wait_q);
5128 } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
5129 hdev->suspend_tasks)) {
5130 bt_dev_dbg(hdev, "Unpaused advertising");
5131 wake_up(&hdev->suspend_wait_q);
5132 }
5133
5134 /* If "Set Advertising" was just disabled and instance advertising was
5135 * set up earlier, then re-enable multi-instance advertising.
5136 */
5137 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5138 list_empty(&hdev->adv_instances))
5139 goto unlock;
5140
5141 instance = hdev->cur_adv_instance;
5142 if (!instance) {
5143 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
5144 struct adv_info, list);
5145 if (!adv_instance)
5146 goto unlock;
5147
5148 instance = adv_instance->instance;
5149 }
5150
5151 hci_req_init(&req, hdev);
5152
5153 err = __hci_req_schedule_adv_instance(&req, instance, true);
5154
5155 if (!err)
5156 err = hci_req_run(&req, enable_advertising_instance);
5157
5158 if (err)
5159 bt_dev_err(hdev, "failed to re-configure advertising");
5160
5161 unlock:
5162 hci_dev_unlock(hdev);
5163 }
5164
5165 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
5166 u16 len)
5167 {
5168 struct mgmt_mode *cp = data;
5169 struct mgmt_pending_cmd *cmd;
5170 struct hci_request req;
5171 u8 val, status;
5172 int err;
5173
5174 bt_dev_dbg(hdev, "sock %p", sk);
5175
5176 status = mgmt_le_support(hdev);
5177 if (status)
5178 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5179 status);
5180
5181 /* Enabling the experimental LL Privay support disables support for
5182 * advertising.
5183 */
5184 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
5185 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5186 MGMT_STATUS_NOT_SUPPORTED);
5187
5188 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5189 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5190 MGMT_STATUS_INVALID_PARAMS);
5191
5192 if (hdev->advertising_paused)
5193 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5194 MGMT_STATUS_BUSY);
5195
5196 hci_dev_lock(hdev);
5197
5198 val = !!cp->val;
5199
5200 /* The following conditions are ones which mean that we should
5201 * not do any HCI communication but directly send a mgmt
5202 * response to user space (after toggling the flag if
5203 * necessary).
5204 */
5205 if (!hdev_is_powered(hdev) ||
5206 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5207 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
5208 hci_conn_num(hdev, LE_LINK) > 0 ||
5209 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5210 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
5211 bool changed;
5212
5213 if (cp->val) {
5214 hdev->cur_adv_instance = 0x00;
5215 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
5216 if (cp->val == 0x02)
5217 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5218 else
5219 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5220 } else {
5221 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
5222 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5223 }
5224
5225 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
5226 if (err < 0)
5227 goto unlock;
5228
5229 if (changed)
5230 err = new_settings(hdev, sk);
5231
5232 goto unlock;
5233 }
5234
5235 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
5236 pending_find(MGMT_OP_SET_LE, hdev)) {
5237 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
5238 MGMT_STATUS_BUSY);
5239 goto unlock;
5240 }
5241
5242 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
5243 if (!cmd) {
5244 err = -ENOMEM;
5245 goto unlock;
5246 }
5247
5248 hci_req_init(&req, hdev);
5249
5250 if (cp->val == 0x02)
5251 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5252 else
5253 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
5254
5255 cancel_adv_timeout(hdev);
5256
5257 if (val) {
5258 /* Switch to instance "0" for the Set Advertising setting.
5259 * We cannot use update_[adv|scan_rsp]_data() here as the
5260 * HCI_ADVERTISING flag is not yet set.
5261 */
5262 hdev->cur_adv_instance = 0x00;
5263
5264 if (ext_adv_capable(hdev)) {
5265 __hci_req_start_ext_adv(&req, 0x00);
5266 } else {
5267 __hci_req_update_adv_data(&req, 0x00);
5268 __hci_req_update_scan_rsp_data(&req, 0x00);
5269 __hci_req_enable_advertising(&req);
5270 }
5271 } else {
5272 __hci_req_disable_advertising(&req);
5273 }
5274
5275 err = hci_req_run(&req, set_advertising_complete);
5276 if (err < 0)
5277 mgmt_pending_remove(cmd);
5278
5279 unlock:
5280 hci_dev_unlock(hdev);
5281 return err;
5282 }
5283
5284 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
5285 void *data, u16 len)
5286 {
5287 struct mgmt_cp_set_static_address *cp = data;
5288 int err;
5289
5290 bt_dev_dbg(hdev, "sock %p", sk);
5291
5292 if (!lmp_le_capable(hdev))
5293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5294 MGMT_STATUS_NOT_SUPPORTED);
5295
5296 if (hdev_is_powered(hdev))
5297 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
5298 MGMT_STATUS_REJECTED);
5299
5300 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
5301 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
5302 return mgmt_cmd_status(sk, hdev->id,
5303 MGMT_OP_SET_STATIC_ADDRESS,
5304 MGMT_STATUS_INVALID_PARAMS);
5305
5306 /* Two most significant bits shall be set */
5307 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
5308 return mgmt_cmd_status(sk, hdev->id,
5309 MGMT_OP_SET_STATIC_ADDRESS,
5310 MGMT_STATUS_INVALID_PARAMS);
5311 }
5312
5313 hci_dev_lock(hdev);
5314
5315 bacpy(&hdev->static_addr, &cp->bdaddr);
5316
5317 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5318 if (err < 0)
5319 goto unlock;
5320
5321 err = new_settings(hdev, sk);
5322
5323 unlock:
5324 hci_dev_unlock(hdev);
5325 return err;
5326 }
5327
5328 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5329 void *data, u16 len)
5330 {
5331 struct mgmt_cp_set_scan_params *cp = data;
5332 __u16 interval, window;
5333 int err;
5334
5335 bt_dev_dbg(hdev, "sock %p", sk);
5336
5337 if (!lmp_le_capable(hdev))
5338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5339 MGMT_STATUS_NOT_SUPPORTED);
5340
5341 interval = __le16_to_cpu(cp->interval);
5342
5343 if (interval < 0x0004 || interval > 0x4000)
5344 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5345 MGMT_STATUS_INVALID_PARAMS);
5346
5347 window = __le16_to_cpu(cp->window);
5348
5349 if (window < 0x0004 || window > 0x4000)
5350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5351 MGMT_STATUS_INVALID_PARAMS);
5352
5353 if (window > interval)
5354 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5355 MGMT_STATUS_INVALID_PARAMS);
5356
5357 hci_dev_lock(hdev);
5358
5359 hdev->le_scan_interval = interval;
5360 hdev->le_scan_window = window;
5361
5362 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5363 NULL, 0);
5364
5365 /* If background scan is running, restart it so new parameters are
5366 * loaded.
5367 */
5368 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
5369 hdev->discovery.state == DISCOVERY_STOPPED) {
5370 struct hci_request req;
5371
5372 hci_req_init(&req, hdev);
5373
5374 hci_req_add_le_scan_disable(&req, false);
5375 hci_req_add_le_passive_scan(&req);
5376
5377 hci_req_run(&req, NULL);
5378 }
5379
5380 hci_dev_unlock(hdev);
5381
5382 return err;
5383 }
5384
5385 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5386 u16 opcode)
5387 {
5388 struct mgmt_pending_cmd *cmd;
5389
5390 bt_dev_dbg(hdev, "status 0x%02x", status);
5391
5392 hci_dev_lock(hdev);
5393
5394 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5395 if (!cmd)
5396 goto unlock;
5397
5398 if (status) {
5399 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5400 mgmt_status(status));
5401 } else {
5402 struct mgmt_mode *cp = cmd->param;
5403
5404 if (cp->val)
5405 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
5406 else
5407 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5408
5409 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5410 new_settings(hdev, cmd->sk);
5411 }
5412
5413 mgmt_pending_remove(cmd);
5414
5415 unlock:
5416 hci_dev_unlock(hdev);
5417 }
5418
5419 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
5420 void *data, u16 len)
5421 {
5422 struct mgmt_mode *cp = data;
5423 struct mgmt_pending_cmd *cmd;
5424 struct hci_request req;
5425 int err;
5426
5427 bt_dev_dbg(hdev, "sock %p", sk);
5428
5429 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
5430 hdev->hci_ver < BLUETOOTH_VER_1_2)
5431 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5432 MGMT_STATUS_NOT_SUPPORTED);
5433
5434 if (cp->val != 0x00 && cp->val != 0x01)
5435 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5436 MGMT_STATUS_INVALID_PARAMS);
5437
5438 hci_dev_lock(hdev);
5439
5440 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
5441 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5442 MGMT_STATUS_BUSY);
5443 goto unlock;
5444 }
5445
5446 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
5447 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5448 hdev);
5449 goto unlock;
5450 }
5451
5452 if (!hdev_is_powered(hdev)) {
5453 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
5454 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5455 hdev);
5456 new_settings(hdev, sk);
5457 goto unlock;
5458 }
5459
5460 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5461 data, len);
5462 if (!cmd) {
5463 err = -ENOMEM;
5464 goto unlock;
5465 }
5466
5467 hci_req_init(&req, hdev);
5468
5469 __hci_req_write_fast_connectable(&req, cp->val);
5470
5471 err = hci_req_run(&req, fast_connectable_complete);
5472 if (err < 0) {
5473 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5474 MGMT_STATUS_FAILED);
5475 mgmt_pending_remove(cmd);
5476 }
5477
5478 unlock:
5479 hci_dev_unlock(hdev);
5480
5481 return err;
5482 }
5483
5484 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5485 {
5486 struct mgmt_pending_cmd *cmd;
5487
5488 bt_dev_dbg(hdev, "status 0x%02x", status);
5489
5490 hci_dev_lock(hdev);
5491
5492 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
5493 if (!cmd)
5494 goto unlock;
5495
5496 if (status) {
5497 u8 mgmt_err = mgmt_status(status);
5498
5499 /* We need to restore the flag if related HCI commands
5500 * failed.
5501 */
5502 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
5503
5504 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
5505 } else {
5506 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5507 new_settings(hdev, cmd->sk);
5508 }
5509
5510 mgmt_pending_remove(cmd);
5511
5512 unlock:
5513 hci_dev_unlock(hdev);
5514 }
5515
5516 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5517 {
5518 struct mgmt_mode *cp = data;
5519 struct mgmt_pending_cmd *cmd;
5520 struct hci_request req;
5521 int err;
5522
5523 bt_dev_dbg(hdev, "sock %p", sk);
5524
5525 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
5526 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5527 MGMT_STATUS_NOT_SUPPORTED);
5528
5529 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5531 MGMT_STATUS_REJECTED);
5532
5533 if (cp->val != 0x00 && cp->val != 0x01)
5534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5535 MGMT_STATUS_INVALID_PARAMS);
5536
5537 hci_dev_lock(hdev);
5538
5539 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5540 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5541 goto unlock;
5542 }
5543
5544 if (!hdev_is_powered(hdev)) {
5545 if (!cp->val) {
5546 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5547 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5548 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5549 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5550 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
5551 }
5552
5553 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
5554
5555 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5556 if (err < 0)
5557 goto unlock;
5558
5559 err = new_settings(hdev, sk);
5560 goto unlock;
5561 }
5562
5563 /* Reject disabling when powered on */
5564 if (!cp->val) {
5565 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5566 MGMT_STATUS_REJECTED);
5567 goto unlock;
5568 } else {
5569 /* When configuring a dual-mode controller to operate
5570 * with LE only and using a static address, then switching
5571 * BR/EDR back on is not allowed.
5572 *
5573 * Dual-mode controllers shall operate with the public
5574 * address as its identity address for BR/EDR and LE. So
5575 * reject the attempt to create an invalid configuration.
5576 *
5577 * The same restrictions applies when secure connections
5578 * has been enabled. For BR/EDR this is a controller feature
5579 * while for LE it is a host stack feature. This means that
5580 * switching BR/EDR back on when secure connections has been
5581 * enabled is not a supported transaction.
5582 */
5583 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5584 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
5585 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
5586 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5587 MGMT_STATUS_REJECTED);
5588 goto unlock;
5589 }
5590 }
5591
5592 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
5593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5594 MGMT_STATUS_BUSY);
5595 goto unlock;
5596 }
5597
5598 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5599 if (!cmd) {
5600 err = -ENOMEM;
5601 goto unlock;
5602 }
5603
5604 /* We need to flip the bit already here so that
5605 * hci_req_update_adv_data generates the correct flags.
5606 */
5607 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
5608
5609 hci_req_init(&req, hdev);
5610
5611 __hci_req_write_fast_connectable(&req, false);
5612 __hci_req_update_scan(&req);
5613
5614 /* Since only the advertising data flags will change, there
5615 * is no need to update the scan response data.
5616 */
5617 __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
5618
5619 err = hci_req_run(&req, set_bredr_complete);
5620 if (err < 0)
5621 mgmt_pending_remove(cmd);
5622
5623 unlock:
5624 hci_dev_unlock(hdev);
5625 return err;
5626 }
5627
5628 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5629 {
5630 struct mgmt_pending_cmd *cmd;
5631 struct mgmt_mode *cp;
5632
5633 bt_dev_dbg(hdev, "status %u", status);
5634
5635 hci_dev_lock(hdev);
5636
5637 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
5638 if (!cmd)
5639 goto unlock;
5640
5641 if (status) {
5642 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5643 mgmt_status(status));
5644 goto remove;
5645 }
5646
5647 cp = cmd->param;
5648
5649 switch (cp->val) {
5650 case 0x00:
5651 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5652 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5653 break;
5654 case 0x01:
5655 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5656 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5657 break;
5658 case 0x02:
5659 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5660 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5661 break;
5662 }
5663
5664 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5665 new_settings(hdev, cmd->sk);
5666
5667 remove:
5668 mgmt_pending_remove(cmd);
5669 unlock:
5670 hci_dev_unlock(hdev);
5671 }
5672
5673 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5674 void *data, u16 len)
5675 {
5676 struct mgmt_mode *cp = data;
5677 struct mgmt_pending_cmd *cmd;
5678 struct hci_request req;
5679 u8 val;
5680 int err;
5681
5682 bt_dev_dbg(hdev, "sock %p", sk);
5683
5684 if (!lmp_sc_capable(hdev) &&
5685 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
5686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5687 MGMT_STATUS_NOT_SUPPORTED);
5688
5689 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5690 lmp_sc_capable(hdev) &&
5691 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
5692 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5693 MGMT_STATUS_REJECTED);
5694
5695 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5696 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5697 MGMT_STATUS_INVALID_PARAMS);
5698
5699 hci_dev_lock(hdev);
5700
5701 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
5702 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5703 bool changed;
5704
5705 if (cp->val) {
5706 changed = !hci_dev_test_and_set_flag(hdev,
5707 HCI_SC_ENABLED);
5708 if (cp->val == 0x02)
5709 hci_dev_set_flag(hdev, HCI_SC_ONLY);
5710 else
5711 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5712 } else {
5713 changed = hci_dev_test_and_clear_flag(hdev,
5714 HCI_SC_ENABLED);
5715 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5716 }
5717
5718 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5719 if (err < 0)
5720 goto failed;
5721
5722 if (changed)
5723 err = new_settings(hdev, sk);
5724
5725 goto failed;
5726 }
5727
5728 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5729 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5730 MGMT_STATUS_BUSY);
5731 goto failed;
5732 }
5733
5734 val = !!cp->val;
5735
5736 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5737 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5738 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5739 goto failed;
5740 }
5741
5742 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5743 if (!cmd) {
5744 err = -ENOMEM;
5745 goto failed;
5746 }
5747
5748 hci_req_init(&req, hdev);
5749 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5750 err = hci_req_run(&req, sc_enable_complete);
5751 if (err < 0) {
5752 mgmt_pending_remove(cmd);
5753 goto failed;
5754 }
5755
5756 failed:
5757 hci_dev_unlock(hdev);
5758 return err;
5759 }
5760
5761 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5762 void *data, u16 len)
5763 {
5764 struct mgmt_mode *cp = data;
5765 bool changed, use_changed;
5766 int err;
5767
5768 bt_dev_dbg(hdev, "sock %p", sk);
5769
5770 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5771 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5772 MGMT_STATUS_INVALID_PARAMS);
5773
5774 hci_dev_lock(hdev);
5775
5776 if (cp->val)
5777 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5778 else
5779 changed = hci_dev_test_and_clear_flag(hdev,
5780 HCI_KEEP_DEBUG_KEYS);
5781
5782 if (cp->val == 0x02)
5783 use_changed = !hci_dev_test_and_set_flag(hdev,
5784 HCI_USE_DEBUG_KEYS);
5785 else
5786 use_changed = hci_dev_test_and_clear_flag(hdev,
5787 HCI_USE_DEBUG_KEYS);
5788
5789 if (hdev_is_powered(hdev) && use_changed &&
5790 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5791 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5792 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5793 sizeof(mode), &mode);
5794 }
5795
5796 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5797 if (err < 0)
5798 goto unlock;
5799
5800 if (changed)
5801 err = new_settings(hdev, sk);
5802
5803 unlock:
5804 hci_dev_unlock(hdev);
5805 return err;
5806 }
5807
5808 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5809 u16 len)
5810 {
5811 struct mgmt_cp_set_privacy *cp = cp_data;
5812 bool changed;
5813 int err;
5814
5815 bt_dev_dbg(hdev, "sock %p", sk);
5816
5817 if (!lmp_le_capable(hdev))
5818 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5819 MGMT_STATUS_NOT_SUPPORTED);
5820
5821 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
5822 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5823 MGMT_STATUS_INVALID_PARAMS);
5824
5825 if (hdev_is_powered(hdev))
5826 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5827 MGMT_STATUS_REJECTED);
5828
5829 hci_dev_lock(hdev);
5830
5831 /* If user space supports this command it is also expected to
5832 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5833 */
5834 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5835
5836 if (cp->privacy) {
5837 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5838 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5839 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5840 hci_adv_instances_set_rpa_expired(hdev, true);
5841 if (cp->privacy == 0x02)
5842 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
5843 else
5844 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5845 } else {
5846 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5847 memset(hdev->irk, 0, sizeof(hdev->irk));
5848 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5849 hci_adv_instances_set_rpa_expired(hdev, false);
5850 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5851 }
5852
5853 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5854 if (err < 0)
5855 goto unlock;
5856
5857 if (changed)
5858 err = new_settings(hdev, sk);
5859
5860 unlock:
5861 hci_dev_unlock(hdev);
5862 return err;
5863 }
5864
5865 static bool irk_is_valid(struct mgmt_irk_info *irk)
5866 {
5867 switch (irk->addr.type) {
5868 case BDADDR_LE_PUBLIC:
5869 return true;
5870
5871 case BDADDR_LE_RANDOM:
5872 /* Two most significant bits shall be set */
5873 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5874 return false;
5875 return true;
5876 }
5877
5878 return false;
5879 }
5880
5881 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5882 u16 len)
5883 {
5884 struct mgmt_cp_load_irks *cp = cp_data;
5885 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5886 sizeof(struct mgmt_irk_info));
5887 u16 irk_count, expected_len;
5888 int i, err;
5889
5890 bt_dev_dbg(hdev, "sock %p", sk);
5891
5892 if (!lmp_le_capable(hdev))
5893 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5894 MGMT_STATUS_NOT_SUPPORTED);
5895
5896 irk_count = __le16_to_cpu(cp->irk_count);
5897 if (irk_count > max_irk_count) {
5898 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5899 irk_count);
5900 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5901 MGMT_STATUS_INVALID_PARAMS);
5902 }
5903
5904 expected_len = struct_size(cp, irks, irk_count);
5905 if (expected_len != len) {
5906 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5907 expected_len, len);
5908 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5909 MGMT_STATUS_INVALID_PARAMS);
5910 }
5911
5912 bt_dev_dbg(hdev, "irk_count %u", irk_count);
5913
5914 for (i = 0; i < irk_count; i++) {
5915 struct mgmt_irk_info *key = &cp->irks[i];
5916
5917 if (!irk_is_valid(key))
5918 return mgmt_cmd_status(sk, hdev->id,
5919 MGMT_OP_LOAD_IRKS,
5920 MGMT_STATUS_INVALID_PARAMS);
5921 }
5922
5923 hci_dev_lock(hdev);
5924
5925 hci_smp_irks_clear(hdev);
5926
5927 for (i = 0; i < irk_count; i++) {
5928 struct mgmt_irk_info *irk = &cp->irks[i];
5929
5930 if (hci_is_blocked_key(hdev,
5931 HCI_BLOCKED_KEY_TYPE_IRK,
5932 irk->val)) {
5933 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
5934 &irk->addr.bdaddr);
5935 continue;
5936 }
5937
5938 hci_add_irk(hdev, &irk->addr.bdaddr,
5939 le_addr_type(irk->addr.type), irk->val,
5940 BDADDR_ANY);
5941 }
5942
5943 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5944
5945 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5946
5947 hci_dev_unlock(hdev);
5948
5949 return err;
5950 }
5951
5952 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5953 {
5954 if (key->master != 0x00 && key->master != 0x01)
5955 return false;
5956
5957 switch (key->addr.type) {
5958 case BDADDR_LE_PUBLIC:
5959 return true;
5960
5961 case BDADDR_LE_RANDOM:
5962 /* Two most significant bits shall be set */
5963 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5964 return false;
5965 return true;
5966 }
5967
5968 return false;
5969 }
5970
5971 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5972 void *cp_data, u16 len)
5973 {
5974 struct mgmt_cp_load_long_term_keys *cp = cp_data;
5975 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5976 sizeof(struct mgmt_ltk_info));
5977 u16 key_count, expected_len;
5978 int i, err;
5979
5980 bt_dev_dbg(hdev, "sock %p", sk);
5981
5982 if (!lmp_le_capable(hdev))
5983 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5984 MGMT_STATUS_NOT_SUPPORTED);
5985
5986 key_count = __le16_to_cpu(cp->key_count);
5987 if (key_count > max_key_count) {
5988 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5989 key_count);
5990 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5991 MGMT_STATUS_INVALID_PARAMS);
5992 }
5993
5994 expected_len = struct_size(cp, keys, key_count);
5995 if (expected_len != len) {
5996 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5997 expected_len, len);
5998 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5999 MGMT_STATUS_INVALID_PARAMS);
6000 }
6001
6002 bt_dev_dbg(hdev, "key_count %u", key_count);
6003
6004 for (i = 0; i < key_count; i++) {
6005 struct mgmt_ltk_info *key = &cp->keys[i];
6006
6007 if (!ltk_is_valid(key))
6008 return mgmt_cmd_status(sk, hdev->id,
6009 MGMT_OP_LOAD_LONG_TERM_KEYS,
6010 MGMT_STATUS_INVALID_PARAMS);
6011 }
6012
6013 hci_dev_lock(hdev);
6014
6015 hci_smp_ltks_clear(hdev);
6016
6017 for (i = 0; i < key_count; i++) {
6018 struct mgmt_ltk_info *key = &cp->keys[i];
6019 u8 type, authenticated;
6020
6021 if (hci_is_blocked_key(hdev,
6022 HCI_BLOCKED_KEY_TYPE_LTK,
6023 key->val)) {
6024 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
6025 &key->addr.bdaddr);
6026 continue;
6027 }
6028
6029 switch (key->type) {
6030 case MGMT_LTK_UNAUTHENTICATED:
6031 authenticated = 0x00;
6032 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6033 break;
6034 case MGMT_LTK_AUTHENTICATED:
6035 authenticated = 0x01;
6036 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
6037 break;
6038 case MGMT_LTK_P256_UNAUTH:
6039 authenticated = 0x00;
6040 type = SMP_LTK_P256;
6041 break;
6042 case MGMT_LTK_P256_AUTH:
6043 authenticated = 0x01;
6044 type = SMP_LTK_P256;
6045 break;
6046 case MGMT_LTK_P256_DEBUG:
6047 authenticated = 0x00;
6048 type = SMP_LTK_P256_DEBUG;
6049 fallthrough;
6050 default:
6051 continue;
6052 }
6053
6054 hci_add_ltk(hdev, &key->addr.bdaddr,
6055 le_addr_type(key->addr.type), type, authenticated,
6056 key->val, key->enc_size, key->ediv, key->rand);
6057 }
6058
6059 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
6060 NULL, 0);
6061
6062 hci_dev_unlock(hdev);
6063
6064 return err;
6065 }
6066
6067 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6068 {
6069 struct hci_conn *conn = cmd->user_data;
6070 struct mgmt_rp_get_conn_info rp;
6071 int err;
6072
6073 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6074
6075 if (status == MGMT_STATUS_SUCCESS) {
6076 rp.rssi = conn->rssi;
6077 rp.tx_power = conn->tx_power;
6078 rp.max_tx_power = conn->max_tx_power;
6079 } else {
6080 rp.rssi = HCI_RSSI_INVALID;
6081 rp.tx_power = HCI_TX_POWER_INVALID;
6082 rp.max_tx_power = HCI_TX_POWER_INVALID;
6083 }
6084
6085 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
6086 status, &rp, sizeof(rp));
6087
6088 hci_conn_drop(conn);
6089 hci_conn_put(conn);
6090
6091 return err;
6092 }
6093
6094 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
6095 u16 opcode)
6096 {
6097 struct hci_cp_read_rssi *cp;
6098 struct mgmt_pending_cmd *cmd;
6099 struct hci_conn *conn;
6100 u16 handle;
6101 u8 status;
6102
6103 bt_dev_dbg(hdev, "status 0x%02x", hci_status);
6104
6105 hci_dev_lock(hdev);
6106
6107 /* Commands sent in request are either Read RSSI or Read Transmit Power
6108 * Level so we check which one was last sent to retrieve connection
6109 * handle. Both commands have handle as first parameter so it's safe to
6110 * cast data on the same command struct.
6111 *
6112 * First command sent is always Read RSSI and we fail only if it fails.
6113 * In other case we simply override error to indicate success as we
6114 * already remembered if TX power value is actually valid.
6115 */
6116 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
6117 if (!cp) {
6118 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
6119 status = MGMT_STATUS_SUCCESS;
6120 } else {
6121 status = mgmt_status(hci_status);
6122 }
6123
6124 if (!cp) {
6125 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
6126 goto unlock;
6127 }
6128
6129 handle = __le16_to_cpu(cp->handle);
6130 conn = hci_conn_hash_lookup_handle(hdev, handle);
6131 if (!conn) {
6132 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
6133 handle);
6134 goto unlock;
6135 }
6136
6137 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
6138 if (!cmd)
6139 goto unlock;
6140
6141 cmd->cmd_complete(cmd, status);
6142 mgmt_pending_remove(cmd);
6143
6144 unlock:
6145 hci_dev_unlock(hdev);
6146 }
6147
6148 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
6149 u16 len)
6150 {
6151 struct mgmt_cp_get_conn_info *cp = data;
6152 struct mgmt_rp_get_conn_info rp;
6153 struct hci_conn *conn;
6154 unsigned long conn_info_age;
6155 int err = 0;
6156
6157 bt_dev_dbg(hdev, "sock %p", sk);
6158
6159 memset(&rp, 0, sizeof(rp));
6160 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6161 rp.addr.type = cp->addr.type;
6162
6163 if (!bdaddr_type_is_valid(cp->addr.type))
6164 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6165 MGMT_STATUS_INVALID_PARAMS,
6166 &rp, sizeof(rp));
6167
6168 hci_dev_lock(hdev);
6169
6170 if (!hdev_is_powered(hdev)) {
6171 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6172 MGMT_STATUS_NOT_POWERED, &rp,
6173 sizeof(rp));
6174 goto unlock;
6175 }
6176
6177 if (cp->addr.type == BDADDR_BREDR)
6178 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6179 &cp->addr.bdaddr);
6180 else
6181 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
6182
6183 if (!conn || conn->state != BT_CONNECTED) {
6184 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6185 MGMT_STATUS_NOT_CONNECTED, &rp,
6186 sizeof(rp));
6187 goto unlock;
6188 }
6189
6190 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
6191 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6192 MGMT_STATUS_BUSY, &rp, sizeof(rp));
6193 goto unlock;
6194 }
6195
6196 /* To avoid client trying to guess when to poll again for information we
6197 * calculate conn info age as random value between min/max set in hdev.
6198 */
6199 conn_info_age = hdev->conn_info_min_age +
6200 prandom_u32_max(hdev->conn_info_max_age -
6201 hdev->conn_info_min_age);
6202
6203 /* Query controller to refresh cached values if they are too old or were
6204 * never read.
6205 */
6206 if (time_after(jiffies, conn->conn_info_timestamp +
6207 msecs_to_jiffies(conn_info_age)) ||
6208 !conn->conn_info_timestamp) {
6209 struct hci_request req;
6210 struct hci_cp_read_tx_power req_txp_cp;
6211 struct hci_cp_read_rssi req_rssi_cp;
6212 struct mgmt_pending_cmd *cmd;
6213
6214 hci_req_init(&req, hdev);
6215 req_rssi_cp.handle = cpu_to_le16(conn->handle);
6216 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
6217 &req_rssi_cp);
6218
6219 /* For LE links TX power does not change thus we don't need to
6220 * query for it once value is known.
6221 */
6222 if (!bdaddr_type_is_le(cp->addr.type) ||
6223 conn->tx_power == HCI_TX_POWER_INVALID) {
6224 req_txp_cp.handle = cpu_to_le16(conn->handle);
6225 req_txp_cp.type = 0x00;
6226 hci_req_add(&req, HCI_OP_READ_TX_POWER,
6227 sizeof(req_txp_cp), &req_txp_cp);
6228 }
6229
6230 /* Max TX power needs to be read only once per connection */
6231 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
6232 req_txp_cp.handle = cpu_to_le16(conn->handle);
6233 req_txp_cp.type = 0x01;
6234 hci_req_add(&req, HCI_OP_READ_TX_POWER,
6235 sizeof(req_txp_cp), &req_txp_cp);
6236 }
6237
6238 err = hci_req_run(&req, conn_info_refresh_complete);
6239 if (err < 0)
6240 goto unlock;
6241
6242 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
6243 data, len);
6244 if (!cmd) {
6245 err = -ENOMEM;
6246 goto unlock;
6247 }
6248
6249 hci_conn_hold(conn);
6250 cmd->user_data = hci_conn_get(conn);
6251 cmd->cmd_complete = conn_info_cmd_complete;
6252
6253 conn->conn_info_timestamp = jiffies;
6254 } else {
6255 /* Cache is valid, just reply with values cached in hci_conn */
6256 rp.rssi = conn->rssi;
6257 rp.tx_power = conn->tx_power;
6258 rp.max_tx_power = conn->max_tx_power;
6259
6260 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
6261 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6262 }
6263
6264 unlock:
6265 hci_dev_unlock(hdev);
6266 return err;
6267 }
6268
6269 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
6270 {
6271 struct hci_conn *conn = cmd->user_data;
6272 struct mgmt_rp_get_clock_info rp;
6273 struct hci_dev *hdev;
6274 int err;
6275
6276 memset(&rp, 0, sizeof(rp));
6277 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
6278
6279 if (status)
6280 goto complete;
6281
6282 hdev = hci_dev_get(cmd->index);
6283 if (hdev) {
6284 rp.local_clock = cpu_to_le32(hdev->clock);
6285 hci_dev_put(hdev);
6286 }
6287
6288 if (conn) {
6289 rp.piconet_clock = cpu_to_le32(conn->clock);
6290 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
6291 }
6292
6293 complete:
6294 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
6295 sizeof(rp));
6296
6297 if (conn) {
6298 hci_conn_drop(conn);
6299 hci_conn_put(conn);
6300 }
6301
6302 return err;
6303 }
6304
6305 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
6306 {
6307 struct hci_cp_read_clock *hci_cp;
6308 struct mgmt_pending_cmd *cmd;
6309 struct hci_conn *conn;
6310
6311 bt_dev_dbg(hdev, "status %u", status);
6312
6313 hci_dev_lock(hdev);
6314
6315 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
6316 if (!hci_cp)
6317 goto unlock;
6318
6319 if (hci_cp->which) {
6320 u16 handle = __le16_to_cpu(hci_cp->handle);
6321 conn = hci_conn_hash_lookup_handle(hdev, handle);
6322 } else {
6323 conn = NULL;
6324 }
6325
6326 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
6327 if (!cmd)
6328 goto unlock;
6329
6330 cmd->cmd_complete(cmd, mgmt_status(status));
6331 mgmt_pending_remove(cmd);
6332
6333 unlock:
6334 hci_dev_unlock(hdev);
6335 }
6336
6337 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
6338 u16 len)
6339 {
6340 struct mgmt_cp_get_clock_info *cp = data;
6341 struct mgmt_rp_get_clock_info rp;
6342 struct hci_cp_read_clock hci_cp;
6343 struct mgmt_pending_cmd *cmd;
6344 struct hci_request req;
6345 struct hci_conn *conn;
6346 int err;
6347
6348 bt_dev_dbg(hdev, "sock %p", sk);
6349
6350 memset(&rp, 0, sizeof(rp));
6351 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6352 rp.addr.type = cp->addr.type;
6353
6354 if (cp->addr.type != BDADDR_BREDR)
6355 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6356 MGMT_STATUS_INVALID_PARAMS,
6357 &rp, sizeof(rp));
6358
6359 hci_dev_lock(hdev);
6360
6361 if (!hdev_is_powered(hdev)) {
6362 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6363 MGMT_STATUS_NOT_POWERED, &rp,
6364 sizeof(rp));
6365 goto unlock;
6366 }
6367
6368 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6369 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6370 &cp->addr.bdaddr);
6371 if (!conn || conn->state != BT_CONNECTED) {
6372 err = mgmt_cmd_complete(sk, hdev->id,
6373 MGMT_OP_GET_CLOCK_INFO,
6374 MGMT_STATUS_NOT_CONNECTED,
6375 &rp, sizeof(rp));
6376 goto unlock;
6377 }
6378 } else {
6379 conn = NULL;
6380 }
6381
6382 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6383 if (!cmd) {
6384 err = -ENOMEM;
6385 goto unlock;
6386 }
6387
6388 cmd->cmd_complete = clock_info_cmd_complete;
6389
6390 hci_req_init(&req, hdev);
6391
6392 memset(&hci_cp, 0, sizeof(hci_cp));
6393 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6394
6395 if (conn) {
6396 hci_conn_hold(conn);
6397 cmd->user_data = hci_conn_get(conn);
6398
6399 hci_cp.handle = cpu_to_le16(conn->handle);
6400 hci_cp.which = 0x01; /* Piconet clock */
6401 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6402 }
6403
6404 err = hci_req_run(&req, get_clock_info_complete);
6405 if (err < 0)
6406 mgmt_pending_remove(cmd);
6407
6408 unlock:
6409 hci_dev_unlock(hdev);
6410 return err;
6411 }
6412
6413 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6414 {
6415 struct hci_conn *conn;
6416
6417 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6418 if (!conn)
6419 return false;
6420
6421 if (conn->dst_type != type)
6422 return false;
6423
6424 if (conn->state != BT_CONNECTED)
6425 return false;
6426
6427 return true;
6428 }
6429
6430 /* This function requires the caller holds hdev->lock */
6431 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
6432 u8 addr_type, u8 auto_connect)
6433 {
6434 struct hci_conn_params *params;
6435
6436 params = hci_conn_params_add(hdev, addr, addr_type);
6437 if (!params)
6438 return -EIO;
6439
6440 if (params->auto_connect == auto_connect)
6441 return 0;
6442
6443 list_del_init(&params->action);
6444
6445 switch (auto_connect) {
6446 case HCI_AUTO_CONN_DISABLED:
6447 case HCI_AUTO_CONN_LINK_LOSS:
6448 /* If auto connect is being disabled when we're trying to
6449 * connect to device, keep connecting.
6450 */
6451 if (params->explicit_connect)
6452 list_add(&params->action, &hdev->pend_le_conns);
6453 break;
6454 case HCI_AUTO_CONN_REPORT:
6455 if (params->explicit_connect)
6456 list_add(&params->action, &hdev->pend_le_conns);
6457 else
6458 list_add(&params->action, &hdev->pend_le_reports);
6459 break;
6460 case HCI_AUTO_CONN_DIRECT:
6461 case HCI_AUTO_CONN_ALWAYS:
6462 if (!is_connected(hdev, addr, addr_type))
6463 list_add(&params->action, &hdev->pend_le_conns);
6464 break;
6465 }
6466
6467 params->auto_connect = auto_connect;
6468
6469 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u",
6470 addr, addr_type, auto_connect);
6471
6472 return 0;
6473 }
6474
6475 static void device_added(struct sock *sk, struct hci_dev *hdev,
6476 bdaddr_t *bdaddr, u8 type, u8 action)
6477 {
6478 struct mgmt_ev_device_added ev;
6479
6480 bacpy(&ev.addr.bdaddr, bdaddr);
6481 ev.addr.type = type;
6482 ev.action = action;
6483
6484 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6485 }
6486
6487 static int add_device(struct sock *sk, struct hci_dev *hdev,
6488 void *data, u16 len)
6489 {
6490 struct mgmt_cp_add_device *cp = data;
6491 u8 auto_conn, addr_type;
6492 struct hci_conn_params *params;
6493 int err;
6494 u32 current_flags = 0;
6495
6496 bt_dev_dbg(hdev, "sock %p", sk);
6497
6498 if (!bdaddr_type_is_valid(cp->addr.type) ||
6499 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
6500 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6501 MGMT_STATUS_INVALID_PARAMS,
6502 &cp->addr, sizeof(cp->addr));
6503
6504 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
6505 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6506 MGMT_STATUS_INVALID_PARAMS,
6507 &cp->addr, sizeof(cp->addr));
6508
6509 hci_dev_lock(hdev);
6510
6511 if (cp->addr.type == BDADDR_BREDR) {
6512 /* Only incoming connections action is supported for now */
6513 if (cp->action != 0x01) {
6514 err = mgmt_cmd_complete(sk, hdev->id,
6515 MGMT_OP_ADD_DEVICE,
6516 MGMT_STATUS_INVALID_PARAMS,
6517 &cp->addr, sizeof(cp->addr));
6518 goto unlock;
6519 }
6520
6521 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist,
6522 &cp->addr.bdaddr,
6523 cp->addr.type, 0);
6524 if (err)
6525 goto unlock;
6526
6527 hci_req_update_scan(hdev);
6528
6529 goto added;
6530 }
6531
6532 addr_type = le_addr_type(cp->addr.type);
6533
6534 if (cp->action == 0x02)
6535 auto_conn = HCI_AUTO_CONN_ALWAYS;
6536 else if (cp->action == 0x01)
6537 auto_conn = HCI_AUTO_CONN_DIRECT;
6538 else
6539 auto_conn = HCI_AUTO_CONN_REPORT;
6540
6541 /* Kernel internally uses conn_params with resolvable private
6542 * address, but Add Device allows only identity addresses.
6543 * Make sure it is enforced before calling
6544 * hci_conn_params_lookup.
6545 */
6546 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6547 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6548 MGMT_STATUS_INVALID_PARAMS,
6549 &cp->addr, sizeof(cp->addr));
6550 goto unlock;
6551 }
6552
6553 /* If the connection parameters don't exist for this device,
6554 * they will be created and configured with defaults.
6555 */
6556 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
6557 auto_conn) < 0) {
6558 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6559 MGMT_STATUS_FAILED, &cp->addr,
6560 sizeof(cp->addr));
6561 goto unlock;
6562 } else {
6563 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6564 addr_type);
6565 if (params)
6566 current_flags = params->current_flags;
6567 }
6568
6569 hci_update_background_scan(hdev);
6570
6571 added:
6572 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6573 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type,
6574 SUPPORTED_DEVICE_FLAGS(), current_flags);
6575
6576 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6577 MGMT_STATUS_SUCCESS, &cp->addr,
6578 sizeof(cp->addr));
6579
6580 unlock:
6581 hci_dev_unlock(hdev);
6582 return err;
6583 }
6584
6585 static void device_removed(struct sock *sk, struct hci_dev *hdev,
6586 bdaddr_t *bdaddr, u8 type)
6587 {
6588 struct mgmt_ev_device_removed ev;
6589
6590 bacpy(&ev.addr.bdaddr, bdaddr);
6591 ev.addr.type = type;
6592
6593 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6594 }
6595
6596 static int remove_device(struct sock *sk, struct hci_dev *hdev,
6597 void *data, u16 len)
6598 {
6599 struct mgmt_cp_remove_device *cp = data;
6600 int err;
6601
6602 bt_dev_dbg(hdev, "sock %p", sk);
6603
6604 hci_dev_lock(hdev);
6605
6606 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6607 struct hci_conn_params *params;
6608 u8 addr_type;
6609
6610 if (!bdaddr_type_is_valid(cp->addr.type)) {
6611 err = mgmt_cmd_complete(sk, hdev->id,
6612 MGMT_OP_REMOVE_DEVICE,
6613 MGMT_STATUS_INVALID_PARAMS,
6614 &cp->addr, sizeof(cp->addr));
6615 goto unlock;
6616 }
6617
6618 if (cp->addr.type == BDADDR_BREDR) {
6619 err = hci_bdaddr_list_del(&hdev->whitelist,
6620 &cp->addr.bdaddr,
6621 cp->addr.type);
6622 if (err) {
6623 err = mgmt_cmd_complete(sk, hdev->id,
6624 MGMT_OP_REMOVE_DEVICE,
6625 MGMT_STATUS_INVALID_PARAMS,
6626 &cp->addr,
6627 sizeof(cp->addr));
6628 goto unlock;
6629 }
6630
6631 hci_req_update_scan(hdev);
6632
6633 device_removed(sk, hdev, &cp->addr.bdaddr,
6634 cp->addr.type);
6635 goto complete;
6636 }
6637
6638 addr_type = le_addr_type(cp->addr.type);
6639
6640 /* Kernel internally uses conn_params with resolvable private
6641 * address, but Remove Device allows only identity addresses.
6642 * Make sure it is enforced before calling
6643 * hci_conn_params_lookup.
6644 */
6645 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6646 err = mgmt_cmd_complete(sk, hdev->id,
6647 MGMT_OP_REMOVE_DEVICE,
6648 MGMT_STATUS_INVALID_PARAMS,
6649 &cp->addr, sizeof(cp->addr));
6650 goto unlock;
6651 }
6652
6653 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6654 addr_type);
6655 if (!params) {
6656 err = mgmt_cmd_complete(sk, hdev->id,
6657 MGMT_OP_REMOVE_DEVICE,
6658 MGMT_STATUS_INVALID_PARAMS,
6659 &cp->addr, sizeof(cp->addr));
6660 goto unlock;
6661 }
6662
6663 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6664 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
6665 err = mgmt_cmd_complete(sk, hdev->id,
6666 MGMT_OP_REMOVE_DEVICE,
6667 MGMT_STATUS_INVALID_PARAMS,
6668 &cp->addr, sizeof(cp->addr));
6669 goto unlock;
6670 }
6671
6672 list_del(&params->action);
6673 list_del(&params->list);
6674 kfree(params);
6675 hci_update_background_scan(hdev);
6676
6677 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
6678 } else {
6679 struct hci_conn_params *p, *tmp;
6680 struct bdaddr_list *b, *btmp;
6681
6682 if (cp->addr.type) {
6683 err = mgmt_cmd_complete(sk, hdev->id,
6684 MGMT_OP_REMOVE_DEVICE,
6685 MGMT_STATUS_INVALID_PARAMS,
6686 &cp->addr, sizeof(cp->addr));
6687 goto unlock;
6688 }
6689
6690 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6691 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6692 list_del(&b->list);
6693 kfree(b);
6694 }
6695
6696 hci_req_update_scan(hdev);
6697
6698 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6699 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6700 continue;
6701 device_removed(sk, hdev, &p->addr, p->addr_type);
6702 if (p->explicit_connect) {
6703 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6704 continue;
6705 }
6706 list_del(&p->action);
6707 list_del(&p->list);
6708 kfree(p);
6709 }
6710
6711 bt_dev_dbg(hdev, "All LE connection parameters were removed");
6712
6713 hci_update_background_scan(hdev);
6714 }
6715
6716 complete:
6717 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
6718 MGMT_STATUS_SUCCESS, &cp->addr,
6719 sizeof(cp->addr));
6720 unlock:
6721 hci_dev_unlock(hdev);
6722 return err;
6723 }
6724
6725 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6726 u16 len)
6727 {
6728 struct mgmt_cp_load_conn_param *cp = data;
6729 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6730 sizeof(struct mgmt_conn_param));
6731 u16 param_count, expected_len;
6732 int i;
6733
6734 if (!lmp_le_capable(hdev))
6735 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6736 MGMT_STATUS_NOT_SUPPORTED);
6737
6738 param_count = __le16_to_cpu(cp->param_count);
6739 if (param_count > max_param_count) {
6740 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6741 param_count);
6742 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6743 MGMT_STATUS_INVALID_PARAMS);
6744 }
6745
6746 expected_len = struct_size(cp, params, param_count);
6747 if (expected_len != len) {
6748 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
6749 expected_len, len);
6750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6751 MGMT_STATUS_INVALID_PARAMS);
6752 }
6753
6754 bt_dev_dbg(hdev, "param_count %u", param_count);
6755
6756 hci_dev_lock(hdev);
6757
6758 hci_conn_params_clear_disabled(hdev);
6759
6760 for (i = 0; i < param_count; i++) {
6761 struct mgmt_conn_param *param = &cp->params[i];
6762 struct hci_conn_params *hci_param;
6763 u16 min, max, latency, timeout;
6764 u8 addr_type;
6765
6766 bt_dev_dbg(hdev, "Adding %pMR (type %u)", &param->addr.bdaddr,
6767 param->addr.type);
6768
6769 if (param->addr.type == BDADDR_LE_PUBLIC) {
6770 addr_type = ADDR_LE_DEV_PUBLIC;
6771 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6772 addr_type = ADDR_LE_DEV_RANDOM;
6773 } else {
6774 bt_dev_err(hdev, "ignoring invalid connection parameters");
6775 continue;
6776 }
6777
6778 min = le16_to_cpu(param->min_interval);
6779 max = le16_to_cpu(param->max_interval);
6780 latency = le16_to_cpu(param->latency);
6781 timeout = le16_to_cpu(param->timeout);
6782
6783 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6784 min, max, latency, timeout);
6785
6786 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6787 bt_dev_err(hdev, "ignoring invalid connection parameters");
6788 continue;
6789 }
6790
6791 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6792 addr_type);
6793 if (!hci_param) {
6794 bt_dev_err(hdev, "failed to add connection parameters");
6795 continue;
6796 }
6797
6798 hci_param->conn_min_interval = min;
6799 hci_param->conn_max_interval = max;
6800 hci_param->conn_latency = latency;
6801 hci_param->supervision_timeout = timeout;
6802 }
6803
6804 hci_dev_unlock(hdev);
6805
6806 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6807 NULL, 0);
6808 }
6809
6810 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6811 void *data, u16 len)
6812 {
6813 struct mgmt_cp_set_external_config *cp = data;
6814 bool changed;
6815 int err;
6816
6817 bt_dev_dbg(hdev, "sock %p", sk);
6818
6819 if (hdev_is_powered(hdev))
6820 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6821 MGMT_STATUS_REJECTED);
6822
6823 if (cp->config != 0x00 && cp->config != 0x01)
6824 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6825 MGMT_STATUS_INVALID_PARAMS);
6826
6827 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6828 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6829 MGMT_STATUS_NOT_SUPPORTED);
6830
6831 hci_dev_lock(hdev);
6832
6833 if (cp->config)
6834 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6835 else
6836 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6837
6838 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6839 if (err < 0)
6840 goto unlock;
6841
6842 if (!changed)
6843 goto unlock;
6844
6845 err = new_options(hdev, sk);
6846
6847 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6848 mgmt_index_removed(hdev);
6849
6850 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6851 hci_dev_set_flag(hdev, HCI_CONFIG);
6852 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6853
6854 queue_work(hdev->req_workqueue, &hdev->power_on);
6855 } else {
6856 set_bit(HCI_RAW, &hdev->flags);
6857 mgmt_index_added(hdev);
6858 }
6859 }
6860
6861 unlock:
6862 hci_dev_unlock(hdev);
6863 return err;
6864 }
6865
6866 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6867 void *data, u16 len)
6868 {
6869 struct mgmt_cp_set_public_address *cp = data;
6870 bool changed;
6871 int err;
6872
6873 bt_dev_dbg(hdev, "sock %p", sk);
6874
6875 if (hdev_is_powered(hdev))
6876 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6877 MGMT_STATUS_REJECTED);
6878
6879 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6880 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6881 MGMT_STATUS_INVALID_PARAMS);
6882
6883 if (!hdev->set_bdaddr)
6884 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6885 MGMT_STATUS_NOT_SUPPORTED);
6886
6887 hci_dev_lock(hdev);
6888
6889 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6890 bacpy(&hdev->public_addr, &cp->bdaddr);
6891
6892 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6893 if (err < 0)
6894 goto unlock;
6895
6896 if (!changed)
6897 goto unlock;
6898
6899 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6900 err = new_options(hdev, sk);
6901
6902 if (is_configured(hdev)) {
6903 mgmt_index_removed(hdev);
6904
6905 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6906
6907 hci_dev_set_flag(hdev, HCI_CONFIG);
6908 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6909
6910 queue_work(hdev->req_workqueue, &hdev->power_on);
6911 }
6912
6913 unlock:
6914 hci_dev_unlock(hdev);
6915 return err;
6916 }
6917
6918 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6919 u16 opcode, struct sk_buff *skb)
6920 {
6921 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6922 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6923 u8 *h192, *r192, *h256, *r256;
6924 struct mgmt_pending_cmd *cmd;
6925 u16 eir_len;
6926 int err;
6927
6928 bt_dev_dbg(hdev, "status %u", status);
6929
6930 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6931 if (!cmd)
6932 return;
6933
6934 mgmt_cp = cmd->param;
6935
6936 if (status) {
6937 status = mgmt_status(status);
6938 eir_len = 0;
6939
6940 h192 = NULL;
6941 r192 = NULL;
6942 h256 = NULL;
6943 r256 = NULL;
6944 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6945 struct hci_rp_read_local_oob_data *rp;
6946
6947 if (skb->len != sizeof(*rp)) {
6948 status = MGMT_STATUS_FAILED;
6949 eir_len = 0;
6950 } else {
6951 status = MGMT_STATUS_SUCCESS;
6952 rp = (void *)skb->data;
6953
6954 eir_len = 5 + 18 + 18;
6955 h192 = rp->hash;
6956 r192 = rp->rand;
6957 h256 = NULL;
6958 r256 = NULL;
6959 }
6960 } else {
6961 struct hci_rp_read_local_oob_ext_data *rp;
6962
6963 if (skb->len != sizeof(*rp)) {
6964 status = MGMT_STATUS_FAILED;
6965 eir_len = 0;
6966 } else {
6967 status = MGMT_STATUS_SUCCESS;
6968 rp = (void *)skb->data;
6969
6970 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6971 eir_len = 5 + 18 + 18;
6972 h192 = NULL;
6973 r192 = NULL;
6974 } else {
6975 eir_len = 5 + 18 + 18 + 18 + 18;
6976 h192 = rp->hash192;
6977 r192 = rp->rand192;
6978 }
6979
6980 h256 = rp->hash256;
6981 r256 = rp->rand256;
6982 }
6983 }
6984
6985 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6986 if (!mgmt_rp)
6987 goto done;
6988
6989 if (status)
6990 goto send_rsp;
6991
6992 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6993 hdev->dev_class, 3);
6994
6995 if (h192 && r192) {
6996 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6997 EIR_SSP_HASH_C192, h192, 16);
6998 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6999 EIR_SSP_RAND_R192, r192, 16);
7000 }
7001
7002 if (h256 && r256) {
7003 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7004 EIR_SSP_HASH_C256, h256, 16);
7005 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
7006 EIR_SSP_RAND_R256, r256, 16);
7007 }
7008
7009 send_rsp:
7010 mgmt_rp->type = mgmt_cp->type;
7011 mgmt_rp->eir_len = cpu_to_le16(eir_len);
7012
7013 err = mgmt_cmd_complete(cmd->sk, hdev->id,
7014 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
7015 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
7016 if (err < 0 || status)
7017 goto done;
7018
7019 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
7020
7021 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7022 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
7023 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
7024 done:
7025 kfree(mgmt_rp);
7026 mgmt_pending_remove(cmd);
7027 }
7028
7029 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
7030 struct mgmt_cp_read_local_oob_ext_data *cp)
7031 {
7032 struct mgmt_pending_cmd *cmd;
7033 struct hci_request req;
7034 int err;
7035
7036 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
7037 cp, sizeof(*cp));
7038 if (!cmd)
7039 return -ENOMEM;
7040
7041 hci_req_init(&req, hdev);
7042
7043 if (bredr_sc_enabled(hdev))
7044 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
7045 else
7046 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
7047
7048 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
7049 if (err < 0) {
7050 mgmt_pending_remove(cmd);
7051 return err;
7052 }
7053
7054 return 0;
7055 }
7056
7057 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
7058 void *data, u16 data_len)
7059 {
7060 struct mgmt_cp_read_local_oob_ext_data *cp = data;
7061 struct mgmt_rp_read_local_oob_ext_data *rp;
7062 size_t rp_len;
7063 u16 eir_len;
7064 u8 status, flags, role, addr[7], hash[16], rand[16];
7065 int err;
7066
7067 bt_dev_dbg(hdev, "sock %p", sk);
7068
7069 if (hdev_is_powered(hdev)) {
7070 switch (cp->type) {
7071 case BIT(BDADDR_BREDR):
7072 status = mgmt_bredr_support(hdev);
7073 if (status)
7074 eir_len = 0;
7075 else
7076 eir_len = 5;
7077 break;
7078 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7079 status = mgmt_le_support(hdev);
7080 if (status)
7081 eir_len = 0;
7082 else
7083 eir_len = 9 + 3 + 18 + 18 + 3;
7084 break;
7085 default:
7086 status = MGMT_STATUS_INVALID_PARAMS;
7087 eir_len = 0;
7088 break;
7089 }
7090 } else {
7091 status = MGMT_STATUS_NOT_POWERED;
7092 eir_len = 0;
7093 }
7094
7095 rp_len = sizeof(*rp) + eir_len;
7096 rp = kmalloc(rp_len, GFP_ATOMIC);
7097 if (!rp)
7098 return -ENOMEM;
7099
7100 if (status)
7101 goto complete;
7102
7103 hci_dev_lock(hdev);
7104
7105 eir_len = 0;
7106 switch (cp->type) {
7107 case BIT(BDADDR_BREDR):
7108 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7109 err = read_local_ssp_oob_req(hdev, sk, cp);
7110 hci_dev_unlock(hdev);
7111 if (!err)
7112 goto done;
7113
7114 status = MGMT_STATUS_FAILED;
7115 goto complete;
7116 } else {
7117 eir_len = eir_append_data(rp->eir, eir_len,
7118 EIR_CLASS_OF_DEV,
7119 hdev->dev_class, 3);
7120 }
7121 break;
7122 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
7123 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
7124 smp_generate_oob(hdev, hash, rand) < 0) {
7125 hci_dev_unlock(hdev);
7126 status = MGMT_STATUS_FAILED;
7127 goto complete;
7128 }
7129
7130 /* This should return the active RPA, but since the RPA
7131 * is only programmed on demand, it is really hard to fill
7132 * this in at the moment. For now disallow retrieving
7133 * local out-of-band data when privacy is in use.
7134 *
7135 * Returning the identity address will not help here since
7136 * pairing happens before the identity resolving key is
7137 * known and thus the connection establishment happens
7138 * based on the RPA and not the identity address.
7139 */
7140 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
7141 hci_dev_unlock(hdev);
7142 status = MGMT_STATUS_REJECTED;
7143 goto complete;
7144 }
7145
7146 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
7147 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
7148 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
7149 bacmp(&hdev->static_addr, BDADDR_ANY))) {
7150 memcpy(addr, &hdev->static_addr, 6);
7151 addr[6] = 0x01;
7152 } else {
7153 memcpy(addr, &hdev->bdaddr, 6);
7154 addr[6] = 0x00;
7155 }
7156
7157 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
7158 addr, sizeof(addr));
7159
7160 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7161 role = 0x02;
7162 else
7163 role = 0x01;
7164
7165 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
7166 &role, sizeof(role));
7167
7168 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
7169 eir_len = eir_append_data(rp->eir, eir_len,
7170 EIR_LE_SC_CONFIRM,
7171 hash, sizeof(hash));
7172
7173 eir_len = eir_append_data(rp->eir, eir_len,
7174 EIR_LE_SC_RANDOM,
7175 rand, sizeof(rand));
7176 }
7177
7178 flags = mgmt_get_adv_discov_flags(hdev);
7179
7180 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
7181 flags |= LE_AD_NO_BREDR;
7182
7183 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
7184 &flags, sizeof(flags));
7185 break;
7186 }
7187
7188 hci_dev_unlock(hdev);
7189
7190 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
7191
7192 status = MGMT_STATUS_SUCCESS;
7193
7194 complete:
7195 rp->type = cp->type;
7196 rp->eir_len = cpu_to_le16(eir_len);
7197
7198 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
7199 status, rp, sizeof(*rp) + eir_len);
7200 if (err < 0 || status)
7201 goto done;
7202
7203 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
7204 rp, sizeof(*rp) + eir_len,
7205 HCI_MGMT_OOB_DATA_EVENTS, sk);
7206
7207 done:
7208 kfree(rp);
7209
7210 return err;
7211 }
7212
7213 static u32 get_supported_adv_flags(struct hci_dev *hdev)
7214 {
7215 u32 flags = 0;
7216
7217 flags |= MGMT_ADV_FLAG_CONNECTABLE;
7218 flags |= MGMT_ADV_FLAG_DISCOV;
7219 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
7220 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
7221 flags |= MGMT_ADV_FLAG_APPEARANCE;
7222 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
7223 flags |= MGMT_ADV_PARAM_DURATION;
7224 flags |= MGMT_ADV_PARAM_TIMEOUT;
7225 flags |= MGMT_ADV_PARAM_INTERVALS;
7226 flags |= MGMT_ADV_PARAM_TX_POWER;
7227
7228 /* In extended adv TX_POWER returned from Set Adv Param
7229 * will be always valid.
7230 */
7231 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
7232 ext_adv_capable(hdev))
7233 flags |= MGMT_ADV_FLAG_TX_POWER;
7234
7235 if (ext_adv_capable(hdev)) {
7236 flags |= MGMT_ADV_FLAG_SEC_1M;
7237 flags |= MGMT_ADV_FLAG_HW_OFFLOAD;
7238 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER;
7239
7240 if (hdev->le_features[1] & HCI_LE_PHY_2M)
7241 flags |= MGMT_ADV_FLAG_SEC_2M;
7242
7243 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
7244 flags |= MGMT_ADV_FLAG_SEC_CODED;
7245 }
7246
7247 return flags;
7248 }
7249
7250 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
7251 void *data, u16 data_len)
7252 {
7253 struct mgmt_rp_read_adv_features *rp;
7254 size_t rp_len;
7255 int err;
7256 struct adv_info *adv_instance;
7257 u32 supported_flags;
7258 u8 *instance;
7259
7260 bt_dev_dbg(hdev, "sock %p", sk);
7261
7262 if (!lmp_le_capable(hdev))
7263 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7264 MGMT_STATUS_REJECTED);
7265
7266 /* Enabling the experimental LL Privay support disables support for
7267 * advertising.
7268 */
7269 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7270 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7271 MGMT_STATUS_NOT_SUPPORTED);
7272
7273 hci_dev_lock(hdev);
7274
7275 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
7276 rp = kmalloc(rp_len, GFP_ATOMIC);
7277 if (!rp) {
7278 hci_dev_unlock(hdev);
7279 return -ENOMEM;
7280 }
7281
7282 supported_flags = get_supported_adv_flags(hdev);
7283
7284 rp->supported_flags = cpu_to_le32(supported_flags);
7285 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
7286 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
7287 rp->max_instances = hdev->le_num_of_adv_sets;
7288 rp->num_instances = hdev->adv_instance_cnt;
7289
7290 instance = rp->instance;
7291 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
7292 *instance = adv_instance->instance;
7293 instance++;
7294 }
7295
7296 hci_dev_unlock(hdev);
7297
7298 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7299 MGMT_STATUS_SUCCESS, rp, rp_len);
7300
7301 kfree(rp);
7302
7303 return err;
7304 }
7305
7306 static u8 calculate_name_len(struct hci_dev *hdev)
7307 {
7308 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
7309
7310 return append_local_name(hdev, buf, 0);
7311 }
7312
7313 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
7314 bool is_adv_data)
7315 {
7316 u8 max_len = HCI_MAX_AD_LENGTH;
7317
7318 if (is_adv_data) {
7319 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
7320 MGMT_ADV_FLAG_LIMITED_DISCOV |
7321 MGMT_ADV_FLAG_MANAGED_FLAGS))
7322 max_len -= 3;
7323
7324 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
7325 max_len -= 3;
7326 } else {
7327 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
7328 max_len -= calculate_name_len(hdev);
7329
7330 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
7331 max_len -= 4;
7332 }
7333
7334 return max_len;
7335 }
7336
7337 static bool flags_managed(u32 adv_flags)
7338 {
7339 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
7340 MGMT_ADV_FLAG_LIMITED_DISCOV |
7341 MGMT_ADV_FLAG_MANAGED_FLAGS);
7342 }
7343
7344 static bool tx_power_managed(u32 adv_flags)
7345 {
7346 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
7347 }
7348
7349 static bool name_managed(u32 adv_flags)
7350 {
7351 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
7352 }
7353
7354 static bool appearance_managed(u32 adv_flags)
7355 {
7356 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
7357 }
7358
7359 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
7360 u8 len, bool is_adv_data)
7361 {
7362 int i, cur_len;
7363 u8 max_len;
7364
7365 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
7366
7367 if (len > max_len)
7368 return false;
7369
7370 /* Make sure that the data is correctly formatted. */
7371 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7372 cur_len = data[i];
7373
7374 if (data[i + 1] == EIR_FLAGS &&
7375 (!is_adv_data || flags_managed(adv_flags)))
7376 return false;
7377
7378 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
7379 return false;
7380
7381 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
7382 return false;
7383
7384 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
7385 return false;
7386
7387 if (data[i + 1] == EIR_APPEARANCE &&
7388 appearance_managed(adv_flags))
7389 return false;
7390
7391 /* If the current field length would exceed the total data
7392 * length, then it's invalid.
7393 */
7394 if (i + cur_len >= len)
7395 return false;
7396 }
7397
7398 return true;
7399 }
7400
7401 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags)
7402 {
7403 u32 supported_flags, phy_flags;
7404
7405 /* The current implementation only supports a subset of the specified
7406 * flags. Also need to check mutual exclusiveness of sec flags.
7407 */
7408 supported_flags = get_supported_adv_flags(hdev);
7409 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK;
7410 if (adv_flags & ~supported_flags ||
7411 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
7412 return false;
7413
7414 return true;
7415 }
7416
7417 static bool adv_busy(struct hci_dev *hdev)
7418 {
7419 return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7420 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7421 pending_find(MGMT_OP_SET_LE, hdev) ||
7422 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) ||
7423 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev));
7424 }
7425
7426 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7427 u16 opcode)
7428 {
7429 struct mgmt_pending_cmd *cmd;
7430 struct mgmt_cp_add_advertising *cp;
7431 struct mgmt_rp_add_advertising rp;
7432 struct adv_info *adv_instance, *n;
7433 u8 instance;
7434
7435 bt_dev_dbg(hdev, "status %d", status);
7436
7437 hci_dev_lock(hdev);
7438
7439 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7440 if (!cmd)
7441 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev);
7442
7443 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7444 if (!adv_instance->pending)
7445 continue;
7446
7447 if (!status) {
7448 adv_instance->pending = false;
7449 continue;
7450 }
7451
7452 instance = adv_instance->instance;
7453
7454 if (hdev->cur_adv_instance == instance)
7455 cancel_adv_timeout(hdev);
7456
7457 hci_remove_adv_instance(hdev, instance);
7458 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
7459 }
7460
7461 if (!cmd)
7462 goto unlock;
7463
7464 cp = cmd->param;
7465 rp.instance = cp->instance;
7466
7467 if (status)
7468 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7469 mgmt_status(status));
7470 else
7471 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7472 mgmt_status(status), &rp, sizeof(rp));
7473
7474 mgmt_pending_remove(cmd);
7475
7476 unlock:
7477 hci_dev_unlock(hdev);
7478 }
7479
7480 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7481 void *data, u16 data_len)
7482 {
7483 struct mgmt_cp_add_advertising *cp = data;
7484 struct mgmt_rp_add_advertising rp;
7485 u32 flags;
7486 u8 status;
7487 u16 timeout, duration;
7488 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7489 u8 schedule_instance = 0;
7490 struct adv_info *next_instance;
7491 int err;
7492 struct mgmt_pending_cmd *cmd;
7493 struct hci_request req;
7494
7495 bt_dev_dbg(hdev, "sock %p", sk);
7496
7497 status = mgmt_le_support(hdev);
7498 if (status)
7499 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7500 status);
7501
7502 /* Enabling the experimental LL Privay support disables support for
7503 * advertising.
7504 */
7505 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
7506 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
7507 MGMT_STATUS_NOT_SUPPORTED);
7508
7509 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7510 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7511 MGMT_STATUS_INVALID_PARAMS);
7512
7513 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
7514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7515 MGMT_STATUS_INVALID_PARAMS);
7516
7517 flags = __le32_to_cpu(cp->flags);
7518 timeout = __le16_to_cpu(cp->timeout);
7519 duration = __le16_to_cpu(cp->duration);
7520
7521 if (!requested_adv_flags_are_valid(hdev, flags))
7522 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7523 MGMT_STATUS_INVALID_PARAMS);
7524
7525 hci_dev_lock(hdev);
7526
7527 if (timeout && !hdev_is_powered(hdev)) {
7528 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7529 MGMT_STATUS_REJECTED);
7530 goto unlock;
7531 }
7532
7533 if (adv_busy(hdev)) {
7534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7535 MGMT_STATUS_BUSY);
7536 goto unlock;
7537 }
7538
7539 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
7540 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
7541 cp->scan_rsp_len, false)) {
7542 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7543 MGMT_STATUS_INVALID_PARAMS);
7544 goto unlock;
7545 }
7546
7547 err = hci_add_adv_instance(hdev, cp->instance, flags,
7548 cp->adv_data_len, cp->data,
7549 cp->scan_rsp_len,
7550 cp->data + cp->adv_data_len,
7551 timeout, duration,
7552 HCI_ADV_TX_POWER_NO_PREFERENCE,
7553 hdev->le_adv_min_interval,
7554 hdev->le_adv_max_interval);
7555 if (err < 0) {
7556 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7557 MGMT_STATUS_FAILED);
7558 goto unlock;
7559 }
7560
7561 /* Only trigger an advertising added event if a new instance was
7562 * actually added.
7563 */
7564 if (hdev->adv_instance_cnt > prev_instance_cnt)
7565 mgmt_advertising_added(sk, hdev, cp->instance);
7566
7567 if (hdev->cur_adv_instance == cp->instance) {
7568 /* If the currently advertised instance is being changed then
7569 * cancel the current advertising and schedule the next
7570 * instance. If there is only one instance then the overridden
7571 * advertising data will be visible right away.
7572 */
7573 cancel_adv_timeout(hdev);
7574
7575 next_instance = hci_get_next_instance(hdev, cp->instance);
7576 if (next_instance)
7577 schedule_instance = next_instance->instance;
7578 } else if (!hdev->adv_instance_timeout) {
7579 /* Immediately advertise the new instance if no other
7580 * instance is currently being advertised.
7581 */
7582 schedule_instance = cp->instance;
7583 }
7584
7585 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7586 * there is no instance to be advertised then we have no HCI
7587 * communication to make. Simply return.
7588 */
7589 if (!hdev_is_powered(hdev) ||
7590 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7591 !schedule_instance) {
7592 rp.instance = cp->instance;
7593 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7594 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7595 goto unlock;
7596 }
7597
7598 /* We're good to go, update advertising data, parameters, and start
7599 * advertising.
7600 */
7601 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7602 data_len);
7603 if (!cmd) {
7604 err = -ENOMEM;
7605 goto unlock;
7606 }
7607
7608 hci_req_init(&req, hdev);
7609
7610 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
7611
7612 if (!err)
7613 err = hci_req_run(&req, add_advertising_complete);
7614
7615 if (err < 0) {
7616 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7617 MGMT_STATUS_FAILED);
7618 mgmt_pending_remove(cmd);
7619 }
7620
7621 unlock:
7622 hci_dev_unlock(hdev);
7623
7624 return err;
7625 }
7626
7627 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status,
7628 u16 opcode)
7629 {
7630 struct mgmt_pending_cmd *cmd;
7631 struct mgmt_cp_add_ext_adv_params *cp;
7632 struct mgmt_rp_add_ext_adv_params rp;
7633 struct adv_info *adv_instance;
7634 u32 flags;
7635
7636 BT_DBG("%s", hdev->name);
7637
7638 hci_dev_lock(hdev);
7639
7640 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev);
7641 if (!cmd)
7642 goto unlock;
7643
7644 cp = cmd->param;
7645 adv_instance = hci_find_adv_instance(hdev, cp->instance);
7646 if (!adv_instance)
7647 goto unlock;
7648
7649 rp.instance = cp->instance;
7650 rp.tx_power = adv_instance->tx_power;
7651
7652 /* While we're at it, inform userspace of the available space for this
7653 * advertisement, given the flags that will be used.
7654 */
7655 flags = __le32_to_cpu(cp->flags);
7656 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7657 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7658
7659 if (status) {
7660 /* If this advertisement was previously advertising and we
7661 * failed to update it, we signal that it has been removed and
7662 * delete its structure
7663 */
7664 if (!adv_instance->pending)
7665 mgmt_advertising_removed(cmd->sk, hdev, cp->instance);
7666
7667 hci_remove_adv_instance(hdev, cp->instance);
7668
7669 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7670 mgmt_status(status));
7671
7672 } else {
7673 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7674 mgmt_status(status), &rp, sizeof(rp));
7675 }
7676
7677 unlock:
7678 if (cmd)
7679 mgmt_pending_remove(cmd);
7680
7681 hci_dev_unlock(hdev);
7682 }
7683
7684 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev,
7685 void *data, u16 data_len)
7686 {
7687 struct mgmt_cp_add_ext_adv_params *cp = data;
7688 struct mgmt_rp_add_ext_adv_params rp;
7689 struct mgmt_pending_cmd *cmd = NULL;
7690 struct adv_info *adv_instance;
7691 struct hci_request req;
7692 u32 flags, min_interval, max_interval;
7693 u16 timeout, duration;
7694 u8 status;
7695 s8 tx_power;
7696 int err;
7697
7698 BT_DBG("%s", hdev->name);
7699
7700 status = mgmt_le_support(hdev);
7701 if (status)
7702 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7703 status);
7704
7705 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
7706 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7707 MGMT_STATUS_INVALID_PARAMS);
7708
7709 /* The purpose of breaking add_advertising into two separate MGMT calls
7710 * for params and data is to allow more parameters to be added to this
7711 * structure in the future. For this reason, we verify that we have the
7712 * bare minimum structure we know of when the interface was defined. Any
7713 * extra parameters we don't know about will be ignored in this request.
7714 */
7715 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE)
7716 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7717 MGMT_STATUS_INVALID_PARAMS);
7718
7719 flags = __le32_to_cpu(cp->flags);
7720
7721 if (!requested_adv_flags_are_valid(hdev, flags))
7722 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7723 MGMT_STATUS_INVALID_PARAMS);
7724
7725 hci_dev_lock(hdev);
7726
7727 /* In new interface, we require that we are powered to register */
7728 if (!hdev_is_powered(hdev)) {
7729 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7730 MGMT_STATUS_REJECTED);
7731 goto unlock;
7732 }
7733
7734 if (adv_busy(hdev)) {
7735 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7736 MGMT_STATUS_BUSY);
7737 goto unlock;
7738 }
7739
7740 /* Parse defined parameters from request, use defaults otherwise */
7741 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ?
7742 __le16_to_cpu(cp->timeout) : 0;
7743
7744 duration = (flags & MGMT_ADV_PARAM_DURATION) ?
7745 __le16_to_cpu(cp->duration) :
7746 hdev->def_multi_adv_rotation_duration;
7747
7748 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7749 __le32_to_cpu(cp->min_interval) :
7750 hdev->le_adv_min_interval;
7751
7752 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ?
7753 __le32_to_cpu(cp->max_interval) :
7754 hdev->le_adv_max_interval;
7755
7756 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ?
7757 cp->tx_power :
7758 HCI_ADV_TX_POWER_NO_PREFERENCE;
7759
7760 /* Create advertising instance with no advertising or response data */
7761 err = hci_add_adv_instance(hdev, cp->instance, flags,
7762 0, NULL, 0, NULL, timeout, duration,
7763 tx_power, min_interval, max_interval);
7764
7765 if (err < 0) {
7766 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS,
7767 MGMT_STATUS_FAILED);
7768 goto unlock;
7769 }
7770
7771 hdev->cur_adv_instance = cp->instance;
7772 /* Submit request for advertising params if ext adv available */
7773 if (ext_adv_capable(hdev)) {
7774 hci_req_init(&req, hdev);
7775 adv_instance = hci_find_adv_instance(hdev, cp->instance);
7776
7777 /* Updating parameters of an active instance will return a
7778 * Command Disallowed error, so we must first disable the
7779 * instance if it is active.
7780 */
7781 if (!adv_instance->pending)
7782 __hci_req_disable_ext_adv_instance(&req, cp->instance);
7783
7784 __hci_req_setup_ext_adv_instance(&req, cp->instance);
7785
7786 err = hci_req_run(&req, add_ext_adv_params_complete);
7787
7788 if (!err)
7789 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS,
7790 hdev, data, data_len);
7791 if (!cmd) {
7792 err = -ENOMEM;
7793 hci_remove_adv_instance(hdev, cp->instance);
7794 goto unlock;
7795 }
7796
7797 } else {
7798 rp.instance = cp->instance;
7799 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
7800 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
7801 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
7802 err = mgmt_cmd_complete(sk, hdev->id,
7803 MGMT_OP_ADD_EXT_ADV_PARAMS,
7804 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7805 }
7806
7807 unlock:
7808 hci_dev_unlock(hdev);
7809
7810 return err;
7811 }
7812
7813 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data,
7814 u16 data_len)
7815 {
7816 struct mgmt_cp_add_ext_adv_data *cp = data;
7817 struct mgmt_rp_add_ext_adv_data rp;
7818 u8 schedule_instance = 0;
7819 struct adv_info *next_instance;
7820 struct adv_info *adv_instance;
7821 int err = 0;
7822 struct mgmt_pending_cmd *cmd;
7823 struct hci_request req;
7824
7825 BT_DBG("%s", hdev->name);
7826
7827 hci_dev_lock(hdev);
7828
7829 adv_instance = hci_find_adv_instance(hdev, cp->instance);
7830
7831 if (!adv_instance) {
7832 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
7833 MGMT_STATUS_INVALID_PARAMS);
7834 goto unlock;
7835 }
7836
7837 /* In new interface, we require that we are powered to register */
7838 if (!hdev_is_powered(hdev)) {
7839 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
7840 MGMT_STATUS_REJECTED);
7841 goto clear_new_instance;
7842 }
7843
7844 if (adv_busy(hdev)) {
7845 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
7846 MGMT_STATUS_BUSY);
7847 goto clear_new_instance;
7848 }
7849
7850 /* Validate new data */
7851 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data,
7852 cp->adv_data_len, true) ||
7853 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data +
7854 cp->adv_data_len, cp->scan_rsp_len, false)) {
7855 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
7856 MGMT_STATUS_INVALID_PARAMS);
7857 goto clear_new_instance;
7858 }
7859
7860 /* Set the data in the advertising instance */
7861 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len,
7862 cp->data, cp->scan_rsp_len,
7863 cp->data + cp->adv_data_len);
7864
7865 /* We're good to go, update advertising data, parameters, and start
7866 * advertising.
7867 */
7868
7869 hci_req_init(&req, hdev);
7870
7871 hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
7872
7873 if (ext_adv_capable(hdev)) {
7874 __hci_req_update_adv_data(&req, cp->instance);
7875 __hci_req_update_scan_rsp_data(&req, cp->instance);
7876 __hci_req_enable_ext_advertising(&req, cp->instance);
7877
7878 } else {
7879 /* If using software rotation, determine next instance to use */
7880
7881 if (hdev->cur_adv_instance == cp->instance) {
7882 /* If the currently advertised instance is being changed
7883 * then cancel the current advertising and schedule the
7884 * next instance. If there is only one instance then the
7885 * overridden advertising data will be visible right
7886 * away
7887 */
7888 cancel_adv_timeout(hdev);
7889
7890 next_instance = hci_get_next_instance(hdev,
7891 cp->instance);
7892 if (next_instance)
7893 schedule_instance = next_instance->instance;
7894 } else if (!hdev->adv_instance_timeout) {
7895 /* Immediately advertise the new instance if no other
7896 * instance is currently being advertised.
7897 */
7898 schedule_instance = cp->instance;
7899 }
7900
7901 /* If the HCI_ADVERTISING flag is set or there is no instance to
7902 * be advertised then we have no HCI communication to make.
7903 * Simply return.
7904 */
7905 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7906 !schedule_instance) {
7907 if (adv_instance->pending) {
7908 mgmt_advertising_added(sk, hdev, cp->instance);
7909 adv_instance->pending = false;
7910 }
7911 rp.instance = cp->instance;
7912 err = mgmt_cmd_complete(sk, hdev->id,
7913 MGMT_OP_ADD_EXT_ADV_DATA,
7914 MGMT_STATUS_SUCCESS, &rp,
7915 sizeof(rp));
7916 goto unlock;
7917 }
7918
7919 err = __hci_req_schedule_adv_instance(&req, schedule_instance,
7920 true);
7921 }
7922
7923 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data,
7924 data_len);
7925 if (!cmd) {
7926 err = -ENOMEM;
7927 goto clear_new_instance;
7928 }
7929
7930 if (!err)
7931 err = hci_req_run(&req, add_advertising_complete);
7932
7933 if (err < 0) {
7934 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA,
7935 MGMT_STATUS_FAILED);
7936 mgmt_pending_remove(cmd);
7937 goto clear_new_instance;
7938 }
7939
7940 /* We were successful in updating data, so trigger advertising_added
7941 * event if this is an instance that wasn't previously advertising. If
7942 * a failure occurs in the requests we initiated, we will remove the
7943 * instance again in add_advertising_complete
7944 */
7945 if (adv_instance->pending)
7946 mgmt_advertising_added(sk, hdev, cp->instance);
7947
7948 goto unlock;
7949
7950 clear_new_instance:
7951 hci_remove_adv_instance(hdev, cp->instance);
7952
7953 unlock:
7954 hci_dev_unlock(hdev);
7955
7956 return err;
7957 }
7958
7959 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7960 u16 opcode)
7961 {
7962 struct mgmt_pending_cmd *cmd;
7963 struct mgmt_cp_remove_advertising *cp;
7964 struct mgmt_rp_remove_advertising rp;
7965
7966 bt_dev_dbg(hdev, "status %d", status);
7967
7968 hci_dev_lock(hdev);
7969
7970 /* A failure status here only means that we failed to disable
7971 * advertising. Otherwise, the advertising instance has been removed,
7972 * so report success.
7973 */
7974 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7975 if (!cmd)
7976 goto unlock;
7977
7978 cp = cmd->param;
7979 rp.instance = cp->instance;
7980
7981 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7982 &rp, sizeof(rp));
7983 mgmt_pending_remove(cmd);
7984
7985 unlock:
7986 hci_dev_unlock(hdev);
7987 }
7988
7989 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7990 void *data, u16 data_len)
7991 {
7992 struct mgmt_cp_remove_advertising *cp = data;
7993 struct mgmt_rp_remove_advertising rp;
7994 struct mgmt_pending_cmd *cmd;
7995 struct hci_request req;
7996 int err;
7997
7998 bt_dev_dbg(hdev, "sock %p", sk);
7999
8000 /* Enabling the experimental LL Privay support disables support for
8001 * advertising.
8002 */
8003 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
8004 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
8005 MGMT_STATUS_NOT_SUPPORTED);
8006
8007 hci_dev_lock(hdev);
8008
8009 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
8010 err = mgmt_cmd_status(sk, hdev->id,
8011 MGMT_OP_REMOVE_ADVERTISING,
8012 MGMT_STATUS_INVALID_PARAMS);
8013 goto unlock;
8014 }
8015
8016 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
8017 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
8018 pending_find(MGMT_OP_SET_LE, hdev)) {
8019 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8020 MGMT_STATUS_BUSY);
8021 goto unlock;
8022 }
8023
8024 if (list_empty(&hdev->adv_instances)) {
8025 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
8026 MGMT_STATUS_INVALID_PARAMS);
8027 goto unlock;
8028 }
8029
8030 hci_req_init(&req, hdev);
8031
8032 /* If we use extended advertising, instance is disabled and removed */
8033 if (ext_adv_capable(hdev)) {
8034 __hci_req_disable_ext_adv_instance(&req, cp->instance);
8035 __hci_req_remove_ext_adv_instance(&req, cp->instance);
8036 }
8037
8038 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
8039
8040 if (list_empty(&hdev->adv_instances))
8041 __hci_req_disable_advertising(&req);
8042
8043 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
8044 * flag is set or the device isn't powered then we have no HCI
8045 * communication to make. Simply return.
8046 */
8047 if (skb_queue_empty(&req.cmd_q) ||
8048 !hdev_is_powered(hdev) ||
8049 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
8050 hci_req_purge(&req);
8051 rp.instance = cp->instance;
8052 err = mgmt_cmd_complete(sk, hdev->id,
8053 MGMT_OP_REMOVE_ADVERTISING,
8054 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8055 goto unlock;
8056 }
8057
8058 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
8059 data_len);
8060 if (!cmd) {
8061 err = -ENOMEM;
8062 goto unlock;
8063 }
8064
8065 err = hci_req_run(&req, remove_advertising_complete);
8066 if (err < 0)
8067 mgmt_pending_remove(cmd);
8068
8069 unlock:
8070 hci_dev_unlock(hdev);
8071
8072 return err;
8073 }
8074
8075 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
8076 void *data, u16 data_len)
8077 {
8078 struct mgmt_cp_get_adv_size_info *cp = data;
8079 struct mgmt_rp_get_adv_size_info rp;
8080 u32 flags, supported_flags;
8081 int err;
8082
8083 bt_dev_dbg(hdev, "sock %p", sk);
8084
8085 if (!lmp_le_capable(hdev))
8086 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8087 MGMT_STATUS_REJECTED);
8088
8089 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
8090 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8091 MGMT_STATUS_INVALID_PARAMS);
8092
8093 flags = __le32_to_cpu(cp->flags);
8094
8095 /* The current implementation only supports a subset of the specified
8096 * flags.
8097 */
8098 supported_flags = get_supported_adv_flags(hdev);
8099 if (flags & ~supported_flags)
8100 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8101 MGMT_STATUS_INVALID_PARAMS);
8102
8103 rp.instance = cp->instance;
8104 rp.flags = cp->flags;
8105 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
8106 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
8107
8108 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
8109 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
8110
8111 return err;
8112 }
8113
8114 static const struct hci_mgmt_handler mgmt_handlers[] = {
8115 { NULL }, /* 0x0000 (no command) */
8116 { read_version, MGMT_READ_VERSION_SIZE,
8117 HCI_MGMT_NO_HDEV |
8118 HCI_MGMT_UNTRUSTED },
8119 { read_commands, MGMT_READ_COMMANDS_SIZE,
8120 HCI_MGMT_NO_HDEV |
8121 HCI_MGMT_UNTRUSTED },
8122 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
8123 HCI_MGMT_NO_HDEV |
8124 HCI_MGMT_UNTRUSTED },
8125 { read_controller_info, MGMT_READ_INFO_SIZE,
8126 HCI_MGMT_UNTRUSTED },
8127 { set_powered, MGMT_SETTING_SIZE },
8128 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
8129 { set_connectable, MGMT_SETTING_SIZE },
8130 { set_fast_connectable, MGMT_SETTING_SIZE },
8131 { set_bondable, MGMT_SETTING_SIZE },
8132 { set_link_security, MGMT_SETTING_SIZE },
8133 { set_ssp, MGMT_SETTING_SIZE },
8134 { set_hs, MGMT_SETTING_SIZE },
8135 { set_le, MGMT_SETTING_SIZE },
8136 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
8137 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
8138 { add_uuid, MGMT_ADD_UUID_SIZE },
8139 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
8140 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
8141 HCI_MGMT_VAR_LEN },
8142 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
8143 HCI_MGMT_VAR_LEN },
8144 { disconnect, MGMT_DISCONNECT_SIZE },
8145 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
8146 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
8147 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
8148 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
8149 { pair_device, MGMT_PAIR_DEVICE_SIZE },
8150 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
8151 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
8152 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
8153 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
8154 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
8155 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
8156 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
8157 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
8158 HCI_MGMT_VAR_LEN },
8159 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
8160 { start_discovery, MGMT_START_DISCOVERY_SIZE },
8161 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
8162 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
8163 { block_device, MGMT_BLOCK_DEVICE_SIZE },
8164 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
8165 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
8166 { set_advertising, MGMT_SETTING_SIZE },
8167 { set_bredr, MGMT_SETTING_SIZE },
8168 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
8169 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
8170 { set_secure_conn, MGMT_SETTING_SIZE },
8171 { set_debug_keys, MGMT_SETTING_SIZE },
8172 { set_privacy, MGMT_SET_PRIVACY_SIZE },
8173 { load_irks, MGMT_LOAD_IRKS_SIZE,
8174 HCI_MGMT_VAR_LEN },
8175 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
8176 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
8177 { add_device, MGMT_ADD_DEVICE_SIZE },
8178 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
8179 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
8180 HCI_MGMT_VAR_LEN },
8181 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
8182 HCI_MGMT_NO_HDEV |
8183 HCI_MGMT_UNTRUSTED },
8184 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
8185 HCI_MGMT_UNCONFIGURED |
8186 HCI_MGMT_UNTRUSTED },
8187 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
8188 HCI_MGMT_UNCONFIGURED },
8189 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
8190 HCI_MGMT_UNCONFIGURED },
8191 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
8192 HCI_MGMT_VAR_LEN },
8193 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
8194 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
8195 HCI_MGMT_NO_HDEV |
8196 HCI_MGMT_UNTRUSTED },
8197 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
8198 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
8199 HCI_MGMT_VAR_LEN },
8200 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
8201 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
8202 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
8203 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
8204 HCI_MGMT_UNTRUSTED },
8205 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
8206 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
8207 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
8208 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE,
8209 HCI_MGMT_VAR_LEN },
8210 { set_wideband_speech, MGMT_SETTING_SIZE },
8211 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE,
8212 HCI_MGMT_UNTRUSTED },
8213 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE,
8214 HCI_MGMT_UNTRUSTED |
8215 HCI_MGMT_HDEV_OPTIONAL },
8216 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE,
8217 HCI_MGMT_VAR_LEN |
8218 HCI_MGMT_HDEV_OPTIONAL },
8219 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE,
8220 HCI_MGMT_UNTRUSTED },
8221 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE,
8222 HCI_MGMT_VAR_LEN },
8223 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE,
8224 HCI_MGMT_UNTRUSTED },
8225 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE,
8226 HCI_MGMT_VAR_LEN },
8227 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE },
8228 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE },
8229 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE },
8230 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE,
8231 HCI_MGMT_VAR_LEN },
8232 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE },
8233 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE,
8234 HCI_MGMT_VAR_LEN },
8235 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE,
8236 HCI_MGMT_VAR_LEN },
8237 };
8238
8239 void mgmt_index_added(struct hci_dev *hdev)
8240 {
8241 struct mgmt_ev_ext_index ev;
8242
8243 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8244 return;
8245
8246 switch (hdev->dev_type) {
8247 case HCI_PRIMARY:
8248 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8249 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
8250 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8251 ev.type = 0x01;
8252 } else {
8253 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
8254 HCI_MGMT_INDEX_EVENTS);
8255 ev.type = 0x00;
8256 }
8257 break;
8258 case HCI_AMP:
8259 ev.type = 0x02;
8260 break;
8261 default:
8262 return;
8263 }
8264
8265 ev.bus = hdev->bus;
8266
8267 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
8268 HCI_MGMT_EXT_INDEX_EVENTS);
8269 }
8270
8271 void mgmt_index_removed(struct hci_dev *hdev)
8272 {
8273 struct mgmt_ev_ext_index ev;
8274 u8 status = MGMT_STATUS_INVALID_INDEX;
8275
8276 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
8277 return;
8278
8279 switch (hdev->dev_type) {
8280 case HCI_PRIMARY:
8281 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8282
8283 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
8284 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
8285 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
8286 ev.type = 0x01;
8287 } else {
8288 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
8289 HCI_MGMT_INDEX_EVENTS);
8290 ev.type = 0x00;
8291 }
8292 break;
8293 case HCI_AMP:
8294 ev.type = 0x02;
8295 break;
8296 default:
8297 return;
8298 }
8299
8300 ev.bus = hdev->bus;
8301
8302 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
8303 HCI_MGMT_EXT_INDEX_EVENTS);
8304 }
8305
8306 /* This function requires the caller holds hdev->lock */
8307 static void restart_le_actions(struct hci_dev *hdev)
8308 {
8309 struct hci_conn_params *p;
8310
8311 list_for_each_entry(p, &hdev->le_conn_params, list) {
8312 /* Needed for AUTO_OFF case where might not "really"
8313 * have been powered off.
8314 */
8315 list_del_init(&p->action);
8316
8317 switch (p->auto_connect) {
8318 case HCI_AUTO_CONN_DIRECT:
8319 case HCI_AUTO_CONN_ALWAYS:
8320 list_add(&p->action, &hdev->pend_le_conns);
8321 break;
8322 case HCI_AUTO_CONN_REPORT:
8323 list_add(&p->action, &hdev->pend_le_reports);
8324 break;
8325 default:
8326 break;
8327 }
8328 }
8329 }
8330
8331 void mgmt_power_on(struct hci_dev *hdev, int err)
8332 {
8333 struct cmd_lookup match = { NULL, hdev };
8334
8335 bt_dev_dbg(hdev, "err %d", err);
8336
8337 hci_dev_lock(hdev);
8338
8339 if (!err) {
8340 restart_le_actions(hdev);
8341 hci_update_background_scan(hdev);
8342 }
8343
8344 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8345
8346 new_settings(hdev, match.sk);
8347
8348 if (match.sk)
8349 sock_put(match.sk);
8350
8351 hci_dev_unlock(hdev);
8352 }
8353
8354 void __mgmt_power_off(struct hci_dev *hdev)
8355 {
8356 struct cmd_lookup match = { NULL, hdev };
8357 u8 status, zero_cod[] = { 0, 0, 0 };
8358
8359 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
8360
8361 /* If the power off is because of hdev unregistration let
8362 * use the appropriate INVALID_INDEX status. Otherwise use
8363 * NOT_POWERED. We cover both scenarios here since later in
8364 * mgmt_index_removed() any hci_conn callbacks will have already
8365 * been triggered, potentially causing misleading DISCONNECTED
8366 * status responses.
8367 */
8368 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
8369 status = MGMT_STATUS_INVALID_INDEX;
8370 else
8371 status = MGMT_STATUS_NOT_POWERED;
8372
8373 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
8374
8375 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
8376 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8377 zero_cod, sizeof(zero_cod),
8378 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8379 ext_info_changed(hdev, NULL);
8380 }
8381
8382 new_settings(hdev, match.sk);
8383
8384 if (match.sk)
8385 sock_put(match.sk);
8386 }
8387
8388 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
8389 {
8390 struct mgmt_pending_cmd *cmd;
8391 u8 status;
8392
8393 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8394 if (!cmd)
8395 return;
8396
8397 if (err == -ERFKILL)
8398 status = MGMT_STATUS_RFKILLED;
8399 else
8400 status = MGMT_STATUS_FAILED;
8401
8402 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
8403
8404 mgmt_pending_remove(cmd);
8405 }
8406
8407 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
8408 bool persistent)
8409 {
8410 struct mgmt_ev_new_link_key ev;
8411
8412 memset(&ev, 0, sizeof(ev));
8413
8414 ev.store_hint = persistent;
8415 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8416 ev.key.addr.type = BDADDR_BREDR;
8417 ev.key.type = key->type;
8418 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
8419 ev.key.pin_len = key->pin_len;
8420
8421 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
8422 }
8423
8424 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
8425 {
8426 switch (ltk->type) {
8427 case SMP_LTK:
8428 case SMP_LTK_SLAVE:
8429 if (ltk->authenticated)
8430 return MGMT_LTK_AUTHENTICATED;
8431 return MGMT_LTK_UNAUTHENTICATED;
8432 case SMP_LTK_P256:
8433 if (ltk->authenticated)
8434 return MGMT_LTK_P256_AUTH;
8435 return MGMT_LTK_P256_UNAUTH;
8436 case SMP_LTK_P256_DEBUG:
8437 return MGMT_LTK_P256_DEBUG;
8438 }
8439
8440 return MGMT_LTK_UNAUTHENTICATED;
8441 }
8442
8443 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
8444 {
8445 struct mgmt_ev_new_long_term_key ev;
8446
8447 memset(&ev, 0, sizeof(ev));
8448
8449 /* Devices using resolvable or non-resolvable random addresses
8450 * without providing an identity resolving key don't require
8451 * to store long term keys. Their addresses will change the
8452 * next time around.
8453 *
8454 * Only when a remote device provides an identity address
8455 * make sure the long term key is stored. If the remote
8456 * identity is known, the long term keys are internally
8457 * mapped to the identity address. So allow static random
8458 * and public addresses here.
8459 */
8460 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8461 (key->bdaddr.b[5] & 0xc0) != 0xc0)
8462 ev.store_hint = 0x00;
8463 else
8464 ev.store_hint = persistent;
8465
8466 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
8467 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
8468 ev.key.type = mgmt_ltk_type(key);
8469 ev.key.enc_size = key->enc_size;
8470 ev.key.ediv = key->ediv;
8471 ev.key.rand = key->rand;
8472
8473 if (key->type == SMP_LTK)
8474 ev.key.master = 1;
8475
8476 /* Make sure we copy only the significant bytes based on the
8477 * encryption key size, and set the rest of the value to zeroes.
8478 */
8479 memcpy(ev.key.val, key->val, key->enc_size);
8480 memset(ev.key.val + key->enc_size, 0,
8481 sizeof(ev.key.val) - key->enc_size);
8482
8483 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
8484 }
8485
8486 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
8487 {
8488 struct mgmt_ev_new_irk ev;
8489
8490 memset(&ev, 0, sizeof(ev));
8491
8492 ev.store_hint = persistent;
8493
8494 bacpy(&ev.rpa, &irk->rpa);
8495 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
8496 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
8497 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
8498
8499 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
8500 }
8501
8502 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
8503 bool persistent)
8504 {
8505 struct mgmt_ev_new_csrk ev;
8506
8507 memset(&ev, 0, sizeof(ev));
8508
8509 /* Devices using resolvable or non-resolvable random addresses
8510 * without providing an identity resolving key don't require
8511 * to store signature resolving keys. Their addresses will change
8512 * the next time around.
8513 *
8514 * Only when a remote device provides an identity address
8515 * make sure the signature resolving key is stored. So allow
8516 * static random and public addresses here.
8517 */
8518 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
8519 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
8520 ev.store_hint = 0x00;
8521 else
8522 ev.store_hint = persistent;
8523
8524 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
8525 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
8526 ev.key.type = csrk->type;
8527 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
8528
8529 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
8530 }
8531
8532 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
8533 u8 bdaddr_type, u8 store_hint, u16 min_interval,
8534 u16 max_interval, u16 latency, u16 timeout)
8535 {
8536 struct mgmt_ev_new_conn_param ev;
8537
8538 if (!hci_is_identity_address(bdaddr, bdaddr_type))
8539 return;
8540
8541 memset(&ev, 0, sizeof(ev));
8542 bacpy(&ev.addr.bdaddr, bdaddr);
8543 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
8544 ev.store_hint = store_hint;
8545 ev.min_interval = cpu_to_le16(min_interval);
8546 ev.max_interval = cpu_to_le16(max_interval);
8547 ev.latency = cpu_to_le16(latency);
8548 ev.timeout = cpu_to_le16(timeout);
8549
8550 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
8551 }
8552
8553 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
8554 u32 flags, u8 *name, u8 name_len)
8555 {
8556 char buf[512];
8557 struct mgmt_ev_device_connected *ev = (void *) buf;
8558 u16 eir_len = 0;
8559
8560 bacpy(&ev->addr.bdaddr, &conn->dst);
8561 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8562
8563 ev->flags = __cpu_to_le32(flags);
8564
8565 /* We must ensure that the EIR Data fields are ordered and
8566 * unique. Keep it simple for now and avoid the problem by not
8567 * adding any BR/EDR data to the LE adv.
8568 */
8569 if (conn->le_adv_data_len > 0) {
8570 memcpy(&ev->eir[eir_len],
8571 conn->le_adv_data, conn->le_adv_data_len);
8572 eir_len = conn->le_adv_data_len;
8573 } else {
8574 if (name_len > 0)
8575 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
8576 name, name_len);
8577
8578 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
8579 eir_len = eir_append_data(ev->eir, eir_len,
8580 EIR_CLASS_OF_DEV,
8581 conn->dev_class, 3);
8582 }
8583
8584 ev->eir_len = cpu_to_le16(eir_len);
8585
8586 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
8587 sizeof(*ev) + eir_len, NULL);
8588 }
8589
8590 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8591 {
8592 struct sock **sk = data;
8593
8594 cmd->cmd_complete(cmd, 0);
8595
8596 *sk = cmd->sk;
8597 sock_hold(*sk);
8598
8599 mgmt_pending_remove(cmd);
8600 }
8601
8602 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
8603 {
8604 struct hci_dev *hdev = data;
8605 struct mgmt_cp_unpair_device *cp = cmd->param;
8606
8607 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
8608
8609 cmd->cmd_complete(cmd, 0);
8610 mgmt_pending_remove(cmd);
8611 }
8612
8613 bool mgmt_powering_down(struct hci_dev *hdev)
8614 {
8615 struct mgmt_pending_cmd *cmd;
8616 struct mgmt_mode *cp;
8617
8618 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
8619 if (!cmd)
8620 return false;
8621
8622 cp = cmd->param;
8623 if (!cp->val)
8624 return true;
8625
8626 return false;
8627 }
8628
8629 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
8630 u8 link_type, u8 addr_type, u8 reason,
8631 bool mgmt_connected)
8632 {
8633 struct mgmt_ev_device_disconnected ev;
8634 struct sock *sk = NULL;
8635
8636 /* The connection is still in hci_conn_hash so test for 1
8637 * instead of 0 to know if this is the last one.
8638 */
8639 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8640 cancel_delayed_work(&hdev->power_off);
8641 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8642 }
8643
8644 if (!mgmt_connected)
8645 return;
8646
8647 if (link_type != ACL_LINK && link_type != LE_LINK)
8648 return;
8649
8650 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
8651
8652 bacpy(&ev.addr.bdaddr, bdaddr);
8653 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8654 ev.reason = reason;
8655
8656 /* Report disconnects due to suspend */
8657 if (hdev->suspended)
8658 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND;
8659
8660 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8661
8662 if (sk)
8663 sock_put(sk);
8664
8665 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8666 hdev);
8667 }
8668
8669 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8670 u8 link_type, u8 addr_type, u8 status)
8671 {
8672 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8673 struct mgmt_cp_disconnect *cp;
8674 struct mgmt_pending_cmd *cmd;
8675
8676 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8677 hdev);
8678
8679 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8680 if (!cmd)
8681 return;
8682
8683 cp = cmd->param;
8684
8685 if (bacmp(bdaddr, &cp->addr.bdaddr))
8686 return;
8687
8688 if (cp->addr.type != bdaddr_type)
8689 return;
8690
8691 cmd->cmd_complete(cmd, mgmt_status(status));
8692 mgmt_pending_remove(cmd);
8693 }
8694
8695 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8696 u8 addr_type, u8 status)
8697 {
8698 struct mgmt_ev_connect_failed ev;
8699
8700 /* The connection is still in hci_conn_hash so test for 1
8701 * instead of 0 to know if this is the last one.
8702 */
8703 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8704 cancel_delayed_work(&hdev->power_off);
8705 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8706 }
8707
8708 bacpy(&ev.addr.bdaddr, bdaddr);
8709 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8710 ev.status = mgmt_status(status);
8711
8712 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
8713 }
8714
8715 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
8716 {
8717 struct mgmt_ev_pin_code_request ev;
8718
8719 bacpy(&ev.addr.bdaddr, bdaddr);
8720 ev.addr.type = BDADDR_BREDR;
8721 ev.secure = secure;
8722
8723 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
8724 }
8725
8726 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8727 u8 status)
8728 {
8729 struct mgmt_pending_cmd *cmd;
8730
8731 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
8732 if (!cmd)
8733 return;
8734
8735 cmd->cmd_complete(cmd, mgmt_status(status));
8736 mgmt_pending_remove(cmd);
8737 }
8738
8739 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8740 u8 status)
8741 {
8742 struct mgmt_pending_cmd *cmd;
8743
8744 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
8745 if (!cmd)
8746 return;
8747
8748 cmd->cmd_complete(cmd, mgmt_status(status));
8749 mgmt_pending_remove(cmd);
8750 }
8751
8752 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8753 u8 link_type, u8 addr_type, u32 value,
8754 u8 confirm_hint)
8755 {
8756 struct mgmt_ev_user_confirm_request ev;
8757
8758 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8759
8760 bacpy(&ev.addr.bdaddr, bdaddr);
8761 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8762 ev.confirm_hint = confirm_hint;
8763 ev.value = cpu_to_le32(value);
8764
8765 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
8766 NULL);
8767 }
8768
8769 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8770 u8 link_type, u8 addr_type)
8771 {
8772 struct mgmt_ev_user_passkey_request ev;
8773
8774 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8775
8776 bacpy(&ev.addr.bdaddr, bdaddr);
8777 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8778
8779 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
8780 NULL);
8781 }
8782
8783 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8784 u8 link_type, u8 addr_type, u8 status,
8785 u8 opcode)
8786 {
8787 struct mgmt_pending_cmd *cmd;
8788
8789 cmd = pending_find(opcode, hdev);
8790 if (!cmd)
8791 return -ENOENT;
8792
8793 cmd->cmd_complete(cmd, mgmt_status(status));
8794 mgmt_pending_remove(cmd);
8795
8796 return 0;
8797 }
8798
8799 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8800 u8 link_type, u8 addr_type, u8 status)
8801 {
8802 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8803 status, MGMT_OP_USER_CONFIRM_REPLY);
8804 }
8805
8806 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8807 u8 link_type, u8 addr_type, u8 status)
8808 {
8809 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8810 status,
8811 MGMT_OP_USER_CONFIRM_NEG_REPLY);
8812 }
8813
8814 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8815 u8 link_type, u8 addr_type, u8 status)
8816 {
8817 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8818 status, MGMT_OP_USER_PASSKEY_REPLY);
8819 }
8820
8821 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8822 u8 link_type, u8 addr_type, u8 status)
8823 {
8824 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8825 status,
8826 MGMT_OP_USER_PASSKEY_NEG_REPLY);
8827 }
8828
8829 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8830 u8 link_type, u8 addr_type, u32 passkey,
8831 u8 entered)
8832 {
8833 struct mgmt_ev_passkey_notify ev;
8834
8835 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr);
8836
8837 bacpy(&ev.addr.bdaddr, bdaddr);
8838 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8839 ev.passkey = __cpu_to_le32(passkey);
8840 ev.entered = entered;
8841
8842 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8843 }
8844
8845 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
8846 {
8847 struct mgmt_ev_auth_failed ev;
8848 struct mgmt_pending_cmd *cmd;
8849 u8 status = mgmt_status(hci_status);
8850
8851 bacpy(&ev.addr.bdaddr, &conn->dst);
8852 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8853 ev.status = status;
8854
8855 cmd = find_pairing(conn);
8856
8857 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8858 cmd ? cmd->sk : NULL);
8859
8860 if (cmd) {
8861 cmd->cmd_complete(cmd, status);
8862 mgmt_pending_remove(cmd);
8863 }
8864 }
8865
8866 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
8867 {
8868 struct cmd_lookup match = { NULL, hdev };
8869 bool changed;
8870
8871 if (status) {
8872 u8 mgmt_err = mgmt_status(status);
8873 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
8874 cmd_status_rsp, &mgmt_err);
8875 return;
8876 }
8877
8878 if (test_bit(HCI_AUTH, &hdev->flags))
8879 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
8880 else
8881 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
8882
8883 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
8884 &match);
8885
8886 if (changed)
8887 new_settings(hdev, match.sk);
8888
8889 if (match.sk)
8890 sock_put(match.sk);
8891 }
8892
8893 static void clear_eir(struct hci_request *req)
8894 {
8895 struct hci_dev *hdev = req->hdev;
8896 struct hci_cp_write_eir cp;
8897
8898 if (!lmp_ext_inq_capable(hdev))
8899 return;
8900
8901 memset(hdev->eir, 0, sizeof(hdev->eir));
8902
8903 memset(&cp, 0, sizeof(cp));
8904
8905 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
8906 }
8907
8908 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
8909 {
8910 struct cmd_lookup match = { NULL, hdev };
8911 struct hci_request req;
8912 bool changed = false;
8913
8914 if (status) {
8915 u8 mgmt_err = mgmt_status(status);
8916
8917 if (enable && hci_dev_test_and_clear_flag(hdev,
8918 HCI_SSP_ENABLED)) {
8919 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8920 new_settings(hdev, NULL);
8921 }
8922
8923 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8924 &mgmt_err);
8925 return;
8926 }
8927
8928 if (enable) {
8929 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
8930 } else {
8931 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
8932 if (!changed)
8933 changed = hci_dev_test_and_clear_flag(hdev,
8934 HCI_HS_ENABLED);
8935 else
8936 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
8937 }
8938
8939 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8940
8941 if (changed)
8942 new_settings(hdev, match.sk);
8943
8944 if (match.sk)
8945 sock_put(match.sk);
8946
8947 hci_req_init(&req, hdev);
8948
8949 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8950 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
8951 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8952 sizeof(enable), &enable);
8953 __hci_req_update_eir(&req);
8954 } else {
8955 clear_eir(&req);
8956 }
8957
8958 hci_req_run(&req, NULL);
8959 }
8960
8961 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
8962 {
8963 struct cmd_lookup *match = data;
8964
8965 if (match->sk == NULL) {
8966 match->sk = cmd->sk;
8967 sock_hold(match->sk);
8968 }
8969 }
8970
8971 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8972 u8 status)
8973 {
8974 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
8975
8976 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8977 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8978 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
8979
8980 if (!status) {
8981 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
8982 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
8983 ext_info_changed(hdev, NULL);
8984 }
8985
8986 if (match.sk)
8987 sock_put(match.sk);
8988 }
8989
8990 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
8991 {
8992 struct mgmt_cp_set_local_name ev;
8993 struct mgmt_pending_cmd *cmd;
8994
8995 if (status)
8996 return;
8997
8998 memset(&ev, 0, sizeof(ev));
8999 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
9000 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
9001
9002 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
9003 if (!cmd) {
9004 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
9005
9006 /* If this is a HCI command related to powering on the
9007 * HCI dev don't send any mgmt signals.
9008 */
9009 if (pending_find(MGMT_OP_SET_POWERED, hdev))
9010 return;
9011 }
9012
9013 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
9014 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
9015 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
9016 }
9017
9018 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
9019 {
9020 int i;
9021
9022 for (i = 0; i < uuid_count; i++) {
9023 if (!memcmp(uuid, uuids[i], 16))
9024 return true;
9025 }
9026
9027 return false;
9028 }
9029
9030 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
9031 {
9032 u16 parsed = 0;
9033
9034 while (parsed < eir_len) {
9035 u8 field_len = eir[0];
9036 u8 uuid[16];
9037 int i;
9038
9039 if (field_len == 0)
9040 break;
9041
9042 if (eir_len - parsed < field_len + 1)
9043 break;
9044
9045 switch (eir[1]) {
9046 case EIR_UUID16_ALL:
9047 case EIR_UUID16_SOME:
9048 for (i = 0; i + 3 <= field_len; i += 2) {
9049 memcpy(uuid, bluetooth_base_uuid, 16);
9050 uuid[13] = eir[i + 3];
9051 uuid[12] = eir[i + 2];
9052 if (has_uuid(uuid, uuid_count, uuids))
9053 return true;
9054 }
9055 break;
9056 case EIR_UUID32_ALL:
9057 case EIR_UUID32_SOME:
9058 for (i = 0; i + 5 <= field_len; i += 4) {
9059 memcpy(uuid, bluetooth_base_uuid, 16);
9060 uuid[15] = eir[i + 5];
9061 uuid[14] = eir[i + 4];
9062 uuid[13] = eir[i + 3];
9063 uuid[12] = eir[i + 2];
9064 if (has_uuid(uuid, uuid_count, uuids))
9065 return true;
9066 }
9067 break;
9068 case EIR_UUID128_ALL:
9069 case EIR_UUID128_SOME:
9070 for (i = 0; i + 17 <= field_len; i += 16) {
9071 memcpy(uuid, eir + i + 2, 16);
9072 if (has_uuid(uuid, uuid_count, uuids))
9073 return true;
9074 }
9075 break;
9076 }
9077
9078 parsed += field_len + 1;
9079 eir += field_len + 1;
9080 }
9081
9082 return false;
9083 }
9084
9085 static void restart_le_scan(struct hci_dev *hdev)
9086 {
9087 /* If controller is not scanning we are done. */
9088 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
9089 return;
9090
9091 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
9092 hdev->discovery.scan_start +
9093 hdev->discovery.scan_duration))
9094 return;
9095
9096 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
9097 DISCOV_LE_RESTART_DELAY);
9098 }
9099
9100 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
9101 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9102 {
9103 /* If a RSSI threshold has been specified, and
9104 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
9105 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
9106 * is set, let it through for further processing, as we might need to
9107 * restart the scan.
9108 *
9109 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
9110 * the results are also dropped.
9111 */
9112 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9113 (rssi == HCI_RSSI_INVALID ||
9114 (rssi < hdev->discovery.rssi &&
9115 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
9116 return false;
9117
9118 if (hdev->discovery.uuid_count != 0) {
9119 /* If a list of UUIDs is provided in filter, results with no
9120 * matching UUID should be dropped.
9121 */
9122 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
9123 hdev->discovery.uuids) &&
9124 !eir_has_uuids(scan_rsp, scan_rsp_len,
9125 hdev->discovery.uuid_count,
9126 hdev->discovery.uuids))
9127 return false;
9128 }
9129
9130 /* If duplicate filtering does not report RSSI changes, then restart
9131 * scanning to ensure updated result with updated RSSI values.
9132 */
9133 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
9134 restart_le_scan(hdev);
9135
9136 /* Validate RSSI value against the RSSI threshold once more. */
9137 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
9138 rssi < hdev->discovery.rssi)
9139 return false;
9140 }
9141
9142 return true;
9143 }
9144
9145 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9146 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
9147 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
9148 {
9149 char buf[512];
9150 struct mgmt_ev_device_found *ev = (void *)buf;
9151 size_t ev_size;
9152
9153 /* Don't send events for a non-kernel initiated discovery. With
9154 * LE one exception is if we have pend_le_reports > 0 in which
9155 * case we're doing passive scanning and want these events.
9156 */
9157 if (!hci_discovery_active(hdev)) {
9158 if (link_type == ACL_LINK)
9159 return;
9160 if (link_type == LE_LINK &&
9161 list_empty(&hdev->pend_le_reports) &&
9162 !hci_is_adv_monitoring(hdev)) {
9163 return;
9164 }
9165 }
9166
9167 if (hdev->discovery.result_filtering) {
9168 /* We are using service discovery */
9169 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
9170 scan_rsp_len))
9171 return;
9172 }
9173
9174 if (hdev->discovery.limited) {
9175 /* Check for limited discoverable bit */
9176 if (dev_class) {
9177 if (!(dev_class[1] & 0x20))
9178 return;
9179 } else {
9180 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
9181 if (!flags || !(flags[0] & LE_AD_LIMITED))
9182 return;
9183 }
9184 }
9185
9186 /* Make sure that the buffer is big enough. The 5 extra bytes
9187 * are for the potential CoD field.
9188 */
9189 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
9190 return;
9191
9192 memset(buf, 0, sizeof(buf));
9193
9194 /* In case of device discovery with BR/EDR devices (pre 1.2), the
9195 * RSSI value was reported as 0 when not available. This behavior
9196 * is kept when using device discovery. This is required for full
9197 * backwards compatibility with the API.
9198 *
9199 * However when using service discovery, the value 127 will be
9200 * returned when the RSSI is not available.
9201 */
9202 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
9203 link_type == ACL_LINK)
9204 rssi = 0;
9205
9206 bacpy(&ev->addr.bdaddr, bdaddr);
9207 ev->addr.type = link_to_bdaddr(link_type, addr_type);
9208 ev->rssi = rssi;
9209 ev->flags = cpu_to_le32(flags);
9210
9211 if (eir_len > 0)
9212 /* Copy EIR or advertising data into event */
9213 memcpy(ev->eir, eir, eir_len);
9214
9215 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9216 NULL))
9217 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
9218 dev_class, 3);
9219
9220 if (scan_rsp_len > 0)
9221 /* Append scan response data to event */
9222 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
9223
9224 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
9225 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
9226
9227 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
9228 }
9229
9230 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
9231 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
9232 {
9233 struct mgmt_ev_device_found *ev;
9234 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
9235 u16 eir_len;
9236
9237 ev = (struct mgmt_ev_device_found *) buf;
9238
9239 memset(buf, 0, sizeof(buf));
9240
9241 bacpy(&ev->addr.bdaddr, bdaddr);
9242 ev->addr.type = link_to_bdaddr(link_type, addr_type);
9243 ev->rssi = rssi;
9244
9245 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
9246 name_len);
9247
9248 ev->eir_len = cpu_to_le16(eir_len);
9249
9250 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
9251 }
9252
9253 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
9254 {
9255 struct mgmt_ev_discovering ev;
9256
9257 bt_dev_dbg(hdev, "discovering %u", discovering);
9258
9259 memset(&ev, 0, sizeof(ev));
9260 ev.type = hdev->discovery.type;
9261 ev.discovering = discovering;
9262
9263 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
9264 }
9265
9266 void mgmt_suspending(struct hci_dev *hdev, u8 state)
9267 {
9268 struct mgmt_ev_controller_suspend ev;
9269
9270 ev.suspend_state = state;
9271 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL);
9272 }
9273
9274 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
9275 u8 addr_type)
9276 {
9277 struct mgmt_ev_controller_resume ev;
9278
9279 ev.wake_reason = reason;
9280 if (bdaddr) {
9281 bacpy(&ev.addr.bdaddr, bdaddr);
9282 ev.addr.type = addr_type;
9283 } else {
9284 memset(&ev.addr, 0, sizeof(ev.addr));
9285 }
9286
9287 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL);
9288 }
9289
9290 static struct hci_mgmt_chan chan = {
9291 .channel = HCI_CHANNEL_CONTROL,
9292 .handler_count = ARRAY_SIZE(mgmt_handlers),
9293 .handlers = mgmt_handlers,
9294 .hdev_init = mgmt_init_hdev,
9295 };
9296
9297 int mgmt_init(void)
9298 {
9299 return hci_mgmt_chan_register(&chan);
9300 }
9301
9302 void mgmt_exit(void)
9303 {
9304 hci_mgmt_chan_unregister(&chan);
9305 }
Linux with added FPC-III support