?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Linux 5.7.7
[linux/fpc-iii.git] / net / bluetooth / mgmt.c
blob6552003a170eb4c0c5f51e069279f4f9823c5734
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 16
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 MGMT_OP_SET_BLOCKED_KEYS,
110 MGMT_OP_SET_WIDEBAND_SPEECH,
111 };
112
113 static const u16 mgmt_events[] = {
114 MGMT_EV_CONTROLLER_ERROR,
115 MGMT_EV_INDEX_ADDED,
116 MGMT_EV_INDEX_REMOVED,
117 MGMT_EV_NEW_SETTINGS,
118 MGMT_EV_CLASS_OF_DEV_CHANGED,
119 MGMT_EV_LOCAL_NAME_CHANGED,
120 MGMT_EV_NEW_LINK_KEY,
121 MGMT_EV_NEW_LONG_TERM_KEY,
122 MGMT_EV_DEVICE_CONNECTED,
123 MGMT_EV_DEVICE_DISCONNECTED,
124 MGMT_EV_CONNECT_FAILED,
125 MGMT_EV_PIN_CODE_REQUEST,
126 MGMT_EV_USER_CONFIRM_REQUEST,
127 MGMT_EV_USER_PASSKEY_REQUEST,
128 MGMT_EV_AUTH_FAILED,
129 MGMT_EV_DEVICE_FOUND,
130 MGMT_EV_DISCOVERING,
131 MGMT_EV_DEVICE_BLOCKED,
132 MGMT_EV_DEVICE_UNBLOCKED,
133 MGMT_EV_DEVICE_UNPAIRED,
134 MGMT_EV_PASSKEY_NOTIFY,
135 MGMT_EV_NEW_IRK,
136 MGMT_EV_NEW_CSRK,
137 MGMT_EV_DEVICE_ADDED,
138 MGMT_EV_DEVICE_REMOVED,
139 MGMT_EV_NEW_CONN_PARAM,
140 MGMT_EV_UNCONF_INDEX_ADDED,
141 MGMT_EV_UNCONF_INDEX_REMOVED,
142 MGMT_EV_NEW_CONFIG_OPTIONS,
143 MGMT_EV_EXT_INDEX_ADDED,
144 MGMT_EV_EXT_INDEX_REMOVED,
145 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
146 MGMT_EV_ADVERTISING_ADDED,
147 MGMT_EV_ADVERTISING_REMOVED,
148 MGMT_EV_EXT_INFO_CHANGED,
149 };
150
151 static const u16 mgmt_untrusted_commands[] = {
152 MGMT_OP_READ_INDEX_LIST,
153 MGMT_OP_READ_INFO,
154 MGMT_OP_READ_UNCONF_INDEX_LIST,
155 MGMT_OP_READ_CONFIG_INFO,
156 MGMT_OP_READ_EXT_INDEX_LIST,
157 MGMT_OP_READ_EXT_INFO,
158 };
159
160 static const u16 mgmt_untrusted_events[] = {
161 MGMT_EV_INDEX_ADDED,
162 MGMT_EV_INDEX_REMOVED,
163 MGMT_EV_NEW_SETTINGS,
164 MGMT_EV_CLASS_OF_DEV_CHANGED,
165 MGMT_EV_LOCAL_NAME_CHANGED,
166 MGMT_EV_UNCONF_INDEX_ADDED,
167 MGMT_EV_UNCONF_INDEX_REMOVED,
168 MGMT_EV_NEW_CONFIG_OPTIONS,
169 MGMT_EV_EXT_INDEX_ADDED,
170 MGMT_EV_EXT_INDEX_REMOVED,
171 MGMT_EV_EXT_INFO_CHANGED,
172 };
173
174 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
175
176 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
177 "\x00\x00\x00\x00\x00\x00\x00\x00"
178
179 /* HCI to MGMT error code conversion table */
180 static const u8 mgmt_status_table[] = {
181 MGMT_STATUS_SUCCESS,
182 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
183 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
184 MGMT_STATUS_FAILED, /* Hardware Failure */
185 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
186 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
187 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
188 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
189 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
190 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
191 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
192 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
193 MGMT_STATUS_BUSY, /* Command Disallowed */
194 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
195 MGMT_STATUS_REJECTED, /* Rejected Security */
196 MGMT_STATUS_REJECTED, /* Rejected Personal */
197 MGMT_STATUS_TIMEOUT, /* Host Timeout */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
199 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
200 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
201 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
202 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
203 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
204 MGMT_STATUS_BUSY, /* Repeated Attempts */
205 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
206 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
207 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
208 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
209 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
210 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
211 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
212 MGMT_STATUS_FAILED, /* Unspecified Error */
213 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
214 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
215 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
216 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
217 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
218 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
219 MGMT_STATUS_FAILED, /* Unit Link Key Used */
220 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
221 MGMT_STATUS_TIMEOUT, /* Instant Passed */
222 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
223 MGMT_STATUS_FAILED, /* Transaction Collision */
224 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
225 MGMT_STATUS_REJECTED, /* QoS Rejected */
226 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
227 MGMT_STATUS_REJECTED, /* Insufficient Security */
228 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
229 MGMT_STATUS_BUSY, /* Role Switch Pending */
230 MGMT_STATUS_FAILED, /* Slot Violation */
231 MGMT_STATUS_FAILED, /* Role Switch Failed */
232 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
233 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
234 MGMT_STATUS_BUSY, /* Host Busy Pairing */
235 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
236 MGMT_STATUS_BUSY, /* Controller Busy */
237 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
238 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
239 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
240 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
241 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
242 };
243
244 static u8 mgmt_status(u8 hci_status)
245 {
246 if (hci_status < ARRAY_SIZE(mgmt_status_table))
247 return mgmt_status_table[hci_status];
248
249 return MGMT_STATUS_FAILED;
250 }
251
252 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
253 u16 len, int flag)
254 {
255 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
256 flag, NULL);
257 }
258
259 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
260 u16 len, int flag, struct sock *skip_sk)
261 {
262 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
263 flag, skip_sk);
264 }
265
266 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
267 struct sock *skip_sk)
268 {
269 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
270 HCI_SOCK_TRUSTED, skip_sk);
271 }
272
273 static u8 le_addr_type(u8 mgmt_addr_type)
274 {
275 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
276 return ADDR_LE_DEV_PUBLIC;
277 else
278 return ADDR_LE_DEV_RANDOM;
279 }
280
281 void mgmt_fill_version_info(void *ver)
282 {
283 struct mgmt_rp_read_version *rp = ver;
284
285 rp->version = MGMT_VERSION;
286 rp->revision = cpu_to_le16(MGMT_REVISION);
287 }
288
289 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
290 u16 data_len)
291 {
292 struct mgmt_rp_read_version rp;
293
294 BT_DBG("sock %p", sk);
295
296 mgmt_fill_version_info(&rp);
297
298 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
299 &rp, sizeof(rp));
300 }
301
302 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
303 u16 data_len)
304 {
305 struct mgmt_rp_read_commands *rp;
306 u16 num_commands, num_events;
307 size_t rp_size;
308 int i, err;
309
310 BT_DBG("sock %p", sk);
311
312 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
313 num_commands = ARRAY_SIZE(mgmt_commands);
314 num_events = ARRAY_SIZE(mgmt_events);
315 } else {
316 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
317 num_events = ARRAY_SIZE(mgmt_untrusted_events);
318 }
319
320 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
321
322 rp = kmalloc(rp_size, GFP_KERNEL);
323 if (!rp)
324 return -ENOMEM;
325
326 rp->num_commands = cpu_to_le16(num_commands);
327 rp->num_events = cpu_to_le16(num_events);
328
329 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
330 __le16 *opcode = rp->opcodes;
331
332 for (i = 0; i < num_commands; i++, opcode++)
333 put_unaligned_le16(mgmt_commands[i], opcode);
334
335 for (i = 0; i < num_events; i++, opcode++)
336 put_unaligned_le16(mgmt_events[i], opcode);
337 } else {
338 __le16 *opcode = rp->opcodes;
339
340 for (i = 0; i < num_commands; i++, opcode++)
341 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
342
343 for (i = 0; i < num_events; i++, opcode++)
344 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
345 }
346
347 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
348 rp, rp_size);
349 kfree(rp);
350
351 return err;
352 }
353
354 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
355 u16 data_len)
356 {
357 struct mgmt_rp_read_index_list *rp;
358 struct hci_dev *d;
359 size_t rp_len;
360 u16 count;
361 int err;
362
363 BT_DBG("sock %p", sk);
364
365 read_lock(&hci_dev_list_lock);
366
367 count = 0;
368 list_for_each_entry(d, &hci_dev_list, list) {
369 if (d->dev_type == HCI_PRIMARY &&
370 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
371 count++;
372 }
373
374 rp_len = sizeof(*rp) + (2 * count);
375 rp = kmalloc(rp_len, GFP_ATOMIC);
376 if (!rp) {
377 read_unlock(&hci_dev_list_lock);
378 return -ENOMEM;
379 }
380
381 count = 0;
382 list_for_each_entry(d, &hci_dev_list, list) {
383 if (hci_dev_test_flag(d, HCI_SETUP) ||
384 hci_dev_test_flag(d, HCI_CONFIG) ||
385 hci_dev_test_flag(d, HCI_USER_CHANNEL))
386 continue;
387
388 /* Devices marked as raw-only are neither configured
389 * nor unconfigured controllers.
390 */
391 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
392 continue;
393
394 if (d->dev_type == HCI_PRIMARY &&
395 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
396 rp->index[count++] = cpu_to_le16(d->id);
397 BT_DBG("Added hci%u", d->id);
398 }
399 }
400
401 rp->num_controllers = cpu_to_le16(count);
402 rp_len = sizeof(*rp) + (2 * count);
403
404 read_unlock(&hci_dev_list_lock);
405
406 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
407 0, rp, rp_len);
408
409 kfree(rp);
410
411 return err;
412 }
413
414 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
415 void *data, u16 data_len)
416 {
417 struct mgmt_rp_read_unconf_index_list *rp;
418 struct hci_dev *d;
419 size_t rp_len;
420 u16 count;
421 int err;
422
423 BT_DBG("sock %p", sk);
424
425 read_lock(&hci_dev_list_lock);
426
427 count = 0;
428 list_for_each_entry(d, &hci_dev_list, list) {
429 if (d->dev_type == HCI_PRIMARY &&
430 hci_dev_test_flag(d, HCI_UNCONFIGURED))
431 count++;
432 }
433
434 rp_len = sizeof(*rp) + (2 * count);
435 rp = kmalloc(rp_len, GFP_ATOMIC);
436 if (!rp) {
437 read_unlock(&hci_dev_list_lock);
438 return -ENOMEM;
439 }
440
441 count = 0;
442 list_for_each_entry(d, &hci_dev_list, list) {
443 if (hci_dev_test_flag(d, HCI_SETUP) ||
444 hci_dev_test_flag(d, HCI_CONFIG) ||
445 hci_dev_test_flag(d, HCI_USER_CHANNEL))
446 continue;
447
448 /* Devices marked as raw-only are neither configured
449 * nor unconfigured controllers.
450 */
451 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
452 continue;
453
454 if (d->dev_type == HCI_PRIMARY &&
455 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
456 rp->index[count++] = cpu_to_le16(d->id);
457 BT_DBG("Added hci%u", d->id);
458 }
459 }
460
461 rp->num_controllers = cpu_to_le16(count);
462 rp_len = sizeof(*rp) + (2 * count);
463
464 read_unlock(&hci_dev_list_lock);
465
466 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
467 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
468
469 kfree(rp);
470
471 return err;
472 }
473
474 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
475 void *data, u16 data_len)
476 {
477 struct mgmt_rp_read_ext_index_list *rp;
478 struct hci_dev *d;
479 u16 count;
480 int err;
481
482 BT_DBG("sock %p", sk);
483
484 read_lock(&hci_dev_list_lock);
485
486 count = 0;
487 list_for_each_entry(d, &hci_dev_list, list) {
488 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
489 count++;
490 }
491
492 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
493 if (!rp) {
494 read_unlock(&hci_dev_list_lock);
495 return -ENOMEM;
496 }
497
498 count = 0;
499 list_for_each_entry(d, &hci_dev_list, list) {
500 if (hci_dev_test_flag(d, HCI_SETUP) ||
501 hci_dev_test_flag(d, HCI_CONFIG) ||
502 hci_dev_test_flag(d, HCI_USER_CHANNEL))
503 continue;
504
505 /* Devices marked as raw-only are neither configured
506 * nor unconfigured controllers.
507 */
508 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
509 continue;
510
511 if (d->dev_type == HCI_PRIMARY) {
512 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
513 rp->entry[count].type = 0x01;
514 else
515 rp->entry[count].type = 0x00;
516 } else if (d->dev_type == HCI_AMP) {
517 rp->entry[count].type = 0x02;
518 } else {
519 continue;
520 }
521
522 rp->entry[count].bus = d->bus;
523 rp->entry[count++].index = cpu_to_le16(d->id);
524 BT_DBG("Added hci%u", d->id);
525 }
526
527 rp->num_controllers = cpu_to_le16(count);
528
529 read_unlock(&hci_dev_list_lock);
530
531 /* If this command is called at least once, then all the
532 * default index and unconfigured index events are disabled
533 * and from now on only extended index events are used.
534 */
535 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
536 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
537 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
538
539 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
540 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
541 struct_size(rp, entry, count));
542
543 kfree(rp);
544
545 return err;
546 }
547
548 static bool is_configured(struct hci_dev *hdev)
549 {
550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
552 return false;
553
554 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
555 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
556 !bacmp(&hdev->public_addr, BDADDR_ANY))
557 return false;
558
559 return true;
560 }
561
562 static __le32 get_missing_options(struct hci_dev *hdev)
563 {
564 u32 options = 0;
565
566 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
567 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
568 options |= MGMT_OPTION_EXTERNAL_CONFIG;
569
570 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
571 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
572 !bacmp(&hdev->public_addr, BDADDR_ANY))
573 options |= MGMT_OPTION_PUBLIC_ADDRESS;
574
575 return cpu_to_le32(options);
576 }
577
578 static int new_options(struct hci_dev *hdev, struct sock *skip)
579 {
580 __le32 options = get_missing_options(hdev);
581
582 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
583 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
584 }
585
586 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
587 {
588 __le32 options = get_missing_options(hdev);
589
590 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
591 sizeof(options));
592 }
593
594 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
595 void *data, u16 data_len)
596 {
597 struct mgmt_rp_read_config_info rp;
598 u32 options = 0;
599
600 BT_DBG("sock %p %s", sk, hdev->name);
601
602 hci_dev_lock(hdev);
603
604 memset(&rp, 0, sizeof(rp));
605 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
606
607 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
608 options |= MGMT_OPTION_EXTERNAL_CONFIG;
609
610 if (hdev->set_bdaddr)
611 options |= MGMT_OPTION_PUBLIC_ADDRESS;
612
613 rp.supported_options = cpu_to_le32(options);
614 rp.missing_options = get_missing_options(hdev);
615
616 hci_dev_unlock(hdev);
617
618 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
619 &rp, sizeof(rp));
620 }
621
622 static u32 get_supported_phys(struct hci_dev *hdev)
623 {
624 u32 supported_phys = 0;
625
626 if (lmp_bredr_capable(hdev)) {
627 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
628
629 if (hdev->features[0][0] & LMP_3SLOT)
630 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
631
632 if (hdev->features[0][0] & LMP_5SLOT)
633 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
634
635 if (lmp_edr_2m_capable(hdev)) {
636 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
637
638 if (lmp_edr_3slot_capable(hdev))
639 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
640
641 if (lmp_edr_5slot_capable(hdev))
642 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
643
644 if (lmp_edr_3m_capable(hdev)) {
645 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
646
647 if (lmp_edr_3slot_capable(hdev))
648 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
649
650 if (lmp_edr_5slot_capable(hdev))
651 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
652 }
653 }
654 }
655
656 if (lmp_le_capable(hdev)) {
657 supported_phys |= MGMT_PHY_LE_1M_TX;
658 supported_phys |= MGMT_PHY_LE_1M_RX;
659
660 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
661 supported_phys |= MGMT_PHY_LE_2M_TX;
662 supported_phys |= MGMT_PHY_LE_2M_RX;
663 }
664
665 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
666 supported_phys |= MGMT_PHY_LE_CODED_TX;
667 supported_phys |= MGMT_PHY_LE_CODED_RX;
668 }
669 }
670
671 return supported_phys;
672 }
673
674 static u32 get_selected_phys(struct hci_dev *hdev)
675 {
676 u32 selected_phys = 0;
677
678 if (lmp_bredr_capable(hdev)) {
679 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
680
681 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
682 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
683
684 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
685 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
686
687 if (lmp_edr_2m_capable(hdev)) {
688 if (!(hdev->pkt_type & HCI_2DH1))
689 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
690
691 if (lmp_edr_3slot_capable(hdev) &&
692 !(hdev->pkt_type & HCI_2DH3))
693 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
694
695 if (lmp_edr_5slot_capable(hdev) &&
696 !(hdev->pkt_type & HCI_2DH5))
697 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
698
699 if (lmp_edr_3m_capable(hdev)) {
700 if (!(hdev->pkt_type & HCI_3DH1))
701 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
702
703 if (lmp_edr_3slot_capable(hdev) &&
704 !(hdev->pkt_type & HCI_3DH3))
705 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
706
707 if (lmp_edr_5slot_capable(hdev) &&
708 !(hdev->pkt_type & HCI_3DH5))
709 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
710 }
711 }
712 }
713
714 if (lmp_le_capable(hdev)) {
715 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
716 selected_phys |= MGMT_PHY_LE_1M_TX;
717
718 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
719 selected_phys |= MGMT_PHY_LE_1M_RX;
720
721 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
722 selected_phys |= MGMT_PHY_LE_2M_TX;
723
724 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
725 selected_phys |= MGMT_PHY_LE_2M_RX;
726
727 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
728 selected_phys |= MGMT_PHY_LE_CODED_TX;
729
730 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
731 selected_phys |= MGMT_PHY_LE_CODED_RX;
732 }
733
734 return selected_phys;
735 }
736
737 static u32 get_configurable_phys(struct hci_dev *hdev)
738 {
739 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
740 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
741 }
742
743 static u32 get_supported_settings(struct hci_dev *hdev)
744 {
745 u32 settings = 0;
746
747 settings |= MGMT_SETTING_POWERED;
748 settings |= MGMT_SETTING_BONDABLE;
749 settings |= MGMT_SETTING_DEBUG_KEYS;
750 settings |= MGMT_SETTING_CONNECTABLE;
751 settings |= MGMT_SETTING_DISCOVERABLE;
752
753 if (lmp_bredr_capable(hdev)) {
754 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
755 settings |= MGMT_SETTING_FAST_CONNECTABLE;
756 settings |= MGMT_SETTING_BREDR;
757 settings |= MGMT_SETTING_LINK_SECURITY;
758
759 if (lmp_ssp_capable(hdev)) {
760 settings |= MGMT_SETTING_SSP;
761 settings |= MGMT_SETTING_HS;
762 }
763
764 if (lmp_sc_capable(hdev))
765 settings |= MGMT_SETTING_SECURE_CONN;
766
767 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
768 &hdev->quirks))
769 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
770 }
771
772 if (lmp_le_capable(hdev)) {
773 settings |= MGMT_SETTING_LE;
774 settings |= MGMT_SETTING_ADVERTISING;
775 settings |= MGMT_SETTING_SECURE_CONN;
776 settings |= MGMT_SETTING_PRIVACY;
777 settings |= MGMT_SETTING_STATIC_ADDRESS;
778 }
779
780 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
781 hdev->set_bdaddr)
782 settings |= MGMT_SETTING_CONFIGURATION;
783
784 settings |= MGMT_SETTING_PHY_CONFIGURATION;
785
786 return settings;
787 }
788
789 static u32 get_current_settings(struct hci_dev *hdev)
790 {
791 u32 settings = 0;
792
793 if (hdev_is_powered(hdev))
794 settings |= MGMT_SETTING_POWERED;
795
796 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
797 settings |= MGMT_SETTING_CONNECTABLE;
798
799 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
800 settings |= MGMT_SETTING_FAST_CONNECTABLE;
801
802 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
803 settings |= MGMT_SETTING_DISCOVERABLE;
804
805 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
806 settings |= MGMT_SETTING_BONDABLE;
807
808 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
809 settings |= MGMT_SETTING_BREDR;
810
811 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
812 settings |= MGMT_SETTING_LE;
813
814 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
815 settings |= MGMT_SETTING_LINK_SECURITY;
816
817 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
818 settings |= MGMT_SETTING_SSP;
819
820 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
821 settings |= MGMT_SETTING_HS;
822
823 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
824 settings |= MGMT_SETTING_ADVERTISING;
825
826 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
827 settings |= MGMT_SETTING_SECURE_CONN;
828
829 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
830 settings |= MGMT_SETTING_DEBUG_KEYS;
831
832 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
833 settings |= MGMT_SETTING_PRIVACY;
834
835 /* The current setting for static address has two purposes. The
836 * first is to indicate if the static address will be used and
837 * the second is to indicate if it is actually set.
838 *
839 * This means if the static address is not configured, this flag
840 * will never be set. If the address is configured, then if the
841 * address is actually used decides if the flag is set or not.
842 *
843 * For single mode LE only controllers and dual-mode controllers
844 * with BR/EDR disabled, the existence of the static address will
845 * be evaluated.
846 */
847 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
848 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
849 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
850 if (bacmp(&hdev->static_addr, BDADDR_ANY))
851 settings |= MGMT_SETTING_STATIC_ADDRESS;
852 }
853
854 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED))
855 settings |= MGMT_SETTING_WIDEBAND_SPEECH;
856
857 return settings;
858 }
859
860 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
861 {
862 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
863 }
864
865 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
866 struct hci_dev *hdev,
867 const void *data)
868 {
869 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
870 }
871
872 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
873 {
874 struct mgmt_pending_cmd *cmd;
875
876 /* If there's a pending mgmt command the flags will not yet have
877 * their final values, so check for this first.
878 */
879 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
880 if (cmd) {
881 struct mgmt_mode *cp = cmd->param;
882 if (cp->val == 0x01)
883 return LE_AD_GENERAL;
884 else if (cp->val == 0x02)
885 return LE_AD_LIMITED;
886 } else {
887 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
888 return LE_AD_LIMITED;
889 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
890 return LE_AD_GENERAL;
891 }
892
893 return 0;
894 }
895
896 bool mgmt_get_connectable(struct hci_dev *hdev)
897 {
898 struct mgmt_pending_cmd *cmd;
899
900 /* If there's a pending mgmt command the flag will not yet have
901 * it's final value, so check for this first.
902 */
903 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
904 if (cmd) {
905 struct mgmt_mode *cp = cmd->param;
906
907 return cp->val;
908 }
909
910 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
911 }
912
913 static void service_cache_off(struct work_struct *work)
914 {
915 struct hci_dev *hdev = container_of(work, struct hci_dev,
916 service_cache.work);
917 struct hci_request req;
918
919 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
920 return;
921
922 hci_req_init(&req, hdev);
923
924 hci_dev_lock(hdev);
925
926 __hci_req_update_eir(&req);
927 __hci_req_update_class(&req);
928
929 hci_dev_unlock(hdev);
930
931 hci_req_run(&req, NULL);
932 }
933
934 static void rpa_expired(struct work_struct *work)
935 {
936 struct hci_dev *hdev = container_of(work, struct hci_dev,
937 rpa_expired.work);
938 struct hci_request req;
939
940 BT_DBG("");
941
942 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
943
944 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
945 return;
946
947 /* The generation of a new RPA and programming it into the
948 * controller happens in the hci_req_enable_advertising()
949 * function.
950 */
951 hci_req_init(&req, hdev);
952 if (ext_adv_capable(hdev))
953 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
954 else
955 __hci_req_enable_advertising(&req);
956 hci_req_run(&req, NULL);
957 }
958
959 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
960 {
961 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
962 return;
963
964 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
965 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
966
967 /* Non-mgmt controlled devices get this bit set
968 * implicitly so that pairing works for them, however
969 * for mgmt we require user-space to explicitly enable
970 * it
971 */
972 hci_dev_clear_flag(hdev, HCI_BONDABLE);
973 }
974
975 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
976 void *data, u16 data_len)
977 {
978 struct mgmt_rp_read_info rp;
979
980 BT_DBG("sock %p %s", sk, hdev->name);
981
982 hci_dev_lock(hdev);
983
984 memset(&rp, 0, sizeof(rp));
985
986 bacpy(&rp.bdaddr, &hdev->bdaddr);
987
988 rp.version = hdev->hci_ver;
989 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
990
991 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
992 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
993
994 memcpy(rp.dev_class, hdev->dev_class, 3);
995
996 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
997 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
998
999 hci_dev_unlock(hdev);
1000
1001 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1002 sizeof(rp));
1003 }
1004
1005 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1006 {
1007 u16 eir_len = 0;
1008 size_t name_len;
1009
1010 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1011 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1012 hdev->dev_class, 3);
1013
1014 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1015 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1016 hdev->appearance);
1017
1018 name_len = strlen(hdev->dev_name);
1019 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1020 hdev->dev_name, name_len);
1021
1022 name_len = strlen(hdev->short_name);
1023 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1024 hdev->short_name, name_len);
1025
1026 return eir_len;
1027 }
1028
1029 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1030 void *data, u16 data_len)
1031 {
1032 char buf[512];
1033 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1034 u16 eir_len;
1035
1036 BT_DBG("sock %p %s", sk, hdev->name);
1037
1038 memset(&buf, 0, sizeof(buf));
1039
1040 hci_dev_lock(hdev);
1041
1042 bacpy(&rp->bdaddr, &hdev->bdaddr);
1043
1044 rp->version = hdev->hci_ver;
1045 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1046
1047 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1048 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1049
1050
1051 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1052 rp->eir_len = cpu_to_le16(eir_len);
1053
1054 hci_dev_unlock(hdev);
1055
1056 /* If this command is called at least once, then the events
1057 * for class of device and local name changes are disabled
1058 * and only the new extended controller information event
1059 * is used.
1060 */
1061 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1062 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1063 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1064
1065 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1066 sizeof(*rp) + eir_len);
1067 }
1068
1069 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1070 {
1071 char buf[512];
1072 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1073 u16 eir_len;
1074
1075 memset(buf, 0, sizeof(buf));
1076
1077 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1078 ev->eir_len = cpu_to_le16(eir_len);
1079
1080 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1081 sizeof(*ev) + eir_len,
1082 HCI_MGMT_EXT_INFO_EVENTS, skip);
1083 }
1084
1085 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1086 {
1087 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1088
1089 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1090 sizeof(settings));
1091 }
1092
1093 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1094 {
1095 BT_DBG("%s status 0x%02x", hdev->name, status);
1096
1097 if (hci_conn_count(hdev) == 0) {
1098 cancel_delayed_work(&hdev->power_off);
1099 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1100 }
1101 }
1102
1103 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1104 {
1105 struct mgmt_ev_advertising_added ev;
1106
1107 ev.instance = instance;
1108
1109 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1110 }
1111
1112 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1113 u8 instance)
1114 {
1115 struct mgmt_ev_advertising_removed ev;
1116
1117 ev.instance = instance;
1118
1119 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1120 }
1121
1122 static void cancel_adv_timeout(struct hci_dev *hdev)
1123 {
1124 if (hdev->adv_instance_timeout) {
1125 hdev->adv_instance_timeout = 0;
1126 cancel_delayed_work(&hdev->adv_instance_expire);
1127 }
1128 }
1129
1130 static int clean_up_hci_state(struct hci_dev *hdev)
1131 {
1132 struct hci_request req;
1133 struct hci_conn *conn;
1134 bool discov_stopped;
1135 int err;
1136
1137 hci_req_init(&req, hdev);
1138
1139 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1140 test_bit(HCI_PSCAN, &hdev->flags)) {
1141 u8 scan = 0x00;
1142 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1143 }
1144
1145 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1146
1147 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1148 __hci_req_disable_advertising(&req);
1149
1150 discov_stopped = hci_req_stop_discovery(&req);
1151
1152 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1153 /* 0x15 == Terminated due to Power Off */
1154 __hci_abort_conn(&req, conn, 0x15);
1155 }
1156
1157 err = hci_req_run(&req, clean_up_hci_complete);
1158 if (!err && discov_stopped)
1159 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1160
1161 return err;
1162 }
1163
1164 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1165 u16 len)
1166 {
1167 struct mgmt_mode *cp = data;
1168 struct mgmt_pending_cmd *cmd;
1169 int err;
1170
1171 BT_DBG("request for %s", hdev->name);
1172
1173 if (cp->val != 0x00 && cp->val != 0x01)
1174 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1175 MGMT_STATUS_INVALID_PARAMS);
1176
1177 hci_dev_lock(hdev);
1178
1179 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1180 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1181 MGMT_STATUS_BUSY);
1182 goto failed;
1183 }
1184
1185 if (!!cp->val == hdev_is_powered(hdev)) {
1186 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1187 goto failed;
1188 }
1189
1190 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1191 if (!cmd) {
1192 err = -ENOMEM;
1193 goto failed;
1194 }
1195
1196 if (cp->val) {
1197 queue_work(hdev->req_workqueue, &hdev->power_on);
1198 err = 0;
1199 } else {
1200 /* Disconnect connections, stop scans, etc */
1201 err = clean_up_hci_state(hdev);
1202 if (!err)
1203 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1204 HCI_POWER_OFF_TIMEOUT);
1205
1206 /* ENODATA means there were no HCI commands queued */
1207 if (err == -ENODATA) {
1208 cancel_delayed_work(&hdev->power_off);
1209 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1210 err = 0;
1211 }
1212 }
1213
1214 failed:
1215 hci_dev_unlock(hdev);
1216 return err;
1217 }
1218
1219 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1220 {
1221 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1222
1223 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1224 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1225 }
1226
1227 int mgmt_new_settings(struct hci_dev *hdev)
1228 {
1229 return new_settings(hdev, NULL);
1230 }
1231
1232 struct cmd_lookup {
1233 struct sock *sk;
1234 struct hci_dev *hdev;
1235 u8 mgmt_status;
1236 };
1237
1238 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1239 {
1240 struct cmd_lookup *match = data;
1241
1242 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1243
1244 list_del(&cmd->list);
1245
1246 if (match->sk == NULL) {
1247 match->sk = cmd->sk;
1248 sock_hold(match->sk);
1249 }
1250
1251 mgmt_pending_free(cmd);
1252 }
1253
1254 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1255 {
1256 u8 *status = data;
1257
1258 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1259 mgmt_pending_remove(cmd);
1260 }
1261
1262 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1263 {
1264 if (cmd->cmd_complete) {
1265 u8 *status = data;
1266
1267 cmd->cmd_complete(cmd, *status);
1268 mgmt_pending_remove(cmd);
1269
1270 return;
1271 }
1272
1273 cmd_status_rsp(cmd, data);
1274 }
1275
1276 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1277 {
1278 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1279 cmd->param, cmd->param_len);
1280 }
1281
1282 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1283 {
1284 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1285 cmd->param, sizeof(struct mgmt_addr_info));
1286 }
1287
1288 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1289 {
1290 if (!lmp_bredr_capable(hdev))
1291 return MGMT_STATUS_NOT_SUPPORTED;
1292 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1293 return MGMT_STATUS_REJECTED;
1294 else
1295 return MGMT_STATUS_SUCCESS;
1296 }
1297
1298 static u8 mgmt_le_support(struct hci_dev *hdev)
1299 {
1300 if (!lmp_le_capable(hdev))
1301 return MGMT_STATUS_NOT_SUPPORTED;
1302 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1303 return MGMT_STATUS_REJECTED;
1304 else
1305 return MGMT_STATUS_SUCCESS;
1306 }
1307
1308 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1309 {
1310 struct mgmt_pending_cmd *cmd;
1311
1312 BT_DBG("status 0x%02x", status);
1313
1314 hci_dev_lock(hdev);
1315
1316 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1317 if (!cmd)
1318 goto unlock;
1319
1320 if (status) {
1321 u8 mgmt_err = mgmt_status(status);
1322 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1323 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1324 goto remove_cmd;
1325 }
1326
1327 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1328 hdev->discov_timeout > 0) {
1329 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1330 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1331 }
1332
1333 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1334 new_settings(hdev, cmd->sk);
1335
1336 remove_cmd:
1337 mgmt_pending_remove(cmd);
1338
1339 unlock:
1340 hci_dev_unlock(hdev);
1341 }
1342
1343 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1344 u16 len)
1345 {
1346 struct mgmt_cp_set_discoverable *cp = data;
1347 struct mgmt_pending_cmd *cmd;
1348 u16 timeout;
1349 int err;
1350
1351 BT_DBG("request for %s", hdev->name);
1352
1353 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1354 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1355 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1356 MGMT_STATUS_REJECTED);
1357
1358 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1359 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1360 MGMT_STATUS_INVALID_PARAMS);
1361
1362 timeout = __le16_to_cpu(cp->timeout);
1363
1364 /* Disabling discoverable requires that no timeout is set,
1365 * and enabling limited discoverable requires a timeout.
1366 */
1367 if ((cp->val == 0x00 && timeout > 0) ||
1368 (cp->val == 0x02 && timeout == 0))
1369 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1370 MGMT_STATUS_INVALID_PARAMS);
1371
1372 hci_dev_lock(hdev);
1373
1374 if (!hdev_is_powered(hdev) && timeout > 0) {
1375 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1376 MGMT_STATUS_NOT_POWERED);
1377 goto failed;
1378 }
1379
1380 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1381 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1382 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1383 MGMT_STATUS_BUSY);
1384 goto failed;
1385 }
1386
1387 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1388 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1389 MGMT_STATUS_REJECTED);
1390 goto failed;
1391 }
1392
1393 if (hdev->advertising_paused) {
1394 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1395 MGMT_STATUS_BUSY);
1396 goto failed;
1397 }
1398
1399 if (!hdev_is_powered(hdev)) {
1400 bool changed = false;
1401
1402 /* Setting limited discoverable when powered off is
1403 * not a valid operation since it requires a timeout
1404 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1405 */
1406 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1407 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1408 changed = true;
1409 }
1410
1411 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1412 if (err < 0)
1413 goto failed;
1414
1415 if (changed)
1416 err = new_settings(hdev, sk);
1417
1418 goto failed;
1419 }
1420
1421 /* If the current mode is the same, then just update the timeout
1422 * value with the new value. And if only the timeout gets updated,
1423 * then no need for any HCI transactions.
1424 */
1425 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1426 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1427 HCI_LIMITED_DISCOVERABLE)) {
1428 cancel_delayed_work(&hdev->discov_off);
1429 hdev->discov_timeout = timeout;
1430
1431 if (cp->val && hdev->discov_timeout > 0) {
1432 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1433 queue_delayed_work(hdev->req_workqueue,
1434 &hdev->discov_off, to);
1435 }
1436
1437 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1438 goto failed;
1439 }
1440
1441 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1442 if (!cmd) {
1443 err = -ENOMEM;
1444 goto failed;
1445 }
1446
1447 /* Cancel any potential discoverable timeout that might be
1448 * still active and store new timeout value. The arming of
1449 * the timeout happens in the complete handler.
1450 */
1451 cancel_delayed_work(&hdev->discov_off);
1452 hdev->discov_timeout = timeout;
1453
1454 if (cp->val)
1455 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1456 else
1457 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1458
1459 /* Limited discoverable mode */
1460 if (cp->val == 0x02)
1461 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1462 else
1463 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1464
1465 queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1466 err = 0;
1467
1468 failed:
1469 hci_dev_unlock(hdev);
1470 return err;
1471 }
1472
1473 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1474 {
1475 struct mgmt_pending_cmd *cmd;
1476
1477 BT_DBG("status 0x%02x", status);
1478
1479 hci_dev_lock(hdev);
1480
1481 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1482 if (!cmd)
1483 goto unlock;
1484
1485 if (status) {
1486 u8 mgmt_err = mgmt_status(status);
1487 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1488 goto remove_cmd;
1489 }
1490
1491 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1492 new_settings(hdev, cmd->sk);
1493
1494 remove_cmd:
1495 mgmt_pending_remove(cmd);
1496
1497 unlock:
1498 hci_dev_unlock(hdev);
1499 }
1500
1501 static int set_connectable_update_settings(struct hci_dev *hdev,
1502 struct sock *sk, u8 val)
1503 {
1504 bool changed = false;
1505 int err;
1506
1507 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1508 changed = true;
1509
1510 if (val) {
1511 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1512 } else {
1513 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1514 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1515 }
1516
1517 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1518 if (err < 0)
1519 return err;
1520
1521 if (changed) {
1522 hci_req_update_scan(hdev);
1523 hci_update_background_scan(hdev);
1524 return new_settings(hdev, sk);
1525 }
1526
1527 return 0;
1528 }
1529
1530 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1531 u16 len)
1532 {
1533 struct mgmt_mode *cp = data;
1534 struct mgmt_pending_cmd *cmd;
1535 int err;
1536
1537 BT_DBG("request for %s", hdev->name);
1538
1539 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1540 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1541 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1542 MGMT_STATUS_REJECTED);
1543
1544 if (cp->val != 0x00 && cp->val != 0x01)
1545 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1546 MGMT_STATUS_INVALID_PARAMS);
1547
1548 hci_dev_lock(hdev);
1549
1550 if (!hdev_is_powered(hdev)) {
1551 err = set_connectable_update_settings(hdev, sk, cp->val);
1552 goto failed;
1553 }
1554
1555 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1556 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1557 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1558 MGMT_STATUS_BUSY);
1559 goto failed;
1560 }
1561
1562 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1563 if (!cmd) {
1564 err = -ENOMEM;
1565 goto failed;
1566 }
1567
1568 if (cp->val) {
1569 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1570 } else {
1571 if (hdev->discov_timeout > 0)
1572 cancel_delayed_work(&hdev->discov_off);
1573
1574 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1575 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1576 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1577 }
1578
1579 queue_work(hdev->req_workqueue, &hdev->connectable_update);
1580 err = 0;
1581
1582 failed:
1583 hci_dev_unlock(hdev);
1584 return err;
1585 }
1586
1587 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1588 u16 len)
1589 {
1590 struct mgmt_mode *cp = data;
1591 bool changed;
1592 int err;
1593
1594 BT_DBG("request for %s", hdev->name);
1595
1596 if (cp->val != 0x00 && cp->val != 0x01)
1597 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1598 MGMT_STATUS_INVALID_PARAMS);
1599
1600 hci_dev_lock(hdev);
1601
1602 if (cp->val)
1603 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1604 else
1605 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1606
1607 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1608 if (err < 0)
1609 goto unlock;
1610
1611 if (changed) {
1612 /* In limited privacy mode the change of bondable mode
1613 * may affect the local advertising address.
1614 */
1615 if (hdev_is_powered(hdev) &&
1616 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1617 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1618 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1619 queue_work(hdev->req_workqueue,
1620 &hdev->discoverable_update);
1621
1622 err = new_settings(hdev, sk);
1623 }
1624
1625 unlock:
1626 hci_dev_unlock(hdev);
1627 return err;
1628 }
1629
1630 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1631 u16 len)
1632 {
1633 struct mgmt_mode *cp = data;
1634 struct mgmt_pending_cmd *cmd;
1635 u8 val, status;
1636 int err;
1637
1638 BT_DBG("request for %s", hdev->name);
1639
1640 status = mgmt_bredr_support(hdev);
1641 if (status)
1642 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1643 status);
1644
1645 if (cp->val != 0x00 && cp->val != 0x01)
1646 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1647 MGMT_STATUS_INVALID_PARAMS);
1648
1649 hci_dev_lock(hdev);
1650
1651 if (!hdev_is_powered(hdev)) {
1652 bool changed = false;
1653
1654 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1655 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1656 changed = true;
1657 }
1658
1659 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1660 if (err < 0)
1661 goto failed;
1662
1663 if (changed)
1664 err = new_settings(hdev, sk);
1665
1666 goto failed;
1667 }
1668
1669 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1670 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1671 MGMT_STATUS_BUSY);
1672 goto failed;
1673 }
1674
1675 val = !!cp->val;
1676
1677 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1678 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1679 goto failed;
1680 }
1681
1682 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1683 if (!cmd) {
1684 err = -ENOMEM;
1685 goto failed;
1686 }
1687
1688 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1689 if (err < 0) {
1690 mgmt_pending_remove(cmd);
1691 goto failed;
1692 }
1693
1694 failed:
1695 hci_dev_unlock(hdev);
1696 return err;
1697 }
1698
1699 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1700 {
1701 struct mgmt_mode *cp = data;
1702 struct mgmt_pending_cmd *cmd;
1703 u8 status;
1704 int err;
1705
1706 BT_DBG("request for %s", hdev->name);
1707
1708 status = mgmt_bredr_support(hdev);
1709 if (status)
1710 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1711
1712 if (!lmp_ssp_capable(hdev))
1713 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1714 MGMT_STATUS_NOT_SUPPORTED);
1715
1716 if (cp->val != 0x00 && cp->val != 0x01)
1717 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1718 MGMT_STATUS_INVALID_PARAMS);
1719
1720 hci_dev_lock(hdev);
1721
1722 if (!hdev_is_powered(hdev)) {
1723 bool changed;
1724
1725 if (cp->val) {
1726 changed = !hci_dev_test_and_set_flag(hdev,
1727 HCI_SSP_ENABLED);
1728 } else {
1729 changed = hci_dev_test_and_clear_flag(hdev,
1730 HCI_SSP_ENABLED);
1731 if (!changed)
1732 changed = hci_dev_test_and_clear_flag(hdev,
1733 HCI_HS_ENABLED);
1734 else
1735 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1736 }
1737
1738 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1739 if (err < 0)
1740 goto failed;
1741
1742 if (changed)
1743 err = new_settings(hdev, sk);
1744
1745 goto failed;
1746 }
1747
1748 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1749 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1750 MGMT_STATUS_BUSY);
1751 goto failed;
1752 }
1753
1754 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1755 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1756 goto failed;
1757 }
1758
1759 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1760 if (!cmd) {
1761 err = -ENOMEM;
1762 goto failed;
1763 }
1764
1765 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1766 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1767 sizeof(cp->val), &cp->val);
1768
1769 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1770 if (err < 0) {
1771 mgmt_pending_remove(cmd);
1772 goto failed;
1773 }
1774
1775 failed:
1776 hci_dev_unlock(hdev);
1777 return err;
1778 }
1779
1780 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1781 {
1782 struct mgmt_mode *cp = data;
1783 bool changed;
1784 u8 status;
1785 int err;
1786
1787 BT_DBG("request for %s", hdev->name);
1788
1789 status = mgmt_bredr_support(hdev);
1790 if (status)
1791 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1792
1793 if (!lmp_ssp_capable(hdev))
1794 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1795 MGMT_STATUS_NOT_SUPPORTED);
1796
1797 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1798 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1799 MGMT_STATUS_REJECTED);
1800
1801 if (cp->val != 0x00 && cp->val != 0x01)
1802 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803 MGMT_STATUS_INVALID_PARAMS);
1804
1805 hci_dev_lock(hdev);
1806
1807 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1808 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1809 MGMT_STATUS_BUSY);
1810 goto unlock;
1811 }
1812
1813 if (cp->val) {
1814 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1815 } else {
1816 if (hdev_is_powered(hdev)) {
1817 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1818 MGMT_STATUS_REJECTED);
1819 goto unlock;
1820 }
1821
1822 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1823 }
1824
1825 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1826 if (err < 0)
1827 goto unlock;
1828
1829 if (changed)
1830 err = new_settings(hdev, sk);
1831
1832 unlock:
1833 hci_dev_unlock(hdev);
1834 return err;
1835 }
1836
1837 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1838 {
1839 struct cmd_lookup match = { NULL, hdev };
1840
1841 hci_dev_lock(hdev);
1842
1843 if (status) {
1844 u8 mgmt_err = mgmt_status(status);
1845
1846 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1847 &mgmt_err);
1848 goto unlock;
1849 }
1850
1851 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1852
1853 new_settings(hdev, match.sk);
1854
1855 if (match.sk)
1856 sock_put(match.sk);
1857
1858 /* Make sure the controller has a good default for
1859 * advertising data. Restrict the update to when LE
1860 * has actually been enabled. During power on, the
1861 * update in powered_update_hci will take care of it.
1862 */
1863 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1864 struct hci_request req;
1865 hci_req_init(&req, hdev);
1866 if (ext_adv_capable(hdev)) {
1867 int err;
1868
1869 err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1870 if (!err)
1871 __hci_req_update_scan_rsp_data(&req, 0x00);
1872 } else {
1873 __hci_req_update_adv_data(&req, 0x00);
1874 __hci_req_update_scan_rsp_data(&req, 0x00);
1875 }
1876 hci_req_run(&req, NULL);
1877 hci_update_background_scan(hdev);
1878 }
1879
1880 unlock:
1881 hci_dev_unlock(hdev);
1882 }
1883
1884 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1885 {
1886 struct mgmt_mode *cp = data;
1887 struct hci_cp_write_le_host_supported hci_cp;
1888 struct mgmt_pending_cmd *cmd;
1889 struct hci_request req;
1890 int err;
1891 u8 val, enabled;
1892
1893 BT_DBG("request for %s", hdev->name);
1894
1895 if (!lmp_le_capable(hdev))
1896 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1897 MGMT_STATUS_NOT_SUPPORTED);
1898
1899 if (cp->val != 0x00 && cp->val != 0x01)
1900 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1901 MGMT_STATUS_INVALID_PARAMS);
1902
1903 /* Bluetooth single mode LE only controllers or dual-mode
1904 * controllers configured as LE only devices, do not allow
1905 * switching LE off. These have either LE enabled explicitly
1906 * or BR/EDR has been previously switched off.
1907 *
1908 * When trying to enable an already enabled LE, then gracefully
1909 * send a positive response. Trying to disable it however will
1910 * result into rejection.
1911 */
1912 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1913 if (cp->val == 0x01)
1914 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1915
1916 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1917 MGMT_STATUS_REJECTED);
1918 }
1919
1920 hci_dev_lock(hdev);
1921
1922 val = !!cp->val;
1923 enabled = lmp_host_le_capable(hdev);
1924
1925 if (!val)
1926 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1927
1928 if (!hdev_is_powered(hdev) || val == enabled) {
1929 bool changed = false;
1930
1931 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1932 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1933 changed = true;
1934 }
1935
1936 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1937 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1938 changed = true;
1939 }
1940
1941 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1942 if (err < 0)
1943 goto unlock;
1944
1945 if (changed)
1946 err = new_settings(hdev, sk);
1947
1948 goto unlock;
1949 }
1950
1951 if (pending_find(MGMT_OP_SET_LE, hdev) ||
1952 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1953 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1954 MGMT_STATUS_BUSY);
1955 goto unlock;
1956 }
1957
1958 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1959 if (!cmd) {
1960 err = -ENOMEM;
1961 goto unlock;
1962 }
1963
1964 hci_req_init(&req, hdev);
1965
1966 memset(&hci_cp, 0, sizeof(hci_cp));
1967
1968 if (val) {
1969 hci_cp.le = val;
1970 hci_cp.simul = 0x00;
1971 } else {
1972 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1973 __hci_req_disable_advertising(&req);
1974
1975 if (ext_adv_capable(hdev))
1976 __hci_req_clear_ext_adv_sets(&req);
1977 }
1978
1979 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1980 &hci_cp);
1981
1982 err = hci_req_run(&req, le_enable_complete);
1983 if (err < 0)
1984 mgmt_pending_remove(cmd);
1985
1986 unlock:
1987 hci_dev_unlock(hdev);
1988 return err;
1989 }
1990
1991 /* This is a helper function to test for pending mgmt commands that can
1992 * cause CoD or EIR HCI commands. We can only allow one such pending
1993 * mgmt command at a time since otherwise we cannot easily track what
1994 * the current values are, will be, and based on that calculate if a new
1995 * HCI command needs to be sent and if yes with what value.
1996 */
1997 static bool pending_eir_or_class(struct hci_dev *hdev)
1998 {
1999 struct mgmt_pending_cmd *cmd;
2000
2001 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2002 switch (cmd->opcode) {
2003 case MGMT_OP_ADD_UUID:
2004 case MGMT_OP_REMOVE_UUID:
2005 case MGMT_OP_SET_DEV_CLASS:
2006 case MGMT_OP_SET_POWERED:
2007 return true;
2008 }
2009 }
2010
2011 return false;
2012 }
2013
2014 static const u8 bluetooth_base_uuid[] = {
2015 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2016 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2017 };
2018
2019 static u8 get_uuid_size(const u8 *uuid)
2020 {
2021 u32 val;
2022
2023 if (memcmp(uuid, bluetooth_base_uuid, 12))
2024 return 128;
2025
2026 val = get_unaligned_le32(&uuid[12]);
2027 if (val > 0xffff)
2028 return 32;
2029
2030 return 16;
2031 }
2032
2033 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2034 {
2035 struct mgmt_pending_cmd *cmd;
2036
2037 hci_dev_lock(hdev);
2038
2039 cmd = pending_find(mgmt_op, hdev);
2040 if (!cmd)
2041 goto unlock;
2042
2043 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2044 mgmt_status(status), hdev->dev_class, 3);
2045
2046 mgmt_pending_remove(cmd);
2047
2048 unlock:
2049 hci_dev_unlock(hdev);
2050 }
2051
2052 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2053 {
2054 BT_DBG("status 0x%02x", status);
2055
2056 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2057 }
2058
2059 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2060 {
2061 struct mgmt_cp_add_uuid *cp = data;
2062 struct mgmt_pending_cmd *cmd;
2063 struct hci_request req;
2064 struct bt_uuid *uuid;
2065 int err;
2066
2067 BT_DBG("request for %s", hdev->name);
2068
2069 hci_dev_lock(hdev);
2070
2071 if (pending_eir_or_class(hdev)) {
2072 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2073 MGMT_STATUS_BUSY);
2074 goto failed;
2075 }
2076
2077 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2078 if (!uuid) {
2079 err = -ENOMEM;
2080 goto failed;
2081 }
2082
2083 memcpy(uuid->uuid, cp->uuid, 16);
2084 uuid->svc_hint = cp->svc_hint;
2085 uuid->size = get_uuid_size(cp->uuid);
2086
2087 list_add_tail(&uuid->list, &hdev->uuids);
2088
2089 hci_req_init(&req, hdev);
2090
2091 __hci_req_update_class(&req);
2092 __hci_req_update_eir(&req);
2093
2094 err = hci_req_run(&req, add_uuid_complete);
2095 if (err < 0) {
2096 if (err != -ENODATA)
2097 goto failed;
2098
2099 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2100 hdev->dev_class, 3);
2101 goto failed;
2102 }
2103
2104 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2105 if (!cmd) {
2106 err = -ENOMEM;
2107 goto failed;
2108 }
2109
2110 err = 0;
2111
2112 failed:
2113 hci_dev_unlock(hdev);
2114 return err;
2115 }
2116
2117 static bool enable_service_cache(struct hci_dev *hdev)
2118 {
2119 if (!hdev_is_powered(hdev))
2120 return false;
2121
2122 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2123 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2124 CACHE_TIMEOUT);
2125 return true;
2126 }
2127
2128 return false;
2129 }
2130
2131 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2132 {
2133 BT_DBG("status 0x%02x", status);
2134
2135 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2136 }
2137
2138 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2139 u16 len)
2140 {
2141 struct mgmt_cp_remove_uuid *cp = data;
2142 struct mgmt_pending_cmd *cmd;
2143 struct bt_uuid *match, *tmp;
2144 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2145 struct hci_request req;
2146 int err, found;
2147
2148 BT_DBG("request for %s", hdev->name);
2149
2150 hci_dev_lock(hdev);
2151
2152 if (pending_eir_or_class(hdev)) {
2153 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2154 MGMT_STATUS_BUSY);
2155 goto unlock;
2156 }
2157
2158 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2159 hci_uuids_clear(hdev);
2160
2161 if (enable_service_cache(hdev)) {
2162 err = mgmt_cmd_complete(sk, hdev->id,
2163 MGMT_OP_REMOVE_UUID,
2164 0, hdev->dev_class, 3);
2165 goto unlock;
2166 }
2167
2168 goto update_class;
2169 }
2170
2171 found = 0;
2172
2173 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2174 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2175 continue;
2176
2177 list_del(&match->list);
2178 kfree(match);
2179 found++;
2180 }
2181
2182 if (found == 0) {
2183 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2184 MGMT_STATUS_INVALID_PARAMS);
2185 goto unlock;
2186 }
2187
2188 update_class:
2189 hci_req_init(&req, hdev);
2190
2191 __hci_req_update_class(&req);
2192 __hci_req_update_eir(&req);
2193
2194 err = hci_req_run(&req, remove_uuid_complete);
2195 if (err < 0) {
2196 if (err != -ENODATA)
2197 goto unlock;
2198
2199 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2200 hdev->dev_class, 3);
2201 goto unlock;
2202 }
2203
2204 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2205 if (!cmd) {
2206 err = -ENOMEM;
2207 goto unlock;
2208 }
2209
2210 err = 0;
2211
2212 unlock:
2213 hci_dev_unlock(hdev);
2214 return err;
2215 }
2216
2217 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2218 {
2219 BT_DBG("status 0x%02x", status);
2220
2221 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2222 }
2223
2224 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2225 u16 len)
2226 {
2227 struct mgmt_cp_set_dev_class *cp = data;
2228 struct mgmt_pending_cmd *cmd;
2229 struct hci_request req;
2230 int err;
2231
2232 BT_DBG("request for %s", hdev->name);
2233
2234 if (!lmp_bredr_capable(hdev))
2235 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2236 MGMT_STATUS_NOT_SUPPORTED);
2237
2238 hci_dev_lock(hdev);
2239
2240 if (pending_eir_or_class(hdev)) {
2241 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2242 MGMT_STATUS_BUSY);
2243 goto unlock;
2244 }
2245
2246 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2248 MGMT_STATUS_INVALID_PARAMS);
2249 goto unlock;
2250 }
2251
2252 hdev->major_class = cp->major;
2253 hdev->minor_class = cp->minor;
2254
2255 if (!hdev_is_powered(hdev)) {
2256 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2257 hdev->dev_class, 3);
2258 goto unlock;
2259 }
2260
2261 hci_req_init(&req, hdev);
2262
2263 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2264 hci_dev_unlock(hdev);
2265 cancel_delayed_work_sync(&hdev->service_cache);
2266 hci_dev_lock(hdev);
2267 __hci_req_update_eir(&req);
2268 }
2269
2270 __hci_req_update_class(&req);
2271
2272 err = hci_req_run(&req, set_class_complete);
2273 if (err < 0) {
2274 if (err != -ENODATA)
2275 goto unlock;
2276
2277 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2278 hdev->dev_class, 3);
2279 goto unlock;
2280 }
2281
2282 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2283 if (!cmd) {
2284 err = -ENOMEM;
2285 goto unlock;
2286 }
2287
2288 err = 0;
2289
2290 unlock:
2291 hci_dev_unlock(hdev);
2292 return err;
2293 }
2294
2295 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2296 u16 len)
2297 {
2298 struct mgmt_cp_load_link_keys *cp = data;
2299 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2300 sizeof(struct mgmt_link_key_info));
2301 u16 key_count, expected_len;
2302 bool changed;
2303 int i;
2304
2305 BT_DBG("request for %s", hdev->name);
2306
2307 if (!lmp_bredr_capable(hdev))
2308 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309 MGMT_STATUS_NOT_SUPPORTED);
2310
2311 key_count = __le16_to_cpu(cp->key_count);
2312 if (key_count > max_key_count) {
2313 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2314 key_count);
2315 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2316 MGMT_STATUS_INVALID_PARAMS);
2317 }
2318
2319 expected_len = struct_size(cp, keys, key_count);
2320 if (expected_len != len) {
2321 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2322 expected_len, len);
2323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2324 MGMT_STATUS_INVALID_PARAMS);
2325 }
2326
2327 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2328 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2329 MGMT_STATUS_INVALID_PARAMS);
2330
2331 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2332 key_count);
2333
2334 for (i = 0; i < key_count; i++) {
2335 struct mgmt_link_key_info *key = &cp->keys[i];
2336
2337 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2338 return mgmt_cmd_status(sk, hdev->id,
2339 MGMT_OP_LOAD_LINK_KEYS,
2340 MGMT_STATUS_INVALID_PARAMS);
2341 }
2342
2343 hci_dev_lock(hdev);
2344
2345 hci_link_keys_clear(hdev);
2346
2347 if (cp->debug_keys)
2348 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2349 else
2350 changed = hci_dev_test_and_clear_flag(hdev,
2351 HCI_KEEP_DEBUG_KEYS);
2352
2353 if (changed)
2354 new_settings(hdev, NULL);
2355
2356 for (i = 0; i < key_count; i++) {
2357 struct mgmt_link_key_info *key = &cp->keys[i];
2358
2359 if (hci_is_blocked_key(hdev,
2360 HCI_BLOCKED_KEY_TYPE_LINKKEY,
2361 key->val)) {
2362 bt_dev_warn(hdev, "Skipping blocked link key for %pMR",
2363 &key->addr.bdaddr);
2364 continue;
2365 }
2366
2367 /* Always ignore debug keys and require a new pairing if
2368 * the user wants to use them.
2369 */
2370 if (key->type == HCI_LK_DEBUG_COMBINATION)
2371 continue;
2372
2373 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2374 key->type, key->pin_len, NULL);
2375 }
2376
2377 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2378
2379 hci_dev_unlock(hdev);
2380
2381 return 0;
2382 }
2383
2384 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2385 u8 addr_type, struct sock *skip_sk)
2386 {
2387 struct mgmt_ev_device_unpaired ev;
2388
2389 bacpy(&ev.addr.bdaddr, bdaddr);
2390 ev.addr.type = addr_type;
2391
2392 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2393 skip_sk);
2394 }
2395
2396 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2397 u16 len)
2398 {
2399 struct mgmt_cp_unpair_device *cp = data;
2400 struct mgmt_rp_unpair_device rp;
2401 struct hci_conn_params *params;
2402 struct mgmt_pending_cmd *cmd;
2403 struct hci_conn *conn;
2404 u8 addr_type;
2405 int err;
2406
2407 memset(&rp, 0, sizeof(rp));
2408 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2409 rp.addr.type = cp->addr.type;
2410
2411 if (!bdaddr_type_is_valid(cp->addr.type))
2412 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2413 MGMT_STATUS_INVALID_PARAMS,
2414 &rp, sizeof(rp));
2415
2416 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2417 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2418 MGMT_STATUS_INVALID_PARAMS,
2419 &rp, sizeof(rp));
2420
2421 hci_dev_lock(hdev);
2422
2423 if (!hdev_is_powered(hdev)) {
2424 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2425 MGMT_STATUS_NOT_POWERED, &rp,
2426 sizeof(rp));
2427 goto unlock;
2428 }
2429
2430 if (cp->addr.type == BDADDR_BREDR) {
2431 /* If disconnection is requested, then look up the
2432 * connection. If the remote device is connected, it
2433 * will be later used to terminate the link.
2434 *
2435 * Setting it to NULL explicitly will cause no
2436 * termination of the link.
2437 */
2438 if (cp->disconnect)
2439 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2440 &cp->addr.bdaddr);
2441 else
2442 conn = NULL;
2443
2444 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2445 if (err < 0) {
2446 err = mgmt_cmd_complete(sk, hdev->id,
2447 MGMT_OP_UNPAIR_DEVICE,
2448 MGMT_STATUS_NOT_PAIRED, &rp,
2449 sizeof(rp));
2450 goto unlock;
2451 }
2452
2453 goto done;
2454 }
2455
2456 /* LE address type */
2457 addr_type = le_addr_type(cp->addr.type);
2458
2459 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2460 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2461 if (err < 0) {
2462 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2463 MGMT_STATUS_NOT_PAIRED, &rp,
2464 sizeof(rp));
2465 goto unlock;
2466 }
2467
2468 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2469 if (!conn) {
2470 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2471 goto done;
2472 }
2473
2474
2475 /* Defer clearing up the connection parameters until closing to
2476 * give a chance of keeping them if a repairing happens.
2477 */
2478 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2479
2480 /* Disable auto-connection parameters if present */
2481 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2482 if (params) {
2483 if (params->explicit_connect)
2484 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2485 else
2486 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2487 }
2488
2489 /* If disconnection is not requested, then clear the connection
2490 * variable so that the link is not terminated.
2491 */
2492 if (!cp->disconnect)
2493 conn = NULL;
2494
2495 done:
2496 /* If the connection variable is set, then termination of the
2497 * link is requested.
2498 */
2499 if (!conn) {
2500 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2501 &rp, sizeof(rp));
2502 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2503 goto unlock;
2504 }
2505
2506 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2507 sizeof(*cp));
2508 if (!cmd) {
2509 err = -ENOMEM;
2510 goto unlock;
2511 }
2512
2513 cmd->cmd_complete = addr_cmd_complete;
2514
2515 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2516 if (err < 0)
2517 mgmt_pending_remove(cmd);
2518
2519 unlock:
2520 hci_dev_unlock(hdev);
2521 return err;
2522 }
2523
2524 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2525 u16 len)
2526 {
2527 struct mgmt_cp_disconnect *cp = data;
2528 struct mgmt_rp_disconnect rp;
2529 struct mgmt_pending_cmd *cmd;
2530 struct hci_conn *conn;
2531 int err;
2532
2533 BT_DBG("");
2534
2535 memset(&rp, 0, sizeof(rp));
2536 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2537 rp.addr.type = cp->addr.type;
2538
2539 if (!bdaddr_type_is_valid(cp->addr.type))
2540 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2541 MGMT_STATUS_INVALID_PARAMS,
2542 &rp, sizeof(rp));
2543
2544 hci_dev_lock(hdev);
2545
2546 if (!test_bit(HCI_UP, &hdev->flags)) {
2547 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2548 MGMT_STATUS_NOT_POWERED, &rp,
2549 sizeof(rp));
2550 goto failed;
2551 }
2552
2553 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2554 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2555 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2556 goto failed;
2557 }
2558
2559 if (cp->addr.type == BDADDR_BREDR)
2560 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2561 &cp->addr.bdaddr);
2562 else
2563 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2564 le_addr_type(cp->addr.type));
2565
2566 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2567 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2568 MGMT_STATUS_NOT_CONNECTED, &rp,
2569 sizeof(rp));
2570 goto failed;
2571 }
2572
2573 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2574 if (!cmd) {
2575 err = -ENOMEM;
2576 goto failed;
2577 }
2578
2579 cmd->cmd_complete = generic_cmd_complete;
2580
2581 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2582 if (err < 0)
2583 mgmt_pending_remove(cmd);
2584
2585 failed:
2586 hci_dev_unlock(hdev);
2587 return err;
2588 }
2589
2590 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2591 {
2592 switch (link_type) {
2593 case LE_LINK:
2594 switch (addr_type) {
2595 case ADDR_LE_DEV_PUBLIC:
2596 return BDADDR_LE_PUBLIC;
2597
2598 default:
2599 /* Fallback to LE Random address type */
2600 return BDADDR_LE_RANDOM;
2601 }
2602
2603 default:
2604 /* Fallback to BR/EDR type */
2605 return BDADDR_BREDR;
2606 }
2607 }
2608
2609 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2610 u16 data_len)
2611 {
2612 struct mgmt_rp_get_connections *rp;
2613 struct hci_conn *c;
2614 int err;
2615 u16 i;
2616
2617 BT_DBG("");
2618
2619 hci_dev_lock(hdev);
2620
2621 if (!hdev_is_powered(hdev)) {
2622 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2623 MGMT_STATUS_NOT_POWERED);
2624 goto unlock;
2625 }
2626
2627 i = 0;
2628 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2629 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2630 i++;
2631 }
2632
2633 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2634 if (!rp) {
2635 err = -ENOMEM;
2636 goto unlock;
2637 }
2638
2639 i = 0;
2640 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2641 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2642 continue;
2643 bacpy(&rp->addr[i].bdaddr, &c->dst);
2644 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2645 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2646 continue;
2647 i++;
2648 }
2649
2650 rp->conn_count = cpu_to_le16(i);
2651
2652 /* Recalculate length in case of filtered SCO connections, etc */
2653 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2654 struct_size(rp, addr, i));
2655
2656 kfree(rp);
2657
2658 unlock:
2659 hci_dev_unlock(hdev);
2660 return err;
2661 }
2662
2663 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2664 struct mgmt_cp_pin_code_neg_reply *cp)
2665 {
2666 struct mgmt_pending_cmd *cmd;
2667 int err;
2668
2669 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2670 sizeof(*cp));
2671 if (!cmd)
2672 return -ENOMEM;
2673
2674 cmd->cmd_complete = addr_cmd_complete;
2675
2676 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2677 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2678 if (err < 0)
2679 mgmt_pending_remove(cmd);
2680
2681 return err;
2682 }
2683
2684 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2685 u16 len)
2686 {
2687 struct hci_conn *conn;
2688 struct mgmt_cp_pin_code_reply *cp = data;
2689 struct hci_cp_pin_code_reply reply;
2690 struct mgmt_pending_cmd *cmd;
2691 int err;
2692
2693 BT_DBG("");
2694
2695 hci_dev_lock(hdev);
2696
2697 if (!hdev_is_powered(hdev)) {
2698 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2699 MGMT_STATUS_NOT_POWERED);
2700 goto failed;
2701 }
2702
2703 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2704 if (!conn) {
2705 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2706 MGMT_STATUS_NOT_CONNECTED);
2707 goto failed;
2708 }
2709
2710 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2711 struct mgmt_cp_pin_code_neg_reply ncp;
2712
2713 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2714
2715 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2716
2717 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2718 if (err >= 0)
2719 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2720 MGMT_STATUS_INVALID_PARAMS);
2721
2722 goto failed;
2723 }
2724
2725 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2726 if (!cmd) {
2727 err = -ENOMEM;
2728 goto failed;
2729 }
2730
2731 cmd->cmd_complete = addr_cmd_complete;
2732
2733 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2734 reply.pin_len = cp->pin_len;
2735 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2736
2737 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2738 if (err < 0)
2739 mgmt_pending_remove(cmd);
2740
2741 failed:
2742 hci_dev_unlock(hdev);
2743 return err;
2744 }
2745
2746 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2747 u16 len)
2748 {
2749 struct mgmt_cp_set_io_capability *cp = data;
2750
2751 BT_DBG("");
2752
2753 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2755 MGMT_STATUS_INVALID_PARAMS);
2756
2757 hci_dev_lock(hdev);
2758
2759 hdev->io_capability = cp->io_capability;
2760
2761 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2762 hdev->io_capability);
2763
2764 hci_dev_unlock(hdev);
2765
2766 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2767 NULL, 0);
2768 }
2769
2770 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2771 {
2772 struct hci_dev *hdev = conn->hdev;
2773 struct mgmt_pending_cmd *cmd;
2774
2775 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2776 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2777 continue;
2778
2779 if (cmd->user_data != conn)
2780 continue;
2781
2782 return cmd;
2783 }
2784
2785 return NULL;
2786 }
2787
2788 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2789 {
2790 struct mgmt_rp_pair_device rp;
2791 struct hci_conn *conn = cmd->user_data;
2792 int err;
2793
2794 bacpy(&rp.addr.bdaddr, &conn->dst);
2795 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2796
2797 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2798 status, &rp, sizeof(rp));
2799
2800 /* So we don't get further callbacks for this connection */
2801 conn->connect_cfm_cb = NULL;
2802 conn->security_cfm_cb = NULL;
2803 conn->disconn_cfm_cb = NULL;
2804
2805 hci_conn_drop(conn);
2806
2807 /* The device is paired so there is no need to remove
2808 * its connection parameters anymore.
2809 */
2810 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2811
2812 hci_conn_put(conn);
2813
2814 return err;
2815 }
2816
2817 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2818 {
2819 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2820 struct mgmt_pending_cmd *cmd;
2821
2822 cmd = find_pairing(conn);
2823 if (cmd) {
2824 cmd->cmd_complete(cmd, status);
2825 mgmt_pending_remove(cmd);
2826 }
2827 }
2828
2829 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2830 {
2831 struct mgmt_pending_cmd *cmd;
2832
2833 BT_DBG("status %u", status);
2834
2835 cmd = find_pairing(conn);
2836 if (!cmd) {
2837 BT_DBG("Unable to find a pending command");
2838 return;
2839 }
2840
2841 cmd->cmd_complete(cmd, mgmt_status(status));
2842 mgmt_pending_remove(cmd);
2843 }
2844
2845 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2846 {
2847 struct mgmt_pending_cmd *cmd;
2848
2849 BT_DBG("status %u", status);
2850
2851 if (!status)
2852 return;
2853
2854 cmd = find_pairing(conn);
2855 if (!cmd) {
2856 BT_DBG("Unable to find a pending command");
2857 return;
2858 }
2859
2860 cmd->cmd_complete(cmd, mgmt_status(status));
2861 mgmt_pending_remove(cmd);
2862 }
2863
2864 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2865 u16 len)
2866 {
2867 struct mgmt_cp_pair_device *cp = data;
2868 struct mgmt_rp_pair_device rp;
2869 struct mgmt_pending_cmd *cmd;
2870 u8 sec_level, auth_type;
2871 struct hci_conn *conn;
2872 int err;
2873
2874 BT_DBG("");
2875
2876 memset(&rp, 0, sizeof(rp));
2877 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2878 rp.addr.type = cp->addr.type;
2879
2880 if (!bdaddr_type_is_valid(cp->addr.type))
2881 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2882 MGMT_STATUS_INVALID_PARAMS,
2883 &rp, sizeof(rp));
2884
2885 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2886 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2887 MGMT_STATUS_INVALID_PARAMS,
2888 &rp, sizeof(rp));
2889
2890 hci_dev_lock(hdev);
2891
2892 if (!hdev_is_powered(hdev)) {
2893 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2894 MGMT_STATUS_NOT_POWERED, &rp,
2895 sizeof(rp));
2896 goto unlock;
2897 }
2898
2899 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2900 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2901 MGMT_STATUS_ALREADY_PAIRED, &rp,
2902 sizeof(rp));
2903 goto unlock;
2904 }
2905
2906 sec_level = BT_SECURITY_MEDIUM;
2907 auth_type = HCI_AT_DEDICATED_BONDING;
2908
2909 if (cp->addr.type == BDADDR_BREDR) {
2910 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2911 auth_type);
2912 } else {
2913 u8 addr_type = le_addr_type(cp->addr.type);
2914 struct hci_conn_params *p;
2915
2916 /* When pairing a new device, it is expected to remember
2917 * this device for future connections. Adding the connection
2918 * parameter information ahead of time allows tracking
2919 * of the slave preferred values and will speed up any
2920 * further connection establishment.
2921 *
2922 * If connection parameters already exist, then they
2923 * will be kept and this function does nothing.
2924 */
2925 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2926
2927 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2928 p->auto_connect = HCI_AUTO_CONN_DISABLED;
2929
2930 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2931 addr_type, sec_level,
2932 HCI_LE_CONN_TIMEOUT);
2933 }
2934
2935 if (IS_ERR(conn)) {
2936 int status;
2937
2938 if (PTR_ERR(conn) == -EBUSY)
2939 status = MGMT_STATUS_BUSY;
2940 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2941 status = MGMT_STATUS_NOT_SUPPORTED;
2942 else if (PTR_ERR(conn) == -ECONNREFUSED)
2943 status = MGMT_STATUS_REJECTED;
2944 else
2945 status = MGMT_STATUS_CONNECT_FAILED;
2946
2947 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2948 status, &rp, sizeof(rp));
2949 goto unlock;
2950 }
2951
2952 if (conn->connect_cfm_cb) {
2953 hci_conn_drop(conn);
2954 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2955 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2956 goto unlock;
2957 }
2958
2959 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2960 if (!cmd) {
2961 err = -ENOMEM;
2962 hci_conn_drop(conn);
2963 goto unlock;
2964 }
2965
2966 cmd->cmd_complete = pairing_complete;
2967
2968 /* For LE, just connecting isn't a proof that the pairing finished */
2969 if (cp->addr.type == BDADDR_BREDR) {
2970 conn->connect_cfm_cb = pairing_complete_cb;
2971 conn->security_cfm_cb = pairing_complete_cb;
2972 conn->disconn_cfm_cb = pairing_complete_cb;
2973 } else {
2974 conn->connect_cfm_cb = le_pairing_complete_cb;
2975 conn->security_cfm_cb = le_pairing_complete_cb;
2976 conn->disconn_cfm_cb = le_pairing_complete_cb;
2977 }
2978
2979 conn->io_capability = cp->io_cap;
2980 cmd->user_data = hci_conn_get(conn);
2981
2982 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2983 hci_conn_security(conn, sec_level, auth_type, true)) {
2984 cmd->cmd_complete(cmd, 0);
2985 mgmt_pending_remove(cmd);
2986 }
2987
2988 err = 0;
2989
2990 unlock:
2991 hci_dev_unlock(hdev);
2992 return err;
2993 }
2994
2995 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2996 u16 len)
2997 {
2998 struct mgmt_addr_info *addr = data;
2999 struct mgmt_pending_cmd *cmd;
3000 struct hci_conn *conn;
3001 int err;
3002
3003 BT_DBG("");
3004
3005 hci_dev_lock(hdev);
3006
3007 if (!hdev_is_powered(hdev)) {
3008 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3009 MGMT_STATUS_NOT_POWERED);
3010 goto unlock;
3011 }
3012
3013 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3014 if (!cmd) {
3015 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3016 MGMT_STATUS_INVALID_PARAMS);
3017 goto unlock;
3018 }
3019
3020 conn = cmd->user_data;
3021
3022 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3023 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3024 MGMT_STATUS_INVALID_PARAMS);
3025 goto unlock;
3026 }
3027
3028 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3029 mgmt_pending_remove(cmd);
3030
3031 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3032 addr, sizeof(*addr));
3033 unlock:
3034 hci_dev_unlock(hdev);
3035 return err;
3036 }
3037
3038 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3039 struct mgmt_addr_info *addr, u16 mgmt_op,
3040 u16 hci_op, __le32 passkey)
3041 {
3042 struct mgmt_pending_cmd *cmd;
3043 struct hci_conn *conn;
3044 int err;
3045
3046 hci_dev_lock(hdev);
3047
3048 if (!hdev_is_powered(hdev)) {
3049 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3050 MGMT_STATUS_NOT_POWERED, addr,
3051 sizeof(*addr));
3052 goto done;
3053 }
3054
3055 if (addr->type == BDADDR_BREDR)
3056 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3057 else
3058 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3059 le_addr_type(addr->type));
3060
3061 if (!conn) {
3062 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3063 MGMT_STATUS_NOT_CONNECTED, addr,
3064 sizeof(*addr));
3065 goto done;
3066 }
3067
3068 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3069 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3070 if (!err)
3071 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3072 MGMT_STATUS_SUCCESS, addr,
3073 sizeof(*addr));
3074 else
3075 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3076 MGMT_STATUS_FAILED, addr,
3077 sizeof(*addr));
3078
3079 goto done;
3080 }
3081
3082 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3083 if (!cmd) {
3084 err = -ENOMEM;
3085 goto done;
3086 }
3087
3088 cmd->cmd_complete = addr_cmd_complete;
3089
3090 /* Continue with pairing via HCI */
3091 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3092 struct hci_cp_user_passkey_reply cp;
3093
3094 bacpy(&cp.bdaddr, &addr->bdaddr);
3095 cp.passkey = passkey;
3096 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3097 } else
3098 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3099 &addr->bdaddr);
3100
3101 if (err < 0)
3102 mgmt_pending_remove(cmd);
3103
3104 done:
3105 hci_dev_unlock(hdev);
3106 return err;
3107 }
3108
3109 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3110 void *data, u16 len)
3111 {
3112 struct mgmt_cp_pin_code_neg_reply *cp = data;
3113
3114 BT_DBG("");
3115
3116 return user_pairing_resp(sk, hdev, &cp->addr,
3117 MGMT_OP_PIN_CODE_NEG_REPLY,
3118 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3119 }
3120
3121 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3122 u16 len)
3123 {
3124 struct mgmt_cp_user_confirm_reply *cp = data;
3125
3126 BT_DBG("");
3127
3128 if (len != sizeof(*cp))
3129 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3130 MGMT_STATUS_INVALID_PARAMS);
3131
3132 return user_pairing_resp(sk, hdev, &cp->addr,
3133 MGMT_OP_USER_CONFIRM_REPLY,
3134 HCI_OP_USER_CONFIRM_REPLY, 0);
3135 }
3136
3137 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3138 void *data, u16 len)
3139 {
3140 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3141
3142 BT_DBG("");
3143
3144 return user_pairing_resp(sk, hdev, &cp->addr,
3145 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3146 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3147 }
3148
3149 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3150 u16 len)
3151 {
3152 struct mgmt_cp_user_passkey_reply *cp = data;
3153
3154 BT_DBG("");
3155
3156 return user_pairing_resp(sk, hdev, &cp->addr,
3157 MGMT_OP_USER_PASSKEY_REPLY,
3158 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3159 }
3160
3161 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3162 void *data, u16 len)
3163 {
3164 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3165
3166 BT_DBG("");
3167
3168 return user_pairing_resp(sk, hdev, &cp->addr,
3169 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3170 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3171 }
3172
3173 static void adv_expire(struct hci_dev *hdev, u32 flags)
3174 {
3175 struct adv_info *adv_instance;
3176 struct hci_request req;
3177 int err;
3178
3179 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3180 if (!adv_instance)
3181 return;
3182
3183 /* stop if current instance doesn't need to be changed */
3184 if (!(adv_instance->flags & flags))
3185 return;
3186
3187 cancel_adv_timeout(hdev);
3188
3189 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3190 if (!adv_instance)
3191 return;
3192
3193 hci_req_init(&req, hdev);
3194 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3195 true);
3196 if (err)
3197 return;
3198
3199 hci_req_run(&req, NULL);
3200 }
3201
3202 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3203 {
3204 struct mgmt_cp_set_local_name *cp;
3205 struct mgmt_pending_cmd *cmd;
3206
3207 BT_DBG("status 0x%02x", status);
3208
3209 hci_dev_lock(hdev);
3210
3211 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3212 if (!cmd)
3213 goto unlock;
3214
3215 cp = cmd->param;
3216
3217 if (status) {
3218 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3219 mgmt_status(status));
3220 } else {
3221 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3222 cp, sizeof(*cp));
3223
3224 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3225 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3226 }
3227
3228 mgmt_pending_remove(cmd);
3229
3230 unlock:
3231 hci_dev_unlock(hdev);
3232 }
3233
3234 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3235 u16 len)
3236 {
3237 struct mgmt_cp_set_local_name *cp = data;
3238 struct mgmt_pending_cmd *cmd;
3239 struct hci_request req;
3240 int err;
3241
3242 BT_DBG("");
3243
3244 hci_dev_lock(hdev);
3245
3246 /* If the old values are the same as the new ones just return a
3247 * direct command complete event.
3248 */
3249 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3250 !memcmp(hdev->short_name, cp->short_name,
3251 sizeof(hdev->short_name))) {
3252 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3253 data, len);
3254 goto failed;
3255 }
3256
3257 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3258
3259 if (!hdev_is_powered(hdev)) {
3260 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3261
3262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3263 data, len);
3264 if (err < 0)
3265 goto failed;
3266
3267 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3268 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3269 ext_info_changed(hdev, sk);
3270
3271 goto failed;
3272 }
3273
3274 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3275 if (!cmd) {
3276 err = -ENOMEM;
3277 goto failed;
3278 }
3279
3280 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3281
3282 hci_req_init(&req, hdev);
3283
3284 if (lmp_bredr_capable(hdev)) {
3285 __hci_req_update_name(&req);
3286 __hci_req_update_eir(&req);
3287 }
3288
3289 /* The name is stored in the scan response data and so
3290 * no need to udpate the advertising data here.
3291 */
3292 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3293 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3294
3295 err = hci_req_run(&req, set_name_complete);
3296 if (err < 0)
3297 mgmt_pending_remove(cmd);
3298
3299 failed:
3300 hci_dev_unlock(hdev);
3301 return err;
3302 }
3303
3304 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3305 u16 len)
3306 {
3307 struct mgmt_cp_set_appearance *cp = data;
3308 u16 appearance;
3309 int err;
3310
3311 BT_DBG("");
3312
3313 if (!lmp_le_capable(hdev))
3314 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3315 MGMT_STATUS_NOT_SUPPORTED);
3316
3317 appearance = le16_to_cpu(cp->appearance);
3318
3319 hci_dev_lock(hdev);
3320
3321 if (hdev->appearance != appearance) {
3322 hdev->appearance = appearance;
3323
3324 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3325 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3326
3327 ext_info_changed(hdev, sk);
3328 }
3329
3330 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3331 0);
3332
3333 hci_dev_unlock(hdev);
3334
3335 return err;
3336 }
3337
3338 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3339 void *data, u16 len)
3340 {
3341 struct mgmt_rp_get_phy_confguration rp;
3342
3343 BT_DBG("sock %p %s", sk, hdev->name);
3344
3345 hci_dev_lock(hdev);
3346
3347 memset(&rp, 0, sizeof(rp));
3348
3349 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3350 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3351 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3352
3353 hci_dev_unlock(hdev);
3354
3355 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3356 &rp, sizeof(rp));
3357 }
3358
3359 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3360 {
3361 struct mgmt_ev_phy_configuration_changed ev;
3362
3363 memset(&ev, 0, sizeof(ev));
3364
3365 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3366
3367 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3368 sizeof(ev), skip);
3369 }
3370
3371 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3372 u16 opcode, struct sk_buff *skb)
3373 {
3374 struct mgmt_pending_cmd *cmd;
3375
3376 BT_DBG("status 0x%02x", status);
3377
3378 hci_dev_lock(hdev);
3379
3380 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3381 if (!cmd)
3382 goto unlock;
3383
3384 if (status) {
3385 mgmt_cmd_status(cmd->sk, hdev->id,
3386 MGMT_OP_SET_PHY_CONFIGURATION,
3387 mgmt_status(status));
3388 } else {
3389 mgmt_cmd_complete(cmd->sk, hdev->id,
3390 MGMT_OP_SET_PHY_CONFIGURATION, 0,
3391 NULL, 0);
3392
3393 mgmt_phy_configuration_changed(hdev, cmd->sk);
3394 }
3395
3396 mgmt_pending_remove(cmd);
3397
3398 unlock:
3399 hci_dev_unlock(hdev);
3400 }
3401
3402 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3403 void *data, u16 len)
3404 {
3405 struct mgmt_cp_set_phy_confguration *cp = data;
3406 struct hci_cp_le_set_default_phy cp_phy;
3407 struct mgmt_pending_cmd *cmd;
3408 struct hci_request req;
3409 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3410 u16 pkt_type = (HCI_DH1 | HCI_DM1);
3411 bool changed = false;
3412 int err;
3413
3414 BT_DBG("sock %p %s", sk, hdev->name);
3415
3416 configurable_phys = get_configurable_phys(hdev);
3417 supported_phys = get_supported_phys(hdev);
3418 selected_phys = __le32_to_cpu(cp->selected_phys);
3419
3420 if (selected_phys & ~supported_phys)
3421 return mgmt_cmd_status(sk, hdev->id,
3422 MGMT_OP_SET_PHY_CONFIGURATION,
3423 MGMT_STATUS_INVALID_PARAMS);
3424
3425 unconfigure_phys = supported_phys & ~configurable_phys;
3426
3427 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3428 return mgmt_cmd_status(sk, hdev->id,
3429 MGMT_OP_SET_PHY_CONFIGURATION,
3430 MGMT_STATUS_INVALID_PARAMS);
3431
3432 if (selected_phys == get_selected_phys(hdev))
3433 return mgmt_cmd_complete(sk, hdev->id,
3434 MGMT_OP_SET_PHY_CONFIGURATION,
3435 0, NULL, 0);
3436
3437 hci_dev_lock(hdev);
3438
3439 if (!hdev_is_powered(hdev)) {
3440 err = mgmt_cmd_status(sk, hdev->id,
3441 MGMT_OP_SET_PHY_CONFIGURATION,
3442 MGMT_STATUS_REJECTED);
3443 goto unlock;
3444 }
3445
3446 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3447 err = mgmt_cmd_status(sk, hdev->id,
3448 MGMT_OP_SET_PHY_CONFIGURATION,
3449 MGMT_STATUS_BUSY);
3450 goto unlock;
3451 }
3452
3453 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3454 pkt_type |= (HCI_DH3 | HCI_DM3);
3455 else
3456 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3457
3458 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3459 pkt_type |= (HCI_DH5 | HCI_DM5);
3460 else
3461 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3462
3463 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3464 pkt_type &= ~HCI_2DH1;
3465 else
3466 pkt_type |= HCI_2DH1;
3467
3468 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3469 pkt_type &= ~HCI_2DH3;
3470 else
3471 pkt_type |= HCI_2DH3;
3472
3473 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3474 pkt_type &= ~HCI_2DH5;
3475 else
3476 pkt_type |= HCI_2DH5;
3477
3478 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3479 pkt_type &= ~HCI_3DH1;
3480 else
3481 pkt_type |= HCI_3DH1;
3482
3483 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3484 pkt_type &= ~HCI_3DH3;
3485 else
3486 pkt_type |= HCI_3DH3;
3487
3488 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3489 pkt_type &= ~HCI_3DH5;
3490 else
3491 pkt_type |= HCI_3DH5;
3492
3493 if (pkt_type != hdev->pkt_type) {
3494 hdev->pkt_type = pkt_type;
3495 changed = true;
3496 }
3497
3498 if ((selected_phys & MGMT_PHY_LE_MASK) ==
3499 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3500 if (changed)
3501 mgmt_phy_configuration_changed(hdev, sk);
3502
3503 err = mgmt_cmd_complete(sk, hdev->id,
3504 MGMT_OP_SET_PHY_CONFIGURATION,
3505 0, NULL, 0);
3506
3507 goto unlock;
3508 }
3509
3510 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3511 len);
3512 if (!cmd) {
3513 err = -ENOMEM;
3514 goto unlock;
3515 }
3516
3517 hci_req_init(&req, hdev);
3518
3519 memset(&cp_phy, 0, sizeof(cp_phy));
3520
3521 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3522 cp_phy.all_phys |= 0x01;
3523
3524 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3525 cp_phy.all_phys |= 0x02;
3526
3527 if (selected_phys & MGMT_PHY_LE_1M_TX)
3528 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3529
3530 if (selected_phys & MGMT_PHY_LE_2M_TX)
3531 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3532
3533 if (selected_phys & MGMT_PHY_LE_CODED_TX)
3534 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3535
3536 if (selected_phys & MGMT_PHY_LE_1M_RX)
3537 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3538
3539 if (selected_phys & MGMT_PHY_LE_2M_RX)
3540 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3541
3542 if (selected_phys & MGMT_PHY_LE_CODED_RX)
3543 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3544
3545 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3546
3547 err = hci_req_run_skb(&req, set_default_phy_complete);
3548 if (err < 0)
3549 mgmt_pending_remove(cmd);
3550
3551 unlock:
3552 hci_dev_unlock(hdev);
3553
3554 return err;
3555 }
3556
3557 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data,
3558 u16 len)
3559 {
3560 int err = MGMT_STATUS_SUCCESS;
3561 struct mgmt_cp_set_blocked_keys *keys = data;
3562 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) /
3563 sizeof(struct mgmt_blocked_key_info));
3564 u16 key_count, expected_len;
3565 int i;
3566
3567 BT_DBG("request for %s", hdev->name);
3568
3569 key_count = __le16_to_cpu(keys->key_count);
3570 if (key_count > max_key_count) {
3571 bt_dev_err(hdev, "too big key_count value %u", key_count);
3572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3573 MGMT_STATUS_INVALID_PARAMS);
3574 }
3575
3576 expected_len = struct_size(keys, keys, key_count);
3577 if (expected_len != len) {
3578 bt_dev_err(hdev, "expected %u bytes, got %u bytes",
3579 expected_len, len);
3580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3581 MGMT_STATUS_INVALID_PARAMS);
3582 }
3583
3584 hci_dev_lock(hdev);
3585
3586 hci_blocked_keys_clear(hdev);
3587
3588 for (i = 0; i < keys->key_count; ++i) {
3589 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL);
3590
3591 if (!b) {
3592 err = MGMT_STATUS_NO_RESOURCES;
3593 break;
3594 }
3595
3596 b->type = keys->keys[i].type;
3597 memcpy(b->val, keys->keys[i].val, sizeof(b->val));
3598 list_add_rcu(&b->list, &hdev->blocked_keys);
3599 }
3600 hci_dev_unlock(hdev);
3601
3602 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS,
3603 err, NULL, 0);
3604 }
3605
3606 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev,
3607 void *data, u16 len)
3608 {
3609 struct mgmt_mode *cp = data;
3610 int err;
3611 bool changed = false;
3612
3613 BT_DBG("request for %s", hdev->name);
3614
3615 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks))
3616 return mgmt_cmd_status(sk, hdev->id,
3617 MGMT_OP_SET_WIDEBAND_SPEECH,
3618 MGMT_STATUS_NOT_SUPPORTED);
3619
3620 if (cp->val != 0x00 && cp->val != 0x01)
3621 return mgmt_cmd_status(sk, hdev->id,
3622 MGMT_OP_SET_WIDEBAND_SPEECH,
3623 MGMT_STATUS_INVALID_PARAMS);
3624
3625 hci_dev_lock(hdev);
3626
3627 if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) {
3628 err = mgmt_cmd_status(sk, hdev->id,
3629 MGMT_OP_SET_WIDEBAND_SPEECH,
3630 MGMT_STATUS_BUSY);
3631 goto unlock;
3632 }
3633
3634 if (hdev_is_powered(hdev) &&
3635 !!cp->val != hci_dev_test_flag(hdev,
3636 HCI_WIDEBAND_SPEECH_ENABLED)) {
3637 err = mgmt_cmd_status(sk, hdev->id,
3638 MGMT_OP_SET_WIDEBAND_SPEECH,
3639 MGMT_STATUS_REJECTED);
3640 goto unlock;
3641 }
3642
3643 if (cp->val)
3644 changed = !hci_dev_test_and_set_flag(hdev,
3645 HCI_WIDEBAND_SPEECH_ENABLED);
3646 else
3647 changed = hci_dev_test_and_clear_flag(hdev,
3648 HCI_WIDEBAND_SPEECH_ENABLED);
3649
3650 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev);
3651 if (err < 0)
3652 goto unlock;
3653
3654 if (changed)
3655 err = new_settings(hdev, sk);
3656
3657 unlock:
3658 hci_dev_unlock(hdev);
3659 return err;
3660 }
3661
3662 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3663 u16 opcode, struct sk_buff *skb)
3664 {
3665 struct mgmt_rp_read_local_oob_data mgmt_rp;
3666 size_t rp_size = sizeof(mgmt_rp);
3667 struct mgmt_pending_cmd *cmd;
3668
3669 BT_DBG("%s status %u", hdev->name, status);
3670
3671 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3672 if (!cmd)
3673 return;
3674
3675 if (status || !skb) {
3676 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3677 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3678 goto remove;
3679 }
3680
3681 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3682
3683 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3684 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3685
3686 if (skb->len < sizeof(*rp)) {
3687 mgmt_cmd_status(cmd->sk, hdev->id,
3688 MGMT_OP_READ_LOCAL_OOB_DATA,
3689 MGMT_STATUS_FAILED);
3690 goto remove;
3691 }
3692
3693 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3694 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3695
3696 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3697 } else {
3698 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3699
3700 if (skb->len < sizeof(*rp)) {
3701 mgmt_cmd_status(cmd->sk, hdev->id,
3702 MGMT_OP_READ_LOCAL_OOB_DATA,
3703 MGMT_STATUS_FAILED);
3704 goto remove;
3705 }
3706
3707 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3708 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3709
3710 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3711 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3712 }
3713
3714 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3715 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3716
3717 remove:
3718 mgmt_pending_remove(cmd);
3719 }
3720
3721 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3722 void *data, u16 data_len)
3723 {
3724 struct mgmt_pending_cmd *cmd;
3725 struct hci_request req;
3726 int err;
3727
3728 BT_DBG("%s", hdev->name);
3729
3730 hci_dev_lock(hdev);
3731
3732 if (!hdev_is_powered(hdev)) {
3733 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3734 MGMT_STATUS_NOT_POWERED);
3735 goto unlock;
3736 }
3737
3738 if (!lmp_ssp_capable(hdev)) {
3739 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3740 MGMT_STATUS_NOT_SUPPORTED);
3741 goto unlock;
3742 }
3743
3744 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3745 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3746 MGMT_STATUS_BUSY);
3747 goto unlock;
3748 }
3749
3750 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3751 if (!cmd) {
3752 err = -ENOMEM;
3753 goto unlock;
3754 }
3755
3756 hci_req_init(&req, hdev);
3757
3758 if (bredr_sc_enabled(hdev))
3759 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3760 else
3761 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3762
3763 err = hci_req_run_skb(&req, read_local_oob_data_complete);
3764 if (err < 0)
3765 mgmt_pending_remove(cmd);
3766
3767 unlock:
3768 hci_dev_unlock(hdev);
3769 return err;
3770 }
3771
3772 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3773 void *data, u16 len)
3774 {
3775 struct mgmt_addr_info *addr = data;
3776 int err;
3777
3778 BT_DBG("%s ", hdev->name);
3779
3780 if (!bdaddr_type_is_valid(addr->type))
3781 return mgmt_cmd_complete(sk, hdev->id,
3782 MGMT_OP_ADD_REMOTE_OOB_DATA,
3783 MGMT_STATUS_INVALID_PARAMS,
3784 addr, sizeof(*addr));
3785
3786 hci_dev_lock(hdev);
3787
3788 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3789 struct mgmt_cp_add_remote_oob_data *cp = data;
3790 u8 status;
3791
3792 if (cp->addr.type != BDADDR_BREDR) {
3793 err = mgmt_cmd_complete(sk, hdev->id,
3794 MGMT_OP_ADD_REMOTE_OOB_DATA,
3795 MGMT_STATUS_INVALID_PARAMS,
3796 &cp->addr, sizeof(cp->addr));
3797 goto unlock;
3798 }
3799
3800 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3801 cp->addr.type, cp->hash,
3802 cp->rand, NULL, NULL);
3803 if (err < 0)
3804 status = MGMT_STATUS_FAILED;
3805 else
3806 status = MGMT_STATUS_SUCCESS;
3807
3808 err = mgmt_cmd_complete(sk, hdev->id,
3809 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3810 &cp->addr, sizeof(cp->addr));
3811 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3812 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3813 u8 *rand192, *hash192, *rand256, *hash256;
3814 u8 status;
3815
3816 if (bdaddr_type_is_le(cp->addr.type)) {
3817 /* Enforce zero-valued 192-bit parameters as
3818 * long as legacy SMP OOB isn't implemented.
3819 */
3820 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3821 memcmp(cp->hash192, ZERO_KEY, 16)) {
3822 err = mgmt_cmd_complete(sk, hdev->id,
3823 MGMT_OP_ADD_REMOTE_OOB_DATA,
3824 MGMT_STATUS_INVALID_PARAMS,
3825 addr, sizeof(*addr));
3826 goto unlock;
3827 }
3828
3829 rand192 = NULL;
3830 hash192 = NULL;
3831 } else {
3832 /* In case one of the P-192 values is set to zero,
3833 * then just disable OOB data for P-192.
3834 */
3835 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3836 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3837 rand192 = NULL;
3838 hash192 = NULL;
3839 } else {
3840 rand192 = cp->rand192;
3841 hash192 = cp->hash192;
3842 }
3843 }
3844
3845 /* In case one of the P-256 values is set to zero, then just
3846 * disable OOB data for P-256.
3847 */
3848 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3849 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3850 rand256 = NULL;
3851 hash256 = NULL;
3852 } else {
3853 rand256 = cp->rand256;
3854 hash256 = cp->hash256;
3855 }
3856
3857 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3858 cp->addr.type, hash192, rand192,
3859 hash256, rand256);
3860 if (err < 0)
3861 status = MGMT_STATUS_FAILED;
3862 else
3863 status = MGMT_STATUS_SUCCESS;
3864
3865 err = mgmt_cmd_complete(sk, hdev->id,
3866 MGMT_OP_ADD_REMOTE_OOB_DATA,
3867 status, &cp->addr, sizeof(cp->addr));
3868 } else {
3869 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3870 len);
3871 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3872 MGMT_STATUS_INVALID_PARAMS);
3873 }
3874
3875 unlock:
3876 hci_dev_unlock(hdev);
3877 return err;
3878 }
3879
3880 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3881 void *data, u16 len)
3882 {
3883 struct mgmt_cp_remove_remote_oob_data *cp = data;
3884 u8 status;
3885 int err;
3886
3887 BT_DBG("%s", hdev->name);
3888
3889 if (cp->addr.type != BDADDR_BREDR)
3890 return mgmt_cmd_complete(sk, hdev->id,
3891 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3892 MGMT_STATUS_INVALID_PARAMS,
3893 &cp->addr, sizeof(cp->addr));
3894
3895 hci_dev_lock(hdev);
3896
3897 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3898 hci_remote_oob_data_clear(hdev);
3899 status = MGMT_STATUS_SUCCESS;
3900 goto done;
3901 }
3902
3903 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3904 if (err < 0)
3905 status = MGMT_STATUS_INVALID_PARAMS;
3906 else
3907 status = MGMT_STATUS_SUCCESS;
3908
3909 done:
3910 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3911 status, &cp->addr, sizeof(cp->addr));
3912
3913 hci_dev_unlock(hdev);
3914 return err;
3915 }
3916
3917 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3918 {
3919 struct mgmt_pending_cmd *cmd;
3920
3921 BT_DBG("status %d", status);
3922
3923 hci_dev_lock(hdev);
3924
3925 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3926 if (!cmd)
3927 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3928
3929 if (!cmd)
3930 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3931
3932 if (cmd) {
3933 cmd->cmd_complete(cmd, mgmt_status(status));
3934 mgmt_pending_remove(cmd);
3935 }
3936
3937 hci_dev_unlock(hdev);
3938
3939 /* Handle suspend notifier */
3940 if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY,
3941 hdev->suspend_tasks)) {
3942 bt_dev_dbg(hdev, "Unpaused discovery");
3943 wake_up(&hdev->suspend_wait_q);
3944 }
3945 }
3946
3947 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3948 uint8_t *mgmt_status)
3949 {
3950 switch (type) {
3951 case DISCOV_TYPE_LE:
3952 *mgmt_status = mgmt_le_support(hdev);
3953 if (*mgmt_status)
3954 return false;
3955 break;
3956 case DISCOV_TYPE_INTERLEAVED:
3957 *mgmt_status = mgmt_le_support(hdev);
3958 if (*mgmt_status)
3959 return false;
3960 /* Intentional fall-through */
3961 case DISCOV_TYPE_BREDR:
3962 *mgmt_status = mgmt_bredr_support(hdev);
3963 if (*mgmt_status)
3964 return false;
3965 break;
3966 default:
3967 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3968 return false;
3969 }
3970
3971 return true;
3972 }
3973
3974 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3975 u16 op, void *data, u16 len)
3976 {
3977 struct mgmt_cp_start_discovery *cp = data;
3978 struct mgmt_pending_cmd *cmd;
3979 u8 status;
3980 int err;
3981
3982 BT_DBG("%s", hdev->name);
3983
3984 hci_dev_lock(hdev);
3985
3986 if (!hdev_is_powered(hdev)) {
3987 err = mgmt_cmd_complete(sk, hdev->id, op,
3988 MGMT_STATUS_NOT_POWERED,
3989 &cp->type, sizeof(cp->type));
3990 goto failed;
3991 }
3992
3993 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3994 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3995 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3996 &cp->type, sizeof(cp->type));
3997 goto failed;
3998 }
3999
4000 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4001 err = mgmt_cmd_complete(sk, hdev->id, op, status,
4002 &cp->type, sizeof(cp->type));
4003 goto failed;
4004 }
4005
4006 /* Can't start discovery when it is paused */
4007 if (hdev->discovery_paused) {
4008 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
4009 &cp->type, sizeof(cp->type));
4010 goto failed;
4011 }
4012
4013 /* Clear the discovery filter first to free any previously
4014 * allocated memory for the UUID list.
4015 */
4016 hci_discovery_filter_clear(hdev);
4017
4018 hdev->discovery.type = cp->type;
4019 hdev->discovery.report_invalid_rssi = false;
4020 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
4021 hdev->discovery.limited = true;
4022 else
4023 hdev->discovery.limited = false;
4024
4025 cmd = mgmt_pending_add(sk, op, hdev, data, len);
4026 if (!cmd) {
4027 err = -ENOMEM;
4028 goto failed;
4029 }
4030
4031 cmd->cmd_complete = generic_cmd_complete;
4032
4033 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4034 queue_work(hdev->req_workqueue, &hdev->discov_update);
4035 err = 0;
4036
4037 failed:
4038 hci_dev_unlock(hdev);
4039 return err;
4040 }
4041
4042 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
4043 void *data, u16 len)
4044 {
4045 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
4046 data, len);
4047 }
4048
4049 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
4050 void *data, u16 len)
4051 {
4052 return start_discovery_internal(sk, hdev,
4053 MGMT_OP_START_LIMITED_DISCOVERY,
4054 data, len);
4055 }
4056
4057 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4058 u8 status)
4059 {
4060 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4061 cmd->param, 1);
4062 }
4063
4064 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4065 void *data, u16 len)
4066 {
4067 struct mgmt_cp_start_service_discovery *cp = data;
4068 struct mgmt_pending_cmd *cmd;
4069 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4070 u16 uuid_count, expected_len;
4071 u8 status;
4072 int err;
4073
4074 BT_DBG("%s", hdev->name);
4075
4076 hci_dev_lock(hdev);
4077
4078 if (!hdev_is_powered(hdev)) {
4079 err = mgmt_cmd_complete(sk, hdev->id,
4080 MGMT_OP_START_SERVICE_DISCOVERY,
4081 MGMT_STATUS_NOT_POWERED,
4082 &cp->type, sizeof(cp->type));
4083 goto failed;
4084 }
4085
4086 if (hdev->discovery.state != DISCOVERY_STOPPED ||
4087 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
4088 err = mgmt_cmd_complete(sk, hdev->id,
4089 MGMT_OP_START_SERVICE_DISCOVERY,
4090 MGMT_STATUS_BUSY, &cp->type,
4091 sizeof(cp->type));
4092 goto failed;
4093 }
4094
4095 uuid_count = __le16_to_cpu(cp->uuid_count);
4096 if (uuid_count > max_uuid_count) {
4097 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
4098 uuid_count);
4099 err = mgmt_cmd_complete(sk, hdev->id,
4100 MGMT_OP_START_SERVICE_DISCOVERY,
4101 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4102 sizeof(cp->type));
4103 goto failed;
4104 }
4105
4106 expected_len = sizeof(*cp) + uuid_count * 16;
4107 if (expected_len != len) {
4108 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
4109 expected_len, len);
4110 err = mgmt_cmd_complete(sk, hdev->id,
4111 MGMT_OP_START_SERVICE_DISCOVERY,
4112 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4113 sizeof(cp->type));
4114 goto failed;
4115 }
4116
4117 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
4118 err = mgmt_cmd_complete(sk, hdev->id,
4119 MGMT_OP_START_SERVICE_DISCOVERY,
4120 status, &cp->type, sizeof(cp->type));
4121 goto failed;
4122 }
4123
4124 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4125 hdev, data, len);
4126 if (!cmd) {
4127 err = -ENOMEM;
4128 goto failed;
4129 }
4130
4131 cmd->cmd_complete = service_discovery_cmd_complete;
4132
4133 /* Clear the discovery filter first to free any previously
4134 * allocated memory for the UUID list.
4135 */
4136 hci_discovery_filter_clear(hdev);
4137
4138 hdev->discovery.result_filtering = true;
4139 hdev->discovery.type = cp->type;
4140 hdev->discovery.rssi = cp->rssi;
4141 hdev->discovery.uuid_count = uuid_count;
4142
4143 if (uuid_count > 0) {
4144 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4145 GFP_KERNEL);
4146 if (!hdev->discovery.uuids) {
4147 err = mgmt_cmd_complete(sk, hdev->id,
4148 MGMT_OP_START_SERVICE_DISCOVERY,
4149 MGMT_STATUS_FAILED,
4150 &cp->type, sizeof(cp->type));
4151 mgmt_pending_remove(cmd);
4152 goto failed;
4153 }
4154 }
4155
4156 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4157 queue_work(hdev->req_workqueue, &hdev->discov_update);
4158 err = 0;
4159
4160 failed:
4161 hci_dev_unlock(hdev);
4162 return err;
4163 }
4164
4165 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4166 {
4167 struct mgmt_pending_cmd *cmd;
4168
4169 BT_DBG("status %d", status);
4170
4171 hci_dev_lock(hdev);
4172
4173 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4174 if (cmd) {
4175 cmd->cmd_complete(cmd, mgmt_status(status));
4176 mgmt_pending_remove(cmd);
4177 }
4178
4179 hci_dev_unlock(hdev);
4180
4181 /* Handle suspend notifier */
4182 if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) {
4183 bt_dev_dbg(hdev, "Paused discovery");
4184 wake_up(&hdev->suspend_wait_q);
4185 }
4186 }
4187
4188 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4189 u16 len)
4190 {
4191 struct mgmt_cp_stop_discovery *mgmt_cp = data;
4192 struct mgmt_pending_cmd *cmd;
4193 int err;
4194
4195 BT_DBG("%s", hdev->name);
4196
4197 hci_dev_lock(hdev);
4198
4199 if (!hci_discovery_active(hdev)) {
4200 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4201 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4202 sizeof(mgmt_cp->type));
4203 goto unlock;
4204 }
4205
4206 if (hdev->discovery.type != mgmt_cp->type) {
4207 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4208 MGMT_STATUS_INVALID_PARAMS,
4209 &mgmt_cp->type, sizeof(mgmt_cp->type));
4210 goto unlock;
4211 }
4212
4213 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4214 if (!cmd) {
4215 err = -ENOMEM;
4216 goto unlock;
4217 }
4218
4219 cmd->cmd_complete = generic_cmd_complete;
4220
4221 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4222 queue_work(hdev->req_workqueue, &hdev->discov_update);
4223 err = 0;
4224
4225 unlock:
4226 hci_dev_unlock(hdev);
4227 return err;
4228 }
4229
4230 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4231 u16 len)
4232 {
4233 struct mgmt_cp_confirm_name *cp = data;
4234 struct inquiry_entry *e;
4235 int err;
4236
4237 BT_DBG("%s", hdev->name);
4238
4239 hci_dev_lock(hdev);
4240
4241 if (!hci_discovery_active(hdev)) {
4242 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4243 MGMT_STATUS_FAILED, &cp->addr,
4244 sizeof(cp->addr));
4245 goto failed;
4246 }
4247
4248 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4249 if (!e) {
4250 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4251 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4252 sizeof(cp->addr));
4253 goto failed;
4254 }
4255
4256 if (cp->name_known) {
4257 e->name_state = NAME_KNOWN;
4258 list_del(&e->list);
4259 } else {
4260 e->name_state = NAME_NEEDED;
4261 hci_inquiry_cache_update_resolve(hdev, e);
4262 }
4263
4264 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4265 &cp->addr, sizeof(cp->addr));
4266
4267 failed:
4268 hci_dev_unlock(hdev);
4269 return err;
4270 }
4271
4272 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4273 u16 len)
4274 {
4275 struct mgmt_cp_block_device *cp = data;
4276 u8 status;
4277 int err;
4278
4279 BT_DBG("%s", hdev->name);
4280
4281 if (!bdaddr_type_is_valid(cp->addr.type))
4282 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4283 MGMT_STATUS_INVALID_PARAMS,
4284 &cp->addr, sizeof(cp->addr));
4285
4286 hci_dev_lock(hdev);
4287
4288 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4289 cp->addr.type);
4290 if (err < 0) {
4291 status = MGMT_STATUS_FAILED;
4292 goto done;
4293 }
4294
4295 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4296 sk);
4297 status = MGMT_STATUS_SUCCESS;
4298
4299 done:
4300 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4301 &cp->addr, sizeof(cp->addr));
4302
4303 hci_dev_unlock(hdev);
4304
4305 return err;
4306 }
4307
4308 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4309 u16 len)
4310 {
4311 struct mgmt_cp_unblock_device *cp = data;
4312 u8 status;
4313 int err;
4314
4315 BT_DBG("%s", hdev->name);
4316
4317 if (!bdaddr_type_is_valid(cp->addr.type))
4318 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4319 MGMT_STATUS_INVALID_PARAMS,
4320 &cp->addr, sizeof(cp->addr));
4321
4322 hci_dev_lock(hdev);
4323
4324 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4325 cp->addr.type);
4326 if (err < 0) {
4327 status = MGMT_STATUS_INVALID_PARAMS;
4328 goto done;
4329 }
4330
4331 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4332 sk);
4333 status = MGMT_STATUS_SUCCESS;
4334
4335 done:
4336 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4337 &cp->addr, sizeof(cp->addr));
4338
4339 hci_dev_unlock(hdev);
4340
4341 return err;
4342 }
4343
4344 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4345 u16 len)
4346 {
4347 struct mgmt_cp_set_device_id *cp = data;
4348 struct hci_request req;
4349 int err;
4350 __u16 source;
4351
4352 BT_DBG("%s", hdev->name);
4353
4354 source = __le16_to_cpu(cp->source);
4355
4356 if (source > 0x0002)
4357 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4358 MGMT_STATUS_INVALID_PARAMS);
4359
4360 hci_dev_lock(hdev);
4361
4362 hdev->devid_source = source;
4363 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4364 hdev->devid_product = __le16_to_cpu(cp->product);
4365 hdev->devid_version = __le16_to_cpu(cp->version);
4366
4367 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4368 NULL, 0);
4369
4370 hci_req_init(&req, hdev);
4371 __hci_req_update_eir(&req);
4372 hci_req_run(&req, NULL);
4373
4374 hci_dev_unlock(hdev);
4375
4376 return err;
4377 }
4378
4379 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4380 u16 opcode)
4381 {
4382 BT_DBG("status %d", status);
4383 }
4384
4385 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4386 u16 opcode)
4387 {
4388 struct cmd_lookup match = { NULL, hdev };
4389 struct hci_request req;
4390 u8 instance;
4391 struct adv_info *adv_instance;
4392 int err;
4393
4394 hci_dev_lock(hdev);
4395
4396 if (status) {
4397 u8 mgmt_err = mgmt_status(status);
4398
4399 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4400 cmd_status_rsp, &mgmt_err);
4401 goto unlock;
4402 }
4403
4404 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4405 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4406 else
4407 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4408
4409 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4410 &match);
4411
4412 new_settings(hdev, match.sk);
4413
4414 if (match.sk)
4415 sock_put(match.sk);
4416
4417 /* Handle suspend notifier */
4418 if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING,
4419 hdev->suspend_tasks)) {
4420 bt_dev_dbg(hdev, "Paused advertising");
4421 wake_up(&hdev->suspend_wait_q);
4422 } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING,
4423 hdev->suspend_tasks)) {
4424 bt_dev_dbg(hdev, "Unpaused advertising");
4425 wake_up(&hdev->suspend_wait_q);
4426 }
4427
4428 /* If "Set Advertising" was just disabled and instance advertising was
4429 * set up earlier, then re-enable multi-instance advertising.
4430 */
4431 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4432 list_empty(&hdev->adv_instances))
4433 goto unlock;
4434
4435 instance = hdev->cur_adv_instance;
4436 if (!instance) {
4437 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4438 struct adv_info, list);
4439 if (!adv_instance)
4440 goto unlock;
4441
4442 instance = adv_instance->instance;
4443 }
4444
4445 hci_req_init(&req, hdev);
4446
4447 err = __hci_req_schedule_adv_instance(&req, instance, true);
4448
4449 if (!err)
4450 err = hci_req_run(&req, enable_advertising_instance);
4451
4452 if (err)
4453 bt_dev_err(hdev, "failed to re-configure advertising");
4454
4455 unlock:
4456 hci_dev_unlock(hdev);
4457 }
4458
4459 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4460 u16 len)
4461 {
4462 struct mgmt_mode *cp = data;
4463 struct mgmt_pending_cmd *cmd;
4464 struct hci_request req;
4465 u8 val, status;
4466 int err;
4467
4468 BT_DBG("request for %s", hdev->name);
4469
4470 status = mgmt_le_support(hdev);
4471 if (status)
4472 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4473 status);
4474
4475 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4476 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4477 MGMT_STATUS_INVALID_PARAMS);
4478
4479 if (hdev->advertising_paused)
4480 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4481 MGMT_STATUS_BUSY);
4482
4483 hci_dev_lock(hdev);
4484
4485 val = !!cp->val;
4486
4487 /* The following conditions are ones which mean that we should
4488 * not do any HCI communication but directly send a mgmt
4489 * response to user space (after toggling the flag if
4490 * necessary).
4491 */
4492 if (!hdev_is_powered(hdev) ||
4493 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4494 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4495 hci_conn_num(hdev, LE_LINK) > 0 ||
4496 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4497 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4498 bool changed;
4499
4500 if (cp->val) {
4501 hdev->cur_adv_instance = 0x00;
4502 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4503 if (cp->val == 0x02)
4504 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4505 else
4506 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4507 } else {
4508 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4509 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4510 }
4511
4512 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4513 if (err < 0)
4514 goto unlock;
4515
4516 if (changed)
4517 err = new_settings(hdev, sk);
4518
4519 goto unlock;
4520 }
4521
4522 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4523 pending_find(MGMT_OP_SET_LE, hdev)) {
4524 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4525 MGMT_STATUS_BUSY);
4526 goto unlock;
4527 }
4528
4529 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4530 if (!cmd) {
4531 err = -ENOMEM;
4532 goto unlock;
4533 }
4534
4535 hci_req_init(&req, hdev);
4536
4537 if (cp->val == 0x02)
4538 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4539 else
4540 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4541
4542 cancel_adv_timeout(hdev);
4543
4544 if (val) {
4545 /* Switch to instance "0" for the Set Advertising setting.
4546 * We cannot use update_[adv|scan_rsp]_data() here as the
4547 * HCI_ADVERTISING flag is not yet set.
4548 */
4549 hdev->cur_adv_instance = 0x00;
4550
4551 if (ext_adv_capable(hdev)) {
4552 __hci_req_start_ext_adv(&req, 0x00);
4553 } else {
4554 __hci_req_update_adv_data(&req, 0x00);
4555 __hci_req_update_scan_rsp_data(&req, 0x00);
4556 __hci_req_enable_advertising(&req);
4557 }
4558 } else {
4559 __hci_req_disable_advertising(&req);
4560 }
4561
4562 err = hci_req_run(&req, set_advertising_complete);
4563 if (err < 0)
4564 mgmt_pending_remove(cmd);
4565
4566 unlock:
4567 hci_dev_unlock(hdev);
4568 return err;
4569 }
4570
4571 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4572 void *data, u16 len)
4573 {
4574 struct mgmt_cp_set_static_address *cp = data;
4575 int err;
4576
4577 BT_DBG("%s", hdev->name);
4578
4579 if (!lmp_le_capable(hdev))
4580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4581 MGMT_STATUS_NOT_SUPPORTED);
4582
4583 if (hdev_is_powered(hdev))
4584 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4585 MGMT_STATUS_REJECTED);
4586
4587 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4588 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4589 return mgmt_cmd_status(sk, hdev->id,
4590 MGMT_OP_SET_STATIC_ADDRESS,
4591 MGMT_STATUS_INVALID_PARAMS);
4592
4593 /* Two most significant bits shall be set */
4594 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4595 return mgmt_cmd_status(sk, hdev->id,
4596 MGMT_OP_SET_STATIC_ADDRESS,
4597 MGMT_STATUS_INVALID_PARAMS);
4598 }
4599
4600 hci_dev_lock(hdev);
4601
4602 bacpy(&hdev->static_addr, &cp->bdaddr);
4603
4604 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4605 if (err < 0)
4606 goto unlock;
4607
4608 err = new_settings(hdev, sk);
4609
4610 unlock:
4611 hci_dev_unlock(hdev);
4612 return err;
4613 }
4614
4615 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4616 void *data, u16 len)
4617 {
4618 struct mgmt_cp_set_scan_params *cp = data;
4619 __u16 interval, window;
4620 int err;
4621
4622 BT_DBG("%s", hdev->name);
4623
4624 if (!lmp_le_capable(hdev))
4625 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4626 MGMT_STATUS_NOT_SUPPORTED);
4627
4628 interval = __le16_to_cpu(cp->interval);
4629
4630 if (interval < 0x0004 || interval > 0x4000)
4631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4632 MGMT_STATUS_INVALID_PARAMS);
4633
4634 window = __le16_to_cpu(cp->window);
4635
4636 if (window < 0x0004 || window > 0x4000)
4637 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4638 MGMT_STATUS_INVALID_PARAMS);
4639
4640 if (window > interval)
4641 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4642 MGMT_STATUS_INVALID_PARAMS);
4643
4644 hci_dev_lock(hdev);
4645
4646 hdev->le_scan_interval = interval;
4647 hdev->le_scan_window = window;
4648
4649 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4650 NULL, 0);
4651
4652 /* If background scan is running, restart it so new parameters are
4653 * loaded.
4654 */
4655 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4656 hdev->discovery.state == DISCOVERY_STOPPED) {
4657 struct hci_request req;
4658
4659 hci_req_init(&req, hdev);
4660
4661 hci_req_add_le_scan_disable(&req);
4662 hci_req_add_le_passive_scan(&req);
4663
4664 hci_req_run(&req, NULL);
4665 }
4666
4667 hci_dev_unlock(hdev);
4668
4669 return err;
4670 }
4671
4672 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4673 u16 opcode)
4674 {
4675 struct mgmt_pending_cmd *cmd;
4676
4677 BT_DBG("status 0x%02x", status);
4678
4679 hci_dev_lock(hdev);
4680
4681 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4682 if (!cmd)
4683 goto unlock;
4684
4685 if (status) {
4686 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4687 mgmt_status(status));
4688 } else {
4689 struct mgmt_mode *cp = cmd->param;
4690
4691 if (cp->val)
4692 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4693 else
4694 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4695
4696 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4697 new_settings(hdev, cmd->sk);
4698 }
4699
4700 mgmt_pending_remove(cmd);
4701
4702 unlock:
4703 hci_dev_unlock(hdev);
4704 }
4705
4706 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4707 void *data, u16 len)
4708 {
4709 struct mgmt_mode *cp = data;
4710 struct mgmt_pending_cmd *cmd;
4711 struct hci_request req;
4712 int err;
4713
4714 BT_DBG("%s", hdev->name);
4715
4716 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4717 hdev->hci_ver < BLUETOOTH_VER_1_2)
4718 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4719 MGMT_STATUS_NOT_SUPPORTED);
4720
4721 if (cp->val != 0x00 && cp->val != 0x01)
4722 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4723 MGMT_STATUS_INVALID_PARAMS);
4724
4725 hci_dev_lock(hdev);
4726
4727 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4728 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4729 MGMT_STATUS_BUSY);
4730 goto unlock;
4731 }
4732
4733 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4734 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4735 hdev);
4736 goto unlock;
4737 }
4738
4739 if (!hdev_is_powered(hdev)) {
4740 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4741 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4742 hdev);
4743 new_settings(hdev, sk);
4744 goto unlock;
4745 }
4746
4747 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4748 data, len);
4749 if (!cmd) {
4750 err = -ENOMEM;
4751 goto unlock;
4752 }
4753
4754 hci_req_init(&req, hdev);
4755
4756 __hci_req_write_fast_connectable(&req, cp->val);
4757
4758 err = hci_req_run(&req, fast_connectable_complete);
4759 if (err < 0) {
4760 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4761 MGMT_STATUS_FAILED);
4762 mgmt_pending_remove(cmd);
4763 }
4764
4765 unlock:
4766 hci_dev_unlock(hdev);
4767
4768 return err;
4769 }
4770
4771 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4772 {
4773 struct mgmt_pending_cmd *cmd;
4774
4775 BT_DBG("status 0x%02x", status);
4776
4777 hci_dev_lock(hdev);
4778
4779 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4780 if (!cmd)
4781 goto unlock;
4782
4783 if (status) {
4784 u8 mgmt_err = mgmt_status(status);
4785
4786 /* We need to restore the flag if related HCI commands
4787 * failed.
4788 */
4789 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4790
4791 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4792 } else {
4793 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4794 new_settings(hdev, cmd->sk);
4795 }
4796
4797 mgmt_pending_remove(cmd);
4798
4799 unlock:
4800 hci_dev_unlock(hdev);
4801 }
4802
4803 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4804 {
4805 struct mgmt_mode *cp = data;
4806 struct mgmt_pending_cmd *cmd;
4807 struct hci_request req;
4808 int err;
4809
4810 BT_DBG("request for %s", hdev->name);
4811
4812 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4813 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4814 MGMT_STATUS_NOT_SUPPORTED);
4815
4816 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4817 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4818 MGMT_STATUS_REJECTED);
4819
4820 if (cp->val != 0x00 && cp->val != 0x01)
4821 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4822 MGMT_STATUS_INVALID_PARAMS);
4823
4824 hci_dev_lock(hdev);
4825
4826 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4827 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4828 goto unlock;
4829 }
4830
4831 if (!hdev_is_powered(hdev)) {
4832 if (!cp->val) {
4833 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4834 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4835 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4836 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4837 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4838 }
4839
4840 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4841
4842 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4843 if (err < 0)
4844 goto unlock;
4845
4846 err = new_settings(hdev, sk);
4847 goto unlock;
4848 }
4849
4850 /* Reject disabling when powered on */
4851 if (!cp->val) {
4852 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4853 MGMT_STATUS_REJECTED);
4854 goto unlock;
4855 } else {
4856 /* When configuring a dual-mode controller to operate
4857 * with LE only and using a static address, then switching
4858 * BR/EDR back on is not allowed.
4859 *
4860 * Dual-mode controllers shall operate with the public
4861 * address as its identity address for BR/EDR and LE. So
4862 * reject the attempt to create an invalid configuration.
4863 *
4864 * The same restrictions applies when secure connections
4865 * has been enabled. For BR/EDR this is a controller feature
4866 * while for LE it is a host stack feature. This means that
4867 * switching BR/EDR back on when secure connections has been
4868 * enabled is not a supported transaction.
4869 */
4870 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4871 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4872 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4873 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4874 MGMT_STATUS_REJECTED);
4875 goto unlock;
4876 }
4877 }
4878
4879 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4880 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4881 MGMT_STATUS_BUSY);
4882 goto unlock;
4883 }
4884
4885 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4886 if (!cmd) {
4887 err = -ENOMEM;
4888 goto unlock;
4889 }
4890
4891 /* We need to flip the bit already here so that
4892 * hci_req_update_adv_data generates the correct flags.
4893 */
4894 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4895
4896 hci_req_init(&req, hdev);
4897
4898 __hci_req_write_fast_connectable(&req, false);
4899 __hci_req_update_scan(&req);
4900
4901 /* Since only the advertising data flags will change, there
4902 * is no need to update the scan response data.
4903 */
4904 __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4905
4906 err = hci_req_run(&req, set_bredr_complete);
4907 if (err < 0)
4908 mgmt_pending_remove(cmd);
4909
4910 unlock:
4911 hci_dev_unlock(hdev);
4912 return err;
4913 }
4914
4915 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4916 {
4917 struct mgmt_pending_cmd *cmd;
4918 struct mgmt_mode *cp;
4919
4920 BT_DBG("%s status %u", hdev->name, status);
4921
4922 hci_dev_lock(hdev);
4923
4924 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4925 if (!cmd)
4926 goto unlock;
4927
4928 if (status) {
4929 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4930 mgmt_status(status));
4931 goto remove;
4932 }
4933
4934 cp = cmd->param;
4935
4936 switch (cp->val) {
4937 case 0x00:
4938 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4939 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4940 break;
4941 case 0x01:
4942 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4943 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4944 break;
4945 case 0x02:
4946 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4947 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4948 break;
4949 }
4950
4951 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4952 new_settings(hdev, cmd->sk);
4953
4954 remove:
4955 mgmt_pending_remove(cmd);
4956 unlock:
4957 hci_dev_unlock(hdev);
4958 }
4959
4960 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4961 void *data, u16 len)
4962 {
4963 struct mgmt_mode *cp = data;
4964 struct mgmt_pending_cmd *cmd;
4965 struct hci_request req;
4966 u8 val;
4967 int err;
4968
4969 BT_DBG("request for %s", hdev->name);
4970
4971 if (!lmp_sc_capable(hdev) &&
4972 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4973 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4974 MGMT_STATUS_NOT_SUPPORTED);
4975
4976 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4977 lmp_sc_capable(hdev) &&
4978 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4979 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4980 MGMT_STATUS_REJECTED);
4981
4982 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4983 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4984 MGMT_STATUS_INVALID_PARAMS);
4985
4986 hci_dev_lock(hdev);
4987
4988 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4989 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4990 bool changed;
4991
4992 if (cp->val) {
4993 changed = !hci_dev_test_and_set_flag(hdev,
4994 HCI_SC_ENABLED);
4995 if (cp->val == 0x02)
4996 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4997 else
4998 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4999 } else {
5000 changed = hci_dev_test_and_clear_flag(hdev,
5001 HCI_SC_ENABLED);
5002 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
5003 }
5004
5005 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5006 if (err < 0)
5007 goto failed;
5008
5009 if (changed)
5010 err = new_settings(hdev, sk);
5011
5012 goto failed;
5013 }
5014
5015 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
5016 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5017 MGMT_STATUS_BUSY);
5018 goto failed;
5019 }
5020
5021 val = !!cp->val;
5022
5023 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5024 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5025 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5026 goto failed;
5027 }
5028
5029 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5030 if (!cmd) {
5031 err = -ENOMEM;
5032 goto failed;
5033 }
5034
5035 hci_req_init(&req, hdev);
5036 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5037 err = hci_req_run(&req, sc_enable_complete);
5038 if (err < 0) {
5039 mgmt_pending_remove(cmd);
5040 goto failed;
5041 }
5042
5043 failed:
5044 hci_dev_unlock(hdev);
5045 return err;
5046 }
5047
5048 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5049 void *data, u16 len)
5050 {
5051 struct mgmt_mode *cp = data;
5052 bool changed, use_changed;
5053 int err;
5054
5055 BT_DBG("request for %s", hdev->name);
5056
5057 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
5058 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5059 MGMT_STATUS_INVALID_PARAMS);
5060
5061 hci_dev_lock(hdev);
5062
5063 if (cp->val)
5064 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
5065 else
5066 changed = hci_dev_test_and_clear_flag(hdev,
5067 HCI_KEEP_DEBUG_KEYS);
5068
5069 if (cp->val == 0x02)
5070 use_changed = !hci_dev_test_and_set_flag(hdev,
5071 HCI_USE_DEBUG_KEYS);
5072 else
5073 use_changed = hci_dev_test_and_clear_flag(hdev,
5074 HCI_USE_DEBUG_KEYS);
5075
5076 if (hdev_is_powered(hdev) && use_changed &&
5077 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5078 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5079 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5080 sizeof(mode), &mode);
5081 }
5082
5083 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5084 if (err < 0)
5085 goto unlock;
5086
5087 if (changed)
5088 err = new_settings(hdev, sk);
5089
5090 unlock:
5091 hci_dev_unlock(hdev);
5092 return err;
5093 }
5094
5095 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5096 u16 len)
5097 {
5098 struct mgmt_cp_set_privacy *cp = cp_data;
5099 bool changed;
5100 int err;
5101
5102 BT_DBG("request for %s", hdev->name);
5103
5104 if (!lmp_le_capable(hdev))
5105 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5106 MGMT_STATUS_NOT_SUPPORTED);
5107
5108 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
5109 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5110 MGMT_STATUS_INVALID_PARAMS);
5111
5112 if (hdev_is_powered(hdev))
5113 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5114 MGMT_STATUS_REJECTED);
5115
5116 hci_dev_lock(hdev);
5117
5118 /* If user space supports this command it is also expected to
5119 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5120 */
5121 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5122
5123 if (cp->privacy) {
5124 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
5125 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5126 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5127 hci_adv_instances_set_rpa_expired(hdev, true);
5128 if (cp->privacy == 0x02)
5129 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
5130 else
5131 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5132 } else {
5133 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
5134 memset(hdev->irk, 0, sizeof(hdev->irk));
5135 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
5136 hci_adv_instances_set_rpa_expired(hdev, false);
5137 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
5138 }
5139
5140 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5141 if (err < 0)
5142 goto unlock;
5143
5144 if (changed)
5145 err = new_settings(hdev, sk);
5146
5147 unlock:
5148 hci_dev_unlock(hdev);
5149 return err;
5150 }
5151
5152 static bool irk_is_valid(struct mgmt_irk_info *irk)
5153 {
5154 switch (irk->addr.type) {
5155 case BDADDR_LE_PUBLIC:
5156 return true;
5157
5158 case BDADDR_LE_RANDOM:
5159 /* Two most significant bits shall be set */
5160 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5161 return false;
5162 return true;
5163 }
5164
5165 return false;
5166 }
5167
5168 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5169 u16 len)
5170 {
5171 struct mgmt_cp_load_irks *cp = cp_data;
5172 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5173 sizeof(struct mgmt_irk_info));
5174 u16 irk_count, expected_len;
5175 int i, err;
5176
5177 BT_DBG("request for %s", hdev->name);
5178
5179 if (!lmp_le_capable(hdev))
5180 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5181 MGMT_STATUS_NOT_SUPPORTED);
5182
5183 irk_count = __le16_to_cpu(cp->irk_count);
5184 if (irk_count > max_irk_count) {
5185 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5186 irk_count);
5187 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5188 MGMT_STATUS_INVALID_PARAMS);
5189 }
5190
5191 expected_len = struct_size(cp, irks, irk_count);
5192 if (expected_len != len) {
5193 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5194 expected_len, len);
5195 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5196 MGMT_STATUS_INVALID_PARAMS);
5197 }
5198
5199 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5200
5201 for (i = 0; i < irk_count; i++) {
5202 struct mgmt_irk_info *key = &cp->irks[i];
5203
5204 if (!irk_is_valid(key))
5205 return mgmt_cmd_status(sk, hdev->id,
5206 MGMT_OP_LOAD_IRKS,
5207 MGMT_STATUS_INVALID_PARAMS);
5208 }
5209
5210 hci_dev_lock(hdev);
5211
5212 hci_smp_irks_clear(hdev);
5213
5214 for (i = 0; i < irk_count; i++) {
5215 struct mgmt_irk_info *irk = &cp->irks[i];
5216
5217 if (hci_is_blocked_key(hdev,
5218 HCI_BLOCKED_KEY_TYPE_IRK,
5219 irk->val)) {
5220 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR",
5221 &irk->addr.bdaddr);
5222 continue;
5223 }
5224
5225 hci_add_irk(hdev, &irk->addr.bdaddr,
5226 le_addr_type(irk->addr.type), irk->val,
5227 BDADDR_ANY);
5228 }
5229
5230 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5231
5232 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5233
5234 hci_dev_unlock(hdev);
5235
5236 return err;
5237 }
5238
5239 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5240 {
5241 if (key->master != 0x00 && key->master != 0x01)
5242 return false;
5243
5244 switch (key->addr.type) {
5245 case BDADDR_LE_PUBLIC:
5246 return true;
5247
5248 case BDADDR_LE_RANDOM:
5249 /* Two most significant bits shall be set */
5250 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5251 return false;
5252 return true;
5253 }
5254
5255 return false;
5256 }
5257
5258 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5259 void *cp_data, u16 len)
5260 {
5261 struct mgmt_cp_load_long_term_keys *cp = cp_data;
5262 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5263 sizeof(struct mgmt_ltk_info));
5264 u16 key_count, expected_len;
5265 int i, err;
5266
5267 BT_DBG("request for %s", hdev->name);
5268
5269 if (!lmp_le_capable(hdev))
5270 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5271 MGMT_STATUS_NOT_SUPPORTED);
5272
5273 key_count = __le16_to_cpu(cp->key_count);
5274 if (key_count > max_key_count) {
5275 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5276 key_count);
5277 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5278 MGMT_STATUS_INVALID_PARAMS);
5279 }
5280
5281 expected_len = struct_size(cp, keys, key_count);
5282 if (expected_len != len) {
5283 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5284 expected_len, len);
5285 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5286 MGMT_STATUS_INVALID_PARAMS);
5287 }
5288
5289 BT_DBG("%s key_count %u", hdev->name, key_count);
5290
5291 for (i = 0; i < key_count; i++) {
5292 struct mgmt_ltk_info *key = &cp->keys[i];
5293
5294 if (!ltk_is_valid(key))
5295 return mgmt_cmd_status(sk, hdev->id,
5296 MGMT_OP_LOAD_LONG_TERM_KEYS,
5297 MGMT_STATUS_INVALID_PARAMS);
5298 }
5299
5300 hci_dev_lock(hdev);
5301
5302 hci_smp_ltks_clear(hdev);
5303
5304 for (i = 0; i < key_count; i++) {
5305 struct mgmt_ltk_info *key = &cp->keys[i];
5306 u8 type, authenticated;
5307
5308 if (hci_is_blocked_key(hdev,
5309 HCI_BLOCKED_KEY_TYPE_LTK,
5310 key->val)) {
5311 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR",
5312 &key->addr.bdaddr);
5313 continue;
5314 }
5315
5316 switch (key->type) {
5317 case MGMT_LTK_UNAUTHENTICATED:
5318 authenticated = 0x00;
5319 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5320 break;
5321 case MGMT_LTK_AUTHENTICATED:
5322 authenticated = 0x01;
5323 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5324 break;
5325 case MGMT_LTK_P256_UNAUTH:
5326 authenticated = 0x00;
5327 type = SMP_LTK_P256;
5328 break;
5329 case MGMT_LTK_P256_AUTH:
5330 authenticated = 0x01;
5331 type = SMP_LTK_P256;
5332 break;
5333 case MGMT_LTK_P256_DEBUG:
5334 authenticated = 0x00;
5335 type = SMP_LTK_P256_DEBUG;
5336 /* fall through */
5337 default:
5338 continue;
5339 }
5340
5341 hci_add_ltk(hdev, &key->addr.bdaddr,
5342 le_addr_type(key->addr.type), type, authenticated,
5343 key->val, key->enc_size, key->ediv, key->rand);
5344 }
5345
5346 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5347 NULL, 0);
5348
5349 hci_dev_unlock(hdev);
5350
5351 return err;
5352 }
5353
5354 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5355 {
5356 struct hci_conn *conn = cmd->user_data;
5357 struct mgmt_rp_get_conn_info rp;
5358 int err;
5359
5360 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5361
5362 if (status == MGMT_STATUS_SUCCESS) {
5363 rp.rssi = conn->rssi;
5364 rp.tx_power = conn->tx_power;
5365 rp.max_tx_power = conn->max_tx_power;
5366 } else {
5367 rp.rssi = HCI_RSSI_INVALID;
5368 rp.tx_power = HCI_TX_POWER_INVALID;
5369 rp.max_tx_power = HCI_TX_POWER_INVALID;
5370 }
5371
5372 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5373 status, &rp, sizeof(rp));
5374
5375 hci_conn_drop(conn);
5376 hci_conn_put(conn);
5377
5378 return err;
5379 }
5380
5381 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5382 u16 opcode)
5383 {
5384 struct hci_cp_read_rssi *cp;
5385 struct mgmt_pending_cmd *cmd;
5386 struct hci_conn *conn;
5387 u16 handle;
5388 u8 status;
5389
5390 BT_DBG("status 0x%02x", hci_status);
5391
5392 hci_dev_lock(hdev);
5393
5394 /* Commands sent in request are either Read RSSI or Read Transmit Power
5395 * Level so we check which one was last sent to retrieve connection
5396 * handle. Both commands have handle as first parameter so it's safe to
5397 * cast data on the same command struct.
5398 *
5399 * First command sent is always Read RSSI and we fail only if it fails.
5400 * In other case we simply override error to indicate success as we
5401 * already remembered if TX power value is actually valid.
5402 */
5403 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5404 if (!cp) {
5405 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5406 status = MGMT_STATUS_SUCCESS;
5407 } else {
5408 status = mgmt_status(hci_status);
5409 }
5410
5411 if (!cp) {
5412 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5413 goto unlock;
5414 }
5415
5416 handle = __le16_to_cpu(cp->handle);
5417 conn = hci_conn_hash_lookup_handle(hdev, handle);
5418 if (!conn) {
5419 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5420 handle);
5421 goto unlock;
5422 }
5423
5424 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5425 if (!cmd)
5426 goto unlock;
5427
5428 cmd->cmd_complete(cmd, status);
5429 mgmt_pending_remove(cmd);
5430
5431 unlock:
5432 hci_dev_unlock(hdev);
5433 }
5434
5435 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5436 u16 len)
5437 {
5438 struct mgmt_cp_get_conn_info *cp = data;
5439 struct mgmt_rp_get_conn_info rp;
5440 struct hci_conn *conn;
5441 unsigned long conn_info_age;
5442 int err = 0;
5443
5444 BT_DBG("%s", hdev->name);
5445
5446 memset(&rp, 0, sizeof(rp));
5447 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5448 rp.addr.type = cp->addr.type;
5449
5450 if (!bdaddr_type_is_valid(cp->addr.type))
5451 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5452 MGMT_STATUS_INVALID_PARAMS,
5453 &rp, sizeof(rp));
5454
5455 hci_dev_lock(hdev);
5456
5457 if (!hdev_is_powered(hdev)) {
5458 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5459 MGMT_STATUS_NOT_POWERED, &rp,
5460 sizeof(rp));
5461 goto unlock;
5462 }
5463
5464 if (cp->addr.type == BDADDR_BREDR)
5465 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5466 &cp->addr.bdaddr);
5467 else
5468 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5469
5470 if (!conn || conn->state != BT_CONNECTED) {
5471 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5472 MGMT_STATUS_NOT_CONNECTED, &rp,
5473 sizeof(rp));
5474 goto unlock;
5475 }
5476
5477 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5478 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5479 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5480 goto unlock;
5481 }
5482
5483 /* To avoid client trying to guess when to poll again for information we
5484 * calculate conn info age as random value between min/max set in hdev.
5485 */
5486 conn_info_age = hdev->conn_info_min_age +
5487 prandom_u32_max(hdev->conn_info_max_age -
5488 hdev->conn_info_min_age);
5489
5490 /* Query controller to refresh cached values if they are too old or were
5491 * never read.
5492 */
5493 if (time_after(jiffies, conn->conn_info_timestamp +
5494 msecs_to_jiffies(conn_info_age)) ||
5495 !conn->conn_info_timestamp) {
5496 struct hci_request req;
5497 struct hci_cp_read_tx_power req_txp_cp;
5498 struct hci_cp_read_rssi req_rssi_cp;
5499 struct mgmt_pending_cmd *cmd;
5500
5501 hci_req_init(&req, hdev);
5502 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5503 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5504 &req_rssi_cp);
5505
5506 /* For LE links TX power does not change thus we don't need to
5507 * query for it once value is known.
5508 */
5509 if (!bdaddr_type_is_le(cp->addr.type) ||
5510 conn->tx_power == HCI_TX_POWER_INVALID) {
5511 req_txp_cp.handle = cpu_to_le16(conn->handle);
5512 req_txp_cp.type = 0x00;
5513 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5514 sizeof(req_txp_cp), &req_txp_cp);
5515 }
5516
5517 /* Max TX power needs to be read only once per connection */
5518 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5519 req_txp_cp.handle = cpu_to_le16(conn->handle);
5520 req_txp_cp.type = 0x01;
5521 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5522 sizeof(req_txp_cp), &req_txp_cp);
5523 }
5524
5525 err = hci_req_run(&req, conn_info_refresh_complete);
5526 if (err < 0)
5527 goto unlock;
5528
5529 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5530 data, len);
5531 if (!cmd) {
5532 err = -ENOMEM;
5533 goto unlock;
5534 }
5535
5536 hci_conn_hold(conn);
5537 cmd->user_data = hci_conn_get(conn);
5538 cmd->cmd_complete = conn_info_cmd_complete;
5539
5540 conn->conn_info_timestamp = jiffies;
5541 } else {
5542 /* Cache is valid, just reply with values cached in hci_conn */
5543 rp.rssi = conn->rssi;
5544 rp.tx_power = conn->tx_power;
5545 rp.max_tx_power = conn->max_tx_power;
5546
5547 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5548 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5549 }
5550
5551 unlock:
5552 hci_dev_unlock(hdev);
5553 return err;
5554 }
5555
5556 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5557 {
5558 struct hci_conn *conn = cmd->user_data;
5559 struct mgmt_rp_get_clock_info rp;
5560 struct hci_dev *hdev;
5561 int err;
5562
5563 memset(&rp, 0, sizeof(rp));
5564 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5565
5566 if (status)
5567 goto complete;
5568
5569 hdev = hci_dev_get(cmd->index);
5570 if (hdev) {
5571 rp.local_clock = cpu_to_le32(hdev->clock);
5572 hci_dev_put(hdev);
5573 }
5574
5575 if (conn) {
5576 rp.piconet_clock = cpu_to_le32(conn->clock);
5577 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5578 }
5579
5580 complete:
5581 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5582 sizeof(rp));
5583
5584 if (conn) {
5585 hci_conn_drop(conn);
5586 hci_conn_put(conn);
5587 }
5588
5589 return err;
5590 }
5591
5592 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5593 {
5594 struct hci_cp_read_clock *hci_cp;
5595 struct mgmt_pending_cmd *cmd;
5596 struct hci_conn *conn;
5597
5598 BT_DBG("%s status %u", hdev->name, status);
5599
5600 hci_dev_lock(hdev);
5601
5602 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5603 if (!hci_cp)
5604 goto unlock;
5605
5606 if (hci_cp->which) {
5607 u16 handle = __le16_to_cpu(hci_cp->handle);
5608 conn = hci_conn_hash_lookup_handle(hdev, handle);
5609 } else {
5610 conn = NULL;
5611 }
5612
5613 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5614 if (!cmd)
5615 goto unlock;
5616
5617 cmd->cmd_complete(cmd, mgmt_status(status));
5618 mgmt_pending_remove(cmd);
5619
5620 unlock:
5621 hci_dev_unlock(hdev);
5622 }
5623
5624 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5625 u16 len)
5626 {
5627 struct mgmt_cp_get_clock_info *cp = data;
5628 struct mgmt_rp_get_clock_info rp;
5629 struct hci_cp_read_clock hci_cp;
5630 struct mgmt_pending_cmd *cmd;
5631 struct hci_request req;
5632 struct hci_conn *conn;
5633 int err;
5634
5635 BT_DBG("%s", hdev->name);
5636
5637 memset(&rp, 0, sizeof(rp));
5638 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5639 rp.addr.type = cp->addr.type;
5640
5641 if (cp->addr.type != BDADDR_BREDR)
5642 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5643 MGMT_STATUS_INVALID_PARAMS,
5644 &rp, sizeof(rp));
5645
5646 hci_dev_lock(hdev);
5647
5648 if (!hdev_is_powered(hdev)) {
5649 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5650 MGMT_STATUS_NOT_POWERED, &rp,
5651 sizeof(rp));
5652 goto unlock;
5653 }
5654
5655 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5656 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5657 &cp->addr.bdaddr);
5658 if (!conn || conn->state != BT_CONNECTED) {
5659 err = mgmt_cmd_complete(sk, hdev->id,
5660 MGMT_OP_GET_CLOCK_INFO,
5661 MGMT_STATUS_NOT_CONNECTED,
5662 &rp, sizeof(rp));
5663 goto unlock;
5664 }
5665 } else {
5666 conn = NULL;
5667 }
5668
5669 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5670 if (!cmd) {
5671 err = -ENOMEM;
5672 goto unlock;
5673 }
5674
5675 cmd->cmd_complete = clock_info_cmd_complete;
5676
5677 hci_req_init(&req, hdev);
5678
5679 memset(&hci_cp, 0, sizeof(hci_cp));
5680 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5681
5682 if (conn) {
5683 hci_conn_hold(conn);
5684 cmd->user_data = hci_conn_get(conn);
5685
5686 hci_cp.handle = cpu_to_le16(conn->handle);
5687 hci_cp.which = 0x01; /* Piconet clock */
5688 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5689 }
5690
5691 err = hci_req_run(&req, get_clock_info_complete);
5692 if (err < 0)
5693 mgmt_pending_remove(cmd);
5694
5695 unlock:
5696 hci_dev_unlock(hdev);
5697 return err;
5698 }
5699
5700 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5701 {
5702 struct hci_conn *conn;
5703
5704 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5705 if (!conn)
5706 return false;
5707
5708 if (conn->dst_type != type)
5709 return false;
5710
5711 if (conn->state != BT_CONNECTED)
5712 return false;
5713
5714 return true;
5715 }
5716
5717 /* This function requires the caller holds hdev->lock */
5718 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5719 u8 addr_type, u8 auto_connect)
5720 {
5721 struct hci_conn_params *params;
5722
5723 params = hci_conn_params_add(hdev, addr, addr_type);
5724 if (!params)
5725 return -EIO;
5726
5727 if (params->auto_connect == auto_connect)
5728 return 0;
5729
5730 list_del_init(&params->action);
5731
5732 switch (auto_connect) {
5733 case HCI_AUTO_CONN_DISABLED:
5734 case HCI_AUTO_CONN_LINK_LOSS:
5735 /* If auto connect is being disabled when we're trying to
5736 * connect to device, keep connecting.
5737 */
5738 if (params->explicit_connect)
5739 list_add(&params->action, &hdev->pend_le_conns);
5740 break;
5741 case HCI_AUTO_CONN_REPORT:
5742 if (params->explicit_connect)
5743 list_add(&params->action, &hdev->pend_le_conns);
5744 else
5745 list_add(&params->action, &hdev->pend_le_reports);
5746 break;
5747 case HCI_AUTO_CONN_DIRECT:
5748 case HCI_AUTO_CONN_ALWAYS:
5749 if (!is_connected(hdev, addr, addr_type))
5750 list_add(&params->action, &hdev->pend_le_conns);
5751 break;
5752 }
5753
5754 params->auto_connect = auto_connect;
5755
5756 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5757 auto_connect);
5758
5759 return 0;
5760 }
5761
5762 static void device_added(struct sock *sk, struct hci_dev *hdev,
5763 bdaddr_t *bdaddr, u8 type, u8 action)
5764 {
5765 struct mgmt_ev_device_added ev;
5766
5767 bacpy(&ev.addr.bdaddr, bdaddr);
5768 ev.addr.type = type;
5769 ev.action = action;
5770
5771 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5772 }
5773
5774 static int add_device(struct sock *sk, struct hci_dev *hdev,
5775 void *data, u16 len)
5776 {
5777 struct mgmt_cp_add_device *cp = data;
5778 u8 auto_conn, addr_type;
5779 int err;
5780
5781 BT_DBG("%s", hdev->name);
5782
5783 if (!bdaddr_type_is_valid(cp->addr.type) ||
5784 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5785 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5786 MGMT_STATUS_INVALID_PARAMS,
5787 &cp->addr, sizeof(cp->addr));
5788
5789 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5790 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5791 MGMT_STATUS_INVALID_PARAMS,
5792 &cp->addr, sizeof(cp->addr));
5793
5794 hci_dev_lock(hdev);
5795
5796 if (cp->addr.type == BDADDR_BREDR) {
5797 /* Only incoming connections action is supported for now */
5798 if (cp->action != 0x01) {
5799 err = mgmt_cmd_complete(sk, hdev->id,
5800 MGMT_OP_ADD_DEVICE,
5801 MGMT_STATUS_INVALID_PARAMS,
5802 &cp->addr, sizeof(cp->addr));
5803 goto unlock;
5804 }
5805
5806 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5807 cp->addr.type);
5808 if (err)
5809 goto unlock;
5810
5811 hci_req_update_scan(hdev);
5812
5813 goto added;
5814 }
5815
5816 addr_type = le_addr_type(cp->addr.type);
5817
5818 if (cp->action == 0x02)
5819 auto_conn = HCI_AUTO_CONN_ALWAYS;
5820 else if (cp->action == 0x01)
5821 auto_conn = HCI_AUTO_CONN_DIRECT;
5822 else
5823 auto_conn = HCI_AUTO_CONN_REPORT;
5824
5825 /* Kernel internally uses conn_params with resolvable private
5826 * address, but Add Device allows only identity addresses.
5827 * Make sure it is enforced before calling
5828 * hci_conn_params_lookup.
5829 */
5830 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5831 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5832 MGMT_STATUS_INVALID_PARAMS,
5833 &cp->addr, sizeof(cp->addr));
5834 goto unlock;
5835 }
5836
5837 /* If the connection parameters don't exist for this device,
5838 * they will be created and configured with defaults.
5839 */
5840 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5841 auto_conn) < 0) {
5842 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5843 MGMT_STATUS_FAILED, &cp->addr,
5844 sizeof(cp->addr));
5845 goto unlock;
5846 }
5847
5848 hci_update_background_scan(hdev);
5849
5850 added:
5851 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5852
5853 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5854 MGMT_STATUS_SUCCESS, &cp->addr,
5855 sizeof(cp->addr));
5856
5857 unlock:
5858 hci_dev_unlock(hdev);
5859 return err;
5860 }
5861
5862 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5863 bdaddr_t *bdaddr, u8 type)
5864 {
5865 struct mgmt_ev_device_removed ev;
5866
5867 bacpy(&ev.addr.bdaddr, bdaddr);
5868 ev.addr.type = type;
5869
5870 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5871 }
5872
5873 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5874 void *data, u16 len)
5875 {
5876 struct mgmt_cp_remove_device *cp = data;
5877 int err;
5878
5879 BT_DBG("%s", hdev->name);
5880
5881 hci_dev_lock(hdev);
5882
5883 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5884 struct hci_conn_params *params;
5885 u8 addr_type;
5886
5887 if (!bdaddr_type_is_valid(cp->addr.type)) {
5888 err = mgmt_cmd_complete(sk, hdev->id,
5889 MGMT_OP_REMOVE_DEVICE,
5890 MGMT_STATUS_INVALID_PARAMS,
5891 &cp->addr, sizeof(cp->addr));
5892 goto unlock;
5893 }
5894
5895 if (cp->addr.type == BDADDR_BREDR) {
5896 err = hci_bdaddr_list_del(&hdev->whitelist,
5897 &cp->addr.bdaddr,
5898 cp->addr.type);
5899 if (err) {
5900 err = mgmt_cmd_complete(sk, hdev->id,
5901 MGMT_OP_REMOVE_DEVICE,
5902 MGMT_STATUS_INVALID_PARAMS,
5903 &cp->addr,
5904 sizeof(cp->addr));
5905 goto unlock;
5906 }
5907
5908 hci_req_update_scan(hdev);
5909
5910 device_removed(sk, hdev, &cp->addr.bdaddr,
5911 cp->addr.type);
5912 goto complete;
5913 }
5914
5915 addr_type = le_addr_type(cp->addr.type);
5916
5917 /* Kernel internally uses conn_params with resolvable private
5918 * address, but Remove Device allows only identity addresses.
5919 * Make sure it is enforced before calling
5920 * hci_conn_params_lookup.
5921 */
5922 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5923 err = mgmt_cmd_complete(sk, hdev->id,
5924 MGMT_OP_REMOVE_DEVICE,
5925 MGMT_STATUS_INVALID_PARAMS,
5926 &cp->addr, sizeof(cp->addr));
5927 goto unlock;
5928 }
5929
5930 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5931 addr_type);
5932 if (!params) {
5933 err = mgmt_cmd_complete(sk, hdev->id,
5934 MGMT_OP_REMOVE_DEVICE,
5935 MGMT_STATUS_INVALID_PARAMS,
5936 &cp->addr, sizeof(cp->addr));
5937 goto unlock;
5938 }
5939
5940 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5941 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5942 err = mgmt_cmd_complete(sk, hdev->id,
5943 MGMT_OP_REMOVE_DEVICE,
5944 MGMT_STATUS_INVALID_PARAMS,
5945 &cp->addr, sizeof(cp->addr));
5946 goto unlock;
5947 }
5948
5949 list_del(&params->action);
5950 list_del(&params->list);
5951 kfree(params);
5952 hci_update_background_scan(hdev);
5953
5954 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5955 } else {
5956 struct hci_conn_params *p, *tmp;
5957 struct bdaddr_list *b, *btmp;
5958
5959 if (cp->addr.type) {
5960 err = mgmt_cmd_complete(sk, hdev->id,
5961 MGMT_OP_REMOVE_DEVICE,
5962 MGMT_STATUS_INVALID_PARAMS,
5963 &cp->addr, sizeof(cp->addr));
5964 goto unlock;
5965 }
5966
5967 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5968 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5969 list_del(&b->list);
5970 kfree(b);
5971 }
5972
5973 hci_req_update_scan(hdev);
5974
5975 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5976 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5977 continue;
5978 device_removed(sk, hdev, &p->addr, p->addr_type);
5979 if (p->explicit_connect) {
5980 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5981 continue;
5982 }
5983 list_del(&p->action);
5984 list_del(&p->list);
5985 kfree(p);
5986 }
5987
5988 BT_DBG("All LE connection parameters were removed");
5989
5990 hci_update_background_scan(hdev);
5991 }
5992
5993 complete:
5994 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5995 MGMT_STATUS_SUCCESS, &cp->addr,
5996 sizeof(cp->addr));
5997 unlock:
5998 hci_dev_unlock(hdev);
5999 return err;
6000 }
6001
6002 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6003 u16 len)
6004 {
6005 struct mgmt_cp_load_conn_param *cp = data;
6006 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6007 sizeof(struct mgmt_conn_param));
6008 u16 param_count, expected_len;
6009 int i;
6010
6011 if (!lmp_le_capable(hdev))
6012 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6013 MGMT_STATUS_NOT_SUPPORTED);
6014
6015 param_count = __le16_to_cpu(cp->param_count);
6016 if (param_count > max_param_count) {
6017 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
6018 param_count);
6019 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6020 MGMT_STATUS_INVALID_PARAMS);
6021 }
6022
6023 expected_len = struct_size(cp, params, param_count);
6024 if (expected_len != len) {
6025 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
6026 expected_len, len);
6027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6028 MGMT_STATUS_INVALID_PARAMS);
6029 }
6030
6031 BT_DBG("%s param_count %u", hdev->name, param_count);
6032
6033 hci_dev_lock(hdev);
6034
6035 hci_conn_params_clear_disabled(hdev);
6036
6037 for (i = 0; i < param_count; i++) {
6038 struct mgmt_conn_param *param = &cp->params[i];
6039 struct hci_conn_params *hci_param;
6040 u16 min, max, latency, timeout;
6041 u8 addr_type;
6042
6043 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6044 param->addr.type);
6045
6046 if (param->addr.type == BDADDR_LE_PUBLIC) {
6047 addr_type = ADDR_LE_DEV_PUBLIC;
6048 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6049 addr_type = ADDR_LE_DEV_RANDOM;
6050 } else {
6051 bt_dev_err(hdev, "ignoring invalid connection parameters");
6052 continue;
6053 }
6054
6055 min = le16_to_cpu(param->min_interval);
6056 max = le16_to_cpu(param->max_interval);
6057 latency = le16_to_cpu(param->latency);
6058 timeout = le16_to_cpu(param->timeout);
6059
6060 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6061 min, max, latency, timeout);
6062
6063 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6064 bt_dev_err(hdev, "ignoring invalid connection parameters");
6065 continue;
6066 }
6067
6068 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6069 addr_type);
6070 if (!hci_param) {
6071 bt_dev_err(hdev, "failed to add connection parameters");
6072 continue;
6073 }
6074
6075 hci_param->conn_min_interval = min;
6076 hci_param->conn_max_interval = max;
6077 hci_param->conn_latency = latency;
6078 hci_param->supervision_timeout = timeout;
6079 }
6080
6081 hci_dev_unlock(hdev);
6082
6083 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6084 NULL, 0);
6085 }
6086
6087 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6088 void *data, u16 len)
6089 {
6090 struct mgmt_cp_set_external_config *cp = data;
6091 bool changed;
6092 int err;
6093
6094 BT_DBG("%s", hdev->name);
6095
6096 if (hdev_is_powered(hdev))
6097 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6098 MGMT_STATUS_REJECTED);
6099
6100 if (cp->config != 0x00 && cp->config != 0x01)
6101 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6102 MGMT_STATUS_INVALID_PARAMS);
6103
6104 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6105 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6106 MGMT_STATUS_NOT_SUPPORTED);
6107
6108 hci_dev_lock(hdev);
6109
6110 if (cp->config)
6111 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
6112 else
6113 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
6114
6115 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6116 if (err < 0)
6117 goto unlock;
6118
6119 if (!changed)
6120 goto unlock;
6121
6122 err = new_options(hdev, sk);
6123
6124 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
6125 mgmt_index_removed(hdev);
6126
6127 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
6128 hci_dev_set_flag(hdev, HCI_CONFIG);
6129 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6130
6131 queue_work(hdev->req_workqueue, &hdev->power_on);
6132 } else {
6133 set_bit(HCI_RAW, &hdev->flags);
6134 mgmt_index_added(hdev);
6135 }
6136 }
6137
6138 unlock:
6139 hci_dev_unlock(hdev);
6140 return err;
6141 }
6142
6143 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6144 void *data, u16 len)
6145 {
6146 struct mgmt_cp_set_public_address *cp = data;
6147 bool changed;
6148 int err;
6149
6150 BT_DBG("%s", hdev->name);
6151
6152 if (hdev_is_powered(hdev))
6153 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6154 MGMT_STATUS_REJECTED);
6155
6156 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6157 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6158 MGMT_STATUS_INVALID_PARAMS);
6159
6160 if (!hdev->set_bdaddr)
6161 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6162 MGMT_STATUS_NOT_SUPPORTED);
6163
6164 hci_dev_lock(hdev);
6165
6166 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6167 bacpy(&hdev->public_addr, &cp->bdaddr);
6168
6169 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6170 if (err < 0)
6171 goto unlock;
6172
6173 if (!changed)
6174 goto unlock;
6175
6176 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6177 err = new_options(hdev, sk);
6178
6179 if (is_configured(hdev)) {
6180 mgmt_index_removed(hdev);
6181
6182 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6183
6184 hci_dev_set_flag(hdev, HCI_CONFIG);
6185 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6186
6187 queue_work(hdev->req_workqueue, &hdev->power_on);
6188 }
6189
6190 unlock:
6191 hci_dev_unlock(hdev);
6192 return err;
6193 }
6194
6195 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6196 u16 opcode, struct sk_buff *skb)
6197 {
6198 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6199 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6200 u8 *h192, *r192, *h256, *r256;
6201 struct mgmt_pending_cmd *cmd;
6202 u16 eir_len;
6203 int err;
6204
6205 BT_DBG("%s status %u", hdev->name, status);
6206
6207 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6208 if (!cmd)
6209 return;
6210
6211 mgmt_cp = cmd->param;
6212
6213 if (status) {
6214 status = mgmt_status(status);
6215 eir_len = 0;
6216
6217 h192 = NULL;
6218 r192 = NULL;
6219 h256 = NULL;
6220 r256 = NULL;
6221 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6222 struct hci_rp_read_local_oob_data *rp;
6223
6224 if (skb->len != sizeof(*rp)) {
6225 status = MGMT_STATUS_FAILED;
6226 eir_len = 0;
6227 } else {
6228 status = MGMT_STATUS_SUCCESS;
6229 rp = (void *)skb->data;
6230
6231 eir_len = 5 + 18 + 18;
6232 h192 = rp->hash;
6233 r192 = rp->rand;
6234 h256 = NULL;
6235 r256 = NULL;
6236 }
6237 } else {
6238 struct hci_rp_read_local_oob_ext_data *rp;
6239
6240 if (skb->len != sizeof(*rp)) {
6241 status = MGMT_STATUS_FAILED;
6242 eir_len = 0;
6243 } else {
6244 status = MGMT_STATUS_SUCCESS;
6245 rp = (void *)skb->data;
6246
6247 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6248 eir_len = 5 + 18 + 18;
6249 h192 = NULL;
6250 r192 = NULL;
6251 } else {
6252 eir_len = 5 + 18 + 18 + 18 + 18;
6253 h192 = rp->hash192;
6254 r192 = rp->rand192;
6255 }
6256
6257 h256 = rp->hash256;
6258 r256 = rp->rand256;
6259 }
6260 }
6261
6262 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6263 if (!mgmt_rp)
6264 goto done;
6265
6266 if (status)
6267 goto send_rsp;
6268
6269 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6270 hdev->dev_class, 3);
6271
6272 if (h192 && r192) {
6273 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6274 EIR_SSP_HASH_C192, h192, 16);
6275 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6276 EIR_SSP_RAND_R192, r192, 16);
6277 }
6278
6279 if (h256 && r256) {
6280 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6281 EIR_SSP_HASH_C256, h256, 16);
6282 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6283 EIR_SSP_RAND_R256, r256, 16);
6284 }
6285
6286 send_rsp:
6287 mgmt_rp->type = mgmt_cp->type;
6288 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6289
6290 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6291 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6292 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6293 if (err < 0 || status)
6294 goto done;
6295
6296 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6297
6298 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6299 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6300 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6301 done:
6302 kfree(mgmt_rp);
6303 mgmt_pending_remove(cmd);
6304 }
6305
6306 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6307 struct mgmt_cp_read_local_oob_ext_data *cp)
6308 {
6309 struct mgmt_pending_cmd *cmd;
6310 struct hci_request req;
6311 int err;
6312
6313 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6314 cp, sizeof(*cp));
6315 if (!cmd)
6316 return -ENOMEM;
6317
6318 hci_req_init(&req, hdev);
6319
6320 if (bredr_sc_enabled(hdev))
6321 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6322 else
6323 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6324
6325 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6326 if (err < 0) {
6327 mgmt_pending_remove(cmd);
6328 return err;
6329 }
6330
6331 return 0;
6332 }
6333
6334 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6335 void *data, u16 data_len)
6336 {
6337 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6338 struct mgmt_rp_read_local_oob_ext_data *rp;
6339 size_t rp_len;
6340 u16 eir_len;
6341 u8 status, flags, role, addr[7], hash[16], rand[16];
6342 int err;
6343
6344 BT_DBG("%s", hdev->name);
6345
6346 if (hdev_is_powered(hdev)) {
6347 switch (cp->type) {
6348 case BIT(BDADDR_BREDR):
6349 status = mgmt_bredr_support(hdev);
6350 if (status)
6351 eir_len = 0;
6352 else
6353 eir_len = 5;
6354 break;
6355 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6356 status = mgmt_le_support(hdev);
6357 if (status)
6358 eir_len = 0;
6359 else
6360 eir_len = 9 + 3 + 18 + 18 + 3;
6361 break;
6362 default:
6363 status = MGMT_STATUS_INVALID_PARAMS;
6364 eir_len = 0;
6365 break;
6366 }
6367 } else {
6368 status = MGMT_STATUS_NOT_POWERED;
6369 eir_len = 0;
6370 }
6371
6372 rp_len = sizeof(*rp) + eir_len;
6373 rp = kmalloc(rp_len, GFP_ATOMIC);
6374 if (!rp)
6375 return -ENOMEM;
6376
6377 if (status)
6378 goto complete;
6379
6380 hci_dev_lock(hdev);
6381
6382 eir_len = 0;
6383 switch (cp->type) {
6384 case BIT(BDADDR_BREDR):
6385 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6386 err = read_local_ssp_oob_req(hdev, sk, cp);
6387 hci_dev_unlock(hdev);
6388 if (!err)
6389 goto done;
6390
6391 status = MGMT_STATUS_FAILED;
6392 goto complete;
6393 } else {
6394 eir_len = eir_append_data(rp->eir, eir_len,
6395 EIR_CLASS_OF_DEV,
6396 hdev->dev_class, 3);
6397 }
6398 break;
6399 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6400 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6401 smp_generate_oob(hdev, hash, rand) < 0) {
6402 hci_dev_unlock(hdev);
6403 status = MGMT_STATUS_FAILED;
6404 goto complete;
6405 }
6406
6407 /* This should return the active RPA, but since the RPA
6408 * is only programmed on demand, it is really hard to fill
6409 * this in at the moment. For now disallow retrieving
6410 * local out-of-band data when privacy is in use.
6411 *
6412 * Returning the identity address will not help here since
6413 * pairing happens before the identity resolving key is
6414 * known and thus the connection establishment happens
6415 * based on the RPA and not the identity address.
6416 */
6417 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6418 hci_dev_unlock(hdev);
6419 status = MGMT_STATUS_REJECTED;
6420 goto complete;
6421 }
6422
6423 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6424 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6425 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6426 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6427 memcpy(addr, &hdev->static_addr, 6);
6428 addr[6] = 0x01;
6429 } else {
6430 memcpy(addr, &hdev->bdaddr, 6);
6431 addr[6] = 0x00;
6432 }
6433
6434 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6435 addr, sizeof(addr));
6436
6437 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6438 role = 0x02;
6439 else
6440 role = 0x01;
6441
6442 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6443 &role, sizeof(role));
6444
6445 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6446 eir_len = eir_append_data(rp->eir, eir_len,
6447 EIR_LE_SC_CONFIRM,
6448 hash, sizeof(hash));
6449
6450 eir_len = eir_append_data(rp->eir, eir_len,
6451 EIR_LE_SC_RANDOM,
6452 rand, sizeof(rand));
6453 }
6454
6455 flags = mgmt_get_adv_discov_flags(hdev);
6456
6457 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6458 flags |= LE_AD_NO_BREDR;
6459
6460 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6461 &flags, sizeof(flags));
6462 break;
6463 }
6464
6465 hci_dev_unlock(hdev);
6466
6467 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6468
6469 status = MGMT_STATUS_SUCCESS;
6470
6471 complete:
6472 rp->type = cp->type;
6473 rp->eir_len = cpu_to_le16(eir_len);
6474
6475 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6476 status, rp, sizeof(*rp) + eir_len);
6477 if (err < 0 || status)
6478 goto done;
6479
6480 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6481 rp, sizeof(*rp) + eir_len,
6482 HCI_MGMT_OOB_DATA_EVENTS, sk);
6483
6484 done:
6485 kfree(rp);
6486
6487 return err;
6488 }
6489
6490 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6491 {
6492 u32 flags = 0;
6493
6494 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6495 flags |= MGMT_ADV_FLAG_DISCOV;
6496 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6497 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6498 flags |= MGMT_ADV_FLAG_APPEARANCE;
6499 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6500
6501 /* In extended adv TX_POWER returned from Set Adv Param
6502 * will be always valid.
6503 */
6504 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6505 ext_adv_capable(hdev))
6506 flags |= MGMT_ADV_FLAG_TX_POWER;
6507
6508 if (ext_adv_capable(hdev)) {
6509 flags |= MGMT_ADV_FLAG_SEC_1M;
6510
6511 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6512 flags |= MGMT_ADV_FLAG_SEC_2M;
6513
6514 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6515 flags |= MGMT_ADV_FLAG_SEC_CODED;
6516 }
6517
6518 return flags;
6519 }
6520
6521 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6522 void *data, u16 data_len)
6523 {
6524 struct mgmt_rp_read_adv_features *rp;
6525 size_t rp_len;
6526 int err;
6527 struct adv_info *adv_instance;
6528 u32 supported_flags;
6529 u8 *instance;
6530
6531 BT_DBG("%s", hdev->name);
6532
6533 if (!lmp_le_capable(hdev))
6534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6535 MGMT_STATUS_REJECTED);
6536
6537 hci_dev_lock(hdev);
6538
6539 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6540 rp = kmalloc(rp_len, GFP_ATOMIC);
6541 if (!rp) {
6542 hci_dev_unlock(hdev);
6543 return -ENOMEM;
6544 }
6545
6546 supported_flags = get_supported_adv_flags(hdev);
6547
6548 rp->supported_flags = cpu_to_le32(supported_flags);
6549 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6550 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6551 rp->max_instances = HCI_MAX_ADV_INSTANCES;
6552 rp->num_instances = hdev->adv_instance_cnt;
6553
6554 instance = rp->instance;
6555 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6556 *instance = adv_instance->instance;
6557 instance++;
6558 }
6559
6560 hci_dev_unlock(hdev);
6561
6562 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6563 MGMT_STATUS_SUCCESS, rp, rp_len);
6564
6565 kfree(rp);
6566
6567 return err;
6568 }
6569
6570 static u8 calculate_name_len(struct hci_dev *hdev)
6571 {
6572 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6573
6574 return append_local_name(hdev, buf, 0);
6575 }
6576
6577 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6578 bool is_adv_data)
6579 {
6580 u8 max_len = HCI_MAX_AD_LENGTH;
6581
6582 if (is_adv_data) {
6583 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6584 MGMT_ADV_FLAG_LIMITED_DISCOV |
6585 MGMT_ADV_FLAG_MANAGED_FLAGS))
6586 max_len -= 3;
6587
6588 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6589 max_len -= 3;
6590 } else {
6591 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6592 max_len -= calculate_name_len(hdev);
6593
6594 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6595 max_len -= 4;
6596 }
6597
6598 return max_len;
6599 }
6600
6601 static bool flags_managed(u32 adv_flags)
6602 {
6603 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6604 MGMT_ADV_FLAG_LIMITED_DISCOV |
6605 MGMT_ADV_FLAG_MANAGED_FLAGS);
6606 }
6607
6608 static bool tx_power_managed(u32 adv_flags)
6609 {
6610 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6611 }
6612
6613 static bool name_managed(u32 adv_flags)
6614 {
6615 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6616 }
6617
6618 static bool appearance_managed(u32 adv_flags)
6619 {
6620 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6621 }
6622
6623 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6624 u8 len, bool is_adv_data)
6625 {
6626 int i, cur_len;
6627 u8 max_len;
6628
6629 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6630
6631 if (len > max_len)
6632 return false;
6633
6634 /* Make sure that the data is correctly formatted. */
6635 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6636 cur_len = data[i];
6637
6638 if (data[i + 1] == EIR_FLAGS &&
6639 (!is_adv_data || flags_managed(adv_flags)))
6640 return false;
6641
6642 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6643 return false;
6644
6645 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6646 return false;
6647
6648 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6649 return false;
6650
6651 if (data[i + 1] == EIR_APPEARANCE &&
6652 appearance_managed(adv_flags))
6653 return false;
6654
6655 /* If the current field length would exceed the total data
6656 * length, then it's invalid.
6657 */
6658 if (i + cur_len >= len)
6659 return false;
6660 }
6661
6662 return true;
6663 }
6664
6665 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6666 u16 opcode)
6667 {
6668 struct mgmt_pending_cmd *cmd;
6669 struct mgmt_cp_add_advertising *cp;
6670 struct mgmt_rp_add_advertising rp;
6671 struct adv_info *adv_instance, *n;
6672 u8 instance;
6673
6674 BT_DBG("status %d", status);
6675
6676 hci_dev_lock(hdev);
6677
6678 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6679
6680 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6681 if (!adv_instance->pending)
6682 continue;
6683
6684 if (!status) {
6685 adv_instance->pending = false;
6686 continue;
6687 }
6688
6689 instance = adv_instance->instance;
6690
6691 if (hdev->cur_adv_instance == instance)
6692 cancel_adv_timeout(hdev);
6693
6694 hci_remove_adv_instance(hdev, instance);
6695 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6696 }
6697
6698 if (!cmd)
6699 goto unlock;
6700
6701 cp = cmd->param;
6702 rp.instance = cp->instance;
6703
6704 if (status)
6705 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6706 mgmt_status(status));
6707 else
6708 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6709 mgmt_status(status), &rp, sizeof(rp));
6710
6711 mgmt_pending_remove(cmd);
6712
6713 unlock:
6714 hci_dev_unlock(hdev);
6715 }
6716
6717 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6718 void *data, u16 data_len)
6719 {
6720 struct mgmt_cp_add_advertising *cp = data;
6721 struct mgmt_rp_add_advertising rp;
6722 u32 flags;
6723 u32 supported_flags, phy_flags;
6724 u8 status;
6725 u16 timeout, duration;
6726 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6727 u8 schedule_instance = 0;
6728 struct adv_info *next_instance;
6729 int err;
6730 struct mgmt_pending_cmd *cmd;
6731 struct hci_request req;
6732
6733 BT_DBG("%s", hdev->name);
6734
6735 status = mgmt_le_support(hdev);
6736 if (status)
6737 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6738 status);
6739
6740 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6741 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6742 MGMT_STATUS_INVALID_PARAMS);
6743
6744 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6745 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6746 MGMT_STATUS_INVALID_PARAMS);
6747
6748 flags = __le32_to_cpu(cp->flags);
6749 timeout = __le16_to_cpu(cp->timeout);
6750 duration = __le16_to_cpu(cp->duration);
6751
6752 /* The current implementation only supports a subset of the specified
6753 * flags. Also need to check mutual exclusiveness of sec flags.
6754 */
6755 supported_flags = get_supported_adv_flags(hdev);
6756 phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6757 if (flags & ~supported_flags ||
6758 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6759 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6760 MGMT_STATUS_INVALID_PARAMS);
6761
6762 hci_dev_lock(hdev);
6763
6764 if (timeout && !hdev_is_powered(hdev)) {
6765 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6766 MGMT_STATUS_REJECTED);
6767 goto unlock;
6768 }
6769
6770 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6771 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6772 pending_find(MGMT_OP_SET_LE, hdev)) {
6773 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6774 MGMT_STATUS_BUSY);
6775 goto unlock;
6776 }
6777
6778 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6779 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6780 cp->scan_rsp_len, false)) {
6781 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6782 MGMT_STATUS_INVALID_PARAMS);
6783 goto unlock;
6784 }
6785
6786 err = hci_add_adv_instance(hdev, cp->instance, flags,
6787 cp->adv_data_len, cp->data,
6788 cp->scan_rsp_len,
6789 cp->data + cp->adv_data_len,
6790 timeout, duration);
6791 if (err < 0) {
6792 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6793 MGMT_STATUS_FAILED);
6794 goto unlock;
6795 }
6796
6797 /* Only trigger an advertising added event if a new instance was
6798 * actually added.
6799 */
6800 if (hdev->adv_instance_cnt > prev_instance_cnt)
6801 mgmt_advertising_added(sk, hdev, cp->instance);
6802
6803 if (hdev->cur_adv_instance == cp->instance) {
6804 /* If the currently advertised instance is being changed then
6805 * cancel the current advertising and schedule the next
6806 * instance. If there is only one instance then the overridden
6807 * advertising data will be visible right away.
6808 */
6809 cancel_adv_timeout(hdev);
6810
6811 next_instance = hci_get_next_instance(hdev, cp->instance);
6812 if (next_instance)
6813 schedule_instance = next_instance->instance;
6814 } else if (!hdev->adv_instance_timeout) {
6815 /* Immediately advertise the new instance if no other
6816 * instance is currently being advertised.
6817 */
6818 schedule_instance = cp->instance;
6819 }
6820
6821 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6822 * there is no instance to be advertised then we have no HCI
6823 * communication to make. Simply return.
6824 */
6825 if (!hdev_is_powered(hdev) ||
6826 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6827 !schedule_instance) {
6828 rp.instance = cp->instance;
6829 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6830 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6831 goto unlock;
6832 }
6833
6834 /* We're good to go, update advertising data, parameters, and start
6835 * advertising.
6836 */
6837 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6838 data_len);
6839 if (!cmd) {
6840 err = -ENOMEM;
6841 goto unlock;
6842 }
6843
6844 hci_req_init(&req, hdev);
6845
6846 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6847
6848 if (!err)
6849 err = hci_req_run(&req, add_advertising_complete);
6850
6851 if (err < 0) {
6852 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6853 MGMT_STATUS_FAILED);
6854 mgmt_pending_remove(cmd);
6855 }
6856
6857 unlock:
6858 hci_dev_unlock(hdev);
6859
6860 return err;
6861 }
6862
6863 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6864 u16 opcode)
6865 {
6866 struct mgmt_pending_cmd *cmd;
6867 struct mgmt_cp_remove_advertising *cp;
6868 struct mgmt_rp_remove_advertising rp;
6869
6870 BT_DBG("status %d", status);
6871
6872 hci_dev_lock(hdev);
6873
6874 /* A failure status here only means that we failed to disable
6875 * advertising. Otherwise, the advertising instance has been removed,
6876 * so report success.
6877 */
6878 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6879 if (!cmd)
6880 goto unlock;
6881
6882 cp = cmd->param;
6883 rp.instance = cp->instance;
6884
6885 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6886 &rp, sizeof(rp));
6887 mgmt_pending_remove(cmd);
6888
6889 unlock:
6890 hci_dev_unlock(hdev);
6891 }
6892
6893 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6894 void *data, u16 data_len)
6895 {
6896 struct mgmt_cp_remove_advertising *cp = data;
6897 struct mgmt_rp_remove_advertising rp;
6898 struct mgmt_pending_cmd *cmd;
6899 struct hci_request req;
6900 int err;
6901
6902 BT_DBG("%s", hdev->name);
6903
6904 hci_dev_lock(hdev);
6905
6906 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6907 err = mgmt_cmd_status(sk, hdev->id,
6908 MGMT_OP_REMOVE_ADVERTISING,
6909 MGMT_STATUS_INVALID_PARAMS);
6910 goto unlock;
6911 }
6912
6913 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6914 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6915 pending_find(MGMT_OP_SET_LE, hdev)) {
6916 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6917 MGMT_STATUS_BUSY);
6918 goto unlock;
6919 }
6920
6921 if (list_empty(&hdev->adv_instances)) {
6922 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6923 MGMT_STATUS_INVALID_PARAMS);
6924 goto unlock;
6925 }
6926
6927 hci_req_init(&req, hdev);
6928
6929 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6930
6931 if (list_empty(&hdev->adv_instances))
6932 __hci_req_disable_advertising(&req);
6933
6934 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6935 * flag is set or the device isn't powered then we have no HCI
6936 * communication to make. Simply return.
6937 */
6938 if (skb_queue_empty(&req.cmd_q) ||
6939 !hdev_is_powered(hdev) ||
6940 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6941 hci_req_purge(&req);
6942 rp.instance = cp->instance;
6943 err = mgmt_cmd_complete(sk, hdev->id,
6944 MGMT_OP_REMOVE_ADVERTISING,
6945 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6946 goto unlock;
6947 }
6948
6949 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6950 data_len);
6951 if (!cmd) {
6952 err = -ENOMEM;
6953 goto unlock;
6954 }
6955
6956 err = hci_req_run(&req, remove_advertising_complete);
6957 if (err < 0)
6958 mgmt_pending_remove(cmd);
6959
6960 unlock:
6961 hci_dev_unlock(hdev);
6962
6963 return err;
6964 }
6965
6966 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6967 void *data, u16 data_len)
6968 {
6969 struct mgmt_cp_get_adv_size_info *cp = data;
6970 struct mgmt_rp_get_adv_size_info rp;
6971 u32 flags, supported_flags;
6972 int err;
6973
6974 BT_DBG("%s", hdev->name);
6975
6976 if (!lmp_le_capable(hdev))
6977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6978 MGMT_STATUS_REJECTED);
6979
6980 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6982 MGMT_STATUS_INVALID_PARAMS);
6983
6984 flags = __le32_to_cpu(cp->flags);
6985
6986 /* The current implementation only supports a subset of the specified
6987 * flags.
6988 */
6989 supported_flags = get_supported_adv_flags(hdev);
6990 if (flags & ~supported_flags)
6991 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6992 MGMT_STATUS_INVALID_PARAMS);
6993
6994 rp.instance = cp->instance;
6995 rp.flags = cp->flags;
6996 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6997 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6998
6999 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
7000 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7001
7002 return err;
7003 }
7004
7005 static const struct hci_mgmt_handler mgmt_handlers[] = {
7006 { NULL }, /* 0x0000 (no command) */
7007 { read_version, MGMT_READ_VERSION_SIZE,
7008 HCI_MGMT_NO_HDEV |
7009 HCI_MGMT_UNTRUSTED },
7010 { read_commands, MGMT_READ_COMMANDS_SIZE,
7011 HCI_MGMT_NO_HDEV |
7012 HCI_MGMT_UNTRUSTED },
7013 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
7014 HCI_MGMT_NO_HDEV |
7015 HCI_MGMT_UNTRUSTED },
7016 { read_controller_info, MGMT_READ_INFO_SIZE,
7017 HCI_MGMT_UNTRUSTED },
7018 { set_powered, MGMT_SETTING_SIZE },
7019 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
7020 { set_connectable, MGMT_SETTING_SIZE },
7021 { set_fast_connectable, MGMT_SETTING_SIZE },
7022 { set_bondable, MGMT_SETTING_SIZE },
7023 { set_link_security, MGMT_SETTING_SIZE },
7024 { set_ssp, MGMT_SETTING_SIZE },
7025 { set_hs, MGMT_SETTING_SIZE },
7026 { set_le, MGMT_SETTING_SIZE },
7027 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
7028 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
7029 { add_uuid, MGMT_ADD_UUID_SIZE },
7030 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
7031 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
7032 HCI_MGMT_VAR_LEN },
7033 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7034 HCI_MGMT_VAR_LEN },
7035 { disconnect, MGMT_DISCONNECT_SIZE },
7036 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
7037 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
7038 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
7039 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
7040 { pair_device, MGMT_PAIR_DEVICE_SIZE },
7041 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
7042 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
7043 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
7044 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7045 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
7046 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
7047 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
7048 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7049 HCI_MGMT_VAR_LEN },
7050 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7051 { start_discovery, MGMT_START_DISCOVERY_SIZE },
7052 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
7053 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
7054 { block_device, MGMT_BLOCK_DEVICE_SIZE },
7055 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
7056 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
7057 { set_advertising, MGMT_SETTING_SIZE },
7058 { set_bredr, MGMT_SETTING_SIZE },
7059 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
7060 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
7061 { set_secure_conn, MGMT_SETTING_SIZE },
7062 { set_debug_keys, MGMT_SETTING_SIZE },
7063 { set_privacy, MGMT_SET_PRIVACY_SIZE },
7064 { load_irks, MGMT_LOAD_IRKS_SIZE,
7065 HCI_MGMT_VAR_LEN },
7066 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
7067 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
7068 { add_device, MGMT_ADD_DEVICE_SIZE },
7069 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
7070 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
7071 HCI_MGMT_VAR_LEN },
7072 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
7073 HCI_MGMT_NO_HDEV |
7074 HCI_MGMT_UNTRUSTED },
7075 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
7076 HCI_MGMT_UNCONFIGURED |
7077 HCI_MGMT_UNTRUSTED },
7078 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
7079 HCI_MGMT_UNCONFIGURED },
7080 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
7081 HCI_MGMT_UNCONFIGURED },
7082 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7083 HCI_MGMT_VAR_LEN },
7084 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
7085 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
7086 HCI_MGMT_NO_HDEV |
7087 HCI_MGMT_UNTRUSTED },
7088 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
7089 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7090 HCI_MGMT_VAR_LEN },
7091 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
7092 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
7093 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
7094 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
7095 HCI_MGMT_UNTRUSTED },
7096 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
7097 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
7098 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
7099 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE,
7100 HCI_MGMT_VAR_LEN },
7101 { set_wideband_speech, MGMT_SETTING_SIZE },
7102 };
7103
7104 void mgmt_index_added(struct hci_dev *hdev)
7105 {
7106 struct mgmt_ev_ext_index ev;
7107
7108 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7109 return;
7110
7111 switch (hdev->dev_type) {
7112 case HCI_PRIMARY:
7113 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7114 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7115 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7116 ev.type = 0x01;
7117 } else {
7118 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7119 HCI_MGMT_INDEX_EVENTS);
7120 ev.type = 0x00;
7121 }
7122 break;
7123 case HCI_AMP:
7124 ev.type = 0x02;
7125 break;
7126 default:
7127 return;
7128 }
7129
7130 ev.bus = hdev->bus;
7131
7132 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7133 HCI_MGMT_EXT_INDEX_EVENTS);
7134 }
7135
7136 void mgmt_index_removed(struct hci_dev *hdev)
7137 {
7138 struct mgmt_ev_ext_index ev;
7139 u8 status = MGMT_STATUS_INVALID_INDEX;
7140
7141 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7142 return;
7143
7144 switch (hdev->dev_type) {
7145 case HCI_PRIMARY:
7146 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7147
7148 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7149 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7150 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
7151 ev.type = 0x01;
7152 } else {
7153 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7154 HCI_MGMT_INDEX_EVENTS);
7155 ev.type = 0x00;
7156 }
7157 break;
7158 case HCI_AMP:
7159 ev.type = 0x02;
7160 break;
7161 default:
7162 return;
7163 }
7164
7165 ev.bus = hdev->bus;
7166
7167 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7168 HCI_MGMT_EXT_INDEX_EVENTS);
7169 }
7170
7171 /* This function requires the caller holds hdev->lock */
7172 static void restart_le_actions(struct hci_dev *hdev)
7173 {
7174 struct hci_conn_params *p;
7175
7176 list_for_each_entry(p, &hdev->le_conn_params, list) {
7177 /* Needed for AUTO_OFF case where might not "really"
7178 * have been powered off.
7179 */
7180 list_del_init(&p->action);
7181
7182 switch (p->auto_connect) {
7183 case HCI_AUTO_CONN_DIRECT:
7184 case HCI_AUTO_CONN_ALWAYS:
7185 list_add(&p->action, &hdev->pend_le_conns);
7186 break;
7187 case HCI_AUTO_CONN_REPORT:
7188 list_add(&p->action, &hdev->pend_le_reports);
7189 break;
7190 default:
7191 break;
7192 }
7193 }
7194 }
7195
7196 void mgmt_power_on(struct hci_dev *hdev, int err)
7197 {
7198 struct cmd_lookup match = { NULL, hdev };
7199
7200 BT_DBG("err %d", err);
7201
7202 hci_dev_lock(hdev);
7203
7204 if (!err) {
7205 restart_le_actions(hdev);
7206 hci_update_background_scan(hdev);
7207 }
7208
7209 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7210
7211 new_settings(hdev, match.sk);
7212
7213 if (match.sk)
7214 sock_put(match.sk);
7215
7216 hci_dev_unlock(hdev);
7217 }
7218
7219 void __mgmt_power_off(struct hci_dev *hdev)
7220 {
7221 struct cmd_lookup match = { NULL, hdev };
7222 u8 status, zero_cod[] = { 0, 0, 0 };
7223
7224 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7225
7226 /* If the power off is because of hdev unregistration let
7227 * use the appropriate INVALID_INDEX status. Otherwise use
7228 * NOT_POWERED. We cover both scenarios here since later in
7229 * mgmt_index_removed() any hci_conn callbacks will have already
7230 * been triggered, potentially causing misleading DISCONNECTED
7231 * status responses.
7232 */
7233 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7234 status = MGMT_STATUS_INVALID_INDEX;
7235 else
7236 status = MGMT_STATUS_NOT_POWERED;
7237
7238 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7239
7240 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7241 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7242 zero_cod, sizeof(zero_cod),
7243 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7244 ext_info_changed(hdev, NULL);
7245 }
7246
7247 new_settings(hdev, match.sk);
7248
7249 if (match.sk)
7250 sock_put(match.sk);
7251 }
7252
7253 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7254 {
7255 struct mgmt_pending_cmd *cmd;
7256 u8 status;
7257
7258 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7259 if (!cmd)
7260 return;
7261
7262 if (err == -ERFKILL)
7263 status = MGMT_STATUS_RFKILLED;
7264 else
7265 status = MGMT_STATUS_FAILED;
7266
7267 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7268
7269 mgmt_pending_remove(cmd);
7270 }
7271
7272 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7273 bool persistent)
7274 {
7275 struct mgmt_ev_new_link_key ev;
7276
7277 memset(&ev, 0, sizeof(ev));
7278
7279 ev.store_hint = persistent;
7280 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7281 ev.key.addr.type = BDADDR_BREDR;
7282 ev.key.type = key->type;
7283 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7284 ev.key.pin_len = key->pin_len;
7285
7286 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7287 }
7288
7289 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7290 {
7291 switch (ltk->type) {
7292 case SMP_LTK:
7293 case SMP_LTK_SLAVE:
7294 if (ltk->authenticated)
7295 return MGMT_LTK_AUTHENTICATED;
7296 return MGMT_LTK_UNAUTHENTICATED;
7297 case SMP_LTK_P256:
7298 if (ltk->authenticated)
7299 return MGMT_LTK_P256_AUTH;
7300 return MGMT_LTK_P256_UNAUTH;
7301 case SMP_LTK_P256_DEBUG:
7302 return MGMT_LTK_P256_DEBUG;
7303 }
7304
7305 return MGMT_LTK_UNAUTHENTICATED;
7306 }
7307
7308 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7309 {
7310 struct mgmt_ev_new_long_term_key ev;
7311
7312 memset(&ev, 0, sizeof(ev));
7313
7314 /* Devices using resolvable or non-resolvable random addresses
7315 * without providing an identity resolving key don't require
7316 * to store long term keys. Their addresses will change the
7317 * next time around.
7318 *
7319 * Only when a remote device provides an identity address
7320 * make sure the long term key is stored. If the remote
7321 * identity is known, the long term keys are internally
7322 * mapped to the identity address. So allow static random
7323 * and public addresses here.
7324 */
7325 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7326 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7327 ev.store_hint = 0x00;
7328 else
7329 ev.store_hint = persistent;
7330
7331 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7332 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7333 ev.key.type = mgmt_ltk_type(key);
7334 ev.key.enc_size = key->enc_size;
7335 ev.key.ediv = key->ediv;
7336 ev.key.rand = key->rand;
7337
7338 if (key->type == SMP_LTK)
7339 ev.key.master = 1;
7340
7341 /* Make sure we copy only the significant bytes based on the
7342 * encryption key size, and set the rest of the value to zeroes.
7343 */
7344 memcpy(ev.key.val, key->val, key->enc_size);
7345 memset(ev.key.val + key->enc_size, 0,
7346 sizeof(ev.key.val) - key->enc_size);
7347
7348 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7349 }
7350
7351 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7352 {
7353 struct mgmt_ev_new_irk ev;
7354
7355 memset(&ev, 0, sizeof(ev));
7356
7357 ev.store_hint = persistent;
7358
7359 bacpy(&ev.rpa, &irk->rpa);
7360 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7361 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7362 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7363
7364 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7365 }
7366
7367 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7368 bool persistent)
7369 {
7370 struct mgmt_ev_new_csrk ev;
7371
7372 memset(&ev, 0, sizeof(ev));
7373
7374 /* Devices using resolvable or non-resolvable random addresses
7375 * without providing an identity resolving key don't require
7376 * to store signature resolving keys. Their addresses will change
7377 * the next time around.
7378 *
7379 * Only when a remote device provides an identity address
7380 * make sure the signature resolving key is stored. So allow
7381 * static random and public addresses here.
7382 */
7383 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7384 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7385 ev.store_hint = 0x00;
7386 else
7387 ev.store_hint = persistent;
7388
7389 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7390 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7391 ev.key.type = csrk->type;
7392 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7393
7394 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7395 }
7396
7397 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7398 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7399 u16 max_interval, u16 latency, u16 timeout)
7400 {
7401 struct mgmt_ev_new_conn_param ev;
7402
7403 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7404 return;
7405
7406 memset(&ev, 0, sizeof(ev));
7407 bacpy(&ev.addr.bdaddr, bdaddr);
7408 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7409 ev.store_hint = store_hint;
7410 ev.min_interval = cpu_to_le16(min_interval);
7411 ev.max_interval = cpu_to_le16(max_interval);
7412 ev.latency = cpu_to_le16(latency);
7413 ev.timeout = cpu_to_le16(timeout);
7414
7415 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7416 }
7417
7418 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7419 u32 flags, u8 *name, u8 name_len)
7420 {
7421 char buf[512];
7422 struct mgmt_ev_device_connected *ev = (void *) buf;
7423 u16 eir_len = 0;
7424
7425 bacpy(&ev->addr.bdaddr, &conn->dst);
7426 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7427
7428 ev->flags = __cpu_to_le32(flags);
7429
7430 /* We must ensure that the EIR Data fields are ordered and
7431 * unique. Keep it simple for now and avoid the problem by not
7432 * adding any BR/EDR data to the LE adv.
7433 */
7434 if (conn->le_adv_data_len > 0) {
7435 memcpy(&ev->eir[eir_len],
7436 conn->le_adv_data, conn->le_adv_data_len);
7437 eir_len = conn->le_adv_data_len;
7438 } else {
7439 if (name_len > 0)
7440 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7441 name, name_len);
7442
7443 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7444 eir_len = eir_append_data(ev->eir, eir_len,
7445 EIR_CLASS_OF_DEV,
7446 conn->dev_class, 3);
7447 }
7448
7449 ev->eir_len = cpu_to_le16(eir_len);
7450
7451 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7452 sizeof(*ev) + eir_len, NULL);
7453 }
7454
7455 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7456 {
7457 struct sock **sk = data;
7458
7459 cmd->cmd_complete(cmd, 0);
7460
7461 *sk = cmd->sk;
7462 sock_hold(*sk);
7463
7464 mgmt_pending_remove(cmd);
7465 }
7466
7467 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7468 {
7469 struct hci_dev *hdev = data;
7470 struct mgmt_cp_unpair_device *cp = cmd->param;
7471
7472 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7473
7474 cmd->cmd_complete(cmd, 0);
7475 mgmt_pending_remove(cmd);
7476 }
7477
7478 bool mgmt_powering_down(struct hci_dev *hdev)
7479 {
7480 struct mgmt_pending_cmd *cmd;
7481 struct mgmt_mode *cp;
7482
7483 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7484 if (!cmd)
7485 return false;
7486
7487 cp = cmd->param;
7488 if (!cp->val)
7489 return true;
7490
7491 return false;
7492 }
7493
7494 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7495 u8 link_type, u8 addr_type, u8 reason,
7496 bool mgmt_connected)
7497 {
7498 struct mgmt_ev_device_disconnected ev;
7499 struct sock *sk = NULL;
7500
7501 /* The connection is still in hci_conn_hash so test for 1
7502 * instead of 0 to know if this is the last one.
7503 */
7504 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7505 cancel_delayed_work(&hdev->power_off);
7506 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7507 }
7508
7509 if (!mgmt_connected)
7510 return;
7511
7512 if (link_type != ACL_LINK && link_type != LE_LINK)
7513 return;
7514
7515 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7516
7517 bacpy(&ev.addr.bdaddr, bdaddr);
7518 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7519 ev.reason = reason;
7520
7521 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7522
7523 if (sk)
7524 sock_put(sk);
7525
7526 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7527 hdev);
7528 }
7529
7530 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7531 u8 link_type, u8 addr_type, u8 status)
7532 {
7533 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7534 struct mgmt_cp_disconnect *cp;
7535 struct mgmt_pending_cmd *cmd;
7536
7537 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7538 hdev);
7539
7540 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7541 if (!cmd)
7542 return;
7543
7544 cp = cmd->param;
7545
7546 if (bacmp(bdaddr, &cp->addr.bdaddr))
7547 return;
7548
7549 if (cp->addr.type != bdaddr_type)
7550 return;
7551
7552 cmd->cmd_complete(cmd, mgmt_status(status));
7553 mgmt_pending_remove(cmd);
7554 }
7555
7556 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7557 u8 addr_type, u8 status)
7558 {
7559 struct mgmt_ev_connect_failed ev;
7560
7561 /* The connection is still in hci_conn_hash so test for 1
7562 * instead of 0 to know if this is the last one.
7563 */
7564 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7565 cancel_delayed_work(&hdev->power_off);
7566 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7567 }
7568
7569 bacpy(&ev.addr.bdaddr, bdaddr);
7570 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7571 ev.status = mgmt_status(status);
7572
7573 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7574 }
7575
7576 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7577 {
7578 struct mgmt_ev_pin_code_request ev;
7579
7580 bacpy(&ev.addr.bdaddr, bdaddr);
7581 ev.addr.type = BDADDR_BREDR;
7582 ev.secure = secure;
7583
7584 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7585 }
7586
7587 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7588 u8 status)
7589 {
7590 struct mgmt_pending_cmd *cmd;
7591
7592 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7593 if (!cmd)
7594 return;
7595
7596 cmd->cmd_complete(cmd, mgmt_status(status));
7597 mgmt_pending_remove(cmd);
7598 }
7599
7600 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7601 u8 status)
7602 {
7603 struct mgmt_pending_cmd *cmd;
7604
7605 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7606 if (!cmd)
7607 return;
7608
7609 cmd->cmd_complete(cmd, mgmt_status(status));
7610 mgmt_pending_remove(cmd);
7611 }
7612
7613 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7614 u8 link_type, u8 addr_type, u32 value,
7615 u8 confirm_hint)
7616 {
7617 struct mgmt_ev_user_confirm_request ev;
7618
7619 BT_DBG("%s", hdev->name);
7620
7621 bacpy(&ev.addr.bdaddr, bdaddr);
7622 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7623 ev.confirm_hint = confirm_hint;
7624 ev.value = cpu_to_le32(value);
7625
7626 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7627 NULL);
7628 }
7629
7630 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7631 u8 link_type, u8 addr_type)
7632 {
7633 struct mgmt_ev_user_passkey_request ev;
7634
7635 BT_DBG("%s", hdev->name);
7636
7637 bacpy(&ev.addr.bdaddr, bdaddr);
7638 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7639
7640 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7641 NULL);
7642 }
7643
7644 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7645 u8 link_type, u8 addr_type, u8 status,
7646 u8 opcode)
7647 {
7648 struct mgmt_pending_cmd *cmd;
7649
7650 cmd = pending_find(opcode, hdev);
7651 if (!cmd)
7652 return -ENOENT;
7653
7654 cmd->cmd_complete(cmd, mgmt_status(status));
7655 mgmt_pending_remove(cmd);
7656
7657 return 0;
7658 }
7659
7660 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7661 u8 link_type, u8 addr_type, u8 status)
7662 {
7663 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7664 status, MGMT_OP_USER_CONFIRM_REPLY);
7665 }
7666
7667 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7668 u8 link_type, u8 addr_type, u8 status)
7669 {
7670 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7671 status,
7672 MGMT_OP_USER_CONFIRM_NEG_REPLY);
7673 }
7674
7675 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7676 u8 link_type, u8 addr_type, u8 status)
7677 {
7678 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7679 status, MGMT_OP_USER_PASSKEY_REPLY);
7680 }
7681
7682 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7683 u8 link_type, u8 addr_type, u8 status)
7684 {
7685 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7686 status,
7687 MGMT_OP_USER_PASSKEY_NEG_REPLY);
7688 }
7689
7690 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7691 u8 link_type, u8 addr_type, u32 passkey,
7692 u8 entered)
7693 {
7694 struct mgmt_ev_passkey_notify ev;
7695
7696 BT_DBG("%s", hdev->name);
7697
7698 bacpy(&ev.addr.bdaddr, bdaddr);
7699 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7700 ev.passkey = __cpu_to_le32(passkey);
7701 ev.entered = entered;
7702
7703 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7704 }
7705
7706 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7707 {
7708 struct mgmt_ev_auth_failed ev;
7709 struct mgmt_pending_cmd *cmd;
7710 u8 status = mgmt_status(hci_status);
7711
7712 bacpy(&ev.addr.bdaddr, &conn->dst);
7713 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7714 ev.status = status;
7715
7716 cmd = find_pairing(conn);
7717
7718 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7719 cmd ? cmd->sk : NULL);
7720
7721 if (cmd) {
7722 cmd->cmd_complete(cmd, status);
7723 mgmt_pending_remove(cmd);
7724 }
7725 }
7726
7727 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7728 {
7729 struct cmd_lookup match = { NULL, hdev };
7730 bool changed;
7731
7732 if (status) {
7733 u8 mgmt_err = mgmt_status(status);
7734 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7735 cmd_status_rsp, &mgmt_err);
7736 return;
7737 }
7738
7739 if (test_bit(HCI_AUTH, &hdev->flags))
7740 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7741 else
7742 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7743
7744 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7745 &match);
7746
7747 if (changed)
7748 new_settings(hdev, match.sk);
7749
7750 if (match.sk)
7751 sock_put(match.sk);
7752 }
7753
7754 static void clear_eir(struct hci_request *req)
7755 {
7756 struct hci_dev *hdev = req->hdev;
7757 struct hci_cp_write_eir cp;
7758
7759 if (!lmp_ext_inq_capable(hdev))
7760 return;
7761
7762 memset(hdev->eir, 0, sizeof(hdev->eir));
7763
7764 memset(&cp, 0, sizeof(cp));
7765
7766 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7767 }
7768
7769 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7770 {
7771 struct cmd_lookup match = { NULL, hdev };
7772 struct hci_request req;
7773 bool changed = false;
7774
7775 if (status) {
7776 u8 mgmt_err = mgmt_status(status);
7777
7778 if (enable && hci_dev_test_and_clear_flag(hdev,
7779 HCI_SSP_ENABLED)) {
7780 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7781 new_settings(hdev, NULL);
7782 }
7783
7784 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7785 &mgmt_err);
7786 return;
7787 }
7788
7789 if (enable) {
7790 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7791 } else {
7792 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7793 if (!changed)
7794 changed = hci_dev_test_and_clear_flag(hdev,
7795 HCI_HS_ENABLED);
7796 else
7797 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7798 }
7799
7800 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7801
7802 if (changed)
7803 new_settings(hdev, match.sk);
7804
7805 if (match.sk)
7806 sock_put(match.sk);
7807
7808 hci_req_init(&req, hdev);
7809
7810 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7811 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7812 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7813 sizeof(enable), &enable);
7814 __hci_req_update_eir(&req);
7815 } else {
7816 clear_eir(&req);
7817 }
7818
7819 hci_req_run(&req, NULL);
7820 }
7821
7822 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7823 {
7824 struct cmd_lookup *match = data;
7825
7826 if (match->sk == NULL) {
7827 match->sk = cmd->sk;
7828 sock_hold(match->sk);
7829 }
7830 }
7831
7832 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7833 u8 status)
7834 {
7835 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7836
7837 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7838 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7839 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7840
7841 if (!status) {
7842 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7843 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7844 ext_info_changed(hdev, NULL);
7845 }
7846
7847 if (match.sk)
7848 sock_put(match.sk);
7849 }
7850
7851 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7852 {
7853 struct mgmt_cp_set_local_name ev;
7854 struct mgmt_pending_cmd *cmd;
7855
7856 if (status)
7857 return;
7858
7859 memset(&ev, 0, sizeof(ev));
7860 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7861 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7862
7863 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7864 if (!cmd) {
7865 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7866
7867 /* If this is a HCI command related to powering on the
7868 * HCI dev don't send any mgmt signals.
7869 */
7870 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7871 return;
7872 }
7873
7874 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7875 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7876 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7877 }
7878
7879 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7880 {
7881 int i;
7882
7883 for (i = 0; i < uuid_count; i++) {
7884 if (!memcmp(uuid, uuids[i], 16))
7885 return true;
7886 }
7887
7888 return false;
7889 }
7890
7891 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7892 {
7893 u16 parsed = 0;
7894
7895 while (parsed < eir_len) {
7896 u8 field_len = eir[0];
7897 u8 uuid[16];
7898 int i;
7899
7900 if (field_len == 0)
7901 break;
7902
7903 if (eir_len - parsed < field_len + 1)
7904 break;
7905
7906 switch (eir[1]) {
7907 case EIR_UUID16_ALL:
7908 case EIR_UUID16_SOME:
7909 for (i = 0; i + 3 <= field_len; i += 2) {
7910 memcpy(uuid, bluetooth_base_uuid, 16);
7911 uuid[13] = eir[i + 3];
7912 uuid[12] = eir[i + 2];
7913 if (has_uuid(uuid, uuid_count, uuids))
7914 return true;
7915 }
7916 break;
7917 case EIR_UUID32_ALL:
7918 case EIR_UUID32_SOME:
7919 for (i = 0; i + 5 <= field_len; i += 4) {
7920 memcpy(uuid, bluetooth_base_uuid, 16);
7921 uuid[15] = eir[i + 5];
7922 uuid[14] = eir[i + 4];
7923 uuid[13] = eir[i + 3];
7924 uuid[12] = eir[i + 2];
7925 if (has_uuid(uuid, uuid_count, uuids))
7926 return true;
7927 }
7928 break;
7929 case EIR_UUID128_ALL:
7930 case EIR_UUID128_SOME:
7931 for (i = 0; i + 17 <= field_len; i += 16) {
7932 memcpy(uuid, eir + i + 2, 16);
7933 if (has_uuid(uuid, uuid_count, uuids))
7934 return true;
7935 }
7936 break;
7937 }
7938
7939 parsed += field_len + 1;
7940 eir += field_len + 1;
7941 }
7942
7943 return false;
7944 }
7945
7946 static void restart_le_scan(struct hci_dev *hdev)
7947 {
7948 /* If controller is not scanning we are done. */
7949 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7950 return;
7951
7952 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7953 hdev->discovery.scan_start +
7954 hdev->discovery.scan_duration))
7955 return;
7956
7957 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7958 DISCOV_LE_RESTART_DELAY);
7959 }
7960
7961 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7962 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7963 {
7964 /* If a RSSI threshold has been specified, and
7965 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7966 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7967 * is set, let it through for further processing, as we might need to
7968 * restart the scan.
7969 *
7970 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7971 * the results are also dropped.
7972 */
7973 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7974 (rssi == HCI_RSSI_INVALID ||
7975 (rssi < hdev->discovery.rssi &&
7976 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7977 return false;
7978
7979 if (hdev->discovery.uuid_count != 0) {
7980 /* If a list of UUIDs is provided in filter, results with no
7981 * matching UUID should be dropped.
7982 */
7983 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7984 hdev->discovery.uuids) &&
7985 !eir_has_uuids(scan_rsp, scan_rsp_len,
7986 hdev->discovery.uuid_count,
7987 hdev->discovery.uuids))
7988 return false;
7989 }
7990
7991 /* If duplicate filtering does not report RSSI changes, then restart
7992 * scanning to ensure updated result with updated RSSI values.
7993 */
7994 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7995 restart_le_scan(hdev);
7996
7997 /* Validate RSSI value against the RSSI threshold once more. */
7998 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7999 rssi < hdev->discovery.rssi)
8000 return false;
8001 }
8002
8003 return true;
8004 }
8005
8006 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8007 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8008 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8009 {
8010 char buf[512];
8011 struct mgmt_ev_device_found *ev = (void *)buf;
8012 size_t ev_size;
8013
8014 /* Don't send events for a non-kernel initiated discovery. With
8015 * LE one exception is if we have pend_le_reports > 0 in which
8016 * case we're doing passive scanning and want these events.
8017 */
8018 if (!hci_discovery_active(hdev)) {
8019 if (link_type == ACL_LINK)
8020 return;
8021 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8022 return;
8023 }
8024
8025 if (hdev->discovery.result_filtering) {
8026 /* We are using service discovery */
8027 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8028 scan_rsp_len))
8029 return;
8030 }
8031
8032 if (hdev->discovery.limited) {
8033 /* Check for limited discoverable bit */
8034 if (dev_class) {
8035 if (!(dev_class[1] & 0x20))
8036 return;
8037 } else {
8038 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
8039 if (!flags || !(flags[0] & LE_AD_LIMITED))
8040 return;
8041 }
8042 }
8043
8044 /* Make sure that the buffer is big enough. The 5 extra bytes
8045 * are for the potential CoD field.
8046 */
8047 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
8048 return;
8049
8050 memset(buf, 0, sizeof(buf));
8051
8052 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8053 * RSSI value was reported as 0 when not available. This behavior
8054 * is kept when using device discovery. This is required for full
8055 * backwards compatibility with the API.
8056 *
8057 * However when using service discovery, the value 127 will be
8058 * returned when the RSSI is not available.
8059 */
8060 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8061 link_type == ACL_LINK)
8062 rssi = 0;
8063
8064 bacpy(&ev->addr.bdaddr, bdaddr);
8065 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8066 ev->rssi = rssi;
8067 ev->flags = cpu_to_le32(flags);
8068
8069 if (eir_len > 0)
8070 /* Copy EIR or advertising data into event */
8071 memcpy(ev->eir, eir, eir_len);
8072
8073 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8074 NULL))
8075 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8076 dev_class, 3);
8077
8078 if (scan_rsp_len > 0)
8079 /* Append scan response data to event */
8080 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8081
8082 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8083 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
8084
8085 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
8086 }
8087
8088 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8089 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
8090 {
8091 struct mgmt_ev_device_found *ev;
8092 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8093 u16 eir_len;
8094
8095 ev = (struct mgmt_ev_device_found *) buf;
8096
8097 memset(buf, 0, sizeof(buf));
8098
8099 bacpy(&ev->addr.bdaddr, bdaddr);
8100 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8101 ev->rssi = rssi;
8102
8103 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
8104 name_len);
8105
8106 ev->eir_len = cpu_to_le16(eir_len);
8107
8108 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
8109 }
8110
8111 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
8112 {
8113 struct mgmt_ev_discovering ev;
8114
8115 BT_DBG("%s discovering %u", hdev->name, discovering);
8116
8117 memset(&ev, 0, sizeof(ev));
8118 ev.type = hdev->discovery.type;
8119 ev.discovering = discovering;
8120
8121 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
8122 }
8123
8124 static struct hci_mgmt_chan chan = {
8125 .channel = HCI_CHANNEL_CONTROL,
8126 .handler_count = ARRAY_SIZE(mgmt_handlers),
8127 .handlers = mgmt_handlers,
8128 .hdev_init = mgmt_init_hdev,
8129 };
8130
8131 int mgmt_init(void)
8132 {
8133 return hci_mgmt_chan_register(&chan);
8134 }
8135
8136 void mgmt_exit(void)
8137 {
8138 hci_mgmt_chan_unregister(&chan);
8139 }
Linux with added FPC-III support