]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - net/bluetooth/mgmt.c
projects / mirror_ubuntu-zesty-kernel.git / blob
? search:


af8e0a6243b7520617156f79d7d430ce12ef4be9
[mirror_ubuntu-zesty-kernel.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33 #include <net/bluetooth/mgmt.h>
34
35 #include "smp.h"
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 6
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 MGMT_OP_SET_ADVERTISING,
80 MGMT_OP_SET_BREDR,
81 MGMT_OP_SET_STATIC_ADDRESS,
82 MGMT_OP_SET_SCAN_PARAMS,
83 MGMT_OP_SET_SECURE_CONN,
84 MGMT_OP_SET_DEBUG_KEYS,
85 MGMT_OP_SET_PRIVACY,
86 MGMT_OP_LOAD_IRKS,
87 MGMT_OP_GET_CONN_INFO,
88 };
89
90 static const u16 mgmt_events[] = {
91 MGMT_EV_CONTROLLER_ERROR,
92 MGMT_EV_INDEX_ADDED,
93 MGMT_EV_INDEX_REMOVED,
94 MGMT_EV_NEW_SETTINGS,
95 MGMT_EV_CLASS_OF_DEV_CHANGED,
96 MGMT_EV_LOCAL_NAME_CHANGED,
97 MGMT_EV_NEW_LINK_KEY,
98 MGMT_EV_NEW_LONG_TERM_KEY,
99 MGMT_EV_DEVICE_CONNECTED,
100 MGMT_EV_DEVICE_DISCONNECTED,
101 MGMT_EV_CONNECT_FAILED,
102 MGMT_EV_PIN_CODE_REQUEST,
103 MGMT_EV_USER_CONFIRM_REQUEST,
104 MGMT_EV_USER_PASSKEY_REQUEST,
105 MGMT_EV_AUTH_FAILED,
106 MGMT_EV_DEVICE_FOUND,
107 MGMT_EV_DISCOVERING,
108 MGMT_EV_DEVICE_BLOCKED,
109 MGMT_EV_DEVICE_UNBLOCKED,
110 MGMT_EV_DEVICE_UNPAIRED,
111 MGMT_EV_PASSKEY_NOTIFY,
112 MGMT_EV_NEW_IRK,
113 MGMT_EV_NEW_CSRK,
114 };
115
116 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
117
118 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
119 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
120
121 struct pending_cmd {
122 struct list_head list;
123 u16 opcode;
124 int index;
125 void *param;
126 struct sock *sk;
127 void *user_data;
128 };
129
130 /* HCI to MGMT error code conversion table */
131 static u8 mgmt_status_table[] = {
132 MGMT_STATUS_SUCCESS,
133 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
134 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
135 MGMT_STATUS_FAILED, /* Hardware Failure */
136 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
137 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
138 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
139 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
140 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
141 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
142 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
143 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
144 MGMT_STATUS_BUSY, /* Command Disallowed */
145 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
146 MGMT_STATUS_REJECTED, /* Rejected Security */
147 MGMT_STATUS_REJECTED, /* Rejected Personal */
148 MGMT_STATUS_TIMEOUT, /* Host Timeout */
149 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
150 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
151 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
152 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
153 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
154 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
155 MGMT_STATUS_BUSY, /* Repeated Attempts */
156 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
157 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
158 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
159 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
160 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
161 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
162 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
163 MGMT_STATUS_FAILED, /* Unspecified Error */
164 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
165 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
166 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
167 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
168 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
169 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
170 MGMT_STATUS_FAILED, /* Unit Link Key Used */
171 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
172 MGMT_STATUS_TIMEOUT, /* Instant Passed */
173 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
174 MGMT_STATUS_FAILED, /* Transaction Collision */
175 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
176 MGMT_STATUS_REJECTED, /* QoS Rejected */
177 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
178 MGMT_STATUS_REJECTED, /* Insufficient Security */
179 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
180 MGMT_STATUS_BUSY, /* Role Switch Pending */
181 MGMT_STATUS_FAILED, /* Slot Violation */
182 MGMT_STATUS_FAILED, /* Role Switch Failed */
183 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
184 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
185 MGMT_STATUS_BUSY, /* Host Busy Pairing */
186 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
187 MGMT_STATUS_BUSY, /* Controller Busy */
188 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
189 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
190 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
191 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
192 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
193 };
194
195 static u8 mgmt_status(u8 hci_status)
196 {
197 if (hci_status < ARRAY_SIZE(mgmt_status_table))
198 return mgmt_status_table[hci_status];
199
200 return MGMT_STATUS_FAILED;
201 }
202
203 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
204 {
205 struct sk_buff *skb;
206 struct mgmt_hdr *hdr;
207 struct mgmt_ev_cmd_status *ev;
208 int err;
209
210 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
211
212 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
213 if (!skb)
214 return -ENOMEM;
215
216 hdr = (void *) skb_put(skb, sizeof(*hdr));
217
218 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
219 hdr->index = cpu_to_le16(index);
220 hdr->len = cpu_to_le16(sizeof(*ev));
221
222 ev = (void *) skb_put(skb, sizeof(*ev));
223 ev->status = status;
224 ev->opcode = cpu_to_le16(cmd);
225
226 err = sock_queue_rcv_skb(sk, skb);
227 if (err < 0)
228 kfree_skb(skb);
229
230 return err;
231 }
232
233 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
234 void *rp, size_t rp_len)
235 {
236 struct sk_buff *skb;
237 struct mgmt_hdr *hdr;
238 struct mgmt_ev_cmd_complete *ev;
239 int err;
240
241 BT_DBG("sock %p", sk);
242
243 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
244 if (!skb)
245 return -ENOMEM;
246
247 hdr = (void *) skb_put(skb, sizeof(*hdr));
248
249 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
250 hdr->index = cpu_to_le16(index);
251 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
252
253 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
254 ev->opcode = cpu_to_le16(cmd);
255 ev->status = status;
256
257 if (rp)
258 memcpy(ev->data, rp, rp_len);
259
260 err = sock_queue_rcv_skb(sk, skb);
261 if (err < 0)
262 kfree_skb(skb);
263
264 return err;
265 }
266
267 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
268 u16 data_len)
269 {
270 struct mgmt_rp_read_version rp;
271
272 BT_DBG("sock %p", sk);
273
274 rp.version = MGMT_VERSION;
275 rp.revision = cpu_to_le16(MGMT_REVISION);
276
277 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
278 sizeof(rp));
279 }
280
281 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
282 u16 data_len)
283 {
284 struct mgmt_rp_read_commands *rp;
285 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
286 const u16 num_events = ARRAY_SIZE(mgmt_events);
287 __le16 *opcode;
288 size_t rp_size;
289 int i, err;
290
291 BT_DBG("sock %p", sk);
292
293 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
294
295 rp = kmalloc(rp_size, GFP_KERNEL);
296 if (!rp)
297 return -ENOMEM;
298
299 rp->num_commands = cpu_to_le16(num_commands);
300 rp->num_events = cpu_to_le16(num_events);
301
302 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
303 put_unaligned_le16(mgmt_commands[i], opcode);
304
305 for (i = 0; i < num_events; i++, opcode++)
306 put_unaligned_le16(mgmt_events[i], opcode);
307
308 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
309 rp_size);
310 kfree(rp);
311
312 return err;
313 }
314
315 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
316 u16 data_len)
317 {
318 struct mgmt_rp_read_index_list *rp;
319 struct hci_dev *d;
320 size_t rp_len;
321 u16 count;
322 int err;
323
324 BT_DBG("sock %p", sk);
325
326 read_lock(&hci_dev_list_lock);
327
328 count = 0;
329 list_for_each_entry(d, &hci_dev_list, list) {
330 if (d->dev_type == HCI_BREDR)
331 count++;
332 }
333
334 rp_len = sizeof(*rp) + (2 * count);
335 rp = kmalloc(rp_len, GFP_ATOMIC);
336 if (!rp) {
337 read_unlock(&hci_dev_list_lock);
338 return -ENOMEM;
339 }
340
341 count = 0;
342 list_for_each_entry(d, &hci_dev_list, list) {
343 if (test_bit(HCI_SETUP, &d->dev_flags))
344 continue;
345
346 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags))
347 continue;
348
349 if (d->dev_type == HCI_BREDR) {
350 rp->index[count++] = cpu_to_le16(d->id);
351 BT_DBG("Added hci%u", d->id);
352 }
353 }
354
355 rp->num_controllers = cpu_to_le16(count);
356 rp_len = sizeof(*rp) + (2 * count);
357
358 read_unlock(&hci_dev_list_lock);
359
360 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
361 rp_len);
362
363 kfree(rp);
364
365 return err;
366 }
367
368 static u32 get_supported_settings(struct hci_dev *hdev)
369 {
370 u32 settings = 0;
371
372 settings |= MGMT_SETTING_POWERED;
373 settings |= MGMT_SETTING_PAIRABLE;
374 settings |= MGMT_SETTING_DEBUG_KEYS;
375
376 if (lmp_bredr_capable(hdev)) {
377 settings |= MGMT_SETTING_CONNECTABLE;
378 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
379 settings |= MGMT_SETTING_FAST_CONNECTABLE;
380 settings |= MGMT_SETTING_DISCOVERABLE;
381 settings |= MGMT_SETTING_BREDR;
382 settings |= MGMT_SETTING_LINK_SECURITY;
383
384 if (lmp_ssp_capable(hdev)) {
385 settings |= MGMT_SETTING_SSP;
386 settings |= MGMT_SETTING_HS;
387 }
388
389 if (lmp_sc_capable(hdev) ||
390 test_bit(HCI_FORCE_SC, &hdev->dev_flags))
391 settings |= MGMT_SETTING_SECURE_CONN;
392 }
393
394 if (lmp_le_capable(hdev)) {
395 settings |= MGMT_SETTING_LE;
396 settings |= MGMT_SETTING_ADVERTISING;
397 settings |= MGMT_SETTING_PRIVACY;
398 }
399
400 return settings;
401 }
402
403 static u32 get_current_settings(struct hci_dev *hdev)
404 {
405 u32 settings = 0;
406
407 if (hdev_is_powered(hdev))
408 settings |= MGMT_SETTING_POWERED;
409
410 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
411 settings |= MGMT_SETTING_CONNECTABLE;
412
413 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
414 settings |= MGMT_SETTING_FAST_CONNECTABLE;
415
416 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
417 settings |= MGMT_SETTING_DISCOVERABLE;
418
419 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
420 settings |= MGMT_SETTING_PAIRABLE;
421
422 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
423 settings |= MGMT_SETTING_BREDR;
424
425 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
426 settings |= MGMT_SETTING_LE;
427
428 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
429 settings |= MGMT_SETTING_LINK_SECURITY;
430
431 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
432 settings |= MGMT_SETTING_SSP;
433
434 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
435 settings |= MGMT_SETTING_HS;
436
437 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
438 settings |= MGMT_SETTING_ADVERTISING;
439
440 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
441 settings |= MGMT_SETTING_SECURE_CONN;
442
443 if (test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags))
444 settings |= MGMT_SETTING_DEBUG_KEYS;
445
446 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
447 settings |= MGMT_SETTING_PRIVACY;
448
449 return settings;
450 }
451
452 #define PNP_INFO_SVCLASS_ID 0x1200
453
454 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
455 {
456 u8 *ptr = data, *uuids_start = NULL;
457 struct bt_uuid *uuid;
458
459 if (len < 4)
460 return ptr;
461
462 list_for_each_entry(uuid, &hdev->uuids, list) {
463 u16 uuid16;
464
465 if (uuid->size != 16)
466 continue;
467
468 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
469 if (uuid16 < 0x1100)
470 continue;
471
472 if (uuid16 == PNP_INFO_SVCLASS_ID)
473 continue;
474
475 if (!uuids_start) {
476 uuids_start = ptr;
477 uuids_start[0] = 1;
478 uuids_start[1] = EIR_UUID16_ALL;
479 ptr += 2;
480 }
481
482 /* Stop if not enough space to put next UUID */
483 if ((ptr - data) + sizeof(u16) > len) {
484 uuids_start[1] = EIR_UUID16_SOME;
485 break;
486 }
487
488 *ptr++ = (uuid16 & 0x00ff);
489 *ptr++ = (uuid16 & 0xff00) >> 8;
490 uuids_start[0] += sizeof(uuid16);
491 }
492
493 return ptr;
494 }
495
496 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
497 {
498 u8 *ptr = data, *uuids_start = NULL;
499 struct bt_uuid *uuid;
500
501 if (len < 6)
502 return ptr;
503
504 list_for_each_entry(uuid, &hdev->uuids, list) {
505 if (uuid->size != 32)
506 continue;
507
508 if (!uuids_start) {
509 uuids_start = ptr;
510 uuids_start[0] = 1;
511 uuids_start[1] = EIR_UUID32_ALL;
512 ptr += 2;
513 }
514
515 /* Stop if not enough space to put next UUID */
516 if ((ptr - data) + sizeof(u32) > len) {
517 uuids_start[1] = EIR_UUID32_SOME;
518 break;
519 }
520
521 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
522 ptr += sizeof(u32);
523 uuids_start[0] += sizeof(u32);
524 }
525
526 return ptr;
527 }
528
529 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
530 {
531 u8 *ptr = data, *uuids_start = NULL;
532 struct bt_uuid *uuid;
533
534 if (len < 18)
535 return ptr;
536
537 list_for_each_entry(uuid, &hdev->uuids, list) {
538 if (uuid->size != 128)
539 continue;
540
541 if (!uuids_start) {
542 uuids_start = ptr;
543 uuids_start[0] = 1;
544 uuids_start[1] = EIR_UUID128_ALL;
545 ptr += 2;
546 }
547
548 /* Stop if not enough space to put next UUID */
549 if ((ptr - data) + 16 > len) {
550 uuids_start[1] = EIR_UUID128_SOME;
551 break;
552 }
553
554 memcpy(ptr, uuid->uuid, 16);
555 ptr += 16;
556 uuids_start[0] += 16;
557 }
558
559 return ptr;
560 }
561
562 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
563 {
564 struct pending_cmd *cmd;
565
566 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
567 if (cmd->opcode == opcode)
568 return cmd;
569 }
570
571 return NULL;
572 }
573
574 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
575 {
576 u8 ad_len = 0;
577 size_t name_len;
578
579 name_len = strlen(hdev->dev_name);
580 if (name_len > 0) {
581 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
582
583 if (name_len > max_len) {
584 name_len = max_len;
585 ptr[1] = EIR_NAME_SHORT;
586 } else
587 ptr[1] = EIR_NAME_COMPLETE;
588
589 ptr[0] = name_len + 1;
590
591 memcpy(ptr + 2, hdev->dev_name, name_len);
592
593 ad_len += (name_len + 2);
594 ptr += (name_len + 2);
595 }
596
597 return ad_len;
598 }
599
600 static void update_scan_rsp_data(struct hci_request *req)
601 {
602 struct hci_dev *hdev = req->hdev;
603 struct hci_cp_le_set_scan_rsp_data cp;
604 u8 len;
605
606 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
607 return;
608
609 memset(&cp, 0, sizeof(cp));
610
611 len = create_scan_rsp_data(hdev, cp.data);
612
613 if (hdev->scan_rsp_data_len == len &&
614 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
615 return;
616
617 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
618 hdev->scan_rsp_data_len = len;
619
620 cp.length = len;
621
622 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
623 }
624
625 static u8 get_adv_discov_flags(struct hci_dev *hdev)
626 {
627 struct pending_cmd *cmd;
628
629 /* If there's a pending mgmt command the flags will not yet have
630 * their final values, so check for this first.
631 */
632 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
633 if (cmd) {
634 struct mgmt_mode *cp = cmd->param;
635 if (cp->val == 0x01)
636 return LE_AD_GENERAL;
637 else if (cp->val == 0x02)
638 return LE_AD_LIMITED;
639 } else {
640 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
641 return LE_AD_LIMITED;
642 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
643 return LE_AD_GENERAL;
644 }
645
646 return 0;
647 }
648
649 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
650 {
651 u8 ad_len = 0, flags = 0;
652
653 flags |= get_adv_discov_flags(hdev);
654
655 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
656 flags |= LE_AD_NO_BREDR;
657
658 if (flags) {
659 BT_DBG("adv flags 0x%02x", flags);
660
661 ptr[0] = 2;
662 ptr[1] = EIR_FLAGS;
663 ptr[2] = flags;
664
665 ad_len += 3;
666 ptr += 3;
667 }
668
669 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
670 ptr[0] = 2;
671 ptr[1] = EIR_TX_POWER;
672 ptr[2] = (u8) hdev->adv_tx_power;
673
674 ad_len += 3;
675 ptr += 3;
676 }
677
678 return ad_len;
679 }
680
681 static void update_adv_data(struct hci_request *req)
682 {
683 struct hci_dev *hdev = req->hdev;
684 struct hci_cp_le_set_adv_data cp;
685 u8 len;
686
687 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
688 return;
689
690 memset(&cp, 0, sizeof(cp));
691
692 len = create_adv_data(hdev, cp.data);
693
694 if (hdev->adv_data_len == len &&
695 memcmp(cp.data, hdev->adv_data, len) == 0)
696 return;
697
698 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
699 hdev->adv_data_len = len;
700
701 cp.length = len;
702
703 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
704 }
705
706 static void create_eir(struct hci_dev *hdev, u8 *data)
707 {
708 u8 *ptr = data;
709 size_t name_len;
710
711 name_len = strlen(hdev->dev_name);
712
713 if (name_len > 0) {
714 /* EIR Data type */
715 if (name_len > 48) {
716 name_len = 48;
717 ptr[1] = EIR_NAME_SHORT;
718 } else
719 ptr[1] = EIR_NAME_COMPLETE;
720
721 /* EIR Data length */
722 ptr[0] = name_len + 1;
723
724 memcpy(ptr + 2, hdev->dev_name, name_len);
725
726 ptr += (name_len + 2);
727 }
728
729 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
730 ptr[0] = 2;
731 ptr[1] = EIR_TX_POWER;
732 ptr[2] = (u8) hdev->inq_tx_power;
733
734 ptr += 3;
735 }
736
737 if (hdev->devid_source > 0) {
738 ptr[0] = 9;
739 ptr[1] = EIR_DEVICE_ID;
740
741 put_unaligned_le16(hdev->devid_source, ptr + 2);
742 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
743 put_unaligned_le16(hdev->devid_product, ptr + 6);
744 put_unaligned_le16(hdev->devid_version, ptr + 8);
745
746 ptr += 10;
747 }
748
749 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
750 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
751 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
752 }
753
754 static void update_eir(struct hci_request *req)
755 {
756 struct hci_dev *hdev = req->hdev;
757 struct hci_cp_write_eir cp;
758
759 if (!hdev_is_powered(hdev))
760 return;
761
762 if (!lmp_ext_inq_capable(hdev))
763 return;
764
765 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
766 return;
767
768 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
769 return;
770
771 memset(&cp, 0, sizeof(cp));
772
773 create_eir(hdev, cp.data);
774
775 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
776 return;
777
778 memcpy(hdev->eir, cp.data, sizeof(cp.data));
779
780 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
781 }
782
783 static u8 get_service_classes(struct hci_dev *hdev)
784 {
785 struct bt_uuid *uuid;
786 u8 val = 0;
787
788 list_for_each_entry(uuid, &hdev->uuids, list)
789 val |= uuid->svc_hint;
790
791 return val;
792 }
793
794 static void update_class(struct hci_request *req)
795 {
796 struct hci_dev *hdev = req->hdev;
797 u8 cod[3];
798
799 BT_DBG("%s", hdev->name);
800
801 if (!hdev_is_powered(hdev))
802 return;
803
804 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
805 return;
806
807 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
808 return;
809
810 cod[0] = hdev->minor_class;
811 cod[1] = hdev->major_class;
812 cod[2] = get_service_classes(hdev);
813
814 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
815 cod[1] |= 0x20;
816
817 if (memcmp(cod, hdev->dev_class, 3) == 0)
818 return;
819
820 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
821 }
822
823 static bool get_connectable(struct hci_dev *hdev)
824 {
825 struct pending_cmd *cmd;
826
827 /* If there's a pending mgmt command the flag will not yet have
828 * it's final value, so check for this first.
829 */
830 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
831 if (cmd) {
832 struct mgmt_mode *cp = cmd->param;
833 return cp->val;
834 }
835
836 return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
837 }
838
839 static void enable_advertising(struct hci_request *req)
840 {
841 struct hci_dev *hdev = req->hdev;
842 struct hci_cp_le_set_adv_param cp;
843 u8 own_addr_type, enable = 0x01;
844 bool connectable;
845
846 /* Clear the HCI_ADVERTISING bit temporarily so that the
847 * hci_update_random_address knows that it's safe to go ahead
848 * and write a new random address. The flag will be set back on
849 * as soon as the SET_ADV_ENABLE HCI command completes.
850 */
851 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
852
853 connectable = get_connectable(hdev);
854
855 /* Set require_privacy to true only when non-connectable
856 * advertising is used. In that case it is fine to use a
857 * non-resolvable private address.
858 */
859 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
860 return;
861
862 memset(&cp, 0, sizeof(cp));
863 cp.min_interval = cpu_to_le16(0x0800);
864 cp.max_interval = cpu_to_le16(0x0800);
865 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
866 cp.own_address_type = own_addr_type;
867 cp.channel_map = hdev->le_adv_channel_map;
868
869 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
870
871 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
872 }
873
874 static void disable_advertising(struct hci_request *req)
875 {
876 u8 enable = 0x00;
877
878 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
879 }
880
881 static void service_cache_off(struct work_struct *work)
882 {
883 struct hci_dev *hdev = container_of(work, struct hci_dev,
884 service_cache.work);
885 struct hci_request req;
886
887 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
888 return;
889
890 hci_req_init(&req, hdev);
891
892 hci_dev_lock(hdev);
893
894 update_eir(&req);
895 update_class(&req);
896
897 hci_dev_unlock(hdev);
898
899 hci_req_run(&req, NULL);
900 }
901
902 static void rpa_expired(struct work_struct *work)
903 {
904 struct hci_dev *hdev = container_of(work, struct hci_dev,
905 rpa_expired.work);
906 struct hci_request req;
907
908 BT_DBG("");
909
910 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
911
912 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
913 hci_conn_num(hdev, LE_LINK) > 0)
914 return;
915
916 /* The generation of a new RPA and programming it into the
917 * controller happens in the enable_advertising() function.
918 */
919
920 hci_req_init(&req, hdev);
921
922 disable_advertising(&req);
923 enable_advertising(&req);
924
925 hci_req_run(&req, NULL);
926 }
927
928 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
929 {
930 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
931 return;
932
933 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
934 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
935
936 /* Non-mgmt controlled devices get this bit set
937 * implicitly so that pairing works for them, however
938 * for mgmt we require user-space to explicitly enable
939 * it
940 */
941 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
942 }
943
944 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
945 void *data, u16 data_len)
946 {
947 struct mgmt_rp_read_info rp;
948
949 BT_DBG("sock %p %s", sk, hdev->name);
950
951 hci_dev_lock(hdev);
952
953 memset(&rp, 0, sizeof(rp));
954
955 bacpy(&rp.bdaddr, &hdev->bdaddr);
956
957 rp.version = hdev->hci_ver;
958 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
959
960 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
961 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
962
963 memcpy(rp.dev_class, hdev->dev_class, 3);
964
965 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
966 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
967
968 hci_dev_unlock(hdev);
969
970 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
971 sizeof(rp));
972 }
973
974 static void mgmt_pending_free(struct pending_cmd *cmd)
975 {
976 sock_put(cmd->sk);
977 kfree(cmd->param);
978 kfree(cmd);
979 }
980
981 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
982 struct hci_dev *hdev, void *data,
983 u16 len)
984 {
985 struct pending_cmd *cmd;
986
987 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
988 if (!cmd)
989 return NULL;
990
991 cmd->opcode = opcode;
992 cmd->index = hdev->id;
993
994 cmd->param = kmalloc(len, GFP_KERNEL);
995 if (!cmd->param) {
996 kfree(cmd);
997 return NULL;
998 }
999
1000 if (data)
1001 memcpy(cmd->param, data, len);
1002
1003 cmd->sk = sk;
1004 sock_hold(sk);
1005
1006 list_add(&cmd->list, &hdev->mgmt_pending);
1007
1008 return cmd;
1009 }
1010
1011 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1012 void (*cb)(struct pending_cmd *cmd,
1013 void *data),
1014 void *data)
1015 {
1016 struct pending_cmd *cmd, *tmp;
1017
1018 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1019 if (opcode > 0 && cmd->opcode != opcode)
1020 continue;
1021
1022 cb(cmd, data);
1023 }
1024 }
1025
1026 static void mgmt_pending_remove(struct pending_cmd *cmd)
1027 {
1028 list_del(&cmd->list);
1029 mgmt_pending_free(cmd);
1030 }
1031
1032 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1033 {
1034 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1035
1036 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1037 sizeof(settings));
1038 }
1039
1040 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1041 {
1042 BT_DBG("%s status 0x%02x", hdev->name, status);
1043
1044 if (hci_conn_count(hdev) == 0) {
1045 cancel_delayed_work(&hdev->power_off);
1046 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1047 }
1048 }
1049
1050 static void hci_stop_discovery(struct hci_request *req)
1051 {
1052 struct hci_dev *hdev = req->hdev;
1053 struct hci_cp_remote_name_req_cancel cp;
1054 struct inquiry_entry *e;
1055
1056 switch (hdev->discovery.state) {
1057 case DISCOVERY_FINDING:
1058 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1059 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1060 } else {
1061 cancel_delayed_work(&hdev->le_scan_disable);
1062 hci_req_add_le_scan_disable(req);
1063 }
1064
1065 break;
1066
1067 case DISCOVERY_RESOLVING:
1068 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1069 NAME_PENDING);
1070 if (!e)
1071 return;
1072
1073 bacpy(&cp.bdaddr, &e->data.bdaddr);
1074 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1075 &cp);
1076
1077 break;
1078
1079 default:
1080 /* Passive scanning */
1081 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1082 hci_req_add_le_scan_disable(req);
1083 break;
1084 }
1085 }
1086
1087 static int clean_up_hci_state(struct hci_dev *hdev)
1088 {
1089 struct hci_request req;
1090 struct hci_conn *conn;
1091
1092 hci_req_init(&req, hdev);
1093
1094 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1095 test_bit(HCI_PSCAN, &hdev->flags)) {
1096 u8 scan = 0x00;
1097 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1098 }
1099
1100 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1101 disable_advertising(&req);
1102
1103 hci_stop_discovery(&req);
1104
1105 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1106 struct hci_cp_disconnect dc;
1107 struct hci_cp_reject_conn_req rej;
1108
1109 switch (conn->state) {
1110 case BT_CONNECTED:
1111 case BT_CONFIG:
1112 dc.handle = cpu_to_le16(conn->handle);
1113 dc.reason = 0x15; /* Terminated due to Power Off */
1114 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1115 break;
1116 case BT_CONNECT:
1117 if (conn->type == LE_LINK)
1118 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1119 0, NULL);
1120 else if (conn->type == ACL_LINK)
1121 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1122 6, &conn->dst);
1123 break;
1124 case BT_CONNECT2:
1125 bacpy(&rej.bdaddr, &conn->dst);
1126 rej.reason = 0x15; /* Terminated due to Power Off */
1127 if (conn->type == ACL_LINK)
1128 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1129 sizeof(rej), &rej);
1130 else if (conn->type == SCO_LINK)
1131 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1132 sizeof(rej), &rej);
1133 break;
1134 }
1135 }
1136
1137 return hci_req_run(&req, clean_up_hci_complete);
1138 }
1139
1140 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1141 u16 len)
1142 {
1143 struct mgmt_mode *cp = data;
1144 struct pending_cmd *cmd;
1145 int err;
1146
1147 BT_DBG("request for %s", hdev->name);
1148
1149 if (cp->val != 0x00 && cp->val != 0x01)
1150 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1151 MGMT_STATUS_INVALID_PARAMS);
1152
1153 hci_dev_lock(hdev);
1154
1155 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1156 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1157 MGMT_STATUS_BUSY);
1158 goto failed;
1159 }
1160
1161 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1162 cancel_delayed_work(&hdev->power_off);
1163
1164 if (cp->val) {
1165 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1166 data, len);
1167 err = mgmt_powered(hdev, 1);
1168 goto failed;
1169 }
1170 }
1171
1172 if (!!cp->val == hdev_is_powered(hdev)) {
1173 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1174 goto failed;
1175 }
1176
1177 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1178 if (!cmd) {
1179 err = -ENOMEM;
1180 goto failed;
1181 }
1182
1183 if (cp->val) {
1184 queue_work(hdev->req_workqueue, &hdev->power_on);
1185 err = 0;
1186 } else {
1187 /* Disconnect connections, stop scans, etc */
1188 err = clean_up_hci_state(hdev);
1189 if (!err)
1190 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1191 HCI_POWER_OFF_TIMEOUT);
1192
1193 /* ENODATA means there were no HCI commands queued */
1194 if (err == -ENODATA) {
1195 cancel_delayed_work(&hdev->power_off);
1196 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1197 err = 0;
1198 }
1199 }
1200
1201 failed:
1202 hci_dev_unlock(hdev);
1203 return err;
1204 }
1205
1206 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
1207 struct sock *skip_sk)
1208 {
1209 struct sk_buff *skb;
1210 struct mgmt_hdr *hdr;
1211
1212 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
1213 if (!skb)
1214 return -ENOMEM;
1215
1216 hdr = (void *) skb_put(skb, sizeof(*hdr));
1217 hdr->opcode = cpu_to_le16(event);
1218 if (hdev)
1219 hdr->index = cpu_to_le16(hdev->id);
1220 else
1221 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
1222 hdr->len = cpu_to_le16(data_len);
1223
1224 if (data)
1225 memcpy(skb_put(skb, data_len), data, data_len);
1226
1227 /* Time stamp */
1228 __net_timestamp(skb);
1229
1230 hci_send_to_control(skb, skip_sk);
1231 kfree_skb(skb);
1232
1233 return 0;
1234 }
1235
1236 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1237 {
1238 __le32 ev;
1239
1240 ev = cpu_to_le32(get_current_settings(hdev));
1241
1242 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1243 }
1244
1245 struct cmd_lookup {
1246 struct sock *sk;
1247 struct hci_dev *hdev;
1248 u8 mgmt_status;
1249 };
1250
1251 static void settings_rsp(struct pending_cmd *cmd, void *data)
1252 {
1253 struct cmd_lookup *match = data;
1254
1255 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1256
1257 list_del(&cmd->list);
1258
1259 if (match->sk == NULL) {
1260 match->sk = cmd->sk;
1261 sock_hold(match->sk);
1262 }
1263
1264 mgmt_pending_free(cmd);
1265 }
1266
1267 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1268 {
1269 u8 *status = data;
1270
1271 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1272 mgmt_pending_remove(cmd);
1273 }
1274
1275 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1276 {
1277 if (!lmp_bredr_capable(hdev))
1278 return MGMT_STATUS_NOT_SUPPORTED;
1279 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1280 return MGMT_STATUS_REJECTED;
1281 else
1282 return MGMT_STATUS_SUCCESS;
1283 }
1284
1285 static u8 mgmt_le_support(struct hci_dev *hdev)
1286 {
1287 if (!lmp_le_capable(hdev))
1288 return MGMT_STATUS_NOT_SUPPORTED;
1289 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1290 return MGMT_STATUS_REJECTED;
1291 else
1292 return MGMT_STATUS_SUCCESS;
1293 }
1294
1295 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1296 {
1297 struct pending_cmd *cmd;
1298 struct mgmt_mode *cp;
1299 struct hci_request req;
1300 bool changed;
1301
1302 BT_DBG("status 0x%02x", status);
1303
1304 hci_dev_lock(hdev);
1305
1306 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1307 if (!cmd)
1308 goto unlock;
1309
1310 if (status) {
1311 u8 mgmt_err = mgmt_status(status);
1312 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1313 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1314 goto remove_cmd;
1315 }
1316
1317 cp = cmd->param;
1318 if (cp->val) {
1319 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1320 &hdev->dev_flags);
1321
1322 if (hdev->discov_timeout > 0) {
1323 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1324 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1325 to);
1326 }
1327 } else {
1328 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1329 &hdev->dev_flags);
1330 }
1331
1332 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1333
1334 if (changed)
1335 new_settings(hdev, cmd->sk);
1336
1337 /* When the discoverable mode gets changed, make sure
1338 * that class of device has the limited discoverable
1339 * bit correctly set.
1340 */
1341 hci_req_init(&req, hdev);
1342 update_class(&req);
1343 hci_req_run(&req, NULL);
1344
1345 remove_cmd:
1346 mgmt_pending_remove(cmd);
1347
1348 unlock:
1349 hci_dev_unlock(hdev);
1350 }
1351
1352 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1353 u16 len)
1354 {
1355 struct mgmt_cp_set_discoverable *cp = data;
1356 struct pending_cmd *cmd;
1357 struct hci_request req;
1358 u16 timeout;
1359 u8 scan;
1360 int err;
1361
1362 BT_DBG("request for %s", hdev->name);
1363
1364 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1365 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1366 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367 MGMT_STATUS_REJECTED);
1368
1369 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1370 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1371 MGMT_STATUS_INVALID_PARAMS);
1372
1373 timeout = __le16_to_cpu(cp->timeout);
1374
1375 /* Disabling discoverable requires that no timeout is set,
1376 * and enabling limited discoverable requires a timeout.
1377 */
1378 if ((cp->val == 0x00 && timeout > 0) ||
1379 (cp->val == 0x02 && timeout == 0))
1380 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1381 MGMT_STATUS_INVALID_PARAMS);
1382
1383 hci_dev_lock(hdev);
1384
1385 if (!hdev_is_powered(hdev) && timeout > 0) {
1386 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1387 MGMT_STATUS_NOT_POWERED);
1388 goto failed;
1389 }
1390
1391 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1392 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1393 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1394 MGMT_STATUS_BUSY);
1395 goto failed;
1396 }
1397
1398 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1399 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1400 MGMT_STATUS_REJECTED);
1401 goto failed;
1402 }
1403
1404 if (!hdev_is_powered(hdev)) {
1405 bool changed = false;
1406
1407 /* Setting limited discoverable when powered off is
1408 * not a valid operation since it requires a timeout
1409 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1410 */
1411 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1412 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1413 changed = true;
1414 }
1415
1416 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1417 if (err < 0)
1418 goto failed;
1419
1420 if (changed)
1421 err = new_settings(hdev, sk);
1422
1423 goto failed;
1424 }
1425
1426 /* If the current mode is the same, then just update the timeout
1427 * value with the new value. And if only the timeout gets updated,
1428 * then no need for any HCI transactions.
1429 */
1430 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1431 (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1432 &hdev->dev_flags)) {
1433 cancel_delayed_work(&hdev->discov_off);
1434 hdev->discov_timeout = timeout;
1435
1436 if (cp->val && hdev->discov_timeout > 0) {
1437 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1438 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1439 to);
1440 }
1441
1442 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1443 goto failed;
1444 }
1445
1446 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1447 if (!cmd) {
1448 err = -ENOMEM;
1449 goto failed;
1450 }
1451
1452 /* Cancel any potential discoverable timeout that might be
1453 * still active and store new timeout value. The arming of
1454 * the timeout happens in the complete handler.
1455 */
1456 cancel_delayed_work(&hdev->discov_off);
1457 hdev->discov_timeout = timeout;
1458
1459 /* Limited discoverable mode */
1460 if (cp->val == 0x02)
1461 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1462 else
1463 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1464
1465 hci_req_init(&req, hdev);
1466
1467 /* The procedure for LE-only controllers is much simpler - just
1468 * update the advertising data.
1469 */
1470 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1471 goto update_ad;
1472
1473 scan = SCAN_PAGE;
1474
1475 if (cp->val) {
1476 struct hci_cp_write_current_iac_lap hci_cp;
1477
1478 if (cp->val == 0x02) {
1479 /* Limited discoverable mode */
1480 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1481 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1482 hci_cp.iac_lap[1] = 0x8b;
1483 hci_cp.iac_lap[2] = 0x9e;
1484 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1485 hci_cp.iac_lap[4] = 0x8b;
1486 hci_cp.iac_lap[5] = 0x9e;
1487 } else {
1488 /* General discoverable mode */
1489 hci_cp.num_iac = 1;
1490 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1491 hci_cp.iac_lap[1] = 0x8b;
1492 hci_cp.iac_lap[2] = 0x9e;
1493 }
1494
1495 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1496 (hci_cp.num_iac * 3) + 1, &hci_cp);
1497
1498 scan |= SCAN_INQUIRY;
1499 } else {
1500 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1501 }
1502
1503 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1504
1505 update_ad:
1506 update_adv_data(&req);
1507
1508 err = hci_req_run(&req, set_discoverable_complete);
1509 if (err < 0)
1510 mgmt_pending_remove(cmd);
1511
1512 failed:
1513 hci_dev_unlock(hdev);
1514 return err;
1515 }
1516
1517 static void write_fast_connectable(struct hci_request *req, bool enable)
1518 {
1519 struct hci_dev *hdev = req->hdev;
1520 struct hci_cp_write_page_scan_activity acp;
1521 u8 type;
1522
1523 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1524 return;
1525
1526 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1527 return;
1528
1529 if (enable) {
1530 type = PAGE_SCAN_TYPE_INTERLACED;
1531
1532 /* 160 msec page scan interval */
1533 acp.interval = cpu_to_le16(0x0100);
1534 } else {
1535 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1536
1537 /* default 1.28 sec page scan */
1538 acp.interval = cpu_to_le16(0x0800);
1539 }
1540
1541 acp.window = cpu_to_le16(0x0012);
1542
1543 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1544 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1545 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1546 sizeof(acp), &acp);
1547
1548 if (hdev->page_scan_type != type)
1549 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1550 }
1551
1552 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1553 {
1554 struct pending_cmd *cmd;
1555 struct mgmt_mode *cp;
1556 bool changed;
1557
1558 BT_DBG("status 0x%02x", status);
1559
1560 hci_dev_lock(hdev);
1561
1562 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1563 if (!cmd)
1564 goto unlock;
1565
1566 if (status) {
1567 u8 mgmt_err = mgmt_status(status);
1568 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1569 goto remove_cmd;
1570 }
1571
1572 cp = cmd->param;
1573 if (cp->val)
1574 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1575 else
1576 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1577
1578 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1579
1580 if (changed)
1581 new_settings(hdev, cmd->sk);
1582
1583 remove_cmd:
1584 mgmt_pending_remove(cmd);
1585
1586 unlock:
1587 hci_dev_unlock(hdev);
1588 }
1589
1590 static int set_connectable_update_settings(struct hci_dev *hdev,
1591 struct sock *sk, u8 val)
1592 {
1593 bool changed = false;
1594 int err;
1595
1596 if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1597 changed = true;
1598
1599 if (val) {
1600 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1601 } else {
1602 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1603 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1604 }
1605
1606 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1607 if (err < 0)
1608 return err;
1609
1610 if (changed)
1611 return new_settings(hdev, sk);
1612
1613 return 0;
1614 }
1615
1616 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1617 u16 len)
1618 {
1619 struct mgmt_mode *cp = data;
1620 struct pending_cmd *cmd;
1621 struct hci_request req;
1622 u8 scan;
1623 int err;
1624
1625 BT_DBG("request for %s", hdev->name);
1626
1627 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1628 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1629 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1630 MGMT_STATUS_REJECTED);
1631
1632 if (cp->val != 0x00 && cp->val != 0x01)
1633 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1634 MGMT_STATUS_INVALID_PARAMS);
1635
1636 hci_dev_lock(hdev);
1637
1638 if (!hdev_is_powered(hdev)) {
1639 err = set_connectable_update_settings(hdev, sk, cp->val);
1640 goto failed;
1641 }
1642
1643 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1644 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1645 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1646 MGMT_STATUS_BUSY);
1647 goto failed;
1648 }
1649
1650 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1651 if (!cmd) {
1652 err = -ENOMEM;
1653 goto failed;
1654 }
1655
1656 hci_req_init(&req, hdev);
1657
1658 /* If BR/EDR is not enabled and we disable advertising as a
1659 * by-product of disabling connectable, we need to update the
1660 * advertising flags.
1661 */
1662 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1663 if (!cp->val) {
1664 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1665 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1666 }
1667 update_adv_data(&req);
1668 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1669 if (cp->val) {
1670 scan = SCAN_PAGE;
1671 } else {
1672 scan = 0;
1673
1674 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1675 hdev->discov_timeout > 0)
1676 cancel_delayed_work(&hdev->discov_off);
1677 }
1678
1679 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1680 }
1681
1682 /* If we're going from non-connectable to connectable or
1683 * vice-versa when fast connectable is enabled ensure that fast
1684 * connectable gets disabled. write_fast_connectable won't do
1685 * anything if the page scan parameters are already what they
1686 * should be.
1687 */
1688 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1689 write_fast_connectable(&req, false);
1690
1691 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) &&
1692 hci_conn_num(hdev, LE_LINK) == 0) {
1693 disable_advertising(&req);
1694 enable_advertising(&req);
1695 }
1696
1697 err = hci_req_run(&req, set_connectable_complete);
1698 if (err < 0) {
1699 mgmt_pending_remove(cmd);
1700 if (err == -ENODATA)
1701 err = set_connectable_update_settings(hdev, sk,
1702 cp->val);
1703 goto failed;
1704 }
1705
1706 failed:
1707 hci_dev_unlock(hdev);
1708 return err;
1709 }
1710
1711 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1712 u16 len)
1713 {
1714 struct mgmt_mode *cp = data;
1715 bool changed;
1716 int err;
1717
1718 BT_DBG("request for %s", hdev->name);
1719
1720 if (cp->val != 0x00 && cp->val != 0x01)
1721 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1722 MGMT_STATUS_INVALID_PARAMS);
1723
1724 hci_dev_lock(hdev);
1725
1726 if (cp->val)
1727 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1728 else
1729 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1730
1731 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1732 if (err < 0)
1733 goto unlock;
1734
1735 if (changed)
1736 err = new_settings(hdev, sk);
1737
1738 unlock:
1739 hci_dev_unlock(hdev);
1740 return err;
1741 }
1742
1743 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1744 u16 len)
1745 {
1746 struct mgmt_mode *cp = data;
1747 struct pending_cmd *cmd;
1748 u8 val, status;
1749 int err;
1750
1751 BT_DBG("request for %s", hdev->name);
1752
1753 status = mgmt_bredr_support(hdev);
1754 if (status)
1755 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1756 status);
1757
1758 if (cp->val != 0x00 && cp->val != 0x01)
1759 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1760 MGMT_STATUS_INVALID_PARAMS);
1761
1762 hci_dev_lock(hdev);
1763
1764 if (!hdev_is_powered(hdev)) {
1765 bool changed = false;
1766
1767 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1768 &hdev->dev_flags)) {
1769 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1770 changed = true;
1771 }
1772
1773 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1774 if (err < 0)
1775 goto failed;
1776
1777 if (changed)
1778 err = new_settings(hdev, sk);
1779
1780 goto failed;
1781 }
1782
1783 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1784 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1785 MGMT_STATUS_BUSY);
1786 goto failed;
1787 }
1788
1789 val = !!cp->val;
1790
1791 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1792 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1793 goto failed;
1794 }
1795
1796 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1797 if (!cmd) {
1798 err = -ENOMEM;
1799 goto failed;
1800 }
1801
1802 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1803 if (err < 0) {
1804 mgmt_pending_remove(cmd);
1805 goto failed;
1806 }
1807
1808 failed:
1809 hci_dev_unlock(hdev);
1810 return err;
1811 }
1812
1813 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1814 {
1815 struct mgmt_mode *cp = data;
1816 struct pending_cmd *cmd;
1817 u8 status;
1818 int err;
1819
1820 BT_DBG("request for %s", hdev->name);
1821
1822 status = mgmt_bredr_support(hdev);
1823 if (status)
1824 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1825
1826 if (!lmp_ssp_capable(hdev))
1827 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1828 MGMT_STATUS_NOT_SUPPORTED);
1829
1830 if (cp->val != 0x00 && cp->val != 0x01)
1831 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1832 MGMT_STATUS_INVALID_PARAMS);
1833
1834 hci_dev_lock(hdev);
1835
1836 if (!hdev_is_powered(hdev)) {
1837 bool changed;
1838
1839 if (cp->val) {
1840 changed = !test_and_set_bit(HCI_SSP_ENABLED,
1841 &hdev->dev_flags);
1842 } else {
1843 changed = test_and_clear_bit(HCI_SSP_ENABLED,
1844 &hdev->dev_flags);
1845 if (!changed)
1846 changed = test_and_clear_bit(HCI_HS_ENABLED,
1847 &hdev->dev_flags);
1848 else
1849 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1850 }
1851
1852 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1853 if (err < 0)
1854 goto failed;
1855
1856 if (changed)
1857 err = new_settings(hdev, sk);
1858
1859 goto failed;
1860 }
1861
1862 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
1863 mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
1864 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1865 MGMT_STATUS_BUSY);
1866 goto failed;
1867 }
1868
1869 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1870 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1871 goto failed;
1872 }
1873
1874 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1875 if (!cmd) {
1876 err = -ENOMEM;
1877 goto failed;
1878 }
1879
1880 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1881 if (err < 0) {
1882 mgmt_pending_remove(cmd);
1883 goto failed;
1884 }
1885
1886 failed:
1887 hci_dev_unlock(hdev);
1888 return err;
1889 }
1890
1891 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1892 {
1893 struct mgmt_mode *cp = data;
1894 bool changed;
1895 u8 status;
1896 int err;
1897
1898 BT_DBG("request for %s", hdev->name);
1899
1900 status = mgmt_bredr_support(hdev);
1901 if (status)
1902 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1903
1904 if (!lmp_ssp_capable(hdev))
1905 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1906 MGMT_STATUS_NOT_SUPPORTED);
1907
1908 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
1909 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1910 MGMT_STATUS_REJECTED);
1911
1912 if (cp->val != 0x00 && cp->val != 0x01)
1913 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1914 MGMT_STATUS_INVALID_PARAMS);
1915
1916 hci_dev_lock(hdev);
1917
1918 if (cp->val) {
1919 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1920 } else {
1921 if (hdev_is_powered(hdev)) {
1922 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1923 MGMT_STATUS_REJECTED);
1924 goto unlock;
1925 }
1926
1927 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1928 }
1929
1930 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1931 if (err < 0)
1932 goto unlock;
1933
1934 if (changed)
1935 err = new_settings(hdev, sk);
1936
1937 unlock:
1938 hci_dev_unlock(hdev);
1939 return err;
1940 }
1941
1942 static void le_enable_complete(struct hci_dev *hdev, u8 status)
1943 {
1944 struct cmd_lookup match = { NULL, hdev };
1945
1946 if (status) {
1947 u8 mgmt_err = mgmt_status(status);
1948
1949 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1950 &mgmt_err);
1951 return;
1952 }
1953
1954 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1955
1956 new_settings(hdev, match.sk);
1957
1958 if (match.sk)
1959 sock_put(match.sk);
1960
1961 /* Make sure the controller has a good default for
1962 * advertising data. Restrict the update to when LE
1963 * has actually been enabled. During power on, the
1964 * update in powered_update_hci will take care of it.
1965 */
1966 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1967 struct hci_request req;
1968
1969 hci_dev_lock(hdev);
1970
1971 hci_req_init(&req, hdev);
1972 update_adv_data(&req);
1973 update_scan_rsp_data(&req);
1974 hci_req_run(&req, NULL);
1975
1976 hci_dev_unlock(hdev);
1977 }
1978 }
1979
1980 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1981 {
1982 struct mgmt_mode *cp = data;
1983 struct hci_cp_write_le_host_supported hci_cp;
1984 struct pending_cmd *cmd;
1985 struct hci_request req;
1986 int err;
1987 u8 val, enabled;
1988
1989 BT_DBG("request for %s", hdev->name);
1990
1991 if (!lmp_le_capable(hdev))
1992 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1993 MGMT_STATUS_NOT_SUPPORTED);
1994
1995 if (cp->val != 0x00 && cp->val != 0x01)
1996 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1997 MGMT_STATUS_INVALID_PARAMS);
1998
1999 /* LE-only devices do not allow toggling LE on/off */
2000 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2001 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2002 MGMT_STATUS_REJECTED);
2003
2004 hci_dev_lock(hdev);
2005
2006 val = !!cp->val;
2007 enabled = lmp_host_le_capable(hdev);
2008
2009 if (!hdev_is_powered(hdev) || val == enabled) {
2010 bool changed = false;
2011
2012 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2013 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2014 changed = true;
2015 }
2016
2017 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2018 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2019 changed = true;
2020 }
2021
2022 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2023 if (err < 0)
2024 goto unlock;
2025
2026 if (changed)
2027 err = new_settings(hdev, sk);
2028
2029 goto unlock;
2030 }
2031
2032 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2033 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2034 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2035 MGMT_STATUS_BUSY);
2036 goto unlock;
2037 }
2038
2039 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2040 if (!cmd) {
2041 err = -ENOMEM;
2042 goto unlock;
2043 }
2044
2045 hci_req_init(&req, hdev);
2046
2047 memset(&hci_cp, 0, sizeof(hci_cp));
2048
2049 if (val) {
2050 hci_cp.le = val;
2051 hci_cp.simul = lmp_le_br_capable(hdev);
2052 } else {
2053 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
2054 disable_advertising(&req);
2055 }
2056
2057 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2058 &hci_cp);
2059
2060 err = hci_req_run(&req, le_enable_complete);
2061 if (err < 0)
2062 mgmt_pending_remove(cmd);
2063
2064 unlock:
2065 hci_dev_unlock(hdev);
2066 return err;
2067 }
2068
2069 /* This is a helper function to test for pending mgmt commands that can
2070 * cause CoD or EIR HCI commands. We can only allow one such pending
2071 * mgmt command at a time since otherwise we cannot easily track what
2072 * the current values are, will be, and based on that calculate if a new
2073 * HCI command needs to be sent and if yes with what value.
2074 */
2075 static bool pending_eir_or_class(struct hci_dev *hdev)
2076 {
2077 struct pending_cmd *cmd;
2078
2079 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2080 switch (cmd->opcode) {
2081 case MGMT_OP_ADD_UUID:
2082 case MGMT_OP_REMOVE_UUID:
2083 case MGMT_OP_SET_DEV_CLASS:
2084 case MGMT_OP_SET_POWERED:
2085 return true;
2086 }
2087 }
2088
2089 return false;
2090 }
2091
2092 static const u8 bluetooth_base_uuid[] = {
2093 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2094 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2095 };
2096
2097 static u8 get_uuid_size(const u8 *uuid)
2098 {
2099 u32 val;
2100
2101 if (memcmp(uuid, bluetooth_base_uuid, 12))
2102 return 128;
2103
2104 val = get_unaligned_le32(&uuid[12]);
2105 if (val > 0xffff)
2106 return 32;
2107
2108 return 16;
2109 }
2110
2111 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2112 {
2113 struct pending_cmd *cmd;
2114
2115 hci_dev_lock(hdev);
2116
2117 cmd = mgmt_pending_find(mgmt_op, hdev);
2118 if (!cmd)
2119 goto unlock;
2120
2121 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2122 hdev->dev_class, 3);
2123
2124 mgmt_pending_remove(cmd);
2125
2126 unlock:
2127 hci_dev_unlock(hdev);
2128 }
2129
2130 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2131 {
2132 BT_DBG("status 0x%02x", status);
2133
2134 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2135 }
2136
2137 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2138 {
2139 struct mgmt_cp_add_uuid *cp = data;
2140 struct pending_cmd *cmd;
2141 struct hci_request req;
2142 struct bt_uuid *uuid;
2143 int err;
2144
2145 BT_DBG("request for %s", hdev->name);
2146
2147 hci_dev_lock(hdev);
2148
2149 if (pending_eir_or_class(hdev)) {
2150 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2151 MGMT_STATUS_BUSY);
2152 goto failed;
2153 }
2154
2155 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2156 if (!uuid) {
2157 err = -ENOMEM;
2158 goto failed;
2159 }
2160
2161 memcpy(uuid->uuid, cp->uuid, 16);
2162 uuid->svc_hint = cp->svc_hint;
2163 uuid->size = get_uuid_size(cp->uuid);
2164
2165 list_add_tail(&uuid->list, &hdev->uuids);
2166
2167 hci_req_init(&req, hdev);
2168
2169 update_class(&req);
2170 update_eir(&req);
2171
2172 err = hci_req_run(&req, add_uuid_complete);
2173 if (err < 0) {
2174 if (err != -ENODATA)
2175 goto failed;
2176
2177 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2178 hdev->dev_class, 3);
2179 goto failed;
2180 }
2181
2182 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2183 if (!cmd) {
2184 err = -ENOMEM;
2185 goto failed;
2186 }
2187
2188 err = 0;
2189
2190 failed:
2191 hci_dev_unlock(hdev);
2192 return err;
2193 }
2194
2195 static bool enable_service_cache(struct hci_dev *hdev)
2196 {
2197 if (!hdev_is_powered(hdev))
2198 return false;
2199
2200 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2201 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2202 CACHE_TIMEOUT);
2203 return true;
2204 }
2205
2206 return false;
2207 }
2208
2209 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2210 {
2211 BT_DBG("status 0x%02x", status);
2212
2213 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2214 }
2215
2216 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2217 u16 len)
2218 {
2219 struct mgmt_cp_remove_uuid *cp = data;
2220 struct pending_cmd *cmd;
2221 struct bt_uuid *match, *tmp;
2222 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2223 struct hci_request req;
2224 int err, found;
2225
2226 BT_DBG("request for %s", hdev->name);
2227
2228 hci_dev_lock(hdev);
2229
2230 if (pending_eir_or_class(hdev)) {
2231 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2232 MGMT_STATUS_BUSY);
2233 goto unlock;
2234 }
2235
2236 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2237 hci_uuids_clear(hdev);
2238
2239 if (enable_service_cache(hdev)) {
2240 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2241 0, hdev->dev_class, 3);
2242 goto unlock;
2243 }
2244
2245 goto update_class;
2246 }
2247
2248 found = 0;
2249
2250 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2251 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2252 continue;
2253
2254 list_del(&match->list);
2255 kfree(match);
2256 found++;
2257 }
2258
2259 if (found == 0) {
2260 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2261 MGMT_STATUS_INVALID_PARAMS);
2262 goto unlock;
2263 }
2264
2265 update_class:
2266 hci_req_init(&req, hdev);
2267
2268 update_class(&req);
2269 update_eir(&req);
2270
2271 err = hci_req_run(&req, remove_uuid_complete);
2272 if (err < 0) {
2273 if (err != -ENODATA)
2274 goto unlock;
2275
2276 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2277 hdev->dev_class, 3);
2278 goto unlock;
2279 }
2280
2281 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2282 if (!cmd) {
2283 err = -ENOMEM;
2284 goto unlock;
2285 }
2286
2287 err = 0;
2288
2289 unlock:
2290 hci_dev_unlock(hdev);
2291 return err;
2292 }
2293
2294 static void set_class_complete(struct hci_dev *hdev, u8 status)
2295 {
2296 BT_DBG("status 0x%02x", status);
2297
2298 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2299 }
2300
2301 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2302 u16 len)
2303 {
2304 struct mgmt_cp_set_dev_class *cp = data;
2305 struct pending_cmd *cmd;
2306 struct hci_request req;
2307 int err;
2308
2309 BT_DBG("request for %s", hdev->name);
2310
2311 if (!lmp_bredr_capable(hdev))
2312 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2313 MGMT_STATUS_NOT_SUPPORTED);
2314
2315 hci_dev_lock(hdev);
2316
2317 if (pending_eir_or_class(hdev)) {
2318 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2319 MGMT_STATUS_BUSY);
2320 goto unlock;
2321 }
2322
2323 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2324 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2325 MGMT_STATUS_INVALID_PARAMS);
2326 goto unlock;
2327 }
2328
2329 hdev->major_class = cp->major;
2330 hdev->minor_class = cp->minor;
2331
2332 if (!hdev_is_powered(hdev)) {
2333 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2334 hdev->dev_class, 3);
2335 goto unlock;
2336 }
2337
2338 hci_req_init(&req, hdev);
2339
2340 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2341 hci_dev_unlock(hdev);
2342 cancel_delayed_work_sync(&hdev->service_cache);
2343 hci_dev_lock(hdev);
2344 update_eir(&req);
2345 }
2346
2347 update_class(&req);
2348
2349 err = hci_req_run(&req, set_class_complete);
2350 if (err < 0) {
2351 if (err != -ENODATA)
2352 goto unlock;
2353
2354 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2355 hdev->dev_class, 3);
2356 goto unlock;
2357 }
2358
2359 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2360 if (!cmd) {
2361 err = -ENOMEM;
2362 goto unlock;
2363 }
2364
2365 err = 0;
2366
2367 unlock:
2368 hci_dev_unlock(hdev);
2369 return err;
2370 }
2371
2372 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2373 u16 len)
2374 {
2375 struct mgmt_cp_load_link_keys *cp = data;
2376 u16 key_count, expected_len;
2377 bool changed;
2378 int i;
2379
2380 BT_DBG("request for %s", hdev->name);
2381
2382 if (!lmp_bredr_capable(hdev))
2383 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2384 MGMT_STATUS_NOT_SUPPORTED);
2385
2386 key_count = __le16_to_cpu(cp->key_count);
2387
2388 expected_len = sizeof(*cp) + key_count *
2389 sizeof(struct mgmt_link_key_info);
2390 if (expected_len != len) {
2391 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2392 expected_len, len);
2393 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2394 MGMT_STATUS_INVALID_PARAMS);
2395 }
2396
2397 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2398 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2399 MGMT_STATUS_INVALID_PARAMS);
2400
2401 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2402 key_count);
2403
2404 for (i = 0; i < key_count; i++) {
2405 struct mgmt_link_key_info *key = &cp->keys[i];
2406
2407 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2408 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2409 MGMT_STATUS_INVALID_PARAMS);
2410 }
2411
2412 hci_dev_lock(hdev);
2413
2414 hci_link_keys_clear(hdev);
2415
2416 if (cp->debug_keys)
2417 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2418 else
2419 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
2420
2421 if (changed)
2422 new_settings(hdev, NULL);
2423
2424 for (i = 0; i < key_count; i++) {
2425 struct mgmt_link_key_info *key = &cp->keys[i];
2426
2427 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
2428 key->type, key->pin_len);
2429 }
2430
2431 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2432
2433 hci_dev_unlock(hdev);
2434
2435 return 0;
2436 }
2437
2438 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2439 u8 addr_type, struct sock *skip_sk)
2440 {
2441 struct mgmt_ev_device_unpaired ev;
2442
2443 bacpy(&ev.addr.bdaddr, bdaddr);
2444 ev.addr.type = addr_type;
2445
2446 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2447 skip_sk);
2448 }
2449
2450 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2451 u16 len)
2452 {
2453 struct mgmt_cp_unpair_device *cp = data;
2454 struct mgmt_rp_unpair_device rp;
2455 struct hci_cp_disconnect dc;
2456 struct pending_cmd *cmd;
2457 struct hci_conn *conn;
2458 int err;
2459
2460 memset(&rp, 0, sizeof(rp));
2461 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2462 rp.addr.type = cp->addr.type;
2463
2464 if (!bdaddr_type_is_valid(cp->addr.type))
2465 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2466 MGMT_STATUS_INVALID_PARAMS,
2467 &rp, sizeof(rp));
2468
2469 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2470 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2471 MGMT_STATUS_INVALID_PARAMS,
2472 &rp, sizeof(rp));
2473
2474 hci_dev_lock(hdev);
2475
2476 if (!hdev_is_powered(hdev)) {
2477 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2478 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2479 goto unlock;
2480 }
2481
2482 if (cp->addr.type == BDADDR_BREDR) {
2483 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2484 } else {
2485 u8 addr_type;
2486
2487 if (cp->addr.type == BDADDR_LE_PUBLIC)
2488 addr_type = ADDR_LE_DEV_PUBLIC;
2489 else
2490 addr_type = ADDR_LE_DEV_RANDOM;
2491
2492 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2493
2494 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2495
2496 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2497 }
2498
2499 if (err < 0) {
2500 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2501 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2502 goto unlock;
2503 }
2504
2505 if (cp->disconnect) {
2506 if (cp->addr.type == BDADDR_BREDR)
2507 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2508 &cp->addr.bdaddr);
2509 else
2510 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2511 &cp->addr.bdaddr);
2512 } else {
2513 conn = NULL;
2514 }
2515
2516 if (!conn) {
2517 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2518 &rp, sizeof(rp));
2519 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2520 goto unlock;
2521 }
2522
2523 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2524 sizeof(*cp));
2525 if (!cmd) {
2526 err = -ENOMEM;
2527 goto unlock;
2528 }
2529
2530 dc.handle = cpu_to_le16(conn->handle);
2531 dc.reason = 0x13; /* Remote User Terminated Connection */
2532 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2533 if (err < 0)
2534 mgmt_pending_remove(cmd);
2535
2536 unlock:
2537 hci_dev_unlock(hdev);
2538 return err;
2539 }
2540
2541 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2542 u16 len)
2543 {
2544 struct mgmt_cp_disconnect *cp = data;
2545 struct mgmt_rp_disconnect rp;
2546 struct hci_cp_disconnect dc;
2547 struct pending_cmd *cmd;
2548 struct hci_conn *conn;
2549 int err;
2550
2551 BT_DBG("");
2552
2553 memset(&rp, 0, sizeof(rp));
2554 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2555 rp.addr.type = cp->addr.type;
2556
2557 if (!bdaddr_type_is_valid(cp->addr.type))
2558 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2559 MGMT_STATUS_INVALID_PARAMS,
2560 &rp, sizeof(rp));
2561
2562 hci_dev_lock(hdev);
2563
2564 if (!test_bit(HCI_UP, &hdev->flags)) {
2565 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2566 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2567 goto failed;
2568 }
2569
2570 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2571 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2572 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2573 goto failed;
2574 }
2575
2576 if (cp->addr.type == BDADDR_BREDR)
2577 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2578 &cp->addr.bdaddr);
2579 else
2580 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2581
2582 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2583 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2584 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2585 goto failed;
2586 }
2587
2588 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2589 if (!cmd) {
2590 err = -ENOMEM;
2591 goto failed;
2592 }
2593
2594 dc.handle = cpu_to_le16(conn->handle);
2595 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
2596
2597 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2598 if (err < 0)
2599 mgmt_pending_remove(cmd);
2600
2601 failed:
2602 hci_dev_unlock(hdev);
2603 return err;
2604 }
2605
2606 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2607 {
2608 switch (link_type) {
2609 case LE_LINK:
2610 switch (addr_type) {
2611 case ADDR_LE_DEV_PUBLIC:
2612 return BDADDR_LE_PUBLIC;
2613
2614 default:
2615 /* Fallback to LE Random address type */
2616 return BDADDR_LE_RANDOM;
2617 }
2618
2619 default:
2620 /* Fallback to BR/EDR type */
2621 return BDADDR_BREDR;
2622 }
2623 }
2624
2625 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2626 u16 data_len)
2627 {
2628 struct mgmt_rp_get_connections *rp;
2629 struct hci_conn *c;
2630 size_t rp_len;
2631 int err;
2632 u16 i;
2633
2634 BT_DBG("");
2635
2636 hci_dev_lock(hdev);
2637
2638 if (!hdev_is_powered(hdev)) {
2639 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2640 MGMT_STATUS_NOT_POWERED);
2641 goto unlock;
2642 }
2643
2644 i = 0;
2645 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2646 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2647 i++;
2648 }
2649
2650 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2651 rp = kmalloc(rp_len, GFP_KERNEL);
2652 if (!rp) {
2653 err = -ENOMEM;
2654 goto unlock;
2655 }
2656
2657 i = 0;
2658 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2659 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2660 continue;
2661 bacpy(&rp->addr[i].bdaddr, &c->dst);
2662 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2663 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2664 continue;
2665 i++;
2666 }
2667
2668 rp->conn_count = cpu_to_le16(i);
2669
2670 /* Recalculate length in case of filtered SCO connections, etc */
2671 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2672
2673 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2674 rp_len);
2675
2676 kfree(rp);
2677
2678 unlock:
2679 hci_dev_unlock(hdev);
2680 return err;
2681 }
2682
2683 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2684 struct mgmt_cp_pin_code_neg_reply *cp)
2685 {
2686 struct pending_cmd *cmd;
2687 int err;
2688
2689 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2690 sizeof(*cp));
2691 if (!cmd)
2692 return -ENOMEM;
2693
2694 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2695 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2696 if (err < 0)
2697 mgmt_pending_remove(cmd);
2698
2699 return err;
2700 }
2701
2702 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2703 u16 len)
2704 {
2705 struct hci_conn *conn;
2706 struct mgmt_cp_pin_code_reply *cp = data;
2707 struct hci_cp_pin_code_reply reply;
2708 struct pending_cmd *cmd;
2709 int err;
2710
2711 BT_DBG("");
2712
2713 hci_dev_lock(hdev);
2714
2715 if (!hdev_is_powered(hdev)) {
2716 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2717 MGMT_STATUS_NOT_POWERED);
2718 goto failed;
2719 }
2720
2721 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2722 if (!conn) {
2723 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2724 MGMT_STATUS_NOT_CONNECTED);
2725 goto failed;
2726 }
2727
2728 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2729 struct mgmt_cp_pin_code_neg_reply ncp;
2730
2731 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2732
2733 BT_ERR("PIN code is not 16 bytes long");
2734
2735 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2736 if (err >= 0)
2737 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2738 MGMT_STATUS_INVALID_PARAMS);
2739
2740 goto failed;
2741 }
2742
2743 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2744 if (!cmd) {
2745 err = -ENOMEM;
2746 goto failed;
2747 }
2748
2749 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2750 reply.pin_len = cp->pin_len;
2751 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2752
2753 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2754 if (err < 0)
2755 mgmt_pending_remove(cmd);
2756
2757 failed:
2758 hci_dev_unlock(hdev);
2759 return err;
2760 }
2761
2762 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2763 u16 len)
2764 {
2765 struct mgmt_cp_set_io_capability *cp = data;
2766
2767 BT_DBG("");
2768
2769 hci_dev_lock(hdev);
2770
2771 hdev->io_capability = cp->io_capability;
2772
2773 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2774 hdev->io_capability);
2775
2776 hci_dev_unlock(hdev);
2777
2778 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2779 0);
2780 }
2781
2782 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2783 {
2784 struct hci_dev *hdev = conn->hdev;
2785 struct pending_cmd *cmd;
2786
2787 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2788 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2789 continue;
2790
2791 if (cmd->user_data != conn)
2792 continue;
2793
2794 return cmd;
2795 }
2796
2797 return NULL;
2798 }
2799
2800 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2801 {
2802 struct mgmt_rp_pair_device rp;
2803 struct hci_conn *conn = cmd->user_data;
2804
2805 bacpy(&rp.addr.bdaddr, &conn->dst);
2806 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2807
2808 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2809 &rp, sizeof(rp));
2810
2811 /* So we don't get further callbacks for this connection */
2812 conn->connect_cfm_cb = NULL;
2813 conn->security_cfm_cb = NULL;
2814 conn->disconn_cfm_cb = NULL;
2815
2816 hci_conn_drop(conn);
2817
2818 mgmt_pending_remove(cmd);
2819 }
2820
2821 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2822 {
2823 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2824 struct pending_cmd *cmd;
2825
2826 cmd = find_pairing(conn);
2827 if (cmd)
2828 pairing_complete(cmd, status);
2829 }
2830
2831 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2832 {
2833 struct pending_cmd *cmd;
2834
2835 BT_DBG("status %u", status);
2836
2837 cmd = find_pairing(conn);
2838 if (!cmd)
2839 BT_DBG("Unable to find a pending command");
2840 else
2841 pairing_complete(cmd, mgmt_status(status));
2842 }
2843
2844 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2845 {
2846 struct pending_cmd *cmd;
2847
2848 BT_DBG("status %u", status);
2849
2850 if (!status)
2851 return;
2852
2853 cmd = find_pairing(conn);
2854 if (!cmd)
2855 BT_DBG("Unable to find a pending command");
2856 else
2857 pairing_complete(cmd, mgmt_status(status));
2858 }
2859
2860 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2861 u16 len)
2862 {
2863 struct mgmt_cp_pair_device *cp = data;
2864 struct mgmt_rp_pair_device rp;
2865 struct pending_cmd *cmd;
2866 u8 sec_level, auth_type;
2867 struct hci_conn *conn;
2868 int err;
2869
2870 BT_DBG("");
2871
2872 memset(&rp, 0, sizeof(rp));
2873 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2874 rp.addr.type = cp->addr.type;
2875
2876 if (!bdaddr_type_is_valid(cp->addr.type))
2877 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2878 MGMT_STATUS_INVALID_PARAMS,
2879 &rp, sizeof(rp));
2880
2881 hci_dev_lock(hdev);
2882
2883 if (!hdev_is_powered(hdev)) {
2884 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2885 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2886 goto unlock;
2887 }
2888
2889 sec_level = BT_SECURITY_MEDIUM;
2890 auth_type = HCI_AT_DEDICATED_BONDING;
2891
2892 if (cp->addr.type == BDADDR_BREDR) {
2893 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2894 auth_type);
2895 } else {
2896 u8 addr_type;
2897
2898 /* Convert from L2CAP channel address type to HCI address type
2899 */
2900 if (cp->addr.type == BDADDR_LE_PUBLIC)
2901 addr_type = ADDR_LE_DEV_PUBLIC;
2902 else
2903 addr_type = ADDR_LE_DEV_RANDOM;
2904
2905 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
2906 sec_level, auth_type);
2907 }
2908
2909 if (IS_ERR(conn)) {
2910 int status;
2911
2912 if (PTR_ERR(conn) == -EBUSY)
2913 status = MGMT_STATUS_BUSY;
2914 else
2915 status = MGMT_STATUS_CONNECT_FAILED;
2916
2917 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2918 status, &rp,
2919 sizeof(rp));
2920 goto unlock;
2921 }
2922
2923 if (conn->connect_cfm_cb) {
2924 hci_conn_drop(conn);
2925 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2926 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2927 goto unlock;
2928 }
2929
2930 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2931 if (!cmd) {
2932 err = -ENOMEM;
2933 hci_conn_drop(conn);
2934 goto unlock;
2935 }
2936
2937 /* For LE, just connecting isn't a proof that the pairing finished */
2938 if (cp->addr.type == BDADDR_BREDR) {
2939 conn->connect_cfm_cb = pairing_complete_cb;
2940 conn->security_cfm_cb = pairing_complete_cb;
2941 conn->disconn_cfm_cb = pairing_complete_cb;
2942 } else {
2943 conn->connect_cfm_cb = le_pairing_complete_cb;
2944 conn->security_cfm_cb = le_pairing_complete_cb;
2945 conn->disconn_cfm_cb = le_pairing_complete_cb;
2946 }
2947
2948 conn->io_capability = cp->io_cap;
2949 cmd->user_data = conn;
2950
2951 if (conn->state == BT_CONNECTED &&
2952 hci_conn_security(conn, sec_level, auth_type))
2953 pairing_complete(cmd, 0);
2954
2955 err = 0;
2956
2957 unlock:
2958 hci_dev_unlock(hdev);
2959 return err;
2960 }
2961
2962 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2963 u16 len)
2964 {
2965 struct mgmt_addr_info *addr = data;
2966 struct pending_cmd *cmd;
2967 struct hci_conn *conn;
2968 int err;
2969
2970 BT_DBG("");
2971
2972 hci_dev_lock(hdev);
2973
2974 if (!hdev_is_powered(hdev)) {
2975 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2976 MGMT_STATUS_NOT_POWERED);
2977 goto unlock;
2978 }
2979
2980 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2981 if (!cmd) {
2982 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2983 MGMT_STATUS_INVALID_PARAMS);
2984 goto unlock;
2985 }
2986
2987 conn = cmd->user_data;
2988
2989 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2990 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2991 MGMT_STATUS_INVALID_PARAMS);
2992 goto unlock;
2993 }
2994
2995 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2996
2997 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2998 addr, sizeof(*addr));
2999 unlock:
3000 hci_dev_unlock(hdev);
3001 return err;
3002 }
3003
3004 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3005 struct mgmt_addr_info *addr, u16 mgmt_op,
3006 u16 hci_op, __le32 passkey)
3007 {
3008 struct pending_cmd *cmd;
3009 struct hci_conn *conn;
3010 int err;
3011
3012 hci_dev_lock(hdev);
3013
3014 if (!hdev_is_powered(hdev)) {
3015 err = cmd_complete(sk, hdev->id, mgmt_op,
3016 MGMT_STATUS_NOT_POWERED, addr,
3017 sizeof(*addr));
3018 goto done;
3019 }
3020
3021 if (addr->type == BDADDR_BREDR)
3022 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3023 else
3024 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3025
3026 if (!conn) {
3027 err = cmd_complete(sk, hdev->id, mgmt_op,
3028 MGMT_STATUS_NOT_CONNECTED, addr,
3029 sizeof(*addr));
3030 goto done;
3031 }
3032
3033 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3034 /* Continue with pairing via SMP. The hdev lock must be
3035 * released as SMP may try to recquire it for crypto
3036 * purposes.
3037 */
3038 hci_dev_unlock(hdev);
3039 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3040 hci_dev_lock(hdev);
3041
3042 if (!err)
3043 err = cmd_complete(sk, hdev->id, mgmt_op,
3044 MGMT_STATUS_SUCCESS, addr,
3045 sizeof(*addr));
3046 else
3047 err = cmd_complete(sk, hdev->id, mgmt_op,
3048 MGMT_STATUS_FAILED, addr,
3049 sizeof(*addr));
3050
3051 goto done;
3052 }
3053
3054 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3055 if (!cmd) {
3056 err = -ENOMEM;
3057 goto done;
3058 }
3059
3060 /* Continue with pairing via HCI */
3061 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3062 struct hci_cp_user_passkey_reply cp;
3063
3064 bacpy(&cp.bdaddr, &addr->bdaddr);
3065 cp.passkey = passkey;
3066 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3067 } else
3068 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3069 &addr->bdaddr);
3070
3071 if (err < 0)
3072 mgmt_pending_remove(cmd);
3073
3074 done:
3075 hci_dev_unlock(hdev);
3076 return err;
3077 }
3078
3079 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3080 void *data, u16 len)
3081 {
3082 struct mgmt_cp_pin_code_neg_reply *cp = data;
3083
3084 BT_DBG("");
3085
3086 return user_pairing_resp(sk, hdev, &cp->addr,
3087 MGMT_OP_PIN_CODE_NEG_REPLY,
3088 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3089 }
3090
3091 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3092 u16 len)
3093 {
3094 struct mgmt_cp_user_confirm_reply *cp = data;
3095
3096 BT_DBG("");
3097
3098 if (len != sizeof(*cp))
3099 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3100 MGMT_STATUS_INVALID_PARAMS);
3101
3102 return user_pairing_resp(sk, hdev, &cp->addr,
3103 MGMT_OP_USER_CONFIRM_REPLY,
3104 HCI_OP_USER_CONFIRM_REPLY, 0);
3105 }
3106
3107 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3108 void *data, u16 len)
3109 {
3110 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3111
3112 BT_DBG("");
3113
3114 return user_pairing_resp(sk, hdev, &cp->addr,
3115 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3116 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3117 }
3118
3119 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3120 u16 len)
3121 {
3122 struct mgmt_cp_user_passkey_reply *cp = data;
3123
3124 BT_DBG("");
3125
3126 return user_pairing_resp(sk, hdev, &cp->addr,
3127 MGMT_OP_USER_PASSKEY_REPLY,
3128 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3129 }
3130
3131 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3132 void *data, u16 len)
3133 {
3134 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3135
3136 BT_DBG("");
3137
3138 return user_pairing_resp(sk, hdev, &cp->addr,
3139 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3140 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3141 }
3142
3143 static void update_name(struct hci_request *req)
3144 {
3145 struct hci_dev *hdev = req->hdev;
3146 struct hci_cp_write_local_name cp;
3147
3148 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3149
3150 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3151 }
3152
3153 static void set_name_complete(struct hci_dev *hdev, u8 status)
3154 {
3155 struct mgmt_cp_set_local_name *cp;
3156 struct pending_cmd *cmd;
3157
3158 BT_DBG("status 0x%02x", status);
3159
3160 hci_dev_lock(hdev);
3161
3162 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3163 if (!cmd)
3164 goto unlock;
3165
3166 cp = cmd->param;
3167
3168 if (status)
3169 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3170 mgmt_status(status));
3171 else
3172 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3173 cp, sizeof(*cp));
3174
3175 mgmt_pending_remove(cmd);
3176
3177 unlock:
3178 hci_dev_unlock(hdev);
3179 }
3180
3181 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3182 u16 len)
3183 {
3184 struct mgmt_cp_set_local_name *cp = data;
3185 struct pending_cmd *cmd;
3186 struct hci_request req;
3187 int err;
3188
3189 BT_DBG("");
3190
3191 hci_dev_lock(hdev);
3192
3193 /* If the old values are the same as the new ones just return a
3194 * direct command complete event.
3195 */
3196 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3197 !memcmp(hdev->short_name, cp->short_name,
3198 sizeof(hdev->short_name))) {
3199 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3200 data, len);
3201 goto failed;
3202 }
3203
3204 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3205
3206 if (!hdev_is_powered(hdev)) {
3207 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3208
3209 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3210 data, len);
3211 if (err < 0)
3212 goto failed;
3213
3214 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3215 sk);
3216
3217 goto failed;
3218 }
3219
3220 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3221 if (!cmd) {
3222 err = -ENOMEM;
3223 goto failed;
3224 }
3225
3226 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3227
3228 hci_req_init(&req, hdev);
3229
3230 if (lmp_bredr_capable(hdev)) {
3231 update_name(&req);
3232 update_eir(&req);
3233 }
3234
3235 /* The name is stored in the scan response data and so
3236 * no need to udpate the advertising data here.
3237 */
3238 if (lmp_le_capable(hdev))
3239 update_scan_rsp_data(&req);
3240
3241 err = hci_req_run(&req, set_name_complete);
3242 if (err < 0)
3243 mgmt_pending_remove(cmd);
3244
3245 failed:
3246 hci_dev_unlock(hdev);
3247 return err;
3248 }
3249
3250 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3251 void *data, u16 data_len)
3252 {
3253 struct pending_cmd *cmd;
3254 int err;
3255
3256 BT_DBG("%s", hdev->name);
3257
3258 hci_dev_lock(hdev);
3259
3260 if (!hdev_is_powered(hdev)) {
3261 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3262 MGMT_STATUS_NOT_POWERED);
3263 goto unlock;
3264 }
3265
3266 if (!lmp_ssp_capable(hdev)) {
3267 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3268 MGMT_STATUS_NOT_SUPPORTED);
3269 goto unlock;
3270 }
3271
3272 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3273 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3274 MGMT_STATUS_BUSY);
3275 goto unlock;
3276 }
3277
3278 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3279 if (!cmd) {
3280 err = -ENOMEM;
3281 goto unlock;
3282 }
3283
3284 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
3285 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3286 0, NULL);
3287 else
3288 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3289
3290 if (err < 0)
3291 mgmt_pending_remove(cmd);
3292
3293 unlock:
3294 hci_dev_unlock(hdev);
3295 return err;
3296 }
3297
3298 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3299 void *data, u16 len)
3300 {
3301 int err;
3302
3303 BT_DBG("%s ", hdev->name);
3304
3305 hci_dev_lock(hdev);
3306
3307 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3308 struct mgmt_cp_add_remote_oob_data *cp = data;
3309 u8 status;
3310
3311 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3312 cp->hash, cp->randomizer);
3313 if (err < 0)
3314 status = MGMT_STATUS_FAILED;
3315 else
3316 status = MGMT_STATUS_SUCCESS;
3317
3318 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3319 status, &cp->addr, sizeof(cp->addr));
3320 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3321 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3322 u8 status;
3323
3324 err = hci_add_remote_oob_ext_data(hdev, &cp->addr.bdaddr,
3325 cp->hash192,
3326 cp->randomizer192,
3327 cp->hash256,
3328 cp->randomizer256);
3329 if (err < 0)
3330 status = MGMT_STATUS_FAILED;
3331 else
3332 status = MGMT_STATUS_SUCCESS;
3333
3334 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3335 status, &cp->addr, sizeof(cp->addr));
3336 } else {
3337 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3338 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3339 MGMT_STATUS_INVALID_PARAMS);
3340 }
3341
3342 hci_dev_unlock(hdev);
3343 return err;
3344 }
3345
3346 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3347 void *data, u16 len)
3348 {
3349 struct mgmt_cp_remove_remote_oob_data *cp = data;
3350 u8 status;
3351 int err;
3352
3353 BT_DBG("%s", hdev->name);
3354
3355 hci_dev_lock(hdev);
3356
3357 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
3358 if (err < 0)
3359 status = MGMT_STATUS_INVALID_PARAMS;
3360 else
3361 status = MGMT_STATUS_SUCCESS;
3362
3363 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3364 status, &cp->addr, sizeof(cp->addr));
3365
3366 hci_dev_unlock(hdev);
3367 return err;
3368 }
3369
3370 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3371 {
3372 struct pending_cmd *cmd;
3373 u8 type;
3374 int err;
3375
3376 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3377
3378 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3379 if (!cmd)
3380 return -ENOENT;
3381
3382 type = hdev->discovery.type;
3383
3384 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3385 &type, sizeof(type));
3386 mgmt_pending_remove(cmd);
3387
3388 return err;
3389 }
3390
3391 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3392 {
3393 unsigned long timeout = 0;
3394
3395 BT_DBG("status %d", status);
3396
3397 if (status) {
3398 hci_dev_lock(hdev);
3399 mgmt_start_discovery_failed(hdev, status);
3400 hci_dev_unlock(hdev);
3401 return;
3402 }
3403
3404 hci_dev_lock(hdev);
3405 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3406 hci_dev_unlock(hdev);
3407
3408 switch (hdev->discovery.type) {
3409 case DISCOV_TYPE_LE:
3410 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3411 break;
3412
3413 case DISCOV_TYPE_INTERLEAVED:
3414 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3415 break;
3416
3417 case DISCOV_TYPE_BREDR:
3418 break;
3419
3420 default:
3421 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3422 }
3423
3424 if (!timeout)
3425 return;
3426
3427 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
3428 }
3429
3430 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3431 void *data, u16 len)
3432 {
3433 struct mgmt_cp_start_discovery *cp = data;
3434 struct pending_cmd *cmd;
3435 struct hci_cp_le_set_scan_param param_cp;
3436 struct hci_cp_le_set_scan_enable enable_cp;
3437 struct hci_cp_inquiry inq_cp;
3438 struct hci_request req;
3439 /* General inquiry access code (GIAC) */
3440 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3441 u8 status, own_addr_type;
3442 int err;
3443
3444 BT_DBG("%s", hdev->name);
3445
3446 hci_dev_lock(hdev);
3447
3448 if (!hdev_is_powered(hdev)) {
3449 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3450 MGMT_STATUS_NOT_POWERED);
3451 goto failed;
3452 }
3453
3454 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3455 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3456 MGMT_STATUS_BUSY);
3457 goto failed;
3458 }
3459
3460 if (hdev->discovery.state != DISCOVERY_STOPPED) {
3461 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3462 MGMT_STATUS_BUSY);
3463 goto failed;
3464 }
3465
3466 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
3467 if (!cmd) {
3468 err = -ENOMEM;
3469 goto failed;
3470 }
3471
3472 hdev->discovery.type = cp->type;
3473
3474 hci_req_init(&req, hdev);
3475
3476 switch (hdev->discovery.type) {
3477 case DISCOV_TYPE_BREDR:
3478 status = mgmt_bredr_support(hdev);
3479 if (status) {
3480 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3481 status);
3482 mgmt_pending_remove(cmd);
3483 goto failed;
3484 }
3485
3486 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3487 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3488 MGMT_STATUS_BUSY);
3489 mgmt_pending_remove(cmd);
3490 goto failed;
3491 }
3492
3493 hci_inquiry_cache_flush(hdev);
3494
3495 memset(&inq_cp, 0, sizeof(inq_cp));
3496 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3497 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3498 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3499 break;
3500
3501 case DISCOV_TYPE_LE:
3502 case DISCOV_TYPE_INTERLEAVED:
3503 status = mgmt_le_support(hdev);
3504 if (status) {
3505 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3506 status);
3507 mgmt_pending_remove(cmd);
3508 goto failed;
3509 }
3510
3511 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3512 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3513 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3514 MGMT_STATUS_NOT_SUPPORTED);
3515 mgmt_pending_remove(cmd);
3516 goto failed;
3517 }
3518
3519 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3520 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3521 MGMT_STATUS_REJECTED);
3522 mgmt_pending_remove(cmd);
3523 goto failed;
3524 }
3525
3526 /* If controller is scanning, it means the background scanning
3527 * is running. Thus, we should temporarily stop it in order to
3528 * set the discovery scanning parameters.
3529 */
3530 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3531 hci_req_add_le_scan_disable(&req);
3532
3533 memset(&param_cp, 0, sizeof(param_cp));
3534
3535 /* All active scans will be done with either a resolvable
3536 * private address (when privacy feature has been enabled)
3537 * or unresolvable private address.
3538 */
3539 err = hci_update_random_address(&req, true, &own_addr_type);
3540 if (err < 0) {
3541 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3542 MGMT_STATUS_FAILED);
3543 mgmt_pending_remove(cmd);
3544 goto failed;
3545 }
3546
3547 param_cp.type = LE_SCAN_ACTIVE;
3548 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3549 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3550 param_cp.own_address_type = own_addr_type;
3551 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3552 &param_cp);
3553
3554 memset(&enable_cp, 0, sizeof(enable_cp));
3555 enable_cp.enable = LE_SCAN_ENABLE;
3556 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3557 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3558 &enable_cp);
3559 break;
3560
3561 default:
3562 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3563 MGMT_STATUS_INVALID_PARAMS);
3564 mgmt_pending_remove(cmd);
3565 goto failed;
3566 }
3567
3568 err = hci_req_run(&req, start_discovery_complete);
3569 if (err < 0)
3570 mgmt_pending_remove(cmd);
3571 else
3572 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3573
3574 failed:
3575 hci_dev_unlock(hdev);
3576 return err;
3577 }
3578
3579 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3580 {
3581 struct pending_cmd *cmd;
3582 int err;
3583
3584 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3585 if (!cmd)
3586 return -ENOENT;
3587
3588 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3589 &hdev->discovery.type, sizeof(hdev->discovery.type));
3590 mgmt_pending_remove(cmd);
3591
3592 return err;
3593 }
3594
3595 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
3596 {
3597 BT_DBG("status %d", status);
3598
3599 hci_dev_lock(hdev);
3600
3601 if (status) {
3602 mgmt_stop_discovery_failed(hdev, status);
3603 goto unlock;
3604 }
3605
3606 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3607
3608 unlock:
3609 hci_dev_unlock(hdev);
3610 }
3611
3612 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3613 u16 len)
3614 {
3615 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3616 struct pending_cmd *cmd;
3617 struct hci_request req;
3618 int err;
3619
3620 BT_DBG("%s", hdev->name);
3621
3622 hci_dev_lock(hdev);
3623
3624 if (!hci_discovery_active(hdev)) {
3625 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3626 MGMT_STATUS_REJECTED, &mgmt_cp->type,
3627 sizeof(mgmt_cp->type));
3628 goto unlock;
3629 }
3630
3631 if (hdev->discovery.type != mgmt_cp->type) {
3632 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3633 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
3634 sizeof(mgmt_cp->type));
3635 goto unlock;
3636 }
3637
3638 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
3639 if (!cmd) {
3640 err = -ENOMEM;
3641 goto unlock;
3642 }
3643
3644 hci_req_init(&req, hdev);
3645
3646 hci_stop_discovery(&req);
3647
3648 err = hci_req_run(&req, stop_discovery_complete);
3649 if (!err) {
3650 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3651 goto unlock;
3652 }
3653
3654 mgmt_pending_remove(cmd);
3655
3656 /* If no HCI commands were sent we're done */
3657 if (err == -ENODATA) {
3658 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
3659 &mgmt_cp->type, sizeof(mgmt_cp->type));
3660 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3661 }
3662
3663 unlock:
3664 hci_dev_unlock(hdev);
3665 return err;
3666 }
3667
3668 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3669 u16 len)
3670 {
3671 struct mgmt_cp_confirm_name *cp = data;
3672 struct inquiry_entry *e;
3673 int err;
3674
3675 BT_DBG("%s", hdev->name);
3676
3677 hci_dev_lock(hdev);
3678
3679 if (!hci_discovery_active(hdev)) {
3680 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3681 MGMT_STATUS_FAILED, &cp->addr,
3682 sizeof(cp->addr));
3683 goto failed;
3684 }
3685
3686 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3687 if (!e) {
3688 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3689 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3690 sizeof(cp->addr));
3691 goto failed;
3692 }
3693
3694 if (cp->name_known) {
3695 e->name_state = NAME_KNOWN;
3696 list_del(&e->list);
3697 } else {
3698 e->name_state = NAME_NEEDED;
3699 hci_inquiry_cache_update_resolve(hdev, e);
3700 }
3701
3702 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
3703 sizeof(cp->addr));
3704
3705 failed:
3706 hci_dev_unlock(hdev);
3707 return err;
3708 }
3709
3710 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3711 u16 len)
3712 {
3713 struct mgmt_cp_block_device *cp = data;
3714 u8 status;
3715 int err;
3716
3717 BT_DBG("%s", hdev->name);
3718
3719 if (!bdaddr_type_is_valid(cp->addr.type))
3720 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3721 MGMT_STATUS_INVALID_PARAMS,
3722 &cp->addr, sizeof(cp->addr));
3723
3724 hci_dev_lock(hdev);
3725
3726 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
3727 if (err < 0)
3728 status = MGMT_STATUS_FAILED;
3729 else
3730 status = MGMT_STATUS_SUCCESS;
3731
3732 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3733 &cp->addr, sizeof(cp->addr));
3734
3735 hci_dev_unlock(hdev);
3736
3737 return err;
3738 }
3739
3740 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3741 u16 len)
3742 {
3743 struct mgmt_cp_unblock_device *cp = data;
3744 u8 status;
3745 int err;
3746
3747 BT_DBG("%s", hdev->name);
3748
3749 if (!bdaddr_type_is_valid(cp->addr.type))
3750 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3751 MGMT_STATUS_INVALID_PARAMS,
3752 &cp->addr, sizeof(cp->addr));
3753
3754 hci_dev_lock(hdev);
3755
3756 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3757 if (err < 0)
3758 status = MGMT_STATUS_INVALID_PARAMS;
3759 else
3760 status = MGMT_STATUS_SUCCESS;
3761
3762 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3763 &cp->addr, sizeof(cp->addr));
3764
3765 hci_dev_unlock(hdev);
3766
3767 return err;
3768 }
3769
3770 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3771 u16 len)
3772 {
3773 struct mgmt_cp_set_device_id *cp = data;
3774 struct hci_request req;
3775 int err;
3776 __u16 source;
3777
3778 BT_DBG("%s", hdev->name);
3779
3780 source = __le16_to_cpu(cp->source);
3781
3782 if (source > 0x0002)
3783 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3784 MGMT_STATUS_INVALID_PARAMS);
3785
3786 hci_dev_lock(hdev);
3787
3788 hdev->devid_source = source;
3789 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3790 hdev->devid_product = __le16_to_cpu(cp->product);
3791 hdev->devid_version = __le16_to_cpu(cp->version);
3792
3793 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3794
3795 hci_req_init(&req, hdev);
3796 update_eir(&req);
3797 hci_req_run(&req, NULL);
3798
3799 hci_dev_unlock(hdev);
3800
3801 return err;
3802 }
3803
3804 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
3805 {
3806 struct cmd_lookup match = { NULL, hdev };
3807
3808 if (status) {
3809 u8 mgmt_err = mgmt_status(status);
3810
3811 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3812 cmd_status_rsp, &mgmt_err);
3813 return;
3814 }
3815
3816 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3817 &match);
3818
3819 new_settings(hdev, match.sk);
3820
3821 if (match.sk)
3822 sock_put(match.sk);
3823 }
3824
3825 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3826 u16 len)
3827 {
3828 struct mgmt_mode *cp = data;
3829 struct pending_cmd *cmd;
3830 struct hci_request req;
3831 u8 val, enabled, status;
3832 int err;
3833
3834 BT_DBG("request for %s", hdev->name);
3835
3836 status = mgmt_le_support(hdev);
3837 if (status)
3838 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3839 status);
3840
3841 if (cp->val != 0x00 && cp->val != 0x01)
3842 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3843 MGMT_STATUS_INVALID_PARAMS);
3844
3845 hci_dev_lock(hdev);
3846
3847 val = !!cp->val;
3848 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
3849
3850 /* The following conditions are ones which mean that we should
3851 * not do any HCI communication but directly send a mgmt
3852 * response to user space (after toggling the flag if
3853 * necessary).
3854 */
3855 if (!hdev_is_powered(hdev) || val == enabled ||
3856 hci_conn_num(hdev, LE_LINK) > 0) {
3857 bool changed = false;
3858
3859 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
3860 change_bit(HCI_ADVERTISING, &hdev->dev_flags);
3861 changed = true;
3862 }
3863
3864 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
3865 if (err < 0)
3866 goto unlock;
3867
3868 if (changed)
3869 err = new_settings(hdev, sk);
3870
3871 goto unlock;
3872 }
3873
3874 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
3875 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
3876 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3877 MGMT_STATUS_BUSY);
3878 goto unlock;
3879 }
3880
3881 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
3882 if (!cmd) {
3883 err = -ENOMEM;
3884 goto unlock;
3885 }
3886
3887 hci_req_init(&req, hdev);
3888
3889 if (val)
3890 enable_advertising(&req);
3891 else
3892 disable_advertising(&req);
3893
3894 err = hci_req_run(&req, set_advertising_complete);
3895 if (err < 0)
3896 mgmt_pending_remove(cmd);
3897
3898 unlock:
3899 hci_dev_unlock(hdev);
3900 return err;
3901 }
3902
3903 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
3904 void *data, u16 len)
3905 {
3906 struct mgmt_cp_set_static_address *cp = data;
3907 int err;
3908
3909 BT_DBG("%s", hdev->name);
3910
3911 if (!lmp_le_capable(hdev))
3912 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3913 MGMT_STATUS_NOT_SUPPORTED);
3914
3915 if (hdev_is_powered(hdev))
3916 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
3917 MGMT_STATUS_REJECTED);
3918
3919 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
3920 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
3921 return cmd_status(sk, hdev->id,
3922 MGMT_OP_SET_STATIC_ADDRESS,
3923 MGMT_STATUS_INVALID_PARAMS);
3924
3925 /* Two most significant bits shall be set */
3926 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
3927 return cmd_status(sk, hdev->id,
3928 MGMT_OP_SET_STATIC_ADDRESS,
3929 MGMT_STATUS_INVALID_PARAMS);
3930 }
3931
3932 hci_dev_lock(hdev);
3933
3934 bacpy(&hdev->static_addr, &cp->bdaddr);
3935
3936 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
3937
3938 hci_dev_unlock(hdev);
3939
3940 return err;
3941 }
3942
3943 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
3944 void *data, u16 len)
3945 {
3946 struct mgmt_cp_set_scan_params *cp = data;
3947 __u16 interval, window;
3948 int err;
3949
3950 BT_DBG("%s", hdev->name);
3951
3952 if (!lmp_le_capable(hdev))
3953 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3954 MGMT_STATUS_NOT_SUPPORTED);
3955
3956 interval = __le16_to_cpu(cp->interval);
3957
3958 if (interval < 0x0004 || interval > 0x4000)
3959 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3960 MGMT_STATUS_INVALID_PARAMS);
3961
3962 window = __le16_to_cpu(cp->window);
3963
3964 if (window < 0x0004 || window > 0x4000)
3965 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3966 MGMT_STATUS_INVALID_PARAMS);
3967
3968 if (window > interval)
3969 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
3970 MGMT_STATUS_INVALID_PARAMS);
3971
3972 hci_dev_lock(hdev);
3973
3974 hdev->le_scan_interval = interval;
3975 hdev->le_scan_window = window;
3976
3977 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
3978
3979 /* If background scan is running, restart it so new parameters are
3980 * loaded.
3981 */
3982 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
3983 hdev->discovery.state == DISCOVERY_STOPPED) {
3984 struct hci_request req;
3985
3986 hci_req_init(&req, hdev);
3987
3988 hci_req_add_le_scan_disable(&req);
3989 hci_req_add_le_passive_scan(&req);
3990
3991 hci_req_run(&req, NULL);
3992 }
3993
3994 hci_dev_unlock(hdev);
3995
3996 return err;
3997 }
3998
3999 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4000 {
4001 struct pending_cmd *cmd;
4002
4003 BT_DBG("status 0x%02x", status);
4004
4005 hci_dev_lock(hdev);
4006
4007 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4008 if (!cmd)
4009 goto unlock;
4010
4011 if (status) {
4012 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4013 mgmt_status(status));
4014 } else {
4015 struct mgmt_mode *cp = cmd->param;
4016
4017 if (cp->val)
4018 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4019 else
4020 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4021
4022 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4023 new_settings(hdev, cmd->sk);
4024 }
4025
4026 mgmt_pending_remove(cmd);
4027
4028 unlock:
4029 hci_dev_unlock(hdev);
4030 }
4031
4032 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4033 void *data, u16 len)
4034 {
4035 struct mgmt_mode *cp = data;
4036 struct pending_cmd *cmd;
4037 struct hci_request req;
4038 int err;
4039
4040 BT_DBG("%s", hdev->name);
4041
4042 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4043 hdev->hci_ver < BLUETOOTH_VER_1_2)
4044 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4045 MGMT_STATUS_NOT_SUPPORTED);
4046
4047 if (cp->val != 0x00 && cp->val != 0x01)
4048 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4049 MGMT_STATUS_INVALID_PARAMS);
4050
4051 if (!hdev_is_powered(hdev))
4052 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4053 MGMT_STATUS_NOT_POWERED);
4054
4055 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4056 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4057 MGMT_STATUS_REJECTED);
4058
4059 hci_dev_lock(hdev);
4060
4061 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4062 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4063 MGMT_STATUS_BUSY);
4064 goto unlock;
4065 }
4066
4067 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4068 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4069 hdev);
4070 goto unlock;
4071 }
4072
4073 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4074 data, len);
4075 if (!cmd) {
4076 err = -ENOMEM;
4077 goto unlock;
4078 }
4079
4080 hci_req_init(&req, hdev);
4081
4082 write_fast_connectable(&req, cp->val);
4083
4084 err = hci_req_run(&req, fast_connectable_complete);
4085 if (err < 0) {
4086 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4087 MGMT_STATUS_FAILED);
4088 mgmt_pending_remove(cmd);
4089 }
4090
4091 unlock:
4092 hci_dev_unlock(hdev);
4093
4094 return err;
4095 }
4096
4097 static void set_bredr_scan(struct hci_request *req)
4098 {
4099 struct hci_dev *hdev = req->hdev;
4100 u8 scan = 0;
4101
4102 /* Ensure that fast connectable is disabled. This function will
4103 * not do anything if the page scan parameters are already what
4104 * they should be.
4105 */
4106 write_fast_connectable(req, false);
4107
4108 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4109 scan |= SCAN_PAGE;
4110 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
4111 scan |= SCAN_INQUIRY;
4112
4113 if (scan)
4114 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
4115 }
4116
4117 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4118 {
4119 struct pending_cmd *cmd;
4120
4121 BT_DBG("status 0x%02x", status);
4122
4123 hci_dev_lock(hdev);
4124
4125 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4126 if (!cmd)
4127 goto unlock;
4128
4129 if (status) {
4130 u8 mgmt_err = mgmt_status(status);
4131
4132 /* We need to restore the flag if related HCI commands
4133 * failed.
4134 */
4135 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4136
4137 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4138 } else {
4139 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4140 new_settings(hdev, cmd->sk);
4141 }
4142
4143 mgmt_pending_remove(cmd);
4144
4145 unlock:
4146 hci_dev_unlock(hdev);
4147 }
4148
4149 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4150 {
4151 struct mgmt_mode *cp = data;
4152 struct pending_cmd *cmd;
4153 struct hci_request req;
4154 int err;
4155
4156 BT_DBG("request for %s", hdev->name);
4157
4158 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4159 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4160 MGMT_STATUS_NOT_SUPPORTED);
4161
4162 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4163 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4164 MGMT_STATUS_REJECTED);
4165
4166 if (cp->val != 0x00 && cp->val != 0x01)
4167 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4168 MGMT_STATUS_INVALID_PARAMS);
4169
4170 hci_dev_lock(hdev);
4171
4172 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4173 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4174 goto unlock;
4175 }
4176
4177 if (!hdev_is_powered(hdev)) {
4178 if (!cp->val) {
4179 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4180 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4181 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4182 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4183 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4184 }
4185
4186 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4187
4188 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4189 if (err < 0)
4190 goto unlock;
4191
4192 err = new_settings(hdev, sk);
4193 goto unlock;
4194 }
4195
4196 /* Reject disabling when powered on */
4197 if (!cp->val) {
4198 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4199 MGMT_STATUS_REJECTED);
4200 goto unlock;
4201 }
4202
4203 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4204 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4205 MGMT_STATUS_BUSY);
4206 goto unlock;
4207 }
4208
4209 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4210 if (!cmd) {
4211 err = -ENOMEM;
4212 goto unlock;
4213 }
4214
4215 /* We need to flip the bit already here so that update_adv_data
4216 * generates the correct flags.
4217 */
4218 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4219
4220 hci_req_init(&req, hdev);
4221
4222 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4223 set_bredr_scan(&req);
4224
4225 /* Since only the advertising data flags will change, there
4226 * is no need to update the scan response data.
4227 */
4228 update_adv_data(&req);
4229
4230 err = hci_req_run(&req, set_bredr_complete);
4231 if (err < 0)
4232 mgmt_pending_remove(cmd);
4233
4234 unlock:
4235 hci_dev_unlock(hdev);
4236 return err;
4237 }
4238
4239 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4240 void *data, u16 len)
4241 {
4242 struct mgmt_mode *cp = data;
4243 struct pending_cmd *cmd;
4244 u8 val, status;
4245 int err;
4246
4247 BT_DBG("request for %s", hdev->name);
4248
4249 status = mgmt_bredr_support(hdev);
4250 if (status)
4251 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4252 status);
4253
4254 if (!lmp_sc_capable(hdev) &&
4255 !test_bit(HCI_FORCE_SC, &hdev->dev_flags))
4256 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4257 MGMT_STATUS_NOT_SUPPORTED);
4258
4259 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4260 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4261 MGMT_STATUS_INVALID_PARAMS);
4262
4263 hci_dev_lock(hdev);
4264
4265 if (!hdev_is_powered(hdev)) {
4266 bool changed;
4267
4268 if (cp->val) {
4269 changed = !test_and_set_bit(HCI_SC_ENABLED,
4270 &hdev->dev_flags);
4271 if (cp->val == 0x02)
4272 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4273 else
4274 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4275 } else {
4276 changed = test_and_clear_bit(HCI_SC_ENABLED,
4277 &hdev->dev_flags);
4278 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4279 }
4280
4281 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4282 if (err < 0)
4283 goto failed;
4284
4285 if (changed)
4286 err = new_settings(hdev, sk);
4287
4288 goto failed;
4289 }
4290
4291 if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4292 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4293 MGMT_STATUS_BUSY);
4294 goto failed;
4295 }
4296
4297 val = !!cp->val;
4298
4299 if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4300 (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4301 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4302 goto failed;
4303 }
4304
4305 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4306 if (!cmd) {
4307 err = -ENOMEM;
4308 goto failed;
4309 }
4310
4311 err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4312 if (err < 0) {
4313 mgmt_pending_remove(cmd);
4314 goto failed;
4315 }
4316
4317 if (cp->val == 0x02)
4318 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4319 else
4320 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4321
4322 failed:
4323 hci_dev_unlock(hdev);
4324 return err;
4325 }
4326
4327 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4328 void *data, u16 len)
4329 {
4330 struct mgmt_mode *cp = data;
4331 bool changed;
4332 int err;
4333
4334 BT_DBG("request for %s", hdev->name);
4335
4336 if (cp->val != 0x00 && cp->val != 0x01)
4337 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4338 MGMT_STATUS_INVALID_PARAMS);
4339
4340 hci_dev_lock(hdev);
4341
4342 if (cp->val)
4343 changed = !test_and_set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4344 else
4345 changed = test_and_clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
4346
4347 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4348 if (err < 0)
4349 goto unlock;
4350
4351 if (changed)
4352 err = new_settings(hdev, sk);
4353
4354 unlock:
4355 hci_dev_unlock(hdev);
4356 return err;
4357 }
4358
4359 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4360 u16 len)
4361 {
4362 struct mgmt_cp_set_privacy *cp = cp_data;
4363 bool changed;
4364 int err;
4365
4366 BT_DBG("request for %s", hdev->name);
4367
4368 if (!lmp_le_capable(hdev))
4369 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4370 MGMT_STATUS_NOT_SUPPORTED);
4371
4372 if (cp->privacy != 0x00 && cp->privacy != 0x01)
4373 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4374 MGMT_STATUS_INVALID_PARAMS);
4375
4376 if (hdev_is_powered(hdev))
4377 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4378 MGMT_STATUS_REJECTED);
4379
4380 hci_dev_lock(hdev);
4381
4382 /* If user space supports this command it is also expected to
4383 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4384 */
4385 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4386
4387 if (cp->privacy) {
4388 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4389 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4390 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4391 } else {
4392 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4393 memset(hdev->irk, 0, sizeof(hdev->irk));
4394 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4395 }
4396
4397 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4398 if (err < 0)
4399 goto unlock;
4400
4401 if (changed)
4402 err = new_settings(hdev, sk);
4403
4404 unlock:
4405 hci_dev_unlock(hdev);
4406 return err;
4407 }
4408
4409 static bool irk_is_valid(struct mgmt_irk_info *irk)
4410 {
4411 switch (irk->addr.type) {
4412 case BDADDR_LE_PUBLIC:
4413 return true;
4414
4415 case BDADDR_LE_RANDOM:
4416 /* Two most significant bits shall be set */
4417 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4418 return false;
4419 return true;
4420 }
4421
4422 return false;
4423 }
4424
4425 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4426 u16 len)
4427 {
4428 struct mgmt_cp_load_irks *cp = cp_data;
4429 u16 irk_count, expected_len;
4430 int i, err;
4431
4432 BT_DBG("request for %s", hdev->name);
4433
4434 if (!lmp_le_capable(hdev))
4435 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4436 MGMT_STATUS_NOT_SUPPORTED);
4437
4438 irk_count = __le16_to_cpu(cp->irk_count);
4439
4440 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4441 if (expected_len != len) {
4442 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4443 expected_len, len);
4444 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4445 MGMT_STATUS_INVALID_PARAMS);
4446 }
4447
4448 BT_DBG("%s irk_count %u", hdev->name, irk_count);
4449
4450 for (i = 0; i < irk_count; i++) {
4451 struct mgmt_irk_info *key = &cp->irks[i];
4452
4453 if (!irk_is_valid(key))
4454 return cmd_status(sk, hdev->id,
4455 MGMT_OP_LOAD_IRKS,
4456 MGMT_STATUS_INVALID_PARAMS);
4457 }
4458
4459 hci_dev_lock(hdev);
4460
4461 hci_smp_irks_clear(hdev);
4462
4463 for (i = 0; i < irk_count; i++) {
4464 struct mgmt_irk_info *irk = &cp->irks[i];
4465 u8 addr_type;
4466
4467 if (irk->addr.type == BDADDR_LE_PUBLIC)
4468 addr_type = ADDR_LE_DEV_PUBLIC;
4469 else
4470 addr_type = ADDR_LE_DEV_RANDOM;
4471
4472 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4473 BDADDR_ANY);
4474 }
4475
4476 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4477
4478 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4479
4480 hci_dev_unlock(hdev);
4481
4482 return err;
4483 }
4484
4485 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4486 {
4487 if (key->master != 0x00 && key->master != 0x01)
4488 return false;
4489
4490 switch (key->addr.type) {
4491 case BDADDR_LE_PUBLIC:
4492 return true;
4493
4494 case BDADDR_LE_RANDOM:
4495 /* Two most significant bits shall be set */
4496 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4497 return false;
4498 return true;
4499 }
4500
4501 return false;
4502 }
4503
4504 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4505 void *cp_data, u16 len)
4506 {
4507 struct mgmt_cp_load_long_term_keys *cp = cp_data;
4508 u16 key_count, expected_len;
4509 int i, err;
4510
4511 BT_DBG("request for %s", hdev->name);
4512
4513 if (!lmp_le_capable(hdev))
4514 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4515 MGMT_STATUS_NOT_SUPPORTED);
4516
4517 key_count = __le16_to_cpu(cp->key_count);
4518
4519 expected_len = sizeof(*cp) + key_count *
4520 sizeof(struct mgmt_ltk_info);
4521 if (expected_len != len) {
4522 BT_ERR("load_keys: expected %u bytes, got %u bytes",
4523 expected_len, len);
4524 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4525 MGMT_STATUS_INVALID_PARAMS);
4526 }
4527
4528 BT_DBG("%s key_count %u", hdev->name, key_count);
4529
4530 for (i = 0; i < key_count; i++) {
4531 struct mgmt_ltk_info *key = &cp->keys[i];
4532
4533 if (!ltk_is_valid(key))
4534 return cmd_status(sk, hdev->id,
4535 MGMT_OP_LOAD_LONG_TERM_KEYS,
4536 MGMT_STATUS_INVALID_PARAMS);
4537 }
4538
4539 hci_dev_lock(hdev);
4540
4541 hci_smp_ltks_clear(hdev);
4542
4543 for (i = 0; i < key_count; i++) {
4544 struct mgmt_ltk_info *key = &cp->keys[i];
4545 u8 type, addr_type, authenticated;
4546
4547 if (key->addr.type == BDADDR_LE_PUBLIC)
4548 addr_type = ADDR_LE_DEV_PUBLIC;
4549 else
4550 addr_type = ADDR_LE_DEV_RANDOM;
4551
4552 if (key->master)
4553 type = HCI_SMP_LTK;
4554 else
4555 type = HCI_SMP_LTK_SLAVE;
4556
4557 switch (key->type) {
4558 case MGMT_LTK_UNAUTHENTICATED:
4559 authenticated = 0x00;
4560 break;
4561 case MGMT_LTK_AUTHENTICATED:
4562 authenticated = 0x01;
4563 break;
4564 default:
4565 continue;
4566 }
4567
4568 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
4569 authenticated, key->val, key->enc_size, key->ediv,
4570 key->rand);
4571 }
4572
4573 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4574 NULL, 0);
4575
4576 hci_dev_unlock(hdev);
4577
4578 return err;
4579 }
4580
4581 struct cmd_conn_lookup {
4582 struct hci_conn *conn;
4583 bool valid_tx_power;
4584 u8 mgmt_status;
4585 };
4586
4587 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
4588 {
4589 struct cmd_conn_lookup *match = data;
4590 struct mgmt_cp_get_conn_info *cp;
4591 struct mgmt_rp_get_conn_info rp;
4592 struct hci_conn *conn = cmd->user_data;
4593
4594 if (conn != match->conn)
4595 return;
4596
4597 cp = (struct mgmt_cp_get_conn_info *) cmd->param;
4598
4599 memset(&rp, 0, sizeof(rp));
4600 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4601 rp.addr.type = cp->addr.type;
4602
4603 if (!match->mgmt_status) {
4604 rp.rssi = conn->rssi;
4605
4606 if (match->valid_tx_power) {
4607 rp.tx_power = conn->tx_power;
4608 rp.max_tx_power = conn->max_tx_power;
4609 } else {
4610 rp.tx_power = HCI_TX_POWER_INVALID;
4611 rp.max_tx_power = HCI_TX_POWER_INVALID;
4612 }
4613 }
4614
4615 cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4616 match->mgmt_status, &rp, sizeof(rp));
4617
4618 hci_conn_drop(conn);
4619
4620 mgmt_pending_remove(cmd);
4621 }
4622
4623 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
4624 {
4625 struct hci_cp_read_rssi *cp;
4626 struct hci_conn *conn;
4627 struct cmd_conn_lookup match;
4628 u16 handle;
4629
4630 BT_DBG("status 0x%02x", status);
4631
4632 hci_dev_lock(hdev);
4633
4634 /* TX power data is valid in case request completed successfully,
4635 * otherwise we assume it's not valid. At the moment we assume that
4636 * either both or none of current and max values are valid to keep code
4637 * simple.
4638 */
4639 match.valid_tx_power = !status;
4640
4641 /* Commands sent in request are either Read RSSI or Read Transmit Power
4642 * Level so we check which one was last sent to retrieve connection
4643 * handle. Both commands have handle as first parameter so it's safe to
4644 * cast data on the same command struct.
4645 *
4646 * First command sent is always Read RSSI and we fail only if it fails.
4647 * In other case we simply override error to indicate success as we
4648 * already remembered if TX power value is actually valid.
4649 */
4650 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4651 if (!cp) {
4652 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4653 status = 0;
4654 }
4655
4656 if (!cp) {
4657 BT_ERR("invalid sent_cmd in response");
4658 goto unlock;
4659 }
4660
4661 handle = __le16_to_cpu(cp->handle);
4662 conn = hci_conn_hash_lookup_handle(hdev, handle);
4663 if (!conn) {
4664 BT_ERR("unknown handle (%d) in response", handle);
4665 goto unlock;
4666 }
4667
4668 match.conn = conn;
4669 match.mgmt_status = mgmt_status(status);
4670
4671 /* Cache refresh is complete, now reply for mgmt request for given
4672 * connection only.
4673 */
4674 mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
4675 get_conn_info_complete, &match);
4676
4677 unlock:
4678 hci_dev_unlock(hdev);
4679 }
4680
4681 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4682 u16 len)
4683 {
4684 struct mgmt_cp_get_conn_info *cp = data;
4685 struct mgmt_rp_get_conn_info rp;
4686 struct hci_conn *conn;
4687 unsigned long conn_info_age;
4688 int err = 0;
4689
4690 BT_DBG("%s", hdev->name);
4691
4692 memset(&rp, 0, sizeof(rp));
4693 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4694 rp.addr.type = cp->addr.type;
4695
4696 if (!bdaddr_type_is_valid(cp->addr.type))
4697 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4698 MGMT_STATUS_INVALID_PARAMS,
4699 &rp, sizeof(rp));
4700
4701 hci_dev_lock(hdev);
4702
4703 if (!hdev_is_powered(hdev)) {
4704 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4705 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
4706 goto unlock;
4707 }
4708
4709 if (cp->addr.type == BDADDR_BREDR)
4710 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4711 &cp->addr.bdaddr);
4712 else
4713 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4714
4715 if (!conn || conn->state != BT_CONNECTED) {
4716 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4717 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
4718 goto unlock;
4719 }
4720
4721 /* To avoid client trying to guess when to poll again for information we
4722 * calculate conn info age as random value between min/max set in hdev.
4723 */
4724 conn_info_age = hdev->conn_info_min_age +
4725 prandom_u32_max(hdev->conn_info_max_age -
4726 hdev->conn_info_min_age);
4727
4728 /* Query controller to refresh cached values if they are too old or were
4729 * never read.
4730 */
4731 if (time_after(jiffies, conn->conn_info_timestamp +
4732 msecs_to_jiffies(conn_info_age)) ||
4733 !conn->conn_info_timestamp) {
4734 struct hci_request req;
4735 struct hci_cp_read_tx_power req_txp_cp;
4736 struct hci_cp_read_rssi req_rssi_cp;
4737 struct pending_cmd *cmd;
4738
4739 hci_req_init(&req, hdev);
4740 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4741 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4742 &req_rssi_cp);
4743
4744 /* For LE links TX power does not change thus we don't need to
4745 * query for it once value is known.
4746 */
4747 if (!bdaddr_type_is_le(cp->addr.type) ||
4748 conn->tx_power == HCI_TX_POWER_INVALID) {
4749 req_txp_cp.handle = cpu_to_le16(conn->handle);
4750 req_txp_cp.type = 0x00;
4751 hci_req_add(&req, HCI_OP_READ_TX_POWER,
4752 sizeof(req_txp_cp), &req_txp_cp);
4753 }
4754
4755 /* Max TX power needs to be read only once per connection */
4756 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4757 req_txp_cp.handle = cpu_to_le16(conn->handle);
4758 req_txp_cp.type = 0x01;
4759 hci_req_add(&req, HCI_OP_READ_TX_POWER,
4760 sizeof(req_txp_cp), &req_txp_cp);
4761 }
4762
4763 err = hci_req_run(&req, conn_info_refresh_complete);
4764 if (err < 0)
4765 goto unlock;
4766
4767 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4768 data, len);
4769 if (!cmd) {
4770 err = -ENOMEM;
4771 goto unlock;
4772 }
4773
4774 hci_conn_hold(conn);
4775 cmd->user_data = conn;
4776
4777 conn->conn_info_timestamp = jiffies;
4778 } else {
4779 /* Cache is valid, just reply with values cached in hci_conn */
4780 rp.rssi = conn->rssi;
4781 rp.tx_power = conn->tx_power;
4782 rp.max_tx_power = conn->max_tx_power;
4783
4784 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4785 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
4786 }
4787
4788 unlock:
4789 hci_dev_unlock(hdev);
4790 return err;
4791 }
4792
4793 static const struct mgmt_handler {
4794 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
4795 u16 data_len);
4796 bool var_len;
4797 size_t data_len;
4798 } mgmt_handlers[] = {
4799 { NULL }, /* 0x0000 (no command) */
4800 { read_version, false, MGMT_READ_VERSION_SIZE },
4801 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
4802 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
4803 { read_controller_info, false, MGMT_READ_INFO_SIZE },
4804 { set_powered, false, MGMT_SETTING_SIZE },
4805 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
4806 { set_connectable, false, MGMT_SETTING_SIZE },
4807 { set_fast_connectable, false, MGMT_SETTING_SIZE },
4808 { set_pairable, false, MGMT_SETTING_SIZE },
4809 { set_link_security, false, MGMT_SETTING_SIZE },
4810 { set_ssp, false, MGMT_SETTING_SIZE },
4811 { set_hs, false, MGMT_SETTING_SIZE },
4812 { set_le, false, MGMT_SETTING_SIZE },
4813 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
4814 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
4815 { add_uuid, false, MGMT_ADD_UUID_SIZE },
4816 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
4817 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
4818 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
4819 { disconnect, false, MGMT_DISCONNECT_SIZE },
4820 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
4821 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
4822 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
4823 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
4824 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
4825 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
4826 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
4827 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
4828 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
4829 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
4830 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
4831 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
4832 { add_remote_oob_data, true, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
4833 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
4834 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
4835 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
4836 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
4837 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
4838 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
4839 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
4840 { set_advertising, false, MGMT_SETTING_SIZE },
4841 { set_bredr, false, MGMT_SETTING_SIZE },
4842 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE },
4843 { set_scan_params, false, MGMT_SET_SCAN_PARAMS_SIZE },
4844 { set_secure_conn, false, MGMT_SETTING_SIZE },
4845 { set_debug_keys, false, MGMT_SETTING_SIZE },
4846 { set_privacy, false, MGMT_SET_PRIVACY_SIZE },
4847 { load_irks, true, MGMT_LOAD_IRKS_SIZE },
4848 { get_conn_info, false, MGMT_GET_CONN_INFO_SIZE },
4849 };
4850
4851
4852 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
4853 {
4854 void *buf;
4855 u8 *cp;
4856 struct mgmt_hdr *hdr;
4857 u16 opcode, index, len;
4858 struct hci_dev *hdev = NULL;
4859 const struct mgmt_handler *handler;
4860 int err;
4861
4862 BT_DBG("got %zu bytes", msglen);
4863
4864 if (msglen < sizeof(*hdr))
4865 return -EINVAL;
4866
4867 buf = kmalloc(msglen, GFP_KERNEL);
4868 if (!buf)
4869 return -ENOMEM;
4870
4871 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
4872 err = -EFAULT;
4873 goto done;
4874 }
4875
4876 hdr = buf;
4877 opcode = __le16_to_cpu(hdr->opcode);
4878 index = __le16_to_cpu(hdr->index);
4879 len = __le16_to_cpu(hdr->len);
4880
4881 if (len != msglen - sizeof(*hdr)) {
4882 err = -EINVAL;
4883 goto done;
4884 }
4885
4886 if (index != MGMT_INDEX_NONE) {
4887 hdev = hci_dev_get(index);
4888 if (!hdev) {
4889 err = cmd_status(sk, index, opcode,
4890 MGMT_STATUS_INVALID_INDEX);
4891 goto done;
4892 }
4893
4894 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
4895 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4896 err = cmd_status(sk, index, opcode,
4897 MGMT_STATUS_INVALID_INDEX);
4898 goto done;
4899 }
4900 }
4901
4902 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
4903 mgmt_handlers[opcode].func == NULL) {
4904 BT_DBG("Unknown op %u", opcode);
4905 err = cmd_status(sk, index, opcode,
4906 MGMT_STATUS_UNKNOWN_COMMAND);
4907 goto done;
4908 }
4909
4910 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
4911 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
4912 err = cmd_status(sk, index, opcode,
4913 MGMT_STATUS_INVALID_INDEX);
4914 goto done;
4915 }
4916
4917 handler = &mgmt_handlers[opcode];
4918
4919 if ((handler->var_len && len < handler->data_len) ||
4920 (!handler->var_len && len != handler->data_len)) {
4921 err = cmd_status(sk, index, opcode,
4922 MGMT_STATUS_INVALID_PARAMS);
4923 goto done;
4924 }
4925
4926 if (hdev)
4927 mgmt_init_hdev(sk, hdev);
4928
4929 cp = buf + sizeof(*hdr);
4930
4931 err = handler->func(sk, hdev, cp, len);
4932 if (err < 0)
4933 goto done;
4934
4935 err = msglen;
4936
4937 done:
4938 if (hdev)
4939 hci_dev_put(hdev);
4940
4941 kfree(buf);
4942 return err;
4943 }
4944
4945 void mgmt_index_added(struct hci_dev *hdev)
4946 {
4947 if (hdev->dev_type != HCI_BREDR)
4948 return;
4949
4950 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
4951 }
4952
4953 void mgmt_index_removed(struct hci_dev *hdev)
4954 {
4955 u8 status = MGMT_STATUS_INVALID_INDEX;
4956
4957 if (hdev->dev_type != HCI_BREDR)
4958 return;
4959
4960 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
4961
4962 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
4963 }
4964
4965 /* This function requires the caller holds hdev->lock */
4966 static void restart_le_auto_conns(struct hci_dev *hdev)
4967 {
4968 struct hci_conn_params *p;
4969
4970 list_for_each_entry(p, &hdev->le_conn_params, list) {
4971 if (p->auto_connect == HCI_AUTO_CONN_ALWAYS)
4972 hci_pend_le_conn_add(hdev, &p->addr, p->addr_type);
4973 }
4974 }
4975
4976 static void powered_complete(struct hci_dev *hdev, u8 status)
4977 {
4978 struct cmd_lookup match = { NULL, hdev };
4979
4980 BT_DBG("status 0x%02x", status);
4981
4982 hci_dev_lock(hdev);
4983
4984 restart_le_auto_conns(hdev);
4985
4986 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
4987
4988 new_settings(hdev, match.sk);
4989
4990 hci_dev_unlock(hdev);
4991
4992 if (match.sk)
4993 sock_put(match.sk);
4994 }
4995
4996 static int powered_update_hci(struct hci_dev *hdev)
4997 {
4998 struct hci_request req;
4999 u8 link_sec;
5000
5001 hci_req_init(&req, hdev);
5002
5003 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
5004 !lmp_host_ssp_capable(hdev)) {
5005 u8 ssp = 1;
5006
5007 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
5008 }
5009
5010 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
5011 lmp_bredr_capable(hdev)) {
5012 struct hci_cp_write_le_host_supported cp;
5013
5014 cp.le = 1;
5015 cp.simul = lmp_le_br_capable(hdev);
5016
5017 /* Check first if we already have the right
5018 * host state (host features set)
5019 */
5020 if (cp.le != lmp_host_le_capable(hdev) ||
5021 cp.simul != lmp_host_le_br_capable(hdev))
5022 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
5023 sizeof(cp), &cp);
5024 }
5025
5026 if (lmp_le_capable(hdev)) {
5027 /* Make sure the controller has a good default for
5028 * advertising data. This also applies to the case
5029 * where BR/EDR was toggled during the AUTO_OFF phase.
5030 */
5031 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5032 update_adv_data(&req);
5033 update_scan_rsp_data(&req);
5034 }
5035
5036 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
5037 enable_advertising(&req);
5038 }
5039
5040 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
5041 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
5042 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
5043 sizeof(link_sec), &link_sec);
5044
5045 if (lmp_bredr_capable(hdev)) {
5046 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5047 set_bredr_scan(&req);
5048 update_class(&req);
5049 update_name(&req);
5050 update_eir(&req);
5051 }
5052
5053 return hci_req_run(&req, powered_complete);
5054 }
5055
5056 int mgmt_powered(struct hci_dev *hdev, u8 powered)
5057 {
5058 struct cmd_lookup match = { NULL, hdev };
5059 u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
5060 u8 zero_cod[] = { 0, 0, 0 };
5061 int err;
5062
5063 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
5064 return 0;
5065
5066 if (powered) {
5067 if (powered_update_hci(hdev) == 0)
5068 return 0;
5069
5070 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
5071 &match);
5072 goto new_settings;
5073 }
5074
5075 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
5076 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
5077
5078 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
5079 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
5080 zero_cod, sizeof(zero_cod), NULL);
5081
5082 new_settings:
5083 err = new_settings(hdev, match.sk);
5084
5085 if (match.sk)
5086 sock_put(match.sk);
5087
5088 return err;
5089 }
5090
5091 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
5092 {
5093 struct pending_cmd *cmd;
5094 u8 status;
5095
5096 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5097 if (!cmd)
5098 return;
5099
5100 if (err == -ERFKILL)
5101 status = MGMT_STATUS_RFKILLED;
5102 else
5103 status = MGMT_STATUS_FAILED;
5104
5105 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
5106
5107 mgmt_pending_remove(cmd);
5108 }
5109
5110 void mgmt_discoverable_timeout(struct hci_dev *hdev)
5111 {
5112 struct hci_request req;
5113
5114 hci_dev_lock(hdev);
5115
5116 /* When discoverable timeout triggers, then just make sure
5117 * the limited discoverable flag is cleared. Even in the case
5118 * of a timeout triggered from general discoverable, it is
5119 * safe to unconditionally clear the flag.
5120 */
5121 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5122 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5123
5124 hci_req_init(&req, hdev);
5125 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
5126 u8 scan = SCAN_PAGE;
5127 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
5128 sizeof(scan), &scan);
5129 }
5130 update_class(&req);
5131 update_adv_data(&req);
5132 hci_req_run(&req, NULL);
5133
5134 hdev->discov_timeout = 0;
5135
5136 new_settings(hdev, NULL);
5137
5138 hci_dev_unlock(hdev);
5139 }
5140
5141 void mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
5142 {
5143 bool changed;
5144
5145 /* Nothing needed here if there's a pending command since that
5146 * commands request completion callback takes care of everything
5147 * necessary.
5148 */
5149 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
5150 return;
5151
5152 /* Powering off may clear the scan mode - don't let that interfere */
5153 if (!discoverable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5154 return;
5155
5156 if (discoverable) {
5157 changed = !test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5158 } else {
5159 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
5160 changed = test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
5161 }
5162
5163 if (changed) {
5164 struct hci_request req;
5165
5166 /* In case this change in discoverable was triggered by
5167 * a disabling of connectable there could be a need to
5168 * update the advertising flags.
5169 */
5170 hci_req_init(&req, hdev);
5171 update_adv_data(&req);
5172 hci_req_run(&req, NULL);
5173
5174 new_settings(hdev, NULL);
5175 }
5176 }
5177
5178 void mgmt_connectable(struct hci_dev *hdev, u8 connectable)
5179 {
5180 bool changed;
5181
5182 /* Nothing needed here if there's a pending command since that
5183 * commands request completion callback takes care of everything
5184 * necessary.
5185 */
5186 if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
5187 return;
5188
5189 /* Powering off may clear the scan mode - don't let that interfere */
5190 if (!connectable && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5191 return;
5192
5193 if (connectable)
5194 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5195 else
5196 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
5197
5198 if (changed)
5199 new_settings(hdev, NULL);
5200 }
5201
5202 void mgmt_advertising(struct hci_dev *hdev, u8 advertising)
5203 {
5204 /* Powering off may stop advertising - don't let that interfere */
5205 if (!advertising && mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5206 return;
5207
5208 if (advertising)
5209 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
5210 else
5211 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
5212 }
5213
5214 void mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
5215 {
5216 u8 mgmt_err = mgmt_status(status);
5217
5218 if (scan & SCAN_PAGE)
5219 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
5220 cmd_status_rsp, &mgmt_err);
5221
5222 if (scan & SCAN_INQUIRY)
5223 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
5224 cmd_status_rsp, &mgmt_err);
5225 }
5226
5227 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
5228 bool persistent)
5229 {
5230 struct mgmt_ev_new_link_key ev;
5231
5232 memset(&ev, 0, sizeof(ev));
5233
5234 ev.store_hint = persistent;
5235 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5236 ev.key.addr.type = BDADDR_BREDR;
5237 ev.key.type = key->type;
5238 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
5239 ev.key.pin_len = key->pin_len;
5240
5241 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
5242 }
5243
5244 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
5245 {
5246 if (ltk->authenticated)
5247 return MGMT_LTK_AUTHENTICATED;
5248
5249 return MGMT_LTK_UNAUTHENTICATED;
5250 }
5251
5252 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
5253 {
5254 struct mgmt_ev_new_long_term_key ev;
5255
5256 memset(&ev, 0, sizeof(ev));
5257
5258 /* Devices using resolvable or non-resolvable random addresses
5259 * without providing an indentity resolving key don't require
5260 * to store long term keys. Their addresses will change the
5261 * next time around.
5262 *
5263 * Only when a remote device provides an identity address
5264 * make sure the long term key is stored. If the remote
5265 * identity is known, the long term keys are internally
5266 * mapped to the identity address. So allow static random
5267 * and public addresses here.
5268 */
5269 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5270 (key->bdaddr.b[5] & 0xc0) != 0xc0)
5271 ev.store_hint = 0x00;
5272 else
5273 ev.store_hint = persistent;
5274
5275 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
5276 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
5277 ev.key.type = mgmt_ltk_type(key);
5278 ev.key.enc_size = key->enc_size;
5279 ev.key.ediv = key->ediv;
5280 ev.key.rand = key->rand;
5281
5282 if (key->type == HCI_SMP_LTK)
5283 ev.key.master = 1;
5284
5285 memcpy(ev.key.val, key->val, sizeof(key->val));
5286
5287 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
5288 }
5289
5290 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
5291 {
5292 struct mgmt_ev_new_irk ev;
5293
5294 memset(&ev, 0, sizeof(ev));
5295
5296 /* For identity resolving keys from devices that are already
5297 * using a public address or static random address, do not
5298 * ask for storing this key. The identity resolving key really
5299 * is only mandatory for devices using resovlable random
5300 * addresses.
5301 *
5302 * Storing all identity resolving keys has the downside that
5303 * they will be also loaded on next boot of they system. More
5304 * identity resolving keys, means more time during scanning is
5305 * needed to actually resolve these addresses.
5306 */
5307 if (bacmp(&irk->rpa, BDADDR_ANY))
5308 ev.store_hint = 0x01;
5309 else
5310 ev.store_hint = 0x00;
5311
5312 bacpy(&ev.rpa, &irk->rpa);
5313 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
5314 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
5315 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
5316
5317 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
5318 }
5319
5320 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
5321 bool persistent)
5322 {
5323 struct mgmt_ev_new_csrk ev;
5324
5325 memset(&ev, 0, sizeof(ev));
5326
5327 /* Devices using resolvable or non-resolvable random addresses
5328 * without providing an indentity resolving key don't require
5329 * to store signature resolving keys. Their addresses will change
5330 * the next time around.
5331 *
5332 * Only when a remote device provides an identity address
5333 * make sure the signature resolving key is stored. So allow
5334 * static random and public addresses here.
5335 */
5336 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
5337 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
5338 ev.store_hint = 0x00;
5339 else
5340 ev.store_hint = persistent;
5341
5342 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
5343 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
5344 ev.key.master = csrk->master;
5345 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
5346
5347 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
5348 }
5349
5350 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
5351 u8 data_len)
5352 {
5353 eir[eir_len++] = sizeof(type) + data_len;
5354 eir[eir_len++] = type;
5355 memcpy(&eir[eir_len], data, data_len);
5356 eir_len += data_len;
5357
5358 return eir_len;
5359 }
5360
5361 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5362 u8 addr_type, u32 flags, u8 *name, u8 name_len,
5363 u8 *dev_class)
5364 {
5365 char buf[512];
5366 struct mgmt_ev_device_connected *ev = (void *) buf;
5367 u16 eir_len = 0;
5368
5369 bacpy(&ev->addr.bdaddr, bdaddr);
5370 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5371
5372 ev->flags = __cpu_to_le32(flags);
5373
5374 if (name_len > 0)
5375 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
5376 name, name_len);
5377
5378 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
5379 eir_len = eir_append_data(ev->eir, eir_len,
5380 EIR_CLASS_OF_DEV, dev_class, 3);
5381
5382 ev->eir_len = cpu_to_le16(eir_len);
5383
5384 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
5385 sizeof(*ev) + eir_len, NULL);
5386 }
5387
5388 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
5389 {
5390 struct mgmt_cp_disconnect *cp = cmd->param;
5391 struct sock **sk = data;
5392 struct mgmt_rp_disconnect rp;
5393
5394 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5395 rp.addr.type = cp->addr.type;
5396
5397 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
5398 sizeof(rp));
5399
5400 *sk = cmd->sk;
5401 sock_hold(*sk);
5402
5403 mgmt_pending_remove(cmd);
5404 }
5405
5406 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
5407 {
5408 struct hci_dev *hdev = data;
5409 struct mgmt_cp_unpair_device *cp = cmd->param;
5410 struct mgmt_rp_unpair_device rp;
5411
5412 memset(&rp, 0, sizeof(rp));
5413 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5414 rp.addr.type = cp->addr.type;
5415
5416 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
5417
5418 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
5419
5420 mgmt_pending_remove(cmd);
5421 }
5422
5423 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
5424 u8 link_type, u8 addr_type, u8 reason,
5425 bool mgmt_connected)
5426 {
5427 struct mgmt_ev_device_disconnected ev;
5428 struct pending_cmd *power_off;
5429 struct sock *sk = NULL;
5430
5431 power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5432 if (power_off) {
5433 struct mgmt_mode *cp = power_off->param;
5434
5435 /* The connection is still in hci_conn_hash so test for 1
5436 * instead of 0 to know if this is the last one.
5437 */
5438 if (!cp->val && hci_conn_count(hdev) == 1) {
5439 cancel_delayed_work(&hdev->power_off);
5440 queue_work(hdev->req_workqueue, &hdev->power_off.work);
5441 }
5442 }
5443
5444 if (!mgmt_connected)
5445 return;
5446
5447 if (link_type != ACL_LINK && link_type != LE_LINK)
5448 return;
5449
5450 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
5451
5452 bacpy(&ev.addr.bdaddr, bdaddr);
5453 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5454 ev.reason = reason;
5455
5456 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
5457
5458 if (sk)
5459 sock_put(sk);
5460
5461 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5462 hdev);
5463 }
5464
5465 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
5466 u8 link_type, u8 addr_type, u8 status)
5467 {
5468 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
5469 struct mgmt_cp_disconnect *cp;
5470 struct mgmt_rp_disconnect rp;
5471 struct pending_cmd *cmd;
5472
5473 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
5474 hdev);
5475
5476 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
5477 if (!cmd)
5478 return;
5479
5480 cp = cmd->param;
5481
5482 if (bacmp(bdaddr, &cp->addr.bdaddr))
5483 return;
5484
5485 if (cp->addr.type != bdaddr_type)
5486 return;
5487
5488 bacpy(&rp.addr.bdaddr, bdaddr);
5489 rp.addr.type = bdaddr_type;
5490
5491 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
5492 mgmt_status(status), &rp, sizeof(rp));
5493
5494 mgmt_pending_remove(cmd);
5495 }
5496
5497 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5498 u8 addr_type, u8 status)
5499 {
5500 struct mgmt_ev_connect_failed ev;
5501 struct pending_cmd *power_off;
5502
5503 power_off = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
5504 if (power_off) {
5505 struct mgmt_mode *cp = power_off->param;
5506
5507 /* The connection is still in hci_conn_hash so test for 1
5508 * instead of 0 to know if this is the last one.
5509 */
5510 if (!cp->val && hci_conn_count(hdev) == 1) {
5511 cancel_delayed_work(&hdev->power_off);
5512 queue_work(hdev->req_workqueue, &hdev->power_off.work);
5513 }
5514 }
5515
5516 bacpy(&ev.addr.bdaddr, bdaddr);
5517 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5518 ev.status = mgmt_status(status);
5519
5520 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
5521 }
5522
5523 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
5524 {
5525 struct mgmt_ev_pin_code_request ev;
5526
5527 bacpy(&ev.addr.bdaddr, bdaddr);
5528 ev.addr.type = BDADDR_BREDR;
5529 ev.secure = secure;
5530
5531 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
5532 }
5533
5534 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5535 u8 status)
5536 {
5537 struct pending_cmd *cmd;
5538 struct mgmt_rp_pin_code_reply rp;
5539
5540 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
5541 if (!cmd)
5542 return;
5543
5544 bacpy(&rp.addr.bdaddr, bdaddr);
5545 rp.addr.type = BDADDR_BREDR;
5546
5547 cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
5548 mgmt_status(status), &rp, sizeof(rp));
5549
5550 mgmt_pending_remove(cmd);
5551 }
5552
5553 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5554 u8 status)
5555 {
5556 struct pending_cmd *cmd;
5557 struct mgmt_rp_pin_code_reply rp;
5558
5559 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
5560 if (!cmd)
5561 return;
5562
5563 bacpy(&rp.addr.bdaddr, bdaddr);
5564 rp.addr.type = BDADDR_BREDR;
5565
5566 cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
5567 mgmt_status(status), &rp, sizeof(rp));
5568
5569 mgmt_pending_remove(cmd);
5570 }
5571
5572 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5573 u8 link_type, u8 addr_type, u32 value,
5574 u8 confirm_hint)
5575 {
5576 struct mgmt_ev_user_confirm_request ev;
5577
5578 BT_DBG("%s", hdev->name);
5579
5580 bacpy(&ev.addr.bdaddr, bdaddr);
5581 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5582 ev.confirm_hint = confirm_hint;
5583 ev.value = cpu_to_le32(value);
5584
5585 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
5586 NULL);
5587 }
5588
5589 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
5590 u8 link_type, u8 addr_type)
5591 {
5592 struct mgmt_ev_user_passkey_request ev;
5593
5594 BT_DBG("%s", hdev->name);
5595
5596 bacpy(&ev.addr.bdaddr, bdaddr);
5597 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5598
5599 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
5600 NULL);
5601 }
5602
5603 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5604 u8 link_type, u8 addr_type, u8 status,
5605 u8 opcode)
5606 {
5607 struct pending_cmd *cmd;
5608 struct mgmt_rp_user_confirm_reply rp;
5609 int err;
5610
5611 cmd = mgmt_pending_find(opcode, hdev);
5612 if (!cmd)
5613 return -ENOENT;
5614
5615 bacpy(&rp.addr.bdaddr, bdaddr);
5616 rp.addr.type = link_to_bdaddr(link_type, addr_type);
5617 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
5618 &rp, sizeof(rp));
5619
5620 mgmt_pending_remove(cmd);
5621
5622 return err;
5623 }
5624
5625 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5626 u8 link_type, u8 addr_type, u8 status)
5627 {
5628 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5629 status, MGMT_OP_USER_CONFIRM_REPLY);
5630 }
5631
5632 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5633 u8 link_type, u8 addr_type, u8 status)
5634 {
5635 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5636 status,
5637 MGMT_OP_USER_CONFIRM_NEG_REPLY);
5638 }
5639
5640 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5641 u8 link_type, u8 addr_type, u8 status)
5642 {
5643 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5644 status, MGMT_OP_USER_PASSKEY_REPLY);
5645 }
5646
5647 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
5648 u8 link_type, u8 addr_type, u8 status)
5649 {
5650 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
5651 status,
5652 MGMT_OP_USER_PASSKEY_NEG_REPLY);
5653 }
5654
5655 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
5656 u8 link_type, u8 addr_type, u32 passkey,
5657 u8 entered)
5658 {
5659 struct mgmt_ev_passkey_notify ev;
5660
5661 BT_DBG("%s", hdev->name);
5662
5663 bacpy(&ev.addr.bdaddr, bdaddr);
5664 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5665 ev.passkey = __cpu_to_le32(passkey);
5666 ev.entered = entered;
5667
5668 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
5669 }
5670
5671 void mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5672 u8 addr_type, u8 status)
5673 {
5674 struct mgmt_ev_auth_failed ev;
5675
5676 bacpy(&ev.addr.bdaddr, bdaddr);
5677 ev.addr.type = link_to_bdaddr(link_type, addr_type);
5678 ev.status = mgmt_status(status);
5679
5680 mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
5681 }
5682
5683 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
5684 {
5685 struct cmd_lookup match = { NULL, hdev };
5686 bool changed;
5687
5688 if (status) {
5689 u8 mgmt_err = mgmt_status(status);
5690 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
5691 cmd_status_rsp, &mgmt_err);
5692 return;
5693 }
5694
5695 if (test_bit(HCI_AUTH, &hdev->flags))
5696 changed = !test_and_set_bit(HCI_LINK_SECURITY,
5697 &hdev->dev_flags);
5698 else
5699 changed = test_and_clear_bit(HCI_LINK_SECURITY,
5700 &hdev->dev_flags);
5701
5702 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
5703 &match);
5704
5705 if (changed)
5706 new_settings(hdev, match.sk);
5707
5708 if (match.sk)
5709 sock_put(match.sk);
5710 }
5711
5712 static void clear_eir(struct hci_request *req)
5713 {
5714 struct hci_dev *hdev = req->hdev;
5715 struct hci_cp_write_eir cp;
5716
5717 if (!lmp_ext_inq_capable(hdev))
5718 return;
5719
5720 memset(hdev->eir, 0, sizeof(hdev->eir));
5721
5722 memset(&cp, 0, sizeof(cp));
5723
5724 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
5725 }
5726
5727 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5728 {
5729 struct cmd_lookup match = { NULL, hdev };
5730 struct hci_request req;
5731 bool changed = false;
5732
5733 if (status) {
5734 u8 mgmt_err = mgmt_status(status);
5735
5736 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
5737 &hdev->dev_flags)) {
5738 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5739 new_settings(hdev, NULL);
5740 }
5741
5742 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
5743 &mgmt_err);
5744 return;
5745 }
5746
5747 if (enable) {
5748 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5749 } else {
5750 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
5751 if (!changed)
5752 changed = test_and_clear_bit(HCI_HS_ENABLED,
5753 &hdev->dev_flags);
5754 else
5755 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
5756 }
5757
5758 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
5759
5760 if (changed)
5761 new_settings(hdev, match.sk);
5762
5763 if (match.sk)
5764 sock_put(match.sk);
5765
5766 hci_req_init(&req, hdev);
5767
5768 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
5769 update_eir(&req);
5770 else
5771 clear_eir(&req);
5772
5773 hci_req_run(&req, NULL);
5774 }
5775
5776 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
5777 {
5778 struct cmd_lookup match = { NULL, hdev };
5779 bool changed = false;
5780
5781 if (status) {
5782 u8 mgmt_err = mgmt_status(status);
5783
5784 if (enable) {
5785 if (test_and_clear_bit(HCI_SC_ENABLED,
5786 &hdev->dev_flags))
5787 new_settings(hdev, NULL);
5788 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5789 }
5790
5791 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5792 cmd_status_rsp, &mgmt_err);
5793 return;
5794 }
5795
5796 if (enable) {
5797 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5798 } else {
5799 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
5800 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
5801 }
5802
5803 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
5804 settings_rsp, &match);
5805
5806 if (changed)
5807 new_settings(hdev, match.sk);
5808
5809 if (match.sk)
5810 sock_put(match.sk);
5811 }
5812
5813 static void sk_lookup(struct pending_cmd *cmd, void *data)
5814 {
5815 struct cmd_lookup *match = data;
5816
5817 if (match->sk == NULL) {
5818 match->sk = cmd->sk;
5819 sock_hold(match->sk);
5820 }
5821 }
5822
5823 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
5824 u8 status)
5825 {
5826 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
5827
5828 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
5829 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
5830 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
5831
5832 if (!status)
5833 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
5834 NULL);
5835
5836 if (match.sk)
5837 sock_put(match.sk);
5838 }
5839
5840 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
5841 {
5842 struct mgmt_cp_set_local_name ev;
5843 struct pending_cmd *cmd;
5844
5845 if (status)
5846 return;
5847
5848 memset(&ev, 0, sizeof(ev));
5849 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
5850 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
5851
5852 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
5853 if (!cmd) {
5854 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
5855
5856 /* If this is a HCI command related to powering on the
5857 * HCI dev don't send any mgmt signals.
5858 */
5859 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
5860 return;
5861 }
5862
5863 mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
5864 cmd ? cmd->sk : NULL);
5865 }
5866
5867 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
5868 u8 *randomizer192, u8 *hash256,
5869 u8 *randomizer256, u8 status)
5870 {
5871 struct pending_cmd *cmd;
5872
5873 BT_DBG("%s status %u", hdev->name, status);
5874
5875 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
5876 if (!cmd)
5877 return;
5878
5879 if (status) {
5880 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
5881 mgmt_status(status));
5882 } else {
5883 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
5884 hash256 && randomizer256) {
5885 struct mgmt_rp_read_local_oob_ext_data rp;
5886
5887 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
5888 memcpy(rp.randomizer192, randomizer192,
5889 sizeof(rp.randomizer192));
5890
5891 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
5892 memcpy(rp.randomizer256, randomizer256,
5893 sizeof(rp.randomizer256));
5894
5895 cmd_complete(cmd->sk, hdev->id,
5896 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5897 &rp, sizeof(rp));
5898 } else {
5899 struct mgmt_rp_read_local_oob_data rp;
5900
5901 memcpy(rp.hash, hash192, sizeof(rp.hash));
5902 memcpy(rp.randomizer, randomizer192,
5903 sizeof(rp.randomizer));
5904
5905 cmd_complete(cmd->sk, hdev->id,
5906 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
5907 &rp, sizeof(rp));
5908 }
5909 }
5910
5911 mgmt_pending_remove(cmd);
5912 }
5913
5914 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5915 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
5916 u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
5917 u8 scan_rsp_len)
5918 {
5919 char buf[512];
5920 struct mgmt_ev_device_found *ev = (void *) buf;
5921 struct smp_irk *irk;
5922 size_t ev_size;
5923
5924 if (!hci_discovery_active(hdev))
5925 return;
5926
5927 /* Make sure that the buffer is big enough. The 5 extra bytes
5928 * are for the potential CoD field.
5929 */
5930 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
5931 return;
5932
5933 memset(buf, 0, sizeof(buf));
5934
5935 irk = hci_get_irk(hdev, bdaddr, addr_type);
5936 if (irk) {
5937 bacpy(&ev->addr.bdaddr, &irk->bdaddr);
5938 ev->addr.type = link_to_bdaddr(link_type, irk->addr_type);
5939 } else {
5940 bacpy(&ev->addr.bdaddr, bdaddr);
5941 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5942 }
5943
5944 ev->rssi = rssi;
5945 if (cfm_name)
5946 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
5947 if (!ssp)
5948 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
5949
5950 if (eir_len > 0)
5951 memcpy(ev->eir, eir, eir_len);
5952
5953 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
5954 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
5955 dev_class, 3);
5956
5957 if (scan_rsp_len > 0)
5958 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
5959
5960 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
5961 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
5962
5963 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
5964 }
5965
5966 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
5967 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
5968 {
5969 struct mgmt_ev_device_found *ev;
5970 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
5971 u16 eir_len;
5972
5973 ev = (struct mgmt_ev_device_found *) buf;
5974
5975 memset(buf, 0, sizeof(buf));
5976
5977 bacpy(&ev->addr.bdaddr, bdaddr);
5978 ev->addr.type = link_to_bdaddr(link_type, addr_type);
5979 ev->rssi = rssi;
5980
5981 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
5982 name_len);
5983
5984 ev->eir_len = cpu_to_le16(eir_len);
5985
5986 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
5987 }
5988
5989 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
5990 {
5991 struct mgmt_ev_discovering ev;
5992 struct pending_cmd *cmd;
5993
5994 BT_DBG("%s discovering %u", hdev->name, discovering);
5995
5996 if (discovering)
5997 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
5998 else
5999 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
6000
6001 if (cmd != NULL) {
6002 u8 type = hdev->discovery.type;
6003
6004 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
6005 sizeof(type));
6006 mgmt_pending_remove(cmd);
6007 }
6008
6009 memset(&ev, 0, sizeof(ev));
6010 ev.type = hdev->discovery.type;
6011 ev.discovering = discovering;
6012
6013 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
6014 }
6015
6016 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6017 {
6018 struct pending_cmd *cmd;
6019 struct mgmt_ev_device_blocked ev;
6020
6021 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
6022
6023 bacpy(&ev.addr.bdaddr, bdaddr);
6024 ev.addr.type = type;
6025
6026 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
6027 cmd ? cmd->sk : NULL);
6028 }
6029
6030 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
6031 {
6032 struct pending_cmd *cmd;
6033 struct mgmt_ev_device_unblocked ev;
6034
6035 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
6036
6037 bacpy(&ev.addr.bdaddr, bdaddr);
6038 ev.addr.type = type;
6039
6040 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
6041 cmd ? cmd->sk : NULL);
6042 }
6043
6044 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
6045 {
6046 BT_DBG("%s status %u", hdev->name, status);
6047
6048 /* Clear the advertising mgmt setting if we failed to re-enable it */
6049 if (status) {
6050 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6051 new_settings(hdev, NULL);
6052 }
6053 }
6054
6055 void mgmt_reenable_advertising(struct hci_dev *hdev)
6056 {
6057 struct hci_request req;
6058
6059 if (hci_conn_num(hdev, LE_LINK) > 0)
6060 return;
6061
6062 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6063 return;
6064
6065 hci_req_init(&req, hdev);
6066 enable_advertising(&req);
6067
6068 /* If this fails we have no option but to let user space know
6069 * that we've disabled advertising.
6070 */
6071 if (hci_req_run(&req, adv_enable_complete) < 0) {
6072 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
6073 new_settings(hdev, NULL);
6074 }
6075 }
ubuntu-zesty-kernel mirror