]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/mgmt.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
libnvdimm/bus: Prepare the nd_ioctl() path to be re-entrant
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 14
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 };
110
111 static const u16 mgmt_events[] = {
112 MGMT_EV_CONTROLLER_ERROR,
113 MGMT_EV_INDEX_ADDED,
114 MGMT_EV_INDEX_REMOVED,
115 MGMT_EV_NEW_SETTINGS,
116 MGMT_EV_CLASS_OF_DEV_CHANGED,
117 MGMT_EV_LOCAL_NAME_CHANGED,
118 MGMT_EV_NEW_LINK_KEY,
119 MGMT_EV_NEW_LONG_TERM_KEY,
120 MGMT_EV_DEVICE_CONNECTED,
121 MGMT_EV_DEVICE_DISCONNECTED,
122 MGMT_EV_CONNECT_FAILED,
123 MGMT_EV_PIN_CODE_REQUEST,
124 MGMT_EV_USER_CONFIRM_REQUEST,
125 MGMT_EV_USER_PASSKEY_REQUEST,
126 MGMT_EV_AUTH_FAILED,
127 MGMT_EV_DEVICE_FOUND,
128 MGMT_EV_DISCOVERING,
129 MGMT_EV_DEVICE_BLOCKED,
130 MGMT_EV_DEVICE_UNBLOCKED,
131 MGMT_EV_DEVICE_UNPAIRED,
132 MGMT_EV_PASSKEY_NOTIFY,
133 MGMT_EV_NEW_IRK,
134 MGMT_EV_NEW_CSRK,
135 MGMT_EV_DEVICE_ADDED,
136 MGMT_EV_DEVICE_REMOVED,
137 MGMT_EV_NEW_CONN_PARAM,
138 MGMT_EV_UNCONF_INDEX_ADDED,
139 MGMT_EV_UNCONF_INDEX_REMOVED,
140 MGMT_EV_NEW_CONFIG_OPTIONS,
141 MGMT_EV_EXT_INDEX_ADDED,
142 MGMT_EV_EXT_INDEX_REMOVED,
143 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
144 MGMT_EV_ADVERTISING_ADDED,
145 MGMT_EV_ADVERTISING_REMOVED,
146 MGMT_EV_EXT_INFO_CHANGED,
147 };
148
149 static const u16 mgmt_untrusted_commands[] = {
150 MGMT_OP_READ_INDEX_LIST,
151 MGMT_OP_READ_INFO,
152 MGMT_OP_READ_UNCONF_INDEX_LIST,
153 MGMT_OP_READ_CONFIG_INFO,
154 MGMT_OP_READ_EXT_INDEX_LIST,
155 MGMT_OP_READ_EXT_INFO,
156 };
157
158 static const u16 mgmt_untrusted_events[] = {
159 MGMT_EV_INDEX_ADDED,
160 MGMT_EV_INDEX_REMOVED,
161 MGMT_EV_NEW_SETTINGS,
162 MGMT_EV_CLASS_OF_DEV_CHANGED,
163 MGMT_EV_LOCAL_NAME_CHANGED,
164 MGMT_EV_UNCONF_INDEX_ADDED,
165 MGMT_EV_UNCONF_INDEX_REMOVED,
166 MGMT_EV_NEW_CONFIG_OPTIONS,
167 MGMT_EV_EXT_INDEX_ADDED,
168 MGMT_EV_EXT_INDEX_REMOVED,
169 MGMT_EV_EXT_INFO_CHANGED,
170 };
171
172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
173
174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
175 "\x00\x00\x00\x00\x00\x00\x00\x00"
176
177 /* HCI to MGMT error code conversion table */
178 static u8 mgmt_status_table[] = {
179 MGMT_STATUS_SUCCESS,
180 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
181 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
182 MGMT_STATUS_FAILED, /* Hardware Failure */
183 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
184 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
185 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
186 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
187 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
188 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
189 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
190 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
191 MGMT_STATUS_BUSY, /* Command Disallowed */
192 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
193 MGMT_STATUS_REJECTED, /* Rejected Security */
194 MGMT_STATUS_REJECTED, /* Rejected Personal */
195 MGMT_STATUS_TIMEOUT, /* Host Timeout */
196 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
197 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
198 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
199 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
200 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
201 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
202 MGMT_STATUS_BUSY, /* Repeated Attempts */
203 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
204 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
205 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
206 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
207 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
208 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
209 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
210 MGMT_STATUS_FAILED, /* Unspecified Error */
211 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
212 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
213 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
214 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
215 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
216 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
217 MGMT_STATUS_FAILED, /* Unit Link Key Used */
218 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
219 MGMT_STATUS_TIMEOUT, /* Instant Passed */
220 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
221 MGMT_STATUS_FAILED, /* Transaction Collision */
222 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
223 MGMT_STATUS_REJECTED, /* QoS Rejected */
224 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
225 MGMT_STATUS_REJECTED, /* Insufficient Security */
226 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
227 MGMT_STATUS_BUSY, /* Role Switch Pending */
228 MGMT_STATUS_FAILED, /* Slot Violation */
229 MGMT_STATUS_FAILED, /* Role Switch Failed */
230 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
231 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
232 MGMT_STATUS_BUSY, /* Host Busy Pairing */
233 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
234 MGMT_STATUS_BUSY, /* Controller Busy */
235 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
236 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
237 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
238 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
239 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
240 };
241
242 static u8 mgmt_status(u8 hci_status)
243 {
244 if (hci_status < ARRAY_SIZE(mgmt_status_table))
245 return mgmt_status_table[hci_status];
246
247 return MGMT_STATUS_FAILED;
248 }
249
250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag)
252 {
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, NULL);
255 }
256
257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, int flag, struct sock *skip_sk)
259 {
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 flag, skip_sk);
262 }
263
264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266 {
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
268 HCI_SOCK_TRUSTED, skip_sk);
269 }
270
271 static u8 le_addr_type(u8 mgmt_addr_type)
272 {
273 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
274 return ADDR_LE_DEV_PUBLIC;
275 else
276 return ADDR_LE_DEV_RANDOM;
277 }
278
279 void mgmt_fill_version_info(void *ver)
280 {
281 struct mgmt_rp_read_version *rp = ver;
282
283 rp->version = MGMT_VERSION;
284 rp->revision = cpu_to_le16(MGMT_REVISION);
285 }
286
287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
288 u16 data_len)
289 {
290 struct mgmt_rp_read_version rp;
291
292 BT_DBG("sock %p", sk);
293
294 mgmt_fill_version_info(&rp);
295
296 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
297 &rp, sizeof(rp));
298 }
299
300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
301 u16 data_len)
302 {
303 struct mgmt_rp_read_commands *rp;
304 u16 num_commands, num_events;
305 size_t rp_size;
306 int i, err;
307
308 BT_DBG("sock %p", sk);
309
310 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
311 num_commands = ARRAY_SIZE(mgmt_commands);
312 num_events = ARRAY_SIZE(mgmt_events);
313 } else {
314 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
315 num_events = ARRAY_SIZE(mgmt_untrusted_events);
316 }
317
318 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
319
320 rp = kmalloc(rp_size, GFP_KERNEL);
321 if (!rp)
322 return -ENOMEM;
323
324 rp->num_commands = cpu_to_le16(num_commands);
325 rp->num_events = cpu_to_le16(num_events);
326
327 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
328 __le16 *opcode = rp->opcodes;
329
330 for (i = 0; i < num_commands; i++, opcode++)
331 put_unaligned_le16(mgmt_commands[i], opcode);
332
333 for (i = 0; i < num_events; i++, opcode++)
334 put_unaligned_le16(mgmt_events[i], opcode);
335 } else {
336 __le16 *opcode = rp->opcodes;
337
338 for (i = 0; i < num_commands; i++, opcode++)
339 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
340
341 for (i = 0; i < num_events; i++, opcode++)
342 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
343 }
344
345 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
346 rp, rp_size);
347 kfree(rp);
348
349 return err;
350 }
351
352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
353 u16 data_len)
354 {
355 struct mgmt_rp_read_index_list *rp;
356 struct hci_dev *d;
357 size_t rp_len;
358 u16 count;
359 int err;
360
361 BT_DBG("sock %p", sk);
362
363 read_lock(&hci_dev_list_lock);
364
365 count = 0;
366 list_for_each_entry(d, &hci_dev_list, list) {
367 if (d->dev_type == HCI_PRIMARY &&
368 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
369 count++;
370 }
371
372 rp_len = sizeof(*rp) + (2 * count);
373 rp = kmalloc(rp_len, GFP_ATOMIC);
374 if (!rp) {
375 read_unlock(&hci_dev_list_lock);
376 return -ENOMEM;
377 }
378
379 count = 0;
380 list_for_each_entry(d, &hci_dev_list, list) {
381 if (hci_dev_test_flag(d, HCI_SETUP) ||
382 hci_dev_test_flag(d, HCI_CONFIG) ||
383 hci_dev_test_flag(d, HCI_USER_CHANNEL))
384 continue;
385
386 /* Devices marked as raw-only are neither configured
387 * nor unconfigured controllers.
388 */
389 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
390 continue;
391
392 if (d->dev_type == HCI_PRIMARY &&
393 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
394 rp->index[count++] = cpu_to_le16(d->id);
395 BT_DBG("Added hci%u", d->id);
396 }
397 }
398
399 rp->num_controllers = cpu_to_le16(count);
400 rp_len = sizeof(*rp) + (2 * count);
401
402 read_unlock(&hci_dev_list_lock);
403
404 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
405 0, rp, rp_len);
406
407 kfree(rp);
408
409 return err;
410 }
411
412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
413 void *data, u16 data_len)
414 {
415 struct mgmt_rp_read_unconf_index_list *rp;
416 struct hci_dev *d;
417 size_t rp_len;
418 u16 count;
419 int err;
420
421 BT_DBG("sock %p", sk);
422
423 read_lock(&hci_dev_list_lock);
424
425 count = 0;
426 list_for_each_entry(d, &hci_dev_list, list) {
427 if (d->dev_type == HCI_PRIMARY &&
428 hci_dev_test_flag(d, HCI_UNCONFIGURED))
429 count++;
430 }
431
432 rp_len = sizeof(*rp) + (2 * count);
433 rp = kmalloc(rp_len, GFP_ATOMIC);
434 if (!rp) {
435 read_unlock(&hci_dev_list_lock);
436 return -ENOMEM;
437 }
438
439 count = 0;
440 list_for_each_entry(d, &hci_dev_list, list) {
441 if (hci_dev_test_flag(d, HCI_SETUP) ||
442 hci_dev_test_flag(d, HCI_CONFIG) ||
443 hci_dev_test_flag(d, HCI_USER_CHANNEL))
444 continue;
445
446 /* Devices marked as raw-only are neither configured
447 * nor unconfigured controllers.
448 */
449 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
450 continue;
451
452 if (d->dev_type == HCI_PRIMARY &&
453 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
454 rp->index[count++] = cpu_to_le16(d->id);
455 BT_DBG("Added hci%u", d->id);
456 }
457 }
458
459 rp->num_controllers = cpu_to_le16(count);
460 rp_len = sizeof(*rp) + (2 * count);
461
462 read_unlock(&hci_dev_list_lock);
463
464 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
465 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
466
467 kfree(rp);
468
469 return err;
470 }
471
472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
473 void *data, u16 data_len)
474 {
475 struct mgmt_rp_read_ext_index_list *rp;
476 struct hci_dev *d;
477 size_t rp_len;
478 u16 count;
479 int err;
480
481 BT_DBG("sock %p", sk);
482
483 read_lock(&hci_dev_list_lock);
484
485 count = 0;
486 list_for_each_entry(d, &hci_dev_list, list) {
487 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
488 count++;
489 }
490
491 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
492 rp = kmalloc(rp_len, GFP_ATOMIC);
493 if (!rp) {
494 read_unlock(&hci_dev_list_lock);
495 return -ENOMEM;
496 }
497
498 count = 0;
499 list_for_each_entry(d, &hci_dev_list, list) {
500 if (hci_dev_test_flag(d, HCI_SETUP) ||
501 hci_dev_test_flag(d, HCI_CONFIG) ||
502 hci_dev_test_flag(d, HCI_USER_CHANNEL))
503 continue;
504
505 /* Devices marked as raw-only are neither configured
506 * nor unconfigured controllers.
507 */
508 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
509 continue;
510
511 if (d->dev_type == HCI_PRIMARY) {
512 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
513 rp->entry[count].type = 0x01;
514 else
515 rp->entry[count].type = 0x00;
516 } else if (d->dev_type == HCI_AMP) {
517 rp->entry[count].type = 0x02;
518 } else {
519 continue;
520 }
521
522 rp->entry[count].bus = d->bus;
523 rp->entry[count++].index = cpu_to_le16(d->id);
524 BT_DBG("Added hci%u", d->id);
525 }
526
527 rp->num_controllers = cpu_to_le16(count);
528 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
529
530 read_unlock(&hci_dev_list_lock);
531
532 /* If this command is called at least once, then all the
533 * default index and unconfigured index events are disabled
534 * and from now on only extended index events are used.
535 */
536 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
537 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
538 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
539
540 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
541 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
542
543 kfree(rp);
544
545 return err;
546 }
547
548 static bool is_configured(struct hci_dev *hdev)
549 {
550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
552 return false;
553
554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 return false;
557
558 return true;
559 }
560
561 static __le32 get_missing_options(struct hci_dev *hdev)
562 {
563 u32 options = 0;
564
565 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
566 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
567 options |= MGMT_OPTION_EXTERNAL_CONFIG;
568
569 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
570 !bacmp(&hdev->public_addr, BDADDR_ANY))
571 options |= MGMT_OPTION_PUBLIC_ADDRESS;
572
573 return cpu_to_le32(options);
574 }
575
576 static int new_options(struct hci_dev *hdev, struct sock *skip)
577 {
578 __le32 options = get_missing_options(hdev);
579
580 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
581 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
582 }
583
584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
585 {
586 __le32 options = get_missing_options(hdev);
587
588 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
589 sizeof(options));
590 }
591
592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
593 void *data, u16 data_len)
594 {
595 struct mgmt_rp_read_config_info rp;
596 u32 options = 0;
597
598 BT_DBG("sock %p %s", sk, hdev->name);
599
600 hci_dev_lock(hdev);
601
602 memset(&rp, 0, sizeof(rp));
603 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
604
605 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
606 options |= MGMT_OPTION_EXTERNAL_CONFIG;
607
608 if (hdev->set_bdaddr)
609 options |= MGMT_OPTION_PUBLIC_ADDRESS;
610
611 rp.supported_options = cpu_to_le32(options);
612 rp.missing_options = get_missing_options(hdev);
613
614 hci_dev_unlock(hdev);
615
616 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
617 &rp, sizeof(rp));
618 }
619
620 static u32 get_supported_settings(struct hci_dev *hdev)
621 {
622 u32 settings = 0;
623
624 settings |= MGMT_SETTING_POWERED;
625 settings |= MGMT_SETTING_BONDABLE;
626 settings |= MGMT_SETTING_DEBUG_KEYS;
627 settings |= MGMT_SETTING_CONNECTABLE;
628 settings |= MGMT_SETTING_DISCOVERABLE;
629
630 if (lmp_bredr_capable(hdev)) {
631 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
632 settings |= MGMT_SETTING_FAST_CONNECTABLE;
633 settings |= MGMT_SETTING_BREDR;
634 settings |= MGMT_SETTING_LINK_SECURITY;
635
636 if (lmp_ssp_capable(hdev)) {
637 settings |= MGMT_SETTING_SSP;
638 settings |= MGMT_SETTING_HS;
639 }
640
641 if (lmp_sc_capable(hdev))
642 settings |= MGMT_SETTING_SECURE_CONN;
643 }
644
645 if (lmp_le_capable(hdev)) {
646 settings |= MGMT_SETTING_LE;
647 settings |= MGMT_SETTING_ADVERTISING;
648 settings |= MGMT_SETTING_SECURE_CONN;
649 settings |= MGMT_SETTING_PRIVACY;
650 settings |= MGMT_SETTING_STATIC_ADDRESS;
651 }
652
653 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
654 hdev->set_bdaddr)
655 settings |= MGMT_SETTING_CONFIGURATION;
656
657 return settings;
658 }
659
660 static u32 get_current_settings(struct hci_dev *hdev)
661 {
662 u32 settings = 0;
663
664 if (hdev_is_powered(hdev))
665 settings |= MGMT_SETTING_POWERED;
666
667 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
668 settings |= MGMT_SETTING_CONNECTABLE;
669
670 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
671 settings |= MGMT_SETTING_FAST_CONNECTABLE;
672
673 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
674 settings |= MGMT_SETTING_DISCOVERABLE;
675
676 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
677 settings |= MGMT_SETTING_BONDABLE;
678
679 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
680 settings |= MGMT_SETTING_BREDR;
681
682 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
683 settings |= MGMT_SETTING_LE;
684
685 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
686 settings |= MGMT_SETTING_LINK_SECURITY;
687
688 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
689 settings |= MGMT_SETTING_SSP;
690
691 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
692 settings |= MGMT_SETTING_HS;
693
694 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
695 settings |= MGMT_SETTING_ADVERTISING;
696
697 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
698 settings |= MGMT_SETTING_SECURE_CONN;
699
700 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
701 settings |= MGMT_SETTING_DEBUG_KEYS;
702
703 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
704 settings |= MGMT_SETTING_PRIVACY;
705
706 /* The current setting for static address has two purposes. The
707 * first is to indicate if the static address will be used and
708 * the second is to indicate if it is actually set.
709 *
710 * This means if the static address is not configured, this flag
711 * will never be set. If the address is configured, then if the
712 * address is actually used decides if the flag is set or not.
713 *
714 * For single mode LE only controllers and dual-mode controllers
715 * with BR/EDR disabled, the existence of the static address will
716 * be evaluated.
717 */
718 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
719 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
720 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
721 if (bacmp(&hdev->static_addr, BDADDR_ANY))
722 settings |= MGMT_SETTING_STATIC_ADDRESS;
723 }
724
725 return settings;
726 }
727
728 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
729 {
730 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
731 }
732
733 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
734 struct hci_dev *hdev,
735 const void *data)
736 {
737 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
738 }
739
740 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
741 {
742 struct mgmt_pending_cmd *cmd;
743
744 /* If there's a pending mgmt command the flags will not yet have
745 * their final values, so check for this first.
746 */
747 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
748 if (cmd) {
749 struct mgmt_mode *cp = cmd->param;
750 if (cp->val == 0x01)
751 return LE_AD_GENERAL;
752 else if (cp->val == 0x02)
753 return LE_AD_LIMITED;
754 } else {
755 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
756 return LE_AD_LIMITED;
757 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
758 return LE_AD_GENERAL;
759 }
760
761 return 0;
762 }
763
764 bool mgmt_get_connectable(struct hci_dev *hdev)
765 {
766 struct mgmt_pending_cmd *cmd;
767
768 /* If there's a pending mgmt command the flag will not yet have
769 * it's final value, so check for this first.
770 */
771 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
772 if (cmd) {
773 struct mgmt_mode *cp = cmd->param;
774
775 return cp->val;
776 }
777
778 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
779 }
780
781 static void service_cache_off(struct work_struct *work)
782 {
783 struct hci_dev *hdev = container_of(work, struct hci_dev,
784 service_cache.work);
785 struct hci_request req;
786
787 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
788 return;
789
790 hci_req_init(&req, hdev);
791
792 hci_dev_lock(hdev);
793
794 __hci_req_update_eir(&req);
795 __hci_req_update_class(&req);
796
797 hci_dev_unlock(hdev);
798
799 hci_req_run(&req, NULL);
800 }
801
802 static void rpa_expired(struct work_struct *work)
803 {
804 struct hci_dev *hdev = container_of(work, struct hci_dev,
805 rpa_expired.work);
806 struct hci_request req;
807
808 BT_DBG("");
809
810 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
811
812 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
813 return;
814
815 /* The generation of a new RPA and programming it into the
816 * controller happens in the hci_req_enable_advertising()
817 * function.
818 */
819 hci_req_init(&req, hdev);
820 __hci_req_enable_advertising(&req);
821 hci_req_run(&req, NULL);
822 }
823
824 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
825 {
826 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
827 return;
828
829 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
830 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
831
832 /* Non-mgmt controlled devices get this bit set
833 * implicitly so that pairing works for them, however
834 * for mgmt we require user-space to explicitly enable
835 * it
836 */
837 hci_dev_clear_flag(hdev, HCI_BONDABLE);
838 }
839
840 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
841 void *data, u16 data_len)
842 {
843 struct mgmt_rp_read_info rp;
844
845 BT_DBG("sock %p %s", sk, hdev->name);
846
847 hci_dev_lock(hdev);
848
849 memset(&rp, 0, sizeof(rp));
850
851 bacpy(&rp.bdaddr, &hdev->bdaddr);
852
853 rp.version = hdev->hci_ver;
854 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
855
856 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
857 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
858
859 memcpy(rp.dev_class, hdev->dev_class, 3);
860
861 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
862 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
863
864 hci_dev_unlock(hdev);
865
866 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
867 sizeof(rp));
868 }
869
870 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
871 {
872 u16 eir_len = 0;
873 size_t name_len;
874
875 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
876 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
877 hdev->dev_class, 3);
878
879 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
880 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
881 hdev->appearance);
882
883 name_len = strlen(hdev->dev_name);
884 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
885 hdev->dev_name, name_len);
886
887 name_len = strlen(hdev->short_name);
888 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
889 hdev->short_name, name_len);
890
891 return eir_len;
892 }
893
894 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
895 void *data, u16 data_len)
896 {
897 char buf[512];
898 struct mgmt_rp_read_ext_info *rp = (void *)buf;
899 u16 eir_len;
900
901 BT_DBG("sock %p %s", sk, hdev->name);
902
903 memset(&buf, 0, sizeof(buf));
904
905 hci_dev_lock(hdev);
906
907 bacpy(&rp->bdaddr, &hdev->bdaddr);
908
909 rp->version = hdev->hci_ver;
910 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
911
912 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
913 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
914
915
916 eir_len = append_eir_data_to_buf(hdev, rp->eir);
917 rp->eir_len = cpu_to_le16(eir_len);
918
919 hci_dev_unlock(hdev);
920
921 /* If this command is called at least once, then the events
922 * for class of device and local name changes are disabled
923 * and only the new extended controller information event
924 * is used.
925 */
926 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
927 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
928 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
929
930 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
931 sizeof(*rp) + eir_len);
932 }
933
934 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
935 {
936 char buf[512];
937 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
938 u16 eir_len;
939
940 memset(buf, 0, sizeof(buf));
941
942 eir_len = append_eir_data_to_buf(hdev, ev->eir);
943 ev->eir_len = cpu_to_le16(eir_len);
944
945 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
946 sizeof(*ev) + eir_len,
947 HCI_MGMT_EXT_INFO_EVENTS, skip);
948 }
949
950 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
951 {
952 __le32 settings = cpu_to_le32(get_current_settings(hdev));
953
954 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
955 sizeof(settings));
956 }
957
958 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
959 {
960 BT_DBG("%s status 0x%02x", hdev->name, status);
961
962 if (hci_conn_count(hdev) == 0) {
963 cancel_delayed_work(&hdev->power_off);
964 queue_work(hdev->req_workqueue, &hdev->power_off.work);
965 }
966 }
967
968 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
969 {
970 struct mgmt_ev_advertising_added ev;
971
972 ev.instance = instance;
973
974 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
975 }
976
977 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
978 u8 instance)
979 {
980 struct mgmt_ev_advertising_removed ev;
981
982 ev.instance = instance;
983
984 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
985 }
986
987 static void cancel_adv_timeout(struct hci_dev *hdev)
988 {
989 if (hdev->adv_instance_timeout) {
990 hdev->adv_instance_timeout = 0;
991 cancel_delayed_work(&hdev->adv_instance_expire);
992 }
993 }
994
995 static int clean_up_hci_state(struct hci_dev *hdev)
996 {
997 struct hci_request req;
998 struct hci_conn *conn;
999 bool discov_stopped;
1000 int err;
1001
1002 hci_req_init(&req, hdev);
1003
1004 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1005 test_bit(HCI_PSCAN, &hdev->flags)) {
1006 u8 scan = 0x00;
1007 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008 }
1009
1010 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1011
1012 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1013 __hci_req_disable_advertising(&req);
1014
1015 discov_stopped = hci_req_stop_discovery(&req);
1016
1017 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1018 /* 0x15 == Terminated due to Power Off */
1019 __hci_abort_conn(&req, conn, 0x15);
1020 }
1021
1022 err = hci_req_run(&req, clean_up_hci_complete);
1023 if (!err && discov_stopped)
1024 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1025
1026 return err;
1027 }
1028
1029 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1030 u16 len)
1031 {
1032 struct mgmt_mode *cp = data;
1033 struct mgmt_pending_cmd *cmd;
1034 int err;
1035
1036 BT_DBG("request for %s", hdev->name);
1037
1038 if (cp->val != 0x00 && cp->val != 0x01)
1039 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1040 MGMT_STATUS_INVALID_PARAMS);
1041
1042 hci_dev_lock(hdev);
1043
1044 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1045 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1046 MGMT_STATUS_BUSY);
1047 goto failed;
1048 }
1049
1050 if (!!cp->val == hdev_is_powered(hdev)) {
1051 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1052 goto failed;
1053 }
1054
1055 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1056 if (!cmd) {
1057 err = -ENOMEM;
1058 goto failed;
1059 }
1060
1061 if (cp->val) {
1062 queue_work(hdev->req_workqueue, &hdev->power_on);
1063 err = 0;
1064 } else {
1065 /* Disconnect connections, stop scans, etc */
1066 err = clean_up_hci_state(hdev);
1067 if (!err)
1068 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1069 HCI_POWER_OFF_TIMEOUT);
1070
1071 /* ENODATA means there were no HCI commands queued */
1072 if (err == -ENODATA) {
1073 cancel_delayed_work(&hdev->power_off);
1074 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1075 err = 0;
1076 }
1077 }
1078
1079 failed:
1080 hci_dev_unlock(hdev);
1081 return err;
1082 }
1083
1084 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1085 {
1086 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1087
1088 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1089 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1090 }
1091
1092 int mgmt_new_settings(struct hci_dev *hdev)
1093 {
1094 return new_settings(hdev, NULL);
1095 }
1096
1097 struct cmd_lookup {
1098 struct sock *sk;
1099 struct hci_dev *hdev;
1100 u8 mgmt_status;
1101 };
1102
1103 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1104 {
1105 struct cmd_lookup *match = data;
1106
1107 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1108
1109 list_del(&cmd->list);
1110
1111 if (match->sk == NULL) {
1112 match->sk = cmd->sk;
1113 sock_hold(match->sk);
1114 }
1115
1116 mgmt_pending_free(cmd);
1117 }
1118
1119 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1120 {
1121 u8 *status = data;
1122
1123 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1124 mgmt_pending_remove(cmd);
1125 }
1126
1127 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1128 {
1129 if (cmd->cmd_complete) {
1130 u8 *status = data;
1131
1132 cmd->cmd_complete(cmd, *status);
1133 mgmt_pending_remove(cmd);
1134
1135 return;
1136 }
1137
1138 cmd_status_rsp(cmd, data);
1139 }
1140
1141 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1142 {
1143 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1144 cmd->param, cmd->param_len);
1145 }
1146
1147 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1148 {
1149 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1150 cmd->param, sizeof(struct mgmt_addr_info));
1151 }
1152
1153 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1154 {
1155 if (!lmp_bredr_capable(hdev))
1156 return MGMT_STATUS_NOT_SUPPORTED;
1157 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1158 return MGMT_STATUS_REJECTED;
1159 else
1160 return MGMT_STATUS_SUCCESS;
1161 }
1162
1163 static u8 mgmt_le_support(struct hci_dev *hdev)
1164 {
1165 if (!lmp_le_capable(hdev))
1166 return MGMT_STATUS_NOT_SUPPORTED;
1167 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1168 return MGMT_STATUS_REJECTED;
1169 else
1170 return MGMT_STATUS_SUCCESS;
1171 }
1172
1173 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1174 {
1175 struct mgmt_pending_cmd *cmd;
1176
1177 BT_DBG("status 0x%02x", status);
1178
1179 hci_dev_lock(hdev);
1180
1181 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1182 if (!cmd)
1183 goto unlock;
1184
1185 if (status) {
1186 u8 mgmt_err = mgmt_status(status);
1187 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1188 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1189 goto remove_cmd;
1190 }
1191
1192 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1193 hdev->discov_timeout > 0) {
1194 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1195 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1196 }
1197
1198 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1199 new_settings(hdev, cmd->sk);
1200
1201 remove_cmd:
1202 mgmt_pending_remove(cmd);
1203
1204 unlock:
1205 hci_dev_unlock(hdev);
1206 }
1207
1208 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1209 u16 len)
1210 {
1211 struct mgmt_cp_set_discoverable *cp = data;
1212 struct mgmt_pending_cmd *cmd;
1213 u16 timeout;
1214 int err;
1215
1216 BT_DBG("request for %s", hdev->name);
1217
1218 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1219 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1220 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1221 MGMT_STATUS_REJECTED);
1222
1223 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1224 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1225 MGMT_STATUS_INVALID_PARAMS);
1226
1227 timeout = __le16_to_cpu(cp->timeout);
1228
1229 /* Disabling discoverable requires that no timeout is set,
1230 * and enabling limited discoverable requires a timeout.
1231 */
1232 if ((cp->val == 0x00 && timeout > 0) ||
1233 (cp->val == 0x02 && timeout == 0))
1234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1235 MGMT_STATUS_INVALID_PARAMS);
1236
1237 hci_dev_lock(hdev);
1238
1239 if (!hdev_is_powered(hdev) && timeout > 0) {
1240 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1241 MGMT_STATUS_NOT_POWERED);
1242 goto failed;
1243 }
1244
1245 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1246 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1248 MGMT_STATUS_BUSY);
1249 goto failed;
1250 }
1251
1252 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1253 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1254 MGMT_STATUS_REJECTED);
1255 goto failed;
1256 }
1257
1258 if (!hdev_is_powered(hdev)) {
1259 bool changed = false;
1260
1261 /* Setting limited discoverable when powered off is
1262 * not a valid operation since it requires a timeout
1263 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1264 */
1265 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1266 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1267 changed = true;
1268 }
1269
1270 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1271 if (err < 0)
1272 goto failed;
1273
1274 if (changed)
1275 err = new_settings(hdev, sk);
1276
1277 goto failed;
1278 }
1279
1280 /* If the current mode is the same, then just update the timeout
1281 * value with the new value. And if only the timeout gets updated,
1282 * then no need for any HCI transactions.
1283 */
1284 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1285 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1286 HCI_LIMITED_DISCOVERABLE)) {
1287 cancel_delayed_work(&hdev->discov_off);
1288 hdev->discov_timeout = timeout;
1289
1290 if (cp->val && hdev->discov_timeout > 0) {
1291 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1292 queue_delayed_work(hdev->req_workqueue,
1293 &hdev->discov_off, to);
1294 }
1295
1296 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1297 goto failed;
1298 }
1299
1300 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1301 if (!cmd) {
1302 err = -ENOMEM;
1303 goto failed;
1304 }
1305
1306 /* Cancel any potential discoverable timeout that might be
1307 * still active and store new timeout value. The arming of
1308 * the timeout happens in the complete handler.
1309 */
1310 cancel_delayed_work(&hdev->discov_off);
1311 hdev->discov_timeout = timeout;
1312
1313 if (cp->val)
1314 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1315 else
1316 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1317
1318 /* Limited discoverable mode */
1319 if (cp->val == 0x02)
1320 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1321 else
1322 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1323
1324 queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1325 err = 0;
1326
1327 failed:
1328 hci_dev_unlock(hdev);
1329 return err;
1330 }
1331
1332 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1333 {
1334 struct mgmt_pending_cmd *cmd;
1335
1336 BT_DBG("status 0x%02x", status);
1337
1338 hci_dev_lock(hdev);
1339
1340 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1341 if (!cmd)
1342 goto unlock;
1343
1344 if (status) {
1345 u8 mgmt_err = mgmt_status(status);
1346 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1347 goto remove_cmd;
1348 }
1349
1350 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1351 new_settings(hdev, cmd->sk);
1352
1353 remove_cmd:
1354 mgmt_pending_remove(cmd);
1355
1356 unlock:
1357 hci_dev_unlock(hdev);
1358 }
1359
1360 static int set_connectable_update_settings(struct hci_dev *hdev,
1361 struct sock *sk, u8 val)
1362 {
1363 bool changed = false;
1364 int err;
1365
1366 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1367 changed = true;
1368
1369 if (val) {
1370 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1371 } else {
1372 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1373 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1374 }
1375
1376 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1377 if (err < 0)
1378 return err;
1379
1380 if (changed) {
1381 hci_req_update_scan(hdev);
1382 hci_update_background_scan(hdev);
1383 return new_settings(hdev, sk);
1384 }
1385
1386 return 0;
1387 }
1388
1389 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1390 u16 len)
1391 {
1392 struct mgmt_mode *cp = data;
1393 struct mgmt_pending_cmd *cmd;
1394 int err;
1395
1396 BT_DBG("request for %s", hdev->name);
1397
1398 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1399 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1400 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1401 MGMT_STATUS_REJECTED);
1402
1403 if (cp->val != 0x00 && cp->val != 0x01)
1404 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1405 MGMT_STATUS_INVALID_PARAMS);
1406
1407 hci_dev_lock(hdev);
1408
1409 if (!hdev_is_powered(hdev)) {
1410 err = set_connectable_update_settings(hdev, sk, cp->val);
1411 goto failed;
1412 }
1413
1414 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1415 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1417 MGMT_STATUS_BUSY);
1418 goto failed;
1419 }
1420
1421 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1422 if (!cmd) {
1423 err = -ENOMEM;
1424 goto failed;
1425 }
1426
1427 if (cp->val) {
1428 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1429 } else {
1430 if (hdev->discov_timeout > 0)
1431 cancel_delayed_work(&hdev->discov_off);
1432
1433 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1434 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1435 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1436 }
1437
1438 queue_work(hdev->req_workqueue, &hdev->connectable_update);
1439 err = 0;
1440
1441 failed:
1442 hci_dev_unlock(hdev);
1443 return err;
1444 }
1445
1446 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1447 u16 len)
1448 {
1449 struct mgmt_mode *cp = data;
1450 bool changed;
1451 int err;
1452
1453 BT_DBG("request for %s", hdev->name);
1454
1455 if (cp->val != 0x00 && cp->val != 0x01)
1456 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1457 MGMT_STATUS_INVALID_PARAMS);
1458
1459 hci_dev_lock(hdev);
1460
1461 if (cp->val)
1462 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1463 else
1464 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1465
1466 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1467 if (err < 0)
1468 goto unlock;
1469
1470 if (changed) {
1471 /* In limited privacy mode the change of bondable mode
1472 * may affect the local advertising address.
1473 */
1474 if (hdev_is_powered(hdev) &&
1475 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1476 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1477 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1478 queue_work(hdev->req_workqueue,
1479 &hdev->discoverable_update);
1480
1481 err = new_settings(hdev, sk);
1482 }
1483
1484 unlock:
1485 hci_dev_unlock(hdev);
1486 return err;
1487 }
1488
1489 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1490 u16 len)
1491 {
1492 struct mgmt_mode *cp = data;
1493 struct mgmt_pending_cmd *cmd;
1494 u8 val, status;
1495 int err;
1496
1497 BT_DBG("request for %s", hdev->name);
1498
1499 status = mgmt_bredr_support(hdev);
1500 if (status)
1501 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1502 status);
1503
1504 if (cp->val != 0x00 && cp->val != 0x01)
1505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1506 MGMT_STATUS_INVALID_PARAMS);
1507
1508 hci_dev_lock(hdev);
1509
1510 if (!hdev_is_powered(hdev)) {
1511 bool changed = false;
1512
1513 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1514 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1515 changed = true;
1516 }
1517
1518 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1519 if (err < 0)
1520 goto failed;
1521
1522 if (changed)
1523 err = new_settings(hdev, sk);
1524
1525 goto failed;
1526 }
1527
1528 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1529 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1530 MGMT_STATUS_BUSY);
1531 goto failed;
1532 }
1533
1534 val = !!cp->val;
1535
1536 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1537 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1538 goto failed;
1539 }
1540
1541 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1542 if (!cmd) {
1543 err = -ENOMEM;
1544 goto failed;
1545 }
1546
1547 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1548 if (err < 0) {
1549 mgmt_pending_remove(cmd);
1550 goto failed;
1551 }
1552
1553 failed:
1554 hci_dev_unlock(hdev);
1555 return err;
1556 }
1557
1558 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1559 {
1560 struct mgmt_mode *cp = data;
1561 struct mgmt_pending_cmd *cmd;
1562 u8 status;
1563 int err;
1564
1565 BT_DBG("request for %s", hdev->name);
1566
1567 status = mgmt_bredr_support(hdev);
1568 if (status)
1569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1570
1571 if (!lmp_ssp_capable(hdev))
1572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1573 MGMT_STATUS_NOT_SUPPORTED);
1574
1575 if (cp->val != 0x00 && cp->val != 0x01)
1576 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1577 MGMT_STATUS_INVALID_PARAMS);
1578
1579 hci_dev_lock(hdev);
1580
1581 if (!hdev_is_powered(hdev)) {
1582 bool changed;
1583
1584 if (cp->val) {
1585 changed = !hci_dev_test_and_set_flag(hdev,
1586 HCI_SSP_ENABLED);
1587 } else {
1588 changed = hci_dev_test_and_clear_flag(hdev,
1589 HCI_SSP_ENABLED);
1590 if (!changed)
1591 changed = hci_dev_test_and_clear_flag(hdev,
1592 HCI_HS_ENABLED);
1593 else
1594 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1595 }
1596
1597 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1598 if (err < 0)
1599 goto failed;
1600
1601 if (changed)
1602 err = new_settings(hdev, sk);
1603
1604 goto failed;
1605 }
1606
1607 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1608 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1609 MGMT_STATUS_BUSY);
1610 goto failed;
1611 }
1612
1613 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1614 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1615 goto failed;
1616 }
1617
1618 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1619 if (!cmd) {
1620 err = -ENOMEM;
1621 goto failed;
1622 }
1623
1624 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1625 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1626 sizeof(cp->val), &cp->val);
1627
1628 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1629 if (err < 0) {
1630 mgmt_pending_remove(cmd);
1631 goto failed;
1632 }
1633
1634 failed:
1635 hci_dev_unlock(hdev);
1636 return err;
1637 }
1638
1639 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1640 {
1641 struct mgmt_mode *cp = data;
1642 bool changed;
1643 u8 status;
1644 int err;
1645
1646 BT_DBG("request for %s", hdev->name);
1647
1648 status = mgmt_bredr_support(hdev);
1649 if (status)
1650 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1651
1652 if (!lmp_ssp_capable(hdev))
1653 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1654 MGMT_STATUS_NOT_SUPPORTED);
1655
1656 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1657 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1658 MGMT_STATUS_REJECTED);
1659
1660 if (cp->val != 0x00 && cp->val != 0x01)
1661 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1662 MGMT_STATUS_INVALID_PARAMS);
1663
1664 hci_dev_lock(hdev);
1665
1666 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1667 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1668 MGMT_STATUS_BUSY);
1669 goto unlock;
1670 }
1671
1672 if (cp->val) {
1673 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1674 } else {
1675 if (hdev_is_powered(hdev)) {
1676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1677 MGMT_STATUS_REJECTED);
1678 goto unlock;
1679 }
1680
1681 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1682 }
1683
1684 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1685 if (err < 0)
1686 goto unlock;
1687
1688 if (changed)
1689 err = new_settings(hdev, sk);
1690
1691 unlock:
1692 hci_dev_unlock(hdev);
1693 return err;
1694 }
1695
1696 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1697 {
1698 struct cmd_lookup match = { NULL, hdev };
1699
1700 hci_dev_lock(hdev);
1701
1702 if (status) {
1703 u8 mgmt_err = mgmt_status(status);
1704
1705 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1706 &mgmt_err);
1707 goto unlock;
1708 }
1709
1710 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1711
1712 new_settings(hdev, match.sk);
1713
1714 if (match.sk)
1715 sock_put(match.sk);
1716
1717 /* Make sure the controller has a good default for
1718 * advertising data. Restrict the update to when LE
1719 * has actually been enabled. During power on, the
1720 * update in powered_update_hci will take care of it.
1721 */
1722 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1723 struct hci_request req;
1724
1725 hci_req_init(&req, hdev);
1726 __hci_req_update_adv_data(&req, 0x00);
1727 __hci_req_update_scan_rsp_data(&req, 0x00);
1728 hci_req_run(&req, NULL);
1729 hci_update_background_scan(hdev);
1730 }
1731
1732 unlock:
1733 hci_dev_unlock(hdev);
1734 }
1735
1736 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1737 {
1738 struct mgmt_mode *cp = data;
1739 struct hci_cp_write_le_host_supported hci_cp;
1740 struct mgmt_pending_cmd *cmd;
1741 struct hci_request req;
1742 int err;
1743 u8 val, enabled;
1744
1745 BT_DBG("request for %s", hdev->name);
1746
1747 if (!lmp_le_capable(hdev))
1748 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1749 MGMT_STATUS_NOT_SUPPORTED);
1750
1751 if (cp->val != 0x00 && cp->val != 0x01)
1752 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1753 MGMT_STATUS_INVALID_PARAMS);
1754
1755 /* Bluetooth single mode LE only controllers or dual-mode
1756 * controllers configured as LE only devices, do not allow
1757 * switching LE off. These have either LE enabled explicitly
1758 * or BR/EDR has been previously switched off.
1759 *
1760 * When trying to enable an already enabled LE, then gracefully
1761 * send a positive response. Trying to disable it however will
1762 * result into rejection.
1763 */
1764 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1765 if (cp->val == 0x01)
1766 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1767
1768 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1769 MGMT_STATUS_REJECTED);
1770 }
1771
1772 hci_dev_lock(hdev);
1773
1774 val = !!cp->val;
1775 enabled = lmp_host_le_capable(hdev);
1776
1777 if (!val)
1778 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1779
1780 if (!hdev_is_powered(hdev) || val == enabled) {
1781 bool changed = false;
1782
1783 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1784 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1785 changed = true;
1786 }
1787
1788 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1789 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1790 changed = true;
1791 }
1792
1793 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1794 if (err < 0)
1795 goto unlock;
1796
1797 if (changed)
1798 err = new_settings(hdev, sk);
1799
1800 goto unlock;
1801 }
1802
1803 if (pending_find(MGMT_OP_SET_LE, hdev) ||
1804 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1805 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1806 MGMT_STATUS_BUSY);
1807 goto unlock;
1808 }
1809
1810 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1811 if (!cmd) {
1812 err = -ENOMEM;
1813 goto unlock;
1814 }
1815
1816 hci_req_init(&req, hdev);
1817
1818 memset(&hci_cp, 0, sizeof(hci_cp));
1819
1820 if (val) {
1821 hci_cp.le = val;
1822 hci_cp.simul = 0x00;
1823 } else {
1824 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1825 __hci_req_disable_advertising(&req);
1826 }
1827
1828 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1829 &hci_cp);
1830
1831 err = hci_req_run(&req, le_enable_complete);
1832 if (err < 0)
1833 mgmt_pending_remove(cmd);
1834
1835 unlock:
1836 hci_dev_unlock(hdev);
1837 return err;
1838 }
1839
1840 /* This is a helper function to test for pending mgmt commands that can
1841 * cause CoD or EIR HCI commands. We can only allow one such pending
1842 * mgmt command at a time since otherwise we cannot easily track what
1843 * the current values are, will be, and based on that calculate if a new
1844 * HCI command needs to be sent and if yes with what value.
1845 */
1846 static bool pending_eir_or_class(struct hci_dev *hdev)
1847 {
1848 struct mgmt_pending_cmd *cmd;
1849
1850 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1851 switch (cmd->opcode) {
1852 case MGMT_OP_ADD_UUID:
1853 case MGMT_OP_REMOVE_UUID:
1854 case MGMT_OP_SET_DEV_CLASS:
1855 case MGMT_OP_SET_POWERED:
1856 return true;
1857 }
1858 }
1859
1860 return false;
1861 }
1862
1863 static const u8 bluetooth_base_uuid[] = {
1864 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1865 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1866 };
1867
1868 static u8 get_uuid_size(const u8 *uuid)
1869 {
1870 u32 val;
1871
1872 if (memcmp(uuid, bluetooth_base_uuid, 12))
1873 return 128;
1874
1875 val = get_unaligned_le32(&uuid[12]);
1876 if (val > 0xffff)
1877 return 32;
1878
1879 return 16;
1880 }
1881
1882 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1883 {
1884 struct mgmt_pending_cmd *cmd;
1885
1886 hci_dev_lock(hdev);
1887
1888 cmd = pending_find(mgmt_op, hdev);
1889 if (!cmd)
1890 goto unlock;
1891
1892 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
1893 mgmt_status(status), hdev->dev_class, 3);
1894
1895 mgmt_pending_remove(cmd);
1896
1897 unlock:
1898 hci_dev_unlock(hdev);
1899 }
1900
1901 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1902 {
1903 BT_DBG("status 0x%02x", status);
1904
1905 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1906 }
1907
1908 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1909 {
1910 struct mgmt_cp_add_uuid *cp = data;
1911 struct mgmt_pending_cmd *cmd;
1912 struct hci_request req;
1913 struct bt_uuid *uuid;
1914 int err;
1915
1916 BT_DBG("request for %s", hdev->name);
1917
1918 hci_dev_lock(hdev);
1919
1920 if (pending_eir_or_class(hdev)) {
1921 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1922 MGMT_STATUS_BUSY);
1923 goto failed;
1924 }
1925
1926 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1927 if (!uuid) {
1928 err = -ENOMEM;
1929 goto failed;
1930 }
1931
1932 memcpy(uuid->uuid, cp->uuid, 16);
1933 uuid->svc_hint = cp->svc_hint;
1934 uuid->size = get_uuid_size(cp->uuid);
1935
1936 list_add_tail(&uuid->list, &hdev->uuids);
1937
1938 hci_req_init(&req, hdev);
1939
1940 __hci_req_update_class(&req);
1941 __hci_req_update_eir(&req);
1942
1943 err = hci_req_run(&req, add_uuid_complete);
1944 if (err < 0) {
1945 if (err != -ENODATA)
1946 goto failed;
1947
1948 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1949 hdev->dev_class, 3);
1950 goto failed;
1951 }
1952
1953 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1954 if (!cmd) {
1955 err = -ENOMEM;
1956 goto failed;
1957 }
1958
1959 err = 0;
1960
1961 failed:
1962 hci_dev_unlock(hdev);
1963 return err;
1964 }
1965
1966 static bool enable_service_cache(struct hci_dev *hdev)
1967 {
1968 if (!hdev_is_powered(hdev))
1969 return false;
1970
1971 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
1972 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1973 CACHE_TIMEOUT);
1974 return true;
1975 }
1976
1977 return false;
1978 }
1979
1980 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1981 {
1982 BT_DBG("status 0x%02x", status);
1983
1984 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1985 }
1986
1987 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1988 u16 len)
1989 {
1990 struct mgmt_cp_remove_uuid *cp = data;
1991 struct mgmt_pending_cmd *cmd;
1992 struct bt_uuid *match, *tmp;
1993 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1994 struct hci_request req;
1995 int err, found;
1996
1997 BT_DBG("request for %s", hdev->name);
1998
1999 hci_dev_lock(hdev);
2000
2001 if (pending_eir_or_class(hdev)) {
2002 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2003 MGMT_STATUS_BUSY);
2004 goto unlock;
2005 }
2006
2007 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2008 hci_uuids_clear(hdev);
2009
2010 if (enable_service_cache(hdev)) {
2011 err = mgmt_cmd_complete(sk, hdev->id,
2012 MGMT_OP_REMOVE_UUID,
2013 0, hdev->dev_class, 3);
2014 goto unlock;
2015 }
2016
2017 goto update_class;
2018 }
2019
2020 found = 0;
2021
2022 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2023 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2024 continue;
2025
2026 list_del(&match->list);
2027 kfree(match);
2028 found++;
2029 }
2030
2031 if (found == 0) {
2032 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2033 MGMT_STATUS_INVALID_PARAMS);
2034 goto unlock;
2035 }
2036
2037 update_class:
2038 hci_req_init(&req, hdev);
2039
2040 __hci_req_update_class(&req);
2041 __hci_req_update_eir(&req);
2042
2043 err = hci_req_run(&req, remove_uuid_complete);
2044 if (err < 0) {
2045 if (err != -ENODATA)
2046 goto unlock;
2047
2048 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2049 hdev->dev_class, 3);
2050 goto unlock;
2051 }
2052
2053 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2054 if (!cmd) {
2055 err = -ENOMEM;
2056 goto unlock;
2057 }
2058
2059 err = 0;
2060
2061 unlock:
2062 hci_dev_unlock(hdev);
2063 return err;
2064 }
2065
2066 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2067 {
2068 BT_DBG("status 0x%02x", status);
2069
2070 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2071 }
2072
2073 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2074 u16 len)
2075 {
2076 struct mgmt_cp_set_dev_class *cp = data;
2077 struct mgmt_pending_cmd *cmd;
2078 struct hci_request req;
2079 int err;
2080
2081 BT_DBG("request for %s", hdev->name);
2082
2083 if (!lmp_bredr_capable(hdev))
2084 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2085 MGMT_STATUS_NOT_SUPPORTED);
2086
2087 hci_dev_lock(hdev);
2088
2089 if (pending_eir_or_class(hdev)) {
2090 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2091 MGMT_STATUS_BUSY);
2092 goto unlock;
2093 }
2094
2095 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2096 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2097 MGMT_STATUS_INVALID_PARAMS);
2098 goto unlock;
2099 }
2100
2101 hdev->major_class = cp->major;
2102 hdev->minor_class = cp->minor;
2103
2104 if (!hdev_is_powered(hdev)) {
2105 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2106 hdev->dev_class, 3);
2107 goto unlock;
2108 }
2109
2110 hci_req_init(&req, hdev);
2111
2112 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2113 hci_dev_unlock(hdev);
2114 cancel_delayed_work_sync(&hdev->service_cache);
2115 hci_dev_lock(hdev);
2116 __hci_req_update_eir(&req);
2117 }
2118
2119 __hci_req_update_class(&req);
2120
2121 err = hci_req_run(&req, set_class_complete);
2122 if (err < 0) {
2123 if (err != -ENODATA)
2124 goto unlock;
2125
2126 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2127 hdev->dev_class, 3);
2128 goto unlock;
2129 }
2130
2131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2132 if (!cmd) {
2133 err = -ENOMEM;
2134 goto unlock;
2135 }
2136
2137 err = 0;
2138
2139 unlock:
2140 hci_dev_unlock(hdev);
2141 return err;
2142 }
2143
2144 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2145 u16 len)
2146 {
2147 struct mgmt_cp_load_link_keys *cp = data;
2148 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2149 sizeof(struct mgmt_link_key_info));
2150 u16 key_count, expected_len;
2151 bool changed;
2152 int i;
2153
2154 BT_DBG("request for %s", hdev->name);
2155
2156 if (!lmp_bredr_capable(hdev))
2157 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2158 MGMT_STATUS_NOT_SUPPORTED);
2159
2160 key_count = __le16_to_cpu(cp->key_count);
2161 if (key_count > max_key_count) {
2162 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2163 key_count);
2164 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2165 MGMT_STATUS_INVALID_PARAMS);
2166 }
2167
2168 expected_len = sizeof(*cp) + key_count *
2169 sizeof(struct mgmt_link_key_info);
2170 if (expected_len != len) {
2171 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2172 expected_len, len);
2173 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2174 MGMT_STATUS_INVALID_PARAMS);
2175 }
2176
2177 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2178 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2179 MGMT_STATUS_INVALID_PARAMS);
2180
2181 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2182 key_count);
2183
2184 for (i = 0; i < key_count; i++) {
2185 struct mgmt_link_key_info *key = &cp->keys[i];
2186
2187 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2188 return mgmt_cmd_status(sk, hdev->id,
2189 MGMT_OP_LOAD_LINK_KEYS,
2190 MGMT_STATUS_INVALID_PARAMS);
2191 }
2192
2193 hci_dev_lock(hdev);
2194
2195 hci_link_keys_clear(hdev);
2196
2197 if (cp->debug_keys)
2198 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2199 else
2200 changed = hci_dev_test_and_clear_flag(hdev,
2201 HCI_KEEP_DEBUG_KEYS);
2202
2203 if (changed)
2204 new_settings(hdev, NULL);
2205
2206 for (i = 0; i < key_count; i++) {
2207 struct mgmt_link_key_info *key = &cp->keys[i];
2208
2209 /* Always ignore debug keys and require a new pairing if
2210 * the user wants to use them.
2211 */
2212 if (key->type == HCI_LK_DEBUG_COMBINATION)
2213 continue;
2214
2215 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2216 key->type, key->pin_len, NULL);
2217 }
2218
2219 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2220
2221 hci_dev_unlock(hdev);
2222
2223 return 0;
2224 }
2225
2226 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2227 u8 addr_type, struct sock *skip_sk)
2228 {
2229 struct mgmt_ev_device_unpaired ev;
2230
2231 bacpy(&ev.addr.bdaddr, bdaddr);
2232 ev.addr.type = addr_type;
2233
2234 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2235 skip_sk);
2236 }
2237
2238 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2239 u16 len)
2240 {
2241 struct mgmt_cp_unpair_device *cp = data;
2242 struct mgmt_rp_unpair_device rp;
2243 struct hci_conn_params *params;
2244 struct mgmt_pending_cmd *cmd;
2245 struct hci_conn *conn;
2246 u8 addr_type;
2247 int err;
2248
2249 memset(&rp, 0, sizeof(rp));
2250 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2251 rp.addr.type = cp->addr.type;
2252
2253 if (!bdaddr_type_is_valid(cp->addr.type))
2254 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2255 MGMT_STATUS_INVALID_PARAMS,
2256 &rp, sizeof(rp));
2257
2258 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2259 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2260 MGMT_STATUS_INVALID_PARAMS,
2261 &rp, sizeof(rp));
2262
2263 hci_dev_lock(hdev);
2264
2265 if (!hdev_is_powered(hdev)) {
2266 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2267 MGMT_STATUS_NOT_POWERED, &rp,
2268 sizeof(rp));
2269 goto unlock;
2270 }
2271
2272 if (cp->addr.type == BDADDR_BREDR) {
2273 /* If disconnection is requested, then look up the
2274 * connection. If the remote device is connected, it
2275 * will be later used to terminate the link.
2276 *
2277 * Setting it to NULL explicitly will cause no
2278 * termination of the link.
2279 */
2280 if (cp->disconnect)
2281 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2282 &cp->addr.bdaddr);
2283 else
2284 conn = NULL;
2285
2286 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2287 if (err < 0) {
2288 err = mgmt_cmd_complete(sk, hdev->id,
2289 MGMT_OP_UNPAIR_DEVICE,
2290 MGMT_STATUS_NOT_PAIRED, &rp,
2291 sizeof(rp));
2292 goto unlock;
2293 }
2294
2295 goto done;
2296 }
2297
2298 /* LE address type */
2299 addr_type = le_addr_type(cp->addr.type);
2300
2301 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2302 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2303 if (err < 0) {
2304 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2305 MGMT_STATUS_NOT_PAIRED, &rp,
2306 sizeof(rp));
2307 goto unlock;
2308 }
2309
2310 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2311 if (!conn) {
2312 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2313 goto done;
2314 }
2315
2316
2317 /* Defer clearing up the connection parameters until closing to
2318 * give a chance of keeping them if a repairing happens.
2319 */
2320 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2321
2322 /* Disable auto-connection parameters if present */
2323 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2324 if (params) {
2325 if (params->explicit_connect)
2326 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2327 else
2328 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2329 }
2330
2331 /* If disconnection is not requested, then clear the connection
2332 * variable so that the link is not terminated.
2333 */
2334 if (!cp->disconnect)
2335 conn = NULL;
2336
2337 done:
2338 /* If the connection variable is set, then termination of the
2339 * link is requested.
2340 */
2341 if (!conn) {
2342 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2343 &rp, sizeof(rp));
2344 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2345 goto unlock;
2346 }
2347
2348 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2349 sizeof(*cp));
2350 if (!cmd) {
2351 err = -ENOMEM;
2352 goto unlock;
2353 }
2354
2355 cmd->cmd_complete = addr_cmd_complete;
2356
2357 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2358 if (err < 0)
2359 mgmt_pending_remove(cmd);
2360
2361 unlock:
2362 hci_dev_unlock(hdev);
2363 return err;
2364 }
2365
2366 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2367 u16 len)
2368 {
2369 struct mgmt_cp_disconnect *cp = data;
2370 struct mgmt_rp_disconnect rp;
2371 struct mgmt_pending_cmd *cmd;
2372 struct hci_conn *conn;
2373 int err;
2374
2375 BT_DBG("");
2376
2377 memset(&rp, 0, sizeof(rp));
2378 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2379 rp.addr.type = cp->addr.type;
2380
2381 if (!bdaddr_type_is_valid(cp->addr.type))
2382 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2383 MGMT_STATUS_INVALID_PARAMS,
2384 &rp, sizeof(rp));
2385
2386 hci_dev_lock(hdev);
2387
2388 if (!test_bit(HCI_UP, &hdev->flags)) {
2389 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2390 MGMT_STATUS_NOT_POWERED, &rp,
2391 sizeof(rp));
2392 goto failed;
2393 }
2394
2395 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2396 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2397 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2398 goto failed;
2399 }
2400
2401 if (cp->addr.type == BDADDR_BREDR)
2402 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2403 &cp->addr.bdaddr);
2404 else
2405 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2406 le_addr_type(cp->addr.type));
2407
2408 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2409 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2410 MGMT_STATUS_NOT_CONNECTED, &rp,
2411 sizeof(rp));
2412 goto failed;
2413 }
2414
2415 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2416 if (!cmd) {
2417 err = -ENOMEM;
2418 goto failed;
2419 }
2420
2421 cmd->cmd_complete = generic_cmd_complete;
2422
2423 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2424 if (err < 0)
2425 mgmt_pending_remove(cmd);
2426
2427 failed:
2428 hci_dev_unlock(hdev);
2429 return err;
2430 }
2431
2432 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2433 {
2434 switch (link_type) {
2435 case LE_LINK:
2436 switch (addr_type) {
2437 case ADDR_LE_DEV_PUBLIC:
2438 return BDADDR_LE_PUBLIC;
2439
2440 default:
2441 /* Fallback to LE Random address type */
2442 return BDADDR_LE_RANDOM;
2443 }
2444
2445 default:
2446 /* Fallback to BR/EDR type */
2447 return BDADDR_BREDR;
2448 }
2449 }
2450
2451 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2452 u16 data_len)
2453 {
2454 struct mgmt_rp_get_connections *rp;
2455 struct hci_conn *c;
2456 size_t rp_len;
2457 int err;
2458 u16 i;
2459
2460 BT_DBG("");
2461
2462 hci_dev_lock(hdev);
2463
2464 if (!hdev_is_powered(hdev)) {
2465 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2466 MGMT_STATUS_NOT_POWERED);
2467 goto unlock;
2468 }
2469
2470 i = 0;
2471 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2472 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2473 i++;
2474 }
2475
2476 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2477 rp = kmalloc(rp_len, GFP_KERNEL);
2478 if (!rp) {
2479 err = -ENOMEM;
2480 goto unlock;
2481 }
2482
2483 i = 0;
2484 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2485 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2486 continue;
2487 bacpy(&rp->addr[i].bdaddr, &c->dst);
2488 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2489 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2490 continue;
2491 i++;
2492 }
2493
2494 rp->conn_count = cpu_to_le16(i);
2495
2496 /* Recalculate length in case of filtered SCO connections, etc */
2497 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2498
2499 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2500 rp_len);
2501
2502 kfree(rp);
2503
2504 unlock:
2505 hci_dev_unlock(hdev);
2506 return err;
2507 }
2508
2509 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2510 struct mgmt_cp_pin_code_neg_reply *cp)
2511 {
2512 struct mgmt_pending_cmd *cmd;
2513 int err;
2514
2515 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2516 sizeof(*cp));
2517 if (!cmd)
2518 return -ENOMEM;
2519
2520 cmd->cmd_complete = addr_cmd_complete;
2521
2522 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2523 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2524 if (err < 0)
2525 mgmt_pending_remove(cmd);
2526
2527 return err;
2528 }
2529
2530 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2531 u16 len)
2532 {
2533 struct hci_conn *conn;
2534 struct mgmt_cp_pin_code_reply *cp = data;
2535 struct hci_cp_pin_code_reply reply;
2536 struct mgmt_pending_cmd *cmd;
2537 int err;
2538
2539 BT_DBG("");
2540
2541 hci_dev_lock(hdev);
2542
2543 if (!hdev_is_powered(hdev)) {
2544 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2545 MGMT_STATUS_NOT_POWERED);
2546 goto failed;
2547 }
2548
2549 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2550 if (!conn) {
2551 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2552 MGMT_STATUS_NOT_CONNECTED);
2553 goto failed;
2554 }
2555
2556 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2557 struct mgmt_cp_pin_code_neg_reply ncp;
2558
2559 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2560
2561 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2562
2563 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2564 if (err >= 0)
2565 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2566 MGMT_STATUS_INVALID_PARAMS);
2567
2568 goto failed;
2569 }
2570
2571 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2572 if (!cmd) {
2573 err = -ENOMEM;
2574 goto failed;
2575 }
2576
2577 cmd->cmd_complete = addr_cmd_complete;
2578
2579 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2580 reply.pin_len = cp->pin_len;
2581 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2582
2583 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2584 if (err < 0)
2585 mgmt_pending_remove(cmd);
2586
2587 failed:
2588 hci_dev_unlock(hdev);
2589 return err;
2590 }
2591
2592 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2593 u16 len)
2594 {
2595 struct mgmt_cp_set_io_capability *cp = data;
2596
2597 BT_DBG("");
2598
2599 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2600 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2601 MGMT_STATUS_INVALID_PARAMS);
2602
2603 hci_dev_lock(hdev);
2604
2605 hdev->io_capability = cp->io_capability;
2606
2607 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2608 hdev->io_capability);
2609
2610 hci_dev_unlock(hdev);
2611
2612 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2613 NULL, 0);
2614 }
2615
2616 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2617 {
2618 struct hci_dev *hdev = conn->hdev;
2619 struct mgmt_pending_cmd *cmd;
2620
2621 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2622 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2623 continue;
2624
2625 if (cmd->user_data != conn)
2626 continue;
2627
2628 return cmd;
2629 }
2630
2631 return NULL;
2632 }
2633
2634 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2635 {
2636 struct mgmt_rp_pair_device rp;
2637 struct hci_conn *conn = cmd->user_data;
2638 int err;
2639
2640 bacpy(&rp.addr.bdaddr, &conn->dst);
2641 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2642
2643 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2644 status, &rp, sizeof(rp));
2645
2646 /* So we don't get further callbacks for this connection */
2647 conn->connect_cfm_cb = NULL;
2648 conn->security_cfm_cb = NULL;
2649 conn->disconn_cfm_cb = NULL;
2650
2651 hci_conn_drop(conn);
2652
2653 /* The device is paired so there is no need to remove
2654 * its connection parameters anymore.
2655 */
2656 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2657
2658 hci_conn_put(conn);
2659
2660 return err;
2661 }
2662
2663 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2664 {
2665 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2666 struct mgmt_pending_cmd *cmd;
2667
2668 cmd = find_pairing(conn);
2669 if (cmd) {
2670 cmd->cmd_complete(cmd, status);
2671 mgmt_pending_remove(cmd);
2672 }
2673 }
2674
2675 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2676 {
2677 struct mgmt_pending_cmd *cmd;
2678
2679 BT_DBG("status %u", status);
2680
2681 cmd = find_pairing(conn);
2682 if (!cmd) {
2683 BT_DBG("Unable to find a pending command");
2684 return;
2685 }
2686
2687 cmd->cmd_complete(cmd, mgmt_status(status));
2688 mgmt_pending_remove(cmd);
2689 }
2690
2691 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2692 {
2693 struct mgmt_pending_cmd *cmd;
2694
2695 BT_DBG("status %u", status);
2696
2697 if (!status)
2698 return;
2699
2700 cmd = find_pairing(conn);
2701 if (!cmd) {
2702 BT_DBG("Unable to find a pending command");
2703 return;
2704 }
2705
2706 cmd->cmd_complete(cmd, mgmt_status(status));
2707 mgmt_pending_remove(cmd);
2708 }
2709
2710 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2711 u16 len)
2712 {
2713 struct mgmt_cp_pair_device *cp = data;
2714 struct mgmt_rp_pair_device rp;
2715 struct mgmt_pending_cmd *cmd;
2716 u8 sec_level, auth_type;
2717 struct hci_conn *conn;
2718 int err;
2719
2720 BT_DBG("");
2721
2722 memset(&rp, 0, sizeof(rp));
2723 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2724 rp.addr.type = cp->addr.type;
2725
2726 if (!bdaddr_type_is_valid(cp->addr.type))
2727 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2728 MGMT_STATUS_INVALID_PARAMS,
2729 &rp, sizeof(rp));
2730
2731 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2732 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2733 MGMT_STATUS_INVALID_PARAMS,
2734 &rp, sizeof(rp));
2735
2736 hci_dev_lock(hdev);
2737
2738 if (!hdev_is_powered(hdev)) {
2739 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2740 MGMT_STATUS_NOT_POWERED, &rp,
2741 sizeof(rp));
2742 goto unlock;
2743 }
2744
2745 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2746 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2747 MGMT_STATUS_ALREADY_PAIRED, &rp,
2748 sizeof(rp));
2749 goto unlock;
2750 }
2751
2752 sec_level = BT_SECURITY_MEDIUM;
2753 auth_type = HCI_AT_DEDICATED_BONDING;
2754
2755 if (cp->addr.type == BDADDR_BREDR) {
2756 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2757 auth_type);
2758 } else {
2759 u8 addr_type = le_addr_type(cp->addr.type);
2760 struct hci_conn_params *p;
2761
2762 /* When pairing a new device, it is expected to remember
2763 * this device for future connections. Adding the connection
2764 * parameter information ahead of time allows tracking
2765 * of the slave preferred values and will speed up any
2766 * further connection establishment.
2767 *
2768 * If connection parameters already exist, then they
2769 * will be kept and this function does nothing.
2770 */
2771 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2772
2773 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2774 p->auto_connect = HCI_AUTO_CONN_DISABLED;
2775
2776 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2777 addr_type, sec_level,
2778 HCI_LE_CONN_TIMEOUT);
2779 }
2780
2781 if (IS_ERR(conn)) {
2782 int status;
2783
2784 if (PTR_ERR(conn) == -EBUSY)
2785 status = MGMT_STATUS_BUSY;
2786 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2787 status = MGMT_STATUS_NOT_SUPPORTED;
2788 else if (PTR_ERR(conn) == -ECONNREFUSED)
2789 status = MGMT_STATUS_REJECTED;
2790 else
2791 status = MGMT_STATUS_CONNECT_FAILED;
2792
2793 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2794 status, &rp, sizeof(rp));
2795 goto unlock;
2796 }
2797
2798 if (conn->connect_cfm_cb) {
2799 hci_conn_drop(conn);
2800 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2801 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2802 goto unlock;
2803 }
2804
2805 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2806 if (!cmd) {
2807 err = -ENOMEM;
2808 hci_conn_drop(conn);
2809 goto unlock;
2810 }
2811
2812 cmd->cmd_complete = pairing_complete;
2813
2814 /* For LE, just connecting isn't a proof that the pairing finished */
2815 if (cp->addr.type == BDADDR_BREDR) {
2816 conn->connect_cfm_cb = pairing_complete_cb;
2817 conn->security_cfm_cb = pairing_complete_cb;
2818 conn->disconn_cfm_cb = pairing_complete_cb;
2819 } else {
2820 conn->connect_cfm_cb = le_pairing_complete_cb;
2821 conn->security_cfm_cb = le_pairing_complete_cb;
2822 conn->disconn_cfm_cb = le_pairing_complete_cb;
2823 }
2824
2825 conn->io_capability = cp->io_cap;
2826 cmd->user_data = hci_conn_get(conn);
2827
2828 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2829 hci_conn_security(conn, sec_level, auth_type, true)) {
2830 cmd->cmd_complete(cmd, 0);
2831 mgmt_pending_remove(cmd);
2832 }
2833
2834 err = 0;
2835
2836 unlock:
2837 hci_dev_unlock(hdev);
2838 return err;
2839 }
2840
2841 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2842 u16 len)
2843 {
2844 struct mgmt_addr_info *addr = data;
2845 struct mgmt_pending_cmd *cmd;
2846 struct hci_conn *conn;
2847 int err;
2848
2849 BT_DBG("");
2850
2851 hci_dev_lock(hdev);
2852
2853 if (!hdev_is_powered(hdev)) {
2854 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2855 MGMT_STATUS_NOT_POWERED);
2856 goto unlock;
2857 }
2858
2859 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2860 if (!cmd) {
2861 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2862 MGMT_STATUS_INVALID_PARAMS);
2863 goto unlock;
2864 }
2865
2866 conn = cmd->user_data;
2867
2868 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2869 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2870 MGMT_STATUS_INVALID_PARAMS);
2871 goto unlock;
2872 }
2873
2874 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
2875 mgmt_pending_remove(cmd);
2876
2877 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2878 addr, sizeof(*addr));
2879 unlock:
2880 hci_dev_unlock(hdev);
2881 return err;
2882 }
2883
2884 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2885 struct mgmt_addr_info *addr, u16 mgmt_op,
2886 u16 hci_op, __le32 passkey)
2887 {
2888 struct mgmt_pending_cmd *cmd;
2889 struct hci_conn *conn;
2890 int err;
2891
2892 hci_dev_lock(hdev);
2893
2894 if (!hdev_is_powered(hdev)) {
2895 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2896 MGMT_STATUS_NOT_POWERED, addr,
2897 sizeof(*addr));
2898 goto done;
2899 }
2900
2901 if (addr->type == BDADDR_BREDR)
2902 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2903 else
2904 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
2905 le_addr_type(addr->type));
2906
2907 if (!conn) {
2908 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2909 MGMT_STATUS_NOT_CONNECTED, addr,
2910 sizeof(*addr));
2911 goto done;
2912 }
2913
2914 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2915 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2916 if (!err)
2917 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2918 MGMT_STATUS_SUCCESS, addr,
2919 sizeof(*addr));
2920 else
2921 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
2922 MGMT_STATUS_FAILED, addr,
2923 sizeof(*addr));
2924
2925 goto done;
2926 }
2927
2928 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2929 if (!cmd) {
2930 err = -ENOMEM;
2931 goto done;
2932 }
2933
2934 cmd->cmd_complete = addr_cmd_complete;
2935
2936 /* Continue with pairing via HCI */
2937 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2938 struct hci_cp_user_passkey_reply cp;
2939
2940 bacpy(&cp.bdaddr, &addr->bdaddr);
2941 cp.passkey = passkey;
2942 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2943 } else
2944 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2945 &addr->bdaddr);
2946
2947 if (err < 0)
2948 mgmt_pending_remove(cmd);
2949
2950 done:
2951 hci_dev_unlock(hdev);
2952 return err;
2953 }
2954
2955 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2956 void *data, u16 len)
2957 {
2958 struct mgmt_cp_pin_code_neg_reply *cp = data;
2959
2960 BT_DBG("");
2961
2962 return user_pairing_resp(sk, hdev, &cp->addr,
2963 MGMT_OP_PIN_CODE_NEG_REPLY,
2964 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2965 }
2966
2967 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2968 u16 len)
2969 {
2970 struct mgmt_cp_user_confirm_reply *cp = data;
2971
2972 BT_DBG("");
2973
2974 if (len != sizeof(*cp))
2975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2976 MGMT_STATUS_INVALID_PARAMS);
2977
2978 return user_pairing_resp(sk, hdev, &cp->addr,
2979 MGMT_OP_USER_CONFIRM_REPLY,
2980 HCI_OP_USER_CONFIRM_REPLY, 0);
2981 }
2982
2983 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2984 void *data, u16 len)
2985 {
2986 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2987
2988 BT_DBG("");
2989
2990 return user_pairing_resp(sk, hdev, &cp->addr,
2991 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2992 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2993 }
2994
2995 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2996 u16 len)
2997 {
2998 struct mgmt_cp_user_passkey_reply *cp = data;
2999
3000 BT_DBG("");
3001
3002 return user_pairing_resp(sk, hdev, &cp->addr,
3003 MGMT_OP_USER_PASSKEY_REPLY,
3004 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3005 }
3006
3007 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3008 void *data, u16 len)
3009 {
3010 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3011
3012 BT_DBG("");
3013
3014 return user_pairing_resp(sk, hdev, &cp->addr,
3015 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3016 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3017 }
3018
3019 static void adv_expire(struct hci_dev *hdev, u32 flags)
3020 {
3021 struct adv_info *adv_instance;
3022 struct hci_request req;
3023 int err;
3024
3025 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3026 if (!adv_instance)
3027 return;
3028
3029 /* stop if current instance doesn't need to be changed */
3030 if (!(adv_instance->flags & flags))
3031 return;
3032
3033 cancel_adv_timeout(hdev);
3034
3035 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3036 if (!adv_instance)
3037 return;
3038
3039 hci_req_init(&req, hdev);
3040 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3041 true);
3042 if (err)
3043 return;
3044
3045 hci_req_run(&req, NULL);
3046 }
3047
3048 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3049 {
3050 struct mgmt_cp_set_local_name *cp;
3051 struct mgmt_pending_cmd *cmd;
3052
3053 BT_DBG("status 0x%02x", status);
3054
3055 hci_dev_lock(hdev);
3056
3057 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3058 if (!cmd)
3059 goto unlock;
3060
3061 cp = cmd->param;
3062
3063 if (status) {
3064 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3065 mgmt_status(status));
3066 } else {
3067 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3068 cp, sizeof(*cp));
3069
3070 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3071 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3072 }
3073
3074 mgmt_pending_remove(cmd);
3075
3076 unlock:
3077 hci_dev_unlock(hdev);
3078 }
3079
3080 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3081 u16 len)
3082 {
3083 struct mgmt_cp_set_local_name *cp = data;
3084 struct mgmt_pending_cmd *cmd;
3085 struct hci_request req;
3086 int err;
3087
3088 BT_DBG("");
3089
3090 hci_dev_lock(hdev);
3091
3092 /* If the old values are the same as the new ones just return a
3093 * direct command complete event.
3094 */
3095 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3096 !memcmp(hdev->short_name, cp->short_name,
3097 sizeof(hdev->short_name))) {
3098 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3099 data, len);
3100 goto failed;
3101 }
3102
3103 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3104
3105 if (!hdev_is_powered(hdev)) {
3106 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3107
3108 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3109 data, len);
3110 if (err < 0)
3111 goto failed;
3112
3113 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3114 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3115 ext_info_changed(hdev, sk);
3116
3117 goto failed;
3118 }
3119
3120 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3121 if (!cmd) {
3122 err = -ENOMEM;
3123 goto failed;
3124 }
3125
3126 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3127
3128 hci_req_init(&req, hdev);
3129
3130 if (lmp_bredr_capable(hdev)) {
3131 __hci_req_update_name(&req);
3132 __hci_req_update_eir(&req);
3133 }
3134
3135 /* The name is stored in the scan response data and so
3136 * no need to udpate the advertising data here.
3137 */
3138 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3139 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3140
3141 err = hci_req_run(&req, set_name_complete);
3142 if (err < 0)
3143 mgmt_pending_remove(cmd);
3144
3145 failed:
3146 hci_dev_unlock(hdev);
3147 return err;
3148 }
3149
3150 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3151 u16 len)
3152 {
3153 struct mgmt_cp_set_appearance *cp = data;
3154 u16 apperance;
3155 int err;
3156
3157 BT_DBG("");
3158
3159 if (!lmp_le_capable(hdev))
3160 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3161 MGMT_STATUS_NOT_SUPPORTED);
3162
3163 apperance = le16_to_cpu(cp->appearance);
3164
3165 hci_dev_lock(hdev);
3166
3167 if (hdev->appearance != apperance) {
3168 hdev->appearance = apperance;
3169
3170 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3171 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3172
3173 ext_info_changed(hdev, sk);
3174 }
3175
3176 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3177 0);
3178
3179 hci_dev_unlock(hdev);
3180
3181 return err;
3182 }
3183
3184 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3185 u16 opcode, struct sk_buff *skb)
3186 {
3187 struct mgmt_rp_read_local_oob_data mgmt_rp;
3188 size_t rp_size = sizeof(mgmt_rp);
3189 struct mgmt_pending_cmd *cmd;
3190
3191 BT_DBG("%s status %u", hdev->name, status);
3192
3193 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3194 if (!cmd)
3195 return;
3196
3197 if (status || !skb) {
3198 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3199 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3200 goto remove;
3201 }
3202
3203 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3204
3205 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3206 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3207
3208 if (skb->len < sizeof(*rp)) {
3209 mgmt_cmd_status(cmd->sk, hdev->id,
3210 MGMT_OP_READ_LOCAL_OOB_DATA,
3211 MGMT_STATUS_FAILED);
3212 goto remove;
3213 }
3214
3215 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3216 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3217
3218 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3219 } else {
3220 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3221
3222 if (skb->len < sizeof(*rp)) {
3223 mgmt_cmd_status(cmd->sk, hdev->id,
3224 MGMT_OP_READ_LOCAL_OOB_DATA,
3225 MGMT_STATUS_FAILED);
3226 goto remove;
3227 }
3228
3229 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3230 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3231
3232 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3233 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3234 }
3235
3236 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3237 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3238
3239 remove:
3240 mgmt_pending_remove(cmd);
3241 }
3242
3243 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3244 void *data, u16 data_len)
3245 {
3246 struct mgmt_pending_cmd *cmd;
3247 struct hci_request req;
3248 int err;
3249
3250 BT_DBG("%s", hdev->name);
3251
3252 hci_dev_lock(hdev);
3253
3254 if (!hdev_is_powered(hdev)) {
3255 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3256 MGMT_STATUS_NOT_POWERED);
3257 goto unlock;
3258 }
3259
3260 if (!lmp_ssp_capable(hdev)) {
3261 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3262 MGMT_STATUS_NOT_SUPPORTED);
3263 goto unlock;
3264 }
3265
3266 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3267 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3268 MGMT_STATUS_BUSY);
3269 goto unlock;
3270 }
3271
3272 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3273 if (!cmd) {
3274 err = -ENOMEM;
3275 goto unlock;
3276 }
3277
3278 hci_req_init(&req, hdev);
3279
3280 if (bredr_sc_enabled(hdev))
3281 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3282 else
3283 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3284
3285 err = hci_req_run_skb(&req, read_local_oob_data_complete);
3286 if (err < 0)
3287 mgmt_pending_remove(cmd);
3288
3289 unlock:
3290 hci_dev_unlock(hdev);
3291 return err;
3292 }
3293
3294 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3295 void *data, u16 len)
3296 {
3297 struct mgmt_addr_info *addr = data;
3298 int err;
3299
3300 BT_DBG("%s ", hdev->name);
3301
3302 if (!bdaddr_type_is_valid(addr->type))
3303 return mgmt_cmd_complete(sk, hdev->id,
3304 MGMT_OP_ADD_REMOTE_OOB_DATA,
3305 MGMT_STATUS_INVALID_PARAMS,
3306 addr, sizeof(*addr));
3307
3308 hci_dev_lock(hdev);
3309
3310 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3311 struct mgmt_cp_add_remote_oob_data *cp = data;
3312 u8 status;
3313
3314 if (cp->addr.type != BDADDR_BREDR) {
3315 err = mgmt_cmd_complete(sk, hdev->id,
3316 MGMT_OP_ADD_REMOTE_OOB_DATA,
3317 MGMT_STATUS_INVALID_PARAMS,
3318 &cp->addr, sizeof(cp->addr));
3319 goto unlock;
3320 }
3321
3322 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3323 cp->addr.type, cp->hash,
3324 cp->rand, NULL, NULL);
3325 if (err < 0)
3326 status = MGMT_STATUS_FAILED;
3327 else
3328 status = MGMT_STATUS_SUCCESS;
3329
3330 err = mgmt_cmd_complete(sk, hdev->id,
3331 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3332 &cp->addr, sizeof(cp->addr));
3333 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3334 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3335 u8 *rand192, *hash192, *rand256, *hash256;
3336 u8 status;
3337
3338 if (bdaddr_type_is_le(cp->addr.type)) {
3339 /* Enforce zero-valued 192-bit parameters as
3340 * long as legacy SMP OOB isn't implemented.
3341 */
3342 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3343 memcmp(cp->hash192, ZERO_KEY, 16)) {
3344 err = mgmt_cmd_complete(sk, hdev->id,
3345 MGMT_OP_ADD_REMOTE_OOB_DATA,
3346 MGMT_STATUS_INVALID_PARAMS,
3347 addr, sizeof(*addr));
3348 goto unlock;
3349 }
3350
3351 rand192 = NULL;
3352 hash192 = NULL;
3353 } else {
3354 /* In case one of the P-192 values is set to zero,
3355 * then just disable OOB data for P-192.
3356 */
3357 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3358 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3359 rand192 = NULL;
3360 hash192 = NULL;
3361 } else {
3362 rand192 = cp->rand192;
3363 hash192 = cp->hash192;
3364 }
3365 }
3366
3367 /* In case one of the P-256 values is set to zero, then just
3368 * disable OOB data for P-256.
3369 */
3370 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3371 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3372 rand256 = NULL;
3373 hash256 = NULL;
3374 } else {
3375 rand256 = cp->rand256;
3376 hash256 = cp->hash256;
3377 }
3378
3379 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3380 cp->addr.type, hash192, rand192,
3381 hash256, rand256);
3382 if (err < 0)
3383 status = MGMT_STATUS_FAILED;
3384 else
3385 status = MGMT_STATUS_SUCCESS;
3386
3387 err = mgmt_cmd_complete(sk, hdev->id,
3388 MGMT_OP_ADD_REMOTE_OOB_DATA,
3389 status, &cp->addr, sizeof(cp->addr));
3390 } else {
3391 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3392 len);
3393 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3394 MGMT_STATUS_INVALID_PARAMS);
3395 }
3396
3397 unlock:
3398 hci_dev_unlock(hdev);
3399 return err;
3400 }
3401
3402 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3403 void *data, u16 len)
3404 {
3405 struct mgmt_cp_remove_remote_oob_data *cp = data;
3406 u8 status;
3407 int err;
3408
3409 BT_DBG("%s", hdev->name);
3410
3411 if (cp->addr.type != BDADDR_BREDR)
3412 return mgmt_cmd_complete(sk, hdev->id,
3413 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3414 MGMT_STATUS_INVALID_PARAMS,
3415 &cp->addr, sizeof(cp->addr));
3416
3417 hci_dev_lock(hdev);
3418
3419 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3420 hci_remote_oob_data_clear(hdev);
3421 status = MGMT_STATUS_SUCCESS;
3422 goto done;
3423 }
3424
3425 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3426 if (err < 0)
3427 status = MGMT_STATUS_INVALID_PARAMS;
3428 else
3429 status = MGMT_STATUS_SUCCESS;
3430
3431 done:
3432 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3433 status, &cp->addr, sizeof(cp->addr));
3434
3435 hci_dev_unlock(hdev);
3436 return err;
3437 }
3438
3439 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3440 {
3441 struct mgmt_pending_cmd *cmd;
3442
3443 BT_DBG("status %d", status);
3444
3445 hci_dev_lock(hdev);
3446
3447 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3448 if (!cmd)
3449 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3450
3451 if (!cmd)
3452 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3453
3454 if (cmd) {
3455 cmd->cmd_complete(cmd, mgmt_status(status));
3456 mgmt_pending_remove(cmd);
3457 }
3458
3459 hci_dev_unlock(hdev);
3460 }
3461
3462 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3463 uint8_t *mgmt_status)
3464 {
3465 switch (type) {
3466 case DISCOV_TYPE_LE:
3467 *mgmt_status = mgmt_le_support(hdev);
3468 if (*mgmt_status)
3469 return false;
3470 break;
3471 case DISCOV_TYPE_INTERLEAVED:
3472 *mgmt_status = mgmt_le_support(hdev);
3473 if (*mgmt_status)
3474 return false;
3475 /* Intentional fall-through */
3476 case DISCOV_TYPE_BREDR:
3477 *mgmt_status = mgmt_bredr_support(hdev);
3478 if (*mgmt_status)
3479 return false;
3480 break;
3481 default:
3482 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3483 return false;
3484 }
3485
3486 return true;
3487 }
3488
3489 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3490 u16 op, void *data, u16 len)
3491 {
3492 struct mgmt_cp_start_discovery *cp = data;
3493 struct mgmt_pending_cmd *cmd;
3494 u8 status;
3495 int err;
3496
3497 BT_DBG("%s", hdev->name);
3498
3499 hci_dev_lock(hdev);
3500
3501 if (!hdev_is_powered(hdev)) {
3502 err = mgmt_cmd_complete(sk, hdev->id, op,
3503 MGMT_STATUS_NOT_POWERED,
3504 &cp->type, sizeof(cp->type));
3505 goto failed;
3506 }
3507
3508 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3509 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3510 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3511 &cp->type, sizeof(cp->type));
3512 goto failed;
3513 }
3514
3515 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3516 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3517 &cp->type, sizeof(cp->type));
3518 goto failed;
3519 }
3520
3521 /* Clear the discovery filter first to free any previously
3522 * allocated memory for the UUID list.
3523 */
3524 hci_discovery_filter_clear(hdev);
3525
3526 hdev->discovery.type = cp->type;
3527 hdev->discovery.report_invalid_rssi = false;
3528 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3529 hdev->discovery.limited = true;
3530 else
3531 hdev->discovery.limited = false;
3532
3533 cmd = mgmt_pending_add(sk, op, hdev, data, len);
3534 if (!cmd) {
3535 err = -ENOMEM;
3536 goto failed;
3537 }
3538
3539 cmd->cmd_complete = generic_cmd_complete;
3540
3541 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3542 queue_work(hdev->req_workqueue, &hdev->discov_update);
3543 err = 0;
3544
3545 failed:
3546 hci_dev_unlock(hdev);
3547 return err;
3548 }
3549
3550 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3551 void *data, u16 len)
3552 {
3553 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3554 data, len);
3555 }
3556
3557 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3558 void *data, u16 len)
3559 {
3560 return start_discovery_internal(sk, hdev,
3561 MGMT_OP_START_LIMITED_DISCOVERY,
3562 data, len);
3563 }
3564
3565 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3566 u8 status)
3567 {
3568 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3569 cmd->param, 1);
3570 }
3571
3572 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3573 void *data, u16 len)
3574 {
3575 struct mgmt_cp_start_service_discovery *cp = data;
3576 struct mgmt_pending_cmd *cmd;
3577 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3578 u16 uuid_count, expected_len;
3579 u8 status;
3580 int err;
3581
3582 BT_DBG("%s", hdev->name);
3583
3584 hci_dev_lock(hdev);
3585
3586 if (!hdev_is_powered(hdev)) {
3587 err = mgmt_cmd_complete(sk, hdev->id,
3588 MGMT_OP_START_SERVICE_DISCOVERY,
3589 MGMT_STATUS_NOT_POWERED,
3590 &cp->type, sizeof(cp->type));
3591 goto failed;
3592 }
3593
3594 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3595 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3596 err = mgmt_cmd_complete(sk, hdev->id,
3597 MGMT_OP_START_SERVICE_DISCOVERY,
3598 MGMT_STATUS_BUSY, &cp->type,
3599 sizeof(cp->type));
3600 goto failed;
3601 }
3602
3603 uuid_count = __le16_to_cpu(cp->uuid_count);
3604 if (uuid_count > max_uuid_count) {
3605 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3606 uuid_count);
3607 err = mgmt_cmd_complete(sk, hdev->id,
3608 MGMT_OP_START_SERVICE_DISCOVERY,
3609 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3610 sizeof(cp->type));
3611 goto failed;
3612 }
3613
3614 expected_len = sizeof(*cp) + uuid_count * 16;
3615 if (expected_len != len) {
3616 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3617 expected_len, len);
3618 err = mgmt_cmd_complete(sk, hdev->id,
3619 MGMT_OP_START_SERVICE_DISCOVERY,
3620 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3621 sizeof(cp->type));
3622 goto failed;
3623 }
3624
3625 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3626 err = mgmt_cmd_complete(sk, hdev->id,
3627 MGMT_OP_START_SERVICE_DISCOVERY,
3628 status, &cp->type, sizeof(cp->type));
3629 goto failed;
3630 }
3631
3632 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3633 hdev, data, len);
3634 if (!cmd) {
3635 err = -ENOMEM;
3636 goto failed;
3637 }
3638
3639 cmd->cmd_complete = service_discovery_cmd_complete;
3640
3641 /* Clear the discovery filter first to free any previously
3642 * allocated memory for the UUID list.
3643 */
3644 hci_discovery_filter_clear(hdev);
3645
3646 hdev->discovery.result_filtering = true;
3647 hdev->discovery.type = cp->type;
3648 hdev->discovery.rssi = cp->rssi;
3649 hdev->discovery.uuid_count = uuid_count;
3650
3651 if (uuid_count > 0) {
3652 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
3653 GFP_KERNEL);
3654 if (!hdev->discovery.uuids) {
3655 err = mgmt_cmd_complete(sk, hdev->id,
3656 MGMT_OP_START_SERVICE_DISCOVERY,
3657 MGMT_STATUS_FAILED,
3658 &cp->type, sizeof(cp->type));
3659 mgmt_pending_remove(cmd);
3660 goto failed;
3661 }
3662 }
3663
3664 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3665 queue_work(hdev->req_workqueue, &hdev->discov_update);
3666 err = 0;
3667
3668 failed:
3669 hci_dev_unlock(hdev);
3670 return err;
3671 }
3672
3673 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
3674 {
3675 struct mgmt_pending_cmd *cmd;
3676
3677 BT_DBG("status %d", status);
3678
3679 hci_dev_lock(hdev);
3680
3681 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3682 if (cmd) {
3683 cmd->cmd_complete(cmd, mgmt_status(status));
3684 mgmt_pending_remove(cmd);
3685 }
3686
3687 hci_dev_unlock(hdev);
3688 }
3689
3690 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
3691 u16 len)
3692 {
3693 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3694 struct mgmt_pending_cmd *cmd;
3695 int err;
3696
3697 BT_DBG("%s", hdev->name);
3698
3699 hci_dev_lock(hdev);
3700
3701 if (!hci_discovery_active(hdev)) {
3702 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3703 MGMT_STATUS_REJECTED, &mgmt_cp->type,
3704 sizeof(mgmt_cp->type));
3705 goto unlock;
3706 }
3707
3708 if (hdev->discovery.type != mgmt_cp->type) {
3709 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
3710 MGMT_STATUS_INVALID_PARAMS,
3711 &mgmt_cp->type, sizeof(mgmt_cp->type));
3712 goto unlock;
3713 }
3714
3715 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
3716 if (!cmd) {
3717 err = -ENOMEM;
3718 goto unlock;
3719 }
3720
3721 cmd->cmd_complete = generic_cmd_complete;
3722
3723 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
3724 queue_work(hdev->req_workqueue, &hdev->discov_update);
3725 err = 0;
3726
3727 unlock:
3728 hci_dev_unlock(hdev);
3729 return err;
3730 }
3731
3732 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
3733 u16 len)
3734 {
3735 struct mgmt_cp_confirm_name *cp = data;
3736 struct inquiry_entry *e;
3737 int err;
3738
3739 BT_DBG("%s", hdev->name);
3740
3741 hci_dev_lock(hdev);
3742
3743 if (!hci_discovery_active(hdev)) {
3744 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3745 MGMT_STATUS_FAILED, &cp->addr,
3746 sizeof(cp->addr));
3747 goto failed;
3748 }
3749
3750 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
3751 if (!e) {
3752 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
3753 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
3754 sizeof(cp->addr));
3755 goto failed;
3756 }
3757
3758 if (cp->name_known) {
3759 e->name_state = NAME_KNOWN;
3760 list_del(&e->list);
3761 } else {
3762 e->name_state = NAME_NEEDED;
3763 hci_inquiry_cache_update_resolve(hdev, e);
3764 }
3765
3766 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
3767 &cp->addr, sizeof(cp->addr));
3768
3769 failed:
3770 hci_dev_unlock(hdev);
3771 return err;
3772 }
3773
3774 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
3775 u16 len)
3776 {
3777 struct mgmt_cp_block_device *cp = data;
3778 u8 status;
3779 int err;
3780
3781 BT_DBG("%s", hdev->name);
3782
3783 if (!bdaddr_type_is_valid(cp->addr.type))
3784 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
3785 MGMT_STATUS_INVALID_PARAMS,
3786 &cp->addr, sizeof(cp->addr));
3787
3788 hci_dev_lock(hdev);
3789
3790 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
3791 cp->addr.type);
3792 if (err < 0) {
3793 status = MGMT_STATUS_FAILED;
3794 goto done;
3795 }
3796
3797 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3798 sk);
3799 status = MGMT_STATUS_SUCCESS;
3800
3801 done:
3802 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3803 &cp->addr, sizeof(cp->addr));
3804
3805 hci_dev_unlock(hdev);
3806
3807 return err;
3808 }
3809
3810 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3811 u16 len)
3812 {
3813 struct mgmt_cp_unblock_device *cp = data;
3814 u8 status;
3815 int err;
3816
3817 BT_DBG("%s", hdev->name);
3818
3819 if (!bdaddr_type_is_valid(cp->addr.type))
3820 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3821 MGMT_STATUS_INVALID_PARAMS,
3822 &cp->addr, sizeof(cp->addr));
3823
3824 hci_dev_lock(hdev);
3825
3826 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
3827 cp->addr.type);
3828 if (err < 0) {
3829 status = MGMT_STATUS_INVALID_PARAMS;
3830 goto done;
3831 }
3832
3833 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
3834 sk);
3835 status = MGMT_STATUS_SUCCESS;
3836
3837 done:
3838 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3839 &cp->addr, sizeof(cp->addr));
3840
3841 hci_dev_unlock(hdev);
3842
3843 return err;
3844 }
3845
3846 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3847 u16 len)
3848 {
3849 struct mgmt_cp_set_device_id *cp = data;
3850 struct hci_request req;
3851 int err;
3852 __u16 source;
3853
3854 BT_DBG("%s", hdev->name);
3855
3856 source = __le16_to_cpu(cp->source);
3857
3858 if (source > 0x0002)
3859 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3860 MGMT_STATUS_INVALID_PARAMS);
3861
3862 hci_dev_lock(hdev);
3863
3864 hdev->devid_source = source;
3865 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3866 hdev->devid_product = __le16_to_cpu(cp->product);
3867 hdev->devid_version = __le16_to_cpu(cp->version);
3868
3869 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
3870 NULL, 0);
3871
3872 hci_req_init(&req, hdev);
3873 __hci_req_update_eir(&req);
3874 hci_req_run(&req, NULL);
3875
3876 hci_dev_unlock(hdev);
3877
3878 return err;
3879 }
3880
3881 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
3882 u16 opcode)
3883 {
3884 BT_DBG("status %d", status);
3885 }
3886
3887 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
3888 u16 opcode)
3889 {
3890 struct cmd_lookup match = { NULL, hdev };
3891 struct hci_request req;
3892 u8 instance;
3893 struct adv_info *adv_instance;
3894 int err;
3895
3896 hci_dev_lock(hdev);
3897
3898 if (status) {
3899 u8 mgmt_err = mgmt_status(status);
3900
3901 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
3902 cmd_status_rsp, &mgmt_err);
3903 goto unlock;
3904 }
3905
3906 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3907 hci_dev_set_flag(hdev, HCI_ADVERTISING);
3908 else
3909 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
3910
3911 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
3912 &match);
3913
3914 new_settings(hdev, match.sk);
3915
3916 if (match.sk)
3917 sock_put(match.sk);
3918
3919 /* If "Set Advertising" was just disabled and instance advertising was
3920 * set up earlier, then re-enable multi-instance advertising.
3921 */
3922 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3923 list_empty(&hdev->adv_instances))
3924 goto unlock;
3925
3926 instance = hdev->cur_adv_instance;
3927 if (!instance) {
3928 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
3929 struct adv_info, list);
3930 if (!adv_instance)
3931 goto unlock;
3932
3933 instance = adv_instance->instance;
3934 }
3935
3936 hci_req_init(&req, hdev);
3937
3938 err = __hci_req_schedule_adv_instance(&req, instance, true);
3939
3940 if (!err)
3941 err = hci_req_run(&req, enable_advertising_instance);
3942
3943 if (err)
3944 bt_dev_err(hdev, "failed to re-configure advertising");
3945
3946 unlock:
3947 hci_dev_unlock(hdev);
3948 }
3949
3950 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
3951 u16 len)
3952 {
3953 struct mgmt_mode *cp = data;
3954 struct mgmt_pending_cmd *cmd;
3955 struct hci_request req;
3956 u8 val, status;
3957 int err;
3958
3959 BT_DBG("request for %s", hdev->name);
3960
3961 status = mgmt_le_support(hdev);
3962 if (status)
3963 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3964 status);
3965
3966 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
3967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
3968 MGMT_STATUS_INVALID_PARAMS);
3969
3970 hci_dev_lock(hdev);
3971
3972 val = !!cp->val;
3973
3974 /* The following conditions are ones which mean that we should
3975 * not do any HCI communication but directly send a mgmt
3976 * response to user space (after toggling the flag if
3977 * necessary).
3978 */
3979 if (!hdev_is_powered(hdev) ||
3980 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
3981 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
3982 hci_conn_num(hdev, LE_LINK) > 0 ||
3983 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
3984 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
3985 bool changed;
3986
3987 if (cp->val) {
3988 hdev->cur_adv_instance = 0x00;
3989 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
3990 if (cp->val == 0x02)
3991 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3992 else
3993 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3994 } else {
3995 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
3996 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
3997 }
3998
3999 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4000 if (err < 0)
4001 goto unlock;
4002
4003 if (changed)
4004 err = new_settings(hdev, sk);
4005
4006 goto unlock;
4007 }
4008
4009 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4010 pending_find(MGMT_OP_SET_LE, hdev)) {
4011 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4012 MGMT_STATUS_BUSY);
4013 goto unlock;
4014 }
4015
4016 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4017 if (!cmd) {
4018 err = -ENOMEM;
4019 goto unlock;
4020 }
4021
4022 hci_req_init(&req, hdev);
4023
4024 if (cp->val == 0x02)
4025 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4026 else
4027 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4028
4029 cancel_adv_timeout(hdev);
4030
4031 if (val) {
4032 /* Switch to instance "0" for the Set Advertising setting.
4033 * We cannot use update_[adv|scan_rsp]_data() here as the
4034 * HCI_ADVERTISING flag is not yet set.
4035 */
4036 hdev->cur_adv_instance = 0x00;
4037 __hci_req_update_adv_data(&req, 0x00);
4038 __hci_req_update_scan_rsp_data(&req, 0x00);
4039 __hci_req_enable_advertising(&req);
4040 } else {
4041 __hci_req_disable_advertising(&req);
4042 }
4043
4044 err = hci_req_run(&req, set_advertising_complete);
4045 if (err < 0)
4046 mgmt_pending_remove(cmd);
4047
4048 unlock:
4049 hci_dev_unlock(hdev);
4050 return err;
4051 }
4052
4053 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4054 void *data, u16 len)
4055 {
4056 struct mgmt_cp_set_static_address *cp = data;
4057 int err;
4058
4059 BT_DBG("%s", hdev->name);
4060
4061 if (!lmp_le_capable(hdev))
4062 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4063 MGMT_STATUS_NOT_SUPPORTED);
4064
4065 if (hdev_is_powered(hdev))
4066 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4067 MGMT_STATUS_REJECTED);
4068
4069 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4070 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4071 return mgmt_cmd_status(sk, hdev->id,
4072 MGMT_OP_SET_STATIC_ADDRESS,
4073 MGMT_STATUS_INVALID_PARAMS);
4074
4075 /* Two most significant bits shall be set */
4076 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4077 return mgmt_cmd_status(sk, hdev->id,
4078 MGMT_OP_SET_STATIC_ADDRESS,
4079 MGMT_STATUS_INVALID_PARAMS);
4080 }
4081
4082 hci_dev_lock(hdev);
4083
4084 bacpy(&hdev->static_addr, &cp->bdaddr);
4085
4086 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4087 if (err < 0)
4088 goto unlock;
4089
4090 err = new_settings(hdev, sk);
4091
4092 unlock:
4093 hci_dev_unlock(hdev);
4094 return err;
4095 }
4096
4097 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4098 void *data, u16 len)
4099 {
4100 struct mgmt_cp_set_scan_params *cp = data;
4101 __u16 interval, window;
4102 int err;
4103
4104 BT_DBG("%s", hdev->name);
4105
4106 if (!lmp_le_capable(hdev))
4107 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4108 MGMT_STATUS_NOT_SUPPORTED);
4109
4110 interval = __le16_to_cpu(cp->interval);
4111
4112 if (interval < 0x0004 || interval > 0x4000)
4113 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4114 MGMT_STATUS_INVALID_PARAMS);
4115
4116 window = __le16_to_cpu(cp->window);
4117
4118 if (window < 0x0004 || window > 0x4000)
4119 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4120 MGMT_STATUS_INVALID_PARAMS);
4121
4122 if (window > interval)
4123 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4124 MGMT_STATUS_INVALID_PARAMS);
4125
4126 hci_dev_lock(hdev);
4127
4128 hdev->le_scan_interval = interval;
4129 hdev->le_scan_window = window;
4130
4131 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4132 NULL, 0);
4133
4134 /* If background scan is running, restart it so new parameters are
4135 * loaded.
4136 */
4137 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4138 hdev->discovery.state == DISCOVERY_STOPPED) {
4139 struct hci_request req;
4140
4141 hci_req_init(&req, hdev);
4142
4143 hci_req_add_le_scan_disable(&req);
4144 hci_req_add_le_passive_scan(&req);
4145
4146 hci_req_run(&req, NULL);
4147 }
4148
4149 hci_dev_unlock(hdev);
4150
4151 return err;
4152 }
4153
4154 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4155 u16 opcode)
4156 {
4157 struct mgmt_pending_cmd *cmd;
4158
4159 BT_DBG("status 0x%02x", status);
4160
4161 hci_dev_lock(hdev);
4162
4163 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4164 if (!cmd)
4165 goto unlock;
4166
4167 if (status) {
4168 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4169 mgmt_status(status));
4170 } else {
4171 struct mgmt_mode *cp = cmd->param;
4172
4173 if (cp->val)
4174 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4175 else
4176 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4177
4178 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4179 new_settings(hdev, cmd->sk);
4180 }
4181
4182 mgmt_pending_remove(cmd);
4183
4184 unlock:
4185 hci_dev_unlock(hdev);
4186 }
4187
4188 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4189 void *data, u16 len)
4190 {
4191 struct mgmt_mode *cp = data;
4192 struct mgmt_pending_cmd *cmd;
4193 struct hci_request req;
4194 int err;
4195
4196 BT_DBG("%s", hdev->name);
4197
4198 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4199 hdev->hci_ver < BLUETOOTH_VER_1_2)
4200 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4201 MGMT_STATUS_NOT_SUPPORTED);
4202
4203 if (cp->val != 0x00 && cp->val != 0x01)
4204 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4205 MGMT_STATUS_INVALID_PARAMS);
4206
4207 hci_dev_lock(hdev);
4208
4209 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4210 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4211 MGMT_STATUS_BUSY);
4212 goto unlock;
4213 }
4214
4215 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4216 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4217 hdev);
4218 goto unlock;
4219 }
4220
4221 if (!hdev_is_powered(hdev)) {
4222 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4223 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4224 hdev);
4225 new_settings(hdev, sk);
4226 goto unlock;
4227 }
4228
4229 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4230 data, len);
4231 if (!cmd) {
4232 err = -ENOMEM;
4233 goto unlock;
4234 }
4235
4236 hci_req_init(&req, hdev);
4237
4238 __hci_req_write_fast_connectable(&req, cp->val);
4239
4240 err = hci_req_run(&req, fast_connectable_complete);
4241 if (err < 0) {
4242 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4243 MGMT_STATUS_FAILED);
4244 mgmt_pending_remove(cmd);
4245 }
4246
4247 unlock:
4248 hci_dev_unlock(hdev);
4249
4250 return err;
4251 }
4252
4253 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4254 {
4255 struct mgmt_pending_cmd *cmd;
4256
4257 BT_DBG("status 0x%02x", status);
4258
4259 hci_dev_lock(hdev);
4260
4261 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4262 if (!cmd)
4263 goto unlock;
4264
4265 if (status) {
4266 u8 mgmt_err = mgmt_status(status);
4267
4268 /* We need to restore the flag if related HCI commands
4269 * failed.
4270 */
4271 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4272
4273 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4274 } else {
4275 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4276 new_settings(hdev, cmd->sk);
4277 }
4278
4279 mgmt_pending_remove(cmd);
4280
4281 unlock:
4282 hci_dev_unlock(hdev);
4283 }
4284
4285 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4286 {
4287 struct mgmt_mode *cp = data;
4288 struct mgmt_pending_cmd *cmd;
4289 struct hci_request req;
4290 int err;
4291
4292 BT_DBG("request for %s", hdev->name);
4293
4294 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4295 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4296 MGMT_STATUS_NOT_SUPPORTED);
4297
4298 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4299 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4300 MGMT_STATUS_REJECTED);
4301
4302 if (cp->val != 0x00 && cp->val != 0x01)
4303 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4304 MGMT_STATUS_INVALID_PARAMS);
4305
4306 hci_dev_lock(hdev);
4307
4308 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4309 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4310 goto unlock;
4311 }
4312
4313 if (!hdev_is_powered(hdev)) {
4314 if (!cp->val) {
4315 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4316 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4317 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4318 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4319 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4320 }
4321
4322 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4323
4324 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4325 if (err < 0)
4326 goto unlock;
4327
4328 err = new_settings(hdev, sk);
4329 goto unlock;
4330 }
4331
4332 /* Reject disabling when powered on */
4333 if (!cp->val) {
4334 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4335 MGMT_STATUS_REJECTED);
4336 goto unlock;
4337 } else {
4338 /* When configuring a dual-mode controller to operate
4339 * with LE only and using a static address, then switching
4340 * BR/EDR back on is not allowed.
4341 *
4342 * Dual-mode controllers shall operate with the public
4343 * address as its identity address for BR/EDR and LE. So
4344 * reject the attempt to create an invalid configuration.
4345 *
4346 * The same restrictions applies when secure connections
4347 * has been enabled. For BR/EDR this is a controller feature
4348 * while for LE it is a host stack feature. This means that
4349 * switching BR/EDR back on when secure connections has been
4350 * enabled is not a supported transaction.
4351 */
4352 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4353 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4354 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4355 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4356 MGMT_STATUS_REJECTED);
4357 goto unlock;
4358 }
4359 }
4360
4361 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4362 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4363 MGMT_STATUS_BUSY);
4364 goto unlock;
4365 }
4366
4367 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4368 if (!cmd) {
4369 err = -ENOMEM;
4370 goto unlock;
4371 }
4372
4373 /* We need to flip the bit already here so that
4374 * hci_req_update_adv_data generates the correct flags.
4375 */
4376 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4377
4378 hci_req_init(&req, hdev);
4379
4380 __hci_req_write_fast_connectable(&req, false);
4381 __hci_req_update_scan(&req);
4382
4383 /* Since only the advertising data flags will change, there
4384 * is no need to update the scan response data.
4385 */
4386 __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4387
4388 err = hci_req_run(&req, set_bredr_complete);
4389 if (err < 0)
4390 mgmt_pending_remove(cmd);
4391
4392 unlock:
4393 hci_dev_unlock(hdev);
4394 return err;
4395 }
4396
4397 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4398 {
4399 struct mgmt_pending_cmd *cmd;
4400 struct mgmt_mode *cp;
4401
4402 BT_DBG("%s status %u", hdev->name, status);
4403
4404 hci_dev_lock(hdev);
4405
4406 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4407 if (!cmd)
4408 goto unlock;
4409
4410 if (status) {
4411 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4412 mgmt_status(status));
4413 goto remove;
4414 }
4415
4416 cp = cmd->param;
4417
4418 switch (cp->val) {
4419 case 0x00:
4420 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4421 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4422 break;
4423 case 0x01:
4424 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4425 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4426 break;
4427 case 0x02:
4428 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4429 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4430 break;
4431 }
4432
4433 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4434 new_settings(hdev, cmd->sk);
4435
4436 remove:
4437 mgmt_pending_remove(cmd);
4438 unlock:
4439 hci_dev_unlock(hdev);
4440 }
4441
4442 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4443 void *data, u16 len)
4444 {
4445 struct mgmt_mode *cp = data;
4446 struct mgmt_pending_cmd *cmd;
4447 struct hci_request req;
4448 u8 val;
4449 int err;
4450
4451 BT_DBG("request for %s", hdev->name);
4452
4453 if (!lmp_sc_capable(hdev) &&
4454 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4455 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4456 MGMT_STATUS_NOT_SUPPORTED);
4457
4458 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4459 lmp_sc_capable(hdev) &&
4460 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4462 MGMT_STATUS_REJECTED);
4463
4464 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4465 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4466 MGMT_STATUS_INVALID_PARAMS);
4467
4468 hci_dev_lock(hdev);
4469
4470 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4471 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4472 bool changed;
4473
4474 if (cp->val) {
4475 changed = !hci_dev_test_and_set_flag(hdev,
4476 HCI_SC_ENABLED);
4477 if (cp->val == 0x02)
4478 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4479 else
4480 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4481 } else {
4482 changed = hci_dev_test_and_clear_flag(hdev,
4483 HCI_SC_ENABLED);
4484 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4485 }
4486
4487 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4488 if (err < 0)
4489 goto failed;
4490
4491 if (changed)
4492 err = new_settings(hdev, sk);
4493
4494 goto failed;
4495 }
4496
4497 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4498 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4499 MGMT_STATUS_BUSY);
4500 goto failed;
4501 }
4502
4503 val = !!cp->val;
4504
4505 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4506 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4507 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4508 goto failed;
4509 }
4510
4511 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4512 if (!cmd) {
4513 err = -ENOMEM;
4514 goto failed;
4515 }
4516
4517 hci_req_init(&req, hdev);
4518 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4519 err = hci_req_run(&req, sc_enable_complete);
4520 if (err < 0) {
4521 mgmt_pending_remove(cmd);
4522 goto failed;
4523 }
4524
4525 failed:
4526 hci_dev_unlock(hdev);
4527 return err;
4528 }
4529
4530 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4531 void *data, u16 len)
4532 {
4533 struct mgmt_mode *cp = data;
4534 bool changed, use_changed;
4535 int err;
4536
4537 BT_DBG("request for %s", hdev->name);
4538
4539 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4540 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4541 MGMT_STATUS_INVALID_PARAMS);
4542
4543 hci_dev_lock(hdev);
4544
4545 if (cp->val)
4546 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4547 else
4548 changed = hci_dev_test_and_clear_flag(hdev,
4549 HCI_KEEP_DEBUG_KEYS);
4550
4551 if (cp->val == 0x02)
4552 use_changed = !hci_dev_test_and_set_flag(hdev,
4553 HCI_USE_DEBUG_KEYS);
4554 else
4555 use_changed = hci_dev_test_and_clear_flag(hdev,
4556 HCI_USE_DEBUG_KEYS);
4557
4558 if (hdev_is_powered(hdev) && use_changed &&
4559 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4560 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4561 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4562 sizeof(mode), &mode);
4563 }
4564
4565 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4566 if (err < 0)
4567 goto unlock;
4568
4569 if (changed)
4570 err = new_settings(hdev, sk);
4571
4572 unlock:
4573 hci_dev_unlock(hdev);
4574 return err;
4575 }
4576
4577 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4578 u16 len)
4579 {
4580 struct mgmt_cp_set_privacy *cp = cp_data;
4581 bool changed;
4582 int err;
4583
4584 BT_DBG("request for %s", hdev->name);
4585
4586 if (!lmp_le_capable(hdev))
4587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4588 MGMT_STATUS_NOT_SUPPORTED);
4589
4590 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4591 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4592 MGMT_STATUS_INVALID_PARAMS);
4593
4594 if (hdev_is_powered(hdev))
4595 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4596 MGMT_STATUS_REJECTED);
4597
4598 hci_dev_lock(hdev);
4599
4600 /* If user space supports this command it is also expected to
4601 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4602 */
4603 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4604
4605 if (cp->privacy) {
4606 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4607 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4608 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4609 if (cp->privacy == 0x02)
4610 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4611 else
4612 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4613 } else {
4614 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4615 memset(hdev->irk, 0, sizeof(hdev->irk));
4616 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4617 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4618 }
4619
4620 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4621 if (err < 0)
4622 goto unlock;
4623
4624 if (changed)
4625 err = new_settings(hdev, sk);
4626
4627 unlock:
4628 hci_dev_unlock(hdev);
4629 return err;
4630 }
4631
4632 static bool irk_is_valid(struct mgmt_irk_info *irk)
4633 {
4634 switch (irk->addr.type) {
4635 case BDADDR_LE_PUBLIC:
4636 return true;
4637
4638 case BDADDR_LE_RANDOM:
4639 /* Two most significant bits shall be set */
4640 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4641 return false;
4642 return true;
4643 }
4644
4645 return false;
4646 }
4647
4648 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4649 u16 len)
4650 {
4651 struct mgmt_cp_load_irks *cp = cp_data;
4652 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4653 sizeof(struct mgmt_irk_info));
4654 u16 irk_count, expected_len;
4655 int i, err;
4656
4657 BT_DBG("request for %s", hdev->name);
4658
4659 if (!lmp_le_capable(hdev))
4660 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4661 MGMT_STATUS_NOT_SUPPORTED);
4662
4663 irk_count = __le16_to_cpu(cp->irk_count);
4664 if (irk_count > max_irk_count) {
4665 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
4666 irk_count);
4667 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4668 MGMT_STATUS_INVALID_PARAMS);
4669 }
4670
4671 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4672 if (expected_len != len) {
4673 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
4674 expected_len, len);
4675 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4676 MGMT_STATUS_INVALID_PARAMS);
4677 }
4678
4679 BT_DBG("%s irk_count %u", hdev->name, irk_count);
4680
4681 for (i = 0; i < irk_count; i++) {
4682 struct mgmt_irk_info *key = &cp->irks[i];
4683
4684 if (!irk_is_valid(key))
4685 return mgmt_cmd_status(sk, hdev->id,
4686 MGMT_OP_LOAD_IRKS,
4687 MGMT_STATUS_INVALID_PARAMS);
4688 }
4689
4690 hci_dev_lock(hdev);
4691
4692 hci_smp_irks_clear(hdev);
4693
4694 for (i = 0; i < irk_count; i++) {
4695 struct mgmt_irk_info *irk = &cp->irks[i];
4696
4697 hci_add_irk(hdev, &irk->addr.bdaddr,
4698 le_addr_type(irk->addr.type), irk->val,
4699 BDADDR_ANY);
4700 }
4701
4702 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4703
4704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4705
4706 hci_dev_unlock(hdev);
4707
4708 return err;
4709 }
4710
4711 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4712 {
4713 if (key->master != 0x00 && key->master != 0x01)
4714 return false;
4715
4716 switch (key->addr.type) {
4717 case BDADDR_LE_PUBLIC:
4718 return true;
4719
4720 case BDADDR_LE_RANDOM:
4721 /* Two most significant bits shall be set */
4722 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4723 return false;
4724 return true;
4725 }
4726
4727 return false;
4728 }
4729
4730 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4731 void *cp_data, u16 len)
4732 {
4733 struct mgmt_cp_load_long_term_keys *cp = cp_data;
4734 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4735 sizeof(struct mgmt_ltk_info));
4736 u16 key_count, expected_len;
4737 int i, err;
4738
4739 BT_DBG("request for %s", hdev->name);
4740
4741 if (!lmp_le_capable(hdev))
4742 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4743 MGMT_STATUS_NOT_SUPPORTED);
4744
4745 key_count = __le16_to_cpu(cp->key_count);
4746 if (key_count > max_key_count) {
4747 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
4748 key_count);
4749 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4750 MGMT_STATUS_INVALID_PARAMS);
4751 }
4752
4753 expected_len = sizeof(*cp) + key_count *
4754 sizeof(struct mgmt_ltk_info);
4755 if (expected_len != len) {
4756 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
4757 expected_len, len);
4758 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4759 MGMT_STATUS_INVALID_PARAMS);
4760 }
4761
4762 BT_DBG("%s key_count %u", hdev->name, key_count);
4763
4764 for (i = 0; i < key_count; i++) {
4765 struct mgmt_ltk_info *key = &cp->keys[i];
4766
4767 if (!ltk_is_valid(key))
4768 return mgmt_cmd_status(sk, hdev->id,
4769 MGMT_OP_LOAD_LONG_TERM_KEYS,
4770 MGMT_STATUS_INVALID_PARAMS);
4771 }
4772
4773 hci_dev_lock(hdev);
4774
4775 hci_smp_ltks_clear(hdev);
4776
4777 for (i = 0; i < key_count; i++) {
4778 struct mgmt_ltk_info *key = &cp->keys[i];
4779 u8 type, authenticated;
4780
4781 switch (key->type) {
4782 case MGMT_LTK_UNAUTHENTICATED:
4783 authenticated = 0x00;
4784 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4785 break;
4786 case MGMT_LTK_AUTHENTICATED:
4787 authenticated = 0x01;
4788 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
4789 break;
4790 case MGMT_LTK_P256_UNAUTH:
4791 authenticated = 0x00;
4792 type = SMP_LTK_P256;
4793 break;
4794 case MGMT_LTK_P256_AUTH:
4795 authenticated = 0x01;
4796 type = SMP_LTK_P256;
4797 break;
4798 case MGMT_LTK_P256_DEBUG:
4799 authenticated = 0x00;
4800 type = SMP_LTK_P256_DEBUG;
4801 default:
4802 continue;
4803 }
4804
4805 hci_add_ltk(hdev, &key->addr.bdaddr,
4806 le_addr_type(key->addr.type), type, authenticated,
4807 key->val, key->enc_size, key->ediv, key->rand);
4808 }
4809
4810 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
4811 NULL, 0);
4812
4813 hci_dev_unlock(hdev);
4814
4815 return err;
4816 }
4817
4818 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
4819 {
4820 struct hci_conn *conn = cmd->user_data;
4821 struct mgmt_rp_get_conn_info rp;
4822 int err;
4823
4824 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
4825
4826 if (status == MGMT_STATUS_SUCCESS) {
4827 rp.rssi = conn->rssi;
4828 rp.tx_power = conn->tx_power;
4829 rp.max_tx_power = conn->max_tx_power;
4830 } else {
4831 rp.rssi = HCI_RSSI_INVALID;
4832 rp.tx_power = HCI_TX_POWER_INVALID;
4833 rp.max_tx_power = HCI_TX_POWER_INVALID;
4834 }
4835
4836 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
4837 status, &rp, sizeof(rp));
4838
4839 hci_conn_drop(conn);
4840 hci_conn_put(conn);
4841
4842 return err;
4843 }
4844
4845 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
4846 u16 opcode)
4847 {
4848 struct hci_cp_read_rssi *cp;
4849 struct mgmt_pending_cmd *cmd;
4850 struct hci_conn *conn;
4851 u16 handle;
4852 u8 status;
4853
4854 BT_DBG("status 0x%02x", hci_status);
4855
4856 hci_dev_lock(hdev);
4857
4858 /* Commands sent in request are either Read RSSI or Read Transmit Power
4859 * Level so we check which one was last sent to retrieve connection
4860 * handle. Both commands have handle as first parameter so it's safe to
4861 * cast data on the same command struct.
4862 *
4863 * First command sent is always Read RSSI and we fail only if it fails.
4864 * In other case we simply override error to indicate success as we
4865 * already remembered if TX power value is actually valid.
4866 */
4867 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
4868 if (!cp) {
4869 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
4870 status = MGMT_STATUS_SUCCESS;
4871 } else {
4872 status = mgmt_status(hci_status);
4873 }
4874
4875 if (!cp) {
4876 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
4877 goto unlock;
4878 }
4879
4880 handle = __le16_to_cpu(cp->handle);
4881 conn = hci_conn_hash_lookup_handle(hdev, handle);
4882 if (!conn) {
4883 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
4884 handle);
4885 goto unlock;
4886 }
4887
4888 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
4889 if (!cmd)
4890 goto unlock;
4891
4892 cmd->cmd_complete(cmd, status);
4893 mgmt_pending_remove(cmd);
4894
4895 unlock:
4896 hci_dev_unlock(hdev);
4897 }
4898
4899 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
4900 u16 len)
4901 {
4902 struct mgmt_cp_get_conn_info *cp = data;
4903 struct mgmt_rp_get_conn_info rp;
4904 struct hci_conn *conn;
4905 unsigned long conn_info_age;
4906 int err = 0;
4907
4908 BT_DBG("%s", hdev->name);
4909
4910 memset(&rp, 0, sizeof(rp));
4911 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
4912 rp.addr.type = cp->addr.type;
4913
4914 if (!bdaddr_type_is_valid(cp->addr.type))
4915 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4916 MGMT_STATUS_INVALID_PARAMS,
4917 &rp, sizeof(rp));
4918
4919 hci_dev_lock(hdev);
4920
4921 if (!hdev_is_powered(hdev)) {
4922 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4923 MGMT_STATUS_NOT_POWERED, &rp,
4924 sizeof(rp));
4925 goto unlock;
4926 }
4927
4928 if (cp->addr.type == BDADDR_BREDR)
4929 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
4930 &cp->addr.bdaddr);
4931 else
4932 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
4933
4934 if (!conn || conn->state != BT_CONNECTED) {
4935 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4936 MGMT_STATUS_NOT_CONNECTED, &rp,
4937 sizeof(rp));
4938 goto unlock;
4939 }
4940
4941 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
4942 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
4943 MGMT_STATUS_BUSY, &rp, sizeof(rp));
4944 goto unlock;
4945 }
4946
4947 /* To avoid client trying to guess when to poll again for information we
4948 * calculate conn info age as random value between min/max set in hdev.
4949 */
4950 conn_info_age = hdev->conn_info_min_age +
4951 prandom_u32_max(hdev->conn_info_max_age -
4952 hdev->conn_info_min_age);
4953
4954 /* Query controller to refresh cached values if they are too old or were
4955 * never read.
4956 */
4957 if (time_after(jiffies, conn->conn_info_timestamp +
4958 msecs_to_jiffies(conn_info_age)) ||
4959 !conn->conn_info_timestamp) {
4960 struct hci_request req;
4961 struct hci_cp_read_tx_power req_txp_cp;
4962 struct hci_cp_read_rssi req_rssi_cp;
4963 struct mgmt_pending_cmd *cmd;
4964
4965 hci_req_init(&req, hdev);
4966 req_rssi_cp.handle = cpu_to_le16(conn->handle);
4967 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
4968 &req_rssi_cp);
4969
4970 /* For LE links TX power does not change thus we don't need to
4971 * query for it once value is known.
4972 */
4973 if (!bdaddr_type_is_le(cp->addr.type) ||
4974 conn->tx_power == HCI_TX_POWER_INVALID) {
4975 req_txp_cp.handle = cpu_to_le16(conn->handle);
4976 req_txp_cp.type = 0x00;
4977 hci_req_add(&req, HCI_OP_READ_TX_POWER,
4978 sizeof(req_txp_cp), &req_txp_cp);
4979 }
4980
4981 /* Max TX power needs to be read only once per connection */
4982 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
4983 req_txp_cp.handle = cpu_to_le16(conn->handle);
4984 req_txp_cp.type = 0x01;
4985 hci_req_add(&req, HCI_OP_READ_TX_POWER,
4986 sizeof(req_txp_cp), &req_txp_cp);
4987 }
4988
4989 err = hci_req_run(&req, conn_info_refresh_complete);
4990 if (err < 0)
4991 goto unlock;
4992
4993 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
4994 data, len);
4995 if (!cmd) {
4996 err = -ENOMEM;
4997 goto unlock;
4998 }
4999
5000 hci_conn_hold(conn);
5001 cmd->user_data = hci_conn_get(conn);
5002 cmd->cmd_complete = conn_info_cmd_complete;
5003
5004 conn->conn_info_timestamp = jiffies;
5005 } else {
5006 /* Cache is valid, just reply with values cached in hci_conn */
5007 rp.rssi = conn->rssi;
5008 rp.tx_power = conn->tx_power;
5009 rp.max_tx_power = conn->max_tx_power;
5010
5011 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5012 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5013 }
5014
5015 unlock:
5016 hci_dev_unlock(hdev);
5017 return err;
5018 }
5019
5020 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5021 {
5022 struct hci_conn *conn = cmd->user_data;
5023 struct mgmt_rp_get_clock_info rp;
5024 struct hci_dev *hdev;
5025 int err;
5026
5027 memset(&rp, 0, sizeof(rp));
5028 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5029
5030 if (status)
5031 goto complete;
5032
5033 hdev = hci_dev_get(cmd->index);
5034 if (hdev) {
5035 rp.local_clock = cpu_to_le32(hdev->clock);
5036 hci_dev_put(hdev);
5037 }
5038
5039 if (conn) {
5040 rp.piconet_clock = cpu_to_le32(conn->clock);
5041 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5042 }
5043
5044 complete:
5045 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5046 sizeof(rp));
5047
5048 if (conn) {
5049 hci_conn_drop(conn);
5050 hci_conn_put(conn);
5051 }
5052
5053 return err;
5054 }
5055
5056 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5057 {
5058 struct hci_cp_read_clock *hci_cp;
5059 struct mgmt_pending_cmd *cmd;
5060 struct hci_conn *conn;
5061
5062 BT_DBG("%s status %u", hdev->name, status);
5063
5064 hci_dev_lock(hdev);
5065
5066 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5067 if (!hci_cp)
5068 goto unlock;
5069
5070 if (hci_cp->which) {
5071 u16 handle = __le16_to_cpu(hci_cp->handle);
5072 conn = hci_conn_hash_lookup_handle(hdev, handle);
5073 } else {
5074 conn = NULL;
5075 }
5076
5077 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5078 if (!cmd)
5079 goto unlock;
5080
5081 cmd->cmd_complete(cmd, mgmt_status(status));
5082 mgmt_pending_remove(cmd);
5083
5084 unlock:
5085 hci_dev_unlock(hdev);
5086 }
5087
5088 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5089 u16 len)
5090 {
5091 struct mgmt_cp_get_clock_info *cp = data;
5092 struct mgmt_rp_get_clock_info rp;
5093 struct hci_cp_read_clock hci_cp;
5094 struct mgmt_pending_cmd *cmd;
5095 struct hci_request req;
5096 struct hci_conn *conn;
5097 int err;
5098
5099 BT_DBG("%s", hdev->name);
5100
5101 memset(&rp, 0, sizeof(rp));
5102 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5103 rp.addr.type = cp->addr.type;
5104
5105 if (cp->addr.type != BDADDR_BREDR)
5106 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5107 MGMT_STATUS_INVALID_PARAMS,
5108 &rp, sizeof(rp));
5109
5110 hci_dev_lock(hdev);
5111
5112 if (!hdev_is_powered(hdev)) {
5113 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5114 MGMT_STATUS_NOT_POWERED, &rp,
5115 sizeof(rp));
5116 goto unlock;
5117 }
5118
5119 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5120 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5121 &cp->addr.bdaddr);
5122 if (!conn || conn->state != BT_CONNECTED) {
5123 err = mgmt_cmd_complete(sk, hdev->id,
5124 MGMT_OP_GET_CLOCK_INFO,
5125 MGMT_STATUS_NOT_CONNECTED,
5126 &rp, sizeof(rp));
5127 goto unlock;
5128 }
5129 } else {
5130 conn = NULL;
5131 }
5132
5133 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5134 if (!cmd) {
5135 err = -ENOMEM;
5136 goto unlock;
5137 }
5138
5139 cmd->cmd_complete = clock_info_cmd_complete;
5140
5141 hci_req_init(&req, hdev);
5142
5143 memset(&hci_cp, 0, sizeof(hci_cp));
5144 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5145
5146 if (conn) {
5147 hci_conn_hold(conn);
5148 cmd->user_data = hci_conn_get(conn);
5149
5150 hci_cp.handle = cpu_to_le16(conn->handle);
5151 hci_cp.which = 0x01; /* Piconet clock */
5152 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5153 }
5154
5155 err = hci_req_run(&req, get_clock_info_complete);
5156 if (err < 0)
5157 mgmt_pending_remove(cmd);
5158
5159 unlock:
5160 hci_dev_unlock(hdev);
5161 return err;
5162 }
5163
5164 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5165 {
5166 struct hci_conn *conn;
5167
5168 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5169 if (!conn)
5170 return false;
5171
5172 if (conn->dst_type != type)
5173 return false;
5174
5175 if (conn->state != BT_CONNECTED)
5176 return false;
5177
5178 return true;
5179 }
5180
5181 /* This function requires the caller holds hdev->lock */
5182 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5183 u8 addr_type, u8 auto_connect)
5184 {
5185 struct hci_conn_params *params;
5186
5187 params = hci_conn_params_add(hdev, addr, addr_type);
5188 if (!params)
5189 return -EIO;
5190
5191 if (params->auto_connect == auto_connect)
5192 return 0;
5193
5194 list_del_init(&params->action);
5195
5196 switch (auto_connect) {
5197 case HCI_AUTO_CONN_DISABLED:
5198 case HCI_AUTO_CONN_LINK_LOSS:
5199 /* If auto connect is being disabled when we're trying to
5200 * connect to device, keep connecting.
5201 */
5202 if (params->explicit_connect)
5203 list_add(&params->action, &hdev->pend_le_conns);
5204 break;
5205 case HCI_AUTO_CONN_REPORT:
5206 if (params->explicit_connect)
5207 list_add(&params->action, &hdev->pend_le_conns);
5208 else
5209 list_add(&params->action, &hdev->pend_le_reports);
5210 break;
5211 case HCI_AUTO_CONN_DIRECT:
5212 case HCI_AUTO_CONN_ALWAYS:
5213 if (!is_connected(hdev, addr, addr_type))
5214 list_add(&params->action, &hdev->pend_le_conns);
5215 break;
5216 }
5217
5218 params->auto_connect = auto_connect;
5219
5220 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5221 auto_connect);
5222
5223 return 0;
5224 }
5225
5226 static void device_added(struct sock *sk, struct hci_dev *hdev,
5227 bdaddr_t *bdaddr, u8 type, u8 action)
5228 {
5229 struct mgmt_ev_device_added ev;
5230
5231 bacpy(&ev.addr.bdaddr, bdaddr);
5232 ev.addr.type = type;
5233 ev.action = action;
5234
5235 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5236 }
5237
5238 static int add_device(struct sock *sk, struct hci_dev *hdev,
5239 void *data, u16 len)
5240 {
5241 struct mgmt_cp_add_device *cp = data;
5242 u8 auto_conn, addr_type;
5243 int err;
5244
5245 BT_DBG("%s", hdev->name);
5246
5247 if (!bdaddr_type_is_valid(cp->addr.type) ||
5248 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5249 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5250 MGMT_STATUS_INVALID_PARAMS,
5251 &cp->addr, sizeof(cp->addr));
5252
5253 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5254 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5255 MGMT_STATUS_INVALID_PARAMS,
5256 &cp->addr, sizeof(cp->addr));
5257
5258 hci_dev_lock(hdev);
5259
5260 if (cp->addr.type == BDADDR_BREDR) {
5261 /* Only incoming connections action is supported for now */
5262 if (cp->action != 0x01) {
5263 err = mgmt_cmd_complete(sk, hdev->id,
5264 MGMT_OP_ADD_DEVICE,
5265 MGMT_STATUS_INVALID_PARAMS,
5266 &cp->addr, sizeof(cp->addr));
5267 goto unlock;
5268 }
5269
5270 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5271 cp->addr.type);
5272 if (err)
5273 goto unlock;
5274
5275 hci_req_update_scan(hdev);
5276
5277 goto added;
5278 }
5279
5280 addr_type = le_addr_type(cp->addr.type);
5281
5282 if (cp->action == 0x02)
5283 auto_conn = HCI_AUTO_CONN_ALWAYS;
5284 else if (cp->action == 0x01)
5285 auto_conn = HCI_AUTO_CONN_DIRECT;
5286 else
5287 auto_conn = HCI_AUTO_CONN_REPORT;
5288
5289 /* Kernel internally uses conn_params with resolvable private
5290 * address, but Add Device allows only identity addresses.
5291 * Make sure it is enforced before calling
5292 * hci_conn_params_lookup.
5293 */
5294 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5295 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5296 MGMT_STATUS_INVALID_PARAMS,
5297 &cp->addr, sizeof(cp->addr));
5298 goto unlock;
5299 }
5300
5301 /* If the connection parameters don't exist for this device,
5302 * they will be created and configured with defaults.
5303 */
5304 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5305 auto_conn) < 0) {
5306 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5307 MGMT_STATUS_FAILED, &cp->addr,
5308 sizeof(cp->addr));
5309 goto unlock;
5310 }
5311
5312 hci_update_background_scan(hdev);
5313
5314 added:
5315 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5316
5317 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5318 MGMT_STATUS_SUCCESS, &cp->addr,
5319 sizeof(cp->addr));
5320
5321 unlock:
5322 hci_dev_unlock(hdev);
5323 return err;
5324 }
5325
5326 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5327 bdaddr_t *bdaddr, u8 type)
5328 {
5329 struct mgmt_ev_device_removed ev;
5330
5331 bacpy(&ev.addr.bdaddr, bdaddr);
5332 ev.addr.type = type;
5333
5334 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5335 }
5336
5337 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5338 void *data, u16 len)
5339 {
5340 struct mgmt_cp_remove_device *cp = data;
5341 int err;
5342
5343 BT_DBG("%s", hdev->name);
5344
5345 hci_dev_lock(hdev);
5346
5347 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5348 struct hci_conn_params *params;
5349 u8 addr_type;
5350
5351 if (!bdaddr_type_is_valid(cp->addr.type)) {
5352 err = mgmt_cmd_complete(sk, hdev->id,
5353 MGMT_OP_REMOVE_DEVICE,
5354 MGMT_STATUS_INVALID_PARAMS,
5355 &cp->addr, sizeof(cp->addr));
5356 goto unlock;
5357 }
5358
5359 if (cp->addr.type == BDADDR_BREDR) {
5360 err = hci_bdaddr_list_del(&hdev->whitelist,
5361 &cp->addr.bdaddr,
5362 cp->addr.type);
5363 if (err) {
5364 err = mgmt_cmd_complete(sk, hdev->id,
5365 MGMT_OP_REMOVE_DEVICE,
5366 MGMT_STATUS_INVALID_PARAMS,
5367 &cp->addr,
5368 sizeof(cp->addr));
5369 goto unlock;
5370 }
5371
5372 hci_req_update_scan(hdev);
5373
5374 device_removed(sk, hdev, &cp->addr.bdaddr,
5375 cp->addr.type);
5376 goto complete;
5377 }
5378
5379 addr_type = le_addr_type(cp->addr.type);
5380
5381 /* Kernel internally uses conn_params with resolvable private
5382 * address, but Remove Device allows only identity addresses.
5383 * Make sure it is enforced before calling
5384 * hci_conn_params_lookup.
5385 */
5386 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5387 err = mgmt_cmd_complete(sk, hdev->id,
5388 MGMT_OP_REMOVE_DEVICE,
5389 MGMT_STATUS_INVALID_PARAMS,
5390 &cp->addr, sizeof(cp->addr));
5391 goto unlock;
5392 }
5393
5394 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5395 addr_type);
5396 if (!params) {
5397 err = mgmt_cmd_complete(sk, hdev->id,
5398 MGMT_OP_REMOVE_DEVICE,
5399 MGMT_STATUS_INVALID_PARAMS,
5400 &cp->addr, sizeof(cp->addr));
5401 goto unlock;
5402 }
5403
5404 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5405 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5406 err = mgmt_cmd_complete(sk, hdev->id,
5407 MGMT_OP_REMOVE_DEVICE,
5408 MGMT_STATUS_INVALID_PARAMS,
5409 &cp->addr, sizeof(cp->addr));
5410 goto unlock;
5411 }
5412
5413 list_del(&params->action);
5414 list_del(&params->list);
5415 kfree(params);
5416 hci_update_background_scan(hdev);
5417
5418 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5419 } else {
5420 struct hci_conn_params *p, *tmp;
5421 struct bdaddr_list *b, *btmp;
5422
5423 if (cp->addr.type) {
5424 err = mgmt_cmd_complete(sk, hdev->id,
5425 MGMT_OP_REMOVE_DEVICE,
5426 MGMT_STATUS_INVALID_PARAMS,
5427 &cp->addr, sizeof(cp->addr));
5428 goto unlock;
5429 }
5430
5431 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5432 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5433 list_del(&b->list);
5434 kfree(b);
5435 }
5436
5437 hci_req_update_scan(hdev);
5438
5439 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5440 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5441 continue;
5442 device_removed(sk, hdev, &p->addr, p->addr_type);
5443 if (p->explicit_connect) {
5444 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5445 continue;
5446 }
5447 list_del(&p->action);
5448 list_del(&p->list);
5449 kfree(p);
5450 }
5451
5452 BT_DBG("All LE connection parameters were removed");
5453
5454 hci_update_background_scan(hdev);
5455 }
5456
5457 complete:
5458 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5459 MGMT_STATUS_SUCCESS, &cp->addr,
5460 sizeof(cp->addr));
5461 unlock:
5462 hci_dev_unlock(hdev);
5463 return err;
5464 }
5465
5466 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5467 u16 len)
5468 {
5469 struct mgmt_cp_load_conn_param *cp = data;
5470 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5471 sizeof(struct mgmt_conn_param));
5472 u16 param_count, expected_len;
5473 int i;
5474
5475 if (!lmp_le_capable(hdev))
5476 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5477 MGMT_STATUS_NOT_SUPPORTED);
5478
5479 param_count = __le16_to_cpu(cp->param_count);
5480 if (param_count > max_param_count) {
5481 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5482 param_count);
5483 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5484 MGMT_STATUS_INVALID_PARAMS);
5485 }
5486
5487 expected_len = sizeof(*cp) + param_count *
5488 sizeof(struct mgmt_conn_param);
5489 if (expected_len != len) {
5490 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5491 expected_len, len);
5492 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5493 MGMT_STATUS_INVALID_PARAMS);
5494 }
5495
5496 BT_DBG("%s param_count %u", hdev->name, param_count);
5497
5498 hci_dev_lock(hdev);
5499
5500 hci_conn_params_clear_disabled(hdev);
5501
5502 for (i = 0; i < param_count; i++) {
5503 struct mgmt_conn_param *param = &cp->params[i];
5504 struct hci_conn_params *hci_param;
5505 u16 min, max, latency, timeout;
5506 u8 addr_type;
5507
5508 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5509 param->addr.type);
5510
5511 if (param->addr.type == BDADDR_LE_PUBLIC) {
5512 addr_type = ADDR_LE_DEV_PUBLIC;
5513 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5514 addr_type = ADDR_LE_DEV_RANDOM;
5515 } else {
5516 bt_dev_err(hdev, "ignoring invalid connection parameters");
5517 continue;
5518 }
5519
5520 min = le16_to_cpu(param->min_interval);
5521 max = le16_to_cpu(param->max_interval);
5522 latency = le16_to_cpu(param->latency);
5523 timeout = le16_to_cpu(param->timeout);
5524
5525 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5526 min, max, latency, timeout);
5527
5528 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5529 bt_dev_err(hdev, "ignoring invalid connection parameters");
5530 continue;
5531 }
5532
5533 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5534 addr_type);
5535 if (!hci_param) {
5536 bt_dev_err(hdev, "failed to add connection parameters");
5537 continue;
5538 }
5539
5540 hci_param->conn_min_interval = min;
5541 hci_param->conn_max_interval = max;
5542 hci_param->conn_latency = latency;
5543 hci_param->supervision_timeout = timeout;
5544 }
5545
5546 hci_dev_unlock(hdev);
5547
5548 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5549 NULL, 0);
5550 }
5551
5552 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5553 void *data, u16 len)
5554 {
5555 struct mgmt_cp_set_external_config *cp = data;
5556 bool changed;
5557 int err;
5558
5559 BT_DBG("%s", hdev->name);
5560
5561 if (hdev_is_powered(hdev))
5562 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5563 MGMT_STATUS_REJECTED);
5564
5565 if (cp->config != 0x00 && cp->config != 0x01)
5566 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5567 MGMT_STATUS_INVALID_PARAMS);
5568
5569 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5570 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5571 MGMT_STATUS_NOT_SUPPORTED);
5572
5573 hci_dev_lock(hdev);
5574
5575 if (cp->config)
5576 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5577 else
5578 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5579
5580 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5581 if (err < 0)
5582 goto unlock;
5583
5584 if (!changed)
5585 goto unlock;
5586
5587 err = new_options(hdev, sk);
5588
5589 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5590 mgmt_index_removed(hdev);
5591
5592 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5593 hci_dev_set_flag(hdev, HCI_CONFIG);
5594 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5595
5596 queue_work(hdev->req_workqueue, &hdev->power_on);
5597 } else {
5598 set_bit(HCI_RAW, &hdev->flags);
5599 mgmt_index_added(hdev);
5600 }
5601 }
5602
5603 unlock:
5604 hci_dev_unlock(hdev);
5605 return err;
5606 }
5607
5608 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5609 void *data, u16 len)
5610 {
5611 struct mgmt_cp_set_public_address *cp = data;
5612 bool changed;
5613 int err;
5614
5615 BT_DBG("%s", hdev->name);
5616
5617 if (hdev_is_powered(hdev))
5618 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5619 MGMT_STATUS_REJECTED);
5620
5621 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5622 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5623 MGMT_STATUS_INVALID_PARAMS);
5624
5625 if (!hdev->set_bdaddr)
5626 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5627 MGMT_STATUS_NOT_SUPPORTED);
5628
5629 hci_dev_lock(hdev);
5630
5631 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5632 bacpy(&hdev->public_addr, &cp->bdaddr);
5633
5634 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5635 if (err < 0)
5636 goto unlock;
5637
5638 if (!changed)
5639 goto unlock;
5640
5641 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5642 err = new_options(hdev, sk);
5643
5644 if (is_configured(hdev)) {
5645 mgmt_index_removed(hdev);
5646
5647 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
5648
5649 hci_dev_set_flag(hdev, HCI_CONFIG);
5650 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5651
5652 queue_work(hdev->req_workqueue, &hdev->power_on);
5653 }
5654
5655 unlock:
5656 hci_dev_unlock(hdev);
5657 return err;
5658 }
5659
5660 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
5661 u16 opcode, struct sk_buff *skb)
5662 {
5663 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
5664 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
5665 u8 *h192, *r192, *h256, *r256;
5666 struct mgmt_pending_cmd *cmd;
5667 u16 eir_len;
5668 int err;
5669
5670 BT_DBG("%s status %u", hdev->name, status);
5671
5672 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
5673 if (!cmd)
5674 return;
5675
5676 mgmt_cp = cmd->param;
5677
5678 if (status) {
5679 status = mgmt_status(status);
5680 eir_len = 0;
5681
5682 h192 = NULL;
5683 r192 = NULL;
5684 h256 = NULL;
5685 r256 = NULL;
5686 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
5687 struct hci_rp_read_local_oob_data *rp;
5688
5689 if (skb->len != sizeof(*rp)) {
5690 status = MGMT_STATUS_FAILED;
5691 eir_len = 0;
5692 } else {
5693 status = MGMT_STATUS_SUCCESS;
5694 rp = (void *)skb->data;
5695
5696 eir_len = 5 + 18 + 18;
5697 h192 = rp->hash;
5698 r192 = rp->rand;
5699 h256 = NULL;
5700 r256 = NULL;
5701 }
5702 } else {
5703 struct hci_rp_read_local_oob_ext_data *rp;
5704
5705 if (skb->len != sizeof(*rp)) {
5706 status = MGMT_STATUS_FAILED;
5707 eir_len = 0;
5708 } else {
5709 status = MGMT_STATUS_SUCCESS;
5710 rp = (void *)skb->data;
5711
5712 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5713 eir_len = 5 + 18 + 18;
5714 h192 = NULL;
5715 r192 = NULL;
5716 } else {
5717 eir_len = 5 + 18 + 18 + 18 + 18;
5718 h192 = rp->hash192;
5719 r192 = rp->rand192;
5720 }
5721
5722 h256 = rp->hash256;
5723 r256 = rp->rand256;
5724 }
5725 }
5726
5727 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
5728 if (!mgmt_rp)
5729 goto done;
5730
5731 if (status)
5732 goto send_rsp;
5733
5734 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
5735 hdev->dev_class, 3);
5736
5737 if (h192 && r192) {
5738 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5739 EIR_SSP_HASH_C192, h192, 16);
5740 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5741 EIR_SSP_RAND_R192, r192, 16);
5742 }
5743
5744 if (h256 && r256) {
5745 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5746 EIR_SSP_HASH_C256, h256, 16);
5747 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
5748 EIR_SSP_RAND_R256, r256, 16);
5749 }
5750
5751 send_rsp:
5752 mgmt_rp->type = mgmt_cp->type;
5753 mgmt_rp->eir_len = cpu_to_le16(eir_len);
5754
5755 err = mgmt_cmd_complete(cmd->sk, hdev->id,
5756 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
5757 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
5758 if (err < 0 || status)
5759 goto done;
5760
5761 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
5762
5763 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5764 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
5765 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
5766 done:
5767 kfree(mgmt_rp);
5768 mgmt_pending_remove(cmd);
5769 }
5770
5771 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
5772 struct mgmt_cp_read_local_oob_ext_data *cp)
5773 {
5774 struct mgmt_pending_cmd *cmd;
5775 struct hci_request req;
5776 int err;
5777
5778 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
5779 cp, sizeof(*cp));
5780 if (!cmd)
5781 return -ENOMEM;
5782
5783 hci_req_init(&req, hdev);
5784
5785 if (bredr_sc_enabled(hdev))
5786 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
5787 else
5788 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
5789
5790 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
5791 if (err < 0) {
5792 mgmt_pending_remove(cmd);
5793 return err;
5794 }
5795
5796 return 0;
5797 }
5798
5799 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
5800 void *data, u16 data_len)
5801 {
5802 struct mgmt_cp_read_local_oob_ext_data *cp = data;
5803 struct mgmt_rp_read_local_oob_ext_data *rp;
5804 size_t rp_len;
5805 u16 eir_len;
5806 u8 status, flags, role, addr[7], hash[16], rand[16];
5807 int err;
5808
5809 BT_DBG("%s", hdev->name);
5810
5811 if (hdev_is_powered(hdev)) {
5812 switch (cp->type) {
5813 case BIT(BDADDR_BREDR):
5814 status = mgmt_bredr_support(hdev);
5815 if (status)
5816 eir_len = 0;
5817 else
5818 eir_len = 5;
5819 break;
5820 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5821 status = mgmt_le_support(hdev);
5822 if (status)
5823 eir_len = 0;
5824 else
5825 eir_len = 9 + 3 + 18 + 18 + 3;
5826 break;
5827 default:
5828 status = MGMT_STATUS_INVALID_PARAMS;
5829 eir_len = 0;
5830 break;
5831 }
5832 } else {
5833 status = MGMT_STATUS_NOT_POWERED;
5834 eir_len = 0;
5835 }
5836
5837 rp_len = sizeof(*rp) + eir_len;
5838 rp = kmalloc(rp_len, GFP_ATOMIC);
5839 if (!rp)
5840 return -ENOMEM;
5841
5842 if (status)
5843 goto complete;
5844
5845 hci_dev_lock(hdev);
5846
5847 eir_len = 0;
5848 switch (cp->type) {
5849 case BIT(BDADDR_BREDR):
5850 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
5851 err = read_local_ssp_oob_req(hdev, sk, cp);
5852 hci_dev_unlock(hdev);
5853 if (!err)
5854 goto done;
5855
5856 status = MGMT_STATUS_FAILED;
5857 goto complete;
5858 } else {
5859 eir_len = eir_append_data(rp->eir, eir_len,
5860 EIR_CLASS_OF_DEV,
5861 hdev->dev_class, 3);
5862 }
5863 break;
5864 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5865 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5866 smp_generate_oob(hdev, hash, rand) < 0) {
5867 hci_dev_unlock(hdev);
5868 status = MGMT_STATUS_FAILED;
5869 goto complete;
5870 }
5871
5872 /* This should return the active RPA, but since the RPA
5873 * is only programmed on demand, it is really hard to fill
5874 * this in at the moment. For now disallow retrieving
5875 * local out-of-band data when privacy is in use.
5876 *
5877 * Returning the identity address will not help here since
5878 * pairing happens before the identity resolving key is
5879 * known and thus the connection establishment happens
5880 * based on the RPA and not the identity address.
5881 */
5882 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5883 hci_dev_unlock(hdev);
5884 status = MGMT_STATUS_REJECTED;
5885 goto complete;
5886 }
5887
5888 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
5889 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
5890 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
5891 bacmp(&hdev->static_addr, BDADDR_ANY))) {
5892 memcpy(addr, &hdev->static_addr, 6);
5893 addr[6] = 0x01;
5894 } else {
5895 memcpy(addr, &hdev->bdaddr, 6);
5896 addr[6] = 0x00;
5897 }
5898
5899 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
5900 addr, sizeof(addr));
5901
5902 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
5903 role = 0x02;
5904 else
5905 role = 0x01;
5906
5907 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
5908 &role, sizeof(role));
5909
5910 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
5911 eir_len = eir_append_data(rp->eir, eir_len,
5912 EIR_LE_SC_CONFIRM,
5913 hash, sizeof(hash));
5914
5915 eir_len = eir_append_data(rp->eir, eir_len,
5916 EIR_LE_SC_RANDOM,
5917 rand, sizeof(rand));
5918 }
5919
5920 flags = mgmt_get_adv_discov_flags(hdev);
5921
5922 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5923 flags |= LE_AD_NO_BREDR;
5924
5925 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
5926 &flags, sizeof(flags));
5927 break;
5928 }
5929
5930 hci_dev_unlock(hdev);
5931
5932 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
5933
5934 status = MGMT_STATUS_SUCCESS;
5935
5936 complete:
5937 rp->type = cp->type;
5938 rp->eir_len = cpu_to_le16(eir_len);
5939
5940 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5941 status, rp, sizeof(*rp) + eir_len);
5942 if (err < 0 || status)
5943 goto done;
5944
5945 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
5946 rp, sizeof(*rp) + eir_len,
5947 HCI_MGMT_OOB_DATA_EVENTS, sk);
5948
5949 done:
5950 kfree(rp);
5951
5952 return err;
5953 }
5954
5955 static u32 get_supported_adv_flags(struct hci_dev *hdev)
5956 {
5957 u32 flags = 0;
5958
5959 flags |= MGMT_ADV_FLAG_CONNECTABLE;
5960 flags |= MGMT_ADV_FLAG_DISCOV;
5961 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
5962 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
5963 flags |= MGMT_ADV_FLAG_APPEARANCE;
5964 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
5965
5966 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
5967 flags |= MGMT_ADV_FLAG_TX_POWER;
5968
5969 return flags;
5970 }
5971
5972 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
5973 void *data, u16 data_len)
5974 {
5975 struct mgmt_rp_read_adv_features *rp;
5976 size_t rp_len;
5977 int err;
5978 struct adv_info *adv_instance;
5979 u32 supported_flags;
5980 u8 *instance;
5981
5982 BT_DBG("%s", hdev->name);
5983
5984 if (!lmp_le_capable(hdev))
5985 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
5986 MGMT_STATUS_REJECTED);
5987
5988 hci_dev_lock(hdev);
5989
5990 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
5991 rp = kmalloc(rp_len, GFP_ATOMIC);
5992 if (!rp) {
5993 hci_dev_unlock(hdev);
5994 return -ENOMEM;
5995 }
5996
5997 supported_flags = get_supported_adv_flags(hdev);
5998
5999 rp->supported_flags = cpu_to_le32(supported_flags);
6000 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6001 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6002 rp->max_instances = HCI_MAX_ADV_INSTANCES;
6003 rp->num_instances = hdev->adv_instance_cnt;
6004
6005 instance = rp->instance;
6006 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6007 *instance = adv_instance->instance;
6008 instance++;
6009 }
6010
6011 hci_dev_unlock(hdev);
6012
6013 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6014 MGMT_STATUS_SUCCESS, rp, rp_len);
6015
6016 kfree(rp);
6017
6018 return err;
6019 }
6020
6021 static u8 calculate_name_len(struct hci_dev *hdev)
6022 {
6023 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6024
6025 return append_local_name(hdev, buf, 0);
6026 }
6027
6028 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6029 bool is_adv_data)
6030 {
6031 u8 max_len = HCI_MAX_AD_LENGTH;
6032
6033 if (is_adv_data) {
6034 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6035 MGMT_ADV_FLAG_LIMITED_DISCOV |
6036 MGMT_ADV_FLAG_MANAGED_FLAGS))
6037 max_len -= 3;
6038
6039 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6040 max_len -= 3;
6041 } else {
6042 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6043 max_len -= calculate_name_len(hdev);
6044
6045 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6046 max_len -= 4;
6047 }
6048
6049 return max_len;
6050 }
6051
6052 static bool flags_managed(u32 adv_flags)
6053 {
6054 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6055 MGMT_ADV_FLAG_LIMITED_DISCOV |
6056 MGMT_ADV_FLAG_MANAGED_FLAGS);
6057 }
6058
6059 static bool tx_power_managed(u32 adv_flags)
6060 {
6061 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6062 }
6063
6064 static bool name_managed(u32 adv_flags)
6065 {
6066 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6067 }
6068
6069 static bool appearance_managed(u32 adv_flags)
6070 {
6071 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6072 }
6073
6074 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6075 u8 len, bool is_adv_data)
6076 {
6077 int i, cur_len;
6078 u8 max_len;
6079
6080 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6081
6082 if (len > max_len)
6083 return false;
6084
6085 /* Make sure that the data is correctly formatted. */
6086 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6087 cur_len = data[i];
6088
6089 if (data[i + 1] == EIR_FLAGS &&
6090 (!is_adv_data || flags_managed(adv_flags)))
6091 return false;
6092
6093 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6094 return false;
6095
6096 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6097 return false;
6098
6099 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6100 return false;
6101
6102 if (data[i + 1] == EIR_APPEARANCE &&
6103 appearance_managed(adv_flags))
6104 return false;
6105
6106 /* If the current field length would exceed the total data
6107 * length, then it's invalid.
6108 */
6109 if (i + cur_len >= len)
6110 return false;
6111 }
6112
6113 return true;
6114 }
6115
6116 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6117 u16 opcode)
6118 {
6119 struct mgmt_pending_cmd *cmd;
6120 struct mgmt_cp_add_advertising *cp;
6121 struct mgmt_rp_add_advertising rp;
6122 struct adv_info *adv_instance, *n;
6123 u8 instance;
6124
6125 BT_DBG("status %d", status);
6126
6127 hci_dev_lock(hdev);
6128
6129 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6130
6131 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6132 if (!adv_instance->pending)
6133 continue;
6134
6135 if (!status) {
6136 adv_instance->pending = false;
6137 continue;
6138 }
6139
6140 instance = adv_instance->instance;
6141
6142 if (hdev->cur_adv_instance == instance)
6143 cancel_adv_timeout(hdev);
6144
6145 hci_remove_adv_instance(hdev, instance);
6146 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6147 }
6148
6149 if (!cmd)
6150 goto unlock;
6151
6152 cp = cmd->param;
6153 rp.instance = cp->instance;
6154
6155 if (status)
6156 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6157 mgmt_status(status));
6158 else
6159 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6160 mgmt_status(status), &rp, sizeof(rp));
6161
6162 mgmt_pending_remove(cmd);
6163
6164 unlock:
6165 hci_dev_unlock(hdev);
6166 }
6167
6168 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6169 void *data, u16 data_len)
6170 {
6171 struct mgmt_cp_add_advertising *cp = data;
6172 struct mgmt_rp_add_advertising rp;
6173 u32 flags;
6174 u32 supported_flags;
6175 u8 status;
6176 u16 timeout, duration;
6177 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6178 u8 schedule_instance = 0;
6179 struct adv_info *next_instance;
6180 int err;
6181 struct mgmt_pending_cmd *cmd;
6182 struct hci_request req;
6183
6184 BT_DBG("%s", hdev->name);
6185
6186 status = mgmt_le_support(hdev);
6187 if (status)
6188 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6189 status);
6190
6191 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6192 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6193 MGMT_STATUS_INVALID_PARAMS);
6194
6195 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6196 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6197 MGMT_STATUS_INVALID_PARAMS);
6198
6199 flags = __le32_to_cpu(cp->flags);
6200 timeout = __le16_to_cpu(cp->timeout);
6201 duration = __le16_to_cpu(cp->duration);
6202
6203 /* The current implementation only supports a subset of the specified
6204 * flags.
6205 */
6206 supported_flags = get_supported_adv_flags(hdev);
6207 if (flags & ~supported_flags)
6208 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6209 MGMT_STATUS_INVALID_PARAMS);
6210
6211 hci_dev_lock(hdev);
6212
6213 if (timeout && !hdev_is_powered(hdev)) {
6214 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6215 MGMT_STATUS_REJECTED);
6216 goto unlock;
6217 }
6218
6219 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6220 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6221 pending_find(MGMT_OP_SET_LE, hdev)) {
6222 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6223 MGMT_STATUS_BUSY);
6224 goto unlock;
6225 }
6226
6227 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6228 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6229 cp->scan_rsp_len, false)) {
6230 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6231 MGMT_STATUS_INVALID_PARAMS);
6232 goto unlock;
6233 }
6234
6235 err = hci_add_adv_instance(hdev, cp->instance, flags,
6236 cp->adv_data_len, cp->data,
6237 cp->scan_rsp_len,
6238 cp->data + cp->adv_data_len,
6239 timeout, duration);
6240 if (err < 0) {
6241 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6242 MGMT_STATUS_FAILED);
6243 goto unlock;
6244 }
6245
6246 /* Only trigger an advertising added event if a new instance was
6247 * actually added.
6248 */
6249 if (hdev->adv_instance_cnt > prev_instance_cnt)
6250 mgmt_advertising_added(sk, hdev, cp->instance);
6251
6252 if (hdev->cur_adv_instance == cp->instance) {
6253 /* If the currently advertised instance is being changed then
6254 * cancel the current advertising and schedule the next
6255 * instance. If there is only one instance then the overridden
6256 * advertising data will be visible right away.
6257 */
6258 cancel_adv_timeout(hdev);
6259
6260 next_instance = hci_get_next_instance(hdev, cp->instance);
6261 if (next_instance)
6262 schedule_instance = next_instance->instance;
6263 } else if (!hdev->adv_instance_timeout) {
6264 /* Immediately advertise the new instance if no other
6265 * instance is currently being advertised.
6266 */
6267 schedule_instance = cp->instance;
6268 }
6269
6270 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6271 * there is no instance to be advertised then we have no HCI
6272 * communication to make. Simply return.
6273 */
6274 if (!hdev_is_powered(hdev) ||
6275 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6276 !schedule_instance) {
6277 rp.instance = cp->instance;
6278 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6279 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6280 goto unlock;
6281 }
6282
6283 /* We're good to go, update advertising data, parameters, and start
6284 * advertising.
6285 */
6286 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6287 data_len);
6288 if (!cmd) {
6289 err = -ENOMEM;
6290 goto unlock;
6291 }
6292
6293 hci_req_init(&req, hdev);
6294
6295 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6296
6297 if (!err)
6298 err = hci_req_run(&req, add_advertising_complete);
6299
6300 if (err < 0)
6301 mgmt_pending_remove(cmd);
6302
6303 unlock:
6304 hci_dev_unlock(hdev);
6305
6306 return err;
6307 }
6308
6309 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6310 u16 opcode)
6311 {
6312 struct mgmt_pending_cmd *cmd;
6313 struct mgmt_cp_remove_advertising *cp;
6314 struct mgmt_rp_remove_advertising rp;
6315
6316 BT_DBG("status %d", status);
6317
6318 hci_dev_lock(hdev);
6319
6320 /* A failure status here only means that we failed to disable
6321 * advertising. Otherwise, the advertising instance has been removed,
6322 * so report success.
6323 */
6324 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6325 if (!cmd)
6326 goto unlock;
6327
6328 cp = cmd->param;
6329 rp.instance = cp->instance;
6330
6331 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6332 &rp, sizeof(rp));
6333 mgmt_pending_remove(cmd);
6334
6335 unlock:
6336 hci_dev_unlock(hdev);
6337 }
6338
6339 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6340 void *data, u16 data_len)
6341 {
6342 struct mgmt_cp_remove_advertising *cp = data;
6343 struct mgmt_rp_remove_advertising rp;
6344 struct mgmt_pending_cmd *cmd;
6345 struct hci_request req;
6346 int err;
6347
6348 BT_DBG("%s", hdev->name);
6349
6350 hci_dev_lock(hdev);
6351
6352 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6353 err = mgmt_cmd_status(sk, hdev->id,
6354 MGMT_OP_REMOVE_ADVERTISING,
6355 MGMT_STATUS_INVALID_PARAMS);
6356 goto unlock;
6357 }
6358
6359 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6360 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6361 pending_find(MGMT_OP_SET_LE, hdev)) {
6362 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6363 MGMT_STATUS_BUSY);
6364 goto unlock;
6365 }
6366
6367 if (list_empty(&hdev->adv_instances)) {
6368 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6369 MGMT_STATUS_INVALID_PARAMS);
6370 goto unlock;
6371 }
6372
6373 hci_req_init(&req, hdev);
6374
6375 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6376
6377 if (list_empty(&hdev->adv_instances))
6378 __hci_req_disable_advertising(&req);
6379
6380 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6381 * flag is set or the device isn't powered then we have no HCI
6382 * communication to make. Simply return.
6383 */
6384 if (skb_queue_empty(&req.cmd_q) ||
6385 !hdev_is_powered(hdev) ||
6386 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6387 hci_req_purge(&req);
6388 rp.instance = cp->instance;
6389 err = mgmt_cmd_complete(sk, hdev->id,
6390 MGMT_OP_REMOVE_ADVERTISING,
6391 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6392 goto unlock;
6393 }
6394
6395 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6396 data_len);
6397 if (!cmd) {
6398 err = -ENOMEM;
6399 goto unlock;
6400 }
6401
6402 err = hci_req_run(&req, remove_advertising_complete);
6403 if (err < 0)
6404 mgmt_pending_remove(cmd);
6405
6406 unlock:
6407 hci_dev_unlock(hdev);
6408
6409 return err;
6410 }
6411
6412 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6413 void *data, u16 data_len)
6414 {
6415 struct mgmt_cp_get_adv_size_info *cp = data;
6416 struct mgmt_rp_get_adv_size_info rp;
6417 u32 flags, supported_flags;
6418 int err;
6419
6420 BT_DBG("%s", hdev->name);
6421
6422 if (!lmp_le_capable(hdev))
6423 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6424 MGMT_STATUS_REJECTED);
6425
6426 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6427 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6428 MGMT_STATUS_INVALID_PARAMS);
6429
6430 flags = __le32_to_cpu(cp->flags);
6431
6432 /* The current implementation only supports a subset of the specified
6433 * flags.
6434 */
6435 supported_flags = get_supported_adv_flags(hdev);
6436 if (flags & ~supported_flags)
6437 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6438 MGMT_STATUS_INVALID_PARAMS);
6439
6440 rp.instance = cp->instance;
6441 rp.flags = cp->flags;
6442 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6443 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6444
6445 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6446 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6447
6448 return err;
6449 }
6450
6451 static const struct hci_mgmt_handler mgmt_handlers[] = {
6452 { NULL }, /* 0x0000 (no command) */
6453 { read_version, MGMT_READ_VERSION_SIZE,
6454 HCI_MGMT_NO_HDEV |
6455 HCI_MGMT_UNTRUSTED },
6456 { read_commands, MGMT_READ_COMMANDS_SIZE,
6457 HCI_MGMT_NO_HDEV |
6458 HCI_MGMT_UNTRUSTED },
6459 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
6460 HCI_MGMT_NO_HDEV |
6461 HCI_MGMT_UNTRUSTED },
6462 { read_controller_info, MGMT_READ_INFO_SIZE,
6463 HCI_MGMT_UNTRUSTED },
6464 { set_powered, MGMT_SETTING_SIZE },
6465 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6466 { set_connectable, MGMT_SETTING_SIZE },
6467 { set_fast_connectable, MGMT_SETTING_SIZE },
6468 { set_bondable, MGMT_SETTING_SIZE },
6469 { set_link_security, MGMT_SETTING_SIZE },
6470 { set_ssp, MGMT_SETTING_SIZE },
6471 { set_hs, MGMT_SETTING_SIZE },
6472 { set_le, MGMT_SETTING_SIZE },
6473 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6474 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6475 { add_uuid, MGMT_ADD_UUID_SIZE },
6476 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
6477 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6478 HCI_MGMT_VAR_LEN },
6479 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6480 HCI_MGMT_VAR_LEN },
6481 { disconnect, MGMT_DISCONNECT_SIZE },
6482 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6483 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6484 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6485 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6486 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6487 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6488 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6489 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6490 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6491 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6492 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6493 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6494 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6495 HCI_MGMT_VAR_LEN },
6496 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6497 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6498 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6499 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6500 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6501 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6502 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6503 { set_advertising, MGMT_SETTING_SIZE },
6504 { set_bredr, MGMT_SETTING_SIZE },
6505 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6506 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6507 { set_secure_conn, MGMT_SETTING_SIZE },
6508 { set_debug_keys, MGMT_SETTING_SIZE },
6509 { set_privacy, MGMT_SET_PRIVACY_SIZE },
6510 { load_irks, MGMT_LOAD_IRKS_SIZE,
6511 HCI_MGMT_VAR_LEN },
6512 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6513 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6514 { add_device, MGMT_ADD_DEVICE_SIZE },
6515 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
6516 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6517 HCI_MGMT_VAR_LEN },
6518 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6519 HCI_MGMT_NO_HDEV |
6520 HCI_MGMT_UNTRUSTED },
6521 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
6522 HCI_MGMT_UNCONFIGURED |
6523 HCI_MGMT_UNTRUSTED },
6524 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6525 HCI_MGMT_UNCONFIGURED },
6526 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6527 HCI_MGMT_UNCONFIGURED },
6528 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6529 HCI_MGMT_VAR_LEN },
6530 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6531 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
6532 HCI_MGMT_NO_HDEV |
6533 HCI_MGMT_UNTRUSTED },
6534 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
6535 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
6536 HCI_MGMT_VAR_LEN },
6537 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
6538 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
6539 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6540 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6541 HCI_MGMT_UNTRUSTED },
6542 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
6543 };
6544
6545 void mgmt_index_added(struct hci_dev *hdev)
6546 {
6547 struct mgmt_ev_ext_index ev;
6548
6549 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6550 return;
6551
6552 switch (hdev->dev_type) {
6553 case HCI_PRIMARY:
6554 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6555 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6556 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6557 ev.type = 0x01;
6558 } else {
6559 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6560 HCI_MGMT_INDEX_EVENTS);
6561 ev.type = 0x00;
6562 }
6563 break;
6564 case HCI_AMP:
6565 ev.type = 0x02;
6566 break;
6567 default:
6568 return;
6569 }
6570
6571 ev.bus = hdev->bus;
6572
6573 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6574 HCI_MGMT_EXT_INDEX_EVENTS);
6575 }
6576
6577 void mgmt_index_removed(struct hci_dev *hdev)
6578 {
6579 struct mgmt_ev_ext_index ev;
6580 u8 status = MGMT_STATUS_INVALID_INDEX;
6581
6582 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6583 return;
6584
6585 switch (hdev->dev_type) {
6586 case HCI_PRIMARY:
6587 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6588
6589 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6590 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6591 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6592 ev.type = 0x01;
6593 } else {
6594 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6595 HCI_MGMT_INDEX_EVENTS);
6596 ev.type = 0x00;
6597 }
6598 break;
6599 case HCI_AMP:
6600 ev.type = 0x02;
6601 break;
6602 default:
6603 return;
6604 }
6605
6606 ev.bus = hdev->bus;
6607
6608 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6609 HCI_MGMT_EXT_INDEX_EVENTS);
6610 }
6611
6612 /* This function requires the caller holds hdev->lock */
6613 static void restart_le_actions(struct hci_dev *hdev)
6614 {
6615 struct hci_conn_params *p;
6616
6617 list_for_each_entry(p, &hdev->le_conn_params, list) {
6618 /* Needed for AUTO_OFF case where might not "really"
6619 * have been powered off.
6620 */
6621 list_del_init(&p->action);
6622
6623 switch (p->auto_connect) {
6624 case HCI_AUTO_CONN_DIRECT:
6625 case HCI_AUTO_CONN_ALWAYS:
6626 list_add(&p->action, &hdev->pend_le_conns);
6627 break;
6628 case HCI_AUTO_CONN_REPORT:
6629 list_add(&p->action, &hdev->pend_le_reports);
6630 break;
6631 default:
6632 break;
6633 }
6634 }
6635 }
6636
6637 void mgmt_power_on(struct hci_dev *hdev, int err)
6638 {
6639 struct cmd_lookup match = { NULL, hdev };
6640
6641 BT_DBG("err %d", err);
6642
6643 hci_dev_lock(hdev);
6644
6645 if (!err) {
6646 restart_le_actions(hdev);
6647 hci_update_background_scan(hdev);
6648 }
6649
6650 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6651
6652 new_settings(hdev, match.sk);
6653
6654 if (match.sk)
6655 sock_put(match.sk);
6656
6657 hci_dev_unlock(hdev);
6658 }
6659
6660 void __mgmt_power_off(struct hci_dev *hdev)
6661 {
6662 struct cmd_lookup match = { NULL, hdev };
6663 u8 status, zero_cod[] = { 0, 0, 0 };
6664
6665 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6666
6667 /* If the power off is because of hdev unregistration let
6668 * use the appropriate INVALID_INDEX status. Otherwise use
6669 * NOT_POWERED. We cover both scenarios here since later in
6670 * mgmt_index_removed() any hci_conn callbacks will have already
6671 * been triggered, potentially causing misleading DISCONNECTED
6672 * status responses.
6673 */
6674 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
6675 status = MGMT_STATUS_INVALID_INDEX;
6676 else
6677 status = MGMT_STATUS_NOT_POWERED;
6678
6679 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6680
6681 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
6682 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6683 zero_cod, sizeof(zero_cod),
6684 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
6685 ext_info_changed(hdev, NULL);
6686 }
6687
6688 new_settings(hdev, match.sk);
6689
6690 if (match.sk)
6691 sock_put(match.sk);
6692 }
6693
6694 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6695 {
6696 struct mgmt_pending_cmd *cmd;
6697 u8 status;
6698
6699 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6700 if (!cmd)
6701 return;
6702
6703 if (err == -ERFKILL)
6704 status = MGMT_STATUS_RFKILLED;
6705 else
6706 status = MGMT_STATUS_FAILED;
6707
6708 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6709
6710 mgmt_pending_remove(cmd);
6711 }
6712
6713 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6714 bool persistent)
6715 {
6716 struct mgmt_ev_new_link_key ev;
6717
6718 memset(&ev, 0, sizeof(ev));
6719
6720 ev.store_hint = persistent;
6721 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6722 ev.key.addr.type = BDADDR_BREDR;
6723 ev.key.type = key->type;
6724 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6725 ev.key.pin_len = key->pin_len;
6726
6727 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6728 }
6729
6730 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6731 {
6732 switch (ltk->type) {
6733 case SMP_LTK:
6734 case SMP_LTK_SLAVE:
6735 if (ltk->authenticated)
6736 return MGMT_LTK_AUTHENTICATED;
6737 return MGMT_LTK_UNAUTHENTICATED;
6738 case SMP_LTK_P256:
6739 if (ltk->authenticated)
6740 return MGMT_LTK_P256_AUTH;
6741 return MGMT_LTK_P256_UNAUTH;
6742 case SMP_LTK_P256_DEBUG:
6743 return MGMT_LTK_P256_DEBUG;
6744 }
6745
6746 return MGMT_LTK_UNAUTHENTICATED;
6747 }
6748
6749 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6750 {
6751 struct mgmt_ev_new_long_term_key ev;
6752
6753 memset(&ev, 0, sizeof(ev));
6754
6755 /* Devices using resolvable or non-resolvable random addresses
6756 * without providing an identity resolving key don't require
6757 * to store long term keys. Their addresses will change the
6758 * next time around.
6759 *
6760 * Only when a remote device provides an identity address
6761 * make sure the long term key is stored. If the remote
6762 * identity is known, the long term keys are internally
6763 * mapped to the identity address. So allow static random
6764 * and public addresses here.
6765 */
6766 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6767 (key->bdaddr.b[5] & 0xc0) != 0xc0)
6768 ev.store_hint = 0x00;
6769 else
6770 ev.store_hint = persistent;
6771
6772 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6773 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6774 ev.key.type = mgmt_ltk_type(key);
6775 ev.key.enc_size = key->enc_size;
6776 ev.key.ediv = key->ediv;
6777 ev.key.rand = key->rand;
6778
6779 if (key->type == SMP_LTK)
6780 ev.key.master = 1;
6781
6782 /* Make sure we copy only the significant bytes based on the
6783 * encryption key size, and set the rest of the value to zeroes.
6784 */
6785 memcpy(ev.key.val, key->val, key->enc_size);
6786 memset(ev.key.val + key->enc_size, 0,
6787 sizeof(ev.key.val) - key->enc_size);
6788
6789 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6790 }
6791
6792 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
6793 {
6794 struct mgmt_ev_new_irk ev;
6795
6796 memset(&ev, 0, sizeof(ev));
6797
6798 ev.store_hint = persistent;
6799
6800 bacpy(&ev.rpa, &irk->rpa);
6801 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6802 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6803 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6804
6805 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6806 }
6807
6808 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6809 bool persistent)
6810 {
6811 struct mgmt_ev_new_csrk ev;
6812
6813 memset(&ev, 0, sizeof(ev));
6814
6815 /* Devices using resolvable or non-resolvable random addresses
6816 * without providing an identity resolving key don't require
6817 * to store signature resolving keys. Their addresses will change
6818 * the next time around.
6819 *
6820 * Only when a remote device provides an identity address
6821 * make sure the signature resolving key is stored. So allow
6822 * static random and public addresses here.
6823 */
6824 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6825 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6826 ev.store_hint = 0x00;
6827 else
6828 ev.store_hint = persistent;
6829
6830 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6831 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6832 ev.key.type = csrk->type;
6833 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6834
6835 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6836 }
6837
6838 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6839 u8 bdaddr_type, u8 store_hint, u16 min_interval,
6840 u16 max_interval, u16 latency, u16 timeout)
6841 {
6842 struct mgmt_ev_new_conn_param ev;
6843
6844 if (!hci_is_identity_address(bdaddr, bdaddr_type))
6845 return;
6846
6847 memset(&ev, 0, sizeof(ev));
6848 bacpy(&ev.addr.bdaddr, bdaddr);
6849 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6850 ev.store_hint = store_hint;
6851 ev.min_interval = cpu_to_le16(min_interval);
6852 ev.max_interval = cpu_to_le16(max_interval);
6853 ev.latency = cpu_to_le16(latency);
6854 ev.timeout = cpu_to_le16(timeout);
6855
6856 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6857 }
6858
6859 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6860 u32 flags, u8 *name, u8 name_len)
6861 {
6862 char buf[512];
6863 struct mgmt_ev_device_connected *ev = (void *) buf;
6864 u16 eir_len = 0;
6865
6866 bacpy(&ev->addr.bdaddr, &conn->dst);
6867 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6868
6869 ev->flags = __cpu_to_le32(flags);
6870
6871 /* We must ensure that the EIR Data fields are ordered and
6872 * unique. Keep it simple for now and avoid the problem by not
6873 * adding any BR/EDR data to the LE adv.
6874 */
6875 if (conn->le_adv_data_len > 0) {
6876 memcpy(&ev->eir[eir_len],
6877 conn->le_adv_data, conn->le_adv_data_len);
6878 eir_len = conn->le_adv_data_len;
6879 } else {
6880 if (name_len > 0)
6881 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6882 name, name_len);
6883
6884 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6885 eir_len = eir_append_data(ev->eir, eir_len,
6886 EIR_CLASS_OF_DEV,
6887 conn->dev_class, 3);
6888 }
6889
6890 ev->eir_len = cpu_to_le16(eir_len);
6891
6892 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6893 sizeof(*ev) + eir_len, NULL);
6894 }
6895
6896 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
6897 {
6898 struct sock **sk = data;
6899
6900 cmd->cmd_complete(cmd, 0);
6901
6902 *sk = cmd->sk;
6903 sock_hold(*sk);
6904
6905 mgmt_pending_remove(cmd);
6906 }
6907
6908 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
6909 {
6910 struct hci_dev *hdev = data;
6911 struct mgmt_cp_unpair_device *cp = cmd->param;
6912
6913 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6914
6915 cmd->cmd_complete(cmd, 0);
6916 mgmt_pending_remove(cmd);
6917 }
6918
6919 bool mgmt_powering_down(struct hci_dev *hdev)
6920 {
6921 struct mgmt_pending_cmd *cmd;
6922 struct mgmt_mode *cp;
6923
6924 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
6925 if (!cmd)
6926 return false;
6927
6928 cp = cmd->param;
6929 if (!cp->val)
6930 return true;
6931
6932 return false;
6933 }
6934
6935 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6936 u8 link_type, u8 addr_type, u8 reason,
6937 bool mgmt_connected)
6938 {
6939 struct mgmt_ev_device_disconnected ev;
6940 struct sock *sk = NULL;
6941
6942 /* The connection is still in hci_conn_hash so test for 1
6943 * instead of 0 to know if this is the last one.
6944 */
6945 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6946 cancel_delayed_work(&hdev->power_off);
6947 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6948 }
6949
6950 if (!mgmt_connected)
6951 return;
6952
6953 if (link_type != ACL_LINK && link_type != LE_LINK)
6954 return;
6955
6956 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6957
6958 bacpy(&ev.addr.bdaddr, bdaddr);
6959 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6960 ev.reason = reason;
6961
6962 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6963
6964 if (sk)
6965 sock_put(sk);
6966
6967 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6968 hdev);
6969 }
6970
6971 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6972 u8 link_type, u8 addr_type, u8 status)
6973 {
6974 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6975 struct mgmt_cp_disconnect *cp;
6976 struct mgmt_pending_cmd *cmd;
6977
6978 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6979 hdev);
6980
6981 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
6982 if (!cmd)
6983 return;
6984
6985 cp = cmd->param;
6986
6987 if (bacmp(bdaddr, &cp->addr.bdaddr))
6988 return;
6989
6990 if (cp->addr.type != bdaddr_type)
6991 return;
6992
6993 cmd->cmd_complete(cmd, mgmt_status(status));
6994 mgmt_pending_remove(cmd);
6995 }
6996
6997 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6998 u8 addr_type, u8 status)
6999 {
7000 struct mgmt_ev_connect_failed ev;
7001
7002 /* The connection is still in hci_conn_hash so test for 1
7003 * instead of 0 to know if this is the last one.
7004 */
7005 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7006 cancel_delayed_work(&hdev->power_off);
7007 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7008 }
7009
7010 bacpy(&ev.addr.bdaddr, bdaddr);
7011 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7012 ev.status = mgmt_status(status);
7013
7014 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7015 }
7016
7017 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7018 {
7019 struct mgmt_ev_pin_code_request ev;
7020
7021 bacpy(&ev.addr.bdaddr, bdaddr);
7022 ev.addr.type = BDADDR_BREDR;
7023 ev.secure = secure;
7024
7025 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7026 }
7027
7028 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7029 u8 status)
7030 {
7031 struct mgmt_pending_cmd *cmd;
7032
7033 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7034 if (!cmd)
7035 return;
7036
7037 cmd->cmd_complete(cmd, mgmt_status(status));
7038 mgmt_pending_remove(cmd);
7039 }
7040
7041 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7042 u8 status)
7043 {
7044 struct mgmt_pending_cmd *cmd;
7045
7046 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7047 if (!cmd)
7048 return;
7049
7050 cmd->cmd_complete(cmd, mgmt_status(status));
7051 mgmt_pending_remove(cmd);
7052 }
7053
7054 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7055 u8 link_type, u8 addr_type, u32 value,
7056 u8 confirm_hint)
7057 {
7058 struct mgmt_ev_user_confirm_request ev;
7059
7060 BT_DBG("%s", hdev->name);
7061
7062 bacpy(&ev.addr.bdaddr, bdaddr);
7063 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7064 ev.confirm_hint = confirm_hint;
7065 ev.value = cpu_to_le32(value);
7066
7067 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7068 NULL);
7069 }
7070
7071 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7072 u8 link_type, u8 addr_type)
7073 {
7074 struct mgmt_ev_user_passkey_request ev;
7075
7076 BT_DBG("%s", hdev->name);
7077
7078 bacpy(&ev.addr.bdaddr, bdaddr);
7079 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7080
7081 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7082 NULL);
7083 }
7084
7085 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7086 u8 link_type, u8 addr_type, u8 status,
7087 u8 opcode)
7088 {
7089 struct mgmt_pending_cmd *cmd;
7090
7091 cmd = pending_find(opcode, hdev);
7092 if (!cmd)
7093 return -ENOENT;
7094
7095 cmd->cmd_complete(cmd, mgmt_status(status));
7096 mgmt_pending_remove(cmd);
7097
7098 return 0;
7099 }
7100
7101 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7102 u8 link_type, u8 addr_type, u8 status)
7103 {
7104 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7105 status, MGMT_OP_USER_CONFIRM_REPLY);
7106 }
7107
7108 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7109 u8 link_type, u8 addr_type, u8 status)
7110 {
7111 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7112 status,
7113 MGMT_OP_USER_CONFIRM_NEG_REPLY);
7114 }
7115
7116 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7117 u8 link_type, u8 addr_type, u8 status)
7118 {
7119 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7120 status, MGMT_OP_USER_PASSKEY_REPLY);
7121 }
7122
7123 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7124 u8 link_type, u8 addr_type, u8 status)
7125 {
7126 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7127 status,
7128 MGMT_OP_USER_PASSKEY_NEG_REPLY);
7129 }
7130
7131 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7132 u8 link_type, u8 addr_type, u32 passkey,
7133 u8 entered)
7134 {
7135 struct mgmt_ev_passkey_notify ev;
7136
7137 BT_DBG("%s", hdev->name);
7138
7139 bacpy(&ev.addr.bdaddr, bdaddr);
7140 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7141 ev.passkey = __cpu_to_le32(passkey);
7142 ev.entered = entered;
7143
7144 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7145 }
7146
7147 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7148 {
7149 struct mgmt_ev_auth_failed ev;
7150 struct mgmt_pending_cmd *cmd;
7151 u8 status = mgmt_status(hci_status);
7152
7153 bacpy(&ev.addr.bdaddr, &conn->dst);
7154 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7155 ev.status = status;
7156
7157 cmd = find_pairing(conn);
7158
7159 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7160 cmd ? cmd->sk : NULL);
7161
7162 if (cmd) {
7163 cmd->cmd_complete(cmd, status);
7164 mgmt_pending_remove(cmd);
7165 }
7166 }
7167
7168 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7169 {
7170 struct cmd_lookup match = { NULL, hdev };
7171 bool changed;
7172
7173 if (status) {
7174 u8 mgmt_err = mgmt_status(status);
7175 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7176 cmd_status_rsp, &mgmt_err);
7177 return;
7178 }
7179
7180 if (test_bit(HCI_AUTH, &hdev->flags))
7181 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7182 else
7183 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7184
7185 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7186 &match);
7187
7188 if (changed)
7189 new_settings(hdev, match.sk);
7190
7191 if (match.sk)
7192 sock_put(match.sk);
7193 }
7194
7195 static void clear_eir(struct hci_request *req)
7196 {
7197 struct hci_dev *hdev = req->hdev;
7198 struct hci_cp_write_eir cp;
7199
7200 if (!lmp_ext_inq_capable(hdev))
7201 return;
7202
7203 memset(hdev->eir, 0, sizeof(hdev->eir));
7204
7205 memset(&cp, 0, sizeof(cp));
7206
7207 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7208 }
7209
7210 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7211 {
7212 struct cmd_lookup match = { NULL, hdev };
7213 struct hci_request req;
7214 bool changed = false;
7215
7216 if (status) {
7217 u8 mgmt_err = mgmt_status(status);
7218
7219 if (enable && hci_dev_test_and_clear_flag(hdev,
7220 HCI_SSP_ENABLED)) {
7221 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7222 new_settings(hdev, NULL);
7223 }
7224
7225 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7226 &mgmt_err);
7227 return;
7228 }
7229
7230 if (enable) {
7231 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7232 } else {
7233 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7234 if (!changed)
7235 changed = hci_dev_test_and_clear_flag(hdev,
7236 HCI_HS_ENABLED);
7237 else
7238 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7239 }
7240
7241 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7242
7243 if (changed)
7244 new_settings(hdev, match.sk);
7245
7246 if (match.sk)
7247 sock_put(match.sk);
7248
7249 hci_req_init(&req, hdev);
7250
7251 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7252 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7253 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7254 sizeof(enable), &enable);
7255 __hci_req_update_eir(&req);
7256 } else {
7257 clear_eir(&req);
7258 }
7259
7260 hci_req_run(&req, NULL);
7261 }
7262
7263 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7264 {
7265 struct cmd_lookup *match = data;
7266
7267 if (match->sk == NULL) {
7268 match->sk = cmd->sk;
7269 sock_hold(match->sk);
7270 }
7271 }
7272
7273 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7274 u8 status)
7275 {
7276 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7277
7278 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7279 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7280 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7281
7282 if (!status) {
7283 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7284 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7285 ext_info_changed(hdev, NULL);
7286 }
7287
7288 if (match.sk)
7289 sock_put(match.sk);
7290 }
7291
7292 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7293 {
7294 struct mgmt_cp_set_local_name ev;
7295 struct mgmt_pending_cmd *cmd;
7296
7297 if (status)
7298 return;
7299
7300 memset(&ev, 0, sizeof(ev));
7301 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7302 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7303
7304 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7305 if (!cmd) {
7306 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7307
7308 /* If this is a HCI command related to powering on the
7309 * HCI dev don't send any mgmt signals.
7310 */
7311 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7312 return;
7313 }
7314
7315 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7316 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7317 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7318 }
7319
7320 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7321 {
7322 int i;
7323
7324 for (i = 0; i < uuid_count; i++) {
7325 if (!memcmp(uuid, uuids[i], 16))
7326 return true;
7327 }
7328
7329 return false;
7330 }
7331
7332 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7333 {
7334 u16 parsed = 0;
7335
7336 while (parsed < eir_len) {
7337 u8 field_len = eir[0];
7338 u8 uuid[16];
7339 int i;
7340
7341 if (field_len == 0)
7342 break;
7343
7344 if (eir_len - parsed < field_len + 1)
7345 break;
7346
7347 switch (eir[1]) {
7348 case EIR_UUID16_ALL:
7349 case EIR_UUID16_SOME:
7350 for (i = 0; i + 3 <= field_len; i += 2) {
7351 memcpy(uuid, bluetooth_base_uuid, 16);
7352 uuid[13] = eir[i + 3];
7353 uuid[12] = eir[i + 2];
7354 if (has_uuid(uuid, uuid_count, uuids))
7355 return true;
7356 }
7357 break;
7358 case EIR_UUID32_ALL:
7359 case EIR_UUID32_SOME:
7360 for (i = 0; i + 5 <= field_len; i += 4) {
7361 memcpy(uuid, bluetooth_base_uuid, 16);
7362 uuid[15] = eir[i + 5];
7363 uuid[14] = eir[i + 4];
7364 uuid[13] = eir[i + 3];
7365 uuid[12] = eir[i + 2];
7366 if (has_uuid(uuid, uuid_count, uuids))
7367 return true;
7368 }
7369 break;
7370 case EIR_UUID128_ALL:
7371 case EIR_UUID128_SOME:
7372 for (i = 0; i + 17 <= field_len; i += 16) {
7373 memcpy(uuid, eir + i + 2, 16);
7374 if (has_uuid(uuid, uuid_count, uuids))
7375 return true;
7376 }
7377 break;
7378 }
7379
7380 parsed += field_len + 1;
7381 eir += field_len + 1;
7382 }
7383
7384 return false;
7385 }
7386
7387 static void restart_le_scan(struct hci_dev *hdev)
7388 {
7389 /* If controller is not scanning we are done. */
7390 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7391 return;
7392
7393 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7394 hdev->discovery.scan_start +
7395 hdev->discovery.scan_duration))
7396 return;
7397
7398 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7399 DISCOV_LE_RESTART_DELAY);
7400 }
7401
7402 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7403 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7404 {
7405 /* If a RSSI threshold has been specified, and
7406 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7407 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7408 * is set, let it through for further processing, as we might need to
7409 * restart the scan.
7410 *
7411 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7412 * the results are also dropped.
7413 */
7414 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7415 (rssi == HCI_RSSI_INVALID ||
7416 (rssi < hdev->discovery.rssi &&
7417 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7418 return false;
7419
7420 if (hdev->discovery.uuid_count != 0) {
7421 /* If a list of UUIDs is provided in filter, results with no
7422 * matching UUID should be dropped.
7423 */
7424 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7425 hdev->discovery.uuids) &&
7426 !eir_has_uuids(scan_rsp, scan_rsp_len,
7427 hdev->discovery.uuid_count,
7428 hdev->discovery.uuids))
7429 return false;
7430 }
7431
7432 /* If duplicate filtering does not report RSSI changes, then restart
7433 * scanning to ensure updated result with updated RSSI values.
7434 */
7435 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7436 restart_le_scan(hdev);
7437
7438 /* Validate RSSI value against the RSSI threshold once more. */
7439 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7440 rssi < hdev->discovery.rssi)
7441 return false;
7442 }
7443
7444 return true;
7445 }
7446
7447 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7448 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7449 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7450 {
7451 char buf[512];
7452 struct mgmt_ev_device_found *ev = (void *)buf;
7453 size_t ev_size;
7454
7455 /* Don't send events for a non-kernel initiated discovery. With
7456 * LE one exception is if we have pend_le_reports > 0 in which
7457 * case we're doing passive scanning and want these events.
7458 */
7459 if (!hci_discovery_active(hdev)) {
7460 if (link_type == ACL_LINK)
7461 return;
7462 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7463 return;
7464 }
7465
7466 if (hdev->discovery.result_filtering) {
7467 /* We are using service discovery */
7468 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7469 scan_rsp_len))
7470 return;
7471 }
7472
7473 if (hdev->discovery.limited) {
7474 /* Check for limited discoverable bit */
7475 if (dev_class) {
7476 if (!(dev_class[1] & 0x20))
7477 return;
7478 } else {
7479 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7480 if (!flags || !(flags[0] & LE_AD_LIMITED))
7481 return;
7482 }
7483 }
7484
7485 /* Make sure that the buffer is big enough. The 5 extra bytes
7486 * are for the potential CoD field.
7487 */
7488 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7489 return;
7490
7491 memset(buf, 0, sizeof(buf));
7492
7493 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7494 * RSSI value was reported as 0 when not available. This behavior
7495 * is kept when using device discovery. This is required for full
7496 * backwards compatibility with the API.
7497 *
7498 * However when using service discovery, the value 127 will be
7499 * returned when the RSSI is not available.
7500 */
7501 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7502 link_type == ACL_LINK)
7503 rssi = 0;
7504
7505 bacpy(&ev->addr.bdaddr, bdaddr);
7506 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7507 ev->rssi = rssi;
7508 ev->flags = cpu_to_le32(flags);
7509
7510 if (eir_len > 0)
7511 /* Copy EIR or advertising data into event */
7512 memcpy(ev->eir, eir, eir_len);
7513
7514 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7515 NULL))
7516 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7517 dev_class, 3);
7518
7519 if (scan_rsp_len > 0)
7520 /* Append scan response data to event */
7521 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7522
7523 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7524 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7525
7526 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7527 }
7528
7529 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7530 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7531 {
7532 struct mgmt_ev_device_found *ev;
7533 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7534 u16 eir_len;
7535
7536 ev = (struct mgmt_ev_device_found *) buf;
7537
7538 memset(buf, 0, sizeof(buf));
7539
7540 bacpy(&ev->addr.bdaddr, bdaddr);
7541 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7542 ev->rssi = rssi;
7543
7544 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7545 name_len);
7546
7547 ev->eir_len = cpu_to_le16(eir_len);
7548
7549 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7550 }
7551
7552 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7553 {
7554 struct mgmt_ev_discovering ev;
7555
7556 BT_DBG("%s discovering %u", hdev->name, discovering);
7557
7558 memset(&ev, 0, sizeof(ev));
7559 ev.type = hdev->discovery.type;
7560 ev.discovering = discovering;
7561
7562 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7563 }
7564
7565 static struct hci_mgmt_chan chan = {
7566 .channel = HCI_CHANNEL_CONTROL,
7567 .handler_count = ARRAY_SIZE(mgmt_handlers),
7568 .handlers = mgmt_handlers,
7569 .hdev_init = mgmt_init_hdev,
7570 };
7571
7572 int mgmt_init(void)
7573 {
7574 return hci_mgmt_chan_register(&chan);
7575 }
7576
7577 void mgmt_exit(void)
7578 {
7579 hci_mgmt_chan_unregister(&chan);
7580 }
ubuntu-bionic-kernel mirror