1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 14
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 };
110
111 static const u16 mgmt_events[] = {
112 MGMT_EV_CONTROLLER_ERROR,
113 MGMT_EV_INDEX_ADDED,
114 MGMT_EV_INDEX_REMOVED,
115 MGMT_EV_NEW_SETTINGS,
116 MGMT_EV_CLASS_OF_DEV_CHANGED,
117 MGMT_EV_LOCAL_NAME_CHANGED,
118 MGMT_EV_NEW_LINK_KEY,
119 MGMT_EV_NEW_LONG_TERM_KEY,
120 MGMT_EV_DEVICE_CONNECTED,
121 MGMT_EV_DEVICE_DISCONNECTED,
122 MGMT_EV_CONNECT_FAILED,
123 MGMT_EV_PIN_CODE_REQUEST,
124 MGMT_EV_USER_CONFIRM_REQUEST,
125 MGMT_EV_USER_PASSKEY_REQUEST,
126 MGMT_EV_AUTH_FAILED,
127 MGMT_EV_DEVICE_FOUND,
128 MGMT_EV_DISCOVERING,
129 MGMT_EV_DEVICE_BLOCKED,
130 MGMT_EV_DEVICE_UNBLOCKED,
131 MGMT_EV_DEVICE_UNPAIRED,
132 MGMT_EV_PASSKEY_NOTIFY,
133 MGMT_EV_NEW_IRK,
134 MGMT_EV_NEW_CSRK,
135 MGMT_EV_DEVICE_ADDED,
136 MGMT_EV_DEVICE_REMOVED,
137 MGMT_EV_NEW_CONN_PARAM,
138 MGMT_EV_UNCONF_INDEX_ADDED,
139 MGMT_EV_UNCONF_INDEX_REMOVED,
140 MGMT_EV_NEW_CONFIG_OPTIONS,
141 MGMT_EV_EXT_INDEX_ADDED,
142 MGMT_EV_EXT_INDEX_REMOVED,
143 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
144 MGMT_EV_ADVERTISING_ADDED,
145 MGMT_EV_ADVERTISING_REMOVED,
146 MGMT_EV_EXT_INFO_CHANGED,
147 };
148
149 static const u16 mgmt_untrusted_commands[] = {
150 MGMT_OP_READ_INDEX_LIST,
151 MGMT_OP_READ_INFO,
152 MGMT_OP_READ_UNCONF_INDEX_LIST,
153 MGMT_OP_READ_CONFIG_INFO,
154 MGMT_OP_READ_EXT_INDEX_LIST,
155 MGMT_OP_READ_EXT_INFO,
156 };
157
158 static const u16 mgmt_untrusted_events[] = {
159 MGMT_EV_INDEX_ADDED,
160 MGMT_EV_INDEX_REMOVED,
161 MGMT_EV_NEW_SETTINGS,
162 MGMT_EV_CLASS_OF_DEV_CHANGED,
163 MGMT_EV_LOCAL_NAME_CHANGED,
164 MGMT_EV_UNCONF_INDEX_ADDED,
165 MGMT_EV_UNCONF_INDEX_REMOVED,
166 MGMT_EV_NEW_CONFIG_OPTIONS,
167 MGMT_EV_EXT_INDEX_ADDED,
168 MGMT_EV_EXT_INDEX_REMOVED,
169 MGMT_EV_EXT_INFO_CHANGED,
170 };
171
172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
173
174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
175 "\x00\x00\x00\x00\x00\x00\x00\x00"
176
177 /* HCI to MGMT error code conversion table */
178 static u8 mgmt_status_table[] = {
179 MGMT_STATUS_SUCCESS,
180 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
181 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
182 MGMT_STATUS_FAILED, /* Hardware Failure */
183 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
184 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
185 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
186 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
187 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
188 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
189 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
190 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
191 MGMT_STATUS_BUSY, /* Command Disallowed */
192 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
193 MGMT_STATUS_REJECTED, /* Rejected Security */
194 MGMT_STATUS_REJECTED, /* Rejected Personal */
195 MGMT_STATUS_TIMEOUT, /* Host Timeout */
196 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
197 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
198 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
199 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
200 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
201 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
202 MGMT_STATUS_BUSY, /* Repeated Attempts */
203 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
204 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
205 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
206 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
207 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
208 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
209 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
210 MGMT_STATUS_FAILED, /* Unspecified Error */
211 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
212 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
213 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
214 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
215 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
216 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
217 MGMT_STATUS_FAILED, /* Unit Link Key Used */
218 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
219 MGMT_STATUS_TIMEOUT, /* Instant Passed */
220 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
221 MGMT_STATUS_FAILED, /* Transaction Collision */
222 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
223 MGMT_STATUS_REJECTED, /* QoS Rejected */
224 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
225 MGMT_STATUS_REJECTED, /* Insufficient Security */
226 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
227 MGMT_STATUS_BUSY, /* Role Switch Pending */
228 MGMT_STATUS_FAILED, /* Slot Violation */
229 MGMT_STATUS_FAILED, /* Role Switch Failed */
230 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
231 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
232 MGMT_STATUS_BUSY, /* Host Busy Pairing */
233 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
234 MGMT_STATUS_BUSY, /* Controller Busy */
235 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
236 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
237 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
238 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
239 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
240 };
241
mgmt_status(u8 hci_status)242 static u8 mgmt_status(u8 hci_status)
243 {
244 if (hci_status < ARRAY_SIZE(mgmt_status_table))
245 return mgmt_status_table[hci_status];
246
247 return MGMT_STATUS_FAILED;
248 }
249
mgmt_index_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag)250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag)
252 {
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, NULL);
255 }
256
mgmt_limited_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag,struct sock * skip_sk)257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, int flag, struct sock *skip_sk)
259 {
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 flag, skip_sk);
262 }
263
mgmt_event(u16 event,struct hci_dev * hdev,void * data,u16 len,struct sock * skip_sk)264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266 {
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
268 HCI_SOCK_TRUSTED, skip_sk);
269 }
270
le_addr_type(u8 mgmt_addr_type)271 static u8 le_addr_type(u8 mgmt_addr_type)
272 {
273 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
274 return ADDR_LE_DEV_PUBLIC;
275 else
276 return ADDR_LE_DEV_RANDOM;
277 }
278
mgmt_fill_version_info(void * ver)279 void mgmt_fill_version_info(void *ver)
280 {
281 struct mgmt_rp_read_version *rp = ver;
282
283 rp->version = MGMT_VERSION;
284 rp->revision = cpu_to_le16(MGMT_REVISION);
285 }
286
read_version(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
288 u16 data_len)
289 {
290 struct mgmt_rp_read_version rp;
291
292 BT_DBG("sock %p", sk);
293
294 mgmt_fill_version_info(&rp);
295
296 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
297 &rp, sizeof(rp));
298 }
299
read_commands(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
301 u16 data_len)
302 {
303 struct mgmt_rp_read_commands *rp;
304 u16 num_commands, num_events;
305 size_t rp_size;
306 int i, err;
307
308 BT_DBG("sock %p", sk);
309
310 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
311 num_commands = ARRAY_SIZE(mgmt_commands);
312 num_events = ARRAY_SIZE(mgmt_events);
313 } else {
314 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
315 num_events = ARRAY_SIZE(mgmt_untrusted_events);
316 }
317
318 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
319
320 rp = kmalloc(rp_size, GFP_KERNEL);
321 if (!rp)
322 return -ENOMEM;
323
324 rp->num_commands = cpu_to_le16(num_commands);
325 rp->num_events = cpu_to_le16(num_events);
326
327 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
328 __le16 *opcode = rp->opcodes;
329
330 for (i = 0; i < num_commands; i++, opcode++)
331 put_unaligned_le16(mgmt_commands[i], opcode);
332
333 for (i = 0; i < num_events; i++, opcode++)
334 put_unaligned_le16(mgmt_events[i], opcode);
335 } else {
336 __le16 *opcode = rp->opcodes;
337
338 for (i = 0; i < num_commands; i++, opcode++)
339 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
340
341 for (i = 0; i < num_events; i++, opcode++)
342 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
343 }
344
345 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
346 rp, rp_size);
347 kfree(rp);
348
349 return err;
350 }
351
read_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
353 u16 data_len)
354 {
355 struct mgmt_rp_read_index_list *rp;
356 struct hci_dev *d;
357 size_t rp_len;
358 u16 count;
359 int err;
360
361 BT_DBG("sock %p", sk);
362
363 read_lock(&hci_dev_list_lock);
364
365 count = 0;
366 list_for_each_entry(d, &hci_dev_list, list) {
367 if (d->dev_type == HCI_PRIMARY &&
368 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
369 count++;
370 }
371
372 rp_len = sizeof(*rp) + (2 * count);
373 rp = kmalloc(rp_len, GFP_ATOMIC);
374 if (!rp) {
375 read_unlock(&hci_dev_list_lock);
376 return -ENOMEM;
377 }
378
379 count = 0;
380 list_for_each_entry(d, &hci_dev_list, list) {
381 if (hci_dev_test_flag(d, HCI_SETUP) ||
382 hci_dev_test_flag(d, HCI_CONFIG) ||
383 hci_dev_test_flag(d, HCI_USER_CHANNEL))
384 continue;
385
386 /* Devices marked as raw-only are neither configured
387 * nor unconfigured controllers.
388 */
389 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
390 continue;
391
392 if (d->dev_type == HCI_PRIMARY &&
393 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
394 rp->index[count++] = cpu_to_le16(d->id);
395 BT_DBG("Added hci%u", d->id);
396 }
397 }
398
399 rp->num_controllers = cpu_to_le16(count);
400 rp_len = sizeof(*rp) + (2 * count);
401
402 read_unlock(&hci_dev_list_lock);
403
404 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
405 0, rp, rp_len);
406
407 kfree(rp);
408
409 return err;
410 }
411
read_unconf_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
413 void *data, u16 data_len)
414 {
415 struct mgmt_rp_read_unconf_index_list *rp;
416 struct hci_dev *d;
417 size_t rp_len;
418 u16 count;
419 int err;
420
421 BT_DBG("sock %p", sk);
422
423 read_lock(&hci_dev_list_lock);
424
425 count = 0;
426 list_for_each_entry(d, &hci_dev_list, list) {
427 if (d->dev_type == HCI_PRIMARY &&
428 hci_dev_test_flag(d, HCI_UNCONFIGURED))
429 count++;
430 }
431
432 rp_len = sizeof(*rp) + (2 * count);
433 rp = kmalloc(rp_len, GFP_ATOMIC);
434 if (!rp) {
435 read_unlock(&hci_dev_list_lock);
436 return -ENOMEM;
437 }
438
439 count = 0;
440 list_for_each_entry(d, &hci_dev_list, list) {
441 if (hci_dev_test_flag(d, HCI_SETUP) ||
442 hci_dev_test_flag(d, HCI_CONFIG) ||
443 hci_dev_test_flag(d, HCI_USER_CHANNEL))
444 continue;
445
446 /* Devices marked as raw-only are neither configured
447 * nor unconfigured controllers.
448 */
449 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
450 continue;
451
452 if (d->dev_type == HCI_PRIMARY &&
453 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
454 rp->index[count++] = cpu_to_le16(d->id);
455 BT_DBG("Added hci%u", d->id);
456 }
457 }
458
459 rp->num_controllers = cpu_to_le16(count);
460 rp_len = sizeof(*rp) + (2 * count);
461
462 read_unlock(&hci_dev_list_lock);
463
464 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
465 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
466
467 kfree(rp);
468
469 return err;
470 }
471
read_ext_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
473 void *data, u16 data_len)
474 {
475 struct mgmt_rp_read_ext_index_list *rp;
476 struct hci_dev *d;
477 size_t rp_len;
478 u16 count;
479 int err;
480
481 BT_DBG("sock %p", sk);
482
483 read_lock(&hci_dev_list_lock);
484
485 count = 0;
486 list_for_each_entry(d, &hci_dev_list, list) {
487 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
488 count++;
489 }
490
491 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
492 rp = kmalloc(rp_len, GFP_ATOMIC);
493 if (!rp) {
494 read_unlock(&hci_dev_list_lock);
495 return -ENOMEM;
496 }
497
498 count = 0;
499 list_for_each_entry(d, &hci_dev_list, list) {
500 if (hci_dev_test_flag(d, HCI_SETUP) ||
501 hci_dev_test_flag(d, HCI_CONFIG) ||
502 hci_dev_test_flag(d, HCI_USER_CHANNEL))
503 continue;
504
505 /* Devices marked as raw-only are neither configured
506 * nor unconfigured controllers.
507 */
508 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
509 continue;
510
511 if (d->dev_type == HCI_PRIMARY) {
512 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
513 rp->entry[count].type = 0x01;
514 else
515 rp->entry[count].type = 0x00;
516 } else if (d->dev_type == HCI_AMP) {
517 rp->entry[count].type = 0x02;
518 } else {
519 continue;
520 }
521
522 rp->entry[count].bus = d->bus;
523 rp->entry[count++].index = cpu_to_le16(d->id);
524 BT_DBG("Added hci%u", d->id);
525 }
526
527 rp->num_controllers = cpu_to_le16(count);
528 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
529
530 read_unlock(&hci_dev_list_lock);
531
532 /* If this command is called at least once, then all the
533 * default index and unconfigured index events are disabled
534 * and from now on only extended index events are used.
535 */
536 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
537 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
538 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
539
540 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
541 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
542
543 kfree(rp);
544
545 return err;
546 }
547
is_configured(struct hci_dev * hdev)548 static bool is_configured(struct hci_dev *hdev)
549 {
550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
552 return false;
553
554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 return false;
557
558 return true;
559 }
560
get_missing_options(struct hci_dev * hdev)561 static __le32 get_missing_options(struct hci_dev *hdev)
562 {
563 u32 options = 0;
564
565 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
566 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
567 options |= MGMT_OPTION_EXTERNAL_CONFIG;
568
569 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
570 !bacmp(&hdev->public_addr, BDADDR_ANY))
571 options |= MGMT_OPTION_PUBLIC_ADDRESS;
572
573 return cpu_to_le32(options);
574 }
575
new_options(struct hci_dev * hdev,struct sock * skip)576 static int new_options(struct hci_dev *hdev, struct sock *skip)
577 {
578 __le32 options = get_missing_options(hdev);
579
580 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
581 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
582 }
583
send_options_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
585 {
586 __le32 options = get_missing_options(hdev);
587
588 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
589 sizeof(options));
590 }
591
read_config_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
593 void *data, u16 data_len)
594 {
595 struct mgmt_rp_read_config_info rp;
596 u32 options = 0;
597
598 BT_DBG("sock %p %s", sk, hdev->name);
599
600 hci_dev_lock(hdev);
601
602 memset(&rp, 0, sizeof(rp));
603 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
604
605 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
606 options |= MGMT_OPTION_EXTERNAL_CONFIG;
607
608 if (hdev->set_bdaddr)
609 options |= MGMT_OPTION_PUBLIC_ADDRESS;
610
611 rp.supported_options = cpu_to_le32(options);
612 rp.missing_options = get_missing_options(hdev);
613
614 hci_dev_unlock(hdev);
615
616 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
617 &rp, sizeof(rp));
618 }
619
get_supported_phys(struct hci_dev * hdev)620 static u32 get_supported_phys(struct hci_dev *hdev)
621 {
622 u32 supported_phys = 0;
623
624 if (lmp_bredr_capable(hdev)) {
625 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
626
627 if (hdev->features[0][0] & LMP_3SLOT)
628 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
629
630 if (hdev->features[0][0] & LMP_5SLOT)
631 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
632
633 if (lmp_edr_2m_capable(hdev)) {
634 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
635
636 if (lmp_edr_3slot_capable(hdev))
637 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
638
639 if (lmp_edr_5slot_capable(hdev))
640 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
641
642 if (lmp_edr_3m_capable(hdev)) {
643 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
644
645 if (lmp_edr_3slot_capable(hdev))
646 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
647
648 if (lmp_edr_5slot_capable(hdev))
649 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
650 }
651 }
652 }
653
654 if (lmp_le_capable(hdev)) {
655 supported_phys |= MGMT_PHY_LE_1M_TX;
656 supported_phys |= MGMT_PHY_LE_1M_RX;
657
658 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
659 supported_phys |= MGMT_PHY_LE_2M_TX;
660 supported_phys |= MGMT_PHY_LE_2M_RX;
661 }
662
663 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
664 supported_phys |= MGMT_PHY_LE_CODED_TX;
665 supported_phys |= MGMT_PHY_LE_CODED_RX;
666 }
667 }
668
669 return supported_phys;
670 }
671
get_selected_phys(struct hci_dev * hdev)672 static u32 get_selected_phys(struct hci_dev *hdev)
673 {
674 u32 selected_phys = 0;
675
676 if (lmp_bredr_capable(hdev)) {
677 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
678
679 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
680 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
681
682 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
683 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
684
685 if (lmp_edr_2m_capable(hdev)) {
686 if (!(hdev->pkt_type & HCI_2DH1))
687 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
688
689 if (lmp_edr_3slot_capable(hdev) &&
690 !(hdev->pkt_type & HCI_2DH3))
691 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
692
693 if (lmp_edr_5slot_capable(hdev) &&
694 !(hdev->pkt_type & HCI_2DH5))
695 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
696
697 if (lmp_edr_3m_capable(hdev)) {
698 if (!(hdev->pkt_type & HCI_3DH1))
699 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
700
701 if (lmp_edr_3slot_capable(hdev) &&
702 !(hdev->pkt_type & HCI_3DH3))
703 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
704
705 if (lmp_edr_5slot_capable(hdev) &&
706 !(hdev->pkt_type & HCI_3DH5))
707 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
708 }
709 }
710 }
711
712 if (lmp_le_capable(hdev)) {
713 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
714 selected_phys |= MGMT_PHY_LE_1M_TX;
715
716 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
717 selected_phys |= MGMT_PHY_LE_1M_RX;
718
719 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
720 selected_phys |= MGMT_PHY_LE_2M_TX;
721
722 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
723 selected_phys |= MGMT_PHY_LE_2M_RX;
724
725 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
726 selected_phys |= MGMT_PHY_LE_CODED_TX;
727
728 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
729 selected_phys |= MGMT_PHY_LE_CODED_RX;
730 }
731
732 return selected_phys;
733 }
734
get_configurable_phys(struct hci_dev * hdev)735 static u32 get_configurable_phys(struct hci_dev *hdev)
736 {
737 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
738 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
739 }
740
get_supported_settings(struct hci_dev * hdev)741 static u32 get_supported_settings(struct hci_dev *hdev)
742 {
743 u32 settings = 0;
744
745 settings |= MGMT_SETTING_POWERED;
746 settings |= MGMT_SETTING_BONDABLE;
747 settings |= MGMT_SETTING_DEBUG_KEYS;
748 settings |= MGMT_SETTING_CONNECTABLE;
749 settings |= MGMT_SETTING_DISCOVERABLE;
750
751 if (lmp_bredr_capable(hdev)) {
752 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
753 settings |= MGMT_SETTING_FAST_CONNECTABLE;
754 settings |= MGMT_SETTING_BREDR;
755 settings |= MGMT_SETTING_LINK_SECURITY;
756
757 if (lmp_ssp_capable(hdev)) {
758 settings |= MGMT_SETTING_SSP;
759 settings |= MGMT_SETTING_HS;
760 }
761
762 if (lmp_sc_capable(hdev))
763 settings |= MGMT_SETTING_SECURE_CONN;
764 }
765
766 if (lmp_le_capable(hdev)) {
767 settings |= MGMT_SETTING_LE;
768 settings |= MGMT_SETTING_ADVERTISING;
769 settings |= MGMT_SETTING_SECURE_CONN;
770 settings |= MGMT_SETTING_PRIVACY;
771 settings |= MGMT_SETTING_STATIC_ADDRESS;
772 }
773
774 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
775 hdev->set_bdaddr)
776 settings |= MGMT_SETTING_CONFIGURATION;
777
778 settings |= MGMT_SETTING_PHY_CONFIGURATION;
779
780 return settings;
781 }
782
get_current_settings(struct hci_dev * hdev)783 static u32 get_current_settings(struct hci_dev *hdev)
784 {
785 u32 settings = 0;
786
787 if (hdev_is_powered(hdev))
788 settings |= MGMT_SETTING_POWERED;
789
790 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
791 settings |= MGMT_SETTING_CONNECTABLE;
792
793 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
794 settings |= MGMT_SETTING_FAST_CONNECTABLE;
795
796 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
797 settings |= MGMT_SETTING_DISCOVERABLE;
798
799 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
800 settings |= MGMT_SETTING_BONDABLE;
801
802 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
803 settings |= MGMT_SETTING_BREDR;
804
805 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
806 settings |= MGMT_SETTING_LE;
807
808 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
809 settings |= MGMT_SETTING_LINK_SECURITY;
810
811 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
812 settings |= MGMT_SETTING_SSP;
813
814 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
815 settings |= MGMT_SETTING_HS;
816
817 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
818 settings |= MGMT_SETTING_ADVERTISING;
819
820 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
821 settings |= MGMT_SETTING_SECURE_CONN;
822
823 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
824 settings |= MGMT_SETTING_DEBUG_KEYS;
825
826 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
827 settings |= MGMT_SETTING_PRIVACY;
828
829 /* The current setting for static address has two purposes. The
830 * first is to indicate if the static address will be used and
831 * the second is to indicate if it is actually set.
832 *
833 * This means if the static address is not configured, this flag
834 * will never be set. If the address is configured, then if the
835 * address is actually used decides if the flag is set or not.
836 *
837 * For single mode LE only controllers and dual-mode controllers
838 * with BR/EDR disabled, the existence of the static address will
839 * be evaluated.
840 */
841 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
842 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
843 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
844 if (bacmp(&hdev->static_addr, BDADDR_ANY))
845 settings |= MGMT_SETTING_STATIC_ADDRESS;
846 }
847
848 return settings;
849 }
850
pending_find(u16 opcode,struct hci_dev * hdev)851 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
852 {
853 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
854 }
855
pending_find_data(u16 opcode,struct hci_dev * hdev,const void * data)856 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
857 struct hci_dev *hdev,
858 const void *data)
859 {
860 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
861 }
862
mgmt_get_adv_discov_flags(struct hci_dev * hdev)863 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
864 {
865 struct mgmt_pending_cmd *cmd;
866
867 /* If there's a pending mgmt command the flags will not yet have
868 * their final values, so check for this first.
869 */
870 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
871 if (cmd) {
872 struct mgmt_mode *cp = cmd->param;
873 if (cp->val == 0x01)
874 return LE_AD_GENERAL;
875 else if (cp->val == 0x02)
876 return LE_AD_LIMITED;
877 } else {
878 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
879 return LE_AD_LIMITED;
880 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
881 return LE_AD_GENERAL;
882 }
883
884 return 0;
885 }
886
mgmt_get_connectable(struct hci_dev * hdev)887 bool mgmt_get_connectable(struct hci_dev *hdev)
888 {
889 struct mgmt_pending_cmd *cmd;
890
891 /* If there's a pending mgmt command the flag will not yet have
892 * it's final value, so check for this first.
893 */
894 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
895 if (cmd) {
896 struct mgmt_mode *cp = cmd->param;
897
898 return cp->val;
899 }
900
901 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
902 }
903
service_cache_off(struct work_struct * work)904 static void service_cache_off(struct work_struct *work)
905 {
906 struct hci_dev *hdev = container_of(work, struct hci_dev,
907 service_cache.work);
908 struct hci_request req;
909
910 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
911 return;
912
913 hci_req_init(&req, hdev);
914
915 hci_dev_lock(hdev);
916
917 __hci_req_update_eir(&req);
918 __hci_req_update_class(&req);
919
920 hci_dev_unlock(hdev);
921
922 hci_req_run(&req, NULL);
923 }
924
rpa_expired(struct work_struct * work)925 static void rpa_expired(struct work_struct *work)
926 {
927 struct hci_dev *hdev = container_of(work, struct hci_dev,
928 rpa_expired.work);
929 struct hci_request req;
930
931 BT_DBG("");
932
933 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
934
935 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
936 return;
937
938 /* The generation of a new RPA and programming it into the
939 * controller happens in the hci_req_enable_advertising()
940 * function.
941 */
942 hci_req_init(&req, hdev);
943 if (ext_adv_capable(hdev))
944 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
945 else
946 __hci_req_enable_advertising(&req);
947 hci_req_run(&req, NULL);
948 }
949
mgmt_init_hdev(struct sock * sk,struct hci_dev * hdev)950 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
951 {
952 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
953 return;
954
955 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
956 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
957
958 /* Non-mgmt controlled devices get this bit set
959 * implicitly so that pairing works for them, however
960 * for mgmt we require user-space to explicitly enable
961 * it
962 */
963 hci_dev_clear_flag(hdev, HCI_BONDABLE);
964 }
965
read_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)966 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
967 void *data, u16 data_len)
968 {
969 struct mgmt_rp_read_info rp;
970
971 BT_DBG("sock %p %s", sk, hdev->name);
972
973 hci_dev_lock(hdev);
974
975 memset(&rp, 0, sizeof(rp));
976
977 bacpy(&rp.bdaddr, &hdev->bdaddr);
978
979 rp.version = hdev->hci_ver;
980 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
981
982 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
983 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
984
985 memcpy(rp.dev_class, hdev->dev_class, 3);
986
987 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
988 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
989
990 hci_dev_unlock(hdev);
991
992 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
993 sizeof(rp));
994 }
995
append_eir_data_to_buf(struct hci_dev * hdev,u8 * eir)996 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
997 {
998 u16 eir_len = 0;
999 size_t name_len;
1000
1001 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1002 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1003 hdev->dev_class, 3);
1004
1005 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1006 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1007 hdev->appearance);
1008
1009 name_len = strlen(hdev->dev_name);
1010 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1011 hdev->dev_name, name_len);
1012
1013 name_len = strlen(hdev->short_name);
1014 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1015 hdev->short_name, name_len);
1016
1017 return eir_len;
1018 }
1019
read_ext_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1020 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1021 void *data, u16 data_len)
1022 {
1023 char buf[512];
1024 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1025 u16 eir_len;
1026
1027 BT_DBG("sock %p %s", sk, hdev->name);
1028
1029 memset(&buf, 0, sizeof(buf));
1030
1031 hci_dev_lock(hdev);
1032
1033 bacpy(&rp->bdaddr, &hdev->bdaddr);
1034
1035 rp->version = hdev->hci_ver;
1036 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1037
1038 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1039 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1040
1041
1042 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1043 rp->eir_len = cpu_to_le16(eir_len);
1044
1045 hci_dev_unlock(hdev);
1046
1047 /* If this command is called at least once, then the events
1048 * for class of device and local name changes are disabled
1049 * and only the new extended controller information event
1050 * is used.
1051 */
1052 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1053 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1054 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1055
1056 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1057 sizeof(*rp) + eir_len);
1058 }
1059
ext_info_changed(struct hci_dev * hdev,struct sock * skip)1060 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1061 {
1062 char buf[512];
1063 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1064 u16 eir_len;
1065
1066 memset(buf, 0, sizeof(buf));
1067
1068 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1069 ev->eir_len = cpu_to_le16(eir_len);
1070
1071 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1072 sizeof(*ev) + eir_len,
1073 HCI_MGMT_EXT_INFO_EVENTS, skip);
1074 }
1075
send_settings_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1077 {
1078 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1079
1080 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1081 sizeof(settings));
1082 }
1083
clean_up_hci_complete(struct hci_dev * hdev,u8 status,u16 opcode)1084 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1085 {
1086 BT_DBG("%s status 0x%02x", hdev->name, status);
1087
1088 if (hci_conn_count(hdev) == 0) {
1089 cancel_delayed_work(&hdev->power_off);
1090 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1091 }
1092 }
1093
mgmt_advertising_added(struct sock * sk,struct hci_dev * hdev,u8 instance)1094 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1095 {
1096 struct mgmt_ev_advertising_added ev;
1097
1098 ev.instance = instance;
1099
1100 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1101 }
1102
mgmt_advertising_removed(struct sock * sk,struct hci_dev * hdev,u8 instance)1103 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1104 u8 instance)
1105 {
1106 struct mgmt_ev_advertising_removed ev;
1107
1108 ev.instance = instance;
1109
1110 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1111 }
1112
cancel_adv_timeout(struct hci_dev * hdev)1113 static void cancel_adv_timeout(struct hci_dev *hdev)
1114 {
1115 if (hdev->adv_instance_timeout) {
1116 hdev->adv_instance_timeout = 0;
1117 cancel_delayed_work(&hdev->adv_instance_expire);
1118 }
1119 }
1120
clean_up_hci_state(struct hci_dev * hdev)1121 static int clean_up_hci_state(struct hci_dev *hdev)
1122 {
1123 struct hci_request req;
1124 struct hci_conn *conn;
1125 bool discov_stopped;
1126 int err;
1127
1128 hci_req_init(&req, hdev);
1129
1130 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1131 test_bit(HCI_PSCAN, &hdev->flags)) {
1132 u8 scan = 0x00;
1133 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1134 }
1135
1136 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1137
1138 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1139 __hci_req_disable_advertising(&req);
1140
1141 discov_stopped = hci_req_stop_discovery(&req);
1142
1143 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1144 /* 0x15 == Terminated due to Power Off */
1145 __hci_abort_conn(&req, conn, 0x15);
1146 }
1147
1148 err = hci_req_run(&req, clean_up_hci_complete);
1149 if (!err && discov_stopped)
1150 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1151
1152 return err;
1153 }
1154
set_powered(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1155 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1156 u16 len)
1157 {
1158 struct mgmt_mode *cp = data;
1159 struct mgmt_pending_cmd *cmd;
1160 int err;
1161
1162 BT_DBG("request for %s", hdev->name);
1163
1164 if (cp->val != 0x00 && cp->val != 0x01)
1165 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1166 MGMT_STATUS_INVALID_PARAMS);
1167
1168 hci_dev_lock(hdev);
1169
1170 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1171 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1172 MGMT_STATUS_BUSY);
1173 goto failed;
1174 }
1175
1176 if (!!cp->val == hdev_is_powered(hdev)) {
1177 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1178 goto failed;
1179 }
1180
1181 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1182 if (!cmd) {
1183 err = -ENOMEM;
1184 goto failed;
1185 }
1186
1187 if (cp->val) {
1188 queue_work(hdev->req_workqueue, &hdev->power_on);
1189 err = 0;
1190 } else {
1191 /* Disconnect connections, stop scans, etc */
1192 err = clean_up_hci_state(hdev);
1193 if (!err)
1194 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1195 HCI_POWER_OFF_TIMEOUT);
1196
1197 /* ENODATA means there were no HCI commands queued */
1198 if (err == -ENODATA) {
1199 cancel_delayed_work(&hdev->power_off);
1200 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1201 err = 0;
1202 }
1203 }
1204
1205 failed:
1206 hci_dev_unlock(hdev);
1207 return err;
1208 }
1209
new_settings(struct hci_dev * hdev,struct sock * skip)1210 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211 {
1212 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1213
1214 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216 }
1217
mgmt_new_settings(struct hci_dev * hdev)1218 int mgmt_new_settings(struct hci_dev *hdev)
1219 {
1220 return new_settings(hdev, NULL);
1221 }
1222
1223 struct cmd_lookup {
1224 struct sock *sk;
1225 struct hci_dev *hdev;
1226 u8 mgmt_status;
1227 };
1228
settings_rsp(struct mgmt_pending_cmd * cmd,void * data)1229 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1230 {
1231 struct cmd_lookup *match = data;
1232
1233 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1234
1235 list_del(&cmd->list);
1236
1237 if (match->sk == NULL) {
1238 match->sk = cmd->sk;
1239 sock_hold(match->sk);
1240 }
1241
1242 mgmt_pending_free(cmd);
1243 }
1244
cmd_status_rsp(struct mgmt_pending_cmd * cmd,void * data)1245 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1246 {
1247 u8 *status = data;
1248
1249 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1250 mgmt_pending_remove(cmd);
1251 }
1252
cmd_complete_rsp(struct mgmt_pending_cmd * cmd,void * data)1253 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1254 {
1255 if (cmd->cmd_complete) {
1256 u8 *status = data;
1257
1258 cmd->cmd_complete(cmd, *status);
1259 mgmt_pending_remove(cmd);
1260
1261 return;
1262 }
1263
1264 cmd_status_rsp(cmd, data);
1265 }
1266
generic_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1267 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1268 {
1269 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1270 cmd->param, cmd->param_len);
1271 }
1272
addr_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1273 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1274 {
1275 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1276 cmd->param, sizeof(struct mgmt_addr_info));
1277 }
1278
mgmt_bredr_support(struct hci_dev * hdev)1279 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1280 {
1281 if (!lmp_bredr_capable(hdev))
1282 return MGMT_STATUS_NOT_SUPPORTED;
1283 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1284 return MGMT_STATUS_REJECTED;
1285 else
1286 return MGMT_STATUS_SUCCESS;
1287 }
1288
mgmt_le_support(struct hci_dev * hdev)1289 static u8 mgmt_le_support(struct hci_dev *hdev)
1290 {
1291 if (!lmp_le_capable(hdev))
1292 return MGMT_STATUS_NOT_SUPPORTED;
1293 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1294 return MGMT_STATUS_REJECTED;
1295 else
1296 return MGMT_STATUS_SUCCESS;
1297 }
1298
mgmt_set_discoverable_complete(struct hci_dev * hdev,u8 status)1299 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1300 {
1301 struct mgmt_pending_cmd *cmd;
1302
1303 BT_DBG("status 0x%02x", status);
1304
1305 hci_dev_lock(hdev);
1306
1307 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1308 if (!cmd)
1309 goto unlock;
1310
1311 if (status) {
1312 u8 mgmt_err = mgmt_status(status);
1313 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1314 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1315 goto remove_cmd;
1316 }
1317
1318 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1319 hdev->discov_timeout > 0) {
1320 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1321 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1322 }
1323
1324 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1325 new_settings(hdev, cmd->sk);
1326
1327 remove_cmd:
1328 mgmt_pending_remove(cmd);
1329
1330 unlock:
1331 hci_dev_unlock(hdev);
1332 }
1333
set_discoverable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1334 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1335 u16 len)
1336 {
1337 struct mgmt_cp_set_discoverable *cp = data;
1338 struct mgmt_pending_cmd *cmd;
1339 u16 timeout;
1340 int err;
1341
1342 BT_DBG("request for %s", hdev->name);
1343
1344 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1345 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1346 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1347 MGMT_STATUS_REJECTED);
1348
1349 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351 MGMT_STATUS_INVALID_PARAMS);
1352
1353 timeout = __le16_to_cpu(cp->timeout);
1354
1355 /* Disabling discoverable requires that no timeout is set,
1356 * and enabling limited discoverable requires a timeout.
1357 */
1358 if ((cp->val == 0x00 && timeout > 0) ||
1359 (cp->val == 0x02 && timeout == 0))
1360 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1361 MGMT_STATUS_INVALID_PARAMS);
1362
1363 hci_dev_lock(hdev);
1364
1365 if (!hdev_is_powered(hdev) && timeout > 0) {
1366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367 MGMT_STATUS_NOT_POWERED);
1368 goto failed;
1369 }
1370
1371 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1372 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1373 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1374 MGMT_STATUS_BUSY);
1375 goto failed;
1376 }
1377
1378 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1379 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1380 MGMT_STATUS_REJECTED);
1381 goto failed;
1382 }
1383
1384 if (!hdev_is_powered(hdev)) {
1385 bool changed = false;
1386
1387 /* Setting limited discoverable when powered off is
1388 * not a valid operation since it requires a timeout
1389 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1390 */
1391 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1392 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1393 changed = true;
1394 }
1395
1396 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1397 if (err < 0)
1398 goto failed;
1399
1400 if (changed)
1401 err = new_settings(hdev, sk);
1402
1403 goto failed;
1404 }
1405
1406 /* If the current mode is the same, then just update the timeout
1407 * value with the new value. And if only the timeout gets updated,
1408 * then no need for any HCI transactions.
1409 */
1410 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1411 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1412 HCI_LIMITED_DISCOVERABLE)) {
1413 cancel_delayed_work(&hdev->discov_off);
1414 hdev->discov_timeout = timeout;
1415
1416 if (cp->val && hdev->discov_timeout > 0) {
1417 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1418 queue_delayed_work(hdev->req_workqueue,
1419 &hdev->discov_off, to);
1420 }
1421
1422 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1423 goto failed;
1424 }
1425
1426 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1427 if (!cmd) {
1428 err = -ENOMEM;
1429 goto failed;
1430 }
1431
1432 /* Cancel any potential discoverable timeout that might be
1433 * still active and store new timeout value. The arming of
1434 * the timeout happens in the complete handler.
1435 */
1436 cancel_delayed_work(&hdev->discov_off);
1437 hdev->discov_timeout = timeout;
1438
1439 if (cp->val)
1440 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1441 else
1442 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1443
1444 /* Limited discoverable mode */
1445 if (cp->val == 0x02)
1446 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1447 else
1448 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449
1450 queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1451 err = 0;
1452
1453 failed:
1454 hci_dev_unlock(hdev);
1455 return err;
1456 }
1457
mgmt_set_connectable_complete(struct hci_dev * hdev,u8 status)1458 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1459 {
1460 struct mgmt_pending_cmd *cmd;
1461
1462 BT_DBG("status 0x%02x", status);
1463
1464 hci_dev_lock(hdev);
1465
1466 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1467 if (!cmd)
1468 goto unlock;
1469
1470 if (status) {
1471 u8 mgmt_err = mgmt_status(status);
1472 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1473 goto remove_cmd;
1474 }
1475
1476 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1477 new_settings(hdev, cmd->sk);
1478
1479 remove_cmd:
1480 mgmt_pending_remove(cmd);
1481
1482 unlock:
1483 hci_dev_unlock(hdev);
1484 }
1485
set_connectable_update_settings(struct hci_dev * hdev,struct sock * sk,u8 val)1486 static int set_connectable_update_settings(struct hci_dev *hdev,
1487 struct sock *sk, u8 val)
1488 {
1489 bool changed = false;
1490 int err;
1491
1492 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1493 changed = true;
1494
1495 if (val) {
1496 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1497 } else {
1498 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1499 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1500 }
1501
1502 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1503 if (err < 0)
1504 return err;
1505
1506 if (changed) {
1507 hci_req_update_scan(hdev);
1508 hci_update_background_scan(hdev);
1509 return new_settings(hdev, sk);
1510 }
1511
1512 return 0;
1513 }
1514
set_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1515 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1516 u16 len)
1517 {
1518 struct mgmt_mode *cp = data;
1519 struct mgmt_pending_cmd *cmd;
1520 int err;
1521
1522 BT_DBG("request for %s", hdev->name);
1523
1524 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1525 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1526 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1527 MGMT_STATUS_REJECTED);
1528
1529 if (cp->val != 0x00 && cp->val != 0x01)
1530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531 MGMT_STATUS_INVALID_PARAMS);
1532
1533 hci_dev_lock(hdev);
1534
1535 if (!hdev_is_powered(hdev)) {
1536 err = set_connectable_update_settings(hdev, sk, cp->val);
1537 goto failed;
1538 }
1539
1540 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1541 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1542 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1543 MGMT_STATUS_BUSY);
1544 goto failed;
1545 }
1546
1547 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1548 if (!cmd) {
1549 err = -ENOMEM;
1550 goto failed;
1551 }
1552
1553 if (cp->val) {
1554 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555 } else {
1556 if (hdev->discov_timeout > 0)
1557 cancel_delayed_work(&hdev->discov_off);
1558
1559 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1560 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1561 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1562 }
1563
1564 queue_work(hdev->req_workqueue, &hdev->connectable_update);
1565 err = 0;
1566
1567 failed:
1568 hci_dev_unlock(hdev);
1569 return err;
1570 }
1571
set_bondable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1572 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1573 u16 len)
1574 {
1575 struct mgmt_mode *cp = data;
1576 bool changed;
1577 int err;
1578
1579 BT_DBG("request for %s", hdev->name);
1580
1581 if (cp->val != 0x00 && cp->val != 0x01)
1582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1583 MGMT_STATUS_INVALID_PARAMS);
1584
1585 hci_dev_lock(hdev);
1586
1587 if (cp->val)
1588 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1589 else
1590 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1591
1592 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1593 if (err < 0)
1594 goto unlock;
1595
1596 if (changed) {
1597 /* In limited privacy mode the change of bondable mode
1598 * may affect the local advertising address.
1599 */
1600 if (hdev_is_powered(hdev) &&
1601 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1602 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1603 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1604 queue_work(hdev->req_workqueue,
1605 &hdev->discoverable_update);
1606
1607 err = new_settings(hdev, sk);
1608 }
1609
1610 unlock:
1611 hci_dev_unlock(hdev);
1612 return err;
1613 }
1614
set_link_security(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1615 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1616 u16 len)
1617 {
1618 struct mgmt_mode *cp = data;
1619 struct mgmt_pending_cmd *cmd;
1620 u8 val, status;
1621 int err;
1622
1623 BT_DBG("request for %s", hdev->name);
1624
1625 status = mgmt_bredr_support(hdev);
1626 if (status)
1627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1628 status);
1629
1630 if (cp->val != 0x00 && cp->val != 0x01)
1631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632 MGMT_STATUS_INVALID_PARAMS);
1633
1634 hci_dev_lock(hdev);
1635
1636 if (!hdev_is_powered(hdev)) {
1637 bool changed = false;
1638
1639 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1640 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1641 changed = true;
1642 }
1643
1644 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1645 if (err < 0)
1646 goto failed;
1647
1648 if (changed)
1649 err = new_settings(hdev, sk);
1650
1651 goto failed;
1652 }
1653
1654 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1655 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1656 MGMT_STATUS_BUSY);
1657 goto failed;
1658 }
1659
1660 val = !!cp->val;
1661
1662 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1663 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1664 goto failed;
1665 }
1666
1667 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1668 if (!cmd) {
1669 err = -ENOMEM;
1670 goto failed;
1671 }
1672
1673 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1674 if (err < 0) {
1675 mgmt_pending_remove(cmd);
1676 goto failed;
1677 }
1678
1679 failed:
1680 hci_dev_unlock(hdev);
1681 return err;
1682 }
1683
set_ssp(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1684 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1685 {
1686 struct mgmt_mode *cp = data;
1687 struct mgmt_pending_cmd *cmd;
1688 u8 status;
1689 int err;
1690
1691 BT_DBG("request for %s", hdev->name);
1692
1693 status = mgmt_bredr_support(hdev);
1694 if (status)
1695 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1696
1697 if (!lmp_ssp_capable(hdev))
1698 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1699 MGMT_STATUS_NOT_SUPPORTED);
1700
1701 if (cp->val != 0x00 && cp->val != 0x01)
1702 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703 MGMT_STATUS_INVALID_PARAMS);
1704
1705 hci_dev_lock(hdev);
1706
1707 if (!hdev_is_powered(hdev)) {
1708 bool changed;
1709
1710 if (cp->val) {
1711 changed = !hci_dev_test_and_set_flag(hdev,
1712 HCI_SSP_ENABLED);
1713 } else {
1714 changed = hci_dev_test_and_clear_flag(hdev,
1715 HCI_SSP_ENABLED);
1716 if (!changed)
1717 changed = hci_dev_test_and_clear_flag(hdev,
1718 HCI_HS_ENABLED);
1719 else
1720 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1721 }
1722
1723 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1724 if (err < 0)
1725 goto failed;
1726
1727 if (changed)
1728 err = new_settings(hdev, sk);
1729
1730 goto failed;
1731 }
1732
1733 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1734 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1735 MGMT_STATUS_BUSY);
1736 goto failed;
1737 }
1738
1739 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1740 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1741 goto failed;
1742 }
1743
1744 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1745 if (!cmd) {
1746 err = -ENOMEM;
1747 goto failed;
1748 }
1749
1750 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1751 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1752 sizeof(cp->val), &cp->val);
1753
1754 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1755 if (err < 0) {
1756 mgmt_pending_remove(cmd);
1757 goto failed;
1758 }
1759
1760 failed:
1761 hci_dev_unlock(hdev);
1762 return err;
1763 }
1764
set_hs(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1765 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766 {
1767 struct mgmt_mode *cp = data;
1768 bool changed;
1769 u8 status;
1770 int err;
1771
1772 BT_DBG("request for %s", hdev->name);
1773
1774 status = mgmt_bredr_support(hdev);
1775 if (status)
1776 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1777
1778 if (!lmp_ssp_capable(hdev))
1779 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780 MGMT_STATUS_NOT_SUPPORTED);
1781
1782 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1783 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1784 MGMT_STATUS_REJECTED);
1785
1786 if (cp->val != 0x00 && cp->val != 0x01)
1787 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788 MGMT_STATUS_INVALID_PARAMS);
1789
1790 hci_dev_lock(hdev);
1791
1792 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1794 MGMT_STATUS_BUSY);
1795 goto unlock;
1796 }
1797
1798 if (cp->val) {
1799 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1800 } else {
1801 if (hdev_is_powered(hdev)) {
1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803 MGMT_STATUS_REJECTED);
1804 goto unlock;
1805 }
1806
1807 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1808 }
1809
1810 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1811 if (err < 0)
1812 goto unlock;
1813
1814 if (changed)
1815 err = new_settings(hdev, sk);
1816
1817 unlock:
1818 hci_dev_unlock(hdev);
1819 return err;
1820 }
1821
le_enable_complete(struct hci_dev * hdev,u8 status,u16 opcode)1822 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1823 {
1824 struct cmd_lookup match = { NULL, hdev };
1825
1826 hci_dev_lock(hdev);
1827
1828 if (status) {
1829 u8 mgmt_err = mgmt_status(status);
1830
1831 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1832 &mgmt_err);
1833 goto unlock;
1834 }
1835
1836 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1837
1838 new_settings(hdev, match.sk);
1839
1840 if (match.sk)
1841 sock_put(match.sk);
1842
1843 /* Make sure the controller has a good default for
1844 * advertising data. Restrict the update to when LE
1845 * has actually been enabled. During power on, the
1846 * update in powered_update_hci will take care of it.
1847 */
1848 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1849 struct hci_request req;
1850 hci_req_init(&req, hdev);
1851 if (ext_adv_capable(hdev)) {
1852 int err;
1853
1854 err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1855 if (!err)
1856 __hci_req_update_scan_rsp_data(&req, 0x00);
1857 } else {
1858 __hci_req_update_adv_data(&req, 0x00);
1859 __hci_req_update_scan_rsp_data(&req, 0x00);
1860 }
1861 hci_req_run(&req, NULL);
1862 hci_update_background_scan(hdev);
1863 }
1864
1865 unlock:
1866 hci_dev_unlock(hdev);
1867 }
1868
set_le(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1869 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1870 {
1871 struct mgmt_mode *cp = data;
1872 struct hci_cp_write_le_host_supported hci_cp;
1873 struct mgmt_pending_cmd *cmd;
1874 struct hci_request req;
1875 int err;
1876 u8 val, enabled;
1877
1878 BT_DBG("request for %s", hdev->name);
1879
1880 if (!lmp_le_capable(hdev))
1881 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1882 MGMT_STATUS_NOT_SUPPORTED);
1883
1884 if (cp->val != 0x00 && cp->val != 0x01)
1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1886 MGMT_STATUS_INVALID_PARAMS);
1887
1888 /* Bluetooth single mode LE only controllers or dual-mode
1889 * controllers configured as LE only devices, do not allow
1890 * switching LE off. These have either LE enabled explicitly
1891 * or BR/EDR has been previously switched off.
1892 *
1893 * When trying to enable an already enabled LE, then gracefully
1894 * send a positive response. Trying to disable it however will
1895 * result into rejection.
1896 */
1897 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1898 if (cp->val == 0x01)
1899 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1900
1901 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1902 MGMT_STATUS_REJECTED);
1903 }
1904
1905 hci_dev_lock(hdev);
1906
1907 val = !!cp->val;
1908 enabled = lmp_host_le_capable(hdev);
1909
1910 if (!val)
1911 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1912
1913 if (!hdev_is_powered(hdev) || val == enabled) {
1914 bool changed = false;
1915
1916 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1917 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1918 changed = true;
1919 }
1920
1921 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1922 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1923 changed = true;
1924 }
1925
1926 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1927 if (err < 0)
1928 goto unlock;
1929
1930 if (changed)
1931 err = new_settings(hdev, sk);
1932
1933 goto unlock;
1934 }
1935
1936 if (pending_find(MGMT_OP_SET_LE, hdev) ||
1937 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939 MGMT_STATUS_BUSY);
1940 goto unlock;
1941 }
1942
1943 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1944 if (!cmd) {
1945 err = -ENOMEM;
1946 goto unlock;
1947 }
1948
1949 hci_req_init(&req, hdev);
1950
1951 memset(&hci_cp, 0, sizeof(hci_cp));
1952
1953 if (val) {
1954 hci_cp.le = val;
1955 hci_cp.simul = 0x00;
1956 } else {
1957 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1958 __hci_req_disable_advertising(&req);
1959
1960 if (ext_adv_capable(hdev))
1961 __hci_req_clear_ext_adv_sets(&req);
1962 }
1963
1964 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1965 &hci_cp);
1966
1967 err = hci_req_run(&req, le_enable_complete);
1968 if (err < 0)
1969 mgmt_pending_remove(cmd);
1970
1971 unlock:
1972 hci_dev_unlock(hdev);
1973 return err;
1974 }
1975
1976 /* This is a helper function to test for pending mgmt commands that can
1977 * cause CoD or EIR HCI commands. We can only allow one such pending
1978 * mgmt command at a time since otherwise we cannot easily track what
1979 * the current values are, will be, and based on that calculate if a new
1980 * HCI command needs to be sent and if yes with what value.
1981 */
pending_eir_or_class(struct hci_dev * hdev)1982 static bool pending_eir_or_class(struct hci_dev *hdev)
1983 {
1984 struct mgmt_pending_cmd *cmd;
1985
1986 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1987 switch (cmd->opcode) {
1988 case MGMT_OP_ADD_UUID:
1989 case MGMT_OP_REMOVE_UUID:
1990 case MGMT_OP_SET_DEV_CLASS:
1991 case MGMT_OP_SET_POWERED:
1992 return true;
1993 }
1994 }
1995
1996 return false;
1997 }
1998
1999 static const u8 bluetooth_base_uuid[] = {
2000 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2001 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2002 };
2003
get_uuid_size(const u8 * uuid)2004 static u8 get_uuid_size(const u8 *uuid)
2005 {
2006 u32 val;
2007
2008 if (memcmp(uuid, bluetooth_base_uuid, 12))
2009 return 128;
2010
2011 val = get_unaligned_le32(&uuid[12]);
2012 if (val > 0xffff)
2013 return 32;
2014
2015 return 16;
2016 }
2017
mgmt_class_complete(struct hci_dev * hdev,u16 mgmt_op,u8 status)2018 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2019 {
2020 struct mgmt_pending_cmd *cmd;
2021
2022 hci_dev_lock(hdev);
2023
2024 cmd = pending_find(mgmt_op, hdev);
2025 if (!cmd)
2026 goto unlock;
2027
2028 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2029 mgmt_status(status), hdev->dev_class, 3);
2030
2031 mgmt_pending_remove(cmd);
2032
2033 unlock:
2034 hci_dev_unlock(hdev);
2035 }
2036
add_uuid_complete(struct hci_dev * hdev,u8 status,u16 opcode)2037 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2038 {
2039 BT_DBG("status 0x%02x", status);
2040
2041 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2042 }
2043
add_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2044 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2045 {
2046 struct mgmt_cp_add_uuid *cp = data;
2047 struct mgmt_pending_cmd *cmd;
2048 struct hci_request req;
2049 struct bt_uuid *uuid;
2050 int err;
2051
2052 BT_DBG("request for %s", hdev->name);
2053
2054 hci_dev_lock(hdev);
2055
2056 if (pending_eir_or_class(hdev)) {
2057 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2058 MGMT_STATUS_BUSY);
2059 goto failed;
2060 }
2061
2062 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2063 if (!uuid) {
2064 err = -ENOMEM;
2065 goto failed;
2066 }
2067
2068 memcpy(uuid->uuid, cp->uuid, 16);
2069 uuid->svc_hint = cp->svc_hint;
2070 uuid->size = get_uuid_size(cp->uuid);
2071
2072 list_add_tail(&uuid->list, &hdev->uuids);
2073
2074 hci_req_init(&req, hdev);
2075
2076 __hci_req_update_class(&req);
2077 __hci_req_update_eir(&req);
2078
2079 err = hci_req_run(&req, add_uuid_complete);
2080 if (err < 0) {
2081 if (err != -ENODATA)
2082 goto failed;
2083
2084 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2085 hdev->dev_class, 3);
2086 goto failed;
2087 }
2088
2089 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2090 if (!cmd) {
2091 err = -ENOMEM;
2092 goto failed;
2093 }
2094
2095 err = 0;
2096
2097 failed:
2098 hci_dev_unlock(hdev);
2099 return err;
2100 }
2101
enable_service_cache(struct hci_dev * hdev)2102 static bool enable_service_cache(struct hci_dev *hdev)
2103 {
2104 if (!hdev_is_powered(hdev))
2105 return false;
2106
2107 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2108 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2109 CACHE_TIMEOUT);
2110 return true;
2111 }
2112
2113 return false;
2114 }
2115
remove_uuid_complete(struct hci_dev * hdev,u8 status,u16 opcode)2116 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2117 {
2118 BT_DBG("status 0x%02x", status);
2119
2120 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2121 }
2122
remove_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2123 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2124 u16 len)
2125 {
2126 struct mgmt_cp_remove_uuid *cp = data;
2127 struct mgmt_pending_cmd *cmd;
2128 struct bt_uuid *match, *tmp;
2129 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2130 struct hci_request req;
2131 int err, found;
2132
2133 BT_DBG("request for %s", hdev->name);
2134
2135 hci_dev_lock(hdev);
2136
2137 if (pending_eir_or_class(hdev)) {
2138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2139 MGMT_STATUS_BUSY);
2140 goto unlock;
2141 }
2142
2143 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2144 hci_uuids_clear(hdev);
2145
2146 if (enable_service_cache(hdev)) {
2147 err = mgmt_cmd_complete(sk, hdev->id,
2148 MGMT_OP_REMOVE_UUID,
2149 0, hdev->dev_class, 3);
2150 goto unlock;
2151 }
2152
2153 goto update_class;
2154 }
2155
2156 found = 0;
2157
2158 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2159 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2160 continue;
2161
2162 list_del(&match->list);
2163 kfree(match);
2164 found++;
2165 }
2166
2167 if (found == 0) {
2168 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2169 MGMT_STATUS_INVALID_PARAMS);
2170 goto unlock;
2171 }
2172
2173 update_class:
2174 hci_req_init(&req, hdev);
2175
2176 __hci_req_update_class(&req);
2177 __hci_req_update_eir(&req);
2178
2179 err = hci_req_run(&req, remove_uuid_complete);
2180 if (err < 0) {
2181 if (err != -ENODATA)
2182 goto unlock;
2183
2184 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2185 hdev->dev_class, 3);
2186 goto unlock;
2187 }
2188
2189 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2190 if (!cmd) {
2191 err = -ENOMEM;
2192 goto unlock;
2193 }
2194
2195 err = 0;
2196
2197 unlock:
2198 hci_dev_unlock(hdev);
2199 return err;
2200 }
2201
set_class_complete(struct hci_dev * hdev,u8 status,u16 opcode)2202 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2203 {
2204 BT_DBG("status 0x%02x", status);
2205
2206 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2207 }
2208
set_dev_class(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2209 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2210 u16 len)
2211 {
2212 struct mgmt_cp_set_dev_class *cp = data;
2213 struct mgmt_pending_cmd *cmd;
2214 struct hci_request req;
2215 int err;
2216
2217 BT_DBG("request for %s", hdev->name);
2218
2219 if (!lmp_bredr_capable(hdev))
2220 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2221 MGMT_STATUS_NOT_SUPPORTED);
2222
2223 hci_dev_lock(hdev);
2224
2225 if (pending_eir_or_class(hdev)) {
2226 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2227 MGMT_STATUS_BUSY);
2228 goto unlock;
2229 }
2230
2231 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2232 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2233 MGMT_STATUS_INVALID_PARAMS);
2234 goto unlock;
2235 }
2236
2237 hdev->major_class = cp->major;
2238 hdev->minor_class = cp->minor;
2239
2240 if (!hdev_is_powered(hdev)) {
2241 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2242 hdev->dev_class, 3);
2243 goto unlock;
2244 }
2245
2246 hci_req_init(&req, hdev);
2247
2248 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2249 hci_dev_unlock(hdev);
2250 cancel_delayed_work_sync(&hdev->service_cache);
2251 hci_dev_lock(hdev);
2252 __hci_req_update_eir(&req);
2253 }
2254
2255 __hci_req_update_class(&req);
2256
2257 err = hci_req_run(&req, set_class_complete);
2258 if (err < 0) {
2259 if (err != -ENODATA)
2260 goto unlock;
2261
2262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2263 hdev->dev_class, 3);
2264 goto unlock;
2265 }
2266
2267 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2268 if (!cmd) {
2269 err = -ENOMEM;
2270 goto unlock;
2271 }
2272
2273 err = 0;
2274
2275 unlock:
2276 hci_dev_unlock(hdev);
2277 return err;
2278 }
2279
load_link_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2280 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2281 u16 len)
2282 {
2283 struct mgmt_cp_load_link_keys *cp = data;
2284 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2285 sizeof(struct mgmt_link_key_info));
2286 u16 key_count, expected_len;
2287 bool changed;
2288 int i;
2289
2290 BT_DBG("request for %s", hdev->name);
2291
2292 if (!lmp_bredr_capable(hdev))
2293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2294 MGMT_STATUS_NOT_SUPPORTED);
2295
2296 key_count = __le16_to_cpu(cp->key_count);
2297 if (key_count > max_key_count) {
2298 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2299 key_count);
2300 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2301 MGMT_STATUS_INVALID_PARAMS);
2302 }
2303
2304 expected_len = sizeof(*cp) + key_count *
2305 sizeof(struct mgmt_link_key_info);
2306 if (expected_len != len) {
2307 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2308 expected_len, len);
2309 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2310 MGMT_STATUS_INVALID_PARAMS);
2311 }
2312
2313 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2314 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2315 MGMT_STATUS_INVALID_PARAMS);
2316
2317 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2318 key_count);
2319
2320 for (i = 0; i < key_count; i++) {
2321 struct mgmt_link_key_info *key = &cp->keys[i];
2322
2323 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2324 return mgmt_cmd_status(sk, hdev->id,
2325 MGMT_OP_LOAD_LINK_KEYS,
2326 MGMT_STATUS_INVALID_PARAMS);
2327 }
2328
2329 hci_dev_lock(hdev);
2330
2331 hci_link_keys_clear(hdev);
2332
2333 if (cp->debug_keys)
2334 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2335 else
2336 changed = hci_dev_test_and_clear_flag(hdev,
2337 HCI_KEEP_DEBUG_KEYS);
2338
2339 if (changed)
2340 new_settings(hdev, NULL);
2341
2342 for (i = 0; i < key_count; i++) {
2343 struct mgmt_link_key_info *key = &cp->keys[i];
2344
2345 /* Always ignore debug keys and require a new pairing if
2346 * the user wants to use them.
2347 */
2348 if (key->type == HCI_LK_DEBUG_COMBINATION)
2349 continue;
2350
2351 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2352 key->type, key->pin_len, NULL);
2353 }
2354
2355 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2356
2357 hci_dev_unlock(hdev);
2358
2359 return 0;
2360 }
2361
device_unpaired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,struct sock * skip_sk)2362 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2363 u8 addr_type, struct sock *skip_sk)
2364 {
2365 struct mgmt_ev_device_unpaired ev;
2366
2367 bacpy(&ev.addr.bdaddr, bdaddr);
2368 ev.addr.type = addr_type;
2369
2370 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2371 skip_sk);
2372 }
2373
unpair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2374 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2375 u16 len)
2376 {
2377 struct mgmt_cp_unpair_device *cp = data;
2378 struct mgmt_rp_unpair_device rp;
2379 struct hci_conn_params *params;
2380 struct mgmt_pending_cmd *cmd;
2381 struct hci_conn *conn;
2382 u8 addr_type;
2383 int err;
2384
2385 memset(&rp, 0, sizeof(rp));
2386 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2387 rp.addr.type = cp->addr.type;
2388
2389 if (!bdaddr_type_is_valid(cp->addr.type))
2390 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2391 MGMT_STATUS_INVALID_PARAMS,
2392 &rp, sizeof(rp));
2393
2394 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2395 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2396 MGMT_STATUS_INVALID_PARAMS,
2397 &rp, sizeof(rp));
2398
2399 hci_dev_lock(hdev);
2400
2401 if (!hdev_is_powered(hdev)) {
2402 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2403 MGMT_STATUS_NOT_POWERED, &rp,
2404 sizeof(rp));
2405 goto unlock;
2406 }
2407
2408 if (cp->addr.type == BDADDR_BREDR) {
2409 /* If disconnection is requested, then look up the
2410 * connection. If the remote device is connected, it
2411 * will be later used to terminate the link.
2412 *
2413 * Setting it to NULL explicitly will cause no
2414 * termination of the link.
2415 */
2416 if (cp->disconnect)
2417 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2418 &cp->addr.bdaddr);
2419 else
2420 conn = NULL;
2421
2422 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2423 if (err < 0) {
2424 err = mgmt_cmd_complete(sk, hdev->id,
2425 MGMT_OP_UNPAIR_DEVICE,
2426 MGMT_STATUS_NOT_PAIRED, &rp,
2427 sizeof(rp));
2428 goto unlock;
2429 }
2430
2431 goto done;
2432 }
2433
2434 /* LE address type */
2435 addr_type = le_addr_type(cp->addr.type);
2436
2437 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2438 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2439 if (err < 0) {
2440 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2441 MGMT_STATUS_NOT_PAIRED, &rp,
2442 sizeof(rp));
2443 goto unlock;
2444 }
2445
2446 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2447 if (!conn) {
2448 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2449 goto done;
2450 }
2451
2452
2453 /* Defer clearing up the connection parameters until closing to
2454 * give a chance of keeping them if a repairing happens.
2455 */
2456 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2457
2458 /* Disable auto-connection parameters if present */
2459 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2460 if (params) {
2461 if (params->explicit_connect)
2462 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2463 else
2464 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2465 }
2466
2467 /* If disconnection is not requested, then clear the connection
2468 * variable so that the link is not terminated.
2469 */
2470 if (!cp->disconnect)
2471 conn = NULL;
2472
2473 done:
2474 /* If the connection variable is set, then termination of the
2475 * link is requested.
2476 */
2477 if (!conn) {
2478 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2479 &rp, sizeof(rp));
2480 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2481 goto unlock;
2482 }
2483
2484 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2485 sizeof(*cp));
2486 if (!cmd) {
2487 err = -ENOMEM;
2488 goto unlock;
2489 }
2490
2491 cmd->cmd_complete = addr_cmd_complete;
2492
2493 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2494 if (err < 0)
2495 mgmt_pending_remove(cmd);
2496
2497 unlock:
2498 hci_dev_unlock(hdev);
2499 return err;
2500 }
2501
disconnect(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2502 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2503 u16 len)
2504 {
2505 struct mgmt_cp_disconnect *cp = data;
2506 struct mgmt_rp_disconnect rp;
2507 struct mgmt_pending_cmd *cmd;
2508 struct hci_conn *conn;
2509 int err;
2510
2511 BT_DBG("");
2512
2513 memset(&rp, 0, sizeof(rp));
2514 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2515 rp.addr.type = cp->addr.type;
2516
2517 if (!bdaddr_type_is_valid(cp->addr.type))
2518 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2519 MGMT_STATUS_INVALID_PARAMS,
2520 &rp, sizeof(rp));
2521
2522 hci_dev_lock(hdev);
2523
2524 if (!test_bit(HCI_UP, &hdev->flags)) {
2525 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2526 MGMT_STATUS_NOT_POWERED, &rp,
2527 sizeof(rp));
2528 goto failed;
2529 }
2530
2531 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2532 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2533 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2534 goto failed;
2535 }
2536
2537 if (cp->addr.type == BDADDR_BREDR)
2538 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2539 &cp->addr.bdaddr);
2540 else
2541 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2542 le_addr_type(cp->addr.type));
2543
2544 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2545 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2546 MGMT_STATUS_NOT_CONNECTED, &rp,
2547 sizeof(rp));
2548 goto failed;
2549 }
2550
2551 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2552 if (!cmd) {
2553 err = -ENOMEM;
2554 goto failed;
2555 }
2556
2557 cmd->cmd_complete = generic_cmd_complete;
2558
2559 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2560 if (err < 0)
2561 mgmt_pending_remove(cmd);
2562
2563 failed:
2564 hci_dev_unlock(hdev);
2565 return err;
2566 }
2567
link_to_bdaddr(u8 link_type,u8 addr_type)2568 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2569 {
2570 switch (link_type) {
2571 case LE_LINK:
2572 switch (addr_type) {
2573 case ADDR_LE_DEV_PUBLIC:
2574 return BDADDR_LE_PUBLIC;
2575
2576 default:
2577 /* Fallback to LE Random address type */
2578 return BDADDR_LE_RANDOM;
2579 }
2580
2581 default:
2582 /* Fallback to BR/EDR type */
2583 return BDADDR_BREDR;
2584 }
2585 }
2586
get_connections(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)2587 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2588 u16 data_len)
2589 {
2590 struct mgmt_rp_get_connections *rp;
2591 struct hci_conn *c;
2592 size_t rp_len;
2593 int err;
2594 u16 i;
2595
2596 BT_DBG("");
2597
2598 hci_dev_lock(hdev);
2599
2600 if (!hdev_is_powered(hdev)) {
2601 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2602 MGMT_STATUS_NOT_POWERED);
2603 goto unlock;
2604 }
2605
2606 i = 0;
2607 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2608 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2609 i++;
2610 }
2611
2612 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2613 rp = kmalloc(rp_len, GFP_KERNEL);
2614 if (!rp) {
2615 err = -ENOMEM;
2616 goto unlock;
2617 }
2618
2619 i = 0;
2620 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2621 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2622 continue;
2623 bacpy(&rp->addr[i].bdaddr, &c->dst);
2624 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2625 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2626 continue;
2627 i++;
2628 }
2629
2630 rp->conn_count = cpu_to_le16(i);
2631
2632 /* Recalculate length in case of filtered SCO connections, etc */
2633 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2634
2635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2636 rp_len);
2637
2638 kfree(rp);
2639
2640 unlock:
2641 hci_dev_unlock(hdev);
2642 return err;
2643 }
2644
send_pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_pin_code_neg_reply * cp)2645 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2646 struct mgmt_cp_pin_code_neg_reply *cp)
2647 {
2648 struct mgmt_pending_cmd *cmd;
2649 int err;
2650
2651 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2652 sizeof(*cp));
2653 if (!cmd)
2654 return -ENOMEM;
2655
2656 cmd->cmd_complete = addr_cmd_complete;
2657
2658 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2659 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2660 if (err < 0)
2661 mgmt_pending_remove(cmd);
2662
2663 return err;
2664 }
2665
pin_code_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2666 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2667 u16 len)
2668 {
2669 struct hci_conn *conn;
2670 struct mgmt_cp_pin_code_reply *cp = data;
2671 struct hci_cp_pin_code_reply reply;
2672 struct mgmt_pending_cmd *cmd;
2673 int err;
2674
2675 BT_DBG("");
2676
2677 hci_dev_lock(hdev);
2678
2679 if (!hdev_is_powered(hdev)) {
2680 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2681 MGMT_STATUS_NOT_POWERED);
2682 goto failed;
2683 }
2684
2685 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2686 if (!conn) {
2687 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2688 MGMT_STATUS_NOT_CONNECTED);
2689 goto failed;
2690 }
2691
2692 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2693 struct mgmt_cp_pin_code_neg_reply ncp;
2694
2695 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2696
2697 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2698
2699 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2700 if (err >= 0)
2701 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2702 MGMT_STATUS_INVALID_PARAMS);
2703
2704 goto failed;
2705 }
2706
2707 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2708 if (!cmd) {
2709 err = -ENOMEM;
2710 goto failed;
2711 }
2712
2713 cmd->cmd_complete = addr_cmd_complete;
2714
2715 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2716 reply.pin_len = cp->pin_len;
2717 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2718
2719 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2720 if (err < 0)
2721 mgmt_pending_remove(cmd);
2722
2723 failed:
2724 hci_dev_unlock(hdev);
2725 return err;
2726 }
2727
set_io_capability(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2728 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2729 u16 len)
2730 {
2731 struct mgmt_cp_set_io_capability *cp = data;
2732
2733 BT_DBG("");
2734
2735 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2736 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2737 MGMT_STATUS_INVALID_PARAMS);
2738
2739 hci_dev_lock(hdev);
2740
2741 hdev->io_capability = cp->io_capability;
2742
2743 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2744 hdev->io_capability);
2745
2746 hci_dev_unlock(hdev);
2747
2748 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2749 NULL, 0);
2750 }
2751
find_pairing(struct hci_conn * conn)2752 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2753 {
2754 struct hci_dev *hdev = conn->hdev;
2755 struct mgmt_pending_cmd *cmd;
2756
2757 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2758 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2759 continue;
2760
2761 if (cmd->user_data != conn)
2762 continue;
2763
2764 return cmd;
2765 }
2766
2767 return NULL;
2768 }
2769
pairing_complete(struct mgmt_pending_cmd * cmd,u8 status)2770 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2771 {
2772 struct mgmt_rp_pair_device rp;
2773 struct hci_conn *conn = cmd->user_data;
2774 int err;
2775
2776 bacpy(&rp.addr.bdaddr, &conn->dst);
2777 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2778
2779 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2780 status, &rp, sizeof(rp));
2781
2782 /* So we don't get further callbacks for this connection */
2783 conn->connect_cfm_cb = NULL;
2784 conn->security_cfm_cb = NULL;
2785 conn->disconn_cfm_cb = NULL;
2786
2787 hci_conn_drop(conn);
2788
2789 /* The device is paired so there is no need to remove
2790 * its connection parameters anymore.
2791 */
2792 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2793
2794 hci_conn_put(conn);
2795
2796 return err;
2797 }
2798
mgmt_smp_complete(struct hci_conn * conn,bool complete)2799 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2800 {
2801 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2802 struct mgmt_pending_cmd *cmd;
2803
2804 cmd = find_pairing(conn);
2805 if (cmd) {
2806 cmd->cmd_complete(cmd, status);
2807 mgmt_pending_remove(cmd);
2808 }
2809 }
2810
pairing_complete_cb(struct hci_conn * conn,u8 status)2811 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2812 {
2813 struct mgmt_pending_cmd *cmd;
2814
2815 BT_DBG("status %u", status);
2816
2817 cmd = find_pairing(conn);
2818 if (!cmd) {
2819 BT_DBG("Unable to find a pending command");
2820 return;
2821 }
2822
2823 cmd->cmd_complete(cmd, mgmt_status(status));
2824 mgmt_pending_remove(cmd);
2825 }
2826
le_pairing_complete_cb(struct hci_conn * conn,u8 status)2827 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2828 {
2829 struct mgmt_pending_cmd *cmd;
2830
2831 BT_DBG("status %u", status);
2832
2833 if (!status)
2834 return;
2835
2836 cmd = find_pairing(conn);
2837 if (!cmd) {
2838 BT_DBG("Unable to find a pending command");
2839 return;
2840 }
2841
2842 cmd->cmd_complete(cmd, mgmt_status(status));
2843 mgmt_pending_remove(cmd);
2844 }
2845
pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2846 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2847 u16 len)
2848 {
2849 struct mgmt_cp_pair_device *cp = data;
2850 struct mgmt_rp_pair_device rp;
2851 struct mgmt_pending_cmd *cmd;
2852 u8 sec_level, auth_type;
2853 struct hci_conn *conn;
2854 int err;
2855
2856 BT_DBG("");
2857
2858 memset(&rp, 0, sizeof(rp));
2859 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2860 rp.addr.type = cp->addr.type;
2861
2862 if (!bdaddr_type_is_valid(cp->addr.type))
2863 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2864 MGMT_STATUS_INVALID_PARAMS,
2865 &rp, sizeof(rp));
2866
2867 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2868 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2869 MGMT_STATUS_INVALID_PARAMS,
2870 &rp, sizeof(rp));
2871
2872 hci_dev_lock(hdev);
2873
2874 if (!hdev_is_powered(hdev)) {
2875 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2876 MGMT_STATUS_NOT_POWERED, &rp,
2877 sizeof(rp));
2878 goto unlock;
2879 }
2880
2881 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2882 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2883 MGMT_STATUS_ALREADY_PAIRED, &rp,
2884 sizeof(rp));
2885 goto unlock;
2886 }
2887
2888 sec_level = BT_SECURITY_MEDIUM;
2889 auth_type = HCI_AT_DEDICATED_BONDING;
2890
2891 if (cp->addr.type == BDADDR_BREDR) {
2892 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2893 auth_type);
2894 } else {
2895 u8 addr_type = le_addr_type(cp->addr.type);
2896 struct hci_conn_params *p;
2897
2898 /* When pairing a new device, it is expected to remember
2899 * this device for future connections. Adding the connection
2900 * parameter information ahead of time allows tracking
2901 * of the slave preferred values and will speed up any
2902 * further connection establishment.
2903 *
2904 * If connection parameters already exist, then they
2905 * will be kept and this function does nothing.
2906 */
2907 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2908
2909 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2910 p->auto_connect = HCI_AUTO_CONN_DISABLED;
2911
2912 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2913 addr_type, sec_level,
2914 HCI_LE_CONN_TIMEOUT);
2915 }
2916
2917 if (IS_ERR(conn)) {
2918 int status;
2919
2920 if (PTR_ERR(conn) == -EBUSY)
2921 status = MGMT_STATUS_BUSY;
2922 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2923 status = MGMT_STATUS_NOT_SUPPORTED;
2924 else if (PTR_ERR(conn) == -ECONNREFUSED)
2925 status = MGMT_STATUS_REJECTED;
2926 else
2927 status = MGMT_STATUS_CONNECT_FAILED;
2928
2929 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2930 status, &rp, sizeof(rp));
2931 goto unlock;
2932 }
2933
2934 if (conn->connect_cfm_cb) {
2935 hci_conn_drop(conn);
2936 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2937 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2938 goto unlock;
2939 }
2940
2941 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2942 if (!cmd) {
2943 err = -ENOMEM;
2944 hci_conn_drop(conn);
2945 goto unlock;
2946 }
2947
2948 cmd->cmd_complete = pairing_complete;
2949
2950 /* For LE, just connecting isn't a proof that the pairing finished */
2951 if (cp->addr.type == BDADDR_BREDR) {
2952 conn->connect_cfm_cb = pairing_complete_cb;
2953 conn->security_cfm_cb = pairing_complete_cb;
2954 conn->disconn_cfm_cb = pairing_complete_cb;
2955 } else {
2956 conn->connect_cfm_cb = le_pairing_complete_cb;
2957 conn->security_cfm_cb = le_pairing_complete_cb;
2958 conn->disconn_cfm_cb = le_pairing_complete_cb;
2959 }
2960
2961 conn->io_capability = cp->io_cap;
2962 cmd->user_data = hci_conn_get(conn);
2963
2964 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2965 hci_conn_security(conn, sec_level, auth_type, true)) {
2966 cmd->cmd_complete(cmd, 0);
2967 mgmt_pending_remove(cmd);
2968 }
2969
2970 err = 0;
2971
2972 unlock:
2973 hci_dev_unlock(hdev);
2974 return err;
2975 }
2976
cancel_pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2977 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2978 u16 len)
2979 {
2980 struct mgmt_addr_info *addr = data;
2981 struct mgmt_pending_cmd *cmd;
2982 struct hci_conn *conn;
2983 int err;
2984
2985 BT_DBG("");
2986
2987 hci_dev_lock(hdev);
2988
2989 if (!hdev_is_powered(hdev)) {
2990 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2991 MGMT_STATUS_NOT_POWERED);
2992 goto unlock;
2993 }
2994
2995 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2996 if (!cmd) {
2997 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2998 MGMT_STATUS_INVALID_PARAMS);
2999 goto unlock;
3000 }
3001
3002 conn = cmd->user_data;
3003
3004 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3005 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3006 MGMT_STATUS_INVALID_PARAMS);
3007 goto unlock;
3008 }
3009
3010 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3011 mgmt_pending_remove(cmd);
3012
3013 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3014 addr, sizeof(*addr));
3015 unlock:
3016 hci_dev_unlock(hdev);
3017 return err;
3018 }
3019
user_pairing_resp(struct sock * sk,struct hci_dev * hdev,struct mgmt_addr_info * addr,u16 mgmt_op,u16 hci_op,__le32 passkey)3020 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3021 struct mgmt_addr_info *addr, u16 mgmt_op,
3022 u16 hci_op, __le32 passkey)
3023 {
3024 struct mgmt_pending_cmd *cmd;
3025 struct hci_conn *conn;
3026 int err;
3027
3028 hci_dev_lock(hdev);
3029
3030 if (!hdev_is_powered(hdev)) {
3031 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3032 MGMT_STATUS_NOT_POWERED, addr,
3033 sizeof(*addr));
3034 goto done;
3035 }
3036
3037 if (addr->type == BDADDR_BREDR)
3038 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3039 else
3040 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3041 le_addr_type(addr->type));
3042
3043 if (!conn) {
3044 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3045 MGMT_STATUS_NOT_CONNECTED, addr,
3046 sizeof(*addr));
3047 goto done;
3048 }
3049
3050 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3051 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3052 if (!err)
3053 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3054 MGMT_STATUS_SUCCESS, addr,
3055 sizeof(*addr));
3056 else
3057 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3058 MGMT_STATUS_FAILED, addr,
3059 sizeof(*addr));
3060
3061 goto done;
3062 }
3063
3064 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3065 if (!cmd) {
3066 err = -ENOMEM;
3067 goto done;
3068 }
3069
3070 cmd->cmd_complete = addr_cmd_complete;
3071
3072 /* Continue with pairing via HCI */
3073 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3074 struct hci_cp_user_passkey_reply cp;
3075
3076 bacpy(&cp.bdaddr, &addr->bdaddr);
3077 cp.passkey = passkey;
3078 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3079 } else
3080 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3081 &addr->bdaddr);
3082
3083 if (err < 0)
3084 mgmt_pending_remove(cmd);
3085
3086 done:
3087 hci_dev_unlock(hdev);
3088 return err;
3089 }
3090
pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3091 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3092 void *data, u16 len)
3093 {
3094 struct mgmt_cp_pin_code_neg_reply *cp = data;
3095
3096 BT_DBG("");
3097
3098 return user_pairing_resp(sk, hdev, &cp->addr,
3099 MGMT_OP_PIN_CODE_NEG_REPLY,
3100 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3101 }
3102
user_confirm_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3103 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3104 u16 len)
3105 {
3106 struct mgmt_cp_user_confirm_reply *cp = data;
3107
3108 BT_DBG("");
3109
3110 if (len != sizeof(*cp))
3111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3112 MGMT_STATUS_INVALID_PARAMS);
3113
3114 return user_pairing_resp(sk, hdev, &cp->addr,
3115 MGMT_OP_USER_CONFIRM_REPLY,
3116 HCI_OP_USER_CONFIRM_REPLY, 0);
3117 }
3118
user_confirm_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3119 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3120 void *data, u16 len)
3121 {
3122 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3123
3124 BT_DBG("");
3125
3126 return user_pairing_resp(sk, hdev, &cp->addr,
3127 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3128 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3129 }
3130
user_passkey_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3131 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3132 u16 len)
3133 {
3134 struct mgmt_cp_user_passkey_reply *cp = data;
3135
3136 BT_DBG("");
3137
3138 return user_pairing_resp(sk, hdev, &cp->addr,
3139 MGMT_OP_USER_PASSKEY_REPLY,
3140 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3141 }
3142
user_passkey_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3143 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3144 void *data, u16 len)
3145 {
3146 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3147
3148 BT_DBG("");
3149
3150 return user_pairing_resp(sk, hdev, &cp->addr,
3151 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3152 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3153 }
3154
adv_expire(struct hci_dev * hdev,u32 flags)3155 static void adv_expire(struct hci_dev *hdev, u32 flags)
3156 {
3157 struct adv_info *adv_instance;
3158 struct hci_request req;
3159 int err;
3160
3161 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3162 if (!adv_instance)
3163 return;
3164
3165 /* stop if current instance doesn't need to be changed */
3166 if (!(adv_instance->flags & flags))
3167 return;
3168
3169 cancel_adv_timeout(hdev);
3170
3171 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3172 if (!adv_instance)
3173 return;
3174
3175 hci_req_init(&req, hdev);
3176 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3177 true);
3178 if (err)
3179 return;
3180
3181 hci_req_run(&req, NULL);
3182 }
3183
set_name_complete(struct hci_dev * hdev,u8 status,u16 opcode)3184 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3185 {
3186 struct mgmt_cp_set_local_name *cp;
3187 struct mgmt_pending_cmd *cmd;
3188
3189 BT_DBG("status 0x%02x", status);
3190
3191 hci_dev_lock(hdev);
3192
3193 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3194 if (!cmd)
3195 goto unlock;
3196
3197 cp = cmd->param;
3198
3199 if (status) {
3200 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3201 mgmt_status(status));
3202 } else {
3203 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3204 cp, sizeof(*cp));
3205
3206 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3207 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3208 }
3209
3210 mgmt_pending_remove(cmd);
3211
3212 unlock:
3213 hci_dev_unlock(hdev);
3214 }
3215
set_local_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3216 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3217 u16 len)
3218 {
3219 struct mgmt_cp_set_local_name *cp = data;
3220 struct mgmt_pending_cmd *cmd;
3221 struct hci_request req;
3222 int err;
3223
3224 BT_DBG("");
3225
3226 hci_dev_lock(hdev);
3227
3228 /* If the old values are the same as the new ones just return a
3229 * direct command complete event.
3230 */
3231 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3232 !memcmp(hdev->short_name, cp->short_name,
3233 sizeof(hdev->short_name))) {
3234 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3235 data, len);
3236 goto failed;
3237 }
3238
3239 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3240
3241 if (!hdev_is_powered(hdev)) {
3242 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3243
3244 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3245 data, len);
3246 if (err < 0)
3247 goto failed;
3248
3249 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3250 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3251 ext_info_changed(hdev, sk);
3252
3253 goto failed;
3254 }
3255
3256 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3257 if (!cmd) {
3258 err = -ENOMEM;
3259 goto failed;
3260 }
3261
3262 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3263
3264 hci_req_init(&req, hdev);
3265
3266 if (lmp_bredr_capable(hdev)) {
3267 __hci_req_update_name(&req);
3268 __hci_req_update_eir(&req);
3269 }
3270
3271 /* The name is stored in the scan response data and so
3272 * no need to udpate the advertising data here.
3273 */
3274 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3275 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3276
3277 err = hci_req_run(&req, set_name_complete);
3278 if (err < 0)
3279 mgmt_pending_remove(cmd);
3280
3281 failed:
3282 hci_dev_unlock(hdev);
3283 return err;
3284 }
3285
set_appearance(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3286 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3287 u16 len)
3288 {
3289 struct mgmt_cp_set_appearance *cp = data;
3290 u16 apperance;
3291 int err;
3292
3293 BT_DBG("");
3294
3295 if (!lmp_le_capable(hdev))
3296 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3297 MGMT_STATUS_NOT_SUPPORTED);
3298
3299 apperance = le16_to_cpu(cp->appearance);
3300
3301 hci_dev_lock(hdev);
3302
3303 if (hdev->appearance != apperance) {
3304 hdev->appearance = apperance;
3305
3306 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3307 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3308
3309 ext_info_changed(hdev, sk);
3310 }
3311
3312 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3313 0);
3314
3315 hci_dev_unlock(hdev);
3316
3317 return err;
3318 }
3319
get_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3320 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3321 void *data, u16 len)
3322 {
3323 struct mgmt_rp_get_phy_confguration rp;
3324
3325 BT_DBG("sock %p %s", sk, hdev->name);
3326
3327 hci_dev_lock(hdev);
3328
3329 memset(&rp, 0, sizeof(rp));
3330
3331 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3332 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3333 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3334
3335 hci_dev_unlock(hdev);
3336
3337 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3338 &rp, sizeof(rp));
3339 }
3340
mgmt_phy_configuration_changed(struct hci_dev * hdev,struct sock * skip)3341 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3342 {
3343 struct mgmt_ev_phy_configuration_changed ev;
3344
3345 memset(&ev, 0, sizeof(ev));
3346
3347 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3348
3349 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3350 sizeof(ev), skip);
3351 }
3352
set_default_phy_complete(struct hci_dev * hdev,u8 status,u16 opcode,struct sk_buff * skb)3353 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3354 u16 opcode, struct sk_buff *skb)
3355 {
3356 struct mgmt_pending_cmd *cmd;
3357
3358 BT_DBG("status 0x%02x", status);
3359
3360 hci_dev_lock(hdev);
3361
3362 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3363 if (!cmd)
3364 goto unlock;
3365
3366 if (status) {
3367 mgmt_cmd_status(cmd->sk, hdev->id,
3368 MGMT_OP_SET_PHY_CONFIGURATION,
3369 mgmt_status(status));
3370 } else {
3371 mgmt_cmd_complete(cmd->sk, hdev->id,
3372 MGMT_OP_SET_PHY_CONFIGURATION, 0,
3373 NULL, 0);
3374
3375 mgmt_phy_configuration_changed(hdev, cmd->sk);
3376 }
3377
3378 mgmt_pending_remove(cmd);
3379
3380 unlock:
3381 hci_dev_unlock(hdev);
3382 }
3383
set_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3384 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3385 void *data, u16 len)
3386 {
3387 struct mgmt_cp_set_phy_confguration *cp = data;
3388 struct hci_cp_le_set_default_phy cp_phy;
3389 struct mgmt_pending_cmd *cmd;
3390 struct hci_request req;
3391 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3392 u16 pkt_type = (HCI_DH1 | HCI_DM1);
3393 bool changed = false;
3394 int err;
3395
3396 BT_DBG("sock %p %s", sk, hdev->name);
3397
3398 configurable_phys = get_configurable_phys(hdev);
3399 supported_phys = get_supported_phys(hdev);
3400 selected_phys = __le32_to_cpu(cp->selected_phys);
3401
3402 if (selected_phys & ~supported_phys)
3403 return mgmt_cmd_status(sk, hdev->id,
3404 MGMT_OP_SET_PHY_CONFIGURATION,
3405 MGMT_STATUS_INVALID_PARAMS);
3406
3407 unconfigure_phys = supported_phys & ~configurable_phys;
3408
3409 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3410 return mgmt_cmd_status(sk, hdev->id,
3411 MGMT_OP_SET_PHY_CONFIGURATION,
3412 MGMT_STATUS_INVALID_PARAMS);
3413
3414 if (selected_phys == get_selected_phys(hdev))
3415 return mgmt_cmd_complete(sk, hdev->id,
3416 MGMT_OP_SET_PHY_CONFIGURATION,
3417 0, NULL, 0);
3418
3419 hci_dev_lock(hdev);
3420
3421 if (!hdev_is_powered(hdev)) {
3422 err = mgmt_cmd_status(sk, hdev->id,
3423 MGMT_OP_SET_PHY_CONFIGURATION,
3424 MGMT_STATUS_REJECTED);
3425 goto unlock;
3426 }
3427
3428 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3429 err = mgmt_cmd_status(sk, hdev->id,
3430 MGMT_OP_SET_PHY_CONFIGURATION,
3431 MGMT_STATUS_BUSY);
3432 goto unlock;
3433 }
3434
3435 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3436 pkt_type |= (HCI_DH3 | HCI_DM3);
3437 else
3438 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3439
3440 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3441 pkt_type |= (HCI_DH5 | HCI_DM5);
3442 else
3443 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3444
3445 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3446 pkt_type &= ~HCI_2DH1;
3447 else
3448 pkt_type |= HCI_2DH1;
3449
3450 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3451 pkt_type &= ~HCI_2DH3;
3452 else
3453 pkt_type |= HCI_2DH3;
3454
3455 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3456 pkt_type &= ~HCI_2DH5;
3457 else
3458 pkt_type |= HCI_2DH5;
3459
3460 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3461 pkt_type &= ~HCI_3DH1;
3462 else
3463 pkt_type |= HCI_3DH1;
3464
3465 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3466 pkt_type &= ~HCI_3DH3;
3467 else
3468 pkt_type |= HCI_3DH3;
3469
3470 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3471 pkt_type &= ~HCI_3DH5;
3472 else
3473 pkt_type |= HCI_3DH5;
3474
3475 if (pkt_type != hdev->pkt_type) {
3476 hdev->pkt_type = pkt_type;
3477 changed = true;
3478 }
3479
3480 if ((selected_phys & MGMT_PHY_LE_MASK) ==
3481 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3482 if (changed)
3483 mgmt_phy_configuration_changed(hdev, sk);
3484
3485 err = mgmt_cmd_complete(sk, hdev->id,
3486 MGMT_OP_SET_PHY_CONFIGURATION,
3487 0, NULL, 0);
3488
3489 goto unlock;
3490 }
3491
3492 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3493 len);
3494 if (!cmd) {
3495 err = -ENOMEM;
3496 goto unlock;
3497 }
3498
3499 hci_req_init(&req, hdev);
3500
3501 memset(&cp_phy, 0, sizeof(cp_phy));
3502
3503 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3504 cp_phy.all_phys |= 0x01;
3505
3506 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3507 cp_phy.all_phys |= 0x02;
3508
3509 if (selected_phys & MGMT_PHY_LE_1M_TX)
3510 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3511
3512 if (selected_phys & MGMT_PHY_LE_2M_TX)
3513 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3514
3515 if (selected_phys & MGMT_PHY_LE_CODED_TX)
3516 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3517
3518 if (selected_phys & MGMT_PHY_LE_1M_RX)
3519 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3520
3521 if (selected_phys & MGMT_PHY_LE_2M_RX)
3522 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3523
3524 if (selected_phys & MGMT_PHY_LE_CODED_RX)
3525 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3526
3527 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3528
3529 err = hci_req_run_skb(&req, set_default_phy_complete);
3530 if (err < 0)
3531 mgmt_pending_remove(cmd);
3532
3533 unlock:
3534 hci_dev_unlock(hdev);
3535
3536 return err;
3537 }
3538
read_local_oob_data_complete(struct hci_dev * hdev,u8 status,u16 opcode,struct sk_buff * skb)3539 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3540 u16 opcode, struct sk_buff *skb)
3541 {
3542 struct mgmt_rp_read_local_oob_data mgmt_rp;
3543 size_t rp_size = sizeof(mgmt_rp);
3544 struct mgmt_pending_cmd *cmd;
3545
3546 BT_DBG("%s status %u", hdev->name, status);
3547
3548 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3549 if (!cmd)
3550 return;
3551
3552 if (status || !skb) {
3553 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3554 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3555 goto remove;
3556 }
3557
3558 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3559
3560 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3561 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3562
3563 if (skb->len < sizeof(*rp)) {
3564 mgmt_cmd_status(cmd->sk, hdev->id,
3565 MGMT_OP_READ_LOCAL_OOB_DATA,
3566 MGMT_STATUS_FAILED);
3567 goto remove;
3568 }
3569
3570 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3571 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3572
3573 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3574 } else {
3575 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3576
3577 if (skb->len < sizeof(*rp)) {
3578 mgmt_cmd_status(cmd->sk, hdev->id,
3579 MGMT_OP_READ_LOCAL_OOB_DATA,
3580 MGMT_STATUS_FAILED);
3581 goto remove;
3582 }
3583
3584 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3585 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3586
3587 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3588 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3589 }
3590
3591 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3592 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3593
3594 remove:
3595 mgmt_pending_remove(cmd);
3596 }
3597
read_local_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)3598 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3599 void *data, u16 data_len)
3600 {
3601 struct mgmt_pending_cmd *cmd;
3602 struct hci_request req;
3603 int err;
3604
3605 BT_DBG("%s", hdev->name);
3606
3607 hci_dev_lock(hdev);
3608
3609 if (!hdev_is_powered(hdev)) {
3610 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3611 MGMT_STATUS_NOT_POWERED);
3612 goto unlock;
3613 }
3614
3615 if (!lmp_ssp_capable(hdev)) {
3616 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3617 MGMT_STATUS_NOT_SUPPORTED);
3618 goto unlock;
3619 }
3620
3621 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3622 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3623 MGMT_STATUS_BUSY);
3624 goto unlock;
3625 }
3626
3627 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3628 if (!cmd) {
3629 err = -ENOMEM;
3630 goto unlock;
3631 }
3632
3633 hci_req_init(&req, hdev);
3634
3635 if (bredr_sc_enabled(hdev))
3636 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3637 else
3638 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3639
3640 err = hci_req_run_skb(&req, read_local_oob_data_complete);
3641 if (err < 0)
3642 mgmt_pending_remove(cmd);
3643
3644 unlock:
3645 hci_dev_unlock(hdev);
3646 return err;
3647 }
3648
add_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3649 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3650 void *data, u16 len)
3651 {
3652 struct mgmt_addr_info *addr = data;
3653 int err;
3654
3655 BT_DBG("%s ", hdev->name);
3656
3657 if (!bdaddr_type_is_valid(addr->type))
3658 return mgmt_cmd_complete(sk, hdev->id,
3659 MGMT_OP_ADD_REMOTE_OOB_DATA,
3660 MGMT_STATUS_INVALID_PARAMS,
3661 addr, sizeof(*addr));
3662
3663 hci_dev_lock(hdev);
3664
3665 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3666 struct mgmt_cp_add_remote_oob_data *cp = data;
3667 u8 status;
3668
3669 if (cp->addr.type != BDADDR_BREDR) {
3670 err = mgmt_cmd_complete(sk, hdev->id,
3671 MGMT_OP_ADD_REMOTE_OOB_DATA,
3672 MGMT_STATUS_INVALID_PARAMS,
3673 &cp->addr, sizeof(cp->addr));
3674 goto unlock;
3675 }
3676
3677 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3678 cp->addr.type, cp->hash,
3679 cp->rand, NULL, NULL);
3680 if (err < 0)
3681 status = MGMT_STATUS_FAILED;
3682 else
3683 status = MGMT_STATUS_SUCCESS;
3684
3685 err = mgmt_cmd_complete(sk, hdev->id,
3686 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3687 &cp->addr, sizeof(cp->addr));
3688 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3689 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3690 u8 *rand192, *hash192, *rand256, *hash256;
3691 u8 status;
3692
3693 if (bdaddr_type_is_le(cp->addr.type)) {
3694 /* Enforce zero-valued 192-bit parameters as
3695 * long as legacy SMP OOB isn't implemented.
3696 */
3697 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3698 memcmp(cp->hash192, ZERO_KEY, 16)) {
3699 err = mgmt_cmd_complete(sk, hdev->id,
3700 MGMT_OP_ADD_REMOTE_OOB_DATA,
3701 MGMT_STATUS_INVALID_PARAMS,
3702 addr, sizeof(*addr));
3703 goto unlock;
3704 }
3705
3706 rand192 = NULL;
3707 hash192 = NULL;
3708 } else {
3709 /* In case one of the P-192 values is set to zero,
3710 * then just disable OOB data for P-192.
3711 */
3712 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3713 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3714 rand192 = NULL;
3715 hash192 = NULL;
3716 } else {
3717 rand192 = cp->rand192;
3718 hash192 = cp->hash192;
3719 }
3720 }
3721
3722 /* In case one of the P-256 values is set to zero, then just
3723 * disable OOB data for P-256.
3724 */
3725 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3726 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3727 rand256 = NULL;
3728 hash256 = NULL;
3729 } else {
3730 rand256 = cp->rand256;
3731 hash256 = cp->hash256;
3732 }
3733
3734 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3735 cp->addr.type, hash192, rand192,
3736 hash256, rand256);
3737 if (err < 0)
3738 status = MGMT_STATUS_FAILED;
3739 else
3740 status = MGMT_STATUS_SUCCESS;
3741
3742 err = mgmt_cmd_complete(sk, hdev->id,
3743 MGMT_OP_ADD_REMOTE_OOB_DATA,
3744 status, &cp->addr, sizeof(cp->addr));
3745 } else {
3746 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3747 len);
3748 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3749 MGMT_STATUS_INVALID_PARAMS);
3750 }
3751
3752 unlock:
3753 hci_dev_unlock(hdev);
3754 return err;
3755 }
3756
remove_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3757 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3758 void *data, u16 len)
3759 {
3760 struct mgmt_cp_remove_remote_oob_data *cp = data;
3761 u8 status;
3762 int err;
3763
3764 BT_DBG("%s", hdev->name);
3765
3766 if (cp->addr.type != BDADDR_BREDR)
3767 return mgmt_cmd_complete(sk, hdev->id,
3768 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3769 MGMT_STATUS_INVALID_PARAMS,
3770 &cp->addr, sizeof(cp->addr));
3771
3772 hci_dev_lock(hdev);
3773
3774 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3775 hci_remote_oob_data_clear(hdev);
3776 status = MGMT_STATUS_SUCCESS;
3777 goto done;
3778 }
3779
3780 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3781 if (err < 0)
3782 status = MGMT_STATUS_INVALID_PARAMS;
3783 else
3784 status = MGMT_STATUS_SUCCESS;
3785
3786 done:
3787 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3788 status, &cp->addr, sizeof(cp->addr));
3789
3790 hci_dev_unlock(hdev);
3791 return err;
3792 }
3793
mgmt_start_discovery_complete(struct hci_dev * hdev,u8 status)3794 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3795 {
3796 struct mgmt_pending_cmd *cmd;
3797
3798 BT_DBG("status %d", status);
3799
3800 hci_dev_lock(hdev);
3801
3802 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3803 if (!cmd)
3804 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3805
3806 if (!cmd)
3807 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3808
3809 if (cmd) {
3810 cmd->cmd_complete(cmd, mgmt_status(status));
3811 mgmt_pending_remove(cmd);
3812 }
3813
3814 hci_dev_unlock(hdev);
3815 }
3816
discovery_type_is_valid(struct hci_dev * hdev,uint8_t type,uint8_t * mgmt_status)3817 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3818 uint8_t *mgmt_status)
3819 {
3820 switch (type) {
3821 case DISCOV_TYPE_LE:
3822 *mgmt_status = mgmt_le_support(hdev);
3823 if (*mgmt_status)
3824 return false;
3825 break;
3826 case DISCOV_TYPE_INTERLEAVED:
3827 *mgmt_status = mgmt_le_support(hdev);
3828 if (*mgmt_status)
3829 return false;
3830 /* Intentional fall-through */
3831 case DISCOV_TYPE_BREDR:
3832 *mgmt_status = mgmt_bredr_support(hdev);
3833 if (*mgmt_status)
3834 return false;
3835 break;
3836 default:
3837 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3838 return false;
3839 }
3840
3841 return true;
3842 }
3843
start_discovery_internal(struct sock * sk,struct hci_dev * hdev,u16 op,void * data,u16 len)3844 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3845 u16 op, void *data, u16 len)
3846 {
3847 struct mgmt_cp_start_discovery *cp = data;
3848 struct mgmt_pending_cmd *cmd;
3849 u8 status;
3850 int err;
3851
3852 BT_DBG("%s", hdev->name);
3853
3854 hci_dev_lock(hdev);
3855
3856 if (!hdev_is_powered(hdev)) {
3857 err = mgmt_cmd_complete(sk, hdev->id, op,
3858 MGMT_STATUS_NOT_POWERED,
3859 &cp->type, sizeof(cp->type));
3860 goto failed;
3861 }
3862
3863 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3864 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3865 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3866 &cp->type, sizeof(cp->type));
3867 goto failed;
3868 }
3869
3870 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3871 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3872 &cp->type, sizeof(cp->type));
3873 goto failed;
3874 }
3875
3876 /* Clear the discovery filter first to free any previously
3877 * allocated memory for the UUID list.
3878 */
3879 hci_discovery_filter_clear(hdev);
3880
3881 hdev->discovery.type = cp->type;
3882 hdev->discovery.report_invalid_rssi = false;
3883 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3884 hdev->discovery.limited = true;
3885 else
3886 hdev->discovery.limited = false;
3887
3888 cmd = mgmt_pending_add(sk, op, hdev, data, len);
3889 if (!cmd) {
3890 err = -ENOMEM;
3891 goto failed;
3892 }
3893
3894 cmd->cmd_complete = generic_cmd_complete;
3895
3896 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3897 queue_work(hdev->req_workqueue, &hdev->discov_update);
3898 err = 0;
3899
3900 failed:
3901 hci_dev_unlock(hdev);
3902 return err;
3903 }
3904
start_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3905 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3906 void *data, u16 len)
3907 {
3908 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3909 data, len);
3910 }
3911
start_limited_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3912 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3913 void *data, u16 len)
3914 {
3915 return start_discovery_internal(sk, hdev,
3916 MGMT_OP_START_LIMITED_DISCOVERY,
3917 data, len);
3918 }
3919
service_discovery_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)3920 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3921 u8 status)
3922 {
3923 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3924 cmd->param, 1);
3925 }
3926
start_service_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3927 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3928 void *data, u16 len)
3929 {
3930 struct mgmt_cp_start_service_discovery *cp = data;
3931 struct mgmt_pending_cmd *cmd;
3932 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3933 u16 uuid_count, expected_len;
3934 u8 status;
3935 int err;
3936
3937 BT_DBG("%s", hdev->name);
3938
3939 hci_dev_lock(hdev);
3940
3941 if (!hdev_is_powered(hdev)) {
3942 err = mgmt_cmd_complete(sk, hdev->id,
3943 MGMT_OP_START_SERVICE_DISCOVERY,
3944 MGMT_STATUS_NOT_POWERED,
3945 &cp->type, sizeof(cp->type));
3946 goto failed;
3947 }
3948
3949 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3950 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3951 err = mgmt_cmd_complete(sk, hdev->id,
3952 MGMT_OP_START_SERVICE_DISCOVERY,
3953 MGMT_STATUS_BUSY, &cp->type,
3954 sizeof(cp->type));
3955 goto failed;
3956 }
3957
3958 uuid_count = __le16_to_cpu(cp->uuid_count);
3959 if (uuid_count > max_uuid_count) {
3960 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3961 uuid_count);
3962 err = mgmt_cmd_complete(sk, hdev->id,
3963 MGMT_OP_START_SERVICE_DISCOVERY,
3964 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3965 sizeof(cp->type));
3966 goto failed;
3967 }
3968
3969 expected_len = sizeof(*cp) + uuid_count * 16;
3970 if (expected_len != len) {
3971 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3972 expected_len, len);
3973 err = mgmt_cmd_complete(sk, hdev->id,
3974 MGMT_OP_START_SERVICE_DISCOVERY,
3975 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3976 sizeof(cp->type));
3977 goto failed;
3978 }
3979
3980 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3981 err = mgmt_cmd_complete(sk, hdev->id,
3982 MGMT_OP_START_SERVICE_DISCOVERY,
3983 status, &cp->type, sizeof(cp->type));
3984 goto failed;
3985 }
3986
3987 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3988 hdev, data, len);
3989 if (!cmd) {
3990 err = -ENOMEM;
3991 goto failed;
3992 }
3993
3994 cmd->cmd_complete = service_discovery_cmd_complete;
3995
3996 /* Clear the discovery filter first to free any previously
3997 * allocated memory for the UUID list.
3998 */
3999 hci_discovery_filter_clear(hdev);
4000
4001 hdev->discovery.result_filtering = true;
4002 hdev->discovery.type = cp->type;
4003 hdev->discovery.rssi = cp->rssi;
4004 hdev->discovery.uuid_count = uuid_count;
4005
4006 if (uuid_count > 0) {
4007 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4008 GFP_KERNEL);
4009 if (!hdev->discovery.uuids) {
4010 err = mgmt_cmd_complete(sk, hdev->id,
4011 MGMT_OP_START_SERVICE_DISCOVERY,
4012 MGMT_STATUS_FAILED,
4013 &cp->type, sizeof(cp->type));
4014 mgmt_pending_remove(cmd);
4015 goto failed;
4016 }
4017 }
4018
4019 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4020 queue_work(hdev->req_workqueue, &hdev->discov_update);
4021 err = 0;
4022
4023 failed:
4024 hci_dev_unlock(hdev);
4025 return err;
4026 }
4027
mgmt_stop_discovery_complete(struct hci_dev * hdev,u8 status)4028 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4029 {
4030 struct mgmt_pending_cmd *cmd;
4031
4032 BT_DBG("status %d", status);
4033
4034 hci_dev_lock(hdev);
4035
4036 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4037 if (cmd) {
4038 cmd->cmd_complete(cmd, mgmt_status(status));
4039 mgmt_pending_remove(cmd);
4040 }
4041
4042 hci_dev_unlock(hdev);
4043 }
4044
stop_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4045 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4046 u16 len)
4047 {
4048 struct mgmt_cp_stop_discovery *mgmt_cp = data;
4049 struct mgmt_pending_cmd *cmd;
4050 int err;
4051
4052 BT_DBG("%s", hdev->name);
4053
4054 hci_dev_lock(hdev);
4055
4056 if (!hci_discovery_active(hdev)) {
4057 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4058 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4059 sizeof(mgmt_cp->type));
4060 goto unlock;
4061 }
4062
4063 if (hdev->discovery.type != mgmt_cp->type) {
4064 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4065 MGMT_STATUS_INVALID_PARAMS,
4066 &mgmt_cp->type, sizeof(mgmt_cp->type));
4067 goto unlock;
4068 }
4069
4070 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4071 if (!cmd) {
4072 err = -ENOMEM;
4073 goto unlock;
4074 }
4075
4076 cmd->cmd_complete = generic_cmd_complete;
4077
4078 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4079 queue_work(hdev->req_workqueue, &hdev->discov_update);
4080 err = 0;
4081
4082 unlock:
4083 hci_dev_unlock(hdev);
4084 return err;
4085 }
4086
confirm_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4087 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4088 u16 len)
4089 {
4090 struct mgmt_cp_confirm_name *cp = data;
4091 struct inquiry_entry *e;
4092 int err;
4093
4094 BT_DBG("%s", hdev->name);
4095
4096 hci_dev_lock(hdev);
4097
4098 if (!hci_discovery_active(hdev)) {
4099 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4100 MGMT_STATUS_FAILED, &cp->addr,
4101 sizeof(cp->addr));
4102 goto failed;
4103 }
4104
4105 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4106 if (!e) {
4107 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4108 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4109 sizeof(cp->addr));
4110 goto failed;
4111 }
4112
4113 if (cp->name_known) {
4114 e->name_state = NAME_KNOWN;
4115 list_del(&e->list);
4116 } else {
4117 e->name_state = NAME_NEEDED;
4118 hci_inquiry_cache_update_resolve(hdev, e);
4119 }
4120
4121 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4122 &cp->addr, sizeof(cp->addr));
4123
4124 failed:
4125 hci_dev_unlock(hdev);
4126 return err;
4127 }
4128
block_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4129 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4130 u16 len)
4131 {
4132 struct mgmt_cp_block_device *cp = data;
4133 u8 status;
4134 int err;
4135
4136 BT_DBG("%s", hdev->name);
4137
4138 if (!bdaddr_type_is_valid(cp->addr.type))
4139 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4140 MGMT_STATUS_INVALID_PARAMS,
4141 &cp->addr, sizeof(cp->addr));
4142
4143 hci_dev_lock(hdev);
4144
4145 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4146 cp->addr.type);
4147 if (err < 0) {
4148 status = MGMT_STATUS_FAILED;
4149 goto done;
4150 }
4151
4152 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4153 sk);
4154 status = MGMT_STATUS_SUCCESS;
4155
4156 done:
4157 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4158 &cp->addr, sizeof(cp->addr));
4159
4160 hci_dev_unlock(hdev);
4161
4162 return err;
4163 }
4164
unblock_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4165 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4166 u16 len)
4167 {
4168 struct mgmt_cp_unblock_device *cp = data;
4169 u8 status;
4170 int err;
4171
4172 BT_DBG("%s", hdev->name);
4173
4174 if (!bdaddr_type_is_valid(cp->addr.type))
4175 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4176 MGMT_STATUS_INVALID_PARAMS,
4177 &cp->addr, sizeof(cp->addr));
4178
4179 hci_dev_lock(hdev);
4180
4181 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4182 cp->addr.type);
4183 if (err < 0) {
4184 status = MGMT_STATUS_INVALID_PARAMS;
4185 goto done;
4186 }
4187
4188 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4189 sk);
4190 status = MGMT_STATUS_SUCCESS;
4191
4192 done:
4193 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4194 &cp->addr, sizeof(cp->addr));
4195
4196 hci_dev_unlock(hdev);
4197
4198 return err;
4199 }
4200
set_device_id(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4201 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4202 u16 len)
4203 {
4204 struct mgmt_cp_set_device_id *cp = data;
4205 struct hci_request req;
4206 int err;
4207 __u16 source;
4208
4209 BT_DBG("%s", hdev->name);
4210
4211 source = __le16_to_cpu(cp->source);
4212
4213 if (source > 0x0002)
4214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4215 MGMT_STATUS_INVALID_PARAMS);
4216
4217 hci_dev_lock(hdev);
4218
4219 hdev->devid_source = source;
4220 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4221 hdev->devid_product = __le16_to_cpu(cp->product);
4222 hdev->devid_version = __le16_to_cpu(cp->version);
4223
4224 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4225 NULL, 0);
4226
4227 hci_req_init(&req, hdev);
4228 __hci_req_update_eir(&req);
4229 hci_req_run(&req, NULL);
4230
4231 hci_dev_unlock(hdev);
4232
4233 return err;
4234 }
4235
enable_advertising_instance(struct hci_dev * hdev,u8 status,u16 opcode)4236 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4237 u16 opcode)
4238 {
4239 BT_DBG("status %d", status);
4240 }
4241
set_advertising_complete(struct hci_dev * hdev,u8 status,u16 opcode)4242 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4243 u16 opcode)
4244 {
4245 struct cmd_lookup match = { NULL, hdev };
4246 struct hci_request req;
4247 u8 instance;
4248 struct adv_info *adv_instance;
4249 int err;
4250
4251 hci_dev_lock(hdev);
4252
4253 if (status) {
4254 u8 mgmt_err = mgmt_status(status);
4255
4256 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4257 cmd_status_rsp, &mgmt_err);
4258 goto unlock;
4259 }
4260
4261 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4262 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4263 else
4264 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4265
4266 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4267 &match);
4268
4269 new_settings(hdev, match.sk);
4270
4271 if (match.sk)
4272 sock_put(match.sk);
4273
4274 /* If "Set Advertising" was just disabled and instance advertising was
4275 * set up earlier, then re-enable multi-instance advertising.
4276 */
4277 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4278 list_empty(&hdev->adv_instances))
4279 goto unlock;
4280
4281 instance = hdev->cur_adv_instance;
4282 if (!instance) {
4283 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4284 struct adv_info, list);
4285 if (!adv_instance)
4286 goto unlock;
4287
4288 instance = adv_instance->instance;
4289 }
4290
4291 hci_req_init(&req, hdev);
4292
4293 err = __hci_req_schedule_adv_instance(&req, instance, true);
4294
4295 if (!err)
4296 err = hci_req_run(&req, enable_advertising_instance);
4297
4298 if (err)
4299 bt_dev_err(hdev, "failed to re-configure advertising");
4300
4301 unlock:
4302 hci_dev_unlock(hdev);
4303 }
4304
set_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4305 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4306 u16 len)
4307 {
4308 struct mgmt_mode *cp = data;
4309 struct mgmt_pending_cmd *cmd;
4310 struct hci_request req;
4311 u8 val, status;
4312 int err;
4313
4314 BT_DBG("request for %s", hdev->name);
4315
4316 status = mgmt_le_support(hdev);
4317 if (status)
4318 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4319 status);
4320
4321 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4322 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4323 MGMT_STATUS_INVALID_PARAMS);
4324
4325 hci_dev_lock(hdev);
4326
4327 val = !!cp->val;
4328
4329 /* The following conditions are ones which mean that we should
4330 * not do any HCI communication but directly send a mgmt
4331 * response to user space (after toggling the flag if
4332 * necessary).
4333 */
4334 if (!hdev_is_powered(hdev) ||
4335 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4336 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4337 hci_conn_num(hdev, LE_LINK) > 0 ||
4338 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4339 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4340 bool changed;
4341
4342 if (cp->val) {
4343 hdev->cur_adv_instance = 0x00;
4344 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4345 if (cp->val == 0x02)
4346 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4347 else
4348 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4349 } else {
4350 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4351 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4352 }
4353
4354 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4355 if (err < 0)
4356 goto unlock;
4357
4358 if (changed)
4359 err = new_settings(hdev, sk);
4360
4361 goto unlock;
4362 }
4363
4364 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4365 pending_find(MGMT_OP_SET_LE, hdev)) {
4366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4367 MGMT_STATUS_BUSY);
4368 goto unlock;
4369 }
4370
4371 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4372 if (!cmd) {
4373 err = -ENOMEM;
4374 goto unlock;
4375 }
4376
4377 hci_req_init(&req, hdev);
4378
4379 if (cp->val == 0x02)
4380 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4381 else
4382 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4383
4384 cancel_adv_timeout(hdev);
4385
4386 if (val) {
4387 /* Switch to instance "0" for the Set Advertising setting.
4388 * We cannot use update_[adv|scan_rsp]_data() here as the
4389 * HCI_ADVERTISING flag is not yet set.
4390 */
4391 hdev->cur_adv_instance = 0x00;
4392
4393 if (ext_adv_capable(hdev)) {
4394 __hci_req_start_ext_adv(&req, 0x00);
4395 } else {
4396 __hci_req_update_adv_data(&req, 0x00);
4397 __hci_req_update_scan_rsp_data(&req, 0x00);
4398 __hci_req_enable_advertising(&req);
4399 }
4400 } else {
4401 __hci_req_disable_advertising(&req);
4402 }
4403
4404 err = hci_req_run(&req, set_advertising_complete);
4405 if (err < 0)
4406 mgmt_pending_remove(cmd);
4407
4408 unlock:
4409 hci_dev_unlock(hdev);
4410 return err;
4411 }
4412
set_static_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4413 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4414 void *data, u16 len)
4415 {
4416 struct mgmt_cp_set_static_address *cp = data;
4417 int err;
4418
4419 BT_DBG("%s", hdev->name);
4420
4421 if (!lmp_le_capable(hdev))
4422 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4423 MGMT_STATUS_NOT_SUPPORTED);
4424
4425 if (hdev_is_powered(hdev))
4426 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4427 MGMT_STATUS_REJECTED);
4428
4429 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4430 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4431 return mgmt_cmd_status(sk, hdev->id,
4432 MGMT_OP_SET_STATIC_ADDRESS,
4433 MGMT_STATUS_INVALID_PARAMS);
4434
4435 /* Two most significant bits shall be set */
4436 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4437 return mgmt_cmd_status(sk, hdev->id,
4438 MGMT_OP_SET_STATIC_ADDRESS,
4439 MGMT_STATUS_INVALID_PARAMS);
4440 }
4441
4442 hci_dev_lock(hdev);
4443
4444 bacpy(&hdev->static_addr, &cp->bdaddr);
4445
4446 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4447 if (err < 0)
4448 goto unlock;
4449
4450 err = new_settings(hdev, sk);
4451
4452 unlock:
4453 hci_dev_unlock(hdev);
4454 return err;
4455 }
4456
set_scan_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4457 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4458 void *data, u16 len)
4459 {
4460 struct mgmt_cp_set_scan_params *cp = data;
4461 __u16 interval, window;
4462 int err;
4463
4464 BT_DBG("%s", hdev->name);
4465
4466 if (!lmp_le_capable(hdev))
4467 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4468 MGMT_STATUS_NOT_SUPPORTED);
4469
4470 interval = __le16_to_cpu(cp->interval);
4471
4472 if (interval < 0x0004 || interval > 0x4000)
4473 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4474 MGMT_STATUS_INVALID_PARAMS);
4475
4476 window = __le16_to_cpu(cp->window);
4477
4478 if (window < 0x0004 || window > 0x4000)
4479 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4480 MGMT_STATUS_INVALID_PARAMS);
4481
4482 if (window > interval)
4483 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4484 MGMT_STATUS_INVALID_PARAMS);
4485
4486 hci_dev_lock(hdev);
4487
4488 hdev->le_scan_interval = interval;
4489 hdev->le_scan_window = window;
4490
4491 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4492 NULL, 0);
4493
4494 /* If background scan is running, restart it so new parameters are
4495 * loaded.
4496 */
4497 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4498 hdev->discovery.state == DISCOVERY_STOPPED) {
4499 struct hci_request req;
4500
4501 hci_req_init(&req, hdev);
4502
4503 hci_req_add_le_scan_disable(&req);
4504 hci_req_add_le_passive_scan(&req);
4505
4506 hci_req_run(&req, NULL);
4507 }
4508
4509 hci_dev_unlock(hdev);
4510
4511 return err;
4512 }
4513
fast_connectable_complete(struct hci_dev * hdev,u8 status,u16 opcode)4514 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4515 u16 opcode)
4516 {
4517 struct mgmt_pending_cmd *cmd;
4518
4519 BT_DBG("status 0x%02x", status);
4520
4521 hci_dev_lock(hdev);
4522
4523 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4524 if (!cmd)
4525 goto unlock;
4526
4527 if (status) {
4528 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4529 mgmt_status(status));
4530 } else {
4531 struct mgmt_mode *cp = cmd->param;
4532
4533 if (cp->val)
4534 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4535 else
4536 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4537
4538 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4539 new_settings(hdev, cmd->sk);
4540 }
4541
4542 mgmt_pending_remove(cmd);
4543
4544 unlock:
4545 hci_dev_unlock(hdev);
4546 }
4547
set_fast_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4548 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4549 void *data, u16 len)
4550 {
4551 struct mgmt_mode *cp = data;
4552 struct mgmt_pending_cmd *cmd;
4553 struct hci_request req;
4554 int err;
4555
4556 BT_DBG("%s", hdev->name);
4557
4558 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4559 hdev->hci_ver < BLUETOOTH_VER_1_2)
4560 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4561 MGMT_STATUS_NOT_SUPPORTED);
4562
4563 if (cp->val != 0x00 && cp->val != 0x01)
4564 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4565 MGMT_STATUS_INVALID_PARAMS);
4566
4567 hci_dev_lock(hdev);
4568
4569 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4570 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4571 MGMT_STATUS_BUSY);
4572 goto unlock;
4573 }
4574
4575 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4576 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4577 hdev);
4578 goto unlock;
4579 }
4580
4581 if (!hdev_is_powered(hdev)) {
4582 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4583 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4584 hdev);
4585 new_settings(hdev, sk);
4586 goto unlock;
4587 }
4588
4589 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4590 data, len);
4591 if (!cmd) {
4592 err = -ENOMEM;
4593 goto unlock;
4594 }
4595
4596 hci_req_init(&req, hdev);
4597
4598 __hci_req_write_fast_connectable(&req, cp->val);
4599
4600 err = hci_req_run(&req, fast_connectable_complete);
4601 if (err < 0) {
4602 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4603 MGMT_STATUS_FAILED);
4604 mgmt_pending_remove(cmd);
4605 }
4606
4607 unlock:
4608 hci_dev_unlock(hdev);
4609
4610 return err;
4611 }
4612
set_bredr_complete(struct hci_dev * hdev,u8 status,u16 opcode)4613 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4614 {
4615 struct mgmt_pending_cmd *cmd;
4616
4617 BT_DBG("status 0x%02x", status);
4618
4619 hci_dev_lock(hdev);
4620
4621 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4622 if (!cmd)
4623 goto unlock;
4624
4625 if (status) {
4626 u8 mgmt_err = mgmt_status(status);
4627
4628 /* We need to restore the flag if related HCI commands
4629 * failed.
4630 */
4631 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4632
4633 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4634 } else {
4635 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4636 new_settings(hdev, cmd->sk);
4637 }
4638
4639 mgmt_pending_remove(cmd);
4640
4641 unlock:
4642 hci_dev_unlock(hdev);
4643 }
4644
set_bredr(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4645 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4646 {
4647 struct mgmt_mode *cp = data;
4648 struct mgmt_pending_cmd *cmd;
4649 struct hci_request req;
4650 int err;
4651
4652 BT_DBG("request for %s", hdev->name);
4653
4654 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4655 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4656 MGMT_STATUS_NOT_SUPPORTED);
4657
4658 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4659 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4660 MGMT_STATUS_REJECTED);
4661
4662 if (cp->val != 0x00 && cp->val != 0x01)
4663 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4664 MGMT_STATUS_INVALID_PARAMS);
4665
4666 hci_dev_lock(hdev);
4667
4668 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4669 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4670 goto unlock;
4671 }
4672
4673 if (!hdev_is_powered(hdev)) {
4674 if (!cp->val) {
4675 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4676 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4677 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4678 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4679 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4680 }
4681
4682 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4683
4684 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4685 if (err < 0)
4686 goto unlock;
4687
4688 err = new_settings(hdev, sk);
4689 goto unlock;
4690 }
4691
4692 /* Reject disabling when powered on */
4693 if (!cp->val) {
4694 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4695 MGMT_STATUS_REJECTED);
4696 goto unlock;
4697 } else {
4698 /* When configuring a dual-mode controller to operate
4699 * with LE only and using a static address, then switching
4700 * BR/EDR back on is not allowed.
4701 *
4702 * Dual-mode controllers shall operate with the public
4703 * address as its identity address for BR/EDR and LE. So
4704 * reject the attempt to create an invalid configuration.
4705 *
4706 * The same restrictions applies when secure connections
4707 * has been enabled. For BR/EDR this is a controller feature
4708 * while for LE it is a host stack feature. This means that
4709 * switching BR/EDR back on when secure connections has been
4710 * enabled is not a supported transaction.
4711 */
4712 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4713 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4714 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4715 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4716 MGMT_STATUS_REJECTED);
4717 goto unlock;
4718 }
4719 }
4720
4721 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4722 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4723 MGMT_STATUS_BUSY);
4724 goto unlock;
4725 }
4726
4727 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4728 if (!cmd) {
4729 err = -ENOMEM;
4730 goto unlock;
4731 }
4732
4733 /* We need to flip the bit already here so that
4734 * hci_req_update_adv_data generates the correct flags.
4735 */
4736 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4737
4738 hci_req_init(&req, hdev);
4739
4740 __hci_req_write_fast_connectable(&req, false);
4741 __hci_req_update_scan(&req);
4742
4743 /* Since only the advertising data flags will change, there
4744 * is no need to update the scan response data.
4745 */
4746 __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4747
4748 err = hci_req_run(&req, set_bredr_complete);
4749 if (err < 0)
4750 mgmt_pending_remove(cmd);
4751
4752 unlock:
4753 hci_dev_unlock(hdev);
4754 return err;
4755 }
4756
sc_enable_complete(struct hci_dev * hdev,u8 status,u16 opcode)4757 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4758 {
4759 struct mgmt_pending_cmd *cmd;
4760 struct mgmt_mode *cp;
4761
4762 BT_DBG("%s status %u", hdev->name, status);
4763
4764 hci_dev_lock(hdev);
4765
4766 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4767 if (!cmd)
4768 goto unlock;
4769
4770 if (status) {
4771 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4772 mgmt_status(status));
4773 goto remove;
4774 }
4775
4776 cp = cmd->param;
4777
4778 switch (cp->val) {
4779 case 0x00:
4780 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4781 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4782 break;
4783 case 0x01:
4784 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4785 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4786 break;
4787 case 0x02:
4788 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4789 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4790 break;
4791 }
4792
4793 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4794 new_settings(hdev, cmd->sk);
4795
4796 remove:
4797 mgmt_pending_remove(cmd);
4798 unlock:
4799 hci_dev_unlock(hdev);
4800 }
4801
set_secure_conn(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4802 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4803 void *data, u16 len)
4804 {
4805 struct mgmt_mode *cp = data;
4806 struct mgmt_pending_cmd *cmd;
4807 struct hci_request req;
4808 u8 val;
4809 int err;
4810
4811 BT_DBG("request for %s", hdev->name);
4812
4813 if (!lmp_sc_capable(hdev) &&
4814 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4815 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4816 MGMT_STATUS_NOT_SUPPORTED);
4817
4818 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4819 lmp_sc_capable(hdev) &&
4820 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4821 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4822 MGMT_STATUS_REJECTED);
4823
4824 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4825 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4826 MGMT_STATUS_INVALID_PARAMS);
4827
4828 hci_dev_lock(hdev);
4829
4830 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4831 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4832 bool changed;
4833
4834 if (cp->val) {
4835 changed = !hci_dev_test_and_set_flag(hdev,
4836 HCI_SC_ENABLED);
4837 if (cp->val == 0x02)
4838 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4839 else
4840 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4841 } else {
4842 changed = hci_dev_test_and_clear_flag(hdev,
4843 HCI_SC_ENABLED);
4844 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4845 }
4846
4847 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4848 if (err < 0)
4849 goto failed;
4850
4851 if (changed)
4852 err = new_settings(hdev, sk);
4853
4854 goto failed;
4855 }
4856
4857 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4858 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4859 MGMT_STATUS_BUSY);
4860 goto failed;
4861 }
4862
4863 val = !!cp->val;
4864
4865 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4866 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4867 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4868 goto failed;
4869 }
4870
4871 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4872 if (!cmd) {
4873 err = -ENOMEM;
4874 goto failed;
4875 }
4876
4877 hci_req_init(&req, hdev);
4878 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4879 err = hci_req_run(&req, sc_enable_complete);
4880 if (err < 0) {
4881 mgmt_pending_remove(cmd);
4882 goto failed;
4883 }
4884
4885 failed:
4886 hci_dev_unlock(hdev);
4887 return err;
4888 }
4889
set_debug_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4890 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4891 void *data, u16 len)
4892 {
4893 struct mgmt_mode *cp = data;
4894 bool changed, use_changed;
4895 int err;
4896
4897 BT_DBG("request for %s", hdev->name);
4898
4899 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4900 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4901 MGMT_STATUS_INVALID_PARAMS);
4902
4903 hci_dev_lock(hdev);
4904
4905 if (cp->val)
4906 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4907 else
4908 changed = hci_dev_test_and_clear_flag(hdev,
4909 HCI_KEEP_DEBUG_KEYS);
4910
4911 if (cp->val == 0x02)
4912 use_changed = !hci_dev_test_and_set_flag(hdev,
4913 HCI_USE_DEBUG_KEYS);
4914 else
4915 use_changed = hci_dev_test_and_clear_flag(hdev,
4916 HCI_USE_DEBUG_KEYS);
4917
4918 if (hdev_is_powered(hdev) && use_changed &&
4919 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4920 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4921 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4922 sizeof(mode), &mode);
4923 }
4924
4925 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4926 if (err < 0)
4927 goto unlock;
4928
4929 if (changed)
4930 err = new_settings(hdev, sk);
4931
4932 unlock:
4933 hci_dev_unlock(hdev);
4934 return err;
4935 }
4936
set_privacy(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)4937 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4938 u16 len)
4939 {
4940 struct mgmt_cp_set_privacy *cp = cp_data;
4941 bool changed;
4942 int err;
4943
4944 BT_DBG("request for %s", hdev->name);
4945
4946 if (!lmp_le_capable(hdev))
4947 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4948 MGMT_STATUS_NOT_SUPPORTED);
4949
4950 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4951 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4952 MGMT_STATUS_INVALID_PARAMS);
4953
4954 if (hdev_is_powered(hdev))
4955 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4956 MGMT_STATUS_REJECTED);
4957
4958 hci_dev_lock(hdev);
4959
4960 /* If user space supports this command it is also expected to
4961 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4962 */
4963 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4964
4965 if (cp->privacy) {
4966 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4967 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4968 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4969 hci_adv_instances_set_rpa_expired(hdev, true);
4970 if (cp->privacy == 0x02)
4971 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4972 else
4973 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4974 } else {
4975 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4976 memset(hdev->irk, 0, sizeof(hdev->irk));
4977 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4978 hci_adv_instances_set_rpa_expired(hdev, false);
4979 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4980 }
4981
4982 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4983 if (err < 0)
4984 goto unlock;
4985
4986 if (changed)
4987 err = new_settings(hdev, sk);
4988
4989 unlock:
4990 hci_dev_unlock(hdev);
4991 return err;
4992 }
4993
irk_is_valid(struct mgmt_irk_info * irk)4994 static bool irk_is_valid(struct mgmt_irk_info *irk)
4995 {
4996 switch (irk->addr.type) {
4997 case BDADDR_LE_PUBLIC:
4998 return true;
4999
5000 case BDADDR_LE_RANDOM:
5001 /* Two most significant bits shall be set */
5002 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5003 return false;
5004 return true;
5005 }
5006
5007 return false;
5008 }
5009
load_irks(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)5010 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5011 u16 len)
5012 {
5013 struct mgmt_cp_load_irks *cp = cp_data;
5014 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5015 sizeof(struct mgmt_irk_info));
5016 u16 irk_count, expected_len;
5017 int i, err;
5018
5019 BT_DBG("request for %s", hdev->name);
5020
5021 if (!lmp_le_capable(hdev))
5022 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5023 MGMT_STATUS_NOT_SUPPORTED);
5024
5025 irk_count = __le16_to_cpu(cp->irk_count);
5026 if (irk_count > max_irk_count) {
5027 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5028 irk_count);
5029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5030 MGMT_STATUS_INVALID_PARAMS);
5031 }
5032
5033 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5034 if (expected_len != len) {
5035 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5036 expected_len, len);
5037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5038 MGMT_STATUS_INVALID_PARAMS);
5039 }
5040
5041 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5042
5043 for (i = 0; i < irk_count; i++) {
5044 struct mgmt_irk_info *key = &cp->irks[i];
5045
5046 if (!irk_is_valid(key))
5047 return mgmt_cmd_status(sk, hdev->id,
5048 MGMT_OP_LOAD_IRKS,
5049 MGMT_STATUS_INVALID_PARAMS);
5050 }
5051
5052 hci_dev_lock(hdev);
5053
5054 hci_smp_irks_clear(hdev);
5055
5056 for (i = 0; i < irk_count; i++) {
5057 struct mgmt_irk_info *irk = &cp->irks[i];
5058
5059 hci_add_irk(hdev, &irk->addr.bdaddr,
5060 le_addr_type(irk->addr.type), irk->val,
5061 BDADDR_ANY);
5062 }
5063
5064 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5065
5066 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5067
5068 hci_dev_unlock(hdev);
5069
5070 return err;
5071 }
5072
ltk_is_valid(struct mgmt_ltk_info * key)5073 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5074 {
5075 if (key->master != 0x00 && key->master != 0x01)
5076 return false;
5077
5078 switch (key->addr.type) {
5079 case BDADDR_LE_PUBLIC:
5080 return true;
5081
5082 case BDADDR_LE_RANDOM:
5083 /* Two most significant bits shall be set */
5084 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5085 return false;
5086 return true;
5087 }
5088
5089 return false;
5090 }
5091
load_long_term_keys(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)5092 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5093 void *cp_data, u16 len)
5094 {
5095 struct mgmt_cp_load_long_term_keys *cp = cp_data;
5096 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5097 sizeof(struct mgmt_ltk_info));
5098 u16 key_count, expected_len;
5099 int i, err;
5100
5101 BT_DBG("request for %s", hdev->name);
5102
5103 if (!lmp_le_capable(hdev))
5104 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5105 MGMT_STATUS_NOT_SUPPORTED);
5106
5107 key_count = __le16_to_cpu(cp->key_count);
5108 if (key_count > max_key_count) {
5109 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5110 key_count);
5111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5112 MGMT_STATUS_INVALID_PARAMS);
5113 }
5114
5115 expected_len = sizeof(*cp) + key_count *
5116 sizeof(struct mgmt_ltk_info);
5117 if (expected_len != len) {
5118 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5119 expected_len, len);
5120 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5121 MGMT_STATUS_INVALID_PARAMS);
5122 }
5123
5124 BT_DBG("%s key_count %u", hdev->name, key_count);
5125
5126 for (i = 0; i < key_count; i++) {
5127 struct mgmt_ltk_info *key = &cp->keys[i];
5128
5129 if (!ltk_is_valid(key))
5130 return mgmt_cmd_status(sk, hdev->id,
5131 MGMT_OP_LOAD_LONG_TERM_KEYS,
5132 MGMT_STATUS_INVALID_PARAMS);
5133 }
5134
5135 hci_dev_lock(hdev);
5136
5137 hci_smp_ltks_clear(hdev);
5138
5139 for (i = 0; i < key_count; i++) {
5140 struct mgmt_ltk_info *key = &cp->keys[i];
5141 u8 type, authenticated;
5142
5143 switch (key->type) {
5144 case MGMT_LTK_UNAUTHENTICATED:
5145 authenticated = 0x00;
5146 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5147 break;
5148 case MGMT_LTK_AUTHENTICATED:
5149 authenticated = 0x01;
5150 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5151 break;
5152 case MGMT_LTK_P256_UNAUTH:
5153 authenticated = 0x00;
5154 type = SMP_LTK_P256;
5155 break;
5156 case MGMT_LTK_P256_AUTH:
5157 authenticated = 0x01;
5158 type = SMP_LTK_P256;
5159 break;
5160 case MGMT_LTK_P256_DEBUG:
5161 authenticated = 0x00;
5162 type = SMP_LTK_P256_DEBUG;
5163 /* fall through */
5164 default:
5165 continue;
5166 }
5167
5168 hci_add_ltk(hdev, &key->addr.bdaddr,
5169 le_addr_type(key->addr.type), type, authenticated,
5170 key->val, key->enc_size, key->ediv, key->rand);
5171 }
5172
5173 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5174 NULL, 0);
5175
5176 hci_dev_unlock(hdev);
5177
5178 return err;
5179 }
5180
conn_info_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)5181 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5182 {
5183 struct hci_conn *conn = cmd->user_data;
5184 struct mgmt_rp_get_conn_info rp;
5185 int err;
5186
5187 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5188
5189 if (status == MGMT_STATUS_SUCCESS) {
5190 rp.rssi = conn->rssi;
5191 rp.tx_power = conn->tx_power;
5192 rp.max_tx_power = conn->max_tx_power;
5193 } else {
5194 rp.rssi = HCI_RSSI_INVALID;
5195 rp.tx_power = HCI_TX_POWER_INVALID;
5196 rp.max_tx_power = HCI_TX_POWER_INVALID;
5197 }
5198
5199 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5200 status, &rp, sizeof(rp));
5201
5202 hci_conn_drop(conn);
5203 hci_conn_put(conn);
5204
5205 return err;
5206 }
5207
conn_info_refresh_complete(struct hci_dev * hdev,u8 hci_status,u16 opcode)5208 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5209 u16 opcode)
5210 {
5211 struct hci_cp_read_rssi *cp;
5212 struct mgmt_pending_cmd *cmd;
5213 struct hci_conn *conn;
5214 u16 handle;
5215 u8 status;
5216
5217 BT_DBG("status 0x%02x", hci_status);
5218
5219 hci_dev_lock(hdev);
5220
5221 /* Commands sent in request are either Read RSSI or Read Transmit Power
5222 * Level so we check which one was last sent to retrieve connection
5223 * handle. Both commands have handle as first parameter so it's safe to
5224 * cast data on the same command struct.
5225 *
5226 * First command sent is always Read RSSI and we fail only if it fails.
5227 * In other case we simply override error to indicate success as we
5228 * already remembered if TX power value is actually valid.
5229 */
5230 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5231 if (!cp) {
5232 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5233 status = MGMT_STATUS_SUCCESS;
5234 } else {
5235 status = mgmt_status(hci_status);
5236 }
5237
5238 if (!cp) {
5239 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5240 goto unlock;
5241 }
5242
5243 handle = __le16_to_cpu(cp->handle);
5244 conn = hci_conn_hash_lookup_handle(hdev, handle);
5245 if (!conn) {
5246 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5247 handle);
5248 goto unlock;
5249 }
5250
5251 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5252 if (!cmd)
5253 goto unlock;
5254
5255 cmd->cmd_complete(cmd, status);
5256 mgmt_pending_remove(cmd);
5257
5258 unlock:
5259 hci_dev_unlock(hdev);
5260 }
5261
get_conn_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5262 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5263 u16 len)
5264 {
5265 struct mgmt_cp_get_conn_info *cp = data;
5266 struct mgmt_rp_get_conn_info rp;
5267 struct hci_conn *conn;
5268 unsigned long conn_info_age;
5269 int err = 0;
5270
5271 BT_DBG("%s", hdev->name);
5272
5273 memset(&rp, 0, sizeof(rp));
5274 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5275 rp.addr.type = cp->addr.type;
5276
5277 if (!bdaddr_type_is_valid(cp->addr.type))
5278 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5279 MGMT_STATUS_INVALID_PARAMS,
5280 &rp, sizeof(rp));
5281
5282 hci_dev_lock(hdev);
5283
5284 if (!hdev_is_powered(hdev)) {
5285 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5286 MGMT_STATUS_NOT_POWERED, &rp,
5287 sizeof(rp));
5288 goto unlock;
5289 }
5290
5291 if (cp->addr.type == BDADDR_BREDR)
5292 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5293 &cp->addr.bdaddr);
5294 else
5295 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5296
5297 if (!conn || conn->state != BT_CONNECTED) {
5298 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5299 MGMT_STATUS_NOT_CONNECTED, &rp,
5300 sizeof(rp));
5301 goto unlock;
5302 }
5303
5304 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5305 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5306 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5307 goto unlock;
5308 }
5309
5310 /* To avoid client trying to guess when to poll again for information we
5311 * calculate conn info age as random value between min/max set in hdev.
5312 */
5313 conn_info_age = hdev->conn_info_min_age +
5314 prandom_u32_max(hdev->conn_info_max_age -
5315 hdev->conn_info_min_age);
5316
5317 /* Query controller to refresh cached values if they are too old or were
5318 * never read.
5319 */
5320 if (time_after(jiffies, conn->conn_info_timestamp +
5321 msecs_to_jiffies(conn_info_age)) ||
5322 !conn->conn_info_timestamp) {
5323 struct hci_request req;
5324 struct hci_cp_read_tx_power req_txp_cp;
5325 struct hci_cp_read_rssi req_rssi_cp;
5326 struct mgmt_pending_cmd *cmd;
5327
5328 hci_req_init(&req, hdev);
5329 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5330 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5331 &req_rssi_cp);
5332
5333 /* For LE links TX power does not change thus we don't need to
5334 * query for it once value is known.
5335 */
5336 if (!bdaddr_type_is_le(cp->addr.type) ||
5337 conn->tx_power == HCI_TX_POWER_INVALID) {
5338 req_txp_cp.handle = cpu_to_le16(conn->handle);
5339 req_txp_cp.type = 0x00;
5340 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5341 sizeof(req_txp_cp), &req_txp_cp);
5342 }
5343
5344 /* Max TX power needs to be read only once per connection */
5345 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5346 req_txp_cp.handle = cpu_to_le16(conn->handle);
5347 req_txp_cp.type = 0x01;
5348 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5349 sizeof(req_txp_cp), &req_txp_cp);
5350 }
5351
5352 err = hci_req_run(&req, conn_info_refresh_complete);
5353 if (err < 0)
5354 goto unlock;
5355
5356 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5357 data, len);
5358 if (!cmd) {
5359 err = -ENOMEM;
5360 goto unlock;
5361 }
5362
5363 hci_conn_hold(conn);
5364 cmd->user_data = hci_conn_get(conn);
5365 cmd->cmd_complete = conn_info_cmd_complete;
5366
5367 conn->conn_info_timestamp = jiffies;
5368 } else {
5369 /* Cache is valid, just reply with values cached in hci_conn */
5370 rp.rssi = conn->rssi;
5371 rp.tx_power = conn->tx_power;
5372 rp.max_tx_power = conn->max_tx_power;
5373
5374 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5375 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5376 }
5377
5378 unlock:
5379 hci_dev_unlock(hdev);
5380 return err;
5381 }
5382
clock_info_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)5383 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5384 {
5385 struct hci_conn *conn = cmd->user_data;
5386 struct mgmt_rp_get_clock_info rp;
5387 struct hci_dev *hdev;
5388 int err;
5389
5390 memset(&rp, 0, sizeof(rp));
5391 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5392
5393 if (status)
5394 goto complete;
5395
5396 hdev = hci_dev_get(cmd->index);
5397 if (hdev) {
5398 rp.local_clock = cpu_to_le32(hdev->clock);
5399 hci_dev_put(hdev);
5400 }
5401
5402 if (conn) {
5403 rp.piconet_clock = cpu_to_le32(conn->clock);
5404 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5405 }
5406
5407 complete:
5408 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5409 sizeof(rp));
5410
5411 if (conn) {
5412 hci_conn_drop(conn);
5413 hci_conn_put(conn);
5414 }
5415
5416 return err;
5417 }
5418
get_clock_info_complete(struct hci_dev * hdev,u8 status,u16 opcode)5419 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5420 {
5421 struct hci_cp_read_clock *hci_cp;
5422 struct mgmt_pending_cmd *cmd;
5423 struct hci_conn *conn;
5424
5425 BT_DBG("%s status %u", hdev->name, status);
5426
5427 hci_dev_lock(hdev);
5428
5429 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5430 if (!hci_cp)
5431 goto unlock;
5432
5433 if (hci_cp->which) {
5434 u16 handle = __le16_to_cpu(hci_cp->handle);
5435 conn = hci_conn_hash_lookup_handle(hdev, handle);
5436 } else {
5437 conn = NULL;
5438 }
5439
5440 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5441 if (!cmd)
5442 goto unlock;
5443
5444 cmd->cmd_complete(cmd, mgmt_status(status));
5445 mgmt_pending_remove(cmd);
5446
5447 unlock:
5448 hci_dev_unlock(hdev);
5449 }
5450
get_clock_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5451 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5452 u16 len)
5453 {
5454 struct mgmt_cp_get_clock_info *cp = data;
5455 struct mgmt_rp_get_clock_info rp;
5456 struct hci_cp_read_clock hci_cp;
5457 struct mgmt_pending_cmd *cmd;
5458 struct hci_request req;
5459 struct hci_conn *conn;
5460 int err;
5461
5462 BT_DBG("%s", hdev->name);
5463
5464 memset(&rp, 0, sizeof(rp));
5465 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5466 rp.addr.type = cp->addr.type;
5467
5468 if (cp->addr.type != BDADDR_BREDR)
5469 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5470 MGMT_STATUS_INVALID_PARAMS,
5471 &rp, sizeof(rp));
5472
5473 hci_dev_lock(hdev);
5474
5475 if (!hdev_is_powered(hdev)) {
5476 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5477 MGMT_STATUS_NOT_POWERED, &rp,
5478 sizeof(rp));
5479 goto unlock;
5480 }
5481
5482 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5484 &cp->addr.bdaddr);
5485 if (!conn || conn->state != BT_CONNECTED) {
5486 err = mgmt_cmd_complete(sk, hdev->id,
5487 MGMT_OP_GET_CLOCK_INFO,
5488 MGMT_STATUS_NOT_CONNECTED,
5489 &rp, sizeof(rp));
5490 goto unlock;
5491 }
5492 } else {
5493 conn = NULL;
5494 }
5495
5496 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5497 if (!cmd) {
5498 err = -ENOMEM;
5499 goto unlock;
5500 }
5501
5502 cmd->cmd_complete = clock_info_cmd_complete;
5503
5504 hci_req_init(&req, hdev);
5505
5506 memset(&hci_cp, 0, sizeof(hci_cp));
5507 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5508
5509 if (conn) {
5510 hci_conn_hold(conn);
5511 cmd->user_data = hci_conn_get(conn);
5512
5513 hci_cp.handle = cpu_to_le16(conn->handle);
5514 hci_cp.which = 0x01; /* Piconet clock */
5515 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5516 }
5517
5518 err = hci_req_run(&req, get_clock_info_complete);
5519 if (err < 0)
5520 mgmt_pending_remove(cmd);
5521
5522 unlock:
5523 hci_dev_unlock(hdev);
5524 return err;
5525 }
5526
is_connected(struct hci_dev * hdev,bdaddr_t * addr,u8 type)5527 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5528 {
5529 struct hci_conn *conn;
5530
5531 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5532 if (!conn)
5533 return false;
5534
5535 if (conn->dst_type != type)
5536 return false;
5537
5538 if (conn->state != BT_CONNECTED)
5539 return false;
5540
5541 return true;
5542 }
5543
5544 /* This function requires the caller holds hdev->lock */
hci_conn_params_set(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,u8 auto_connect)5545 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5546 u8 addr_type, u8 auto_connect)
5547 {
5548 struct hci_conn_params *params;
5549
5550 params = hci_conn_params_add(hdev, addr, addr_type);
5551 if (!params)
5552 return -EIO;
5553
5554 if (params->auto_connect == auto_connect)
5555 return 0;
5556
5557 list_del_init(¶ms->action);
5558
5559 switch (auto_connect) {
5560 case HCI_AUTO_CONN_DISABLED:
5561 case HCI_AUTO_CONN_LINK_LOSS:
5562 /* If auto connect is being disabled when we're trying to
5563 * connect to device, keep connecting.
5564 */
5565 if (params->explicit_connect)
5566 list_add(¶ms->action, &hdev->pend_le_conns);
5567 break;
5568 case HCI_AUTO_CONN_REPORT:
5569 if (params->explicit_connect)
5570 list_add(¶ms->action, &hdev->pend_le_conns);
5571 else
5572 list_add(¶ms->action, &hdev->pend_le_reports);
5573 break;
5574 case HCI_AUTO_CONN_DIRECT:
5575 case HCI_AUTO_CONN_ALWAYS:
5576 if (!is_connected(hdev, addr, addr_type))
5577 list_add(¶ms->action, &hdev->pend_le_conns);
5578 break;
5579 }
5580
5581 params->auto_connect = auto_connect;
5582
5583 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5584 auto_connect);
5585
5586 return 0;
5587 }
5588
device_added(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type,u8 action)5589 static void device_added(struct sock *sk, struct hci_dev *hdev,
5590 bdaddr_t *bdaddr, u8 type, u8 action)
5591 {
5592 struct mgmt_ev_device_added ev;
5593
5594 bacpy(&ev.addr.bdaddr, bdaddr);
5595 ev.addr.type = type;
5596 ev.action = action;
5597
5598 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5599 }
5600
add_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5601 static int add_device(struct sock *sk, struct hci_dev *hdev,
5602 void *data, u16 len)
5603 {
5604 struct mgmt_cp_add_device *cp = data;
5605 u8 auto_conn, addr_type;
5606 int err;
5607
5608 BT_DBG("%s", hdev->name);
5609
5610 if (!bdaddr_type_is_valid(cp->addr.type) ||
5611 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5612 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5613 MGMT_STATUS_INVALID_PARAMS,
5614 &cp->addr, sizeof(cp->addr));
5615
5616 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5617 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5618 MGMT_STATUS_INVALID_PARAMS,
5619 &cp->addr, sizeof(cp->addr));
5620
5621 hci_dev_lock(hdev);
5622
5623 if (cp->addr.type == BDADDR_BREDR) {
5624 /* Only incoming connections action is supported for now */
5625 if (cp->action != 0x01) {
5626 err = mgmt_cmd_complete(sk, hdev->id,
5627 MGMT_OP_ADD_DEVICE,
5628 MGMT_STATUS_INVALID_PARAMS,
5629 &cp->addr, sizeof(cp->addr));
5630 goto unlock;
5631 }
5632
5633 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5634 cp->addr.type);
5635 if (err)
5636 goto unlock;
5637
5638 hci_req_update_scan(hdev);
5639
5640 goto added;
5641 }
5642
5643 addr_type = le_addr_type(cp->addr.type);
5644
5645 if (cp->action == 0x02)
5646 auto_conn = HCI_AUTO_CONN_ALWAYS;
5647 else if (cp->action == 0x01)
5648 auto_conn = HCI_AUTO_CONN_DIRECT;
5649 else
5650 auto_conn = HCI_AUTO_CONN_REPORT;
5651
5652 /* Kernel internally uses conn_params with resolvable private
5653 * address, but Add Device allows only identity addresses.
5654 * Make sure it is enforced before calling
5655 * hci_conn_params_lookup.
5656 */
5657 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5658 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5659 MGMT_STATUS_INVALID_PARAMS,
5660 &cp->addr, sizeof(cp->addr));
5661 goto unlock;
5662 }
5663
5664 /* If the connection parameters don't exist for this device,
5665 * they will be created and configured with defaults.
5666 */
5667 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5668 auto_conn) < 0) {
5669 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5670 MGMT_STATUS_FAILED, &cp->addr,
5671 sizeof(cp->addr));
5672 goto unlock;
5673 }
5674
5675 hci_update_background_scan(hdev);
5676
5677 added:
5678 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5679
5680 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5681 MGMT_STATUS_SUCCESS, &cp->addr,
5682 sizeof(cp->addr));
5683
5684 unlock:
5685 hci_dev_unlock(hdev);
5686 return err;
5687 }
5688
device_removed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)5689 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5690 bdaddr_t *bdaddr, u8 type)
5691 {
5692 struct mgmt_ev_device_removed ev;
5693
5694 bacpy(&ev.addr.bdaddr, bdaddr);
5695 ev.addr.type = type;
5696
5697 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5698 }
5699
remove_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5700 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5701 void *data, u16 len)
5702 {
5703 struct mgmt_cp_remove_device *cp = data;
5704 int err;
5705
5706 BT_DBG("%s", hdev->name);
5707
5708 hci_dev_lock(hdev);
5709
5710 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5711 struct hci_conn_params *params;
5712 u8 addr_type;
5713
5714 if (!bdaddr_type_is_valid(cp->addr.type)) {
5715 err = mgmt_cmd_complete(sk, hdev->id,
5716 MGMT_OP_REMOVE_DEVICE,
5717 MGMT_STATUS_INVALID_PARAMS,
5718 &cp->addr, sizeof(cp->addr));
5719 goto unlock;
5720 }
5721
5722 if (cp->addr.type == BDADDR_BREDR) {
5723 err = hci_bdaddr_list_del(&hdev->whitelist,
5724 &cp->addr.bdaddr,
5725 cp->addr.type);
5726 if (err) {
5727 err = mgmt_cmd_complete(sk, hdev->id,
5728 MGMT_OP_REMOVE_DEVICE,
5729 MGMT_STATUS_INVALID_PARAMS,
5730 &cp->addr,
5731 sizeof(cp->addr));
5732 goto unlock;
5733 }
5734
5735 hci_req_update_scan(hdev);
5736
5737 device_removed(sk, hdev, &cp->addr.bdaddr,
5738 cp->addr.type);
5739 goto complete;
5740 }
5741
5742 addr_type = le_addr_type(cp->addr.type);
5743
5744 /* Kernel internally uses conn_params with resolvable private
5745 * address, but Remove Device allows only identity addresses.
5746 * Make sure it is enforced before calling
5747 * hci_conn_params_lookup.
5748 */
5749 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5750 err = mgmt_cmd_complete(sk, hdev->id,
5751 MGMT_OP_REMOVE_DEVICE,
5752 MGMT_STATUS_INVALID_PARAMS,
5753 &cp->addr, sizeof(cp->addr));
5754 goto unlock;
5755 }
5756
5757 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5758 addr_type);
5759 if (!params) {
5760 err = mgmt_cmd_complete(sk, hdev->id,
5761 MGMT_OP_REMOVE_DEVICE,
5762 MGMT_STATUS_INVALID_PARAMS,
5763 &cp->addr, sizeof(cp->addr));
5764 goto unlock;
5765 }
5766
5767 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5768 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5769 err = mgmt_cmd_complete(sk, hdev->id,
5770 MGMT_OP_REMOVE_DEVICE,
5771 MGMT_STATUS_INVALID_PARAMS,
5772 &cp->addr, sizeof(cp->addr));
5773 goto unlock;
5774 }
5775
5776 list_del(¶ms->action);
5777 list_del(¶ms->list);
5778 kfree(params);
5779 hci_update_background_scan(hdev);
5780
5781 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5782 } else {
5783 struct hci_conn_params *p, *tmp;
5784 struct bdaddr_list *b, *btmp;
5785
5786 if (cp->addr.type) {
5787 err = mgmt_cmd_complete(sk, hdev->id,
5788 MGMT_OP_REMOVE_DEVICE,
5789 MGMT_STATUS_INVALID_PARAMS,
5790 &cp->addr, sizeof(cp->addr));
5791 goto unlock;
5792 }
5793
5794 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5795 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5796 list_del(&b->list);
5797 kfree(b);
5798 }
5799
5800 hci_req_update_scan(hdev);
5801
5802 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5803 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5804 continue;
5805 device_removed(sk, hdev, &p->addr, p->addr_type);
5806 if (p->explicit_connect) {
5807 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5808 continue;
5809 }
5810 list_del(&p->action);
5811 list_del(&p->list);
5812 kfree(p);
5813 }
5814
5815 BT_DBG("All LE connection parameters were removed");
5816
5817 hci_update_background_scan(hdev);
5818 }
5819
5820 complete:
5821 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5822 MGMT_STATUS_SUCCESS, &cp->addr,
5823 sizeof(cp->addr));
5824 unlock:
5825 hci_dev_unlock(hdev);
5826 return err;
5827 }
5828
load_conn_param(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5829 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5830 u16 len)
5831 {
5832 struct mgmt_cp_load_conn_param *cp = data;
5833 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5834 sizeof(struct mgmt_conn_param));
5835 u16 param_count, expected_len;
5836 int i;
5837
5838 if (!lmp_le_capable(hdev))
5839 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5840 MGMT_STATUS_NOT_SUPPORTED);
5841
5842 param_count = __le16_to_cpu(cp->param_count);
5843 if (param_count > max_param_count) {
5844 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5845 param_count);
5846 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5847 MGMT_STATUS_INVALID_PARAMS);
5848 }
5849
5850 expected_len = sizeof(*cp) + param_count *
5851 sizeof(struct mgmt_conn_param);
5852 if (expected_len != len) {
5853 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5854 expected_len, len);
5855 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5856 MGMT_STATUS_INVALID_PARAMS);
5857 }
5858
5859 BT_DBG("%s param_count %u", hdev->name, param_count);
5860
5861 hci_dev_lock(hdev);
5862
5863 hci_conn_params_clear_disabled(hdev);
5864
5865 for (i = 0; i < param_count; i++) {
5866 struct mgmt_conn_param *param = &cp->params[i];
5867 struct hci_conn_params *hci_param;
5868 u16 min, max, latency, timeout;
5869 u8 addr_type;
5870
5871 BT_DBG("Adding %pMR (type %u)", ¶m->addr.bdaddr,
5872 param->addr.type);
5873
5874 if (param->addr.type == BDADDR_LE_PUBLIC) {
5875 addr_type = ADDR_LE_DEV_PUBLIC;
5876 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5877 addr_type = ADDR_LE_DEV_RANDOM;
5878 } else {
5879 bt_dev_err(hdev, "ignoring invalid connection parameters");
5880 continue;
5881 }
5882
5883 min = le16_to_cpu(param->min_interval);
5884 max = le16_to_cpu(param->max_interval);
5885 latency = le16_to_cpu(param->latency);
5886 timeout = le16_to_cpu(param->timeout);
5887
5888 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5889 min, max, latency, timeout);
5890
5891 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5892 bt_dev_err(hdev, "ignoring invalid connection parameters");
5893 continue;
5894 }
5895
5896 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
5897 addr_type);
5898 if (!hci_param) {
5899 bt_dev_err(hdev, "failed to add connection parameters");
5900 continue;
5901 }
5902
5903 hci_param->conn_min_interval = min;
5904 hci_param->conn_max_interval = max;
5905 hci_param->conn_latency = latency;
5906 hci_param->supervision_timeout = timeout;
5907 }
5908
5909 hci_dev_unlock(hdev);
5910
5911 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5912 NULL, 0);
5913 }
5914
set_external_config(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5915 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5916 void *data, u16 len)
5917 {
5918 struct mgmt_cp_set_external_config *cp = data;
5919 bool changed;
5920 int err;
5921
5922 BT_DBG("%s", hdev->name);
5923
5924 if (hdev_is_powered(hdev))
5925 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5926 MGMT_STATUS_REJECTED);
5927
5928 if (cp->config != 0x00 && cp->config != 0x01)
5929 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5930 MGMT_STATUS_INVALID_PARAMS);
5931
5932 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5933 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5934 MGMT_STATUS_NOT_SUPPORTED);
5935
5936 hci_dev_lock(hdev);
5937
5938 if (cp->config)
5939 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5940 else
5941 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5942
5943 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5944 if (err < 0)
5945 goto unlock;
5946
5947 if (!changed)
5948 goto unlock;
5949
5950 err = new_options(hdev, sk);
5951
5952 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5953 mgmt_index_removed(hdev);
5954
5955 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5956 hci_dev_set_flag(hdev, HCI_CONFIG);
5957 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5958
5959 queue_work(hdev->req_workqueue, &hdev->power_on);
5960 } else {
5961 set_bit(HCI_RAW, &hdev->flags);
5962 mgmt_index_added(hdev);
5963 }
5964 }
5965
5966 unlock:
5967 hci_dev_unlock(hdev);
5968 return err;
5969 }
5970
set_public_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5971 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5972 void *data, u16 len)
5973 {
5974 struct mgmt_cp_set_public_address *cp = data;
5975 bool changed;
5976 int err;
5977
5978 BT_DBG("%s", hdev->name);
5979
5980 if (hdev_is_powered(hdev))
5981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5982 MGMT_STATUS_REJECTED);
5983
5984 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5985 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5986 MGMT_STATUS_INVALID_PARAMS);
5987
5988 if (!hdev->set_bdaddr)
5989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5990 MGMT_STATUS_NOT_SUPPORTED);
5991
5992 hci_dev_lock(hdev);
5993
5994 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5995 bacpy(&hdev->public_addr, &cp->bdaddr);
5996
5997 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5998 if (err < 0)
5999 goto unlock;
6000
6001 if (!changed)
6002 goto unlock;
6003
6004 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6005 err = new_options(hdev, sk);
6006
6007 if (is_configured(hdev)) {
6008 mgmt_index_removed(hdev);
6009
6010 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6011
6012 hci_dev_set_flag(hdev, HCI_CONFIG);
6013 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6014
6015 queue_work(hdev->req_workqueue, &hdev->power_on);
6016 }
6017
6018 unlock:
6019 hci_dev_unlock(hdev);
6020 return err;
6021 }
6022
read_local_oob_ext_data_complete(struct hci_dev * hdev,u8 status,u16 opcode,struct sk_buff * skb)6023 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6024 u16 opcode, struct sk_buff *skb)
6025 {
6026 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6027 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6028 u8 *h192, *r192, *h256, *r256;
6029 struct mgmt_pending_cmd *cmd;
6030 u16 eir_len;
6031 int err;
6032
6033 BT_DBG("%s status %u", hdev->name, status);
6034
6035 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6036 if (!cmd)
6037 return;
6038
6039 mgmt_cp = cmd->param;
6040
6041 if (status) {
6042 status = mgmt_status(status);
6043 eir_len = 0;
6044
6045 h192 = NULL;
6046 r192 = NULL;
6047 h256 = NULL;
6048 r256 = NULL;
6049 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6050 struct hci_rp_read_local_oob_data *rp;
6051
6052 if (skb->len != sizeof(*rp)) {
6053 status = MGMT_STATUS_FAILED;
6054 eir_len = 0;
6055 } else {
6056 status = MGMT_STATUS_SUCCESS;
6057 rp = (void *)skb->data;
6058
6059 eir_len = 5 + 18 + 18;
6060 h192 = rp->hash;
6061 r192 = rp->rand;
6062 h256 = NULL;
6063 r256 = NULL;
6064 }
6065 } else {
6066 struct hci_rp_read_local_oob_ext_data *rp;
6067
6068 if (skb->len != sizeof(*rp)) {
6069 status = MGMT_STATUS_FAILED;
6070 eir_len = 0;
6071 } else {
6072 status = MGMT_STATUS_SUCCESS;
6073 rp = (void *)skb->data;
6074
6075 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6076 eir_len = 5 + 18 + 18;
6077 h192 = NULL;
6078 r192 = NULL;
6079 } else {
6080 eir_len = 5 + 18 + 18 + 18 + 18;
6081 h192 = rp->hash192;
6082 r192 = rp->rand192;
6083 }
6084
6085 h256 = rp->hash256;
6086 r256 = rp->rand256;
6087 }
6088 }
6089
6090 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6091 if (!mgmt_rp)
6092 goto done;
6093
6094 if (status)
6095 goto send_rsp;
6096
6097 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6098 hdev->dev_class, 3);
6099
6100 if (h192 && r192) {
6101 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6102 EIR_SSP_HASH_C192, h192, 16);
6103 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6104 EIR_SSP_RAND_R192, r192, 16);
6105 }
6106
6107 if (h256 && r256) {
6108 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6109 EIR_SSP_HASH_C256, h256, 16);
6110 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6111 EIR_SSP_RAND_R256, r256, 16);
6112 }
6113
6114 send_rsp:
6115 mgmt_rp->type = mgmt_cp->type;
6116 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6117
6118 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6119 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6120 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6121 if (err < 0 || status)
6122 goto done;
6123
6124 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6125
6126 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6127 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6128 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6129 done:
6130 kfree(mgmt_rp);
6131 mgmt_pending_remove(cmd);
6132 }
6133
read_local_ssp_oob_req(struct hci_dev * hdev,struct sock * sk,struct mgmt_cp_read_local_oob_ext_data * cp)6134 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6135 struct mgmt_cp_read_local_oob_ext_data *cp)
6136 {
6137 struct mgmt_pending_cmd *cmd;
6138 struct hci_request req;
6139 int err;
6140
6141 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6142 cp, sizeof(*cp));
6143 if (!cmd)
6144 return -ENOMEM;
6145
6146 hci_req_init(&req, hdev);
6147
6148 if (bredr_sc_enabled(hdev))
6149 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6150 else
6151 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6152
6153 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6154 if (err < 0) {
6155 mgmt_pending_remove(cmd);
6156 return err;
6157 }
6158
6159 return 0;
6160 }
6161
read_local_oob_ext_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6162 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6163 void *data, u16 data_len)
6164 {
6165 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6166 struct mgmt_rp_read_local_oob_ext_data *rp;
6167 size_t rp_len;
6168 u16 eir_len;
6169 u8 status, flags, role, addr[7], hash[16], rand[16];
6170 int err;
6171
6172 BT_DBG("%s", hdev->name);
6173
6174 if (hdev_is_powered(hdev)) {
6175 switch (cp->type) {
6176 case BIT(BDADDR_BREDR):
6177 status = mgmt_bredr_support(hdev);
6178 if (status)
6179 eir_len = 0;
6180 else
6181 eir_len = 5;
6182 break;
6183 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6184 status = mgmt_le_support(hdev);
6185 if (status)
6186 eir_len = 0;
6187 else
6188 eir_len = 9 + 3 + 18 + 18 + 3;
6189 break;
6190 default:
6191 status = MGMT_STATUS_INVALID_PARAMS;
6192 eir_len = 0;
6193 break;
6194 }
6195 } else {
6196 status = MGMT_STATUS_NOT_POWERED;
6197 eir_len = 0;
6198 }
6199
6200 rp_len = sizeof(*rp) + eir_len;
6201 rp = kmalloc(rp_len, GFP_ATOMIC);
6202 if (!rp)
6203 return -ENOMEM;
6204
6205 if (status)
6206 goto complete;
6207
6208 hci_dev_lock(hdev);
6209
6210 eir_len = 0;
6211 switch (cp->type) {
6212 case BIT(BDADDR_BREDR):
6213 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6214 err = read_local_ssp_oob_req(hdev, sk, cp);
6215 hci_dev_unlock(hdev);
6216 if (!err)
6217 goto done;
6218
6219 status = MGMT_STATUS_FAILED;
6220 goto complete;
6221 } else {
6222 eir_len = eir_append_data(rp->eir, eir_len,
6223 EIR_CLASS_OF_DEV,
6224 hdev->dev_class, 3);
6225 }
6226 break;
6227 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6228 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6229 smp_generate_oob(hdev, hash, rand) < 0) {
6230 hci_dev_unlock(hdev);
6231 status = MGMT_STATUS_FAILED;
6232 goto complete;
6233 }
6234
6235 /* This should return the active RPA, but since the RPA
6236 * is only programmed on demand, it is really hard to fill
6237 * this in at the moment. For now disallow retrieving
6238 * local out-of-band data when privacy is in use.
6239 *
6240 * Returning the identity address will not help here since
6241 * pairing happens before the identity resolving key is
6242 * known and thus the connection establishment happens
6243 * based on the RPA and not the identity address.
6244 */
6245 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6246 hci_dev_unlock(hdev);
6247 status = MGMT_STATUS_REJECTED;
6248 goto complete;
6249 }
6250
6251 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6252 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6253 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6254 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6255 memcpy(addr, &hdev->static_addr, 6);
6256 addr[6] = 0x01;
6257 } else {
6258 memcpy(addr, &hdev->bdaddr, 6);
6259 addr[6] = 0x00;
6260 }
6261
6262 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6263 addr, sizeof(addr));
6264
6265 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6266 role = 0x02;
6267 else
6268 role = 0x01;
6269
6270 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6271 &role, sizeof(role));
6272
6273 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6274 eir_len = eir_append_data(rp->eir, eir_len,
6275 EIR_LE_SC_CONFIRM,
6276 hash, sizeof(hash));
6277
6278 eir_len = eir_append_data(rp->eir, eir_len,
6279 EIR_LE_SC_RANDOM,
6280 rand, sizeof(rand));
6281 }
6282
6283 flags = mgmt_get_adv_discov_flags(hdev);
6284
6285 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6286 flags |= LE_AD_NO_BREDR;
6287
6288 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6289 &flags, sizeof(flags));
6290 break;
6291 }
6292
6293 hci_dev_unlock(hdev);
6294
6295 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6296
6297 status = MGMT_STATUS_SUCCESS;
6298
6299 complete:
6300 rp->type = cp->type;
6301 rp->eir_len = cpu_to_le16(eir_len);
6302
6303 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6304 status, rp, sizeof(*rp) + eir_len);
6305 if (err < 0 || status)
6306 goto done;
6307
6308 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6309 rp, sizeof(*rp) + eir_len,
6310 HCI_MGMT_OOB_DATA_EVENTS, sk);
6311
6312 done:
6313 kfree(rp);
6314
6315 return err;
6316 }
6317
get_supported_adv_flags(struct hci_dev * hdev)6318 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6319 {
6320 u32 flags = 0;
6321
6322 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6323 flags |= MGMT_ADV_FLAG_DISCOV;
6324 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6325 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6326 flags |= MGMT_ADV_FLAG_APPEARANCE;
6327 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6328
6329 /* In extended adv TX_POWER returned from Set Adv Param
6330 * will be always valid.
6331 */
6332 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6333 ext_adv_capable(hdev))
6334 flags |= MGMT_ADV_FLAG_TX_POWER;
6335
6336 if (ext_adv_capable(hdev)) {
6337 flags |= MGMT_ADV_FLAG_SEC_1M;
6338
6339 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6340 flags |= MGMT_ADV_FLAG_SEC_2M;
6341
6342 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6343 flags |= MGMT_ADV_FLAG_SEC_CODED;
6344 }
6345
6346 return flags;
6347 }
6348
read_adv_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6349 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6350 void *data, u16 data_len)
6351 {
6352 struct mgmt_rp_read_adv_features *rp;
6353 size_t rp_len;
6354 int err;
6355 struct adv_info *adv_instance;
6356 u32 supported_flags;
6357 u8 *instance;
6358
6359 BT_DBG("%s", hdev->name);
6360
6361 if (!lmp_le_capable(hdev))
6362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6363 MGMT_STATUS_REJECTED);
6364
6365 hci_dev_lock(hdev);
6366
6367 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6368 rp = kmalloc(rp_len, GFP_ATOMIC);
6369 if (!rp) {
6370 hci_dev_unlock(hdev);
6371 return -ENOMEM;
6372 }
6373
6374 supported_flags = get_supported_adv_flags(hdev);
6375
6376 rp->supported_flags = cpu_to_le32(supported_flags);
6377 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6378 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6379 rp->max_instances = HCI_MAX_ADV_INSTANCES;
6380 rp->num_instances = hdev->adv_instance_cnt;
6381
6382 instance = rp->instance;
6383 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6384 *instance = adv_instance->instance;
6385 instance++;
6386 }
6387
6388 hci_dev_unlock(hdev);
6389
6390 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6391 MGMT_STATUS_SUCCESS, rp, rp_len);
6392
6393 kfree(rp);
6394
6395 return err;
6396 }
6397
calculate_name_len(struct hci_dev * hdev)6398 static u8 calculate_name_len(struct hci_dev *hdev)
6399 {
6400 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6401
6402 return append_local_name(hdev, buf, 0);
6403 }
6404
tlv_data_max_len(struct hci_dev * hdev,u32 adv_flags,bool is_adv_data)6405 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6406 bool is_adv_data)
6407 {
6408 u8 max_len = HCI_MAX_AD_LENGTH;
6409
6410 if (is_adv_data) {
6411 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6412 MGMT_ADV_FLAG_LIMITED_DISCOV |
6413 MGMT_ADV_FLAG_MANAGED_FLAGS))
6414 max_len -= 3;
6415
6416 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6417 max_len -= 3;
6418 } else {
6419 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6420 max_len -= calculate_name_len(hdev);
6421
6422 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6423 max_len -= 4;
6424 }
6425
6426 return max_len;
6427 }
6428
flags_managed(u32 adv_flags)6429 static bool flags_managed(u32 adv_flags)
6430 {
6431 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6432 MGMT_ADV_FLAG_LIMITED_DISCOV |
6433 MGMT_ADV_FLAG_MANAGED_FLAGS);
6434 }
6435
tx_power_managed(u32 adv_flags)6436 static bool tx_power_managed(u32 adv_flags)
6437 {
6438 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6439 }
6440
name_managed(u32 adv_flags)6441 static bool name_managed(u32 adv_flags)
6442 {
6443 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6444 }
6445
appearance_managed(u32 adv_flags)6446 static bool appearance_managed(u32 adv_flags)
6447 {
6448 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6449 }
6450
tlv_data_is_valid(struct hci_dev * hdev,u32 adv_flags,u8 * data,u8 len,bool is_adv_data)6451 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6452 u8 len, bool is_adv_data)
6453 {
6454 int i, cur_len;
6455 u8 max_len;
6456
6457 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6458
6459 if (len > max_len)
6460 return false;
6461
6462 /* Make sure that the data is correctly formatted. */
6463 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6464 cur_len = data[i];
6465
6466 if (data[i + 1] == EIR_FLAGS &&
6467 (!is_adv_data || flags_managed(adv_flags)))
6468 return false;
6469
6470 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6471 return false;
6472
6473 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6474 return false;
6475
6476 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6477 return false;
6478
6479 if (data[i + 1] == EIR_APPEARANCE &&
6480 appearance_managed(adv_flags))
6481 return false;
6482
6483 /* If the current field length would exceed the total data
6484 * length, then it's invalid.
6485 */
6486 if (i + cur_len >= len)
6487 return false;
6488 }
6489
6490 return true;
6491 }
6492
add_advertising_complete(struct hci_dev * hdev,u8 status,u16 opcode)6493 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6494 u16 opcode)
6495 {
6496 struct mgmt_pending_cmd *cmd;
6497 struct mgmt_cp_add_advertising *cp;
6498 struct mgmt_rp_add_advertising rp;
6499 struct adv_info *adv_instance, *n;
6500 u8 instance;
6501
6502 BT_DBG("status %d", status);
6503
6504 hci_dev_lock(hdev);
6505
6506 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6507
6508 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6509 if (!adv_instance->pending)
6510 continue;
6511
6512 if (!status) {
6513 adv_instance->pending = false;
6514 continue;
6515 }
6516
6517 instance = adv_instance->instance;
6518
6519 if (hdev->cur_adv_instance == instance)
6520 cancel_adv_timeout(hdev);
6521
6522 hci_remove_adv_instance(hdev, instance);
6523 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6524 }
6525
6526 if (!cmd)
6527 goto unlock;
6528
6529 cp = cmd->param;
6530 rp.instance = cp->instance;
6531
6532 if (status)
6533 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6534 mgmt_status(status));
6535 else
6536 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6537 mgmt_status(status), &rp, sizeof(rp));
6538
6539 mgmt_pending_remove(cmd);
6540
6541 unlock:
6542 hci_dev_unlock(hdev);
6543 }
6544
add_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6545 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6546 void *data, u16 data_len)
6547 {
6548 struct mgmt_cp_add_advertising *cp = data;
6549 struct mgmt_rp_add_advertising rp;
6550 u32 flags;
6551 u32 supported_flags, phy_flags;
6552 u8 status;
6553 u16 timeout, duration;
6554 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6555 u8 schedule_instance = 0;
6556 struct adv_info *next_instance;
6557 int err;
6558 struct mgmt_pending_cmd *cmd;
6559 struct hci_request req;
6560
6561 BT_DBG("%s", hdev->name);
6562
6563 status = mgmt_le_support(hdev);
6564 if (status)
6565 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6566 status);
6567
6568 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6570 MGMT_STATUS_INVALID_PARAMS);
6571
6572 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6573 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6574 MGMT_STATUS_INVALID_PARAMS);
6575
6576 flags = __le32_to_cpu(cp->flags);
6577 timeout = __le16_to_cpu(cp->timeout);
6578 duration = __le16_to_cpu(cp->duration);
6579
6580 /* The current implementation only supports a subset of the specified
6581 * flags. Also need to check mutual exclusiveness of sec flags.
6582 */
6583 supported_flags = get_supported_adv_flags(hdev);
6584 phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6585 if (flags & ~supported_flags ||
6586 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6588 MGMT_STATUS_INVALID_PARAMS);
6589
6590 hci_dev_lock(hdev);
6591
6592 if (timeout && !hdev_is_powered(hdev)) {
6593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6594 MGMT_STATUS_REJECTED);
6595 goto unlock;
6596 }
6597
6598 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6599 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6600 pending_find(MGMT_OP_SET_LE, hdev)) {
6601 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6602 MGMT_STATUS_BUSY);
6603 goto unlock;
6604 }
6605
6606 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6607 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6608 cp->scan_rsp_len, false)) {
6609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6610 MGMT_STATUS_INVALID_PARAMS);
6611 goto unlock;
6612 }
6613
6614 err = hci_add_adv_instance(hdev, cp->instance, flags,
6615 cp->adv_data_len, cp->data,
6616 cp->scan_rsp_len,
6617 cp->data + cp->adv_data_len,
6618 timeout, duration);
6619 if (err < 0) {
6620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6621 MGMT_STATUS_FAILED);
6622 goto unlock;
6623 }
6624
6625 /* Only trigger an advertising added event if a new instance was
6626 * actually added.
6627 */
6628 if (hdev->adv_instance_cnt > prev_instance_cnt)
6629 mgmt_advertising_added(sk, hdev, cp->instance);
6630
6631 if (hdev->cur_adv_instance == cp->instance) {
6632 /* If the currently advertised instance is being changed then
6633 * cancel the current advertising and schedule the next
6634 * instance. If there is only one instance then the overridden
6635 * advertising data will be visible right away.
6636 */
6637 cancel_adv_timeout(hdev);
6638
6639 next_instance = hci_get_next_instance(hdev, cp->instance);
6640 if (next_instance)
6641 schedule_instance = next_instance->instance;
6642 } else if (!hdev->adv_instance_timeout) {
6643 /* Immediately advertise the new instance if no other
6644 * instance is currently being advertised.
6645 */
6646 schedule_instance = cp->instance;
6647 }
6648
6649 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6650 * there is no instance to be advertised then we have no HCI
6651 * communication to make. Simply return.
6652 */
6653 if (!hdev_is_powered(hdev) ||
6654 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6655 !schedule_instance) {
6656 rp.instance = cp->instance;
6657 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6658 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6659 goto unlock;
6660 }
6661
6662 /* We're good to go, update advertising data, parameters, and start
6663 * advertising.
6664 */
6665 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6666 data_len);
6667 if (!cmd) {
6668 err = -ENOMEM;
6669 goto unlock;
6670 }
6671
6672 hci_req_init(&req, hdev);
6673
6674 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6675
6676 if (!err)
6677 err = hci_req_run(&req, add_advertising_complete);
6678
6679 if (err < 0)
6680 mgmt_pending_remove(cmd);
6681
6682 unlock:
6683 hci_dev_unlock(hdev);
6684
6685 return err;
6686 }
6687
remove_advertising_complete(struct hci_dev * hdev,u8 status,u16 opcode)6688 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6689 u16 opcode)
6690 {
6691 struct mgmt_pending_cmd *cmd;
6692 struct mgmt_cp_remove_advertising *cp;
6693 struct mgmt_rp_remove_advertising rp;
6694
6695 BT_DBG("status %d", status);
6696
6697 hci_dev_lock(hdev);
6698
6699 /* A failure status here only means that we failed to disable
6700 * advertising. Otherwise, the advertising instance has been removed,
6701 * so report success.
6702 */
6703 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6704 if (!cmd)
6705 goto unlock;
6706
6707 cp = cmd->param;
6708 rp.instance = cp->instance;
6709
6710 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6711 &rp, sizeof(rp));
6712 mgmt_pending_remove(cmd);
6713
6714 unlock:
6715 hci_dev_unlock(hdev);
6716 }
6717
remove_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6718 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6719 void *data, u16 data_len)
6720 {
6721 struct mgmt_cp_remove_advertising *cp = data;
6722 struct mgmt_rp_remove_advertising rp;
6723 struct mgmt_pending_cmd *cmd;
6724 struct hci_request req;
6725 int err;
6726
6727 BT_DBG("%s", hdev->name);
6728
6729 hci_dev_lock(hdev);
6730
6731 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6732 err = mgmt_cmd_status(sk, hdev->id,
6733 MGMT_OP_REMOVE_ADVERTISING,
6734 MGMT_STATUS_INVALID_PARAMS);
6735 goto unlock;
6736 }
6737
6738 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6739 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6740 pending_find(MGMT_OP_SET_LE, hdev)) {
6741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6742 MGMT_STATUS_BUSY);
6743 goto unlock;
6744 }
6745
6746 if (list_empty(&hdev->adv_instances)) {
6747 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6748 MGMT_STATUS_INVALID_PARAMS);
6749 goto unlock;
6750 }
6751
6752 hci_req_init(&req, hdev);
6753
6754 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6755
6756 if (list_empty(&hdev->adv_instances))
6757 __hci_req_disable_advertising(&req);
6758
6759 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6760 * flag is set or the device isn't powered then we have no HCI
6761 * communication to make. Simply return.
6762 */
6763 if (skb_queue_empty(&req.cmd_q) ||
6764 !hdev_is_powered(hdev) ||
6765 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6766 hci_req_purge(&req);
6767 rp.instance = cp->instance;
6768 err = mgmt_cmd_complete(sk, hdev->id,
6769 MGMT_OP_REMOVE_ADVERTISING,
6770 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6771 goto unlock;
6772 }
6773
6774 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6775 data_len);
6776 if (!cmd) {
6777 err = -ENOMEM;
6778 goto unlock;
6779 }
6780
6781 err = hci_req_run(&req, remove_advertising_complete);
6782 if (err < 0)
6783 mgmt_pending_remove(cmd);
6784
6785 unlock:
6786 hci_dev_unlock(hdev);
6787
6788 return err;
6789 }
6790
get_adv_size_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6791 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6792 void *data, u16 data_len)
6793 {
6794 struct mgmt_cp_get_adv_size_info *cp = data;
6795 struct mgmt_rp_get_adv_size_info rp;
6796 u32 flags, supported_flags;
6797 int err;
6798
6799 BT_DBG("%s", hdev->name);
6800
6801 if (!lmp_le_capable(hdev))
6802 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6803 MGMT_STATUS_REJECTED);
6804
6805 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6806 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6807 MGMT_STATUS_INVALID_PARAMS);
6808
6809 flags = __le32_to_cpu(cp->flags);
6810
6811 /* The current implementation only supports a subset of the specified
6812 * flags.
6813 */
6814 supported_flags = get_supported_adv_flags(hdev);
6815 if (flags & ~supported_flags)
6816 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6817 MGMT_STATUS_INVALID_PARAMS);
6818
6819 rp.instance = cp->instance;
6820 rp.flags = cp->flags;
6821 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6822 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6823
6824 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6825 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6826
6827 return err;
6828 }
6829
6830 static const struct hci_mgmt_handler mgmt_handlers[] = {
6831 { NULL }, /* 0x0000 (no command) */
6832 { read_version, MGMT_READ_VERSION_SIZE,
6833 HCI_MGMT_NO_HDEV |
6834 HCI_MGMT_UNTRUSTED },
6835 { read_commands, MGMT_READ_COMMANDS_SIZE,
6836 HCI_MGMT_NO_HDEV |
6837 HCI_MGMT_UNTRUSTED },
6838 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
6839 HCI_MGMT_NO_HDEV |
6840 HCI_MGMT_UNTRUSTED },
6841 { read_controller_info, MGMT_READ_INFO_SIZE,
6842 HCI_MGMT_UNTRUSTED },
6843 { set_powered, MGMT_SETTING_SIZE },
6844 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6845 { set_connectable, MGMT_SETTING_SIZE },
6846 { set_fast_connectable, MGMT_SETTING_SIZE },
6847 { set_bondable, MGMT_SETTING_SIZE },
6848 { set_link_security, MGMT_SETTING_SIZE },
6849 { set_ssp, MGMT_SETTING_SIZE },
6850 { set_hs, MGMT_SETTING_SIZE },
6851 { set_le, MGMT_SETTING_SIZE },
6852 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6853 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6854 { add_uuid, MGMT_ADD_UUID_SIZE },
6855 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
6856 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6857 HCI_MGMT_VAR_LEN },
6858 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6859 HCI_MGMT_VAR_LEN },
6860 { disconnect, MGMT_DISCONNECT_SIZE },
6861 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6862 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6863 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6864 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6865 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6866 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6867 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6868 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6869 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6870 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6871 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6872 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6873 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6874 HCI_MGMT_VAR_LEN },
6875 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6876 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6877 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6878 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6879 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6880 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6881 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6882 { set_advertising, MGMT_SETTING_SIZE },
6883 { set_bredr, MGMT_SETTING_SIZE },
6884 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6885 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6886 { set_secure_conn, MGMT_SETTING_SIZE },
6887 { set_debug_keys, MGMT_SETTING_SIZE },
6888 { set_privacy, MGMT_SET_PRIVACY_SIZE },
6889 { load_irks, MGMT_LOAD_IRKS_SIZE,
6890 HCI_MGMT_VAR_LEN },
6891 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6892 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6893 { add_device, MGMT_ADD_DEVICE_SIZE },
6894 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
6895 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6896 HCI_MGMT_VAR_LEN },
6897 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6898 HCI_MGMT_NO_HDEV |
6899 HCI_MGMT_UNTRUSTED },
6900 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
6901 HCI_MGMT_UNCONFIGURED |
6902 HCI_MGMT_UNTRUSTED },
6903 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6904 HCI_MGMT_UNCONFIGURED },
6905 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6906 HCI_MGMT_UNCONFIGURED },
6907 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6908 HCI_MGMT_VAR_LEN },
6909 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6910 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
6911 HCI_MGMT_NO_HDEV |
6912 HCI_MGMT_UNTRUSTED },
6913 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
6914 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
6915 HCI_MGMT_VAR_LEN },
6916 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
6917 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
6918 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6919 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6920 HCI_MGMT_UNTRUSTED },
6921 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
6922 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
6923 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
6924 };
6925
mgmt_index_added(struct hci_dev * hdev)6926 void mgmt_index_added(struct hci_dev *hdev)
6927 {
6928 struct mgmt_ev_ext_index ev;
6929
6930 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6931 return;
6932
6933 switch (hdev->dev_type) {
6934 case HCI_PRIMARY:
6935 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6936 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6937 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6938 ev.type = 0x01;
6939 } else {
6940 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6941 HCI_MGMT_INDEX_EVENTS);
6942 ev.type = 0x00;
6943 }
6944 break;
6945 case HCI_AMP:
6946 ev.type = 0x02;
6947 break;
6948 default:
6949 return;
6950 }
6951
6952 ev.bus = hdev->bus;
6953
6954 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6955 HCI_MGMT_EXT_INDEX_EVENTS);
6956 }
6957
mgmt_index_removed(struct hci_dev * hdev)6958 void mgmt_index_removed(struct hci_dev *hdev)
6959 {
6960 struct mgmt_ev_ext_index ev;
6961 u8 status = MGMT_STATUS_INVALID_INDEX;
6962
6963 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6964 return;
6965
6966 switch (hdev->dev_type) {
6967 case HCI_PRIMARY:
6968 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6969
6970 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6971 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6972 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6973 ev.type = 0x01;
6974 } else {
6975 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6976 HCI_MGMT_INDEX_EVENTS);
6977 ev.type = 0x00;
6978 }
6979 break;
6980 case HCI_AMP:
6981 ev.type = 0x02;
6982 break;
6983 default:
6984 return;
6985 }
6986
6987 ev.bus = hdev->bus;
6988
6989 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6990 HCI_MGMT_EXT_INDEX_EVENTS);
6991 }
6992
6993 /* This function requires the caller holds hdev->lock */
restart_le_actions(struct hci_dev * hdev)6994 static void restart_le_actions(struct hci_dev *hdev)
6995 {
6996 struct hci_conn_params *p;
6997
6998 list_for_each_entry(p, &hdev->le_conn_params, list) {
6999 /* Needed for AUTO_OFF case where might not "really"
7000 * have been powered off.
7001 */
7002 list_del_init(&p->action);
7003
7004 switch (p->auto_connect) {
7005 case HCI_AUTO_CONN_DIRECT:
7006 case HCI_AUTO_CONN_ALWAYS:
7007 list_add(&p->action, &hdev->pend_le_conns);
7008 break;
7009 case HCI_AUTO_CONN_REPORT:
7010 list_add(&p->action, &hdev->pend_le_reports);
7011 break;
7012 default:
7013 break;
7014 }
7015 }
7016 }
7017
mgmt_power_on(struct hci_dev * hdev,int err)7018 void mgmt_power_on(struct hci_dev *hdev, int err)
7019 {
7020 struct cmd_lookup match = { NULL, hdev };
7021
7022 BT_DBG("err %d", err);
7023
7024 hci_dev_lock(hdev);
7025
7026 if (!err) {
7027 restart_le_actions(hdev);
7028 hci_update_background_scan(hdev);
7029 }
7030
7031 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7032
7033 new_settings(hdev, match.sk);
7034
7035 if (match.sk)
7036 sock_put(match.sk);
7037
7038 hci_dev_unlock(hdev);
7039 }
7040
__mgmt_power_off(struct hci_dev * hdev)7041 void __mgmt_power_off(struct hci_dev *hdev)
7042 {
7043 struct cmd_lookup match = { NULL, hdev };
7044 u8 status, zero_cod[] = { 0, 0, 0 };
7045
7046 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7047
7048 /* If the power off is because of hdev unregistration let
7049 * use the appropriate INVALID_INDEX status. Otherwise use
7050 * NOT_POWERED. We cover both scenarios here since later in
7051 * mgmt_index_removed() any hci_conn callbacks will have already
7052 * been triggered, potentially causing misleading DISCONNECTED
7053 * status responses.
7054 */
7055 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7056 status = MGMT_STATUS_INVALID_INDEX;
7057 else
7058 status = MGMT_STATUS_NOT_POWERED;
7059
7060 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7061
7062 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7063 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7064 zero_cod, sizeof(zero_cod),
7065 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7066 ext_info_changed(hdev, NULL);
7067 }
7068
7069 new_settings(hdev, match.sk);
7070
7071 if (match.sk)
7072 sock_put(match.sk);
7073 }
7074
mgmt_set_powered_failed(struct hci_dev * hdev,int err)7075 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7076 {
7077 struct mgmt_pending_cmd *cmd;
7078 u8 status;
7079
7080 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7081 if (!cmd)
7082 return;
7083
7084 if (err == -ERFKILL)
7085 status = MGMT_STATUS_RFKILLED;
7086 else
7087 status = MGMT_STATUS_FAILED;
7088
7089 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7090
7091 mgmt_pending_remove(cmd);
7092 }
7093
mgmt_new_link_key(struct hci_dev * hdev,struct link_key * key,bool persistent)7094 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7095 bool persistent)
7096 {
7097 struct mgmt_ev_new_link_key ev;
7098
7099 memset(&ev, 0, sizeof(ev));
7100
7101 ev.store_hint = persistent;
7102 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7103 ev.key.addr.type = BDADDR_BREDR;
7104 ev.key.type = key->type;
7105 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7106 ev.key.pin_len = key->pin_len;
7107
7108 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7109 }
7110
mgmt_ltk_type(struct smp_ltk * ltk)7111 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7112 {
7113 switch (ltk->type) {
7114 case SMP_LTK:
7115 case SMP_LTK_SLAVE:
7116 if (ltk->authenticated)
7117 return MGMT_LTK_AUTHENTICATED;
7118 return MGMT_LTK_UNAUTHENTICATED;
7119 case SMP_LTK_P256:
7120 if (ltk->authenticated)
7121 return MGMT_LTK_P256_AUTH;
7122 return MGMT_LTK_P256_UNAUTH;
7123 case SMP_LTK_P256_DEBUG:
7124 return MGMT_LTK_P256_DEBUG;
7125 }
7126
7127 return MGMT_LTK_UNAUTHENTICATED;
7128 }
7129
mgmt_new_ltk(struct hci_dev * hdev,struct smp_ltk * key,bool persistent)7130 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7131 {
7132 struct mgmt_ev_new_long_term_key ev;
7133
7134 memset(&ev, 0, sizeof(ev));
7135
7136 /* Devices using resolvable or non-resolvable random addresses
7137 * without providing an identity resolving key don't require
7138 * to store long term keys. Their addresses will change the
7139 * next time around.
7140 *
7141 * Only when a remote device provides an identity address
7142 * make sure the long term key is stored. If the remote
7143 * identity is known, the long term keys are internally
7144 * mapped to the identity address. So allow static random
7145 * and public addresses here.
7146 */
7147 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7148 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7149 ev.store_hint = 0x00;
7150 else
7151 ev.store_hint = persistent;
7152
7153 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7154 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7155 ev.key.type = mgmt_ltk_type(key);
7156 ev.key.enc_size = key->enc_size;
7157 ev.key.ediv = key->ediv;
7158 ev.key.rand = key->rand;
7159
7160 if (key->type == SMP_LTK)
7161 ev.key.master = 1;
7162
7163 /* Make sure we copy only the significant bytes based on the
7164 * encryption key size, and set the rest of the value to zeroes.
7165 */
7166 memcpy(ev.key.val, key->val, key->enc_size);
7167 memset(ev.key.val + key->enc_size, 0,
7168 sizeof(ev.key.val) - key->enc_size);
7169
7170 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7171 }
7172
mgmt_new_irk(struct hci_dev * hdev,struct smp_irk * irk,bool persistent)7173 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7174 {
7175 struct mgmt_ev_new_irk ev;
7176
7177 memset(&ev, 0, sizeof(ev));
7178
7179 ev.store_hint = persistent;
7180
7181 bacpy(&ev.rpa, &irk->rpa);
7182 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7183 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7184 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7185
7186 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7187 }
7188
mgmt_new_csrk(struct hci_dev * hdev,struct smp_csrk * csrk,bool persistent)7189 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7190 bool persistent)
7191 {
7192 struct mgmt_ev_new_csrk ev;
7193
7194 memset(&ev, 0, sizeof(ev));
7195
7196 /* Devices using resolvable or non-resolvable random addresses
7197 * without providing an identity resolving key don't require
7198 * to store signature resolving keys. Their addresses will change
7199 * the next time around.
7200 *
7201 * Only when a remote device provides an identity address
7202 * make sure the signature resolving key is stored. So allow
7203 * static random and public addresses here.
7204 */
7205 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7206 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7207 ev.store_hint = 0x00;
7208 else
7209 ev.store_hint = persistent;
7210
7211 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7212 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7213 ev.key.type = csrk->type;
7214 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7215
7216 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7217 }
7218
mgmt_new_conn_param(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 store_hint,u16 min_interval,u16 max_interval,u16 latency,u16 timeout)7219 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7220 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7221 u16 max_interval, u16 latency, u16 timeout)
7222 {
7223 struct mgmt_ev_new_conn_param ev;
7224
7225 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7226 return;
7227
7228 memset(&ev, 0, sizeof(ev));
7229 bacpy(&ev.addr.bdaddr, bdaddr);
7230 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7231 ev.store_hint = store_hint;
7232 ev.min_interval = cpu_to_le16(min_interval);
7233 ev.max_interval = cpu_to_le16(max_interval);
7234 ev.latency = cpu_to_le16(latency);
7235 ev.timeout = cpu_to_le16(timeout);
7236
7237 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7238 }
7239
mgmt_device_connected(struct hci_dev * hdev,struct hci_conn * conn,u32 flags,u8 * name,u8 name_len)7240 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7241 u32 flags, u8 *name, u8 name_len)
7242 {
7243 char buf[512];
7244 struct mgmt_ev_device_connected *ev = (void *) buf;
7245 u16 eir_len = 0;
7246
7247 bacpy(&ev->addr.bdaddr, &conn->dst);
7248 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7249
7250 ev->flags = __cpu_to_le32(flags);
7251
7252 /* We must ensure that the EIR Data fields are ordered and
7253 * unique. Keep it simple for now and avoid the problem by not
7254 * adding any BR/EDR data to the LE adv.
7255 */
7256 if (conn->le_adv_data_len > 0) {
7257 memcpy(&ev->eir[eir_len],
7258 conn->le_adv_data, conn->le_adv_data_len);
7259 eir_len = conn->le_adv_data_len;
7260 } else {
7261 if (name_len > 0)
7262 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7263 name, name_len);
7264
7265 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7266 eir_len = eir_append_data(ev->eir, eir_len,
7267 EIR_CLASS_OF_DEV,
7268 conn->dev_class, 3);
7269 }
7270
7271 ev->eir_len = cpu_to_le16(eir_len);
7272
7273 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7274 sizeof(*ev) + eir_len, NULL);
7275 }
7276
disconnect_rsp(struct mgmt_pending_cmd * cmd,void * data)7277 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7278 {
7279 struct sock **sk = data;
7280
7281 cmd->cmd_complete(cmd, 0);
7282
7283 *sk = cmd->sk;
7284 sock_hold(*sk);
7285
7286 mgmt_pending_remove(cmd);
7287 }
7288
unpair_device_rsp(struct mgmt_pending_cmd * cmd,void * data)7289 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7290 {
7291 struct hci_dev *hdev = data;
7292 struct mgmt_cp_unpair_device *cp = cmd->param;
7293
7294 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7295
7296 cmd->cmd_complete(cmd, 0);
7297 mgmt_pending_remove(cmd);
7298 }
7299
mgmt_powering_down(struct hci_dev * hdev)7300 bool mgmt_powering_down(struct hci_dev *hdev)
7301 {
7302 struct mgmt_pending_cmd *cmd;
7303 struct mgmt_mode *cp;
7304
7305 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7306 if (!cmd)
7307 return false;
7308
7309 cp = cmd->param;
7310 if (!cp->val)
7311 return true;
7312
7313 return false;
7314 }
7315
mgmt_device_disconnected(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 reason,bool mgmt_connected)7316 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7317 u8 link_type, u8 addr_type, u8 reason,
7318 bool mgmt_connected)
7319 {
7320 struct mgmt_ev_device_disconnected ev;
7321 struct sock *sk = NULL;
7322
7323 /* The connection is still in hci_conn_hash so test for 1
7324 * instead of 0 to know if this is the last one.
7325 */
7326 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7327 cancel_delayed_work(&hdev->power_off);
7328 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7329 }
7330
7331 if (!mgmt_connected)
7332 return;
7333
7334 if (link_type != ACL_LINK && link_type != LE_LINK)
7335 return;
7336
7337 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7338
7339 bacpy(&ev.addr.bdaddr, bdaddr);
7340 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7341 ev.reason = reason;
7342
7343 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7344
7345 if (sk)
7346 sock_put(sk);
7347
7348 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7349 hdev);
7350 }
7351
mgmt_disconnect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7352 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7353 u8 link_type, u8 addr_type, u8 status)
7354 {
7355 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7356 struct mgmt_cp_disconnect *cp;
7357 struct mgmt_pending_cmd *cmd;
7358
7359 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7360 hdev);
7361
7362 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7363 if (!cmd)
7364 return;
7365
7366 cp = cmd->param;
7367
7368 if (bacmp(bdaddr, &cp->addr.bdaddr))
7369 return;
7370
7371 if (cp->addr.type != bdaddr_type)
7372 return;
7373
7374 cmd->cmd_complete(cmd, mgmt_status(status));
7375 mgmt_pending_remove(cmd);
7376 }
7377
mgmt_connect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7378 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7379 u8 addr_type, u8 status)
7380 {
7381 struct mgmt_ev_connect_failed ev;
7382
7383 /* The connection is still in hci_conn_hash so test for 1
7384 * instead of 0 to know if this is the last one.
7385 */
7386 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7387 cancel_delayed_work(&hdev->power_off);
7388 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7389 }
7390
7391 bacpy(&ev.addr.bdaddr, bdaddr);
7392 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7393 ev.status = mgmt_status(status);
7394
7395 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7396 }
7397
mgmt_pin_code_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 secure)7398 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7399 {
7400 struct mgmt_ev_pin_code_request ev;
7401
7402 bacpy(&ev.addr.bdaddr, bdaddr);
7403 ev.addr.type = BDADDR_BREDR;
7404 ev.secure = secure;
7405
7406 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7407 }
7408
mgmt_pin_code_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)7409 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7410 u8 status)
7411 {
7412 struct mgmt_pending_cmd *cmd;
7413
7414 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7415 if (!cmd)
7416 return;
7417
7418 cmd->cmd_complete(cmd, mgmt_status(status));
7419 mgmt_pending_remove(cmd);
7420 }
7421
mgmt_pin_code_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)7422 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7423 u8 status)
7424 {
7425 struct mgmt_pending_cmd *cmd;
7426
7427 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7428 if (!cmd)
7429 return;
7430
7431 cmd->cmd_complete(cmd, mgmt_status(status));
7432 mgmt_pending_remove(cmd);
7433 }
7434
mgmt_user_confirm_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 value,u8 confirm_hint)7435 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7436 u8 link_type, u8 addr_type, u32 value,
7437 u8 confirm_hint)
7438 {
7439 struct mgmt_ev_user_confirm_request ev;
7440
7441 BT_DBG("%s", hdev->name);
7442
7443 bacpy(&ev.addr.bdaddr, bdaddr);
7444 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7445 ev.confirm_hint = confirm_hint;
7446 ev.value = cpu_to_le32(value);
7447
7448 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7449 NULL);
7450 }
7451
mgmt_user_passkey_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type)7452 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7453 u8 link_type, u8 addr_type)
7454 {
7455 struct mgmt_ev_user_passkey_request ev;
7456
7457 BT_DBG("%s", hdev->name);
7458
7459 bacpy(&ev.addr.bdaddr, bdaddr);
7460 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7461
7462 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7463 NULL);
7464 }
7465
user_pairing_resp_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status,u8 opcode)7466 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7467 u8 link_type, u8 addr_type, u8 status,
7468 u8 opcode)
7469 {
7470 struct mgmt_pending_cmd *cmd;
7471
7472 cmd = pending_find(opcode, hdev);
7473 if (!cmd)
7474 return -ENOENT;
7475
7476 cmd->cmd_complete(cmd, mgmt_status(status));
7477 mgmt_pending_remove(cmd);
7478
7479 return 0;
7480 }
7481
mgmt_user_confirm_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7482 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7483 u8 link_type, u8 addr_type, u8 status)
7484 {
7485 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7486 status, MGMT_OP_USER_CONFIRM_REPLY);
7487 }
7488
mgmt_user_confirm_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7489 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7490 u8 link_type, u8 addr_type, u8 status)
7491 {
7492 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7493 status,
7494 MGMT_OP_USER_CONFIRM_NEG_REPLY);
7495 }
7496
mgmt_user_passkey_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7497 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7498 u8 link_type, u8 addr_type, u8 status)
7499 {
7500 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7501 status, MGMT_OP_USER_PASSKEY_REPLY);
7502 }
7503
mgmt_user_passkey_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7504 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7505 u8 link_type, u8 addr_type, u8 status)
7506 {
7507 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7508 status,
7509 MGMT_OP_USER_PASSKEY_NEG_REPLY);
7510 }
7511
mgmt_user_passkey_notify(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 passkey,u8 entered)7512 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7513 u8 link_type, u8 addr_type, u32 passkey,
7514 u8 entered)
7515 {
7516 struct mgmt_ev_passkey_notify ev;
7517
7518 BT_DBG("%s", hdev->name);
7519
7520 bacpy(&ev.addr.bdaddr, bdaddr);
7521 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7522 ev.passkey = __cpu_to_le32(passkey);
7523 ev.entered = entered;
7524
7525 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7526 }
7527
mgmt_auth_failed(struct hci_conn * conn,u8 hci_status)7528 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7529 {
7530 struct mgmt_ev_auth_failed ev;
7531 struct mgmt_pending_cmd *cmd;
7532 u8 status = mgmt_status(hci_status);
7533
7534 bacpy(&ev.addr.bdaddr, &conn->dst);
7535 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7536 ev.status = status;
7537
7538 cmd = find_pairing(conn);
7539
7540 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7541 cmd ? cmd->sk : NULL);
7542
7543 if (cmd) {
7544 cmd->cmd_complete(cmd, status);
7545 mgmt_pending_remove(cmd);
7546 }
7547 }
7548
mgmt_auth_enable_complete(struct hci_dev * hdev,u8 status)7549 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7550 {
7551 struct cmd_lookup match = { NULL, hdev };
7552 bool changed;
7553
7554 if (status) {
7555 u8 mgmt_err = mgmt_status(status);
7556 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7557 cmd_status_rsp, &mgmt_err);
7558 return;
7559 }
7560
7561 if (test_bit(HCI_AUTH, &hdev->flags))
7562 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7563 else
7564 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7565
7566 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7567 &match);
7568
7569 if (changed)
7570 new_settings(hdev, match.sk);
7571
7572 if (match.sk)
7573 sock_put(match.sk);
7574 }
7575
clear_eir(struct hci_request * req)7576 static void clear_eir(struct hci_request *req)
7577 {
7578 struct hci_dev *hdev = req->hdev;
7579 struct hci_cp_write_eir cp;
7580
7581 if (!lmp_ext_inq_capable(hdev))
7582 return;
7583
7584 memset(hdev->eir, 0, sizeof(hdev->eir));
7585
7586 memset(&cp, 0, sizeof(cp));
7587
7588 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7589 }
7590
mgmt_ssp_enable_complete(struct hci_dev * hdev,u8 enable,u8 status)7591 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7592 {
7593 struct cmd_lookup match = { NULL, hdev };
7594 struct hci_request req;
7595 bool changed = false;
7596
7597 if (status) {
7598 u8 mgmt_err = mgmt_status(status);
7599
7600 if (enable && hci_dev_test_and_clear_flag(hdev,
7601 HCI_SSP_ENABLED)) {
7602 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7603 new_settings(hdev, NULL);
7604 }
7605
7606 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7607 &mgmt_err);
7608 return;
7609 }
7610
7611 if (enable) {
7612 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7613 } else {
7614 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7615 if (!changed)
7616 changed = hci_dev_test_and_clear_flag(hdev,
7617 HCI_HS_ENABLED);
7618 else
7619 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7620 }
7621
7622 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7623
7624 if (changed)
7625 new_settings(hdev, match.sk);
7626
7627 if (match.sk)
7628 sock_put(match.sk);
7629
7630 hci_req_init(&req, hdev);
7631
7632 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7633 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7634 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7635 sizeof(enable), &enable);
7636 __hci_req_update_eir(&req);
7637 } else {
7638 clear_eir(&req);
7639 }
7640
7641 hci_req_run(&req, NULL);
7642 }
7643
sk_lookup(struct mgmt_pending_cmd * cmd,void * data)7644 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7645 {
7646 struct cmd_lookup *match = data;
7647
7648 if (match->sk == NULL) {
7649 match->sk = cmd->sk;
7650 sock_hold(match->sk);
7651 }
7652 }
7653
mgmt_set_class_of_dev_complete(struct hci_dev * hdev,u8 * dev_class,u8 status)7654 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7655 u8 status)
7656 {
7657 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7658
7659 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7660 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7661 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7662
7663 if (!status) {
7664 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7665 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7666 ext_info_changed(hdev, NULL);
7667 }
7668
7669 if (match.sk)
7670 sock_put(match.sk);
7671 }
7672
mgmt_set_local_name_complete(struct hci_dev * hdev,u8 * name,u8 status)7673 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7674 {
7675 struct mgmt_cp_set_local_name ev;
7676 struct mgmt_pending_cmd *cmd;
7677
7678 if (status)
7679 return;
7680
7681 memset(&ev, 0, sizeof(ev));
7682 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7683 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7684
7685 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7686 if (!cmd) {
7687 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7688
7689 /* If this is a HCI command related to powering on the
7690 * HCI dev don't send any mgmt signals.
7691 */
7692 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7693 return;
7694 }
7695
7696 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7697 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7698 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7699 }
7700
has_uuid(u8 * uuid,u16 uuid_count,u8 (* uuids)[16])7701 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7702 {
7703 int i;
7704
7705 for (i = 0; i < uuid_count; i++) {
7706 if (!memcmp(uuid, uuids[i], 16))
7707 return true;
7708 }
7709
7710 return false;
7711 }
7712
eir_has_uuids(u8 * eir,u16 eir_len,u16 uuid_count,u8 (* uuids)[16])7713 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7714 {
7715 u16 parsed = 0;
7716
7717 while (parsed < eir_len) {
7718 u8 field_len = eir[0];
7719 u8 uuid[16];
7720 int i;
7721
7722 if (field_len == 0)
7723 break;
7724
7725 if (eir_len - parsed < field_len + 1)
7726 break;
7727
7728 switch (eir[1]) {
7729 case EIR_UUID16_ALL:
7730 case EIR_UUID16_SOME:
7731 for (i = 0; i + 3 <= field_len; i += 2) {
7732 memcpy(uuid, bluetooth_base_uuid, 16);
7733 uuid[13] = eir[i + 3];
7734 uuid[12] = eir[i + 2];
7735 if (has_uuid(uuid, uuid_count, uuids))
7736 return true;
7737 }
7738 break;
7739 case EIR_UUID32_ALL:
7740 case EIR_UUID32_SOME:
7741 for (i = 0; i + 5 <= field_len; i += 4) {
7742 memcpy(uuid, bluetooth_base_uuid, 16);
7743 uuid[15] = eir[i + 5];
7744 uuid[14] = eir[i + 4];
7745 uuid[13] = eir[i + 3];
7746 uuid[12] = eir[i + 2];
7747 if (has_uuid(uuid, uuid_count, uuids))
7748 return true;
7749 }
7750 break;
7751 case EIR_UUID128_ALL:
7752 case EIR_UUID128_SOME:
7753 for (i = 0; i + 17 <= field_len; i += 16) {
7754 memcpy(uuid, eir + i + 2, 16);
7755 if (has_uuid(uuid, uuid_count, uuids))
7756 return true;
7757 }
7758 break;
7759 }
7760
7761 parsed += field_len + 1;
7762 eir += field_len + 1;
7763 }
7764
7765 return false;
7766 }
7767
restart_le_scan(struct hci_dev * hdev)7768 static void restart_le_scan(struct hci_dev *hdev)
7769 {
7770 /* If controller is not scanning we are done. */
7771 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7772 return;
7773
7774 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7775 hdev->discovery.scan_start +
7776 hdev->discovery.scan_duration))
7777 return;
7778
7779 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7780 DISCOV_LE_RESTART_DELAY);
7781 }
7782
is_filter_match(struct hci_dev * hdev,s8 rssi,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)7783 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7784 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7785 {
7786 /* If a RSSI threshold has been specified, and
7787 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7788 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7789 * is set, let it through for further processing, as we might need to
7790 * restart the scan.
7791 *
7792 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7793 * the results are also dropped.
7794 */
7795 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7796 (rssi == HCI_RSSI_INVALID ||
7797 (rssi < hdev->discovery.rssi &&
7798 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7799 return false;
7800
7801 if (hdev->discovery.uuid_count != 0) {
7802 /* If a list of UUIDs is provided in filter, results with no
7803 * matching UUID should be dropped.
7804 */
7805 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7806 hdev->discovery.uuids) &&
7807 !eir_has_uuids(scan_rsp, scan_rsp_len,
7808 hdev->discovery.uuid_count,
7809 hdev->discovery.uuids))
7810 return false;
7811 }
7812
7813 /* If duplicate filtering does not report RSSI changes, then restart
7814 * scanning to ensure updated result with updated RSSI values.
7815 */
7816 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7817 restart_le_scan(hdev);
7818
7819 /* Validate RSSI value against the RSSI threshold once more. */
7820 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7821 rssi < hdev->discovery.rssi)
7822 return false;
7823 }
7824
7825 return true;
7826 }
7827
mgmt_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 * dev_class,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)7828 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7829 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7830 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7831 {
7832 char buf[512];
7833 struct mgmt_ev_device_found *ev = (void *)buf;
7834 size_t ev_size;
7835
7836 /* Don't send events for a non-kernel initiated discovery. With
7837 * LE one exception is if we have pend_le_reports > 0 in which
7838 * case we're doing passive scanning and want these events.
7839 */
7840 if (!hci_discovery_active(hdev)) {
7841 if (link_type == ACL_LINK)
7842 return;
7843 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7844 return;
7845 }
7846
7847 if (hdev->discovery.result_filtering) {
7848 /* We are using service discovery */
7849 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7850 scan_rsp_len))
7851 return;
7852 }
7853
7854 if (hdev->discovery.limited) {
7855 /* Check for limited discoverable bit */
7856 if (dev_class) {
7857 if (!(dev_class[1] & 0x20))
7858 return;
7859 } else {
7860 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7861 if (!flags || !(flags[0] & LE_AD_LIMITED))
7862 return;
7863 }
7864 }
7865
7866 /* Make sure that the buffer is big enough. The 5 extra bytes
7867 * are for the potential CoD field.
7868 */
7869 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7870 return;
7871
7872 memset(buf, 0, sizeof(buf));
7873
7874 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7875 * RSSI value was reported as 0 when not available. This behavior
7876 * is kept when using device discovery. This is required for full
7877 * backwards compatibility with the API.
7878 *
7879 * However when using service discovery, the value 127 will be
7880 * returned when the RSSI is not available.
7881 */
7882 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7883 link_type == ACL_LINK)
7884 rssi = 0;
7885
7886 bacpy(&ev->addr.bdaddr, bdaddr);
7887 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7888 ev->rssi = rssi;
7889 ev->flags = cpu_to_le32(flags);
7890
7891 if (eir_len > 0)
7892 /* Copy EIR or advertising data into event */
7893 memcpy(ev->eir, eir, eir_len);
7894
7895 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7896 NULL))
7897 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7898 dev_class, 3);
7899
7900 if (scan_rsp_len > 0)
7901 /* Append scan response data to event */
7902 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7903
7904 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7905 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7906
7907 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7908 }
7909
mgmt_remote_name(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,s8 rssi,u8 * name,u8 name_len)7910 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7911 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7912 {
7913 struct mgmt_ev_device_found *ev;
7914 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7915 u16 eir_len;
7916
7917 ev = (struct mgmt_ev_device_found *) buf;
7918
7919 memset(buf, 0, sizeof(buf));
7920
7921 bacpy(&ev->addr.bdaddr, bdaddr);
7922 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7923 ev->rssi = rssi;
7924
7925 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7926 name_len);
7927
7928 ev->eir_len = cpu_to_le16(eir_len);
7929
7930 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7931 }
7932
mgmt_discovering(struct hci_dev * hdev,u8 discovering)7933 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7934 {
7935 struct mgmt_ev_discovering ev;
7936
7937 BT_DBG("%s discovering %u", hdev->name, discovering);
7938
7939 memset(&ev, 0, sizeof(ev));
7940 ev.type = hdev->discovery.type;
7941 ev.discovering = discovering;
7942
7943 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7944 }
7945
7946 static struct hci_mgmt_chan chan = {
7947 .channel = HCI_CHANNEL_CONTROL,
7948 .handler_count = ARRAY_SIZE(mgmt_handlers),
7949 .handlers = mgmt_handlers,
7950 .hdev_init = mgmt_init_hdev,
7951 };
7952
mgmt_init(void)7953 int mgmt_init(void)
7954 {
7955 return hci_mgmt_chan_register(&chan);
7956 }
7957
mgmt_exit(void)7958 void mgmt_exit(void)
7959 {
7960 hci_mgmt_chan_unregister(&chan);
7961 }
7962
