1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 14
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 };
110
111 static const u16 mgmt_events[] = {
112 MGMT_EV_CONTROLLER_ERROR,
113 MGMT_EV_INDEX_ADDED,
114 MGMT_EV_INDEX_REMOVED,
115 MGMT_EV_NEW_SETTINGS,
116 MGMT_EV_CLASS_OF_DEV_CHANGED,
117 MGMT_EV_LOCAL_NAME_CHANGED,
118 MGMT_EV_NEW_LINK_KEY,
119 MGMT_EV_NEW_LONG_TERM_KEY,
120 MGMT_EV_DEVICE_CONNECTED,
121 MGMT_EV_DEVICE_DISCONNECTED,
122 MGMT_EV_CONNECT_FAILED,
123 MGMT_EV_PIN_CODE_REQUEST,
124 MGMT_EV_USER_CONFIRM_REQUEST,
125 MGMT_EV_USER_PASSKEY_REQUEST,
126 MGMT_EV_AUTH_FAILED,
127 MGMT_EV_DEVICE_FOUND,
128 MGMT_EV_DISCOVERING,
129 MGMT_EV_DEVICE_BLOCKED,
130 MGMT_EV_DEVICE_UNBLOCKED,
131 MGMT_EV_DEVICE_UNPAIRED,
132 MGMT_EV_PASSKEY_NOTIFY,
133 MGMT_EV_NEW_IRK,
134 MGMT_EV_NEW_CSRK,
135 MGMT_EV_DEVICE_ADDED,
136 MGMT_EV_DEVICE_REMOVED,
137 MGMT_EV_NEW_CONN_PARAM,
138 MGMT_EV_UNCONF_INDEX_ADDED,
139 MGMT_EV_UNCONF_INDEX_REMOVED,
140 MGMT_EV_NEW_CONFIG_OPTIONS,
141 MGMT_EV_EXT_INDEX_ADDED,
142 MGMT_EV_EXT_INDEX_REMOVED,
143 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
144 MGMT_EV_ADVERTISING_ADDED,
145 MGMT_EV_ADVERTISING_REMOVED,
146 MGMT_EV_EXT_INFO_CHANGED,
147 };
148
149 static const u16 mgmt_untrusted_commands[] = {
150 MGMT_OP_READ_INDEX_LIST,
151 MGMT_OP_READ_INFO,
152 MGMT_OP_READ_UNCONF_INDEX_LIST,
153 MGMT_OP_READ_CONFIG_INFO,
154 MGMT_OP_READ_EXT_INDEX_LIST,
155 MGMT_OP_READ_EXT_INFO,
156 };
157
158 static const u16 mgmt_untrusted_events[] = {
159 MGMT_EV_INDEX_ADDED,
160 MGMT_EV_INDEX_REMOVED,
161 MGMT_EV_NEW_SETTINGS,
162 MGMT_EV_CLASS_OF_DEV_CHANGED,
163 MGMT_EV_LOCAL_NAME_CHANGED,
164 MGMT_EV_UNCONF_INDEX_ADDED,
165 MGMT_EV_UNCONF_INDEX_REMOVED,
166 MGMT_EV_NEW_CONFIG_OPTIONS,
167 MGMT_EV_EXT_INDEX_ADDED,
168 MGMT_EV_EXT_INDEX_REMOVED,
169 MGMT_EV_EXT_INFO_CHANGED,
170 };
171
172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
173
174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
175 "\x00\x00\x00\x00\x00\x00\x00\x00"
176
177 /* HCI to MGMT error code conversion table */
178 static u8 mgmt_status_table[] = {
179 MGMT_STATUS_SUCCESS,
180 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
181 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
182 MGMT_STATUS_FAILED, /* Hardware Failure */
183 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
184 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
185 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
186 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
187 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
188 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
189 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
190 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
191 MGMT_STATUS_BUSY, /* Command Disallowed */
192 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
193 MGMT_STATUS_REJECTED, /* Rejected Security */
194 MGMT_STATUS_REJECTED, /* Rejected Personal */
195 MGMT_STATUS_TIMEOUT, /* Host Timeout */
196 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
197 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
198 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
199 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
200 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
201 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
202 MGMT_STATUS_BUSY, /* Repeated Attempts */
203 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
204 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
205 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
206 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
207 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
208 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
209 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
210 MGMT_STATUS_FAILED, /* Unspecified Error */
211 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
212 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
213 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
214 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
215 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
216 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
217 MGMT_STATUS_FAILED, /* Unit Link Key Used */
218 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
219 MGMT_STATUS_TIMEOUT, /* Instant Passed */
220 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
221 MGMT_STATUS_FAILED, /* Transaction Collision */
222 MGMT_STATUS_FAILED, /* Reserved for future use */
223 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
224 MGMT_STATUS_REJECTED, /* QoS Rejected */
225 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
226 MGMT_STATUS_REJECTED, /* Insufficient Security */
227 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
228 MGMT_STATUS_FAILED, /* Reserved for future use */
229 MGMT_STATUS_BUSY, /* Role Switch Pending */
230 MGMT_STATUS_FAILED, /* Reserved for future use */
231 MGMT_STATUS_FAILED, /* Slot Violation */
232 MGMT_STATUS_FAILED, /* Role Switch Failed */
233 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
234 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
235 MGMT_STATUS_BUSY, /* Host Busy Pairing */
236 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
237 MGMT_STATUS_BUSY, /* Controller Busy */
238 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
239 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
240 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
241 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
242 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
243 };
244
mgmt_status(u8 hci_status)245 static u8 mgmt_status(u8 hci_status)
246 {
247 if (hci_status < ARRAY_SIZE(mgmt_status_table))
248 return mgmt_status_table[hci_status];
249
250 return MGMT_STATUS_FAILED;
251 }
252
mgmt_index_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag)253 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
254 u16 len, int flag)
255 {
256 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
257 flag, NULL);
258 }
259
mgmt_limited_event(u16 event,struct hci_dev * hdev,void * data,u16 len,int flag,struct sock * skip_sk)260 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
261 u16 len, int flag, struct sock *skip_sk)
262 {
263 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
264 flag, skip_sk);
265 }
266
mgmt_event(u16 event,struct hci_dev * hdev,void * data,u16 len,struct sock * skip_sk)267 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
268 struct sock *skip_sk)
269 {
270 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
271 HCI_SOCK_TRUSTED, skip_sk);
272 }
273
le_addr_type(u8 mgmt_addr_type)274 static u8 le_addr_type(u8 mgmt_addr_type)
275 {
276 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
277 return ADDR_LE_DEV_PUBLIC;
278 else
279 return ADDR_LE_DEV_RANDOM;
280 }
281
mgmt_fill_version_info(void * ver)282 void mgmt_fill_version_info(void *ver)
283 {
284 struct mgmt_rp_read_version *rp = ver;
285
286 rp->version = MGMT_VERSION;
287 rp->revision = cpu_to_le16(MGMT_REVISION);
288 }
289
read_version(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)290 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
291 u16 data_len)
292 {
293 struct mgmt_rp_read_version rp;
294
295 BT_DBG("sock %p", sk);
296
297 mgmt_fill_version_info(&rp);
298
299 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
300 &rp, sizeof(rp));
301 }
302
read_commands(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)303 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
304 u16 data_len)
305 {
306 struct mgmt_rp_read_commands *rp;
307 u16 num_commands, num_events;
308 size_t rp_size;
309 int i, err;
310
311 BT_DBG("sock %p", sk);
312
313 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
314 num_commands = ARRAY_SIZE(mgmt_commands);
315 num_events = ARRAY_SIZE(mgmt_events);
316 } else {
317 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
318 num_events = ARRAY_SIZE(mgmt_untrusted_events);
319 }
320
321 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
322
323 rp = kmalloc(rp_size, GFP_KERNEL);
324 if (!rp)
325 return -ENOMEM;
326
327 rp->num_commands = cpu_to_le16(num_commands);
328 rp->num_events = cpu_to_le16(num_events);
329
330 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
331 __le16 *opcode = rp->opcodes;
332
333 for (i = 0; i < num_commands; i++, opcode++)
334 put_unaligned_le16(mgmt_commands[i], opcode);
335
336 for (i = 0; i < num_events; i++, opcode++)
337 put_unaligned_le16(mgmt_events[i], opcode);
338 } else {
339 __le16 *opcode = rp->opcodes;
340
341 for (i = 0; i < num_commands; i++, opcode++)
342 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
343
344 for (i = 0; i < num_events; i++, opcode++)
345 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
346 }
347
348 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
349 rp, rp_size);
350 kfree(rp);
351
352 return err;
353 }
354
read_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)355 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
356 u16 data_len)
357 {
358 struct mgmt_rp_read_index_list *rp;
359 struct hci_dev *d;
360 size_t rp_len;
361 u16 count;
362 int err;
363
364 BT_DBG("sock %p", sk);
365
366 read_lock(&hci_dev_list_lock);
367
368 count = 0;
369 list_for_each_entry(d, &hci_dev_list, list) {
370 if (d->dev_type == HCI_PRIMARY &&
371 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
372 count++;
373 }
374
375 rp_len = sizeof(*rp) + (2 * count);
376 rp = kmalloc(rp_len, GFP_ATOMIC);
377 if (!rp) {
378 read_unlock(&hci_dev_list_lock);
379 return -ENOMEM;
380 }
381
382 count = 0;
383 list_for_each_entry(d, &hci_dev_list, list) {
384 if (hci_dev_test_flag(d, HCI_SETUP) ||
385 hci_dev_test_flag(d, HCI_CONFIG) ||
386 hci_dev_test_flag(d, HCI_USER_CHANNEL))
387 continue;
388
389 /* Devices marked as raw-only are neither configured
390 * nor unconfigured controllers.
391 */
392 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
393 continue;
394
395 if (d->dev_type == HCI_PRIMARY &&
396 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
397 rp->index[count++] = cpu_to_le16(d->id);
398 BT_DBG("Added hci%u", d->id);
399 }
400 }
401
402 rp->num_controllers = cpu_to_le16(count);
403 rp_len = sizeof(*rp) + (2 * count);
404
405 read_unlock(&hci_dev_list_lock);
406
407 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
408 0, rp, rp_len);
409
410 kfree(rp);
411
412 return err;
413 }
414
read_unconf_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)415 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
416 void *data, u16 data_len)
417 {
418 struct mgmt_rp_read_unconf_index_list *rp;
419 struct hci_dev *d;
420 size_t rp_len;
421 u16 count;
422 int err;
423
424 BT_DBG("sock %p", sk);
425
426 read_lock(&hci_dev_list_lock);
427
428 count = 0;
429 list_for_each_entry(d, &hci_dev_list, list) {
430 if (d->dev_type == HCI_PRIMARY &&
431 hci_dev_test_flag(d, HCI_UNCONFIGURED))
432 count++;
433 }
434
435 rp_len = sizeof(*rp) + (2 * count);
436 rp = kmalloc(rp_len, GFP_ATOMIC);
437 if (!rp) {
438 read_unlock(&hci_dev_list_lock);
439 return -ENOMEM;
440 }
441
442 count = 0;
443 list_for_each_entry(d, &hci_dev_list, list) {
444 if (hci_dev_test_flag(d, HCI_SETUP) ||
445 hci_dev_test_flag(d, HCI_CONFIG) ||
446 hci_dev_test_flag(d, HCI_USER_CHANNEL))
447 continue;
448
449 /* Devices marked as raw-only are neither configured
450 * nor unconfigured controllers.
451 */
452 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
453 continue;
454
455 if (d->dev_type == HCI_PRIMARY &&
456 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
457 rp->index[count++] = cpu_to_le16(d->id);
458 BT_DBG("Added hci%u", d->id);
459 }
460 }
461
462 rp->num_controllers = cpu_to_le16(count);
463 rp_len = sizeof(*rp) + (2 * count);
464
465 read_unlock(&hci_dev_list_lock);
466
467 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
468 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
469
470 kfree(rp);
471
472 return err;
473 }
474
read_ext_index_list(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)475 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
476 void *data, u16 data_len)
477 {
478 struct mgmt_rp_read_ext_index_list *rp;
479 struct hci_dev *d;
480 u16 count;
481 int err;
482
483 BT_DBG("sock %p", sk);
484
485 read_lock(&hci_dev_list_lock);
486
487 count = 0;
488 list_for_each_entry(d, &hci_dev_list, list) {
489 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
490 count++;
491 }
492
493 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
494 if (!rp) {
495 read_unlock(&hci_dev_list_lock);
496 return -ENOMEM;
497 }
498
499 count = 0;
500 list_for_each_entry(d, &hci_dev_list, list) {
501 if (hci_dev_test_flag(d, HCI_SETUP) ||
502 hci_dev_test_flag(d, HCI_CONFIG) ||
503 hci_dev_test_flag(d, HCI_USER_CHANNEL))
504 continue;
505
506 /* Devices marked as raw-only are neither configured
507 * nor unconfigured controllers.
508 */
509 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
510 continue;
511
512 if (d->dev_type == HCI_PRIMARY) {
513 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
514 rp->entry[count].type = 0x01;
515 else
516 rp->entry[count].type = 0x00;
517 } else if (d->dev_type == HCI_AMP) {
518 rp->entry[count].type = 0x02;
519 } else {
520 continue;
521 }
522
523 rp->entry[count].bus = d->bus;
524 rp->entry[count++].index = cpu_to_le16(d->id);
525 BT_DBG("Added hci%u", d->id);
526 }
527
528 rp->num_controllers = cpu_to_le16(count);
529
530 read_unlock(&hci_dev_list_lock);
531
532 /* If this command is called at least once, then all the
533 * default index and unconfigured index events are disabled
534 * and from now on only extended index events are used.
535 */
536 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
537 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
538 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
539
540 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
541 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
542 struct_size(rp, entry, count));
543
544 kfree(rp);
545
546 return err;
547 }
548
is_configured(struct hci_dev * hdev)549 static bool is_configured(struct hci_dev *hdev)
550 {
551 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
552 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
553 return false;
554
555 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
556 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
557 !bacmp(&hdev->public_addr, BDADDR_ANY))
558 return false;
559
560 return true;
561 }
562
get_missing_options(struct hci_dev * hdev)563 static __le32 get_missing_options(struct hci_dev *hdev)
564 {
565 u32 options = 0;
566
567 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
568 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
569 options |= MGMT_OPTION_EXTERNAL_CONFIG;
570
571 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
572 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
573 !bacmp(&hdev->public_addr, BDADDR_ANY))
574 options |= MGMT_OPTION_PUBLIC_ADDRESS;
575
576 return cpu_to_le32(options);
577 }
578
new_options(struct hci_dev * hdev,struct sock * skip)579 static int new_options(struct hci_dev *hdev, struct sock *skip)
580 {
581 __le32 options = get_missing_options(hdev);
582
583 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
584 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
585 }
586
send_options_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)587 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
588 {
589 __le32 options = get_missing_options(hdev);
590
591 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
592 sizeof(options));
593 }
594
read_config_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)595 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
596 void *data, u16 data_len)
597 {
598 struct mgmt_rp_read_config_info rp;
599 u32 options = 0;
600
601 BT_DBG("sock %p %s", sk, hdev->name);
602
603 hci_dev_lock(hdev);
604
605 memset(&rp, 0, sizeof(rp));
606 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
607
608 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
609 options |= MGMT_OPTION_EXTERNAL_CONFIG;
610
611 if (hdev->set_bdaddr)
612 options |= MGMT_OPTION_PUBLIC_ADDRESS;
613
614 rp.supported_options = cpu_to_le32(options);
615 rp.missing_options = get_missing_options(hdev);
616
617 hci_dev_unlock(hdev);
618
619 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
620 &rp, sizeof(rp));
621 }
622
get_supported_phys(struct hci_dev * hdev)623 static u32 get_supported_phys(struct hci_dev *hdev)
624 {
625 u32 supported_phys = 0;
626
627 if (lmp_bredr_capable(hdev)) {
628 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
629
630 if (hdev->features[0][0] & LMP_3SLOT)
631 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
632
633 if (hdev->features[0][0] & LMP_5SLOT)
634 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
635
636 if (lmp_edr_2m_capable(hdev)) {
637 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
638
639 if (lmp_edr_3slot_capable(hdev))
640 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
641
642 if (lmp_edr_5slot_capable(hdev))
643 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
644
645 if (lmp_edr_3m_capable(hdev)) {
646 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
647
648 if (lmp_edr_3slot_capable(hdev))
649 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
650
651 if (lmp_edr_5slot_capable(hdev))
652 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
653 }
654 }
655 }
656
657 if (lmp_le_capable(hdev)) {
658 supported_phys |= MGMT_PHY_LE_1M_TX;
659 supported_phys |= MGMT_PHY_LE_1M_RX;
660
661 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
662 supported_phys |= MGMT_PHY_LE_2M_TX;
663 supported_phys |= MGMT_PHY_LE_2M_RX;
664 }
665
666 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
667 supported_phys |= MGMT_PHY_LE_CODED_TX;
668 supported_phys |= MGMT_PHY_LE_CODED_RX;
669 }
670 }
671
672 return supported_phys;
673 }
674
get_selected_phys(struct hci_dev * hdev)675 static u32 get_selected_phys(struct hci_dev *hdev)
676 {
677 u32 selected_phys = 0;
678
679 if (lmp_bredr_capable(hdev)) {
680 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
681
682 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
683 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
684
685 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
686 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
687
688 if (lmp_edr_2m_capable(hdev)) {
689 if (!(hdev->pkt_type & HCI_2DH1))
690 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
691
692 if (lmp_edr_3slot_capable(hdev) &&
693 !(hdev->pkt_type & HCI_2DH3))
694 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
695
696 if (lmp_edr_5slot_capable(hdev) &&
697 !(hdev->pkt_type & HCI_2DH5))
698 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
699
700 if (lmp_edr_3m_capable(hdev)) {
701 if (!(hdev->pkt_type & HCI_3DH1))
702 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
703
704 if (lmp_edr_3slot_capable(hdev) &&
705 !(hdev->pkt_type & HCI_3DH3))
706 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
707
708 if (lmp_edr_5slot_capable(hdev) &&
709 !(hdev->pkt_type & HCI_3DH5))
710 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
711 }
712 }
713 }
714
715 if (lmp_le_capable(hdev)) {
716 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
717 selected_phys |= MGMT_PHY_LE_1M_TX;
718
719 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
720 selected_phys |= MGMT_PHY_LE_1M_RX;
721
722 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
723 selected_phys |= MGMT_PHY_LE_2M_TX;
724
725 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
726 selected_phys |= MGMT_PHY_LE_2M_RX;
727
728 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
729 selected_phys |= MGMT_PHY_LE_CODED_TX;
730
731 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
732 selected_phys |= MGMT_PHY_LE_CODED_RX;
733 }
734
735 return selected_phys;
736 }
737
get_configurable_phys(struct hci_dev * hdev)738 static u32 get_configurable_phys(struct hci_dev *hdev)
739 {
740 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
741 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
742 }
743
get_supported_settings(struct hci_dev * hdev)744 static u32 get_supported_settings(struct hci_dev *hdev)
745 {
746 u32 settings = 0;
747
748 settings |= MGMT_SETTING_POWERED;
749 settings |= MGMT_SETTING_BONDABLE;
750 settings |= MGMT_SETTING_DEBUG_KEYS;
751 settings |= MGMT_SETTING_CONNECTABLE;
752 settings |= MGMT_SETTING_DISCOVERABLE;
753
754 if (lmp_bredr_capable(hdev)) {
755 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
756 settings |= MGMT_SETTING_FAST_CONNECTABLE;
757 settings |= MGMT_SETTING_BREDR;
758 settings |= MGMT_SETTING_LINK_SECURITY;
759
760 if (lmp_ssp_capable(hdev)) {
761 settings |= MGMT_SETTING_SSP;
762 if (IS_ENABLED(CONFIG_BT_HS))
763 settings |= MGMT_SETTING_HS;
764 }
765
766 if (lmp_sc_capable(hdev))
767 settings |= MGMT_SETTING_SECURE_CONN;
768 }
769
770 if (lmp_le_capable(hdev)) {
771 settings |= MGMT_SETTING_LE;
772 settings |= MGMT_SETTING_ADVERTISING;
773 settings |= MGMT_SETTING_SECURE_CONN;
774 settings |= MGMT_SETTING_PRIVACY;
775 settings |= MGMT_SETTING_STATIC_ADDRESS;
776 }
777
778 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
779 hdev->set_bdaddr)
780 settings |= MGMT_SETTING_CONFIGURATION;
781
782 settings |= MGMT_SETTING_PHY_CONFIGURATION;
783
784 return settings;
785 }
786
get_current_settings(struct hci_dev * hdev)787 static u32 get_current_settings(struct hci_dev *hdev)
788 {
789 u32 settings = 0;
790
791 if (hdev_is_powered(hdev))
792 settings |= MGMT_SETTING_POWERED;
793
794 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
795 settings |= MGMT_SETTING_CONNECTABLE;
796
797 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
798 settings |= MGMT_SETTING_FAST_CONNECTABLE;
799
800 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
801 settings |= MGMT_SETTING_DISCOVERABLE;
802
803 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
804 settings |= MGMT_SETTING_BONDABLE;
805
806 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
807 settings |= MGMT_SETTING_BREDR;
808
809 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
810 settings |= MGMT_SETTING_LE;
811
812 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
813 settings |= MGMT_SETTING_LINK_SECURITY;
814
815 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
816 settings |= MGMT_SETTING_SSP;
817
818 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
819 settings |= MGMT_SETTING_HS;
820
821 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
822 settings |= MGMT_SETTING_ADVERTISING;
823
824 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
825 settings |= MGMT_SETTING_SECURE_CONN;
826
827 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
828 settings |= MGMT_SETTING_DEBUG_KEYS;
829
830 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
831 settings |= MGMT_SETTING_PRIVACY;
832
833 /* The current setting for static address has two purposes. The
834 * first is to indicate if the static address will be used and
835 * the second is to indicate if it is actually set.
836 *
837 * This means if the static address is not configured, this flag
838 * will never be set. If the address is configured, then if the
839 * address is actually used decides if the flag is set or not.
840 *
841 * For single mode LE only controllers and dual-mode controllers
842 * with BR/EDR disabled, the existence of the static address will
843 * be evaluated.
844 */
845 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
846 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
847 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
848 if (bacmp(&hdev->static_addr, BDADDR_ANY))
849 settings |= MGMT_SETTING_STATIC_ADDRESS;
850 }
851
852 return settings;
853 }
854
pending_find(u16 opcode,struct hci_dev * hdev)855 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
856 {
857 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
858 }
859
pending_find_data(u16 opcode,struct hci_dev * hdev,const void * data)860 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
861 struct hci_dev *hdev,
862 const void *data)
863 {
864 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
865 }
866
mgmt_get_adv_discov_flags(struct hci_dev * hdev)867 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
868 {
869 struct mgmt_pending_cmd *cmd;
870
871 /* If there's a pending mgmt command the flags will not yet have
872 * their final values, so check for this first.
873 */
874 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
875 if (cmd) {
876 struct mgmt_mode *cp = cmd->param;
877 if (cp->val == 0x01)
878 return LE_AD_GENERAL;
879 else if (cp->val == 0x02)
880 return LE_AD_LIMITED;
881 } else {
882 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
883 return LE_AD_LIMITED;
884 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
885 return LE_AD_GENERAL;
886 }
887
888 return 0;
889 }
890
mgmt_get_connectable(struct hci_dev * hdev)891 bool mgmt_get_connectable(struct hci_dev *hdev)
892 {
893 struct mgmt_pending_cmd *cmd;
894
895 /* If there's a pending mgmt command the flag will not yet have
896 * it's final value, so check for this first.
897 */
898 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
899 if (cmd) {
900 struct mgmt_mode *cp = cmd->param;
901
902 return cp->val;
903 }
904
905 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
906 }
907
service_cache_off(struct work_struct * work)908 static void service_cache_off(struct work_struct *work)
909 {
910 struct hci_dev *hdev = container_of(work, struct hci_dev,
911 service_cache.work);
912 struct hci_request req;
913
914 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
915 return;
916
917 hci_req_init(&req, hdev);
918
919 hci_dev_lock(hdev);
920
921 __hci_req_update_eir(&req);
922 __hci_req_update_class(&req);
923
924 hci_dev_unlock(hdev);
925
926 hci_req_run(&req, NULL);
927 }
928
rpa_expired(struct work_struct * work)929 static void rpa_expired(struct work_struct *work)
930 {
931 struct hci_dev *hdev = container_of(work, struct hci_dev,
932 rpa_expired.work);
933 struct hci_request req;
934
935 BT_DBG("");
936
937 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
938
939 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
940 return;
941
942 /* The generation of a new RPA and programming it into the
943 * controller happens in the hci_req_enable_advertising()
944 * function.
945 */
946 hci_req_init(&req, hdev);
947 if (ext_adv_capable(hdev))
948 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
949 else
950 __hci_req_enable_advertising(&req);
951 hci_req_run(&req, NULL);
952 }
953
mgmt_init_hdev(struct sock * sk,struct hci_dev * hdev)954 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
955 {
956 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
957 return;
958
959 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
960 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
961
962 /* Non-mgmt controlled devices get this bit set
963 * implicitly so that pairing works for them, however
964 * for mgmt we require user-space to explicitly enable
965 * it
966 */
967 hci_dev_clear_flag(hdev, HCI_BONDABLE);
968 }
969
read_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)970 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
971 void *data, u16 data_len)
972 {
973 struct mgmt_rp_read_info rp;
974
975 BT_DBG("sock %p %s", sk, hdev->name);
976
977 hci_dev_lock(hdev);
978
979 memset(&rp, 0, sizeof(rp));
980
981 bacpy(&rp.bdaddr, &hdev->bdaddr);
982
983 rp.version = hdev->hci_ver;
984 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
985
986 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
987 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
988
989 memcpy(rp.dev_class, hdev->dev_class, 3);
990
991 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
992 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
993
994 hci_dev_unlock(hdev);
995
996 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
997 sizeof(rp));
998 }
999
append_eir_data_to_buf(struct hci_dev * hdev,u8 * eir)1000 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
1001 {
1002 u16 eir_len = 0;
1003 size_t name_len;
1004
1005 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1006 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1007 hdev->dev_class, 3);
1008
1009 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1010 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1011 hdev->appearance);
1012
1013 name_len = strlen(hdev->dev_name);
1014 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1015 hdev->dev_name, name_len);
1016
1017 name_len = strlen(hdev->short_name);
1018 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1019 hdev->short_name, name_len);
1020
1021 return eir_len;
1022 }
1023
read_ext_controller_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)1024 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1025 void *data, u16 data_len)
1026 {
1027 char buf[512];
1028 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1029 u16 eir_len;
1030
1031 BT_DBG("sock %p %s", sk, hdev->name);
1032
1033 memset(&buf, 0, sizeof(buf));
1034
1035 hci_dev_lock(hdev);
1036
1037 bacpy(&rp->bdaddr, &hdev->bdaddr);
1038
1039 rp->version = hdev->hci_ver;
1040 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1041
1042 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1043 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1044
1045
1046 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1047 rp->eir_len = cpu_to_le16(eir_len);
1048
1049 hci_dev_unlock(hdev);
1050
1051 /* If this command is called at least once, then the events
1052 * for class of device and local name changes are disabled
1053 * and only the new extended controller information event
1054 * is used.
1055 */
1056 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1057 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1058 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1059
1060 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1061 sizeof(*rp) + eir_len);
1062 }
1063
ext_info_changed(struct hci_dev * hdev,struct sock * skip)1064 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1065 {
1066 char buf[512];
1067 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1068 u16 eir_len;
1069
1070 memset(buf, 0, sizeof(buf));
1071
1072 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1073 ev->eir_len = cpu_to_le16(eir_len);
1074
1075 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1076 sizeof(*ev) + eir_len,
1077 HCI_MGMT_EXT_INFO_EVENTS, skip);
1078 }
1079
send_settings_rsp(struct sock * sk,u16 opcode,struct hci_dev * hdev)1080 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1081 {
1082 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1083
1084 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1085 sizeof(settings));
1086 }
1087
clean_up_hci_complete(struct hci_dev * hdev,u8 status,u16 opcode)1088 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1089 {
1090 BT_DBG("%s status 0x%02x", hdev->name, status);
1091
1092 if (hci_conn_count(hdev) == 0) {
1093 cancel_delayed_work(&hdev->power_off);
1094 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1095 }
1096 }
1097
mgmt_advertising_added(struct sock * sk,struct hci_dev * hdev,u8 instance)1098 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1099 {
1100 struct mgmt_ev_advertising_added ev;
1101
1102 ev.instance = instance;
1103
1104 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1105 }
1106
mgmt_advertising_removed(struct sock * sk,struct hci_dev * hdev,u8 instance)1107 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1108 u8 instance)
1109 {
1110 struct mgmt_ev_advertising_removed ev;
1111
1112 ev.instance = instance;
1113
1114 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1115 }
1116
cancel_adv_timeout(struct hci_dev * hdev)1117 static void cancel_adv_timeout(struct hci_dev *hdev)
1118 {
1119 if (hdev->adv_instance_timeout) {
1120 hdev->adv_instance_timeout = 0;
1121 cancel_delayed_work(&hdev->adv_instance_expire);
1122 }
1123 }
1124
clean_up_hci_state(struct hci_dev * hdev)1125 static int clean_up_hci_state(struct hci_dev *hdev)
1126 {
1127 struct hci_request req;
1128 struct hci_conn *conn;
1129 bool discov_stopped;
1130 int err;
1131
1132 hci_req_init(&req, hdev);
1133
1134 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1135 test_bit(HCI_PSCAN, &hdev->flags)) {
1136 u8 scan = 0x00;
1137 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1138 }
1139
1140 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1141
1142 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1143 __hci_req_disable_advertising(&req);
1144
1145 discov_stopped = hci_req_stop_discovery(&req);
1146
1147 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1148 /* 0x15 == Terminated due to Power Off */
1149 __hci_abort_conn(&req, conn, 0x15);
1150 }
1151
1152 err = hci_req_run(&req, clean_up_hci_complete);
1153 if (!err && discov_stopped)
1154 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1155
1156 return err;
1157 }
1158
set_powered(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1159 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1160 u16 len)
1161 {
1162 struct mgmt_mode *cp = data;
1163 struct mgmt_pending_cmd *cmd;
1164 int err;
1165
1166 BT_DBG("request for %s", hdev->name);
1167
1168 if (cp->val != 0x00 && cp->val != 0x01)
1169 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1170 MGMT_STATUS_INVALID_PARAMS);
1171
1172 hci_dev_lock(hdev);
1173
1174 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1175 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1176 MGMT_STATUS_BUSY);
1177 goto failed;
1178 }
1179
1180 if (!!cp->val == hdev_is_powered(hdev)) {
1181 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1182 goto failed;
1183 }
1184
1185 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1186 if (!cmd) {
1187 err = -ENOMEM;
1188 goto failed;
1189 }
1190
1191 if (cp->val) {
1192 queue_work(hdev->req_workqueue, &hdev->power_on);
1193 err = 0;
1194 } else {
1195 /* Disconnect connections, stop scans, etc */
1196 err = clean_up_hci_state(hdev);
1197 if (!err)
1198 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1199 HCI_POWER_OFF_TIMEOUT);
1200
1201 /* ENODATA means there were no HCI commands queued */
1202 if (err == -ENODATA) {
1203 cancel_delayed_work(&hdev->power_off);
1204 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1205 err = 0;
1206 }
1207 }
1208
1209 failed:
1210 hci_dev_unlock(hdev);
1211 return err;
1212 }
1213
new_settings(struct hci_dev * hdev,struct sock * skip)1214 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1215 {
1216 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1217
1218 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1219 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1220 }
1221
mgmt_new_settings(struct hci_dev * hdev)1222 int mgmt_new_settings(struct hci_dev *hdev)
1223 {
1224 return new_settings(hdev, NULL);
1225 }
1226
1227 struct cmd_lookup {
1228 struct sock *sk;
1229 struct hci_dev *hdev;
1230 u8 mgmt_status;
1231 };
1232
settings_rsp(struct mgmt_pending_cmd * cmd,void * data)1233 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1234 {
1235 struct cmd_lookup *match = data;
1236
1237 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1238
1239 list_del(&cmd->list);
1240
1241 if (match->sk == NULL) {
1242 match->sk = cmd->sk;
1243 sock_hold(match->sk);
1244 }
1245
1246 mgmt_pending_free(cmd);
1247 }
1248
cmd_status_rsp(struct mgmt_pending_cmd * cmd,void * data)1249 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1250 {
1251 u8 *status = data;
1252
1253 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1254 mgmt_pending_remove(cmd);
1255 }
1256
cmd_complete_rsp(struct mgmt_pending_cmd * cmd,void * data)1257 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1258 {
1259 if (cmd->cmd_complete) {
1260 u8 *status = data;
1261
1262 cmd->cmd_complete(cmd, *status);
1263 mgmt_pending_remove(cmd);
1264
1265 return;
1266 }
1267
1268 cmd_status_rsp(cmd, data);
1269 }
1270
generic_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1271 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1272 {
1273 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1274 cmd->param, cmd->param_len);
1275 }
1276
addr_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)1277 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1278 {
1279 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1280 cmd->param, sizeof(struct mgmt_addr_info));
1281 }
1282
mgmt_bredr_support(struct hci_dev * hdev)1283 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1284 {
1285 if (!lmp_bredr_capable(hdev))
1286 return MGMT_STATUS_NOT_SUPPORTED;
1287 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1288 return MGMT_STATUS_REJECTED;
1289 else
1290 return MGMT_STATUS_SUCCESS;
1291 }
1292
mgmt_le_support(struct hci_dev * hdev)1293 static u8 mgmt_le_support(struct hci_dev *hdev)
1294 {
1295 if (!lmp_le_capable(hdev))
1296 return MGMT_STATUS_NOT_SUPPORTED;
1297 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1298 return MGMT_STATUS_REJECTED;
1299 else
1300 return MGMT_STATUS_SUCCESS;
1301 }
1302
mgmt_set_discoverable_complete(struct hci_dev * hdev,u8 status)1303 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1304 {
1305 struct mgmt_pending_cmd *cmd;
1306
1307 BT_DBG("status 0x%02x", status);
1308
1309 hci_dev_lock(hdev);
1310
1311 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1312 if (!cmd)
1313 goto unlock;
1314
1315 if (status) {
1316 u8 mgmt_err = mgmt_status(status);
1317 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1318 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1319 goto remove_cmd;
1320 }
1321
1322 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1323 hdev->discov_timeout > 0) {
1324 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1325 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1326 }
1327
1328 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1329 new_settings(hdev, cmd->sk);
1330
1331 remove_cmd:
1332 mgmt_pending_remove(cmd);
1333
1334 unlock:
1335 hci_dev_unlock(hdev);
1336 }
1337
set_discoverable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1338 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1339 u16 len)
1340 {
1341 struct mgmt_cp_set_discoverable *cp = data;
1342 struct mgmt_pending_cmd *cmd;
1343 u16 timeout;
1344 int err;
1345
1346 BT_DBG("request for %s", hdev->name);
1347
1348 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1349 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351 MGMT_STATUS_REJECTED);
1352
1353 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1354 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1355 MGMT_STATUS_INVALID_PARAMS);
1356
1357 timeout = __le16_to_cpu(cp->timeout);
1358
1359 /* Disabling discoverable requires that no timeout is set,
1360 * and enabling limited discoverable requires a timeout.
1361 */
1362 if ((cp->val == 0x00 && timeout > 0) ||
1363 (cp->val == 0x02 && timeout == 0))
1364 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1365 MGMT_STATUS_INVALID_PARAMS);
1366
1367 hci_dev_lock(hdev);
1368
1369 if (!hdev_is_powered(hdev) && timeout > 0) {
1370 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1371 MGMT_STATUS_NOT_POWERED);
1372 goto failed;
1373 }
1374
1375 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1376 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1377 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1378 MGMT_STATUS_BUSY);
1379 goto failed;
1380 }
1381
1382 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1383 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1384 MGMT_STATUS_REJECTED);
1385 goto failed;
1386 }
1387
1388 if (!hdev_is_powered(hdev)) {
1389 bool changed = false;
1390
1391 /* Setting limited discoverable when powered off is
1392 * not a valid operation since it requires a timeout
1393 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1394 */
1395 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1396 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1397 changed = true;
1398 }
1399
1400 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1401 if (err < 0)
1402 goto failed;
1403
1404 if (changed)
1405 err = new_settings(hdev, sk);
1406
1407 goto failed;
1408 }
1409
1410 /* If the current mode is the same, then just update the timeout
1411 * value with the new value. And if only the timeout gets updated,
1412 * then no need for any HCI transactions.
1413 */
1414 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1415 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1416 HCI_LIMITED_DISCOVERABLE)) {
1417 cancel_delayed_work(&hdev->discov_off);
1418 hdev->discov_timeout = timeout;
1419
1420 if (cp->val && hdev->discov_timeout > 0) {
1421 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1422 queue_delayed_work(hdev->req_workqueue,
1423 &hdev->discov_off, to);
1424 }
1425
1426 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1427 goto failed;
1428 }
1429
1430 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1431 if (!cmd) {
1432 err = -ENOMEM;
1433 goto failed;
1434 }
1435
1436 /* Cancel any potential discoverable timeout that might be
1437 * still active and store new timeout value. The arming of
1438 * the timeout happens in the complete handler.
1439 */
1440 cancel_delayed_work(&hdev->discov_off);
1441 hdev->discov_timeout = timeout;
1442
1443 if (cp->val)
1444 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1445 else
1446 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1447
1448 /* Limited discoverable mode */
1449 if (cp->val == 0x02)
1450 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1451 else
1452 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1453
1454 queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1455 err = 0;
1456
1457 failed:
1458 hci_dev_unlock(hdev);
1459 return err;
1460 }
1461
mgmt_set_connectable_complete(struct hci_dev * hdev,u8 status)1462 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1463 {
1464 struct mgmt_pending_cmd *cmd;
1465
1466 BT_DBG("status 0x%02x", status);
1467
1468 hci_dev_lock(hdev);
1469
1470 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1471 if (!cmd)
1472 goto unlock;
1473
1474 if (status) {
1475 u8 mgmt_err = mgmt_status(status);
1476 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1477 goto remove_cmd;
1478 }
1479
1480 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1481 new_settings(hdev, cmd->sk);
1482
1483 remove_cmd:
1484 mgmt_pending_remove(cmd);
1485
1486 unlock:
1487 hci_dev_unlock(hdev);
1488 }
1489
set_connectable_update_settings(struct hci_dev * hdev,struct sock * sk,u8 val)1490 static int set_connectable_update_settings(struct hci_dev *hdev,
1491 struct sock *sk, u8 val)
1492 {
1493 bool changed = false;
1494 int err;
1495
1496 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1497 changed = true;
1498
1499 if (val) {
1500 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1501 } else {
1502 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1503 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1504 }
1505
1506 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1507 if (err < 0)
1508 return err;
1509
1510 if (changed) {
1511 hci_req_update_scan(hdev);
1512 hci_update_background_scan(hdev);
1513 return new_settings(hdev, sk);
1514 }
1515
1516 return 0;
1517 }
1518
set_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1519 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1520 u16 len)
1521 {
1522 struct mgmt_mode *cp = data;
1523 struct mgmt_pending_cmd *cmd;
1524 int err;
1525
1526 BT_DBG("request for %s", hdev->name);
1527
1528 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1529 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531 MGMT_STATUS_REJECTED);
1532
1533 if (cp->val != 0x00 && cp->val != 0x01)
1534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1535 MGMT_STATUS_INVALID_PARAMS);
1536
1537 hci_dev_lock(hdev);
1538
1539 if (!hdev_is_powered(hdev)) {
1540 err = set_connectable_update_settings(hdev, sk, cp->val);
1541 goto failed;
1542 }
1543
1544 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1545 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1546 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1547 MGMT_STATUS_BUSY);
1548 goto failed;
1549 }
1550
1551 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1552 if (!cmd) {
1553 err = -ENOMEM;
1554 goto failed;
1555 }
1556
1557 if (cp->val) {
1558 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1559 } else {
1560 if (hdev->discov_timeout > 0)
1561 cancel_delayed_work(&hdev->discov_off);
1562
1563 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1564 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1565 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1566 }
1567
1568 queue_work(hdev->req_workqueue, &hdev->connectable_update);
1569 err = 0;
1570
1571 failed:
1572 hci_dev_unlock(hdev);
1573 return err;
1574 }
1575
set_bondable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1576 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1577 u16 len)
1578 {
1579 struct mgmt_mode *cp = data;
1580 bool changed;
1581 int err;
1582
1583 BT_DBG("request for %s", hdev->name);
1584
1585 if (cp->val != 0x00 && cp->val != 0x01)
1586 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1587 MGMT_STATUS_INVALID_PARAMS);
1588
1589 hci_dev_lock(hdev);
1590
1591 if (cp->val)
1592 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1593 else
1594 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1595
1596 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1597 if (err < 0)
1598 goto unlock;
1599
1600 if (changed) {
1601 /* In limited privacy mode the change of bondable mode
1602 * may affect the local advertising address.
1603 */
1604 if (hdev_is_powered(hdev) &&
1605 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1606 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1607 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1608 queue_work(hdev->req_workqueue,
1609 &hdev->discoverable_update);
1610
1611 err = new_settings(hdev, sk);
1612 }
1613
1614 unlock:
1615 hci_dev_unlock(hdev);
1616 return err;
1617 }
1618
set_link_security(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1619 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1620 u16 len)
1621 {
1622 struct mgmt_mode *cp = data;
1623 struct mgmt_pending_cmd *cmd;
1624 u8 val, status;
1625 int err;
1626
1627 BT_DBG("request for %s", hdev->name);
1628
1629 status = mgmt_bredr_support(hdev);
1630 if (status)
1631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632 status);
1633
1634 if (cp->val != 0x00 && cp->val != 0x01)
1635 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1636 MGMT_STATUS_INVALID_PARAMS);
1637
1638 hci_dev_lock(hdev);
1639
1640 if (!hdev_is_powered(hdev)) {
1641 bool changed = false;
1642
1643 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1644 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1645 changed = true;
1646 }
1647
1648 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1649 if (err < 0)
1650 goto failed;
1651
1652 if (changed)
1653 err = new_settings(hdev, sk);
1654
1655 goto failed;
1656 }
1657
1658 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1659 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1660 MGMT_STATUS_BUSY);
1661 goto failed;
1662 }
1663
1664 val = !!cp->val;
1665
1666 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1667 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1668 goto failed;
1669 }
1670
1671 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1672 if (!cmd) {
1673 err = -ENOMEM;
1674 goto failed;
1675 }
1676
1677 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1678 if (err < 0) {
1679 mgmt_pending_remove(cmd);
1680 goto failed;
1681 }
1682
1683 failed:
1684 hci_dev_unlock(hdev);
1685 return err;
1686 }
1687
set_ssp(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1688 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1689 {
1690 struct mgmt_mode *cp = data;
1691 struct mgmt_pending_cmd *cmd;
1692 u8 status;
1693 int err;
1694
1695 BT_DBG("request for %s", hdev->name);
1696
1697 status = mgmt_bredr_support(hdev);
1698 if (status)
1699 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1700
1701 if (!lmp_ssp_capable(hdev))
1702 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703 MGMT_STATUS_NOT_SUPPORTED);
1704
1705 if (cp->val != 0x00 && cp->val != 0x01)
1706 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1707 MGMT_STATUS_INVALID_PARAMS);
1708
1709 hci_dev_lock(hdev);
1710
1711 if (!hdev_is_powered(hdev)) {
1712 bool changed;
1713
1714 if (cp->val) {
1715 changed = !hci_dev_test_and_set_flag(hdev,
1716 HCI_SSP_ENABLED);
1717 } else {
1718 changed = hci_dev_test_and_clear_flag(hdev,
1719 HCI_SSP_ENABLED);
1720 if (!changed)
1721 changed = hci_dev_test_and_clear_flag(hdev,
1722 HCI_HS_ENABLED);
1723 else
1724 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1725 }
1726
1727 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1728 if (err < 0)
1729 goto failed;
1730
1731 if (changed)
1732 err = new_settings(hdev, sk);
1733
1734 goto failed;
1735 }
1736
1737 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1738 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1739 MGMT_STATUS_BUSY);
1740 goto failed;
1741 }
1742
1743 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1744 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1745 goto failed;
1746 }
1747
1748 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1749 if (!cmd) {
1750 err = -ENOMEM;
1751 goto failed;
1752 }
1753
1754 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1755 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1756 sizeof(cp->val), &cp->val);
1757
1758 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1759 if (err < 0) {
1760 mgmt_pending_remove(cmd);
1761 goto failed;
1762 }
1763
1764 failed:
1765 hci_dev_unlock(hdev);
1766 return err;
1767 }
1768
set_hs(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1769 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1770 {
1771 struct mgmt_mode *cp = data;
1772 bool changed;
1773 u8 status;
1774 int err;
1775
1776 BT_DBG("request for %s", hdev->name);
1777
1778 if (!IS_ENABLED(CONFIG_BT_HS))
1779 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780 MGMT_STATUS_NOT_SUPPORTED);
1781
1782 status = mgmt_bredr_support(hdev);
1783 if (status)
1784 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1785
1786 if (!lmp_ssp_capable(hdev))
1787 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788 MGMT_STATUS_NOT_SUPPORTED);
1789
1790 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1791 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1792 MGMT_STATUS_REJECTED);
1793
1794 if (cp->val != 0x00 && cp->val != 0x01)
1795 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1796 MGMT_STATUS_INVALID_PARAMS);
1797
1798 hci_dev_lock(hdev);
1799
1800 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1801 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1802 MGMT_STATUS_BUSY);
1803 goto unlock;
1804 }
1805
1806 if (cp->val) {
1807 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1808 } else {
1809 if (hdev_is_powered(hdev)) {
1810 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1811 MGMT_STATUS_REJECTED);
1812 goto unlock;
1813 }
1814
1815 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1816 }
1817
1818 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1819 if (err < 0)
1820 goto unlock;
1821
1822 if (changed)
1823 err = new_settings(hdev, sk);
1824
1825 unlock:
1826 hci_dev_unlock(hdev);
1827 return err;
1828 }
1829
le_enable_complete(struct hci_dev * hdev,u8 status,u16 opcode)1830 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1831 {
1832 struct cmd_lookup match = { NULL, hdev };
1833
1834 hci_dev_lock(hdev);
1835
1836 if (status) {
1837 u8 mgmt_err = mgmt_status(status);
1838
1839 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1840 &mgmt_err);
1841 goto unlock;
1842 }
1843
1844 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1845
1846 new_settings(hdev, match.sk);
1847
1848 if (match.sk)
1849 sock_put(match.sk);
1850
1851 /* Make sure the controller has a good default for
1852 * advertising data. Restrict the update to when LE
1853 * has actually been enabled. During power on, the
1854 * update in powered_update_hci will take care of it.
1855 */
1856 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1857 struct hci_request req;
1858 hci_req_init(&req, hdev);
1859 if (ext_adv_capable(hdev)) {
1860 int err;
1861
1862 err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1863 if (!err)
1864 __hci_req_update_scan_rsp_data(&req, 0x00);
1865 } else {
1866 __hci_req_update_adv_data(&req, 0x00);
1867 __hci_req_update_scan_rsp_data(&req, 0x00);
1868 }
1869 hci_req_run(&req, NULL);
1870 hci_update_background_scan(hdev);
1871 }
1872
1873 unlock:
1874 hci_dev_unlock(hdev);
1875 }
1876
set_le(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)1877 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1878 {
1879 struct mgmt_mode *cp = data;
1880 struct hci_cp_write_le_host_supported hci_cp;
1881 struct mgmt_pending_cmd *cmd;
1882 struct hci_request req;
1883 int err;
1884 u8 val, enabled;
1885
1886 BT_DBG("request for %s", hdev->name);
1887
1888 if (!lmp_le_capable(hdev))
1889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1890 MGMT_STATUS_NOT_SUPPORTED);
1891
1892 if (cp->val != 0x00 && cp->val != 0x01)
1893 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1894 MGMT_STATUS_INVALID_PARAMS);
1895
1896 /* Bluetooth single mode LE only controllers or dual-mode
1897 * controllers configured as LE only devices, do not allow
1898 * switching LE off. These have either LE enabled explicitly
1899 * or BR/EDR has been previously switched off.
1900 *
1901 * When trying to enable an already enabled LE, then gracefully
1902 * send a positive response. Trying to disable it however will
1903 * result into rejection.
1904 */
1905 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1906 if (cp->val == 0x01)
1907 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1908
1909 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1910 MGMT_STATUS_REJECTED);
1911 }
1912
1913 hci_dev_lock(hdev);
1914
1915 val = !!cp->val;
1916 enabled = lmp_host_le_capable(hdev);
1917
1918 if (!val)
1919 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1920
1921 if (!hdev_is_powered(hdev) || val == enabled) {
1922 bool changed = false;
1923
1924 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1925 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1926 changed = true;
1927 }
1928
1929 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1930 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1931 changed = true;
1932 }
1933
1934 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1935 if (err < 0)
1936 goto unlock;
1937
1938 if (changed)
1939 err = new_settings(hdev, sk);
1940
1941 goto unlock;
1942 }
1943
1944 if (pending_find(MGMT_OP_SET_LE, hdev) ||
1945 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1946 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1947 MGMT_STATUS_BUSY);
1948 goto unlock;
1949 }
1950
1951 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1952 if (!cmd) {
1953 err = -ENOMEM;
1954 goto unlock;
1955 }
1956
1957 hci_req_init(&req, hdev);
1958
1959 memset(&hci_cp, 0, sizeof(hci_cp));
1960
1961 if (val) {
1962 hci_cp.le = val;
1963 hci_cp.simul = 0x00;
1964 } else {
1965 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1966 __hci_req_disable_advertising(&req);
1967
1968 if (ext_adv_capable(hdev))
1969 __hci_req_clear_ext_adv_sets(&req);
1970 }
1971
1972 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1973 &hci_cp);
1974
1975 err = hci_req_run(&req, le_enable_complete);
1976 if (err < 0)
1977 mgmt_pending_remove(cmd);
1978
1979 unlock:
1980 hci_dev_unlock(hdev);
1981 return err;
1982 }
1983
1984 /* This is a helper function to test for pending mgmt commands that can
1985 * cause CoD or EIR HCI commands. We can only allow one such pending
1986 * mgmt command at a time since otherwise we cannot easily track what
1987 * the current values are, will be, and based on that calculate if a new
1988 * HCI command needs to be sent and if yes with what value.
1989 */
pending_eir_or_class(struct hci_dev * hdev)1990 static bool pending_eir_or_class(struct hci_dev *hdev)
1991 {
1992 struct mgmt_pending_cmd *cmd;
1993
1994 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1995 switch (cmd->opcode) {
1996 case MGMT_OP_ADD_UUID:
1997 case MGMT_OP_REMOVE_UUID:
1998 case MGMT_OP_SET_DEV_CLASS:
1999 case MGMT_OP_SET_POWERED:
2000 return true;
2001 }
2002 }
2003
2004 return false;
2005 }
2006
2007 static const u8 bluetooth_base_uuid[] = {
2008 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2009 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2010 };
2011
get_uuid_size(const u8 * uuid)2012 static u8 get_uuid_size(const u8 *uuid)
2013 {
2014 u32 val;
2015
2016 if (memcmp(uuid, bluetooth_base_uuid, 12))
2017 return 128;
2018
2019 val = get_unaligned_le32(&uuid[12]);
2020 if (val > 0xffff)
2021 return 32;
2022
2023 return 16;
2024 }
2025
mgmt_class_complete(struct hci_dev * hdev,u16 mgmt_op,u8 status)2026 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2027 {
2028 struct mgmt_pending_cmd *cmd;
2029
2030 hci_dev_lock(hdev);
2031
2032 cmd = pending_find(mgmt_op, hdev);
2033 if (!cmd)
2034 goto unlock;
2035
2036 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2037 mgmt_status(status), hdev->dev_class, 3);
2038
2039 mgmt_pending_remove(cmd);
2040
2041 unlock:
2042 hci_dev_unlock(hdev);
2043 }
2044
add_uuid_complete(struct hci_dev * hdev,u8 status,u16 opcode)2045 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2046 {
2047 BT_DBG("status 0x%02x", status);
2048
2049 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2050 }
2051
add_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2052 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2053 {
2054 struct mgmt_cp_add_uuid *cp = data;
2055 struct mgmt_pending_cmd *cmd;
2056 struct hci_request req;
2057 struct bt_uuid *uuid;
2058 int err;
2059
2060 BT_DBG("request for %s", hdev->name);
2061
2062 hci_dev_lock(hdev);
2063
2064 if (pending_eir_or_class(hdev)) {
2065 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2066 MGMT_STATUS_BUSY);
2067 goto failed;
2068 }
2069
2070 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2071 if (!uuid) {
2072 err = -ENOMEM;
2073 goto failed;
2074 }
2075
2076 memcpy(uuid->uuid, cp->uuid, 16);
2077 uuid->svc_hint = cp->svc_hint;
2078 uuid->size = get_uuid_size(cp->uuid);
2079
2080 list_add_tail(&uuid->list, &hdev->uuids);
2081
2082 hci_req_init(&req, hdev);
2083
2084 __hci_req_update_class(&req);
2085 __hci_req_update_eir(&req);
2086
2087 err = hci_req_run(&req, add_uuid_complete);
2088 if (err < 0) {
2089 if (err != -ENODATA)
2090 goto failed;
2091
2092 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2093 hdev->dev_class, 3);
2094 goto failed;
2095 }
2096
2097 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2098 if (!cmd) {
2099 err = -ENOMEM;
2100 goto failed;
2101 }
2102
2103 err = 0;
2104
2105 failed:
2106 hci_dev_unlock(hdev);
2107 return err;
2108 }
2109
enable_service_cache(struct hci_dev * hdev)2110 static bool enable_service_cache(struct hci_dev *hdev)
2111 {
2112 if (!hdev_is_powered(hdev))
2113 return false;
2114
2115 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2116 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2117 CACHE_TIMEOUT);
2118 return true;
2119 }
2120
2121 return false;
2122 }
2123
remove_uuid_complete(struct hci_dev * hdev,u8 status,u16 opcode)2124 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2125 {
2126 BT_DBG("status 0x%02x", status);
2127
2128 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2129 }
2130
remove_uuid(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2131 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2132 u16 len)
2133 {
2134 struct mgmt_cp_remove_uuid *cp = data;
2135 struct mgmt_pending_cmd *cmd;
2136 struct bt_uuid *match, *tmp;
2137 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2138 struct hci_request req;
2139 int err, found;
2140
2141 BT_DBG("request for %s", hdev->name);
2142
2143 hci_dev_lock(hdev);
2144
2145 if (pending_eir_or_class(hdev)) {
2146 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2147 MGMT_STATUS_BUSY);
2148 goto unlock;
2149 }
2150
2151 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2152 hci_uuids_clear(hdev);
2153
2154 if (enable_service_cache(hdev)) {
2155 err = mgmt_cmd_complete(sk, hdev->id,
2156 MGMT_OP_REMOVE_UUID,
2157 0, hdev->dev_class, 3);
2158 goto unlock;
2159 }
2160
2161 goto update_class;
2162 }
2163
2164 found = 0;
2165
2166 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2167 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2168 continue;
2169
2170 list_del(&match->list);
2171 kfree(match);
2172 found++;
2173 }
2174
2175 if (found == 0) {
2176 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2177 MGMT_STATUS_INVALID_PARAMS);
2178 goto unlock;
2179 }
2180
2181 update_class:
2182 hci_req_init(&req, hdev);
2183
2184 __hci_req_update_class(&req);
2185 __hci_req_update_eir(&req);
2186
2187 err = hci_req_run(&req, remove_uuid_complete);
2188 if (err < 0) {
2189 if (err != -ENODATA)
2190 goto unlock;
2191
2192 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2193 hdev->dev_class, 3);
2194 goto unlock;
2195 }
2196
2197 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2198 if (!cmd) {
2199 err = -ENOMEM;
2200 goto unlock;
2201 }
2202
2203 err = 0;
2204
2205 unlock:
2206 hci_dev_unlock(hdev);
2207 return err;
2208 }
2209
set_class_complete(struct hci_dev * hdev,u8 status,u16 opcode)2210 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2211 {
2212 BT_DBG("status 0x%02x", status);
2213
2214 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2215 }
2216
set_dev_class(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2217 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2218 u16 len)
2219 {
2220 struct mgmt_cp_set_dev_class *cp = data;
2221 struct mgmt_pending_cmd *cmd;
2222 struct hci_request req;
2223 int err;
2224
2225 BT_DBG("request for %s", hdev->name);
2226
2227 if (!lmp_bredr_capable(hdev))
2228 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2229 MGMT_STATUS_NOT_SUPPORTED);
2230
2231 hci_dev_lock(hdev);
2232
2233 if (pending_eir_or_class(hdev)) {
2234 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2235 MGMT_STATUS_BUSY);
2236 goto unlock;
2237 }
2238
2239 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2240 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2241 MGMT_STATUS_INVALID_PARAMS);
2242 goto unlock;
2243 }
2244
2245 hdev->major_class = cp->major;
2246 hdev->minor_class = cp->minor;
2247
2248 if (!hdev_is_powered(hdev)) {
2249 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2250 hdev->dev_class, 3);
2251 goto unlock;
2252 }
2253
2254 hci_req_init(&req, hdev);
2255
2256 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2257 hci_dev_unlock(hdev);
2258 cancel_delayed_work_sync(&hdev->service_cache);
2259 hci_dev_lock(hdev);
2260 __hci_req_update_eir(&req);
2261 }
2262
2263 __hci_req_update_class(&req);
2264
2265 err = hci_req_run(&req, set_class_complete);
2266 if (err < 0) {
2267 if (err != -ENODATA)
2268 goto unlock;
2269
2270 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2271 hdev->dev_class, 3);
2272 goto unlock;
2273 }
2274
2275 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2276 if (!cmd) {
2277 err = -ENOMEM;
2278 goto unlock;
2279 }
2280
2281 err = 0;
2282
2283 unlock:
2284 hci_dev_unlock(hdev);
2285 return err;
2286 }
2287
load_link_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2288 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2289 u16 len)
2290 {
2291 struct mgmt_cp_load_link_keys *cp = data;
2292 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2293 sizeof(struct mgmt_link_key_info));
2294 u16 key_count, expected_len;
2295 bool changed;
2296 int i;
2297
2298 BT_DBG("request for %s", hdev->name);
2299
2300 if (!lmp_bredr_capable(hdev))
2301 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2302 MGMT_STATUS_NOT_SUPPORTED);
2303
2304 key_count = __le16_to_cpu(cp->key_count);
2305 if (key_count > max_key_count) {
2306 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2307 key_count);
2308 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309 MGMT_STATUS_INVALID_PARAMS);
2310 }
2311
2312 expected_len = struct_size(cp, keys, key_count);
2313 if (expected_len != len) {
2314 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2315 expected_len, len);
2316 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2317 MGMT_STATUS_INVALID_PARAMS);
2318 }
2319
2320 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2321 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2322 MGMT_STATUS_INVALID_PARAMS);
2323
2324 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2325 key_count);
2326
2327 for (i = 0; i < key_count; i++) {
2328 struct mgmt_link_key_info *key = &cp->keys[i];
2329
2330 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2331 return mgmt_cmd_status(sk, hdev->id,
2332 MGMT_OP_LOAD_LINK_KEYS,
2333 MGMT_STATUS_INVALID_PARAMS);
2334 }
2335
2336 hci_dev_lock(hdev);
2337
2338 hci_link_keys_clear(hdev);
2339
2340 if (cp->debug_keys)
2341 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2342 else
2343 changed = hci_dev_test_and_clear_flag(hdev,
2344 HCI_KEEP_DEBUG_KEYS);
2345
2346 if (changed)
2347 new_settings(hdev, NULL);
2348
2349 for (i = 0; i < key_count; i++) {
2350 struct mgmt_link_key_info *key = &cp->keys[i];
2351
2352 /* Always ignore debug keys and require a new pairing if
2353 * the user wants to use them.
2354 */
2355 if (key->type == HCI_LK_DEBUG_COMBINATION)
2356 continue;
2357
2358 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2359 key->type, key->pin_len, NULL);
2360 }
2361
2362 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2363
2364 hci_dev_unlock(hdev);
2365
2366 return 0;
2367 }
2368
device_unpaired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,struct sock * skip_sk)2369 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2370 u8 addr_type, struct sock *skip_sk)
2371 {
2372 struct mgmt_ev_device_unpaired ev;
2373
2374 bacpy(&ev.addr.bdaddr, bdaddr);
2375 ev.addr.type = addr_type;
2376
2377 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2378 skip_sk);
2379 }
2380
unpair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2381 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2382 u16 len)
2383 {
2384 struct mgmt_cp_unpair_device *cp = data;
2385 struct mgmt_rp_unpair_device rp;
2386 struct hci_conn_params *params;
2387 struct mgmt_pending_cmd *cmd;
2388 struct hci_conn *conn;
2389 u8 addr_type;
2390 int err;
2391
2392 memset(&rp, 0, sizeof(rp));
2393 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2394 rp.addr.type = cp->addr.type;
2395
2396 if (!bdaddr_type_is_valid(cp->addr.type))
2397 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2398 MGMT_STATUS_INVALID_PARAMS,
2399 &rp, sizeof(rp));
2400
2401 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2402 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2403 MGMT_STATUS_INVALID_PARAMS,
2404 &rp, sizeof(rp));
2405
2406 hci_dev_lock(hdev);
2407
2408 if (!hdev_is_powered(hdev)) {
2409 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2410 MGMT_STATUS_NOT_POWERED, &rp,
2411 sizeof(rp));
2412 goto unlock;
2413 }
2414
2415 if (cp->addr.type == BDADDR_BREDR) {
2416 /* If disconnection is requested, then look up the
2417 * connection. If the remote device is connected, it
2418 * will be later used to terminate the link.
2419 *
2420 * Setting it to NULL explicitly will cause no
2421 * termination of the link.
2422 */
2423 if (cp->disconnect)
2424 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2425 &cp->addr.bdaddr);
2426 else
2427 conn = NULL;
2428
2429 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2430 if (err < 0) {
2431 err = mgmt_cmd_complete(sk, hdev->id,
2432 MGMT_OP_UNPAIR_DEVICE,
2433 MGMT_STATUS_NOT_PAIRED, &rp,
2434 sizeof(rp));
2435 goto unlock;
2436 }
2437
2438 goto done;
2439 }
2440
2441 /* LE address type */
2442 addr_type = le_addr_type(cp->addr.type);
2443
2444 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2445 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2446 if (err < 0) {
2447 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2448 MGMT_STATUS_NOT_PAIRED, &rp,
2449 sizeof(rp));
2450 goto unlock;
2451 }
2452
2453 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2454 if (!conn) {
2455 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2456 goto done;
2457 }
2458
2459
2460 /* Defer clearing up the connection parameters until closing to
2461 * give a chance of keeping them if a repairing happens.
2462 */
2463 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2464
2465 /* Disable auto-connection parameters if present */
2466 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2467 if (params) {
2468 if (params->explicit_connect)
2469 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2470 else
2471 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2472 }
2473
2474 /* If disconnection is not requested, then clear the connection
2475 * variable so that the link is not terminated.
2476 */
2477 if (!cp->disconnect)
2478 conn = NULL;
2479
2480 done:
2481 /* If the connection variable is set, then termination of the
2482 * link is requested.
2483 */
2484 if (!conn) {
2485 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2486 &rp, sizeof(rp));
2487 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2488 goto unlock;
2489 }
2490
2491 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2492 sizeof(*cp));
2493 if (!cmd) {
2494 err = -ENOMEM;
2495 goto unlock;
2496 }
2497
2498 cmd->cmd_complete = addr_cmd_complete;
2499
2500 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2501 if (err < 0)
2502 mgmt_pending_remove(cmd);
2503
2504 unlock:
2505 hci_dev_unlock(hdev);
2506 return err;
2507 }
2508
disconnect(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2509 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2510 u16 len)
2511 {
2512 struct mgmt_cp_disconnect *cp = data;
2513 struct mgmt_rp_disconnect rp;
2514 struct mgmt_pending_cmd *cmd;
2515 struct hci_conn *conn;
2516 int err;
2517
2518 BT_DBG("");
2519
2520 memset(&rp, 0, sizeof(rp));
2521 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2522 rp.addr.type = cp->addr.type;
2523
2524 if (!bdaddr_type_is_valid(cp->addr.type))
2525 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2526 MGMT_STATUS_INVALID_PARAMS,
2527 &rp, sizeof(rp));
2528
2529 hci_dev_lock(hdev);
2530
2531 if (!test_bit(HCI_UP, &hdev->flags)) {
2532 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2533 MGMT_STATUS_NOT_POWERED, &rp,
2534 sizeof(rp));
2535 goto failed;
2536 }
2537
2538 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2539 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2540 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2541 goto failed;
2542 }
2543
2544 if (cp->addr.type == BDADDR_BREDR)
2545 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2546 &cp->addr.bdaddr);
2547 else
2548 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2549 le_addr_type(cp->addr.type));
2550
2551 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2552 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2553 MGMT_STATUS_NOT_CONNECTED, &rp,
2554 sizeof(rp));
2555 goto failed;
2556 }
2557
2558 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2559 if (!cmd) {
2560 err = -ENOMEM;
2561 goto failed;
2562 }
2563
2564 cmd->cmd_complete = generic_cmd_complete;
2565
2566 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2567 if (err < 0)
2568 mgmt_pending_remove(cmd);
2569
2570 failed:
2571 hci_dev_unlock(hdev);
2572 return err;
2573 }
2574
link_to_bdaddr(u8 link_type,u8 addr_type)2575 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2576 {
2577 switch (link_type) {
2578 case LE_LINK:
2579 switch (addr_type) {
2580 case ADDR_LE_DEV_PUBLIC:
2581 return BDADDR_LE_PUBLIC;
2582
2583 default:
2584 /* Fallback to LE Random address type */
2585 return BDADDR_LE_RANDOM;
2586 }
2587
2588 default:
2589 /* Fallback to BR/EDR type */
2590 return BDADDR_BREDR;
2591 }
2592 }
2593
get_connections(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)2594 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2595 u16 data_len)
2596 {
2597 struct mgmt_rp_get_connections *rp;
2598 struct hci_conn *c;
2599 int err;
2600 u16 i;
2601
2602 BT_DBG("");
2603
2604 hci_dev_lock(hdev);
2605
2606 if (!hdev_is_powered(hdev)) {
2607 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2608 MGMT_STATUS_NOT_POWERED);
2609 goto unlock;
2610 }
2611
2612 i = 0;
2613 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2614 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2615 i++;
2616 }
2617
2618 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2619 if (!rp) {
2620 err = -ENOMEM;
2621 goto unlock;
2622 }
2623
2624 i = 0;
2625 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2626 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2627 continue;
2628 bacpy(&rp->addr[i].bdaddr, &c->dst);
2629 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2630 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2631 continue;
2632 i++;
2633 }
2634
2635 rp->conn_count = cpu_to_le16(i);
2636
2637 /* Recalculate length in case of filtered SCO connections, etc */
2638 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2639 struct_size(rp, addr, i));
2640
2641 kfree(rp);
2642
2643 unlock:
2644 hci_dev_unlock(hdev);
2645 return err;
2646 }
2647
send_pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,struct mgmt_cp_pin_code_neg_reply * cp)2648 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2649 struct mgmt_cp_pin_code_neg_reply *cp)
2650 {
2651 struct mgmt_pending_cmd *cmd;
2652 int err;
2653
2654 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2655 sizeof(*cp));
2656 if (!cmd)
2657 return -ENOMEM;
2658
2659 cmd->cmd_complete = addr_cmd_complete;
2660
2661 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2662 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2663 if (err < 0)
2664 mgmt_pending_remove(cmd);
2665
2666 return err;
2667 }
2668
pin_code_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2669 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2670 u16 len)
2671 {
2672 struct hci_conn *conn;
2673 struct mgmt_cp_pin_code_reply *cp = data;
2674 struct hci_cp_pin_code_reply reply;
2675 struct mgmt_pending_cmd *cmd;
2676 int err;
2677
2678 BT_DBG("");
2679
2680 hci_dev_lock(hdev);
2681
2682 if (!hdev_is_powered(hdev)) {
2683 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2684 MGMT_STATUS_NOT_POWERED);
2685 goto failed;
2686 }
2687
2688 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2689 if (!conn) {
2690 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2691 MGMT_STATUS_NOT_CONNECTED);
2692 goto failed;
2693 }
2694
2695 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2696 struct mgmt_cp_pin_code_neg_reply ncp;
2697
2698 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2699
2700 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2701
2702 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2703 if (err >= 0)
2704 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2705 MGMT_STATUS_INVALID_PARAMS);
2706
2707 goto failed;
2708 }
2709
2710 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2711 if (!cmd) {
2712 err = -ENOMEM;
2713 goto failed;
2714 }
2715
2716 cmd->cmd_complete = addr_cmd_complete;
2717
2718 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2719 reply.pin_len = cp->pin_len;
2720 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2721
2722 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2723 if (err < 0)
2724 mgmt_pending_remove(cmd);
2725
2726 failed:
2727 hci_dev_unlock(hdev);
2728 return err;
2729 }
2730
set_io_capability(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2731 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2732 u16 len)
2733 {
2734 struct mgmt_cp_set_io_capability *cp = data;
2735
2736 BT_DBG("");
2737
2738 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2739 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2740 MGMT_STATUS_INVALID_PARAMS);
2741
2742 hci_dev_lock(hdev);
2743
2744 hdev->io_capability = cp->io_capability;
2745
2746 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2747 hdev->io_capability);
2748
2749 hci_dev_unlock(hdev);
2750
2751 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2752 NULL, 0);
2753 }
2754
find_pairing(struct hci_conn * conn)2755 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2756 {
2757 struct hci_dev *hdev = conn->hdev;
2758 struct mgmt_pending_cmd *cmd;
2759
2760 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2761 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2762 continue;
2763
2764 if (cmd->user_data != conn)
2765 continue;
2766
2767 return cmd;
2768 }
2769
2770 return NULL;
2771 }
2772
pairing_complete(struct mgmt_pending_cmd * cmd,u8 status)2773 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2774 {
2775 struct mgmt_rp_pair_device rp;
2776 struct hci_conn *conn = cmd->user_data;
2777 int err;
2778
2779 bacpy(&rp.addr.bdaddr, &conn->dst);
2780 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2781
2782 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2783 status, &rp, sizeof(rp));
2784
2785 /* So we don't get further callbacks for this connection */
2786 conn->connect_cfm_cb = NULL;
2787 conn->security_cfm_cb = NULL;
2788 conn->disconn_cfm_cb = NULL;
2789
2790 hci_conn_drop(conn);
2791
2792 /* The device is paired so there is no need to remove
2793 * its connection parameters anymore.
2794 */
2795 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2796
2797 hci_conn_put(conn);
2798
2799 return err;
2800 }
2801
mgmt_smp_complete(struct hci_conn * conn,bool complete)2802 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2803 {
2804 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2805 struct mgmt_pending_cmd *cmd;
2806
2807 cmd = find_pairing(conn);
2808 if (cmd) {
2809 cmd->cmd_complete(cmd, status);
2810 mgmt_pending_remove(cmd);
2811 }
2812 }
2813
pairing_complete_cb(struct hci_conn * conn,u8 status)2814 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2815 {
2816 struct mgmt_pending_cmd *cmd;
2817
2818 BT_DBG("status %u", status);
2819
2820 cmd = find_pairing(conn);
2821 if (!cmd) {
2822 BT_DBG("Unable to find a pending command");
2823 return;
2824 }
2825
2826 cmd->cmd_complete(cmd, mgmt_status(status));
2827 mgmt_pending_remove(cmd);
2828 }
2829
le_pairing_complete_cb(struct hci_conn * conn,u8 status)2830 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2831 {
2832 struct mgmt_pending_cmd *cmd;
2833
2834 BT_DBG("status %u", status);
2835
2836 if (!status)
2837 return;
2838
2839 cmd = find_pairing(conn);
2840 if (!cmd) {
2841 BT_DBG("Unable to find a pending command");
2842 return;
2843 }
2844
2845 cmd->cmd_complete(cmd, mgmt_status(status));
2846 mgmt_pending_remove(cmd);
2847 }
2848
pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2849 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2850 u16 len)
2851 {
2852 struct mgmt_cp_pair_device *cp = data;
2853 struct mgmt_rp_pair_device rp;
2854 struct mgmt_pending_cmd *cmd;
2855 u8 sec_level, auth_type;
2856 struct hci_conn *conn;
2857 int err;
2858
2859 BT_DBG("");
2860
2861 memset(&rp, 0, sizeof(rp));
2862 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2863 rp.addr.type = cp->addr.type;
2864
2865 if (!bdaddr_type_is_valid(cp->addr.type))
2866 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2867 MGMT_STATUS_INVALID_PARAMS,
2868 &rp, sizeof(rp));
2869
2870 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2871 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2872 MGMT_STATUS_INVALID_PARAMS,
2873 &rp, sizeof(rp));
2874
2875 hci_dev_lock(hdev);
2876
2877 if (!hdev_is_powered(hdev)) {
2878 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2879 MGMT_STATUS_NOT_POWERED, &rp,
2880 sizeof(rp));
2881 goto unlock;
2882 }
2883
2884 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2885 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2886 MGMT_STATUS_ALREADY_PAIRED, &rp,
2887 sizeof(rp));
2888 goto unlock;
2889 }
2890
2891 sec_level = BT_SECURITY_MEDIUM;
2892 auth_type = HCI_AT_DEDICATED_BONDING;
2893
2894 if (cp->addr.type == BDADDR_BREDR) {
2895 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2896 auth_type);
2897 } else {
2898 u8 addr_type = le_addr_type(cp->addr.type);
2899 struct hci_conn_params *p;
2900
2901 /* When pairing a new device, it is expected to remember
2902 * this device for future connections. Adding the connection
2903 * parameter information ahead of time allows tracking
2904 * of the slave preferred values and will speed up any
2905 * further connection establishment.
2906 *
2907 * If connection parameters already exist, then they
2908 * will be kept and this function does nothing.
2909 */
2910 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2911
2912 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2913 p->auto_connect = HCI_AUTO_CONN_DISABLED;
2914
2915 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2916 addr_type, sec_level,
2917 HCI_LE_CONN_TIMEOUT);
2918 }
2919
2920 if (IS_ERR(conn)) {
2921 int status;
2922
2923 if (PTR_ERR(conn) == -EBUSY)
2924 status = MGMT_STATUS_BUSY;
2925 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2926 status = MGMT_STATUS_NOT_SUPPORTED;
2927 else if (PTR_ERR(conn) == -ECONNREFUSED)
2928 status = MGMT_STATUS_REJECTED;
2929 else
2930 status = MGMT_STATUS_CONNECT_FAILED;
2931
2932 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2933 status, &rp, sizeof(rp));
2934 goto unlock;
2935 }
2936
2937 if (conn->connect_cfm_cb) {
2938 hci_conn_drop(conn);
2939 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2940 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2941 goto unlock;
2942 }
2943
2944 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2945 if (!cmd) {
2946 err = -ENOMEM;
2947 hci_conn_drop(conn);
2948 goto unlock;
2949 }
2950
2951 cmd->cmd_complete = pairing_complete;
2952
2953 /* For LE, just connecting isn't a proof that the pairing finished */
2954 if (cp->addr.type == BDADDR_BREDR) {
2955 conn->connect_cfm_cb = pairing_complete_cb;
2956 conn->security_cfm_cb = pairing_complete_cb;
2957 conn->disconn_cfm_cb = pairing_complete_cb;
2958 } else {
2959 conn->connect_cfm_cb = le_pairing_complete_cb;
2960 conn->security_cfm_cb = le_pairing_complete_cb;
2961 conn->disconn_cfm_cb = le_pairing_complete_cb;
2962 }
2963
2964 conn->io_capability = cp->io_cap;
2965 cmd->user_data = hci_conn_get(conn);
2966
2967 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2968 hci_conn_security(conn, sec_level, auth_type, true)) {
2969 cmd->cmd_complete(cmd, 0);
2970 mgmt_pending_remove(cmd);
2971 }
2972
2973 err = 0;
2974
2975 unlock:
2976 hci_dev_unlock(hdev);
2977 return err;
2978 }
2979
cancel_pair_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)2980 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2981 u16 len)
2982 {
2983 struct mgmt_addr_info *addr = data;
2984 struct mgmt_pending_cmd *cmd;
2985 struct hci_conn *conn;
2986 int err;
2987
2988 BT_DBG("");
2989
2990 hci_dev_lock(hdev);
2991
2992 if (!hdev_is_powered(hdev)) {
2993 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2994 MGMT_STATUS_NOT_POWERED);
2995 goto unlock;
2996 }
2997
2998 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2999 if (!cmd) {
3000 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001 MGMT_STATUS_INVALID_PARAMS);
3002 goto unlock;
3003 }
3004
3005 conn = cmd->user_data;
3006
3007 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3008 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3009 MGMT_STATUS_INVALID_PARAMS);
3010 goto unlock;
3011 }
3012
3013 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3014 mgmt_pending_remove(cmd);
3015
3016 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3017 addr, sizeof(*addr));
3018 unlock:
3019 hci_dev_unlock(hdev);
3020 return err;
3021 }
3022
user_pairing_resp(struct sock * sk,struct hci_dev * hdev,struct mgmt_addr_info * addr,u16 mgmt_op,u16 hci_op,__le32 passkey)3023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3024 struct mgmt_addr_info *addr, u16 mgmt_op,
3025 u16 hci_op, __le32 passkey)
3026 {
3027 struct mgmt_pending_cmd *cmd;
3028 struct hci_conn *conn;
3029 int err;
3030
3031 hci_dev_lock(hdev);
3032
3033 if (!hdev_is_powered(hdev)) {
3034 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3035 MGMT_STATUS_NOT_POWERED, addr,
3036 sizeof(*addr));
3037 goto done;
3038 }
3039
3040 if (addr->type == BDADDR_BREDR)
3041 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3042 else
3043 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3044 le_addr_type(addr->type));
3045
3046 if (!conn) {
3047 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3048 MGMT_STATUS_NOT_CONNECTED, addr,
3049 sizeof(*addr));
3050 goto done;
3051 }
3052
3053 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3054 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3055 if (!err)
3056 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3057 MGMT_STATUS_SUCCESS, addr,
3058 sizeof(*addr));
3059 else
3060 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3061 MGMT_STATUS_FAILED, addr,
3062 sizeof(*addr));
3063
3064 goto done;
3065 }
3066
3067 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3068 if (!cmd) {
3069 err = -ENOMEM;
3070 goto done;
3071 }
3072
3073 cmd->cmd_complete = addr_cmd_complete;
3074
3075 /* Continue with pairing via HCI */
3076 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3077 struct hci_cp_user_passkey_reply cp;
3078
3079 bacpy(&cp.bdaddr, &addr->bdaddr);
3080 cp.passkey = passkey;
3081 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3082 } else
3083 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3084 &addr->bdaddr);
3085
3086 if (err < 0)
3087 mgmt_pending_remove(cmd);
3088
3089 done:
3090 hci_dev_unlock(hdev);
3091 return err;
3092 }
3093
pin_code_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3094 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3095 void *data, u16 len)
3096 {
3097 struct mgmt_cp_pin_code_neg_reply *cp = data;
3098
3099 BT_DBG("");
3100
3101 return user_pairing_resp(sk, hdev, &cp->addr,
3102 MGMT_OP_PIN_CODE_NEG_REPLY,
3103 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3104 }
3105
user_confirm_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3106 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3107 u16 len)
3108 {
3109 struct mgmt_cp_user_confirm_reply *cp = data;
3110
3111 BT_DBG("");
3112
3113 if (len != sizeof(*cp))
3114 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3115 MGMT_STATUS_INVALID_PARAMS);
3116
3117 return user_pairing_resp(sk, hdev, &cp->addr,
3118 MGMT_OP_USER_CONFIRM_REPLY,
3119 HCI_OP_USER_CONFIRM_REPLY, 0);
3120 }
3121
user_confirm_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3122 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3123 void *data, u16 len)
3124 {
3125 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3126
3127 BT_DBG("");
3128
3129 return user_pairing_resp(sk, hdev, &cp->addr,
3130 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3131 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3132 }
3133
user_passkey_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3134 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3135 u16 len)
3136 {
3137 struct mgmt_cp_user_passkey_reply *cp = data;
3138
3139 BT_DBG("");
3140
3141 return user_pairing_resp(sk, hdev, &cp->addr,
3142 MGMT_OP_USER_PASSKEY_REPLY,
3143 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3144 }
3145
user_passkey_neg_reply(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3146 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3147 void *data, u16 len)
3148 {
3149 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3150
3151 BT_DBG("");
3152
3153 return user_pairing_resp(sk, hdev, &cp->addr,
3154 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3155 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3156 }
3157
adv_expire(struct hci_dev * hdev,u32 flags)3158 static void adv_expire(struct hci_dev *hdev, u32 flags)
3159 {
3160 struct adv_info *adv_instance;
3161 struct hci_request req;
3162 int err;
3163
3164 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3165 if (!adv_instance)
3166 return;
3167
3168 /* stop if current instance doesn't need to be changed */
3169 if (!(adv_instance->flags & flags))
3170 return;
3171
3172 cancel_adv_timeout(hdev);
3173
3174 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3175 if (!adv_instance)
3176 return;
3177
3178 hci_req_init(&req, hdev);
3179 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3180 true);
3181 if (err)
3182 return;
3183
3184 hci_req_run(&req, NULL);
3185 }
3186
set_name_complete(struct hci_dev * hdev,u8 status,u16 opcode)3187 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3188 {
3189 struct mgmt_cp_set_local_name *cp;
3190 struct mgmt_pending_cmd *cmd;
3191
3192 BT_DBG("status 0x%02x", status);
3193
3194 hci_dev_lock(hdev);
3195
3196 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3197 if (!cmd)
3198 goto unlock;
3199
3200 cp = cmd->param;
3201
3202 if (status) {
3203 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3204 mgmt_status(status));
3205 } else {
3206 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3207 cp, sizeof(*cp));
3208
3209 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3210 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3211 }
3212
3213 mgmt_pending_remove(cmd);
3214
3215 unlock:
3216 hci_dev_unlock(hdev);
3217 }
3218
set_local_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3219 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3220 u16 len)
3221 {
3222 struct mgmt_cp_set_local_name *cp = data;
3223 struct mgmt_pending_cmd *cmd;
3224 struct hci_request req;
3225 int err;
3226
3227 BT_DBG("");
3228
3229 hci_dev_lock(hdev);
3230
3231 /* If the old values are the same as the new ones just return a
3232 * direct command complete event.
3233 */
3234 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3235 !memcmp(hdev->short_name, cp->short_name,
3236 sizeof(hdev->short_name))) {
3237 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3238 data, len);
3239 goto failed;
3240 }
3241
3242 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3243
3244 if (!hdev_is_powered(hdev)) {
3245 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3246
3247 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3248 data, len);
3249 if (err < 0)
3250 goto failed;
3251
3252 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3253 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3254 ext_info_changed(hdev, sk);
3255
3256 goto failed;
3257 }
3258
3259 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3260 if (!cmd) {
3261 err = -ENOMEM;
3262 goto failed;
3263 }
3264
3265 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3266
3267 hci_req_init(&req, hdev);
3268
3269 if (lmp_bredr_capable(hdev)) {
3270 __hci_req_update_name(&req);
3271 __hci_req_update_eir(&req);
3272 }
3273
3274 /* The name is stored in the scan response data and so
3275 * no need to udpate the advertising data here.
3276 */
3277 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3278 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3279
3280 err = hci_req_run(&req, set_name_complete);
3281 if (err < 0)
3282 mgmt_pending_remove(cmd);
3283
3284 failed:
3285 hci_dev_unlock(hdev);
3286 return err;
3287 }
3288
set_appearance(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3289 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3290 u16 len)
3291 {
3292 struct mgmt_cp_set_appearance *cp = data;
3293 u16 apperance;
3294 int err;
3295
3296 BT_DBG("");
3297
3298 if (!lmp_le_capable(hdev))
3299 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3300 MGMT_STATUS_NOT_SUPPORTED);
3301
3302 apperance = le16_to_cpu(cp->appearance);
3303
3304 hci_dev_lock(hdev);
3305
3306 if (hdev->appearance != apperance) {
3307 hdev->appearance = apperance;
3308
3309 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3310 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3311
3312 ext_info_changed(hdev, sk);
3313 }
3314
3315 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3316 0);
3317
3318 hci_dev_unlock(hdev);
3319
3320 return err;
3321 }
3322
get_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3323 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3324 void *data, u16 len)
3325 {
3326 struct mgmt_rp_get_phy_confguration rp;
3327
3328 BT_DBG("sock %p %s", sk, hdev->name);
3329
3330 hci_dev_lock(hdev);
3331
3332 memset(&rp, 0, sizeof(rp));
3333
3334 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3335 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3336 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3337
3338 hci_dev_unlock(hdev);
3339
3340 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3341 &rp, sizeof(rp));
3342 }
3343
mgmt_phy_configuration_changed(struct hci_dev * hdev,struct sock * skip)3344 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3345 {
3346 struct mgmt_ev_phy_configuration_changed ev;
3347
3348 memset(&ev, 0, sizeof(ev));
3349
3350 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3351
3352 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3353 sizeof(ev), skip);
3354 }
3355
set_default_phy_complete(struct hci_dev * hdev,u8 status,u16 opcode,struct sk_buff * skb)3356 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3357 u16 opcode, struct sk_buff *skb)
3358 {
3359 struct mgmt_pending_cmd *cmd;
3360
3361 BT_DBG("status 0x%02x", status);
3362
3363 hci_dev_lock(hdev);
3364
3365 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3366 if (!cmd)
3367 goto unlock;
3368
3369 if (status) {
3370 mgmt_cmd_status(cmd->sk, hdev->id,
3371 MGMT_OP_SET_PHY_CONFIGURATION,
3372 mgmt_status(status));
3373 } else {
3374 mgmt_cmd_complete(cmd->sk, hdev->id,
3375 MGMT_OP_SET_PHY_CONFIGURATION, 0,
3376 NULL, 0);
3377
3378 mgmt_phy_configuration_changed(hdev, cmd->sk);
3379 }
3380
3381 mgmt_pending_remove(cmd);
3382
3383 unlock:
3384 hci_dev_unlock(hdev);
3385 }
3386
set_phy_configuration(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3387 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3388 void *data, u16 len)
3389 {
3390 struct mgmt_cp_set_phy_confguration *cp = data;
3391 struct hci_cp_le_set_default_phy cp_phy;
3392 struct mgmt_pending_cmd *cmd;
3393 struct hci_request req;
3394 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3395 u16 pkt_type = (HCI_DH1 | HCI_DM1);
3396 bool changed = false;
3397 int err;
3398
3399 BT_DBG("sock %p %s", sk, hdev->name);
3400
3401 configurable_phys = get_configurable_phys(hdev);
3402 supported_phys = get_supported_phys(hdev);
3403 selected_phys = __le32_to_cpu(cp->selected_phys);
3404
3405 if (selected_phys & ~supported_phys)
3406 return mgmt_cmd_status(sk, hdev->id,
3407 MGMT_OP_SET_PHY_CONFIGURATION,
3408 MGMT_STATUS_INVALID_PARAMS);
3409
3410 unconfigure_phys = supported_phys & ~configurable_phys;
3411
3412 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3413 return mgmt_cmd_status(sk, hdev->id,
3414 MGMT_OP_SET_PHY_CONFIGURATION,
3415 MGMT_STATUS_INVALID_PARAMS);
3416
3417 if (selected_phys == get_selected_phys(hdev))
3418 return mgmt_cmd_complete(sk, hdev->id,
3419 MGMT_OP_SET_PHY_CONFIGURATION,
3420 0, NULL, 0);
3421
3422 hci_dev_lock(hdev);
3423
3424 if (!hdev_is_powered(hdev)) {
3425 err = mgmt_cmd_status(sk, hdev->id,
3426 MGMT_OP_SET_PHY_CONFIGURATION,
3427 MGMT_STATUS_REJECTED);
3428 goto unlock;
3429 }
3430
3431 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3432 err = mgmt_cmd_status(sk, hdev->id,
3433 MGMT_OP_SET_PHY_CONFIGURATION,
3434 MGMT_STATUS_BUSY);
3435 goto unlock;
3436 }
3437
3438 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3439 pkt_type |= (HCI_DH3 | HCI_DM3);
3440 else
3441 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3442
3443 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3444 pkt_type |= (HCI_DH5 | HCI_DM5);
3445 else
3446 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3447
3448 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3449 pkt_type &= ~HCI_2DH1;
3450 else
3451 pkt_type |= HCI_2DH1;
3452
3453 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3454 pkt_type &= ~HCI_2DH3;
3455 else
3456 pkt_type |= HCI_2DH3;
3457
3458 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3459 pkt_type &= ~HCI_2DH5;
3460 else
3461 pkt_type |= HCI_2DH5;
3462
3463 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3464 pkt_type &= ~HCI_3DH1;
3465 else
3466 pkt_type |= HCI_3DH1;
3467
3468 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3469 pkt_type &= ~HCI_3DH3;
3470 else
3471 pkt_type |= HCI_3DH3;
3472
3473 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3474 pkt_type &= ~HCI_3DH5;
3475 else
3476 pkt_type |= HCI_3DH5;
3477
3478 if (pkt_type != hdev->pkt_type) {
3479 hdev->pkt_type = pkt_type;
3480 changed = true;
3481 }
3482
3483 if ((selected_phys & MGMT_PHY_LE_MASK) ==
3484 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3485 if (changed)
3486 mgmt_phy_configuration_changed(hdev, sk);
3487
3488 err = mgmt_cmd_complete(sk, hdev->id,
3489 MGMT_OP_SET_PHY_CONFIGURATION,
3490 0, NULL, 0);
3491
3492 goto unlock;
3493 }
3494
3495 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3496 len);
3497 if (!cmd) {
3498 err = -ENOMEM;
3499 goto unlock;
3500 }
3501
3502 hci_req_init(&req, hdev);
3503
3504 memset(&cp_phy, 0, sizeof(cp_phy));
3505
3506 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3507 cp_phy.all_phys |= 0x01;
3508
3509 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3510 cp_phy.all_phys |= 0x02;
3511
3512 if (selected_phys & MGMT_PHY_LE_1M_TX)
3513 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3514
3515 if (selected_phys & MGMT_PHY_LE_2M_TX)
3516 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3517
3518 if (selected_phys & MGMT_PHY_LE_CODED_TX)
3519 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3520
3521 if (selected_phys & MGMT_PHY_LE_1M_RX)
3522 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3523
3524 if (selected_phys & MGMT_PHY_LE_2M_RX)
3525 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3526
3527 if (selected_phys & MGMT_PHY_LE_CODED_RX)
3528 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3529
3530 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3531
3532 err = hci_req_run_skb(&req, set_default_phy_complete);
3533 if (err < 0)
3534 mgmt_pending_remove(cmd);
3535
3536 unlock:
3537 hci_dev_unlock(hdev);
3538
3539 return err;
3540 }
3541
read_local_oob_data_complete(struct hci_dev * hdev,u8 status,u16 opcode,struct sk_buff * skb)3542 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3543 u16 opcode, struct sk_buff *skb)
3544 {
3545 struct mgmt_rp_read_local_oob_data mgmt_rp;
3546 size_t rp_size = sizeof(mgmt_rp);
3547 struct mgmt_pending_cmd *cmd;
3548
3549 BT_DBG("%s status %u", hdev->name, status);
3550
3551 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3552 if (!cmd)
3553 return;
3554
3555 if (status || !skb) {
3556 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3557 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3558 goto remove;
3559 }
3560
3561 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3562
3563 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3564 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3565
3566 if (skb->len < sizeof(*rp)) {
3567 mgmt_cmd_status(cmd->sk, hdev->id,
3568 MGMT_OP_READ_LOCAL_OOB_DATA,
3569 MGMT_STATUS_FAILED);
3570 goto remove;
3571 }
3572
3573 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3574 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3575
3576 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3577 } else {
3578 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3579
3580 if (skb->len < sizeof(*rp)) {
3581 mgmt_cmd_status(cmd->sk, hdev->id,
3582 MGMT_OP_READ_LOCAL_OOB_DATA,
3583 MGMT_STATUS_FAILED);
3584 goto remove;
3585 }
3586
3587 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3588 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3589
3590 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3591 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3592 }
3593
3594 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3595 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3596
3597 remove:
3598 mgmt_pending_remove(cmd);
3599 }
3600
read_local_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)3601 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3602 void *data, u16 data_len)
3603 {
3604 struct mgmt_pending_cmd *cmd;
3605 struct hci_request req;
3606 int err;
3607
3608 BT_DBG("%s", hdev->name);
3609
3610 hci_dev_lock(hdev);
3611
3612 if (!hdev_is_powered(hdev)) {
3613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3614 MGMT_STATUS_NOT_POWERED);
3615 goto unlock;
3616 }
3617
3618 if (!lmp_ssp_capable(hdev)) {
3619 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3620 MGMT_STATUS_NOT_SUPPORTED);
3621 goto unlock;
3622 }
3623
3624 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3625 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3626 MGMT_STATUS_BUSY);
3627 goto unlock;
3628 }
3629
3630 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3631 if (!cmd) {
3632 err = -ENOMEM;
3633 goto unlock;
3634 }
3635
3636 hci_req_init(&req, hdev);
3637
3638 if (bredr_sc_enabled(hdev))
3639 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3640 else
3641 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3642
3643 err = hci_req_run_skb(&req, read_local_oob_data_complete);
3644 if (err < 0)
3645 mgmt_pending_remove(cmd);
3646
3647 unlock:
3648 hci_dev_unlock(hdev);
3649 return err;
3650 }
3651
add_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3652 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3653 void *data, u16 len)
3654 {
3655 struct mgmt_addr_info *addr = data;
3656 int err;
3657
3658 BT_DBG("%s ", hdev->name);
3659
3660 if (!bdaddr_type_is_valid(addr->type))
3661 return mgmt_cmd_complete(sk, hdev->id,
3662 MGMT_OP_ADD_REMOTE_OOB_DATA,
3663 MGMT_STATUS_INVALID_PARAMS,
3664 addr, sizeof(*addr));
3665
3666 hci_dev_lock(hdev);
3667
3668 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3669 struct mgmt_cp_add_remote_oob_data *cp = data;
3670 u8 status;
3671
3672 if (cp->addr.type != BDADDR_BREDR) {
3673 err = mgmt_cmd_complete(sk, hdev->id,
3674 MGMT_OP_ADD_REMOTE_OOB_DATA,
3675 MGMT_STATUS_INVALID_PARAMS,
3676 &cp->addr, sizeof(cp->addr));
3677 goto unlock;
3678 }
3679
3680 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3681 cp->addr.type, cp->hash,
3682 cp->rand, NULL, NULL);
3683 if (err < 0)
3684 status = MGMT_STATUS_FAILED;
3685 else
3686 status = MGMT_STATUS_SUCCESS;
3687
3688 err = mgmt_cmd_complete(sk, hdev->id,
3689 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3690 &cp->addr, sizeof(cp->addr));
3691 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3692 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3693 u8 *rand192, *hash192, *rand256, *hash256;
3694 u8 status;
3695
3696 if (bdaddr_type_is_le(cp->addr.type)) {
3697 /* Enforce zero-valued 192-bit parameters as
3698 * long as legacy SMP OOB isn't implemented.
3699 */
3700 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3701 memcmp(cp->hash192, ZERO_KEY, 16)) {
3702 err = mgmt_cmd_complete(sk, hdev->id,
3703 MGMT_OP_ADD_REMOTE_OOB_DATA,
3704 MGMT_STATUS_INVALID_PARAMS,
3705 addr, sizeof(*addr));
3706 goto unlock;
3707 }
3708
3709 rand192 = NULL;
3710 hash192 = NULL;
3711 } else {
3712 /* In case one of the P-192 values is set to zero,
3713 * then just disable OOB data for P-192.
3714 */
3715 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3716 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3717 rand192 = NULL;
3718 hash192 = NULL;
3719 } else {
3720 rand192 = cp->rand192;
3721 hash192 = cp->hash192;
3722 }
3723 }
3724
3725 /* In case one of the P-256 values is set to zero, then just
3726 * disable OOB data for P-256.
3727 */
3728 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3729 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3730 rand256 = NULL;
3731 hash256 = NULL;
3732 } else {
3733 rand256 = cp->rand256;
3734 hash256 = cp->hash256;
3735 }
3736
3737 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3738 cp->addr.type, hash192, rand192,
3739 hash256, rand256);
3740 if (err < 0)
3741 status = MGMT_STATUS_FAILED;
3742 else
3743 status = MGMT_STATUS_SUCCESS;
3744
3745 err = mgmt_cmd_complete(sk, hdev->id,
3746 MGMT_OP_ADD_REMOTE_OOB_DATA,
3747 status, &cp->addr, sizeof(cp->addr));
3748 } else {
3749 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3750 len);
3751 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3752 MGMT_STATUS_INVALID_PARAMS);
3753 }
3754
3755 unlock:
3756 hci_dev_unlock(hdev);
3757 return err;
3758 }
3759
remove_remote_oob_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3760 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3761 void *data, u16 len)
3762 {
3763 struct mgmt_cp_remove_remote_oob_data *cp = data;
3764 u8 status;
3765 int err;
3766
3767 BT_DBG("%s", hdev->name);
3768
3769 if (cp->addr.type != BDADDR_BREDR)
3770 return mgmt_cmd_complete(sk, hdev->id,
3771 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3772 MGMT_STATUS_INVALID_PARAMS,
3773 &cp->addr, sizeof(cp->addr));
3774
3775 hci_dev_lock(hdev);
3776
3777 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3778 hci_remote_oob_data_clear(hdev);
3779 status = MGMT_STATUS_SUCCESS;
3780 goto done;
3781 }
3782
3783 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3784 if (err < 0)
3785 status = MGMT_STATUS_INVALID_PARAMS;
3786 else
3787 status = MGMT_STATUS_SUCCESS;
3788
3789 done:
3790 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3791 status, &cp->addr, sizeof(cp->addr));
3792
3793 hci_dev_unlock(hdev);
3794 return err;
3795 }
3796
mgmt_start_discovery_complete(struct hci_dev * hdev,u8 status)3797 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3798 {
3799 struct mgmt_pending_cmd *cmd;
3800
3801 BT_DBG("status %d", status);
3802
3803 hci_dev_lock(hdev);
3804
3805 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3806 if (!cmd)
3807 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3808
3809 if (!cmd)
3810 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3811
3812 if (cmd) {
3813 cmd->cmd_complete(cmd, mgmt_status(status));
3814 mgmt_pending_remove(cmd);
3815 }
3816
3817 hci_dev_unlock(hdev);
3818 }
3819
discovery_type_is_valid(struct hci_dev * hdev,uint8_t type,uint8_t * mgmt_status)3820 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3821 uint8_t *mgmt_status)
3822 {
3823 switch (type) {
3824 case DISCOV_TYPE_LE:
3825 *mgmt_status = mgmt_le_support(hdev);
3826 if (*mgmt_status)
3827 return false;
3828 break;
3829 case DISCOV_TYPE_INTERLEAVED:
3830 *mgmt_status = mgmt_le_support(hdev);
3831 if (*mgmt_status)
3832 return false;
3833 /* Intentional fall-through */
3834 case DISCOV_TYPE_BREDR:
3835 *mgmt_status = mgmt_bredr_support(hdev);
3836 if (*mgmt_status)
3837 return false;
3838 break;
3839 default:
3840 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3841 return false;
3842 }
3843
3844 return true;
3845 }
3846
start_discovery_internal(struct sock * sk,struct hci_dev * hdev,u16 op,void * data,u16 len)3847 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3848 u16 op, void *data, u16 len)
3849 {
3850 struct mgmt_cp_start_discovery *cp = data;
3851 struct mgmt_pending_cmd *cmd;
3852 u8 status;
3853 int err;
3854
3855 BT_DBG("%s", hdev->name);
3856
3857 hci_dev_lock(hdev);
3858
3859 if (!hdev_is_powered(hdev)) {
3860 err = mgmt_cmd_complete(sk, hdev->id, op,
3861 MGMT_STATUS_NOT_POWERED,
3862 &cp->type, sizeof(cp->type));
3863 goto failed;
3864 }
3865
3866 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3867 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3868 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3869 &cp->type, sizeof(cp->type));
3870 goto failed;
3871 }
3872
3873 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3874 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3875 &cp->type, sizeof(cp->type));
3876 goto failed;
3877 }
3878
3879 /* Clear the discovery filter first to free any previously
3880 * allocated memory for the UUID list.
3881 */
3882 hci_discovery_filter_clear(hdev);
3883
3884 hdev->discovery.type = cp->type;
3885 hdev->discovery.report_invalid_rssi = false;
3886 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3887 hdev->discovery.limited = true;
3888 else
3889 hdev->discovery.limited = false;
3890
3891 cmd = mgmt_pending_add(sk, op, hdev, data, len);
3892 if (!cmd) {
3893 err = -ENOMEM;
3894 goto failed;
3895 }
3896
3897 cmd->cmd_complete = generic_cmd_complete;
3898
3899 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3900 queue_work(hdev->req_workqueue, &hdev->discov_update);
3901 err = 0;
3902
3903 failed:
3904 hci_dev_unlock(hdev);
3905 return err;
3906 }
3907
start_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3908 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3909 void *data, u16 len)
3910 {
3911 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3912 data, len);
3913 }
3914
start_limited_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3915 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3916 void *data, u16 len)
3917 {
3918 return start_discovery_internal(sk, hdev,
3919 MGMT_OP_START_LIMITED_DISCOVERY,
3920 data, len);
3921 }
3922
service_discovery_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)3923 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3924 u8 status)
3925 {
3926 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3927 cmd->param, 1);
3928 }
3929
start_service_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)3930 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3931 void *data, u16 len)
3932 {
3933 struct mgmt_cp_start_service_discovery *cp = data;
3934 struct mgmt_pending_cmd *cmd;
3935 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3936 u16 uuid_count, expected_len;
3937 u8 status;
3938 int err;
3939
3940 BT_DBG("%s", hdev->name);
3941
3942 hci_dev_lock(hdev);
3943
3944 if (!hdev_is_powered(hdev)) {
3945 err = mgmt_cmd_complete(sk, hdev->id,
3946 MGMT_OP_START_SERVICE_DISCOVERY,
3947 MGMT_STATUS_NOT_POWERED,
3948 &cp->type, sizeof(cp->type));
3949 goto failed;
3950 }
3951
3952 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3953 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3954 err = mgmt_cmd_complete(sk, hdev->id,
3955 MGMT_OP_START_SERVICE_DISCOVERY,
3956 MGMT_STATUS_BUSY, &cp->type,
3957 sizeof(cp->type));
3958 goto failed;
3959 }
3960
3961 uuid_count = __le16_to_cpu(cp->uuid_count);
3962 if (uuid_count > max_uuid_count) {
3963 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3964 uuid_count);
3965 err = mgmt_cmd_complete(sk, hdev->id,
3966 MGMT_OP_START_SERVICE_DISCOVERY,
3967 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3968 sizeof(cp->type));
3969 goto failed;
3970 }
3971
3972 expected_len = sizeof(*cp) + uuid_count * 16;
3973 if (expected_len != len) {
3974 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3975 expected_len, len);
3976 err = mgmt_cmd_complete(sk, hdev->id,
3977 MGMT_OP_START_SERVICE_DISCOVERY,
3978 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3979 sizeof(cp->type));
3980 goto failed;
3981 }
3982
3983 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3984 err = mgmt_cmd_complete(sk, hdev->id,
3985 MGMT_OP_START_SERVICE_DISCOVERY,
3986 status, &cp->type, sizeof(cp->type));
3987 goto failed;
3988 }
3989
3990 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3991 hdev, data, len);
3992 if (!cmd) {
3993 err = -ENOMEM;
3994 goto failed;
3995 }
3996
3997 cmd->cmd_complete = service_discovery_cmd_complete;
3998
3999 /* Clear the discovery filter first to free any previously
4000 * allocated memory for the UUID list.
4001 */
4002 hci_discovery_filter_clear(hdev);
4003
4004 hdev->discovery.result_filtering = true;
4005 hdev->discovery.type = cp->type;
4006 hdev->discovery.rssi = cp->rssi;
4007 hdev->discovery.uuid_count = uuid_count;
4008
4009 if (uuid_count > 0) {
4010 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4011 GFP_KERNEL);
4012 if (!hdev->discovery.uuids) {
4013 err = mgmt_cmd_complete(sk, hdev->id,
4014 MGMT_OP_START_SERVICE_DISCOVERY,
4015 MGMT_STATUS_FAILED,
4016 &cp->type, sizeof(cp->type));
4017 mgmt_pending_remove(cmd);
4018 goto failed;
4019 }
4020 }
4021
4022 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4023 queue_work(hdev->req_workqueue, &hdev->discov_update);
4024 err = 0;
4025
4026 failed:
4027 hci_dev_unlock(hdev);
4028 return err;
4029 }
4030
mgmt_stop_discovery_complete(struct hci_dev * hdev,u8 status)4031 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4032 {
4033 struct mgmt_pending_cmd *cmd;
4034
4035 BT_DBG("status %d", status);
4036
4037 hci_dev_lock(hdev);
4038
4039 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4040 if (cmd) {
4041 cmd->cmd_complete(cmd, mgmt_status(status));
4042 mgmt_pending_remove(cmd);
4043 }
4044
4045 hci_dev_unlock(hdev);
4046 }
4047
stop_discovery(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4048 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4049 u16 len)
4050 {
4051 struct mgmt_cp_stop_discovery *mgmt_cp = data;
4052 struct mgmt_pending_cmd *cmd;
4053 int err;
4054
4055 BT_DBG("%s", hdev->name);
4056
4057 hci_dev_lock(hdev);
4058
4059 if (!hci_discovery_active(hdev)) {
4060 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4061 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4062 sizeof(mgmt_cp->type));
4063 goto unlock;
4064 }
4065
4066 if (hdev->discovery.type != mgmt_cp->type) {
4067 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4068 MGMT_STATUS_INVALID_PARAMS,
4069 &mgmt_cp->type, sizeof(mgmt_cp->type));
4070 goto unlock;
4071 }
4072
4073 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4074 if (!cmd) {
4075 err = -ENOMEM;
4076 goto unlock;
4077 }
4078
4079 cmd->cmd_complete = generic_cmd_complete;
4080
4081 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4082 queue_work(hdev->req_workqueue, &hdev->discov_update);
4083 err = 0;
4084
4085 unlock:
4086 hci_dev_unlock(hdev);
4087 return err;
4088 }
4089
confirm_name(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4090 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4091 u16 len)
4092 {
4093 struct mgmt_cp_confirm_name *cp = data;
4094 struct inquiry_entry *e;
4095 int err;
4096
4097 BT_DBG("%s", hdev->name);
4098
4099 hci_dev_lock(hdev);
4100
4101 if (!hci_discovery_active(hdev)) {
4102 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103 MGMT_STATUS_FAILED, &cp->addr,
4104 sizeof(cp->addr));
4105 goto failed;
4106 }
4107
4108 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4109 if (!e) {
4110 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4111 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4112 sizeof(cp->addr));
4113 goto failed;
4114 }
4115
4116 if (cp->name_known) {
4117 e->name_state = NAME_KNOWN;
4118 list_del(&e->list);
4119 } else {
4120 e->name_state = NAME_NEEDED;
4121 hci_inquiry_cache_update_resolve(hdev, e);
4122 }
4123
4124 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4125 &cp->addr, sizeof(cp->addr));
4126
4127 failed:
4128 hci_dev_unlock(hdev);
4129 return err;
4130 }
4131
block_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4132 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4133 u16 len)
4134 {
4135 struct mgmt_cp_block_device *cp = data;
4136 u8 status;
4137 int err;
4138
4139 BT_DBG("%s", hdev->name);
4140
4141 if (!bdaddr_type_is_valid(cp->addr.type))
4142 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4143 MGMT_STATUS_INVALID_PARAMS,
4144 &cp->addr, sizeof(cp->addr));
4145
4146 hci_dev_lock(hdev);
4147
4148 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4149 cp->addr.type);
4150 if (err < 0) {
4151 status = MGMT_STATUS_FAILED;
4152 goto done;
4153 }
4154
4155 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4156 sk);
4157 status = MGMT_STATUS_SUCCESS;
4158
4159 done:
4160 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4161 &cp->addr, sizeof(cp->addr));
4162
4163 hci_dev_unlock(hdev);
4164
4165 return err;
4166 }
4167
unblock_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4168 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4169 u16 len)
4170 {
4171 struct mgmt_cp_unblock_device *cp = data;
4172 u8 status;
4173 int err;
4174
4175 BT_DBG("%s", hdev->name);
4176
4177 if (!bdaddr_type_is_valid(cp->addr.type))
4178 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4179 MGMT_STATUS_INVALID_PARAMS,
4180 &cp->addr, sizeof(cp->addr));
4181
4182 hci_dev_lock(hdev);
4183
4184 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4185 cp->addr.type);
4186 if (err < 0) {
4187 status = MGMT_STATUS_INVALID_PARAMS;
4188 goto done;
4189 }
4190
4191 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4192 sk);
4193 status = MGMT_STATUS_SUCCESS;
4194
4195 done:
4196 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4197 &cp->addr, sizeof(cp->addr));
4198
4199 hci_dev_unlock(hdev);
4200
4201 return err;
4202 }
4203
set_device_id(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4204 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4205 u16 len)
4206 {
4207 struct mgmt_cp_set_device_id *cp = data;
4208 struct hci_request req;
4209 int err;
4210 __u16 source;
4211
4212 BT_DBG("%s", hdev->name);
4213
4214 source = __le16_to_cpu(cp->source);
4215
4216 if (source > 0x0002)
4217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4218 MGMT_STATUS_INVALID_PARAMS);
4219
4220 hci_dev_lock(hdev);
4221
4222 hdev->devid_source = source;
4223 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4224 hdev->devid_product = __le16_to_cpu(cp->product);
4225 hdev->devid_version = __le16_to_cpu(cp->version);
4226
4227 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4228 NULL, 0);
4229
4230 hci_req_init(&req, hdev);
4231 __hci_req_update_eir(&req);
4232 hci_req_run(&req, NULL);
4233
4234 hci_dev_unlock(hdev);
4235
4236 return err;
4237 }
4238
enable_advertising_instance(struct hci_dev * hdev,u8 status,u16 opcode)4239 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4240 u16 opcode)
4241 {
4242 BT_DBG("status %d", status);
4243 }
4244
set_advertising_complete(struct hci_dev * hdev,u8 status,u16 opcode)4245 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4246 u16 opcode)
4247 {
4248 struct cmd_lookup match = { NULL, hdev };
4249 struct hci_request req;
4250 u8 instance;
4251 struct adv_info *adv_instance;
4252 int err;
4253
4254 hci_dev_lock(hdev);
4255
4256 if (status) {
4257 u8 mgmt_err = mgmt_status(status);
4258
4259 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4260 cmd_status_rsp, &mgmt_err);
4261 goto unlock;
4262 }
4263
4264 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4265 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4266 else
4267 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4268
4269 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4270 &match);
4271
4272 new_settings(hdev, match.sk);
4273
4274 if (match.sk)
4275 sock_put(match.sk);
4276
4277 /* If "Set Advertising" was just disabled and instance advertising was
4278 * set up earlier, then re-enable multi-instance advertising.
4279 */
4280 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4281 list_empty(&hdev->adv_instances))
4282 goto unlock;
4283
4284 instance = hdev->cur_adv_instance;
4285 if (!instance) {
4286 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4287 struct adv_info, list);
4288 if (!adv_instance)
4289 goto unlock;
4290
4291 instance = adv_instance->instance;
4292 }
4293
4294 hci_req_init(&req, hdev);
4295
4296 err = __hci_req_schedule_adv_instance(&req, instance, true);
4297
4298 if (!err)
4299 err = hci_req_run(&req, enable_advertising_instance);
4300
4301 if (err)
4302 bt_dev_err(hdev, "failed to re-configure advertising");
4303
4304 unlock:
4305 hci_dev_unlock(hdev);
4306 }
4307
set_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4308 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4309 u16 len)
4310 {
4311 struct mgmt_mode *cp = data;
4312 struct mgmt_pending_cmd *cmd;
4313 struct hci_request req;
4314 u8 val, status;
4315 int err;
4316
4317 BT_DBG("request for %s", hdev->name);
4318
4319 status = mgmt_le_support(hdev);
4320 if (status)
4321 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4322 status);
4323
4324 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4325 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4326 MGMT_STATUS_INVALID_PARAMS);
4327
4328 hci_dev_lock(hdev);
4329
4330 val = !!cp->val;
4331
4332 /* The following conditions are ones which mean that we should
4333 * not do any HCI communication but directly send a mgmt
4334 * response to user space (after toggling the flag if
4335 * necessary).
4336 */
4337 if (!hdev_is_powered(hdev) ||
4338 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4339 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4340 hci_conn_num(hdev, LE_LINK) > 0 ||
4341 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4342 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4343 bool changed;
4344
4345 if (cp->val) {
4346 hdev->cur_adv_instance = 0x00;
4347 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4348 if (cp->val == 0x02)
4349 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4350 else
4351 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4352 } else {
4353 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4354 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4355 }
4356
4357 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4358 if (err < 0)
4359 goto unlock;
4360
4361 if (changed)
4362 err = new_settings(hdev, sk);
4363
4364 goto unlock;
4365 }
4366
4367 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4368 pending_find(MGMT_OP_SET_LE, hdev)) {
4369 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4370 MGMT_STATUS_BUSY);
4371 goto unlock;
4372 }
4373
4374 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4375 if (!cmd) {
4376 err = -ENOMEM;
4377 goto unlock;
4378 }
4379
4380 hci_req_init(&req, hdev);
4381
4382 if (cp->val == 0x02)
4383 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4384 else
4385 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4386
4387 cancel_adv_timeout(hdev);
4388
4389 if (val) {
4390 /* Switch to instance "0" for the Set Advertising setting.
4391 * We cannot use update_[adv|scan_rsp]_data() here as the
4392 * HCI_ADVERTISING flag is not yet set.
4393 */
4394 hdev->cur_adv_instance = 0x00;
4395
4396 if (ext_adv_capable(hdev)) {
4397 __hci_req_start_ext_adv(&req, 0x00);
4398 } else {
4399 __hci_req_update_adv_data(&req, 0x00);
4400 __hci_req_update_scan_rsp_data(&req, 0x00);
4401 __hci_req_enable_advertising(&req);
4402 }
4403 } else {
4404 __hci_req_disable_advertising(&req);
4405 }
4406
4407 err = hci_req_run(&req, set_advertising_complete);
4408 if (err < 0)
4409 mgmt_pending_remove(cmd);
4410
4411 unlock:
4412 hci_dev_unlock(hdev);
4413 return err;
4414 }
4415
set_static_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4416 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4417 void *data, u16 len)
4418 {
4419 struct mgmt_cp_set_static_address *cp = data;
4420 int err;
4421
4422 BT_DBG("%s", hdev->name);
4423
4424 if (!lmp_le_capable(hdev))
4425 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4426 MGMT_STATUS_NOT_SUPPORTED);
4427
4428 if (hdev_is_powered(hdev))
4429 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4430 MGMT_STATUS_REJECTED);
4431
4432 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4433 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4434 return mgmt_cmd_status(sk, hdev->id,
4435 MGMT_OP_SET_STATIC_ADDRESS,
4436 MGMT_STATUS_INVALID_PARAMS);
4437
4438 /* Two most significant bits shall be set */
4439 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4440 return mgmt_cmd_status(sk, hdev->id,
4441 MGMT_OP_SET_STATIC_ADDRESS,
4442 MGMT_STATUS_INVALID_PARAMS);
4443 }
4444
4445 hci_dev_lock(hdev);
4446
4447 bacpy(&hdev->static_addr, &cp->bdaddr);
4448
4449 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4450 if (err < 0)
4451 goto unlock;
4452
4453 err = new_settings(hdev, sk);
4454
4455 unlock:
4456 hci_dev_unlock(hdev);
4457 return err;
4458 }
4459
set_scan_params(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4460 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4461 void *data, u16 len)
4462 {
4463 struct mgmt_cp_set_scan_params *cp = data;
4464 __u16 interval, window;
4465 int err;
4466
4467 BT_DBG("%s", hdev->name);
4468
4469 if (!lmp_le_capable(hdev))
4470 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4471 MGMT_STATUS_NOT_SUPPORTED);
4472
4473 interval = __le16_to_cpu(cp->interval);
4474
4475 if (interval < 0x0004 || interval > 0x4000)
4476 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4477 MGMT_STATUS_INVALID_PARAMS);
4478
4479 window = __le16_to_cpu(cp->window);
4480
4481 if (window < 0x0004 || window > 0x4000)
4482 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4483 MGMT_STATUS_INVALID_PARAMS);
4484
4485 if (window > interval)
4486 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4487 MGMT_STATUS_INVALID_PARAMS);
4488
4489 hci_dev_lock(hdev);
4490
4491 hdev->le_scan_interval = interval;
4492 hdev->le_scan_window = window;
4493
4494 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4495 NULL, 0);
4496
4497 /* If background scan is running, restart it so new parameters are
4498 * loaded.
4499 */
4500 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4501 hdev->discovery.state == DISCOVERY_STOPPED) {
4502 struct hci_request req;
4503
4504 hci_req_init(&req, hdev);
4505
4506 hci_req_add_le_scan_disable(&req);
4507 hci_req_add_le_passive_scan(&req);
4508
4509 hci_req_run(&req, NULL);
4510 }
4511
4512 hci_dev_unlock(hdev);
4513
4514 return err;
4515 }
4516
fast_connectable_complete(struct hci_dev * hdev,u8 status,u16 opcode)4517 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4518 u16 opcode)
4519 {
4520 struct mgmt_pending_cmd *cmd;
4521
4522 BT_DBG("status 0x%02x", status);
4523
4524 hci_dev_lock(hdev);
4525
4526 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4527 if (!cmd)
4528 goto unlock;
4529
4530 if (status) {
4531 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4532 mgmt_status(status));
4533 } else {
4534 struct mgmt_mode *cp = cmd->param;
4535
4536 if (cp->val)
4537 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4538 else
4539 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4540
4541 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4542 new_settings(hdev, cmd->sk);
4543 }
4544
4545 mgmt_pending_remove(cmd);
4546
4547 unlock:
4548 hci_dev_unlock(hdev);
4549 }
4550
set_fast_connectable(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4551 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4552 void *data, u16 len)
4553 {
4554 struct mgmt_mode *cp = data;
4555 struct mgmt_pending_cmd *cmd;
4556 struct hci_request req;
4557 int err;
4558
4559 BT_DBG("%s", hdev->name);
4560
4561 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4562 hdev->hci_ver < BLUETOOTH_VER_1_2)
4563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4564 MGMT_STATUS_NOT_SUPPORTED);
4565
4566 if (cp->val != 0x00 && cp->val != 0x01)
4567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4568 MGMT_STATUS_INVALID_PARAMS);
4569
4570 hci_dev_lock(hdev);
4571
4572 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4573 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4574 MGMT_STATUS_BUSY);
4575 goto unlock;
4576 }
4577
4578 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4579 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4580 hdev);
4581 goto unlock;
4582 }
4583
4584 if (!hdev_is_powered(hdev)) {
4585 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4586 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4587 hdev);
4588 new_settings(hdev, sk);
4589 goto unlock;
4590 }
4591
4592 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4593 data, len);
4594 if (!cmd) {
4595 err = -ENOMEM;
4596 goto unlock;
4597 }
4598
4599 hci_req_init(&req, hdev);
4600
4601 __hci_req_write_fast_connectable(&req, cp->val);
4602
4603 err = hci_req_run(&req, fast_connectable_complete);
4604 if (err < 0) {
4605 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4606 MGMT_STATUS_FAILED);
4607 mgmt_pending_remove(cmd);
4608 }
4609
4610 unlock:
4611 hci_dev_unlock(hdev);
4612
4613 return err;
4614 }
4615
set_bredr_complete(struct hci_dev * hdev,u8 status,u16 opcode)4616 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4617 {
4618 struct mgmt_pending_cmd *cmd;
4619
4620 BT_DBG("status 0x%02x", status);
4621
4622 hci_dev_lock(hdev);
4623
4624 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4625 if (!cmd)
4626 goto unlock;
4627
4628 if (status) {
4629 u8 mgmt_err = mgmt_status(status);
4630
4631 /* We need to restore the flag if related HCI commands
4632 * failed.
4633 */
4634 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4635
4636 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4637 } else {
4638 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4639 new_settings(hdev, cmd->sk);
4640 }
4641
4642 mgmt_pending_remove(cmd);
4643
4644 unlock:
4645 hci_dev_unlock(hdev);
4646 }
4647
set_bredr(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4648 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4649 {
4650 struct mgmt_mode *cp = data;
4651 struct mgmt_pending_cmd *cmd;
4652 struct hci_request req;
4653 int err;
4654
4655 BT_DBG("request for %s", hdev->name);
4656
4657 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4658 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659 MGMT_STATUS_NOT_SUPPORTED);
4660
4661 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4662 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4663 MGMT_STATUS_REJECTED);
4664
4665 if (cp->val != 0x00 && cp->val != 0x01)
4666 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4667 MGMT_STATUS_INVALID_PARAMS);
4668
4669 hci_dev_lock(hdev);
4670
4671 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4672 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4673 goto unlock;
4674 }
4675
4676 if (!hdev_is_powered(hdev)) {
4677 if (!cp->val) {
4678 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4679 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4680 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4681 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4682 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4683 }
4684
4685 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4686
4687 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4688 if (err < 0)
4689 goto unlock;
4690
4691 err = new_settings(hdev, sk);
4692 goto unlock;
4693 }
4694
4695 /* Reject disabling when powered on */
4696 if (!cp->val) {
4697 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4698 MGMT_STATUS_REJECTED);
4699 goto unlock;
4700 } else {
4701 /* When configuring a dual-mode controller to operate
4702 * with LE only and using a static address, then switching
4703 * BR/EDR back on is not allowed.
4704 *
4705 * Dual-mode controllers shall operate with the public
4706 * address as its identity address for BR/EDR and LE. So
4707 * reject the attempt to create an invalid configuration.
4708 *
4709 * The same restrictions applies when secure connections
4710 * has been enabled. For BR/EDR this is a controller feature
4711 * while for LE it is a host stack feature. This means that
4712 * switching BR/EDR back on when secure connections has been
4713 * enabled is not a supported transaction.
4714 */
4715 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4716 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4717 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4718 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4719 MGMT_STATUS_REJECTED);
4720 goto unlock;
4721 }
4722 }
4723
4724 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4725 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4726 MGMT_STATUS_BUSY);
4727 goto unlock;
4728 }
4729
4730 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4731 if (!cmd) {
4732 err = -ENOMEM;
4733 goto unlock;
4734 }
4735
4736 /* We need to flip the bit already here so that
4737 * hci_req_update_adv_data generates the correct flags.
4738 */
4739 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4740
4741 hci_req_init(&req, hdev);
4742
4743 __hci_req_write_fast_connectable(&req, false);
4744 __hci_req_update_scan(&req);
4745
4746 /* Since only the advertising data flags will change, there
4747 * is no need to update the scan response data.
4748 */
4749 __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4750
4751 err = hci_req_run(&req, set_bredr_complete);
4752 if (err < 0)
4753 mgmt_pending_remove(cmd);
4754
4755 unlock:
4756 hci_dev_unlock(hdev);
4757 return err;
4758 }
4759
sc_enable_complete(struct hci_dev * hdev,u8 status,u16 opcode)4760 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4761 {
4762 struct mgmt_pending_cmd *cmd;
4763 struct mgmt_mode *cp;
4764
4765 BT_DBG("%s status %u", hdev->name, status);
4766
4767 hci_dev_lock(hdev);
4768
4769 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4770 if (!cmd)
4771 goto unlock;
4772
4773 if (status) {
4774 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4775 mgmt_status(status));
4776 goto remove;
4777 }
4778
4779 cp = cmd->param;
4780
4781 switch (cp->val) {
4782 case 0x00:
4783 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4784 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4785 break;
4786 case 0x01:
4787 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4788 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4789 break;
4790 case 0x02:
4791 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4792 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4793 break;
4794 }
4795
4796 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4797 new_settings(hdev, cmd->sk);
4798
4799 remove:
4800 mgmt_pending_remove(cmd);
4801 unlock:
4802 hci_dev_unlock(hdev);
4803 }
4804
set_secure_conn(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4805 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4806 void *data, u16 len)
4807 {
4808 struct mgmt_mode *cp = data;
4809 struct mgmt_pending_cmd *cmd;
4810 struct hci_request req;
4811 u8 val;
4812 int err;
4813
4814 BT_DBG("request for %s", hdev->name);
4815
4816 if (!lmp_sc_capable(hdev) &&
4817 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4818 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4819 MGMT_STATUS_NOT_SUPPORTED);
4820
4821 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4822 lmp_sc_capable(hdev) &&
4823 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4824 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4825 MGMT_STATUS_REJECTED);
4826
4827 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4828 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4829 MGMT_STATUS_INVALID_PARAMS);
4830
4831 hci_dev_lock(hdev);
4832
4833 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4834 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4835 bool changed;
4836
4837 if (cp->val) {
4838 changed = !hci_dev_test_and_set_flag(hdev,
4839 HCI_SC_ENABLED);
4840 if (cp->val == 0x02)
4841 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4842 else
4843 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4844 } else {
4845 changed = hci_dev_test_and_clear_flag(hdev,
4846 HCI_SC_ENABLED);
4847 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4848 }
4849
4850 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4851 if (err < 0)
4852 goto failed;
4853
4854 if (changed)
4855 err = new_settings(hdev, sk);
4856
4857 goto failed;
4858 }
4859
4860 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4861 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4862 MGMT_STATUS_BUSY);
4863 goto failed;
4864 }
4865
4866 val = !!cp->val;
4867
4868 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4869 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4870 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4871 goto failed;
4872 }
4873
4874 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4875 if (!cmd) {
4876 err = -ENOMEM;
4877 goto failed;
4878 }
4879
4880 hci_req_init(&req, hdev);
4881 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4882 err = hci_req_run(&req, sc_enable_complete);
4883 if (err < 0) {
4884 mgmt_pending_remove(cmd);
4885 goto failed;
4886 }
4887
4888 failed:
4889 hci_dev_unlock(hdev);
4890 return err;
4891 }
4892
set_debug_keys(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)4893 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4894 void *data, u16 len)
4895 {
4896 struct mgmt_mode *cp = data;
4897 bool changed, use_changed;
4898 int err;
4899
4900 BT_DBG("request for %s", hdev->name);
4901
4902 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4903 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4904 MGMT_STATUS_INVALID_PARAMS);
4905
4906 hci_dev_lock(hdev);
4907
4908 if (cp->val)
4909 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4910 else
4911 changed = hci_dev_test_and_clear_flag(hdev,
4912 HCI_KEEP_DEBUG_KEYS);
4913
4914 if (cp->val == 0x02)
4915 use_changed = !hci_dev_test_and_set_flag(hdev,
4916 HCI_USE_DEBUG_KEYS);
4917 else
4918 use_changed = hci_dev_test_and_clear_flag(hdev,
4919 HCI_USE_DEBUG_KEYS);
4920
4921 if (hdev_is_powered(hdev) && use_changed &&
4922 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4923 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4924 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4925 sizeof(mode), &mode);
4926 }
4927
4928 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4929 if (err < 0)
4930 goto unlock;
4931
4932 if (changed)
4933 err = new_settings(hdev, sk);
4934
4935 unlock:
4936 hci_dev_unlock(hdev);
4937 return err;
4938 }
4939
set_privacy(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)4940 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4941 u16 len)
4942 {
4943 struct mgmt_cp_set_privacy *cp = cp_data;
4944 bool changed;
4945 int err;
4946
4947 BT_DBG("request for %s", hdev->name);
4948
4949 if (!lmp_le_capable(hdev))
4950 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951 MGMT_STATUS_NOT_SUPPORTED);
4952
4953 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4954 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4955 MGMT_STATUS_INVALID_PARAMS);
4956
4957 if (hdev_is_powered(hdev))
4958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4959 MGMT_STATUS_REJECTED);
4960
4961 hci_dev_lock(hdev);
4962
4963 /* If user space supports this command it is also expected to
4964 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4965 */
4966 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4967
4968 if (cp->privacy) {
4969 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4970 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4971 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4972 hci_adv_instances_set_rpa_expired(hdev, true);
4973 if (cp->privacy == 0x02)
4974 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4975 else
4976 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4977 } else {
4978 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4979 memset(hdev->irk, 0, sizeof(hdev->irk));
4980 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4981 hci_adv_instances_set_rpa_expired(hdev, false);
4982 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4983 }
4984
4985 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4986 if (err < 0)
4987 goto unlock;
4988
4989 if (changed)
4990 err = new_settings(hdev, sk);
4991
4992 unlock:
4993 hci_dev_unlock(hdev);
4994 return err;
4995 }
4996
irk_is_valid(struct mgmt_irk_info * irk)4997 static bool irk_is_valid(struct mgmt_irk_info *irk)
4998 {
4999 switch (irk->addr.type) {
5000 case BDADDR_LE_PUBLIC:
5001 return true;
5002
5003 case BDADDR_LE_RANDOM:
5004 /* Two most significant bits shall be set */
5005 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5006 return false;
5007 return true;
5008 }
5009
5010 return false;
5011 }
5012
load_irks(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)5013 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5014 u16 len)
5015 {
5016 struct mgmt_cp_load_irks *cp = cp_data;
5017 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5018 sizeof(struct mgmt_irk_info));
5019 u16 irk_count, expected_len;
5020 int i, err;
5021
5022 BT_DBG("request for %s", hdev->name);
5023
5024 if (!lmp_le_capable(hdev))
5025 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5026 MGMT_STATUS_NOT_SUPPORTED);
5027
5028 irk_count = __le16_to_cpu(cp->irk_count);
5029 if (irk_count > max_irk_count) {
5030 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5031 irk_count);
5032 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033 MGMT_STATUS_INVALID_PARAMS);
5034 }
5035
5036 expected_len = struct_size(cp, irks, irk_count);
5037 if (expected_len != len) {
5038 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5039 expected_len, len);
5040 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5041 MGMT_STATUS_INVALID_PARAMS);
5042 }
5043
5044 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5045
5046 for (i = 0; i < irk_count; i++) {
5047 struct mgmt_irk_info *key = &cp->irks[i];
5048
5049 if (!irk_is_valid(key))
5050 return mgmt_cmd_status(sk, hdev->id,
5051 MGMT_OP_LOAD_IRKS,
5052 MGMT_STATUS_INVALID_PARAMS);
5053 }
5054
5055 hci_dev_lock(hdev);
5056
5057 hci_smp_irks_clear(hdev);
5058
5059 for (i = 0; i < irk_count; i++) {
5060 struct mgmt_irk_info *irk = &cp->irks[i];
5061
5062 hci_add_irk(hdev, &irk->addr.bdaddr,
5063 le_addr_type(irk->addr.type), irk->val,
5064 BDADDR_ANY);
5065 }
5066
5067 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5068
5069 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5070
5071 hci_dev_unlock(hdev);
5072
5073 return err;
5074 }
5075
ltk_is_valid(struct mgmt_ltk_info * key)5076 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5077 {
5078 if (key->master != 0x00 && key->master != 0x01)
5079 return false;
5080
5081 switch (key->addr.type) {
5082 case BDADDR_LE_PUBLIC:
5083 return true;
5084
5085 case BDADDR_LE_RANDOM:
5086 /* Two most significant bits shall be set */
5087 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5088 return false;
5089 return true;
5090 }
5091
5092 return false;
5093 }
5094
load_long_term_keys(struct sock * sk,struct hci_dev * hdev,void * cp_data,u16 len)5095 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5096 void *cp_data, u16 len)
5097 {
5098 struct mgmt_cp_load_long_term_keys *cp = cp_data;
5099 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5100 sizeof(struct mgmt_ltk_info));
5101 u16 key_count, expected_len;
5102 int i, err;
5103
5104 BT_DBG("request for %s", hdev->name);
5105
5106 if (!lmp_le_capable(hdev))
5107 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5108 MGMT_STATUS_NOT_SUPPORTED);
5109
5110 key_count = __le16_to_cpu(cp->key_count);
5111 if (key_count > max_key_count) {
5112 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5113 key_count);
5114 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115 MGMT_STATUS_INVALID_PARAMS);
5116 }
5117
5118 expected_len = struct_size(cp, keys, key_count);
5119 if (expected_len != len) {
5120 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5121 expected_len, len);
5122 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5123 MGMT_STATUS_INVALID_PARAMS);
5124 }
5125
5126 BT_DBG("%s key_count %u", hdev->name, key_count);
5127
5128 for (i = 0; i < key_count; i++) {
5129 struct mgmt_ltk_info *key = &cp->keys[i];
5130
5131 if (!ltk_is_valid(key))
5132 return mgmt_cmd_status(sk, hdev->id,
5133 MGMT_OP_LOAD_LONG_TERM_KEYS,
5134 MGMT_STATUS_INVALID_PARAMS);
5135 }
5136
5137 hci_dev_lock(hdev);
5138
5139 hci_smp_ltks_clear(hdev);
5140
5141 for (i = 0; i < key_count; i++) {
5142 struct mgmt_ltk_info *key = &cp->keys[i];
5143 u8 type, authenticated;
5144
5145 switch (key->type) {
5146 case MGMT_LTK_UNAUTHENTICATED:
5147 authenticated = 0x00;
5148 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5149 break;
5150 case MGMT_LTK_AUTHENTICATED:
5151 authenticated = 0x01;
5152 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5153 break;
5154 case MGMT_LTK_P256_UNAUTH:
5155 authenticated = 0x00;
5156 type = SMP_LTK_P256;
5157 break;
5158 case MGMT_LTK_P256_AUTH:
5159 authenticated = 0x01;
5160 type = SMP_LTK_P256;
5161 break;
5162 case MGMT_LTK_P256_DEBUG:
5163 authenticated = 0x00;
5164 type = SMP_LTK_P256_DEBUG;
5165 /* fall through */
5166 default:
5167 continue;
5168 }
5169
5170 hci_add_ltk(hdev, &key->addr.bdaddr,
5171 le_addr_type(key->addr.type), type, authenticated,
5172 key->val, key->enc_size, key->ediv, key->rand);
5173 }
5174
5175 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5176 NULL, 0);
5177
5178 hci_dev_unlock(hdev);
5179
5180 return err;
5181 }
5182
conn_info_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)5183 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5184 {
5185 struct hci_conn *conn = cmd->user_data;
5186 struct mgmt_rp_get_conn_info rp;
5187 int err;
5188
5189 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5190
5191 if (status == MGMT_STATUS_SUCCESS) {
5192 rp.rssi = conn->rssi;
5193 rp.tx_power = conn->tx_power;
5194 rp.max_tx_power = conn->max_tx_power;
5195 } else {
5196 rp.rssi = HCI_RSSI_INVALID;
5197 rp.tx_power = HCI_TX_POWER_INVALID;
5198 rp.max_tx_power = HCI_TX_POWER_INVALID;
5199 }
5200
5201 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5202 status, &rp, sizeof(rp));
5203
5204 hci_conn_drop(conn);
5205 hci_conn_put(conn);
5206
5207 return err;
5208 }
5209
conn_info_refresh_complete(struct hci_dev * hdev,u8 hci_status,u16 opcode)5210 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5211 u16 opcode)
5212 {
5213 struct hci_cp_read_rssi *cp;
5214 struct mgmt_pending_cmd *cmd;
5215 struct hci_conn *conn;
5216 u16 handle;
5217 u8 status;
5218
5219 BT_DBG("status 0x%02x", hci_status);
5220
5221 hci_dev_lock(hdev);
5222
5223 /* Commands sent in request are either Read RSSI or Read Transmit Power
5224 * Level so we check which one was last sent to retrieve connection
5225 * handle. Both commands have handle as first parameter so it's safe to
5226 * cast data on the same command struct.
5227 *
5228 * First command sent is always Read RSSI and we fail only if it fails.
5229 * In other case we simply override error to indicate success as we
5230 * already remembered if TX power value is actually valid.
5231 */
5232 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5233 if (!cp) {
5234 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5235 status = MGMT_STATUS_SUCCESS;
5236 } else {
5237 status = mgmt_status(hci_status);
5238 }
5239
5240 if (!cp) {
5241 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5242 goto unlock;
5243 }
5244
5245 handle = __le16_to_cpu(cp->handle);
5246 conn = hci_conn_hash_lookup_handle(hdev, handle);
5247 if (!conn) {
5248 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5249 handle);
5250 goto unlock;
5251 }
5252
5253 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5254 if (!cmd)
5255 goto unlock;
5256
5257 cmd->cmd_complete(cmd, status);
5258 mgmt_pending_remove(cmd);
5259
5260 unlock:
5261 hci_dev_unlock(hdev);
5262 }
5263
get_conn_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5264 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5265 u16 len)
5266 {
5267 struct mgmt_cp_get_conn_info *cp = data;
5268 struct mgmt_rp_get_conn_info rp;
5269 struct hci_conn *conn;
5270 unsigned long conn_info_age;
5271 int err = 0;
5272
5273 BT_DBG("%s", hdev->name);
5274
5275 memset(&rp, 0, sizeof(rp));
5276 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5277 rp.addr.type = cp->addr.type;
5278
5279 if (!bdaddr_type_is_valid(cp->addr.type))
5280 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5281 MGMT_STATUS_INVALID_PARAMS,
5282 &rp, sizeof(rp));
5283
5284 hci_dev_lock(hdev);
5285
5286 if (!hdev_is_powered(hdev)) {
5287 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5288 MGMT_STATUS_NOT_POWERED, &rp,
5289 sizeof(rp));
5290 goto unlock;
5291 }
5292
5293 if (cp->addr.type == BDADDR_BREDR)
5294 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5295 &cp->addr.bdaddr);
5296 else
5297 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5298
5299 if (!conn || conn->state != BT_CONNECTED) {
5300 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5301 MGMT_STATUS_NOT_CONNECTED, &rp,
5302 sizeof(rp));
5303 goto unlock;
5304 }
5305
5306 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5307 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5308 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5309 goto unlock;
5310 }
5311
5312 /* To avoid client trying to guess when to poll again for information we
5313 * calculate conn info age as random value between min/max set in hdev.
5314 */
5315 conn_info_age = hdev->conn_info_min_age +
5316 prandom_u32_max(hdev->conn_info_max_age -
5317 hdev->conn_info_min_age);
5318
5319 /* Query controller to refresh cached values if they are too old or were
5320 * never read.
5321 */
5322 if (time_after(jiffies, conn->conn_info_timestamp +
5323 msecs_to_jiffies(conn_info_age)) ||
5324 !conn->conn_info_timestamp) {
5325 struct hci_request req;
5326 struct hci_cp_read_tx_power req_txp_cp;
5327 struct hci_cp_read_rssi req_rssi_cp;
5328 struct mgmt_pending_cmd *cmd;
5329
5330 hci_req_init(&req, hdev);
5331 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5332 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5333 &req_rssi_cp);
5334
5335 /* For LE links TX power does not change thus we don't need to
5336 * query for it once value is known.
5337 */
5338 if (!bdaddr_type_is_le(cp->addr.type) ||
5339 conn->tx_power == HCI_TX_POWER_INVALID) {
5340 req_txp_cp.handle = cpu_to_le16(conn->handle);
5341 req_txp_cp.type = 0x00;
5342 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5343 sizeof(req_txp_cp), &req_txp_cp);
5344 }
5345
5346 /* Max TX power needs to be read only once per connection */
5347 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5348 req_txp_cp.handle = cpu_to_le16(conn->handle);
5349 req_txp_cp.type = 0x01;
5350 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5351 sizeof(req_txp_cp), &req_txp_cp);
5352 }
5353
5354 err = hci_req_run(&req, conn_info_refresh_complete);
5355 if (err < 0)
5356 goto unlock;
5357
5358 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5359 data, len);
5360 if (!cmd) {
5361 err = -ENOMEM;
5362 goto unlock;
5363 }
5364
5365 hci_conn_hold(conn);
5366 cmd->user_data = hci_conn_get(conn);
5367 cmd->cmd_complete = conn_info_cmd_complete;
5368
5369 conn->conn_info_timestamp = jiffies;
5370 } else {
5371 /* Cache is valid, just reply with values cached in hci_conn */
5372 rp.rssi = conn->rssi;
5373 rp.tx_power = conn->tx_power;
5374 rp.max_tx_power = conn->max_tx_power;
5375
5376 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5377 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5378 }
5379
5380 unlock:
5381 hci_dev_unlock(hdev);
5382 return err;
5383 }
5384
clock_info_cmd_complete(struct mgmt_pending_cmd * cmd,u8 status)5385 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5386 {
5387 struct hci_conn *conn = cmd->user_data;
5388 struct mgmt_rp_get_clock_info rp;
5389 struct hci_dev *hdev;
5390 int err;
5391
5392 memset(&rp, 0, sizeof(rp));
5393 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5394
5395 if (status)
5396 goto complete;
5397
5398 hdev = hci_dev_get(cmd->index);
5399 if (hdev) {
5400 rp.local_clock = cpu_to_le32(hdev->clock);
5401 hci_dev_put(hdev);
5402 }
5403
5404 if (conn) {
5405 rp.piconet_clock = cpu_to_le32(conn->clock);
5406 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5407 }
5408
5409 complete:
5410 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5411 sizeof(rp));
5412
5413 if (conn) {
5414 hci_conn_drop(conn);
5415 hci_conn_put(conn);
5416 }
5417
5418 return err;
5419 }
5420
get_clock_info_complete(struct hci_dev * hdev,u8 status,u16 opcode)5421 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5422 {
5423 struct hci_cp_read_clock *hci_cp;
5424 struct mgmt_pending_cmd *cmd;
5425 struct hci_conn *conn;
5426
5427 BT_DBG("%s status %u", hdev->name, status);
5428
5429 hci_dev_lock(hdev);
5430
5431 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5432 if (!hci_cp)
5433 goto unlock;
5434
5435 if (hci_cp->which) {
5436 u16 handle = __le16_to_cpu(hci_cp->handle);
5437 conn = hci_conn_hash_lookup_handle(hdev, handle);
5438 } else {
5439 conn = NULL;
5440 }
5441
5442 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5443 if (!cmd)
5444 goto unlock;
5445
5446 cmd->cmd_complete(cmd, mgmt_status(status));
5447 mgmt_pending_remove(cmd);
5448
5449 unlock:
5450 hci_dev_unlock(hdev);
5451 }
5452
get_clock_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5453 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5454 u16 len)
5455 {
5456 struct mgmt_cp_get_clock_info *cp = data;
5457 struct mgmt_rp_get_clock_info rp;
5458 struct hci_cp_read_clock hci_cp;
5459 struct mgmt_pending_cmd *cmd;
5460 struct hci_request req;
5461 struct hci_conn *conn;
5462 int err;
5463
5464 BT_DBG("%s", hdev->name);
5465
5466 memset(&rp, 0, sizeof(rp));
5467 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5468 rp.addr.type = cp->addr.type;
5469
5470 if (cp->addr.type != BDADDR_BREDR)
5471 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5472 MGMT_STATUS_INVALID_PARAMS,
5473 &rp, sizeof(rp));
5474
5475 hci_dev_lock(hdev);
5476
5477 if (!hdev_is_powered(hdev)) {
5478 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5479 MGMT_STATUS_NOT_POWERED, &rp,
5480 sizeof(rp));
5481 goto unlock;
5482 }
5483
5484 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5485 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5486 &cp->addr.bdaddr);
5487 if (!conn || conn->state != BT_CONNECTED) {
5488 err = mgmt_cmd_complete(sk, hdev->id,
5489 MGMT_OP_GET_CLOCK_INFO,
5490 MGMT_STATUS_NOT_CONNECTED,
5491 &rp, sizeof(rp));
5492 goto unlock;
5493 }
5494 } else {
5495 conn = NULL;
5496 }
5497
5498 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5499 if (!cmd) {
5500 err = -ENOMEM;
5501 goto unlock;
5502 }
5503
5504 cmd->cmd_complete = clock_info_cmd_complete;
5505
5506 hci_req_init(&req, hdev);
5507
5508 memset(&hci_cp, 0, sizeof(hci_cp));
5509 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5510
5511 if (conn) {
5512 hci_conn_hold(conn);
5513 cmd->user_data = hci_conn_get(conn);
5514
5515 hci_cp.handle = cpu_to_le16(conn->handle);
5516 hci_cp.which = 0x01; /* Piconet clock */
5517 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5518 }
5519
5520 err = hci_req_run(&req, get_clock_info_complete);
5521 if (err < 0)
5522 mgmt_pending_remove(cmd);
5523
5524 unlock:
5525 hci_dev_unlock(hdev);
5526 return err;
5527 }
5528
is_connected(struct hci_dev * hdev,bdaddr_t * addr,u8 type)5529 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5530 {
5531 struct hci_conn *conn;
5532
5533 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5534 if (!conn)
5535 return false;
5536
5537 if (conn->dst_type != type)
5538 return false;
5539
5540 if (conn->state != BT_CONNECTED)
5541 return false;
5542
5543 return true;
5544 }
5545
5546 /* This function requires the caller holds hdev->lock */
hci_conn_params_set(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type,u8 auto_connect)5547 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5548 u8 addr_type, u8 auto_connect)
5549 {
5550 struct hci_conn_params *params;
5551
5552 params = hci_conn_params_add(hdev, addr, addr_type);
5553 if (!params)
5554 return -EIO;
5555
5556 if (params->auto_connect == auto_connect)
5557 return 0;
5558
5559 list_del_init(¶ms->action);
5560
5561 switch (auto_connect) {
5562 case HCI_AUTO_CONN_DISABLED:
5563 case HCI_AUTO_CONN_LINK_LOSS:
5564 /* If auto connect is being disabled when we're trying to
5565 * connect to device, keep connecting.
5566 */
5567 if (params->explicit_connect)
5568 list_add(¶ms->action, &hdev->pend_le_conns);
5569 break;
5570 case HCI_AUTO_CONN_REPORT:
5571 if (params->explicit_connect)
5572 list_add(¶ms->action, &hdev->pend_le_conns);
5573 else
5574 list_add(¶ms->action, &hdev->pend_le_reports);
5575 break;
5576 case HCI_AUTO_CONN_DIRECT:
5577 case HCI_AUTO_CONN_ALWAYS:
5578 if (!is_connected(hdev, addr, addr_type))
5579 list_add(¶ms->action, &hdev->pend_le_conns);
5580 break;
5581 }
5582
5583 params->auto_connect = auto_connect;
5584
5585 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5586 auto_connect);
5587
5588 return 0;
5589 }
5590
device_added(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type,u8 action)5591 static void device_added(struct sock *sk, struct hci_dev *hdev,
5592 bdaddr_t *bdaddr, u8 type, u8 action)
5593 {
5594 struct mgmt_ev_device_added ev;
5595
5596 bacpy(&ev.addr.bdaddr, bdaddr);
5597 ev.addr.type = type;
5598 ev.action = action;
5599
5600 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5601 }
5602
add_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5603 static int add_device(struct sock *sk, struct hci_dev *hdev,
5604 void *data, u16 len)
5605 {
5606 struct mgmt_cp_add_device *cp = data;
5607 u8 auto_conn, addr_type;
5608 int err;
5609
5610 BT_DBG("%s", hdev->name);
5611
5612 if (!bdaddr_type_is_valid(cp->addr.type) ||
5613 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5614 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5615 MGMT_STATUS_INVALID_PARAMS,
5616 &cp->addr, sizeof(cp->addr));
5617
5618 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5619 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5620 MGMT_STATUS_INVALID_PARAMS,
5621 &cp->addr, sizeof(cp->addr));
5622
5623 hci_dev_lock(hdev);
5624
5625 if (cp->addr.type == BDADDR_BREDR) {
5626 /* Only incoming connections action is supported for now */
5627 if (cp->action != 0x01) {
5628 err = mgmt_cmd_complete(sk, hdev->id,
5629 MGMT_OP_ADD_DEVICE,
5630 MGMT_STATUS_INVALID_PARAMS,
5631 &cp->addr, sizeof(cp->addr));
5632 goto unlock;
5633 }
5634
5635 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5636 cp->addr.type);
5637 if (err)
5638 goto unlock;
5639
5640 hci_req_update_scan(hdev);
5641
5642 goto added;
5643 }
5644
5645 addr_type = le_addr_type(cp->addr.type);
5646
5647 if (cp->action == 0x02)
5648 auto_conn = HCI_AUTO_CONN_ALWAYS;
5649 else if (cp->action == 0x01)
5650 auto_conn = HCI_AUTO_CONN_DIRECT;
5651 else
5652 auto_conn = HCI_AUTO_CONN_REPORT;
5653
5654 /* Kernel internally uses conn_params with resolvable private
5655 * address, but Add Device allows only identity addresses.
5656 * Make sure it is enforced before calling
5657 * hci_conn_params_lookup.
5658 */
5659 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5660 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5661 MGMT_STATUS_INVALID_PARAMS,
5662 &cp->addr, sizeof(cp->addr));
5663 goto unlock;
5664 }
5665
5666 /* If the connection parameters don't exist for this device,
5667 * they will be created and configured with defaults.
5668 */
5669 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5670 auto_conn) < 0) {
5671 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5672 MGMT_STATUS_FAILED, &cp->addr,
5673 sizeof(cp->addr));
5674 goto unlock;
5675 }
5676
5677 hci_update_background_scan(hdev);
5678
5679 added:
5680 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5681
5682 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5683 MGMT_STATUS_SUCCESS, &cp->addr,
5684 sizeof(cp->addr));
5685
5686 unlock:
5687 hci_dev_unlock(hdev);
5688 return err;
5689 }
5690
device_removed(struct sock * sk,struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)5691 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5692 bdaddr_t *bdaddr, u8 type)
5693 {
5694 struct mgmt_ev_device_removed ev;
5695
5696 bacpy(&ev.addr.bdaddr, bdaddr);
5697 ev.addr.type = type;
5698
5699 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5700 }
5701
remove_device(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5702 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5703 void *data, u16 len)
5704 {
5705 struct mgmt_cp_remove_device *cp = data;
5706 int err;
5707
5708 BT_DBG("%s", hdev->name);
5709
5710 hci_dev_lock(hdev);
5711
5712 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5713 struct hci_conn_params *params;
5714 u8 addr_type;
5715
5716 if (!bdaddr_type_is_valid(cp->addr.type)) {
5717 err = mgmt_cmd_complete(sk, hdev->id,
5718 MGMT_OP_REMOVE_DEVICE,
5719 MGMT_STATUS_INVALID_PARAMS,
5720 &cp->addr, sizeof(cp->addr));
5721 goto unlock;
5722 }
5723
5724 if (cp->addr.type == BDADDR_BREDR) {
5725 err = hci_bdaddr_list_del(&hdev->whitelist,
5726 &cp->addr.bdaddr,
5727 cp->addr.type);
5728 if (err) {
5729 err = mgmt_cmd_complete(sk, hdev->id,
5730 MGMT_OP_REMOVE_DEVICE,
5731 MGMT_STATUS_INVALID_PARAMS,
5732 &cp->addr,
5733 sizeof(cp->addr));
5734 goto unlock;
5735 }
5736
5737 hci_req_update_scan(hdev);
5738
5739 device_removed(sk, hdev, &cp->addr.bdaddr,
5740 cp->addr.type);
5741 goto complete;
5742 }
5743
5744 addr_type = le_addr_type(cp->addr.type);
5745
5746 /* Kernel internally uses conn_params with resolvable private
5747 * address, but Remove Device allows only identity addresses.
5748 * Make sure it is enforced before calling
5749 * hci_conn_params_lookup.
5750 */
5751 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5752 err = mgmt_cmd_complete(sk, hdev->id,
5753 MGMT_OP_REMOVE_DEVICE,
5754 MGMT_STATUS_INVALID_PARAMS,
5755 &cp->addr, sizeof(cp->addr));
5756 goto unlock;
5757 }
5758
5759 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5760 addr_type);
5761 if (!params) {
5762 err = mgmt_cmd_complete(sk, hdev->id,
5763 MGMT_OP_REMOVE_DEVICE,
5764 MGMT_STATUS_INVALID_PARAMS,
5765 &cp->addr, sizeof(cp->addr));
5766 goto unlock;
5767 }
5768
5769 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5770 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5771 err = mgmt_cmd_complete(sk, hdev->id,
5772 MGMT_OP_REMOVE_DEVICE,
5773 MGMT_STATUS_INVALID_PARAMS,
5774 &cp->addr, sizeof(cp->addr));
5775 goto unlock;
5776 }
5777
5778 list_del(¶ms->action);
5779 list_del(¶ms->list);
5780 kfree(params);
5781 hci_update_background_scan(hdev);
5782
5783 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5784 } else {
5785 struct hci_conn_params *p, *tmp;
5786 struct bdaddr_list *b, *btmp;
5787
5788 if (cp->addr.type) {
5789 err = mgmt_cmd_complete(sk, hdev->id,
5790 MGMT_OP_REMOVE_DEVICE,
5791 MGMT_STATUS_INVALID_PARAMS,
5792 &cp->addr, sizeof(cp->addr));
5793 goto unlock;
5794 }
5795
5796 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5797 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5798 list_del(&b->list);
5799 kfree(b);
5800 }
5801
5802 hci_req_update_scan(hdev);
5803
5804 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5805 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5806 continue;
5807 device_removed(sk, hdev, &p->addr, p->addr_type);
5808 if (p->explicit_connect) {
5809 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5810 continue;
5811 }
5812 list_del(&p->action);
5813 list_del(&p->list);
5814 kfree(p);
5815 }
5816
5817 BT_DBG("All LE connection parameters were removed");
5818
5819 hci_update_background_scan(hdev);
5820 }
5821
5822 complete:
5823 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5824 MGMT_STATUS_SUCCESS, &cp->addr,
5825 sizeof(cp->addr));
5826 unlock:
5827 hci_dev_unlock(hdev);
5828 return err;
5829 }
5830
load_conn_param(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5831 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5832 u16 len)
5833 {
5834 struct mgmt_cp_load_conn_param *cp = data;
5835 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5836 sizeof(struct mgmt_conn_param));
5837 u16 param_count, expected_len;
5838 int i;
5839
5840 if (!lmp_le_capable(hdev))
5841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5842 MGMT_STATUS_NOT_SUPPORTED);
5843
5844 param_count = __le16_to_cpu(cp->param_count);
5845 if (param_count > max_param_count) {
5846 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5847 param_count);
5848 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5849 MGMT_STATUS_INVALID_PARAMS);
5850 }
5851
5852 expected_len = struct_size(cp, params, param_count);
5853 if (expected_len != len) {
5854 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5855 expected_len, len);
5856 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5857 MGMT_STATUS_INVALID_PARAMS);
5858 }
5859
5860 BT_DBG("%s param_count %u", hdev->name, param_count);
5861
5862 hci_dev_lock(hdev);
5863
5864 hci_conn_params_clear_disabled(hdev);
5865
5866 for (i = 0; i < param_count; i++) {
5867 struct mgmt_conn_param *param = &cp->params[i];
5868 struct hci_conn_params *hci_param;
5869 u16 min, max, latency, timeout;
5870 u8 addr_type;
5871
5872 BT_DBG("Adding %pMR (type %u)", ¶m->addr.bdaddr,
5873 param->addr.type);
5874
5875 if (param->addr.type == BDADDR_LE_PUBLIC) {
5876 addr_type = ADDR_LE_DEV_PUBLIC;
5877 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5878 addr_type = ADDR_LE_DEV_RANDOM;
5879 } else {
5880 bt_dev_err(hdev, "ignoring invalid connection parameters");
5881 continue;
5882 }
5883
5884 min = le16_to_cpu(param->min_interval);
5885 max = le16_to_cpu(param->max_interval);
5886 latency = le16_to_cpu(param->latency);
5887 timeout = le16_to_cpu(param->timeout);
5888
5889 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5890 min, max, latency, timeout);
5891
5892 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5893 bt_dev_err(hdev, "ignoring invalid connection parameters");
5894 continue;
5895 }
5896
5897 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
5898 addr_type);
5899 if (!hci_param) {
5900 bt_dev_err(hdev, "failed to add connection parameters");
5901 continue;
5902 }
5903
5904 hci_param->conn_min_interval = min;
5905 hci_param->conn_max_interval = max;
5906 hci_param->conn_latency = latency;
5907 hci_param->supervision_timeout = timeout;
5908 }
5909
5910 hci_dev_unlock(hdev);
5911
5912 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5913 NULL, 0);
5914 }
5915
set_external_config(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5916 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5917 void *data, u16 len)
5918 {
5919 struct mgmt_cp_set_external_config *cp = data;
5920 bool changed;
5921 int err;
5922
5923 BT_DBG("%s", hdev->name);
5924
5925 if (hdev_is_powered(hdev))
5926 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5927 MGMT_STATUS_REJECTED);
5928
5929 if (cp->config != 0x00 && cp->config != 0x01)
5930 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5931 MGMT_STATUS_INVALID_PARAMS);
5932
5933 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5934 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5935 MGMT_STATUS_NOT_SUPPORTED);
5936
5937 hci_dev_lock(hdev);
5938
5939 if (cp->config)
5940 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5941 else
5942 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5943
5944 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5945 if (err < 0)
5946 goto unlock;
5947
5948 if (!changed)
5949 goto unlock;
5950
5951 err = new_options(hdev, sk);
5952
5953 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5954 mgmt_index_removed(hdev);
5955
5956 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5957 hci_dev_set_flag(hdev, HCI_CONFIG);
5958 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5959
5960 queue_work(hdev->req_workqueue, &hdev->power_on);
5961 } else {
5962 set_bit(HCI_RAW, &hdev->flags);
5963 mgmt_index_added(hdev);
5964 }
5965 }
5966
5967 unlock:
5968 hci_dev_unlock(hdev);
5969 return err;
5970 }
5971
set_public_address(struct sock * sk,struct hci_dev * hdev,void * data,u16 len)5972 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5973 void *data, u16 len)
5974 {
5975 struct mgmt_cp_set_public_address *cp = data;
5976 bool changed;
5977 int err;
5978
5979 BT_DBG("%s", hdev->name);
5980
5981 if (hdev_is_powered(hdev))
5982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5983 MGMT_STATUS_REJECTED);
5984
5985 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5986 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5987 MGMT_STATUS_INVALID_PARAMS);
5988
5989 if (!hdev->set_bdaddr)
5990 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5991 MGMT_STATUS_NOT_SUPPORTED);
5992
5993 hci_dev_lock(hdev);
5994
5995 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5996 bacpy(&hdev->public_addr, &cp->bdaddr);
5997
5998 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5999 if (err < 0)
6000 goto unlock;
6001
6002 if (!changed)
6003 goto unlock;
6004
6005 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
6006 err = new_options(hdev, sk);
6007
6008 if (is_configured(hdev)) {
6009 mgmt_index_removed(hdev);
6010
6011 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6012
6013 hci_dev_set_flag(hdev, HCI_CONFIG);
6014 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6015
6016 queue_work(hdev->req_workqueue, &hdev->power_on);
6017 }
6018
6019 unlock:
6020 hci_dev_unlock(hdev);
6021 return err;
6022 }
6023
read_local_oob_ext_data_complete(struct hci_dev * hdev,u8 status,u16 opcode,struct sk_buff * skb)6024 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6025 u16 opcode, struct sk_buff *skb)
6026 {
6027 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6028 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6029 u8 *h192, *r192, *h256, *r256;
6030 struct mgmt_pending_cmd *cmd;
6031 u16 eir_len;
6032 int err;
6033
6034 BT_DBG("%s status %u", hdev->name, status);
6035
6036 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6037 if (!cmd)
6038 return;
6039
6040 mgmt_cp = cmd->param;
6041
6042 if (status) {
6043 status = mgmt_status(status);
6044 eir_len = 0;
6045
6046 h192 = NULL;
6047 r192 = NULL;
6048 h256 = NULL;
6049 r256 = NULL;
6050 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6051 struct hci_rp_read_local_oob_data *rp;
6052
6053 if (skb->len != sizeof(*rp)) {
6054 status = MGMT_STATUS_FAILED;
6055 eir_len = 0;
6056 } else {
6057 status = MGMT_STATUS_SUCCESS;
6058 rp = (void *)skb->data;
6059
6060 eir_len = 5 + 18 + 18;
6061 h192 = rp->hash;
6062 r192 = rp->rand;
6063 h256 = NULL;
6064 r256 = NULL;
6065 }
6066 } else {
6067 struct hci_rp_read_local_oob_ext_data *rp;
6068
6069 if (skb->len != sizeof(*rp)) {
6070 status = MGMT_STATUS_FAILED;
6071 eir_len = 0;
6072 } else {
6073 status = MGMT_STATUS_SUCCESS;
6074 rp = (void *)skb->data;
6075
6076 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6077 eir_len = 5 + 18 + 18;
6078 h192 = NULL;
6079 r192 = NULL;
6080 } else {
6081 eir_len = 5 + 18 + 18 + 18 + 18;
6082 h192 = rp->hash192;
6083 r192 = rp->rand192;
6084 }
6085
6086 h256 = rp->hash256;
6087 r256 = rp->rand256;
6088 }
6089 }
6090
6091 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6092 if (!mgmt_rp)
6093 goto done;
6094
6095 if (status)
6096 goto send_rsp;
6097
6098 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6099 hdev->dev_class, 3);
6100
6101 if (h192 && r192) {
6102 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6103 EIR_SSP_HASH_C192, h192, 16);
6104 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6105 EIR_SSP_RAND_R192, r192, 16);
6106 }
6107
6108 if (h256 && r256) {
6109 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6110 EIR_SSP_HASH_C256, h256, 16);
6111 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6112 EIR_SSP_RAND_R256, r256, 16);
6113 }
6114
6115 send_rsp:
6116 mgmt_rp->type = mgmt_cp->type;
6117 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6118
6119 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6120 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6121 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6122 if (err < 0 || status)
6123 goto done;
6124
6125 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6126
6127 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6128 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6129 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6130 done:
6131 kfree(mgmt_rp);
6132 mgmt_pending_remove(cmd);
6133 }
6134
read_local_ssp_oob_req(struct hci_dev * hdev,struct sock * sk,struct mgmt_cp_read_local_oob_ext_data * cp)6135 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6136 struct mgmt_cp_read_local_oob_ext_data *cp)
6137 {
6138 struct mgmt_pending_cmd *cmd;
6139 struct hci_request req;
6140 int err;
6141
6142 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6143 cp, sizeof(*cp));
6144 if (!cmd)
6145 return -ENOMEM;
6146
6147 hci_req_init(&req, hdev);
6148
6149 if (bredr_sc_enabled(hdev))
6150 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6151 else
6152 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6153
6154 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6155 if (err < 0) {
6156 mgmt_pending_remove(cmd);
6157 return err;
6158 }
6159
6160 return 0;
6161 }
6162
read_local_oob_ext_data(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6163 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6164 void *data, u16 data_len)
6165 {
6166 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6167 struct mgmt_rp_read_local_oob_ext_data *rp;
6168 size_t rp_len;
6169 u16 eir_len;
6170 u8 status, flags, role, addr[7], hash[16], rand[16];
6171 int err;
6172
6173 BT_DBG("%s", hdev->name);
6174
6175 if (hdev_is_powered(hdev)) {
6176 switch (cp->type) {
6177 case BIT(BDADDR_BREDR):
6178 status = mgmt_bredr_support(hdev);
6179 if (status)
6180 eir_len = 0;
6181 else
6182 eir_len = 5;
6183 break;
6184 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6185 status = mgmt_le_support(hdev);
6186 if (status)
6187 eir_len = 0;
6188 else
6189 eir_len = 9 + 3 + 18 + 18 + 3;
6190 break;
6191 default:
6192 status = MGMT_STATUS_INVALID_PARAMS;
6193 eir_len = 0;
6194 break;
6195 }
6196 } else {
6197 status = MGMT_STATUS_NOT_POWERED;
6198 eir_len = 0;
6199 }
6200
6201 rp_len = sizeof(*rp) + eir_len;
6202 rp = kmalloc(rp_len, GFP_ATOMIC);
6203 if (!rp)
6204 return -ENOMEM;
6205
6206 if (status)
6207 goto complete;
6208
6209 hci_dev_lock(hdev);
6210
6211 eir_len = 0;
6212 switch (cp->type) {
6213 case BIT(BDADDR_BREDR):
6214 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6215 err = read_local_ssp_oob_req(hdev, sk, cp);
6216 hci_dev_unlock(hdev);
6217 if (!err)
6218 goto done;
6219
6220 status = MGMT_STATUS_FAILED;
6221 goto complete;
6222 } else {
6223 eir_len = eir_append_data(rp->eir, eir_len,
6224 EIR_CLASS_OF_DEV,
6225 hdev->dev_class, 3);
6226 }
6227 break;
6228 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6229 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6230 smp_generate_oob(hdev, hash, rand) < 0) {
6231 hci_dev_unlock(hdev);
6232 status = MGMT_STATUS_FAILED;
6233 goto complete;
6234 }
6235
6236 /* This should return the active RPA, but since the RPA
6237 * is only programmed on demand, it is really hard to fill
6238 * this in at the moment. For now disallow retrieving
6239 * local out-of-band data when privacy is in use.
6240 *
6241 * Returning the identity address will not help here since
6242 * pairing happens before the identity resolving key is
6243 * known and thus the connection establishment happens
6244 * based on the RPA and not the identity address.
6245 */
6246 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6247 hci_dev_unlock(hdev);
6248 status = MGMT_STATUS_REJECTED;
6249 goto complete;
6250 }
6251
6252 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6253 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6254 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6255 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6256 memcpy(addr, &hdev->static_addr, 6);
6257 addr[6] = 0x01;
6258 } else {
6259 memcpy(addr, &hdev->bdaddr, 6);
6260 addr[6] = 0x00;
6261 }
6262
6263 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6264 addr, sizeof(addr));
6265
6266 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6267 role = 0x02;
6268 else
6269 role = 0x01;
6270
6271 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6272 &role, sizeof(role));
6273
6274 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6275 eir_len = eir_append_data(rp->eir, eir_len,
6276 EIR_LE_SC_CONFIRM,
6277 hash, sizeof(hash));
6278
6279 eir_len = eir_append_data(rp->eir, eir_len,
6280 EIR_LE_SC_RANDOM,
6281 rand, sizeof(rand));
6282 }
6283
6284 flags = mgmt_get_adv_discov_flags(hdev);
6285
6286 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6287 flags |= LE_AD_NO_BREDR;
6288
6289 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6290 &flags, sizeof(flags));
6291 break;
6292 }
6293
6294 hci_dev_unlock(hdev);
6295
6296 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6297
6298 status = MGMT_STATUS_SUCCESS;
6299
6300 complete:
6301 rp->type = cp->type;
6302 rp->eir_len = cpu_to_le16(eir_len);
6303
6304 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6305 status, rp, sizeof(*rp) + eir_len);
6306 if (err < 0 || status)
6307 goto done;
6308
6309 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6310 rp, sizeof(*rp) + eir_len,
6311 HCI_MGMT_OOB_DATA_EVENTS, sk);
6312
6313 done:
6314 kfree(rp);
6315
6316 return err;
6317 }
6318
get_supported_adv_flags(struct hci_dev * hdev)6319 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6320 {
6321 u32 flags = 0;
6322
6323 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6324 flags |= MGMT_ADV_FLAG_DISCOV;
6325 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6326 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6327 flags |= MGMT_ADV_FLAG_APPEARANCE;
6328 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6329
6330 /* In extended adv TX_POWER returned from Set Adv Param
6331 * will be always valid.
6332 */
6333 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6334 ext_adv_capable(hdev))
6335 flags |= MGMT_ADV_FLAG_TX_POWER;
6336
6337 if (ext_adv_capable(hdev)) {
6338 flags |= MGMT_ADV_FLAG_SEC_1M;
6339
6340 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6341 flags |= MGMT_ADV_FLAG_SEC_2M;
6342
6343 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6344 flags |= MGMT_ADV_FLAG_SEC_CODED;
6345 }
6346
6347 return flags;
6348 }
6349
read_adv_features(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6350 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6351 void *data, u16 data_len)
6352 {
6353 struct mgmt_rp_read_adv_features *rp;
6354 size_t rp_len;
6355 int err;
6356 struct adv_info *adv_instance;
6357 u32 supported_flags;
6358 u8 *instance;
6359
6360 BT_DBG("%s", hdev->name);
6361
6362 if (!lmp_le_capable(hdev))
6363 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6364 MGMT_STATUS_REJECTED);
6365
6366 hci_dev_lock(hdev);
6367
6368 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6369 rp = kmalloc(rp_len, GFP_ATOMIC);
6370 if (!rp) {
6371 hci_dev_unlock(hdev);
6372 return -ENOMEM;
6373 }
6374
6375 supported_flags = get_supported_adv_flags(hdev);
6376
6377 rp->supported_flags = cpu_to_le32(supported_flags);
6378 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6379 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6380 rp->max_instances = HCI_MAX_ADV_INSTANCES;
6381 rp->num_instances = hdev->adv_instance_cnt;
6382
6383 instance = rp->instance;
6384 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6385 *instance = adv_instance->instance;
6386 instance++;
6387 }
6388
6389 hci_dev_unlock(hdev);
6390
6391 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6392 MGMT_STATUS_SUCCESS, rp, rp_len);
6393
6394 kfree(rp);
6395
6396 return err;
6397 }
6398
calculate_name_len(struct hci_dev * hdev)6399 static u8 calculate_name_len(struct hci_dev *hdev)
6400 {
6401 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6402
6403 return append_local_name(hdev, buf, 0);
6404 }
6405
tlv_data_max_len(struct hci_dev * hdev,u32 adv_flags,bool is_adv_data)6406 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6407 bool is_adv_data)
6408 {
6409 u8 max_len = HCI_MAX_AD_LENGTH;
6410
6411 if (is_adv_data) {
6412 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6413 MGMT_ADV_FLAG_LIMITED_DISCOV |
6414 MGMT_ADV_FLAG_MANAGED_FLAGS))
6415 max_len -= 3;
6416
6417 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6418 max_len -= 3;
6419 } else {
6420 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6421 max_len -= calculate_name_len(hdev);
6422
6423 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6424 max_len -= 4;
6425 }
6426
6427 return max_len;
6428 }
6429
flags_managed(u32 adv_flags)6430 static bool flags_managed(u32 adv_flags)
6431 {
6432 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6433 MGMT_ADV_FLAG_LIMITED_DISCOV |
6434 MGMT_ADV_FLAG_MANAGED_FLAGS);
6435 }
6436
tx_power_managed(u32 adv_flags)6437 static bool tx_power_managed(u32 adv_flags)
6438 {
6439 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6440 }
6441
name_managed(u32 adv_flags)6442 static bool name_managed(u32 adv_flags)
6443 {
6444 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6445 }
6446
appearance_managed(u32 adv_flags)6447 static bool appearance_managed(u32 adv_flags)
6448 {
6449 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6450 }
6451
tlv_data_is_valid(struct hci_dev * hdev,u32 adv_flags,u8 * data,u8 len,bool is_adv_data)6452 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6453 u8 len, bool is_adv_data)
6454 {
6455 int i, cur_len;
6456 u8 max_len;
6457
6458 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6459
6460 if (len > max_len)
6461 return false;
6462
6463 /* Make sure that the data is correctly formatted. */
6464 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6465 cur_len = data[i];
6466
6467 if (!cur_len)
6468 continue;
6469
6470 if (data[i + 1] == EIR_FLAGS &&
6471 (!is_adv_data || flags_managed(adv_flags)))
6472 return false;
6473
6474 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6475 return false;
6476
6477 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6478 return false;
6479
6480 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6481 return false;
6482
6483 if (data[i + 1] == EIR_APPEARANCE &&
6484 appearance_managed(adv_flags))
6485 return false;
6486
6487 /* If the current field length would exceed the total data
6488 * length, then it's invalid.
6489 */
6490 if (i + cur_len >= len)
6491 return false;
6492 }
6493
6494 return true;
6495 }
6496
add_advertising_complete(struct hci_dev * hdev,u8 status,u16 opcode)6497 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6498 u16 opcode)
6499 {
6500 struct mgmt_pending_cmd *cmd;
6501 struct mgmt_cp_add_advertising *cp;
6502 struct mgmt_rp_add_advertising rp;
6503 struct adv_info *adv_instance, *n;
6504 u8 instance;
6505
6506 BT_DBG("status %d", status);
6507
6508 hci_dev_lock(hdev);
6509
6510 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6511
6512 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6513 if (!adv_instance->pending)
6514 continue;
6515
6516 if (!status) {
6517 adv_instance->pending = false;
6518 continue;
6519 }
6520
6521 instance = adv_instance->instance;
6522
6523 if (hdev->cur_adv_instance == instance)
6524 cancel_adv_timeout(hdev);
6525
6526 hci_remove_adv_instance(hdev, instance);
6527 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6528 }
6529
6530 if (!cmd)
6531 goto unlock;
6532
6533 cp = cmd->param;
6534 rp.instance = cp->instance;
6535
6536 if (status)
6537 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6538 mgmt_status(status));
6539 else
6540 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6541 mgmt_status(status), &rp, sizeof(rp));
6542
6543 mgmt_pending_remove(cmd);
6544
6545 unlock:
6546 hci_dev_unlock(hdev);
6547 }
6548
add_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6549 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6550 void *data, u16 data_len)
6551 {
6552 struct mgmt_cp_add_advertising *cp = data;
6553 struct mgmt_rp_add_advertising rp;
6554 u32 flags;
6555 u32 supported_flags, phy_flags;
6556 u8 status;
6557 u16 timeout, duration;
6558 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6559 u8 schedule_instance = 0;
6560 struct adv_info *next_instance;
6561 int err;
6562 struct mgmt_pending_cmd *cmd;
6563 struct hci_request req;
6564
6565 BT_DBG("%s", hdev->name);
6566
6567 status = mgmt_le_support(hdev);
6568 if (status)
6569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6570 status);
6571
6572 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6573 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6574 MGMT_STATUS_INVALID_PARAMS);
6575
6576 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6578 MGMT_STATUS_INVALID_PARAMS);
6579
6580 flags = __le32_to_cpu(cp->flags);
6581 timeout = __le16_to_cpu(cp->timeout);
6582 duration = __le16_to_cpu(cp->duration);
6583
6584 /* The current implementation only supports a subset of the specified
6585 * flags. Also need to check mutual exclusiveness of sec flags.
6586 */
6587 supported_flags = get_supported_adv_flags(hdev);
6588 phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6589 if (flags & ~supported_flags ||
6590 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6591 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6592 MGMT_STATUS_INVALID_PARAMS);
6593
6594 hci_dev_lock(hdev);
6595
6596 if (timeout && !hdev_is_powered(hdev)) {
6597 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6598 MGMT_STATUS_REJECTED);
6599 goto unlock;
6600 }
6601
6602 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6603 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6604 pending_find(MGMT_OP_SET_LE, hdev)) {
6605 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6606 MGMT_STATUS_BUSY);
6607 goto unlock;
6608 }
6609
6610 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6611 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6612 cp->scan_rsp_len, false)) {
6613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6614 MGMT_STATUS_INVALID_PARAMS);
6615 goto unlock;
6616 }
6617
6618 err = hci_add_adv_instance(hdev, cp->instance, flags,
6619 cp->adv_data_len, cp->data,
6620 cp->scan_rsp_len,
6621 cp->data + cp->adv_data_len,
6622 timeout, duration);
6623 if (err < 0) {
6624 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6625 MGMT_STATUS_FAILED);
6626 goto unlock;
6627 }
6628
6629 /* Only trigger an advertising added event if a new instance was
6630 * actually added.
6631 */
6632 if (hdev->adv_instance_cnt > prev_instance_cnt)
6633 mgmt_advertising_added(sk, hdev, cp->instance);
6634
6635 if (hdev->cur_adv_instance == cp->instance) {
6636 /* If the currently advertised instance is being changed then
6637 * cancel the current advertising and schedule the next
6638 * instance. If there is only one instance then the overridden
6639 * advertising data will be visible right away.
6640 */
6641 cancel_adv_timeout(hdev);
6642
6643 next_instance = hci_get_next_instance(hdev, cp->instance);
6644 if (next_instance)
6645 schedule_instance = next_instance->instance;
6646 } else if (!hdev->adv_instance_timeout) {
6647 /* Immediately advertise the new instance if no other
6648 * instance is currently being advertised.
6649 */
6650 schedule_instance = cp->instance;
6651 }
6652
6653 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6654 * there is no instance to be advertised then we have no HCI
6655 * communication to make. Simply return.
6656 */
6657 if (!hdev_is_powered(hdev) ||
6658 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6659 !schedule_instance) {
6660 rp.instance = cp->instance;
6661 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6662 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6663 goto unlock;
6664 }
6665
6666 /* We're good to go, update advertising data, parameters, and start
6667 * advertising.
6668 */
6669 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6670 data_len);
6671 if (!cmd) {
6672 err = -ENOMEM;
6673 goto unlock;
6674 }
6675
6676 hci_req_init(&req, hdev);
6677
6678 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6679
6680 if (!err)
6681 err = hci_req_run(&req, add_advertising_complete);
6682
6683 if (err < 0)
6684 mgmt_pending_remove(cmd);
6685
6686 unlock:
6687 hci_dev_unlock(hdev);
6688
6689 return err;
6690 }
6691
remove_advertising_complete(struct hci_dev * hdev,u8 status,u16 opcode)6692 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6693 u16 opcode)
6694 {
6695 struct mgmt_pending_cmd *cmd;
6696 struct mgmt_cp_remove_advertising *cp;
6697 struct mgmt_rp_remove_advertising rp;
6698
6699 BT_DBG("status %d", status);
6700
6701 hci_dev_lock(hdev);
6702
6703 /* A failure status here only means that we failed to disable
6704 * advertising. Otherwise, the advertising instance has been removed,
6705 * so report success.
6706 */
6707 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6708 if (!cmd)
6709 goto unlock;
6710
6711 cp = cmd->param;
6712 rp.instance = cp->instance;
6713
6714 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6715 &rp, sizeof(rp));
6716 mgmt_pending_remove(cmd);
6717
6718 unlock:
6719 hci_dev_unlock(hdev);
6720 }
6721
remove_advertising(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6722 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6723 void *data, u16 data_len)
6724 {
6725 struct mgmt_cp_remove_advertising *cp = data;
6726 struct mgmt_rp_remove_advertising rp;
6727 struct mgmt_pending_cmd *cmd;
6728 struct hci_request req;
6729 int err;
6730
6731 BT_DBG("%s", hdev->name);
6732
6733 hci_dev_lock(hdev);
6734
6735 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6736 err = mgmt_cmd_status(sk, hdev->id,
6737 MGMT_OP_REMOVE_ADVERTISING,
6738 MGMT_STATUS_INVALID_PARAMS);
6739 goto unlock;
6740 }
6741
6742 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6743 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6744 pending_find(MGMT_OP_SET_LE, hdev)) {
6745 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6746 MGMT_STATUS_BUSY);
6747 goto unlock;
6748 }
6749
6750 if (list_empty(&hdev->adv_instances)) {
6751 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6752 MGMT_STATUS_INVALID_PARAMS);
6753 goto unlock;
6754 }
6755
6756 hci_req_init(&req, hdev);
6757
6758 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6759
6760 if (list_empty(&hdev->adv_instances))
6761 __hci_req_disable_advertising(&req);
6762
6763 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6764 * flag is set or the device isn't powered then we have no HCI
6765 * communication to make. Simply return.
6766 */
6767 if (skb_queue_empty(&req.cmd_q) ||
6768 !hdev_is_powered(hdev) ||
6769 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6770 hci_req_purge(&req);
6771 rp.instance = cp->instance;
6772 err = mgmt_cmd_complete(sk, hdev->id,
6773 MGMT_OP_REMOVE_ADVERTISING,
6774 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6775 goto unlock;
6776 }
6777
6778 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6779 data_len);
6780 if (!cmd) {
6781 err = -ENOMEM;
6782 goto unlock;
6783 }
6784
6785 err = hci_req_run(&req, remove_advertising_complete);
6786 if (err < 0)
6787 mgmt_pending_remove(cmd);
6788
6789 unlock:
6790 hci_dev_unlock(hdev);
6791
6792 return err;
6793 }
6794
get_adv_size_info(struct sock * sk,struct hci_dev * hdev,void * data,u16 data_len)6795 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6796 void *data, u16 data_len)
6797 {
6798 struct mgmt_cp_get_adv_size_info *cp = data;
6799 struct mgmt_rp_get_adv_size_info rp;
6800 u32 flags, supported_flags;
6801 int err;
6802
6803 BT_DBG("%s", hdev->name);
6804
6805 if (!lmp_le_capable(hdev))
6806 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6807 MGMT_STATUS_REJECTED);
6808
6809 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6810 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6811 MGMT_STATUS_INVALID_PARAMS);
6812
6813 flags = __le32_to_cpu(cp->flags);
6814
6815 /* The current implementation only supports a subset of the specified
6816 * flags.
6817 */
6818 supported_flags = get_supported_adv_flags(hdev);
6819 if (flags & ~supported_flags)
6820 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6821 MGMT_STATUS_INVALID_PARAMS);
6822
6823 rp.instance = cp->instance;
6824 rp.flags = cp->flags;
6825 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6826 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6827
6828 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6829 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6830
6831 return err;
6832 }
6833
6834 static const struct hci_mgmt_handler mgmt_handlers[] = {
6835 { NULL }, /* 0x0000 (no command) */
6836 { read_version, MGMT_READ_VERSION_SIZE,
6837 HCI_MGMT_NO_HDEV |
6838 HCI_MGMT_UNTRUSTED },
6839 { read_commands, MGMT_READ_COMMANDS_SIZE,
6840 HCI_MGMT_NO_HDEV |
6841 HCI_MGMT_UNTRUSTED },
6842 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
6843 HCI_MGMT_NO_HDEV |
6844 HCI_MGMT_UNTRUSTED },
6845 { read_controller_info, MGMT_READ_INFO_SIZE,
6846 HCI_MGMT_UNTRUSTED },
6847 { set_powered, MGMT_SETTING_SIZE },
6848 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6849 { set_connectable, MGMT_SETTING_SIZE },
6850 { set_fast_connectable, MGMT_SETTING_SIZE },
6851 { set_bondable, MGMT_SETTING_SIZE },
6852 { set_link_security, MGMT_SETTING_SIZE },
6853 { set_ssp, MGMT_SETTING_SIZE },
6854 { set_hs, MGMT_SETTING_SIZE },
6855 { set_le, MGMT_SETTING_SIZE },
6856 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6857 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6858 { add_uuid, MGMT_ADD_UUID_SIZE },
6859 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
6860 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6861 HCI_MGMT_VAR_LEN },
6862 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6863 HCI_MGMT_VAR_LEN },
6864 { disconnect, MGMT_DISCONNECT_SIZE },
6865 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6866 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6867 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6868 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6869 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6870 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6871 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6872 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6873 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6874 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6875 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6876 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6877 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6878 HCI_MGMT_VAR_LEN },
6879 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6880 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6881 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6882 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6883 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6884 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6885 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6886 { set_advertising, MGMT_SETTING_SIZE },
6887 { set_bredr, MGMT_SETTING_SIZE },
6888 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6889 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6890 { set_secure_conn, MGMT_SETTING_SIZE },
6891 { set_debug_keys, MGMT_SETTING_SIZE },
6892 { set_privacy, MGMT_SET_PRIVACY_SIZE },
6893 { load_irks, MGMT_LOAD_IRKS_SIZE,
6894 HCI_MGMT_VAR_LEN },
6895 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6896 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6897 { add_device, MGMT_ADD_DEVICE_SIZE },
6898 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
6899 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6900 HCI_MGMT_VAR_LEN },
6901 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6902 HCI_MGMT_NO_HDEV |
6903 HCI_MGMT_UNTRUSTED },
6904 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
6905 HCI_MGMT_UNCONFIGURED |
6906 HCI_MGMT_UNTRUSTED },
6907 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6908 HCI_MGMT_UNCONFIGURED },
6909 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6910 HCI_MGMT_UNCONFIGURED },
6911 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6912 HCI_MGMT_VAR_LEN },
6913 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6914 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
6915 HCI_MGMT_NO_HDEV |
6916 HCI_MGMT_UNTRUSTED },
6917 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
6918 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
6919 HCI_MGMT_VAR_LEN },
6920 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
6921 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
6922 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6923 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6924 HCI_MGMT_UNTRUSTED },
6925 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
6926 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
6927 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
6928 };
6929
mgmt_index_added(struct hci_dev * hdev)6930 void mgmt_index_added(struct hci_dev *hdev)
6931 {
6932 struct mgmt_ev_ext_index ev;
6933
6934 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6935 return;
6936
6937 switch (hdev->dev_type) {
6938 case HCI_PRIMARY:
6939 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6940 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6941 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6942 ev.type = 0x01;
6943 } else {
6944 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6945 HCI_MGMT_INDEX_EVENTS);
6946 ev.type = 0x00;
6947 }
6948 break;
6949 case HCI_AMP:
6950 ev.type = 0x02;
6951 break;
6952 default:
6953 return;
6954 }
6955
6956 ev.bus = hdev->bus;
6957
6958 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6959 HCI_MGMT_EXT_INDEX_EVENTS);
6960 }
6961
mgmt_index_removed(struct hci_dev * hdev)6962 void mgmt_index_removed(struct hci_dev *hdev)
6963 {
6964 struct mgmt_ev_ext_index ev;
6965 u8 status = MGMT_STATUS_INVALID_INDEX;
6966
6967 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6968 return;
6969
6970 switch (hdev->dev_type) {
6971 case HCI_PRIMARY:
6972 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6973
6974 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6975 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6976 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6977 ev.type = 0x01;
6978 } else {
6979 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6980 HCI_MGMT_INDEX_EVENTS);
6981 ev.type = 0x00;
6982 }
6983 break;
6984 case HCI_AMP:
6985 ev.type = 0x02;
6986 break;
6987 default:
6988 return;
6989 }
6990
6991 ev.bus = hdev->bus;
6992
6993 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6994 HCI_MGMT_EXT_INDEX_EVENTS);
6995 }
6996
6997 /* This function requires the caller holds hdev->lock */
restart_le_actions(struct hci_dev * hdev)6998 static void restart_le_actions(struct hci_dev *hdev)
6999 {
7000 struct hci_conn_params *p;
7001
7002 list_for_each_entry(p, &hdev->le_conn_params, list) {
7003 /* Needed for AUTO_OFF case where might not "really"
7004 * have been powered off.
7005 */
7006 list_del_init(&p->action);
7007
7008 switch (p->auto_connect) {
7009 case HCI_AUTO_CONN_DIRECT:
7010 case HCI_AUTO_CONN_ALWAYS:
7011 list_add(&p->action, &hdev->pend_le_conns);
7012 break;
7013 case HCI_AUTO_CONN_REPORT:
7014 list_add(&p->action, &hdev->pend_le_reports);
7015 break;
7016 default:
7017 break;
7018 }
7019 }
7020 }
7021
mgmt_power_on(struct hci_dev * hdev,int err)7022 void mgmt_power_on(struct hci_dev *hdev, int err)
7023 {
7024 struct cmd_lookup match = { NULL, hdev };
7025
7026 BT_DBG("err %d", err);
7027
7028 hci_dev_lock(hdev);
7029
7030 if (!err) {
7031 restart_le_actions(hdev);
7032 hci_update_background_scan(hdev);
7033 }
7034
7035 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7036
7037 new_settings(hdev, match.sk);
7038
7039 if (match.sk)
7040 sock_put(match.sk);
7041
7042 hci_dev_unlock(hdev);
7043 }
7044
__mgmt_power_off(struct hci_dev * hdev)7045 void __mgmt_power_off(struct hci_dev *hdev)
7046 {
7047 struct cmd_lookup match = { NULL, hdev };
7048 u8 status, zero_cod[] = { 0, 0, 0 };
7049
7050 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7051
7052 /* If the power off is because of hdev unregistration let
7053 * use the appropriate INVALID_INDEX status. Otherwise use
7054 * NOT_POWERED. We cover both scenarios here since later in
7055 * mgmt_index_removed() any hci_conn callbacks will have already
7056 * been triggered, potentially causing misleading DISCONNECTED
7057 * status responses.
7058 */
7059 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7060 status = MGMT_STATUS_INVALID_INDEX;
7061 else
7062 status = MGMT_STATUS_NOT_POWERED;
7063
7064 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7065
7066 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7067 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7068 zero_cod, sizeof(zero_cod),
7069 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7070 ext_info_changed(hdev, NULL);
7071 }
7072
7073 new_settings(hdev, match.sk);
7074
7075 if (match.sk)
7076 sock_put(match.sk);
7077 }
7078
mgmt_set_powered_failed(struct hci_dev * hdev,int err)7079 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7080 {
7081 struct mgmt_pending_cmd *cmd;
7082 u8 status;
7083
7084 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7085 if (!cmd)
7086 return;
7087
7088 if (err == -ERFKILL)
7089 status = MGMT_STATUS_RFKILLED;
7090 else
7091 status = MGMT_STATUS_FAILED;
7092
7093 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7094
7095 mgmt_pending_remove(cmd);
7096 }
7097
mgmt_new_link_key(struct hci_dev * hdev,struct link_key * key,bool persistent)7098 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7099 bool persistent)
7100 {
7101 struct mgmt_ev_new_link_key ev;
7102
7103 memset(&ev, 0, sizeof(ev));
7104
7105 ev.store_hint = persistent;
7106 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7107 ev.key.addr.type = BDADDR_BREDR;
7108 ev.key.type = key->type;
7109 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7110 ev.key.pin_len = key->pin_len;
7111
7112 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7113 }
7114
mgmt_ltk_type(struct smp_ltk * ltk)7115 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7116 {
7117 switch (ltk->type) {
7118 case SMP_LTK:
7119 case SMP_LTK_SLAVE:
7120 if (ltk->authenticated)
7121 return MGMT_LTK_AUTHENTICATED;
7122 return MGMT_LTK_UNAUTHENTICATED;
7123 case SMP_LTK_P256:
7124 if (ltk->authenticated)
7125 return MGMT_LTK_P256_AUTH;
7126 return MGMT_LTK_P256_UNAUTH;
7127 case SMP_LTK_P256_DEBUG:
7128 return MGMT_LTK_P256_DEBUG;
7129 }
7130
7131 return MGMT_LTK_UNAUTHENTICATED;
7132 }
7133
mgmt_new_ltk(struct hci_dev * hdev,struct smp_ltk * key,bool persistent)7134 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7135 {
7136 struct mgmt_ev_new_long_term_key ev;
7137
7138 memset(&ev, 0, sizeof(ev));
7139
7140 /* Devices using resolvable or non-resolvable random addresses
7141 * without providing an identity resolving key don't require
7142 * to store long term keys. Their addresses will change the
7143 * next time around.
7144 *
7145 * Only when a remote device provides an identity address
7146 * make sure the long term key is stored. If the remote
7147 * identity is known, the long term keys are internally
7148 * mapped to the identity address. So allow static random
7149 * and public addresses here.
7150 */
7151 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7152 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7153 ev.store_hint = 0x00;
7154 else
7155 ev.store_hint = persistent;
7156
7157 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7158 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7159 ev.key.type = mgmt_ltk_type(key);
7160 ev.key.enc_size = key->enc_size;
7161 ev.key.ediv = key->ediv;
7162 ev.key.rand = key->rand;
7163
7164 if (key->type == SMP_LTK)
7165 ev.key.master = 1;
7166
7167 /* Make sure we copy only the significant bytes based on the
7168 * encryption key size, and set the rest of the value to zeroes.
7169 */
7170 memcpy(ev.key.val, key->val, key->enc_size);
7171 memset(ev.key.val + key->enc_size, 0,
7172 sizeof(ev.key.val) - key->enc_size);
7173
7174 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7175 }
7176
mgmt_new_irk(struct hci_dev * hdev,struct smp_irk * irk,bool persistent)7177 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7178 {
7179 struct mgmt_ev_new_irk ev;
7180
7181 memset(&ev, 0, sizeof(ev));
7182
7183 ev.store_hint = persistent;
7184
7185 bacpy(&ev.rpa, &irk->rpa);
7186 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7187 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7188 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7189
7190 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7191 }
7192
mgmt_new_csrk(struct hci_dev * hdev,struct smp_csrk * csrk,bool persistent)7193 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7194 bool persistent)
7195 {
7196 struct mgmt_ev_new_csrk ev;
7197
7198 memset(&ev, 0, sizeof(ev));
7199
7200 /* Devices using resolvable or non-resolvable random addresses
7201 * without providing an identity resolving key don't require
7202 * to store signature resolving keys. Their addresses will change
7203 * the next time around.
7204 *
7205 * Only when a remote device provides an identity address
7206 * make sure the signature resolving key is stored. So allow
7207 * static random and public addresses here.
7208 */
7209 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7210 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7211 ev.store_hint = 0x00;
7212 else
7213 ev.store_hint = persistent;
7214
7215 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7216 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7217 ev.key.type = csrk->type;
7218 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7219
7220 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7221 }
7222
mgmt_new_conn_param(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 store_hint,u16 min_interval,u16 max_interval,u16 latency,u16 timeout)7223 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7224 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7225 u16 max_interval, u16 latency, u16 timeout)
7226 {
7227 struct mgmt_ev_new_conn_param ev;
7228
7229 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7230 return;
7231
7232 memset(&ev, 0, sizeof(ev));
7233 bacpy(&ev.addr.bdaddr, bdaddr);
7234 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7235 ev.store_hint = store_hint;
7236 ev.min_interval = cpu_to_le16(min_interval);
7237 ev.max_interval = cpu_to_le16(max_interval);
7238 ev.latency = cpu_to_le16(latency);
7239 ev.timeout = cpu_to_le16(timeout);
7240
7241 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7242 }
7243
mgmt_device_connected(struct hci_dev * hdev,struct hci_conn * conn,u32 flags,u8 * name,u8 name_len)7244 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7245 u32 flags, u8 *name, u8 name_len)
7246 {
7247 char buf[512];
7248 struct mgmt_ev_device_connected *ev = (void *) buf;
7249 u16 eir_len = 0;
7250
7251 bacpy(&ev->addr.bdaddr, &conn->dst);
7252 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7253
7254 ev->flags = __cpu_to_le32(flags);
7255
7256 /* We must ensure that the EIR Data fields are ordered and
7257 * unique. Keep it simple for now and avoid the problem by not
7258 * adding any BR/EDR data to the LE adv.
7259 */
7260 if (conn->le_adv_data_len > 0) {
7261 memcpy(&ev->eir[eir_len],
7262 conn->le_adv_data, conn->le_adv_data_len);
7263 eir_len = conn->le_adv_data_len;
7264 } else {
7265 if (name_len > 0)
7266 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7267 name, name_len);
7268
7269 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7270 eir_len = eir_append_data(ev->eir, eir_len,
7271 EIR_CLASS_OF_DEV,
7272 conn->dev_class, 3);
7273 }
7274
7275 ev->eir_len = cpu_to_le16(eir_len);
7276
7277 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7278 sizeof(*ev) + eir_len, NULL);
7279 }
7280
disconnect_rsp(struct mgmt_pending_cmd * cmd,void * data)7281 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7282 {
7283 struct sock **sk = data;
7284
7285 cmd->cmd_complete(cmd, 0);
7286
7287 *sk = cmd->sk;
7288 sock_hold(*sk);
7289
7290 mgmt_pending_remove(cmd);
7291 }
7292
unpair_device_rsp(struct mgmt_pending_cmd * cmd,void * data)7293 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7294 {
7295 struct hci_dev *hdev = data;
7296 struct mgmt_cp_unpair_device *cp = cmd->param;
7297
7298 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7299
7300 cmd->cmd_complete(cmd, 0);
7301 mgmt_pending_remove(cmd);
7302 }
7303
mgmt_powering_down(struct hci_dev * hdev)7304 bool mgmt_powering_down(struct hci_dev *hdev)
7305 {
7306 struct mgmt_pending_cmd *cmd;
7307 struct mgmt_mode *cp;
7308
7309 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7310 if (!cmd)
7311 return false;
7312
7313 cp = cmd->param;
7314 if (!cp->val)
7315 return true;
7316
7317 return false;
7318 }
7319
mgmt_device_disconnected(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 reason,bool mgmt_connected)7320 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7321 u8 link_type, u8 addr_type, u8 reason,
7322 bool mgmt_connected)
7323 {
7324 struct mgmt_ev_device_disconnected ev;
7325 struct sock *sk = NULL;
7326
7327 /* The connection is still in hci_conn_hash so test for 1
7328 * instead of 0 to know if this is the last one.
7329 */
7330 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7331 cancel_delayed_work(&hdev->power_off);
7332 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7333 }
7334
7335 if (!mgmt_connected)
7336 return;
7337
7338 if (link_type != ACL_LINK && link_type != LE_LINK)
7339 return;
7340
7341 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7342
7343 bacpy(&ev.addr.bdaddr, bdaddr);
7344 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7345 ev.reason = reason;
7346
7347 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7348
7349 if (sk)
7350 sock_put(sk);
7351
7352 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7353 hdev);
7354 }
7355
mgmt_disconnect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7356 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7357 u8 link_type, u8 addr_type, u8 status)
7358 {
7359 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7360 struct mgmt_cp_disconnect *cp;
7361 struct mgmt_pending_cmd *cmd;
7362
7363 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7364 hdev);
7365
7366 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7367 if (!cmd)
7368 return;
7369
7370 cp = cmd->param;
7371
7372 if (bacmp(bdaddr, &cp->addr.bdaddr))
7373 return;
7374
7375 if (cp->addr.type != bdaddr_type)
7376 return;
7377
7378 cmd->cmd_complete(cmd, mgmt_status(status));
7379 mgmt_pending_remove(cmd);
7380 }
7381
mgmt_connect_failed(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7382 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7383 u8 addr_type, u8 status)
7384 {
7385 struct mgmt_ev_connect_failed ev;
7386
7387 /* The connection is still in hci_conn_hash so test for 1
7388 * instead of 0 to know if this is the last one.
7389 */
7390 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7391 cancel_delayed_work(&hdev->power_off);
7392 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7393 }
7394
7395 bacpy(&ev.addr.bdaddr, bdaddr);
7396 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7397 ev.status = mgmt_status(status);
7398
7399 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7400 }
7401
mgmt_pin_code_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 secure)7402 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7403 {
7404 struct mgmt_ev_pin_code_request ev;
7405
7406 bacpy(&ev.addr.bdaddr, bdaddr);
7407 ev.addr.type = BDADDR_BREDR;
7408 ev.secure = secure;
7409
7410 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7411 }
7412
mgmt_pin_code_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)7413 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7414 u8 status)
7415 {
7416 struct mgmt_pending_cmd *cmd;
7417
7418 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7419 if (!cmd)
7420 return;
7421
7422 cmd->cmd_complete(cmd, mgmt_status(status));
7423 mgmt_pending_remove(cmd);
7424 }
7425
mgmt_pin_code_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 status)7426 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7427 u8 status)
7428 {
7429 struct mgmt_pending_cmd *cmd;
7430
7431 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7432 if (!cmd)
7433 return;
7434
7435 cmd->cmd_complete(cmd, mgmt_status(status));
7436 mgmt_pending_remove(cmd);
7437 }
7438
mgmt_user_confirm_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 value,u8 confirm_hint)7439 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7440 u8 link_type, u8 addr_type, u32 value,
7441 u8 confirm_hint)
7442 {
7443 struct mgmt_ev_user_confirm_request ev;
7444
7445 BT_DBG("%s", hdev->name);
7446
7447 bacpy(&ev.addr.bdaddr, bdaddr);
7448 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7449 ev.confirm_hint = confirm_hint;
7450 ev.value = cpu_to_le32(value);
7451
7452 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7453 NULL);
7454 }
7455
mgmt_user_passkey_request(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type)7456 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7457 u8 link_type, u8 addr_type)
7458 {
7459 struct mgmt_ev_user_passkey_request ev;
7460
7461 BT_DBG("%s", hdev->name);
7462
7463 bacpy(&ev.addr.bdaddr, bdaddr);
7464 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7465
7466 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7467 NULL);
7468 }
7469
user_pairing_resp_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status,u8 opcode)7470 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7471 u8 link_type, u8 addr_type, u8 status,
7472 u8 opcode)
7473 {
7474 struct mgmt_pending_cmd *cmd;
7475
7476 cmd = pending_find(opcode, hdev);
7477 if (!cmd)
7478 return -ENOENT;
7479
7480 cmd->cmd_complete(cmd, mgmt_status(status));
7481 mgmt_pending_remove(cmd);
7482
7483 return 0;
7484 }
7485
mgmt_user_confirm_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7486 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7487 u8 link_type, u8 addr_type, u8 status)
7488 {
7489 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7490 status, MGMT_OP_USER_CONFIRM_REPLY);
7491 }
7492
mgmt_user_confirm_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7493 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7494 u8 link_type, u8 addr_type, u8 status)
7495 {
7496 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7497 status,
7498 MGMT_OP_USER_CONFIRM_NEG_REPLY);
7499 }
7500
mgmt_user_passkey_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7501 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7502 u8 link_type, u8 addr_type, u8 status)
7503 {
7504 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7505 status, MGMT_OP_USER_PASSKEY_REPLY);
7506 }
7507
mgmt_user_passkey_neg_reply_complete(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 status)7508 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7509 u8 link_type, u8 addr_type, u8 status)
7510 {
7511 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7512 status,
7513 MGMT_OP_USER_PASSKEY_NEG_REPLY);
7514 }
7515
mgmt_user_passkey_notify(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u32 passkey,u8 entered)7516 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7517 u8 link_type, u8 addr_type, u32 passkey,
7518 u8 entered)
7519 {
7520 struct mgmt_ev_passkey_notify ev;
7521
7522 BT_DBG("%s", hdev->name);
7523
7524 bacpy(&ev.addr.bdaddr, bdaddr);
7525 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7526 ev.passkey = __cpu_to_le32(passkey);
7527 ev.entered = entered;
7528
7529 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7530 }
7531
mgmt_auth_failed(struct hci_conn * conn,u8 hci_status)7532 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7533 {
7534 struct mgmt_ev_auth_failed ev;
7535 struct mgmt_pending_cmd *cmd;
7536 u8 status = mgmt_status(hci_status);
7537
7538 bacpy(&ev.addr.bdaddr, &conn->dst);
7539 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7540 ev.status = status;
7541
7542 cmd = find_pairing(conn);
7543
7544 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7545 cmd ? cmd->sk : NULL);
7546
7547 if (cmd) {
7548 cmd->cmd_complete(cmd, status);
7549 mgmt_pending_remove(cmd);
7550 }
7551 }
7552
mgmt_auth_enable_complete(struct hci_dev * hdev,u8 status)7553 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7554 {
7555 struct cmd_lookup match = { NULL, hdev };
7556 bool changed;
7557
7558 if (status) {
7559 u8 mgmt_err = mgmt_status(status);
7560 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7561 cmd_status_rsp, &mgmt_err);
7562 return;
7563 }
7564
7565 if (test_bit(HCI_AUTH, &hdev->flags))
7566 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7567 else
7568 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7569
7570 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7571 &match);
7572
7573 if (changed)
7574 new_settings(hdev, match.sk);
7575
7576 if (match.sk)
7577 sock_put(match.sk);
7578 }
7579
clear_eir(struct hci_request * req)7580 static void clear_eir(struct hci_request *req)
7581 {
7582 struct hci_dev *hdev = req->hdev;
7583 struct hci_cp_write_eir cp;
7584
7585 if (!lmp_ext_inq_capable(hdev))
7586 return;
7587
7588 memset(hdev->eir, 0, sizeof(hdev->eir));
7589
7590 memset(&cp, 0, sizeof(cp));
7591
7592 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7593 }
7594
mgmt_ssp_enable_complete(struct hci_dev * hdev,u8 enable,u8 status)7595 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7596 {
7597 struct cmd_lookup match = { NULL, hdev };
7598 struct hci_request req;
7599 bool changed = false;
7600
7601 if (status) {
7602 u8 mgmt_err = mgmt_status(status);
7603
7604 if (enable && hci_dev_test_and_clear_flag(hdev,
7605 HCI_SSP_ENABLED)) {
7606 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7607 new_settings(hdev, NULL);
7608 }
7609
7610 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7611 &mgmt_err);
7612 return;
7613 }
7614
7615 if (enable) {
7616 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7617 } else {
7618 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7619 if (!changed)
7620 changed = hci_dev_test_and_clear_flag(hdev,
7621 HCI_HS_ENABLED);
7622 else
7623 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7624 }
7625
7626 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7627
7628 if (changed)
7629 new_settings(hdev, match.sk);
7630
7631 if (match.sk)
7632 sock_put(match.sk);
7633
7634 hci_req_init(&req, hdev);
7635
7636 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7637 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7638 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7639 sizeof(enable), &enable);
7640 __hci_req_update_eir(&req);
7641 } else {
7642 clear_eir(&req);
7643 }
7644
7645 hci_req_run(&req, NULL);
7646 }
7647
sk_lookup(struct mgmt_pending_cmd * cmd,void * data)7648 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7649 {
7650 struct cmd_lookup *match = data;
7651
7652 if (match->sk == NULL) {
7653 match->sk = cmd->sk;
7654 sock_hold(match->sk);
7655 }
7656 }
7657
mgmt_set_class_of_dev_complete(struct hci_dev * hdev,u8 * dev_class,u8 status)7658 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7659 u8 status)
7660 {
7661 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7662
7663 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7664 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7665 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7666
7667 if (!status) {
7668 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7669 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7670 ext_info_changed(hdev, NULL);
7671 }
7672
7673 if (match.sk)
7674 sock_put(match.sk);
7675 }
7676
mgmt_set_local_name_complete(struct hci_dev * hdev,u8 * name,u8 status)7677 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7678 {
7679 struct mgmt_cp_set_local_name ev;
7680 struct mgmt_pending_cmd *cmd;
7681
7682 if (status)
7683 return;
7684
7685 memset(&ev, 0, sizeof(ev));
7686 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7687 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7688
7689 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7690 if (!cmd) {
7691 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7692
7693 /* If this is a HCI command related to powering on the
7694 * HCI dev don't send any mgmt signals.
7695 */
7696 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7697 return;
7698 }
7699
7700 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7701 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7702 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7703 }
7704
has_uuid(u8 * uuid,u16 uuid_count,u8 (* uuids)[16])7705 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7706 {
7707 int i;
7708
7709 for (i = 0; i < uuid_count; i++) {
7710 if (!memcmp(uuid, uuids[i], 16))
7711 return true;
7712 }
7713
7714 return false;
7715 }
7716
eir_has_uuids(u8 * eir,u16 eir_len,u16 uuid_count,u8 (* uuids)[16])7717 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7718 {
7719 u16 parsed = 0;
7720
7721 while (parsed < eir_len) {
7722 u8 field_len = eir[0];
7723 u8 uuid[16];
7724 int i;
7725
7726 if (field_len == 0)
7727 break;
7728
7729 if (eir_len - parsed < field_len + 1)
7730 break;
7731
7732 switch (eir[1]) {
7733 case EIR_UUID16_ALL:
7734 case EIR_UUID16_SOME:
7735 for (i = 0; i + 3 <= field_len; i += 2) {
7736 memcpy(uuid, bluetooth_base_uuid, 16);
7737 uuid[13] = eir[i + 3];
7738 uuid[12] = eir[i + 2];
7739 if (has_uuid(uuid, uuid_count, uuids))
7740 return true;
7741 }
7742 break;
7743 case EIR_UUID32_ALL:
7744 case EIR_UUID32_SOME:
7745 for (i = 0; i + 5 <= field_len; i += 4) {
7746 memcpy(uuid, bluetooth_base_uuid, 16);
7747 uuid[15] = eir[i + 5];
7748 uuid[14] = eir[i + 4];
7749 uuid[13] = eir[i + 3];
7750 uuid[12] = eir[i + 2];
7751 if (has_uuid(uuid, uuid_count, uuids))
7752 return true;
7753 }
7754 break;
7755 case EIR_UUID128_ALL:
7756 case EIR_UUID128_SOME:
7757 for (i = 0; i + 17 <= field_len; i += 16) {
7758 memcpy(uuid, eir + i + 2, 16);
7759 if (has_uuid(uuid, uuid_count, uuids))
7760 return true;
7761 }
7762 break;
7763 }
7764
7765 parsed += field_len + 1;
7766 eir += field_len + 1;
7767 }
7768
7769 return false;
7770 }
7771
restart_le_scan(struct hci_dev * hdev)7772 static void restart_le_scan(struct hci_dev *hdev)
7773 {
7774 /* If controller is not scanning we are done. */
7775 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7776 return;
7777
7778 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7779 hdev->discovery.scan_start +
7780 hdev->discovery.scan_duration))
7781 return;
7782
7783 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7784 DISCOV_LE_RESTART_DELAY);
7785 }
7786
is_filter_match(struct hci_dev * hdev,s8 rssi,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)7787 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7788 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7789 {
7790 /* If a RSSI threshold has been specified, and
7791 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7792 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7793 * is set, let it through for further processing, as we might need to
7794 * restart the scan.
7795 *
7796 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7797 * the results are also dropped.
7798 */
7799 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7800 (rssi == HCI_RSSI_INVALID ||
7801 (rssi < hdev->discovery.rssi &&
7802 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7803 return false;
7804
7805 if (hdev->discovery.uuid_count != 0) {
7806 /* If a list of UUIDs is provided in filter, results with no
7807 * matching UUID should be dropped.
7808 */
7809 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7810 hdev->discovery.uuids) &&
7811 !eir_has_uuids(scan_rsp, scan_rsp_len,
7812 hdev->discovery.uuid_count,
7813 hdev->discovery.uuids))
7814 return false;
7815 }
7816
7817 /* If duplicate filtering does not report RSSI changes, then restart
7818 * scanning to ensure updated result with updated RSSI values.
7819 */
7820 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7821 restart_le_scan(hdev);
7822
7823 /* Validate RSSI value against the RSSI threshold once more. */
7824 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7825 rssi < hdev->discovery.rssi)
7826 return false;
7827 }
7828
7829 return true;
7830 }
7831
mgmt_device_found(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,u8 * dev_class,s8 rssi,u32 flags,u8 * eir,u16 eir_len,u8 * scan_rsp,u8 scan_rsp_len)7832 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7833 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7834 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7835 {
7836 char buf[512];
7837 struct mgmt_ev_device_found *ev = (void *)buf;
7838 size_t ev_size;
7839
7840 /* Don't send events for a non-kernel initiated discovery. With
7841 * LE one exception is if we have pend_le_reports > 0 in which
7842 * case we're doing passive scanning and want these events.
7843 */
7844 if (!hci_discovery_active(hdev)) {
7845 if (link_type == ACL_LINK)
7846 return;
7847 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7848 return;
7849 }
7850
7851 if (hdev->discovery.result_filtering) {
7852 /* We are using service discovery */
7853 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7854 scan_rsp_len))
7855 return;
7856 }
7857
7858 if (hdev->discovery.limited) {
7859 /* Check for limited discoverable bit */
7860 if (dev_class) {
7861 if (!(dev_class[1] & 0x20))
7862 return;
7863 } else {
7864 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7865 if (!flags || !(flags[0] & LE_AD_LIMITED))
7866 return;
7867 }
7868 }
7869
7870 /* Make sure that the buffer is big enough. The 5 extra bytes
7871 * are for the potential CoD field.
7872 */
7873 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7874 return;
7875
7876 memset(buf, 0, sizeof(buf));
7877
7878 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7879 * RSSI value was reported as 0 when not available. This behavior
7880 * is kept when using device discovery. This is required for full
7881 * backwards compatibility with the API.
7882 *
7883 * However when using service discovery, the value 127 will be
7884 * returned when the RSSI is not available.
7885 */
7886 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7887 link_type == ACL_LINK)
7888 rssi = 0;
7889
7890 bacpy(&ev->addr.bdaddr, bdaddr);
7891 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7892 ev->rssi = rssi;
7893 ev->flags = cpu_to_le32(flags);
7894
7895 if (eir_len > 0)
7896 /* Copy EIR or advertising data into event */
7897 memcpy(ev->eir, eir, eir_len);
7898
7899 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7900 NULL))
7901 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7902 dev_class, 3);
7903
7904 if (scan_rsp_len > 0)
7905 /* Append scan response data to event */
7906 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7907
7908 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7909 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7910
7911 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7912 }
7913
mgmt_remote_name(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 link_type,u8 addr_type,s8 rssi,u8 * name,u8 name_len)7914 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7915 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7916 {
7917 struct mgmt_ev_device_found *ev;
7918 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7919 u16 eir_len;
7920
7921 ev = (struct mgmt_ev_device_found *) buf;
7922
7923 memset(buf, 0, sizeof(buf));
7924
7925 bacpy(&ev->addr.bdaddr, bdaddr);
7926 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7927 ev->rssi = rssi;
7928
7929 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7930 name_len);
7931
7932 ev->eir_len = cpu_to_le16(eir_len);
7933
7934 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7935 }
7936
mgmt_discovering(struct hci_dev * hdev,u8 discovering)7937 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7938 {
7939 struct mgmt_ev_discovering ev;
7940
7941 BT_DBG("%s discovering %u", hdev->name, discovering);
7942
7943 memset(&ev, 0, sizeof(ev));
7944 ev.type = hdev->discovery.type;
7945 ev.discovering = discovering;
7946
7947 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7948 }
7949
7950 static struct hci_mgmt_chan chan = {
7951 .channel = HCI_CHANNEL_CONTROL,
7952 .handler_count = ARRAY_SIZE(mgmt_handlers),
7953 .handlers = mgmt_handlers,
7954 .hdev_init = mgmt_init_hdev,
7955 };
7956
mgmt_init(void)7957 int mgmt_init(void)
7958 {
7959 return hci_mgmt_chan_register(&chan);
7960 }
7961
mgmt_exit(void)7962 void mgmt_exit(void)
7963 {
7964 hci_mgmt_chan_unregister(&chan);
7965 }
7966