1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 14 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 }; 110 111 static const u16 mgmt_events[] = { 112 MGMT_EV_CONTROLLER_ERROR, 113 MGMT_EV_INDEX_ADDED, 114 MGMT_EV_INDEX_REMOVED, 115 MGMT_EV_NEW_SETTINGS, 116 MGMT_EV_CLASS_OF_DEV_CHANGED, 117 MGMT_EV_LOCAL_NAME_CHANGED, 118 MGMT_EV_NEW_LINK_KEY, 119 MGMT_EV_NEW_LONG_TERM_KEY, 120 MGMT_EV_DEVICE_CONNECTED, 121 MGMT_EV_DEVICE_DISCONNECTED, 122 MGMT_EV_CONNECT_FAILED, 123 MGMT_EV_PIN_CODE_REQUEST, 124 MGMT_EV_USER_CONFIRM_REQUEST, 125 MGMT_EV_USER_PASSKEY_REQUEST, 126 MGMT_EV_AUTH_FAILED, 127 MGMT_EV_DEVICE_FOUND, 128 MGMT_EV_DISCOVERING, 129 MGMT_EV_DEVICE_BLOCKED, 130 MGMT_EV_DEVICE_UNBLOCKED, 131 MGMT_EV_DEVICE_UNPAIRED, 132 MGMT_EV_PASSKEY_NOTIFY, 133 MGMT_EV_NEW_IRK, 134 MGMT_EV_NEW_CSRK, 135 MGMT_EV_DEVICE_ADDED, 136 MGMT_EV_DEVICE_REMOVED, 137 MGMT_EV_NEW_CONN_PARAM, 138 MGMT_EV_UNCONF_INDEX_ADDED, 139 MGMT_EV_UNCONF_INDEX_REMOVED, 140 MGMT_EV_NEW_CONFIG_OPTIONS, 141 MGMT_EV_EXT_INDEX_ADDED, 142 MGMT_EV_EXT_INDEX_REMOVED, 143 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 144 MGMT_EV_ADVERTISING_ADDED, 145 MGMT_EV_ADVERTISING_REMOVED, 146 MGMT_EV_EXT_INFO_CHANGED, 147 }; 148 149 static const u16 mgmt_untrusted_commands[] = { 150 MGMT_OP_READ_INDEX_LIST, 151 MGMT_OP_READ_INFO, 152 MGMT_OP_READ_UNCONF_INDEX_LIST, 153 MGMT_OP_READ_CONFIG_INFO, 154 MGMT_OP_READ_EXT_INDEX_LIST, 155 MGMT_OP_READ_EXT_INFO, 156 }; 157 158 static const u16 mgmt_untrusted_events[] = { 159 MGMT_EV_INDEX_ADDED, 160 MGMT_EV_INDEX_REMOVED, 161 MGMT_EV_NEW_SETTINGS, 162 MGMT_EV_CLASS_OF_DEV_CHANGED, 163 MGMT_EV_LOCAL_NAME_CHANGED, 164 MGMT_EV_UNCONF_INDEX_ADDED, 165 MGMT_EV_UNCONF_INDEX_REMOVED, 166 MGMT_EV_NEW_CONFIG_OPTIONS, 167 MGMT_EV_EXT_INDEX_ADDED, 168 MGMT_EV_EXT_INDEX_REMOVED, 169 MGMT_EV_EXT_INFO_CHANGED, 170 }; 171 172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 173 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 175 "\x00\x00\x00\x00\x00\x00\x00\x00" 176 177 /* HCI to MGMT error code conversion table */ 178 static u8 mgmt_status_table[] = { 179 MGMT_STATUS_SUCCESS, 180 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 181 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 182 MGMT_STATUS_FAILED, /* Hardware Failure */ 183 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 184 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 185 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 186 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 187 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 188 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 189 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 190 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 191 MGMT_STATUS_BUSY, /* Command Disallowed */ 192 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 193 MGMT_STATUS_REJECTED, /* Rejected Security */ 194 MGMT_STATUS_REJECTED, /* Rejected Personal */ 195 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 196 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 197 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 198 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 199 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 200 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 201 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 202 MGMT_STATUS_BUSY, /* Repeated Attempts */ 203 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 204 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 205 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 206 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 207 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 208 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 209 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 210 MGMT_STATUS_FAILED, /* Unspecified Error */ 211 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 212 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 213 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 214 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 215 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 216 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 217 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 218 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 219 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 220 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 221 MGMT_STATUS_FAILED, /* Transaction Collision */ 222 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 223 MGMT_STATUS_REJECTED, /* QoS Rejected */ 224 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 225 MGMT_STATUS_REJECTED, /* Insufficient Security */ 226 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 227 MGMT_STATUS_BUSY, /* Role Switch Pending */ 228 MGMT_STATUS_FAILED, /* Slot Violation */ 229 MGMT_STATUS_FAILED, /* Role Switch Failed */ 230 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 231 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 232 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 233 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 234 MGMT_STATUS_BUSY, /* Controller Busy */ 235 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 236 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 237 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 238 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 239 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 240 }; 241 242 static u8 mgmt_status(u8 hci_status) 243 { 244 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 245 return mgmt_status_table[hci_status]; 246 247 return MGMT_STATUS_FAILED; 248 } 249 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 251 u16 len, int flag) 252 { 253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 254 flag, NULL); 255 } 256 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 258 u16 len, int flag, struct sock *skip_sk) 259 { 260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 261 flag, skip_sk); 262 } 263 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 265 struct sock *skip_sk) 266 { 267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 268 HCI_SOCK_TRUSTED, skip_sk); 269 } 270 271 static u8 le_addr_type(u8 mgmt_addr_type) 272 { 273 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 274 return ADDR_LE_DEV_PUBLIC; 275 else 276 return ADDR_LE_DEV_RANDOM; 277 } 278 279 void mgmt_fill_version_info(void *ver) 280 { 281 struct mgmt_rp_read_version *rp = ver; 282 283 rp->version = MGMT_VERSION; 284 rp->revision = cpu_to_le16(MGMT_REVISION); 285 } 286 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 288 u16 data_len) 289 { 290 struct mgmt_rp_read_version rp; 291 292 BT_DBG("sock %p", sk); 293 294 mgmt_fill_version_info(&rp); 295 296 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 297 &rp, sizeof(rp)); 298 } 299 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 301 u16 data_len) 302 { 303 struct mgmt_rp_read_commands *rp; 304 u16 num_commands, num_events; 305 size_t rp_size; 306 int i, err; 307 308 BT_DBG("sock %p", sk); 309 310 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 311 num_commands = ARRAY_SIZE(mgmt_commands); 312 num_events = ARRAY_SIZE(mgmt_events); 313 } else { 314 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 315 num_events = ARRAY_SIZE(mgmt_untrusted_events); 316 } 317 318 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 319 320 rp = kmalloc(rp_size, GFP_KERNEL); 321 if (!rp) 322 return -ENOMEM; 323 324 rp->num_commands = cpu_to_le16(num_commands); 325 rp->num_events = cpu_to_le16(num_events); 326 327 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 328 __le16 *opcode = rp->opcodes; 329 330 for (i = 0; i < num_commands; i++, opcode++) 331 put_unaligned_le16(mgmt_commands[i], opcode); 332 333 for (i = 0; i < num_events; i++, opcode++) 334 put_unaligned_le16(mgmt_events[i], opcode); 335 } else { 336 __le16 *opcode = rp->opcodes; 337 338 for (i = 0; i < num_commands; i++, opcode++) 339 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 340 341 for (i = 0; i < num_events; i++, opcode++) 342 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 343 } 344 345 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 346 rp, rp_size); 347 kfree(rp); 348 349 return err; 350 } 351 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 353 u16 data_len) 354 { 355 struct mgmt_rp_read_index_list *rp; 356 struct hci_dev *d; 357 size_t rp_len; 358 u16 count; 359 int err; 360 361 BT_DBG("sock %p", sk); 362 363 read_lock(&hci_dev_list_lock); 364 365 count = 0; 366 list_for_each_entry(d, &hci_dev_list, list) { 367 if (d->dev_type == HCI_PRIMARY && 368 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 369 count++; 370 } 371 372 rp_len = sizeof(*rp) + (2 * count); 373 rp = kmalloc(rp_len, GFP_ATOMIC); 374 if (!rp) { 375 read_unlock(&hci_dev_list_lock); 376 return -ENOMEM; 377 } 378 379 count = 0; 380 list_for_each_entry(d, &hci_dev_list, list) { 381 if (hci_dev_test_flag(d, HCI_SETUP) || 382 hci_dev_test_flag(d, HCI_CONFIG) || 383 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 384 continue; 385 386 /* Devices marked as raw-only are neither configured 387 * nor unconfigured controllers. 388 */ 389 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 390 continue; 391 392 if (d->dev_type == HCI_PRIMARY && 393 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 394 rp->index[count++] = cpu_to_le16(d->id); 395 BT_DBG("Added hci%u", d->id); 396 } 397 } 398 399 rp->num_controllers = cpu_to_le16(count); 400 rp_len = sizeof(*rp) + (2 * count); 401 402 read_unlock(&hci_dev_list_lock); 403 404 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 405 0, rp, rp_len); 406 407 kfree(rp); 408 409 return err; 410 } 411 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 413 void *data, u16 data_len) 414 { 415 struct mgmt_rp_read_unconf_index_list *rp; 416 struct hci_dev *d; 417 size_t rp_len; 418 u16 count; 419 int err; 420 421 BT_DBG("sock %p", sk); 422 423 read_lock(&hci_dev_list_lock); 424 425 count = 0; 426 list_for_each_entry(d, &hci_dev_list, list) { 427 if (d->dev_type == HCI_PRIMARY && 428 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 429 count++; 430 } 431 432 rp_len = sizeof(*rp) + (2 * count); 433 rp = kmalloc(rp_len, GFP_ATOMIC); 434 if (!rp) { 435 read_unlock(&hci_dev_list_lock); 436 return -ENOMEM; 437 } 438 439 count = 0; 440 list_for_each_entry(d, &hci_dev_list, list) { 441 if (hci_dev_test_flag(d, HCI_SETUP) || 442 hci_dev_test_flag(d, HCI_CONFIG) || 443 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 444 continue; 445 446 /* Devices marked as raw-only are neither configured 447 * nor unconfigured controllers. 448 */ 449 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 450 continue; 451 452 if (d->dev_type == HCI_PRIMARY && 453 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 454 rp->index[count++] = cpu_to_le16(d->id); 455 BT_DBG("Added hci%u", d->id); 456 } 457 } 458 459 rp->num_controllers = cpu_to_le16(count); 460 rp_len = sizeof(*rp) + (2 * count); 461 462 read_unlock(&hci_dev_list_lock); 463 464 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 465 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 466 467 kfree(rp); 468 469 return err; 470 } 471 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 473 void *data, u16 data_len) 474 { 475 struct mgmt_rp_read_ext_index_list *rp; 476 struct hci_dev *d; 477 size_t rp_len; 478 u16 count; 479 int err; 480 481 BT_DBG("sock %p", sk); 482 483 read_lock(&hci_dev_list_lock); 484 485 count = 0; 486 list_for_each_entry(d, &hci_dev_list, list) { 487 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 488 count++; 489 } 490 491 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count); 492 rp = kmalloc(rp_len, GFP_ATOMIC); 493 if (!rp) { 494 read_unlock(&hci_dev_list_lock); 495 return -ENOMEM; 496 } 497 498 count = 0; 499 list_for_each_entry(d, &hci_dev_list, list) { 500 if (hci_dev_test_flag(d, HCI_SETUP) || 501 hci_dev_test_flag(d, HCI_CONFIG) || 502 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 503 continue; 504 505 /* Devices marked as raw-only are neither configured 506 * nor unconfigured controllers. 507 */ 508 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 509 continue; 510 511 if (d->dev_type == HCI_PRIMARY) { 512 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 513 rp->entry[count].type = 0x01; 514 else 515 rp->entry[count].type = 0x00; 516 } else if (d->dev_type == HCI_AMP) { 517 rp->entry[count].type = 0x02; 518 } else { 519 continue; 520 } 521 522 rp->entry[count].bus = d->bus; 523 rp->entry[count++].index = cpu_to_le16(d->id); 524 BT_DBG("Added hci%u", d->id); 525 } 526 527 rp->num_controllers = cpu_to_le16(count); 528 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count); 529 530 read_unlock(&hci_dev_list_lock); 531 532 /* If this command is called at least once, then all the 533 * default index and unconfigured index events are disabled 534 * and from now on only extended index events are used. 535 */ 536 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 537 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 538 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 539 540 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 541 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len); 542 543 kfree(rp); 544 545 return err; 546 } 547 548 static bool is_configured(struct hci_dev *hdev) 549 { 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 552 return false; 553 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) && 555 !bacmp(&hdev->public_addr, BDADDR_ANY)) 556 return false; 557 558 return true; 559 } 560 561 static __le32 get_missing_options(struct hci_dev *hdev) 562 { 563 u32 options = 0; 564 565 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 566 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 567 options |= MGMT_OPTION_EXTERNAL_CONFIG; 568 569 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) && 570 !bacmp(&hdev->public_addr, BDADDR_ANY)) 571 options |= MGMT_OPTION_PUBLIC_ADDRESS; 572 573 return cpu_to_le32(options); 574 } 575 576 static int new_options(struct hci_dev *hdev, struct sock *skip) 577 { 578 __le32 options = get_missing_options(hdev); 579 580 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 581 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 582 } 583 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 585 { 586 __le32 options = get_missing_options(hdev); 587 588 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 589 sizeof(options)); 590 } 591 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 593 void *data, u16 data_len) 594 { 595 struct mgmt_rp_read_config_info rp; 596 u32 options = 0; 597 598 BT_DBG("sock %p %s", sk, hdev->name); 599 600 hci_dev_lock(hdev); 601 602 memset(&rp, 0, sizeof(rp)); 603 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 604 605 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 606 options |= MGMT_OPTION_EXTERNAL_CONFIG; 607 608 if (hdev->set_bdaddr) 609 options |= MGMT_OPTION_PUBLIC_ADDRESS; 610 611 rp.supported_options = cpu_to_le32(options); 612 rp.missing_options = get_missing_options(hdev); 613 614 hci_dev_unlock(hdev); 615 616 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 617 &rp, sizeof(rp)); 618 } 619 620 static u32 get_supported_settings(struct hci_dev *hdev) 621 { 622 u32 settings = 0; 623 624 settings |= MGMT_SETTING_POWERED; 625 settings |= MGMT_SETTING_BONDABLE; 626 settings |= MGMT_SETTING_DEBUG_KEYS; 627 settings |= MGMT_SETTING_CONNECTABLE; 628 settings |= MGMT_SETTING_DISCOVERABLE; 629 630 if (lmp_bredr_capable(hdev)) { 631 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 632 settings |= MGMT_SETTING_FAST_CONNECTABLE; 633 settings |= MGMT_SETTING_BREDR; 634 settings |= MGMT_SETTING_LINK_SECURITY; 635 636 if (lmp_ssp_capable(hdev)) { 637 settings |= MGMT_SETTING_SSP; 638 settings |= MGMT_SETTING_HS; 639 } 640 641 if (lmp_sc_capable(hdev)) 642 settings |= MGMT_SETTING_SECURE_CONN; 643 } 644 645 if (lmp_le_capable(hdev)) { 646 settings |= MGMT_SETTING_LE; 647 settings |= MGMT_SETTING_ADVERTISING; 648 settings |= MGMT_SETTING_SECURE_CONN; 649 settings |= MGMT_SETTING_PRIVACY; 650 settings |= MGMT_SETTING_STATIC_ADDRESS; 651 } 652 653 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 654 hdev->set_bdaddr) 655 settings |= MGMT_SETTING_CONFIGURATION; 656 657 return settings; 658 } 659 660 static u32 get_current_settings(struct hci_dev *hdev) 661 { 662 u32 settings = 0; 663 664 if (hdev_is_powered(hdev)) 665 settings |= MGMT_SETTING_POWERED; 666 667 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 668 settings |= MGMT_SETTING_CONNECTABLE; 669 670 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 671 settings |= MGMT_SETTING_FAST_CONNECTABLE; 672 673 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 674 settings |= MGMT_SETTING_DISCOVERABLE; 675 676 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 677 settings |= MGMT_SETTING_BONDABLE; 678 679 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 680 settings |= MGMT_SETTING_BREDR; 681 682 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 683 settings |= MGMT_SETTING_LE; 684 685 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 686 settings |= MGMT_SETTING_LINK_SECURITY; 687 688 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 689 settings |= MGMT_SETTING_SSP; 690 691 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 692 settings |= MGMT_SETTING_HS; 693 694 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 695 settings |= MGMT_SETTING_ADVERTISING; 696 697 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 698 settings |= MGMT_SETTING_SECURE_CONN; 699 700 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 701 settings |= MGMT_SETTING_DEBUG_KEYS; 702 703 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 704 settings |= MGMT_SETTING_PRIVACY; 705 706 /* The current setting for static address has two purposes. The 707 * first is to indicate if the static address will be used and 708 * the second is to indicate if it is actually set. 709 * 710 * This means if the static address is not configured, this flag 711 * will never be set. If the address is configured, then if the 712 * address is actually used decides if the flag is set or not. 713 * 714 * For single mode LE only controllers and dual-mode controllers 715 * with BR/EDR disabled, the existence of the static address will 716 * be evaluated. 717 */ 718 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 719 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 720 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 721 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 722 settings |= MGMT_SETTING_STATIC_ADDRESS; 723 } 724 725 return settings; 726 } 727 728 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 729 { 730 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 731 } 732 733 static struct mgmt_pending_cmd *pending_find_data(u16 opcode, 734 struct hci_dev *hdev, 735 const void *data) 736 { 737 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data); 738 } 739 740 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 741 { 742 struct mgmt_pending_cmd *cmd; 743 744 /* If there's a pending mgmt command the flags will not yet have 745 * their final values, so check for this first. 746 */ 747 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 748 if (cmd) { 749 struct mgmt_mode *cp = cmd->param; 750 if (cp->val == 0x01) 751 return LE_AD_GENERAL; 752 else if (cp->val == 0x02) 753 return LE_AD_LIMITED; 754 } else { 755 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 756 return LE_AD_LIMITED; 757 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 758 return LE_AD_GENERAL; 759 } 760 761 return 0; 762 } 763 764 bool mgmt_get_connectable(struct hci_dev *hdev) 765 { 766 struct mgmt_pending_cmd *cmd; 767 768 /* If there's a pending mgmt command the flag will not yet have 769 * it's final value, so check for this first. 770 */ 771 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 772 if (cmd) { 773 struct mgmt_mode *cp = cmd->param; 774 775 return cp->val; 776 } 777 778 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 779 } 780 781 static void service_cache_off(struct work_struct *work) 782 { 783 struct hci_dev *hdev = container_of(work, struct hci_dev, 784 service_cache.work); 785 struct hci_request req; 786 787 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 788 return; 789 790 hci_req_init(&req, hdev); 791 792 hci_dev_lock(hdev); 793 794 __hci_req_update_eir(&req); 795 __hci_req_update_class(&req); 796 797 hci_dev_unlock(hdev); 798 799 hci_req_run(&req, NULL); 800 } 801 802 static void rpa_expired(struct work_struct *work) 803 { 804 struct hci_dev *hdev = container_of(work, struct hci_dev, 805 rpa_expired.work); 806 struct hci_request req; 807 808 BT_DBG(""); 809 810 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 811 812 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 813 return; 814 815 /* The generation of a new RPA and programming it into the 816 * controller happens in the hci_req_enable_advertising() 817 * function. 818 */ 819 hci_req_init(&req, hdev); 820 __hci_req_enable_advertising(&req); 821 hci_req_run(&req, NULL); 822 } 823 824 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 825 { 826 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 827 return; 828 829 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 830 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 831 832 /* Non-mgmt controlled devices get this bit set 833 * implicitly so that pairing works for them, however 834 * for mgmt we require user-space to explicitly enable 835 * it 836 */ 837 hci_dev_clear_flag(hdev, HCI_BONDABLE); 838 } 839 840 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 841 void *data, u16 data_len) 842 { 843 struct mgmt_rp_read_info rp; 844 845 BT_DBG("sock %p %s", sk, hdev->name); 846 847 hci_dev_lock(hdev); 848 849 memset(&rp, 0, sizeof(rp)); 850 851 bacpy(&rp.bdaddr, &hdev->bdaddr); 852 853 rp.version = hdev->hci_ver; 854 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 855 856 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 857 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 858 859 memcpy(rp.dev_class, hdev->dev_class, 3); 860 861 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 862 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 863 864 hci_dev_unlock(hdev); 865 866 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 867 sizeof(rp)); 868 } 869 870 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 871 { 872 u16 eir_len = 0; 873 size_t name_len; 874 875 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 876 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 877 hdev->dev_class, 3); 878 879 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 880 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 881 hdev->appearance); 882 883 name_len = strlen(hdev->dev_name); 884 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 885 hdev->dev_name, name_len); 886 887 name_len = strlen(hdev->short_name); 888 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 889 hdev->short_name, name_len); 890 891 return eir_len; 892 } 893 894 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 895 void *data, u16 data_len) 896 { 897 char buf[512]; 898 struct mgmt_rp_read_ext_info *rp = (void *)buf; 899 u16 eir_len; 900 901 BT_DBG("sock %p %s", sk, hdev->name); 902 903 memset(&buf, 0, sizeof(buf)); 904 905 hci_dev_lock(hdev); 906 907 bacpy(&rp->bdaddr, &hdev->bdaddr); 908 909 rp->version = hdev->hci_ver; 910 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 911 912 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 913 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 914 915 916 eir_len = append_eir_data_to_buf(hdev, rp->eir); 917 rp->eir_len = cpu_to_le16(eir_len); 918 919 hci_dev_unlock(hdev); 920 921 /* If this command is called at least once, then the events 922 * for class of device and local name changes are disabled 923 * and only the new extended controller information event 924 * is used. 925 */ 926 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 927 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 928 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 929 930 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 931 sizeof(*rp) + eir_len); 932 } 933 934 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 935 { 936 char buf[512]; 937 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 938 u16 eir_len; 939 940 memset(buf, 0, sizeof(buf)); 941 942 eir_len = append_eir_data_to_buf(hdev, ev->eir); 943 ev->eir_len = cpu_to_le16(eir_len); 944 945 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 946 sizeof(*ev) + eir_len, 947 HCI_MGMT_EXT_INFO_EVENTS, skip); 948 } 949 950 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 951 { 952 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 953 954 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 955 sizeof(settings)); 956 } 957 958 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode) 959 { 960 BT_DBG("%s status 0x%02x", hdev->name, status); 961 962 if (hci_conn_count(hdev) == 0) { 963 cancel_delayed_work(&hdev->power_off); 964 queue_work(hdev->req_workqueue, &hdev->power_off.work); 965 } 966 } 967 968 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 969 { 970 struct mgmt_ev_advertising_added ev; 971 972 ev.instance = instance; 973 974 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 975 } 976 977 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 978 u8 instance) 979 { 980 struct mgmt_ev_advertising_removed ev; 981 982 ev.instance = instance; 983 984 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 985 } 986 987 static void cancel_adv_timeout(struct hci_dev *hdev) 988 { 989 if (hdev->adv_instance_timeout) { 990 hdev->adv_instance_timeout = 0; 991 cancel_delayed_work(&hdev->adv_instance_expire); 992 } 993 } 994 995 static int clean_up_hci_state(struct hci_dev *hdev) 996 { 997 struct hci_request req; 998 struct hci_conn *conn; 999 bool discov_stopped; 1000 int err; 1001 1002 hci_req_init(&req, hdev); 1003 1004 if (test_bit(HCI_ISCAN, &hdev->flags) || 1005 test_bit(HCI_PSCAN, &hdev->flags)) { 1006 u8 scan = 0x00; 1007 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1008 } 1009 1010 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false); 1011 1012 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1013 __hci_req_disable_advertising(&req); 1014 1015 discov_stopped = hci_req_stop_discovery(&req); 1016 1017 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1018 /* 0x15 == Terminated due to Power Off */ 1019 __hci_abort_conn(&req, conn, 0x15); 1020 } 1021 1022 err = hci_req_run(&req, clean_up_hci_complete); 1023 if (!err && discov_stopped) 1024 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 1025 1026 return err; 1027 } 1028 1029 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1030 u16 len) 1031 { 1032 struct mgmt_mode *cp = data; 1033 struct mgmt_pending_cmd *cmd; 1034 int err; 1035 1036 BT_DBG("request for %s", hdev->name); 1037 1038 if (cp->val != 0x00 && cp->val != 0x01) 1039 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1040 MGMT_STATUS_INVALID_PARAMS); 1041 1042 hci_dev_lock(hdev); 1043 1044 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1045 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1046 MGMT_STATUS_BUSY); 1047 goto failed; 1048 } 1049 1050 if (!!cp->val == hdev_is_powered(hdev)) { 1051 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1052 goto failed; 1053 } 1054 1055 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1056 if (!cmd) { 1057 err = -ENOMEM; 1058 goto failed; 1059 } 1060 1061 if (cp->val) { 1062 queue_work(hdev->req_workqueue, &hdev->power_on); 1063 err = 0; 1064 } else { 1065 /* Disconnect connections, stop scans, etc */ 1066 err = clean_up_hci_state(hdev); 1067 if (!err) 1068 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1069 HCI_POWER_OFF_TIMEOUT); 1070 1071 /* ENODATA means there were no HCI commands queued */ 1072 if (err == -ENODATA) { 1073 cancel_delayed_work(&hdev->power_off); 1074 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1075 err = 0; 1076 } 1077 } 1078 1079 failed: 1080 hci_dev_unlock(hdev); 1081 return err; 1082 } 1083 1084 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1085 { 1086 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1087 1088 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1089 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1090 } 1091 1092 int mgmt_new_settings(struct hci_dev *hdev) 1093 { 1094 return new_settings(hdev, NULL); 1095 } 1096 1097 struct cmd_lookup { 1098 struct sock *sk; 1099 struct hci_dev *hdev; 1100 u8 mgmt_status; 1101 }; 1102 1103 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1104 { 1105 struct cmd_lookup *match = data; 1106 1107 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1108 1109 list_del(&cmd->list); 1110 1111 if (match->sk == NULL) { 1112 match->sk = cmd->sk; 1113 sock_hold(match->sk); 1114 } 1115 1116 mgmt_pending_free(cmd); 1117 } 1118 1119 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1120 { 1121 u8 *status = data; 1122 1123 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1124 mgmt_pending_remove(cmd); 1125 } 1126 1127 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1128 { 1129 if (cmd->cmd_complete) { 1130 u8 *status = data; 1131 1132 cmd->cmd_complete(cmd, *status); 1133 mgmt_pending_remove(cmd); 1134 1135 return; 1136 } 1137 1138 cmd_status_rsp(cmd, data); 1139 } 1140 1141 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1142 { 1143 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1144 cmd->param, cmd->param_len); 1145 } 1146 1147 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1148 { 1149 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1150 cmd->param, sizeof(struct mgmt_addr_info)); 1151 } 1152 1153 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1154 { 1155 if (!lmp_bredr_capable(hdev)) 1156 return MGMT_STATUS_NOT_SUPPORTED; 1157 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1158 return MGMT_STATUS_REJECTED; 1159 else 1160 return MGMT_STATUS_SUCCESS; 1161 } 1162 1163 static u8 mgmt_le_support(struct hci_dev *hdev) 1164 { 1165 if (!lmp_le_capable(hdev)) 1166 return MGMT_STATUS_NOT_SUPPORTED; 1167 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1168 return MGMT_STATUS_REJECTED; 1169 else 1170 return MGMT_STATUS_SUCCESS; 1171 } 1172 1173 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status) 1174 { 1175 struct mgmt_pending_cmd *cmd; 1176 1177 BT_DBG("status 0x%02x", status); 1178 1179 hci_dev_lock(hdev); 1180 1181 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1182 if (!cmd) 1183 goto unlock; 1184 1185 if (status) { 1186 u8 mgmt_err = mgmt_status(status); 1187 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1188 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1189 goto remove_cmd; 1190 } 1191 1192 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1193 hdev->discov_timeout > 0) { 1194 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1195 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1196 } 1197 1198 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1199 new_settings(hdev, cmd->sk); 1200 1201 remove_cmd: 1202 mgmt_pending_remove(cmd); 1203 1204 unlock: 1205 hci_dev_unlock(hdev); 1206 } 1207 1208 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1209 u16 len) 1210 { 1211 struct mgmt_cp_set_discoverable *cp = data; 1212 struct mgmt_pending_cmd *cmd; 1213 u16 timeout; 1214 int err; 1215 1216 BT_DBG("request for %s", hdev->name); 1217 1218 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1219 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1220 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1221 MGMT_STATUS_REJECTED); 1222 1223 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1224 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1225 MGMT_STATUS_INVALID_PARAMS); 1226 1227 timeout = __le16_to_cpu(cp->timeout); 1228 1229 /* Disabling discoverable requires that no timeout is set, 1230 * and enabling limited discoverable requires a timeout. 1231 */ 1232 if ((cp->val == 0x00 && timeout > 0) || 1233 (cp->val == 0x02 && timeout == 0)) 1234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1235 MGMT_STATUS_INVALID_PARAMS); 1236 1237 hci_dev_lock(hdev); 1238 1239 if (!hdev_is_powered(hdev) && timeout > 0) { 1240 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1241 MGMT_STATUS_NOT_POWERED); 1242 goto failed; 1243 } 1244 1245 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1246 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1248 MGMT_STATUS_BUSY); 1249 goto failed; 1250 } 1251 1252 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1253 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1254 MGMT_STATUS_REJECTED); 1255 goto failed; 1256 } 1257 1258 if (!hdev_is_powered(hdev)) { 1259 bool changed = false; 1260 1261 /* Setting limited discoverable when powered off is 1262 * not a valid operation since it requires a timeout 1263 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1264 */ 1265 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1266 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1267 changed = true; 1268 } 1269 1270 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1271 if (err < 0) 1272 goto failed; 1273 1274 if (changed) 1275 err = new_settings(hdev, sk); 1276 1277 goto failed; 1278 } 1279 1280 /* If the current mode is the same, then just update the timeout 1281 * value with the new value. And if only the timeout gets updated, 1282 * then no need for any HCI transactions. 1283 */ 1284 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1285 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1286 HCI_LIMITED_DISCOVERABLE)) { 1287 cancel_delayed_work(&hdev->discov_off); 1288 hdev->discov_timeout = timeout; 1289 1290 if (cp->val && hdev->discov_timeout > 0) { 1291 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1292 queue_delayed_work(hdev->req_workqueue, 1293 &hdev->discov_off, to); 1294 } 1295 1296 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1297 goto failed; 1298 } 1299 1300 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1301 if (!cmd) { 1302 err = -ENOMEM; 1303 goto failed; 1304 } 1305 1306 /* Cancel any potential discoverable timeout that might be 1307 * still active and store new timeout value. The arming of 1308 * the timeout happens in the complete handler. 1309 */ 1310 cancel_delayed_work(&hdev->discov_off); 1311 hdev->discov_timeout = timeout; 1312 1313 if (cp->val) 1314 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1315 else 1316 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1317 1318 /* Limited discoverable mode */ 1319 if (cp->val == 0x02) 1320 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1321 else 1322 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1323 1324 queue_work(hdev->req_workqueue, &hdev->discoverable_update); 1325 err = 0; 1326 1327 failed: 1328 hci_dev_unlock(hdev); 1329 return err; 1330 } 1331 1332 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status) 1333 { 1334 struct mgmt_pending_cmd *cmd; 1335 1336 BT_DBG("status 0x%02x", status); 1337 1338 hci_dev_lock(hdev); 1339 1340 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1341 if (!cmd) 1342 goto unlock; 1343 1344 if (status) { 1345 u8 mgmt_err = mgmt_status(status); 1346 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1347 goto remove_cmd; 1348 } 1349 1350 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1351 new_settings(hdev, cmd->sk); 1352 1353 remove_cmd: 1354 mgmt_pending_remove(cmd); 1355 1356 unlock: 1357 hci_dev_unlock(hdev); 1358 } 1359 1360 static int set_connectable_update_settings(struct hci_dev *hdev, 1361 struct sock *sk, u8 val) 1362 { 1363 bool changed = false; 1364 int err; 1365 1366 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1367 changed = true; 1368 1369 if (val) { 1370 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1371 } else { 1372 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1373 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1374 } 1375 1376 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1377 if (err < 0) 1378 return err; 1379 1380 if (changed) { 1381 hci_req_update_scan(hdev); 1382 hci_update_background_scan(hdev); 1383 return new_settings(hdev, sk); 1384 } 1385 1386 return 0; 1387 } 1388 1389 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1390 u16 len) 1391 { 1392 struct mgmt_mode *cp = data; 1393 struct mgmt_pending_cmd *cmd; 1394 int err; 1395 1396 BT_DBG("request for %s", hdev->name); 1397 1398 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1399 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1400 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1401 MGMT_STATUS_REJECTED); 1402 1403 if (cp->val != 0x00 && cp->val != 0x01) 1404 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1405 MGMT_STATUS_INVALID_PARAMS); 1406 1407 hci_dev_lock(hdev); 1408 1409 if (!hdev_is_powered(hdev)) { 1410 err = set_connectable_update_settings(hdev, sk, cp->val); 1411 goto failed; 1412 } 1413 1414 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1415 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1417 MGMT_STATUS_BUSY); 1418 goto failed; 1419 } 1420 1421 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1422 if (!cmd) { 1423 err = -ENOMEM; 1424 goto failed; 1425 } 1426 1427 if (cp->val) { 1428 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1429 } else { 1430 if (hdev->discov_timeout > 0) 1431 cancel_delayed_work(&hdev->discov_off); 1432 1433 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1434 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1435 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1436 } 1437 1438 queue_work(hdev->req_workqueue, &hdev->connectable_update); 1439 err = 0; 1440 1441 failed: 1442 hci_dev_unlock(hdev); 1443 return err; 1444 } 1445 1446 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1447 u16 len) 1448 { 1449 struct mgmt_mode *cp = data; 1450 bool changed; 1451 int err; 1452 1453 BT_DBG("request for %s", hdev->name); 1454 1455 if (cp->val != 0x00 && cp->val != 0x01) 1456 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1457 MGMT_STATUS_INVALID_PARAMS); 1458 1459 hci_dev_lock(hdev); 1460 1461 if (cp->val) 1462 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1463 else 1464 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1465 1466 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1467 if (err < 0) 1468 goto unlock; 1469 1470 if (changed) { 1471 /* In limited privacy mode the change of bondable mode 1472 * may affect the local advertising address. 1473 */ 1474 if (hdev_is_powered(hdev) && 1475 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1476 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1477 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1478 queue_work(hdev->req_workqueue, 1479 &hdev->discoverable_update); 1480 1481 err = new_settings(hdev, sk); 1482 } 1483 1484 unlock: 1485 hci_dev_unlock(hdev); 1486 return err; 1487 } 1488 1489 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1490 u16 len) 1491 { 1492 struct mgmt_mode *cp = data; 1493 struct mgmt_pending_cmd *cmd; 1494 u8 val, status; 1495 int err; 1496 1497 BT_DBG("request for %s", hdev->name); 1498 1499 status = mgmt_bredr_support(hdev); 1500 if (status) 1501 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1502 status); 1503 1504 if (cp->val != 0x00 && cp->val != 0x01) 1505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1506 MGMT_STATUS_INVALID_PARAMS); 1507 1508 hci_dev_lock(hdev); 1509 1510 if (!hdev_is_powered(hdev)) { 1511 bool changed = false; 1512 1513 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1514 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1515 changed = true; 1516 } 1517 1518 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1519 if (err < 0) 1520 goto failed; 1521 1522 if (changed) 1523 err = new_settings(hdev, sk); 1524 1525 goto failed; 1526 } 1527 1528 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1529 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1530 MGMT_STATUS_BUSY); 1531 goto failed; 1532 } 1533 1534 val = !!cp->val; 1535 1536 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1537 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1538 goto failed; 1539 } 1540 1541 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1542 if (!cmd) { 1543 err = -ENOMEM; 1544 goto failed; 1545 } 1546 1547 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1548 if (err < 0) { 1549 mgmt_pending_remove(cmd); 1550 goto failed; 1551 } 1552 1553 failed: 1554 hci_dev_unlock(hdev); 1555 return err; 1556 } 1557 1558 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1559 { 1560 struct mgmt_mode *cp = data; 1561 struct mgmt_pending_cmd *cmd; 1562 u8 status; 1563 int err; 1564 1565 BT_DBG("request for %s", hdev->name); 1566 1567 status = mgmt_bredr_support(hdev); 1568 if (status) 1569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1570 1571 if (!lmp_ssp_capable(hdev)) 1572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1573 MGMT_STATUS_NOT_SUPPORTED); 1574 1575 if (cp->val != 0x00 && cp->val != 0x01) 1576 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1577 MGMT_STATUS_INVALID_PARAMS); 1578 1579 hci_dev_lock(hdev); 1580 1581 if (!hdev_is_powered(hdev)) { 1582 bool changed; 1583 1584 if (cp->val) { 1585 changed = !hci_dev_test_and_set_flag(hdev, 1586 HCI_SSP_ENABLED); 1587 } else { 1588 changed = hci_dev_test_and_clear_flag(hdev, 1589 HCI_SSP_ENABLED); 1590 if (!changed) 1591 changed = hci_dev_test_and_clear_flag(hdev, 1592 HCI_HS_ENABLED); 1593 else 1594 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1595 } 1596 1597 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1598 if (err < 0) 1599 goto failed; 1600 1601 if (changed) 1602 err = new_settings(hdev, sk); 1603 1604 goto failed; 1605 } 1606 1607 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1608 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1609 MGMT_STATUS_BUSY); 1610 goto failed; 1611 } 1612 1613 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1614 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1615 goto failed; 1616 } 1617 1618 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1619 if (!cmd) { 1620 err = -ENOMEM; 1621 goto failed; 1622 } 1623 1624 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 1625 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 1626 sizeof(cp->val), &cp->val); 1627 1628 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1629 if (err < 0) { 1630 mgmt_pending_remove(cmd); 1631 goto failed; 1632 } 1633 1634 failed: 1635 hci_dev_unlock(hdev); 1636 return err; 1637 } 1638 1639 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1640 { 1641 struct mgmt_mode *cp = data; 1642 bool changed; 1643 u8 status; 1644 int err; 1645 1646 BT_DBG("request for %s", hdev->name); 1647 1648 status = mgmt_bredr_support(hdev); 1649 if (status) 1650 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1651 1652 if (!lmp_ssp_capable(hdev)) 1653 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1654 MGMT_STATUS_NOT_SUPPORTED); 1655 1656 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1657 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1658 MGMT_STATUS_REJECTED); 1659 1660 if (cp->val != 0x00 && cp->val != 0x01) 1661 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1662 MGMT_STATUS_INVALID_PARAMS); 1663 1664 hci_dev_lock(hdev); 1665 1666 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1667 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1668 MGMT_STATUS_BUSY); 1669 goto unlock; 1670 } 1671 1672 if (cp->val) { 1673 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1674 } else { 1675 if (hdev_is_powered(hdev)) { 1676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1677 MGMT_STATUS_REJECTED); 1678 goto unlock; 1679 } 1680 1681 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1682 } 1683 1684 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1685 if (err < 0) 1686 goto unlock; 1687 1688 if (changed) 1689 err = new_settings(hdev, sk); 1690 1691 unlock: 1692 hci_dev_unlock(hdev); 1693 return err; 1694 } 1695 1696 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1697 { 1698 struct cmd_lookup match = { NULL, hdev }; 1699 1700 hci_dev_lock(hdev); 1701 1702 if (status) { 1703 u8 mgmt_err = mgmt_status(status); 1704 1705 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1706 &mgmt_err); 1707 goto unlock; 1708 } 1709 1710 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1711 1712 new_settings(hdev, match.sk); 1713 1714 if (match.sk) 1715 sock_put(match.sk); 1716 1717 /* Make sure the controller has a good default for 1718 * advertising data. Restrict the update to when LE 1719 * has actually been enabled. During power on, the 1720 * update in powered_update_hci will take care of it. 1721 */ 1722 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1723 struct hci_request req; 1724 1725 hci_req_init(&req, hdev); 1726 __hci_req_update_adv_data(&req, 0x00); 1727 __hci_req_update_scan_rsp_data(&req, 0x00); 1728 hci_req_run(&req, NULL); 1729 hci_update_background_scan(hdev); 1730 } 1731 1732 unlock: 1733 hci_dev_unlock(hdev); 1734 } 1735 1736 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1737 { 1738 struct mgmt_mode *cp = data; 1739 struct hci_cp_write_le_host_supported hci_cp; 1740 struct mgmt_pending_cmd *cmd; 1741 struct hci_request req; 1742 int err; 1743 u8 val, enabled; 1744 1745 BT_DBG("request for %s", hdev->name); 1746 1747 if (!lmp_le_capable(hdev)) 1748 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1749 MGMT_STATUS_NOT_SUPPORTED); 1750 1751 if (cp->val != 0x00 && cp->val != 0x01) 1752 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1753 MGMT_STATUS_INVALID_PARAMS); 1754 1755 /* Bluetooth single mode LE only controllers or dual-mode 1756 * controllers configured as LE only devices, do not allow 1757 * switching LE off. These have either LE enabled explicitly 1758 * or BR/EDR has been previously switched off. 1759 * 1760 * When trying to enable an already enabled LE, then gracefully 1761 * send a positive response. Trying to disable it however will 1762 * result into rejection. 1763 */ 1764 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1765 if (cp->val == 0x01) 1766 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1767 1768 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1769 MGMT_STATUS_REJECTED); 1770 } 1771 1772 hci_dev_lock(hdev); 1773 1774 val = !!cp->val; 1775 enabled = lmp_host_le_capable(hdev); 1776 1777 if (!val) 1778 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 1779 1780 if (!hdev_is_powered(hdev) || val == enabled) { 1781 bool changed = false; 1782 1783 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1784 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 1785 changed = true; 1786 } 1787 1788 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 1789 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 1790 changed = true; 1791 } 1792 1793 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1794 if (err < 0) 1795 goto unlock; 1796 1797 if (changed) 1798 err = new_settings(hdev, sk); 1799 1800 goto unlock; 1801 } 1802 1803 if (pending_find(MGMT_OP_SET_LE, hdev) || 1804 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1805 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1806 MGMT_STATUS_BUSY); 1807 goto unlock; 1808 } 1809 1810 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1811 if (!cmd) { 1812 err = -ENOMEM; 1813 goto unlock; 1814 } 1815 1816 hci_req_init(&req, hdev); 1817 1818 memset(&hci_cp, 0, sizeof(hci_cp)); 1819 1820 if (val) { 1821 hci_cp.le = val; 1822 hci_cp.simul = 0x00; 1823 } else { 1824 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1825 __hci_req_disable_advertising(&req); 1826 } 1827 1828 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 1829 &hci_cp); 1830 1831 err = hci_req_run(&req, le_enable_complete); 1832 if (err < 0) 1833 mgmt_pending_remove(cmd); 1834 1835 unlock: 1836 hci_dev_unlock(hdev); 1837 return err; 1838 } 1839 1840 /* This is a helper function to test for pending mgmt commands that can 1841 * cause CoD or EIR HCI commands. We can only allow one such pending 1842 * mgmt command at a time since otherwise we cannot easily track what 1843 * the current values are, will be, and based on that calculate if a new 1844 * HCI command needs to be sent and if yes with what value. 1845 */ 1846 static bool pending_eir_or_class(struct hci_dev *hdev) 1847 { 1848 struct mgmt_pending_cmd *cmd; 1849 1850 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 1851 switch (cmd->opcode) { 1852 case MGMT_OP_ADD_UUID: 1853 case MGMT_OP_REMOVE_UUID: 1854 case MGMT_OP_SET_DEV_CLASS: 1855 case MGMT_OP_SET_POWERED: 1856 return true; 1857 } 1858 } 1859 1860 return false; 1861 } 1862 1863 static const u8 bluetooth_base_uuid[] = { 1864 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 1865 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 1866 }; 1867 1868 static u8 get_uuid_size(const u8 *uuid) 1869 { 1870 u32 val; 1871 1872 if (memcmp(uuid, bluetooth_base_uuid, 12)) 1873 return 128; 1874 1875 val = get_unaligned_le32(&uuid[12]); 1876 if (val > 0xffff) 1877 return 32; 1878 1879 return 16; 1880 } 1881 1882 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 1883 { 1884 struct mgmt_pending_cmd *cmd; 1885 1886 hci_dev_lock(hdev); 1887 1888 cmd = pending_find(mgmt_op, hdev); 1889 if (!cmd) 1890 goto unlock; 1891 1892 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 1893 mgmt_status(status), hdev->dev_class, 3); 1894 1895 mgmt_pending_remove(cmd); 1896 1897 unlock: 1898 hci_dev_unlock(hdev); 1899 } 1900 1901 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1902 { 1903 BT_DBG("status 0x%02x", status); 1904 1905 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 1906 } 1907 1908 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1909 { 1910 struct mgmt_cp_add_uuid *cp = data; 1911 struct mgmt_pending_cmd *cmd; 1912 struct hci_request req; 1913 struct bt_uuid *uuid; 1914 int err; 1915 1916 BT_DBG("request for %s", hdev->name); 1917 1918 hci_dev_lock(hdev); 1919 1920 if (pending_eir_or_class(hdev)) { 1921 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 1922 MGMT_STATUS_BUSY); 1923 goto failed; 1924 } 1925 1926 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 1927 if (!uuid) { 1928 err = -ENOMEM; 1929 goto failed; 1930 } 1931 1932 memcpy(uuid->uuid, cp->uuid, 16); 1933 uuid->svc_hint = cp->svc_hint; 1934 uuid->size = get_uuid_size(cp->uuid); 1935 1936 list_add_tail(&uuid->list, &hdev->uuids); 1937 1938 hci_req_init(&req, hdev); 1939 1940 __hci_req_update_class(&req); 1941 __hci_req_update_eir(&req); 1942 1943 err = hci_req_run(&req, add_uuid_complete); 1944 if (err < 0) { 1945 if (err != -ENODATA) 1946 goto failed; 1947 1948 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 1949 hdev->dev_class, 3); 1950 goto failed; 1951 } 1952 1953 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 1954 if (!cmd) { 1955 err = -ENOMEM; 1956 goto failed; 1957 } 1958 1959 err = 0; 1960 1961 failed: 1962 hci_dev_unlock(hdev); 1963 return err; 1964 } 1965 1966 static bool enable_service_cache(struct hci_dev *hdev) 1967 { 1968 if (!hdev_is_powered(hdev)) 1969 return false; 1970 1971 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 1972 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 1973 CACHE_TIMEOUT); 1974 return true; 1975 } 1976 1977 return false; 1978 } 1979 1980 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1981 { 1982 BT_DBG("status 0x%02x", status); 1983 1984 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 1985 } 1986 1987 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 1988 u16 len) 1989 { 1990 struct mgmt_cp_remove_uuid *cp = data; 1991 struct mgmt_pending_cmd *cmd; 1992 struct bt_uuid *match, *tmp; 1993 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 1994 struct hci_request req; 1995 int err, found; 1996 1997 BT_DBG("request for %s", hdev->name); 1998 1999 hci_dev_lock(hdev); 2000 2001 if (pending_eir_or_class(hdev)) { 2002 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2003 MGMT_STATUS_BUSY); 2004 goto unlock; 2005 } 2006 2007 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2008 hci_uuids_clear(hdev); 2009 2010 if (enable_service_cache(hdev)) { 2011 err = mgmt_cmd_complete(sk, hdev->id, 2012 MGMT_OP_REMOVE_UUID, 2013 0, hdev->dev_class, 3); 2014 goto unlock; 2015 } 2016 2017 goto update_class; 2018 } 2019 2020 found = 0; 2021 2022 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2023 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2024 continue; 2025 2026 list_del(&match->list); 2027 kfree(match); 2028 found++; 2029 } 2030 2031 if (found == 0) { 2032 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2033 MGMT_STATUS_INVALID_PARAMS); 2034 goto unlock; 2035 } 2036 2037 update_class: 2038 hci_req_init(&req, hdev); 2039 2040 __hci_req_update_class(&req); 2041 __hci_req_update_eir(&req); 2042 2043 err = hci_req_run(&req, remove_uuid_complete); 2044 if (err < 0) { 2045 if (err != -ENODATA) 2046 goto unlock; 2047 2048 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 2049 hdev->dev_class, 3); 2050 goto unlock; 2051 } 2052 2053 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2054 if (!cmd) { 2055 err = -ENOMEM; 2056 goto unlock; 2057 } 2058 2059 err = 0; 2060 2061 unlock: 2062 hci_dev_unlock(hdev); 2063 return err; 2064 } 2065 2066 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2067 { 2068 BT_DBG("status 0x%02x", status); 2069 2070 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 2071 } 2072 2073 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2074 u16 len) 2075 { 2076 struct mgmt_cp_set_dev_class *cp = data; 2077 struct mgmt_pending_cmd *cmd; 2078 struct hci_request req; 2079 int err; 2080 2081 BT_DBG("request for %s", hdev->name); 2082 2083 if (!lmp_bredr_capable(hdev)) 2084 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2085 MGMT_STATUS_NOT_SUPPORTED); 2086 2087 hci_dev_lock(hdev); 2088 2089 if (pending_eir_or_class(hdev)) { 2090 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2091 MGMT_STATUS_BUSY); 2092 goto unlock; 2093 } 2094 2095 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2096 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2097 MGMT_STATUS_INVALID_PARAMS); 2098 goto unlock; 2099 } 2100 2101 hdev->major_class = cp->major; 2102 hdev->minor_class = cp->minor; 2103 2104 if (!hdev_is_powered(hdev)) { 2105 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2106 hdev->dev_class, 3); 2107 goto unlock; 2108 } 2109 2110 hci_req_init(&req, hdev); 2111 2112 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2113 hci_dev_unlock(hdev); 2114 cancel_delayed_work_sync(&hdev->service_cache); 2115 hci_dev_lock(hdev); 2116 __hci_req_update_eir(&req); 2117 } 2118 2119 __hci_req_update_class(&req); 2120 2121 err = hci_req_run(&req, set_class_complete); 2122 if (err < 0) { 2123 if (err != -ENODATA) 2124 goto unlock; 2125 2126 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2127 hdev->dev_class, 3); 2128 goto unlock; 2129 } 2130 2131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2132 if (!cmd) { 2133 err = -ENOMEM; 2134 goto unlock; 2135 } 2136 2137 err = 0; 2138 2139 unlock: 2140 hci_dev_unlock(hdev); 2141 return err; 2142 } 2143 2144 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2145 u16 len) 2146 { 2147 struct mgmt_cp_load_link_keys *cp = data; 2148 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2149 sizeof(struct mgmt_link_key_info)); 2150 u16 key_count, expected_len; 2151 bool changed; 2152 int i; 2153 2154 BT_DBG("request for %s", hdev->name); 2155 2156 if (!lmp_bredr_capable(hdev)) 2157 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2158 MGMT_STATUS_NOT_SUPPORTED); 2159 2160 key_count = __le16_to_cpu(cp->key_count); 2161 if (key_count > max_key_count) { 2162 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2163 key_count); 2164 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2165 MGMT_STATUS_INVALID_PARAMS); 2166 } 2167 2168 expected_len = sizeof(*cp) + key_count * 2169 sizeof(struct mgmt_link_key_info); 2170 if (expected_len != len) { 2171 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2172 expected_len, len); 2173 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2174 MGMT_STATUS_INVALID_PARAMS); 2175 } 2176 2177 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2178 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2179 MGMT_STATUS_INVALID_PARAMS); 2180 2181 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys, 2182 key_count); 2183 2184 for (i = 0; i < key_count; i++) { 2185 struct mgmt_link_key_info *key = &cp->keys[i]; 2186 2187 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2188 return mgmt_cmd_status(sk, hdev->id, 2189 MGMT_OP_LOAD_LINK_KEYS, 2190 MGMT_STATUS_INVALID_PARAMS); 2191 } 2192 2193 hci_dev_lock(hdev); 2194 2195 hci_link_keys_clear(hdev); 2196 2197 if (cp->debug_keys) 2198 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2199 else 2200 changed = hci_dev_test_and_clear_flag(hdev, 2201 HCI_KEEP_DEBUG_KEYS); 2202 2203 if (changed) 2204 new_settings(hdev, NULL); 2205 2206 for (i = 0; i < key_count; i++) { 2207 struct mgmt_link_key_info *key = &cp->keys[i]; 2208 2209 /* Always ignore debug keys and require a new pairing if 2210 * the user wants to use them. 2211 */ 2212 if (key->type == HCI_LK_DEBUG_COMBINATION) 2213 continue; 2214 2215 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2216 key->type, key->pin_len, NULL); 2217 } 2218 2219 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2220 2221 hci_dev_unlock(hdev); 2222 2223 return 0; 2224 } 2225 2226 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2227 u8 addr_type, struct sock *skip_sk) 2228 { 2229 struct mgmt_ev_device_unpaired ev; 2230 2231 bacpy(&ev.addr.bdaddr, bdaddr); 2232 ev.addr.type = addr_type; 2233 2234 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2235 skip_sk); 2236 } 2237 2238 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2239 u16 len) 2240 { 2241 struct mgmt_cp_unpair_device *cp = data; 2242 struct mgmt_rp_unpair_device rp; 2243 struct hci_conn_params *params; 2244 struct mgmt_pending_cmd *cmd; 2245 struct hci_conn *conn; 2246 u8 addr_type; 2247 int err; 2248 2249 memset(&rp, 0, sizeof(rp)); 2250 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2251 rp.addr.type = cp->addr.type; 2252 2253 if (!bdaddr_type_is_valid(cp->addr.type)) 2254 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2255 MGMT_STATUS_INVALID_PARAMS, 2256 &rp, sizeof(rp)); 2257 2258 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2259 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2260 MGMT_STATUS_INVALID_PARAMS, 2261 &rp, sizeof(rp)); 2262 2263 hci_dev_lock(hdev); 2264 2265 if (!hdev_is_powered(hdev)) { 2266 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2267 MGMT_STATUS_NOT_POWERED, &rp, 2268 sizeof(rp)); 2269 goto unlock; 2270 } 2271 2272 if (cp->addr.type == BDADDR_BREDR) { 2273 /* If disconnection is requested, then look up the 2274 * connection. If the remote device is connected, it 2275 * will be later used to terminate the link. 2276 * 2277 * Setting it to NULL explicitly will cause no 2278 * termination of the link. 2279 */ 2280 if (cp->disconnect) 2281 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2282 &cp->addr.bdaddr); 2283 else 2284 conn = NULL; 2285 2286 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2287 if (err < 0) { 2288 err = mgmt_cmd_complete(sk, hdev->id, 2289 MGMT_OP_UNPAIR_DEVICE, 2290 MGMT_STATUS_NOT_PAIRED, &rp, 2291 sizeof(rp)); 2292 goto unlock; 2293 } 2294 2295 goto done; 2296 } 2297 2298 /* LE address type */ 2299 addr_type = le_addr_type(cp->addr.type); 2300 2301 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type); 2302 2303 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type); 2304 if (err < 0) { 2305 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2306 MGMT_STATUS_NOT_PAIRED, &rp, 2307 sizeof(rp)); 2308 goto unlock; 2309 } 2310 2311 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2312 if (!conn) { 2313 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2314 goto done; 2315 } 2316 2317 /* Abort any ongoing SMP pairing */ 2318 smp_cancel_pairing(conn); 2319 2320 /* Defer clearing up the connection parameters until closing to 2321 * give a chance of keeping them if a repairing happens. 2322 */ 2323 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2324 2325 /* Disable auto-connection parameters if present */ 2326 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2327 if (params) { 2328 if (params->explicit_connect) 2329 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2330 else 2331 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2332 } 2333 2334 /* If disconnection is not requested, then clear the connection 2335 * variable so that the link is not terminated. 2336 */ 2337 if (!cp->disconnect) 2338 conn = NULL; 2339 2340 done: 2341 /* If the connection variable is set, then termination of the 2342 * link is requested. 2343 */ 2344 if (!conn) { 2345 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2346 &rp, sizeof(rp)); 2347 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2348 goto unlock; 2349 } 2350 2351 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2352 sizeof(*cp)); 2353 if (!cmd) { 2354 err = -ENOMEM; 2355 goto unlock; 2356 } 2357 2358 cmd->cmd_complete = addr_cmd_complete; 2359 2360 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2361 if (err < 0) 2362 mgmt_pending_remove(cmd); 2363 2364 unlock: 2365 hci_dev_unlock(hdev); 2366 return err; 2367 } 2368 2369 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2370 u16 len) 2371 { 2372 struct mgmt_cp_disconnect *cp = data; 2373 struct mgmt_rp_disconnect rp; 2374 struct mgmt_pending_cmd *cmd; 2375 struct hci_conn *conn; 2376 int err; 2377 2378 BT_DBG(""); 2379 2380 memset(&rp, 0, sizeof(rp)); 2381 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2382 rp.addr.type = cp->addr.type; 2383 2384 if (!bdaddr_type_is_valid(cp->addr.type)) 2385 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2386 MGMT_STATUS_INVALID_PARAMS, 2387 &rp, sizeof(rp)); 2388 2389 hci_dev_lock(hdev); 2390 2391 if (!test_bit(HCI_UP, &hdev->flags)) { 2392 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2393 MGMT_STATUS_NOT_POWERED, &rp, 2394 sizeof(rp)); 2395 goto failed; 2396 } 2397 2398 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2399 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2400 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2401 goto failed; 2402 } 2403 2404 if (cp->addr.type == BDADDR_BREDR) 2405 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2406 &cp->addr.bdaddr); 2407 else 2408 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2409 le_addr_type(cp->addr.type)); 2410 2411 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2412 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2413 MGMT_STATUS_NOT_CONNECTED, &rp, 2414 sizeof(rp)); 2415 goto failed; 2416 } 2417 2418 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2419 if (!cmd) { 2420 err = -ENOMEM; 2421 goto failed; 2422 } 2423 2424 cmd->cmd_complete = generic_cmd_complete; 2425 2426 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2427 if (err < 0) 2428 mgmt_pending_remove(cmd); 2429 2430 failed: 2431 hci_dev_unlock(hdev); 2432 return err; 2433 } 2434 2435 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2436 { 2437 switch (link_type) { 2438 case LE_LINK: 2439 switch (addr_type) { 2440 case ADDR_LE_DEV_PUBLIC: 2441 return BDADDR_LE_PUBLIC; 2442 2443 default: 2444 /* Fallback to LE Random address type */ 2445 return BDADDR_LE_RANDOM; 2446 } 2447 2448 default: 2449 /* Fallback to BR/EDR type */ 2450 return BDADDR_BREDR; 2451 } 2452 } 2453 2454 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2455 u16 data_len) 2456 { 2457 struct mgmt_rp_get_connections *rp; 2458 struct hci_conn *c; 2459 size_t rp_len; 2460 int err; 2461 u16 i; 2462 2463 BT_DBG(""); 2464 2465 hci_dev_lock(hdev); 2466 2467 if (!hdev_is_powered(hdev)) { 2468 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2469 MGMT_STATUS_NOT_POWERED); 2470 goto unlock; 2471 } 2472 2473 i = 0; 2474 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2475 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2476 i++; 2477 } 2478 2479 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2480 rp = kmalloc(rp_len, GFP_KERNEL); 2481 if (!rp) { 2482 err = -ENOMEM; 2483 goto unlock; 2484 } 2485 2486 i = 0; 2487 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2488 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2489 continue; 2490 bacpy(&rp->addr[i].bdaddr, &c->dst); 2491 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2492 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2493 continue; 2494 i++; 2495 } 2496 2497 rp->conn_count = cpu_to_le16(i); 2498 2499 /* Recalculate length in case of filtered SCO connections, etc */ 2500 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2501 2502 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2503 rp_len); 2504 2505 kfree(rp); 2506 2507 unlock: 2508 hci_dev_unlock(hdev); 2509 return err; 2510 } 2511 2512 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2513 struct mgmt_cp_pin_code_neg_reply *cp) 2514 { 2515 struct mgmt_pending_cmd *cmd; 2516 int err; 2517 2518 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2519 sizeof(*cp)); 2520 if (!cmd) 2521 return -ENOMEM; 2522 2523 cmd->cmd_complete = addr_cmd_complete; 2524 2525 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2526 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2527 if (err < 0) 2528 mgmt_pending_remove(cmd); 2529 2530 return err; 2531 } 2532 2533 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2534 u16 len) 2535 { 2536 struct hci_conn *conn; 2537 struct mgmt_cp_pin_code_reply *cp = data; 2538 struct hci_cp_pin_code_reply reply; 2539 struct mgmt_pending_cmd *cmd; 2540 int err; 2541 2542 BT_DBG(""); 2543 2544 hci_dev_lock(hdev); 2545 2546 if (!hdev_is_powered(hdev)) { 2547 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2548 MGMT_STATUS_NOT_POWERED); 2549 goto failed; 2550 } 2551 2552 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2553 if (!conn) { 2554 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2555 MGMT_STATUS_NOT_CONNECTED); 2556 goto failed; 2557 } 2558 2559 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2560 struct mgmt_cp_pin_code_neg_reply ncp; 2561 2562 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2563 2564 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2565 2566 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2567 if (err >= 0) 2568 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2569 MGMT_STATUS_INVALID_PARAMS); 2570 2571 goto failed; 2572 } 2573 2574 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2575 if (!cmd) { 2576 err = -ENOMEM; 2577 goto failed; 2578 } 2579 2580 cmd->cmd_complete = addr_cmd_complete; 2581 2582 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2583 reply.pin_len = cp->pin_len; 2584 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2585 2586 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2587 if (err < 0) 2588 mgmt_pending_remove(cmd); 2589 2590 failed: 2591 hci_dev_unlock(hdev); 2592 return err; 2593 } 2594 2595 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2596 u16 len) 2597 { 2598 struct mgmt_cp_set_io_capability *cp = data; 2599 2600 BT_DBG(""); 2601 2602 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2603 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2604 MGMT_STATUS_INVALID_PARAMS); 2605 2606 hci_dev_lock(hdev); 2607 2608 hdev->io_capability = cp->io_capability; 2609 2610 BT_DBG("%s IO capability set to 0x%02x", hdev->name, 2611 hdev->io_capability); 2612 2613 hci_dev_unlock(hdev); 2614 2615 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2616 NULL, 0); 2617 } 2618 2619 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2620 { 2621 struct hci_dev *hdev = conn->hdev; 2622 struct mgmt_pending_cmd *cmd; 2623 2624 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2625 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2626 continue; 2627 2628 if (cmd->user_data != conn) 2629 continue; 2630 2631 return cmd; 2632 } 2633 2634 return NULL; 2635 } 2636 2637 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2638 { 2639 struct mgmt_rp_pair_device rp; 2640 struct hci_conn *conn = cmd->user_data; 2641 int err; 2642 2643 bacpy(&rp.addr.bdaddr, &conn->dst); 2644 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2645 2646 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2647 status, &rp, sizeof(rp)); 2648 2649 /* So we don't get further callbacks for this connection */ 2650 conn->connect_cfm_cb = NULL; 2651 conn->security_cfm_cb = NULL; 2652 conn->disconn_cfm_cb = NULL; 2653 2654 hci_conn_drop(conn); 2655 2656 /* The device is paired so there is no need to remove 2657 * its connection parameters anymore. 2658 */ 2659 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2660 2661 hci_conn_put(conn); 2662 2663 return err; 2664 } 2665 2666 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2667 { 2668 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2669 struct mgmt_pending_cmd *cmd; 2670 2671 cmd = find_pairing(conn); 2672 if (cmd) { 2673 cmd->cmd_complete(cmd, status); 2674 mgmt_pending_remove(cmd); 2675 } 2676 } 2677 2678 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2679 { 2680 struct mgmt_pending_cmd *cmd; 2681 2682 BT_DBG("status %u", status); 2683 2684 cmd = find_pairing(conn); 2685 if (!cmd) { 2686 BT_DBG("Unable to find a pending command"); 2687 return; 2688 } 2689 2690 cmd->cmd_complete(cmd, mgmt_status(status)); 2691 mgmt_pending_remove(cmd); 2692 } 2693 2694 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2695 { 2696 struct mgmt_pending_cmd *cmd; 2697 2698 BT_DBG("status %u", status); 2699 2700 if (!status) 2701 return; 2702 2703 cmd = find_pairing(conn); 2704 if (!cmd) { 2705 BT_DBG("Unable to find a pending command"); 2706 return; 2707 } 2708 2709 cmd->cmd_complete(cmd, mgmt_status(status)); 2710 mgmt_pending_remove(cmd); 2711 } 2712 2713 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2714 u16 len) 2715 { 2716 struct mgmt_cp_pair_device *cp = data; 2717 struct mgmt_rp_pair_device rp; 2718 struct mgmt_pending_cmd *cmd; 2719 u8 sec_level, auth_type; 2720 struct hci_conn *conn; 2721 int err; 2722 2723 BT_DBG(""); 2724 2725 memset(&rp, 0, sizeof(rp)); 2726 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2727 rp.addr.type = cp->addr.type; 2728 2729 if (!bdaddr_type_is_valid(cp->addr.type)) 2730 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2731 MGMT_STATUS_INVALID_PARAMS, 2732 &rp, sizeof(rp)); 2733 2734 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 2735 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2736 MGMT_STATUS_INVALID_PARAMS, 2737 &rp, sizeof(rp)); 2738 2739 hci_dev_lock(hdev); 2740 2741 if (!hdev_is_powered(hdev)) { 2742 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2743 MGMT_STATUS_NOT_POWERED, &rp, 2744 sizeof(rp)); 2745 goto unlock; 2746 } 2747 2748 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 2749 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2750 MGMT_STATUS_ALREADY_PAIRED, &rp, 2751 sizeof(rp)); 2752 goto unlock; 2753 } 2754 2755 sec_level = BT_SECURITY_MEDIUM; 2756 auth_type = HCI_AT_DEDICATED_BONDING; 2757 2758 if (cp->addr.type == BDADDR_BREDR) { 2759 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 2760 auth_type); 2761 } else { 2762 u8 addr_type = le_addr_type(cp->addr.type); 2763 struct hci_conn_params *p; 2764 2765 /* When pairing a new device, it is expected to remember 2766 * this device for future connections. Adding the connection 2767 * parameter information ahead of time allows tracking 2768 * of the slave preferred values and will speed up any 2769 * further connection establishment. 2770 * 2771 * If connection parameters already exist, then they 2772 * will be kept and this function does nothing. 2773 */ 2774 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 2775 2776 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 2777 p->auto_connect = HCI_AUTO_CONN_DISABLED; 2778 2779 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, 2780 addr_type, sec_level, 2781 HCI_LE_CONN_TIMEOUT); 2782 } 2783 2784 if (IS_ERR(conn)) { 2785 int status; 2786 2787 if (PTR_ERR(conn) == -EBUSY) 2788 status = MGMT_STATUS_BUSY; 2789 else if (PTR_ERR(conn) == -EOPNOTSUPP) 2790 status = MGMT_STATUS_NOT_SUPPORTED; 2791 else if (PTR_ERR(conn) == -ECONNREFUSED) 2792 status = MGMT_STATUS_REJECTED; 2793 else 2794 status = MGMT_STATUS_CONNECT_FAILED; 2795 2796 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2797 status, &rp, sizeof(rp)); 2798 goto unlock; 2799 } 2800 2801 if (conn->connect_cfm_cb) { 2802 hci_conn_drop(conn); 2803 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2804 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2805 goto unlock; 2806 } 2807 2808 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 2809 if (!cmd) { 2810 err = -ENOMEM; 2811 hci_conn_drop(conn); 2812 goto unlock; 2813 } 2814 2815 cmd->cmd_complete = pairing_complete; 2816 2817 /* For LE, just connecting isn't a proof that the pairing finished */ 2818 if (cp->addr.type == BDADDR_BREDR) { 2819 conn->connect_cfm_cb = pairing_complete_cb; 2820 conn->security_cfm_cb = pairing_complete_cb; 2821 conn->disconn_cfm_cb = pairing_complete_cb; 2822 } else { 2823 conn->connect_cfm_cb = le_pairing_complete_cb; 2824 conn->security_cfm_cb = le_pairing_complete_cb; 2825 conn->disconn_cfm_cb = le_pairing_complete_cb; 2826 } 2827 2828 conn->io_capability = cp->io_cap; 2829 cmd->user_data = hci_conn_get(conn); 2830 2831 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 2832 hci_conn_security(conn, sec_level, auth_type, true)) { 2833 cmd->cmd_complete(cmd, 0); 2834 mgmt_pending_remove(cmd); 2835 } 2836 2837 err = 0; 2838 2839 unlock: 2840 hci_dev_unlock(hdev); 2841 return err; 2842 } 2843 2844 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2845 u16 len) 2846 { 2847 struct mgmt_addr_info *addr = data; 2848 struct mgmt_pending_cmd *cmd; 2849 struct hci_conn *conn; 2850 int err; 2851 2852 BT_DBG(""); 2853 2854 hci_dev_lock(hdev); 2855 2856 if (!hdev_is_powered(hdev)) { 2857 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2858 MGMT_STATUS_NOT_POWERED); 2859 goto unlock; 2860 } 2861 2862 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 2863 if (!cmd) { 2864 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2865 MGMT_STATUS_INVALID_PARAMS); 2866 goto unlock; 2867 } 2868 2869 conn = cmd->user_data; 2870 2871 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 2872 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2873 MGMT_STATUS_INVALID_PARAMS); 2874 goto unlock; 2875 } 2876 2877 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 2878 mgmt_pending_remove(cmd); 2879 2880 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 2881 addr, sizeof(*addr)); 2882 unlock: 2883 hci_dev_unlock(hdev); 2884 return err; 2885 } 2886 2887 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 2888 struct mgmt_addr_info *addr, u16 mgmt_op, 2889 u16 hci_op, __le32 passkey) 2890 { 2891 struct mgmt_pending_cmd *cmd; 2892 struct hci_conn *conn; 2893 int err; 2894 2895 hci_dev_lock(hdev); 2896 2897 if (!hdev_is_powered(hdev)) { 2898 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 2899 MGMT_STATUS_NOT_POWERED, addr, 2900 sizeof(*addr)); 2901 goto done; 2902 } 2903 2904 if (addr->type == BDADDR_BREDR) 2905 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 2906 else 2907 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 2908 le_addr_type(addr->type)); 2909 2910 if (!conn) { 2911 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 2912 MGMT_STATUS_NOT_CONNECTED, addr, 2913 sizeof(*addr)); 2914 goto done; 2915 } 2916 2917 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 2918 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 2919 if (!err) 2920 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 2921 MGMT_STATUS_SUCCESS, addr, 2922 sizeof(*addr)); 2923 else 2924 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 2925 MGMT_STATUS_FAILED, addr, 2926 sizeof(*addr)); 2927 2928 goto done; 2929 } 2930 2931 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 2932 if (!cmd) { 2933 err = -ENOMEM; 2934 goto done; 2935 } 2936 2937 cmd->cmd_complete = addr_cmd_complete; 2938 2939 /* Continue with pairing via HCI */ 2940 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 2941 struct hci_cp_user_passkey_reply cp; 2942 2943 bacpy(&cp.bdaddr, &addr->bdaddr); 2944 cp.passkey = passkey; 2945 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 2946 } else 2947 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 2948 &addr->bdaddr); 2949 2950 if (err < 0) 2951 mgmt_pending_remove(cmd); 2952 2953 done: 2954 hci_dev_unlock(hdev); 2955 return err; 2956 } 2957 2958 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2959 void *data, u16 len) 2960 { 2961 struct mgmt_cp_pin_code_neg_reply *cp = data; 2962 2963 BT_DBG(""); 2964 2965 return user_pairing_resp(sk, hdev, &cp->addr, 2966 MGMT_OP_PIN_CODE_NEG_REPLY, 2967 HCI_OP_PIN_CODE_NEG_REPLY, 0); 2968 } 2969 2970 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2971 u16 len) 2972 { 2973 struct mgmt_cp_user_confirm_reply *cp = data; 2974 2975 BT_DBG(""); 2976 2977 if (len != sizeof(*cp)) 2978 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 2979 MGMT_STATUS_INVALID_PARAMS); 2980 2981 return user_pairing_resp(sk, hdev, &cp->addr, 2982 MGMT_OP_USER_CONFIRM_REPLY, 2983 HCI_OP_USER_CONFIRM_REPLY, 0); 2984 } 2985 2986 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 2987 void *data, u16 len) 2988 { 2989 struct mgmt_cp_user_confirm_neg_reply *cp = data; 2990 2991 BT_DBG(""); 2992 2993 return user_pairing_resp(sk, hdev, &cp->addr, 2994 MGMT_OP_USER_CONFIRM_NEG_REPLY, 2995 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 2996 } 2997 2998 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2999 u16 len) 3000 { 3001 struct mgmt_cp_user_passkey_reply *cp = data; 3002 3003 BT_DBG(""); 3004 3005 return user_pairing_resp(sk, hdev, &cp->addr, 3006 MGMT_OP_USER_PASSKEY_REPLY, 3007 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3008 } 3009 3010 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3011 void *data, u16 len) 3012 { 3013 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3014 3015 BT_DBG(""); 3016 3017 return user_pairing_resp(sk, hdev, &cp->addr, 3018 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3019 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3020 } 3021 3022 static void adv_expire(struct hci_dev *hdev, u32 flags) 3023 { 3024 struct adv_info *adv_instance; 3025 struct hci_request req; 3026 int err; 3027 3028 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3029 if (!adv_instance) 3030 return; 3031 3032 /* stop if current instance doesn't need to be changed */ 3033 if (!(adv_instance->flags & flags)) 3034 return; 3035 3036 cancel_adv_timeout(hdev); 3037 3038 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3039 if (!adv_instance) 3040 return; 3041 3042 hci_req_init(&req, hdev); 3043 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance, 3044 true); 3045 if (err) 3046 return; 3047 3048 hci_req_run(&req, NULL); 3049 } 3050 3051 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3052 { 3053 struct mgmt_cp_set_local_name *cp; 3054 struct mgmt_pending_cmd *cmd; 3055 3056 BT_DBG("status 0x%02x", status); 3057 3058 hci_dev_lock(hdev); 3059 3060 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3061 if (!cmd) 3062 goto unlock; 3063 3064 cp = cmd->param; 3065 3066 if (status) { 3067 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3068 mgmt_status(status)); 3069 } else { 3070 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3071 cp, sizeof(*cp)); 3072 3073 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3074 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3075 } 3076 3077 mgmt_pending_remove(cmd); 3078 3079 unlock: 3080 hci_dev_unlock(hdev); 3081 } 3082 3083 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3084 u16 len) 3085 { 3086 struct mgmt_cp_set_local_name *cp = data; 3087 struct mgmt_pending_cmd *cmd; 3088 struct hci_request req; 3089 int err; 3090 3091 BT_DBG(""); 3092 3093 hci_dev_lock(hdev); 3094 3095 /* If the old values are the same as the new ones just return a 3096 * direct command complete event. 3097 */ 3098 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3099 !memcmp(hdev->short_name, cp->short_name, 3100 sizeof(hdev->short_name))) { 3101 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3102 data, len); 3103 goto failed; 3104 } 3105 3106 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3107 3108 if (!hdev_is_powered(hdev)) { 3109 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3110 3111 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3112 data, len); 3113 if (err < 0) 3114 goto failed; 3115 3116 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3117 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3118 ext_info_changed(hdev, sk); 3119 3120 goto failed; 3121 } 3122 3123 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3124 if (!cmd) { 3125 err = -ENOMEM; 3126 goto failed; 3127 } 3128 3129 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3130 3131 hci_req_init(&req, hdev); 3132 3133 if (lmp_bredr_capable(hdev)) { 3134 __hci_req_update_name(&req); 3135 __hci_req_update_eir(&req); 3136 } 3137 3138 /* The name is stored in the scan response data and so 3139 * no need to udpate the advertising data here. 3140 */ 3141 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3142 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance); 3143 3144 err = hci_req_run(&req, set_name_complete); 3145 if (err < 0) 3146 mgmt_pending_remove(cmd); 3147 3148 failed: 3149 hci_dev_unlock(hdev); 3150 return err; 3151 } 3152 3153 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3154 u16 len) 3155 { 3156 struct mgmt_cp_set_appearance *cp = data; 3157 u16 apperance; 3158 int err; 3159 3160 BT_DBG(""); 3161 3162 if (!lmp_le_capable(hdev)) 3163 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3164 MGMT_STATUS_NOT_SUPPORTED); 3165 3166 apperance = le16_to_cpu(cp->appearance); 3167 3168 hci_dev_lock(hdev); 3169 3170 if (hdev->appearance != apperance) { 3171 hdev->appearance = apperance; 3172 3173 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3174 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE); 3175 3176 ext_info_changed(hdev, sk); 3177 } 3178 3179 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3180 0); 3181 3182 hci_dev_unlock(hdev); 3183 3184 return err; 3185 } 3186 3187 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status, 3188 u16 opcode, struct sk_buff *skb) 3189 { 3190 struct mgmt_rp_read_local_oob_data mgmt_rp; 3191 size_t rp_size = sizeof(mgmt_rp); 3192 struct mgmt_pending_cmd *cmd; 3193 3194 BT_DBG("%s status %u", hdev->name, status); 3195 3196 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 3197 if (!cmd) 3198 return; 3199 3200 if (status || !skb) { 3201 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3202 status ? mgmt_status(status) : MGMT_STATUS_FAILED); 3203 goto remove; 3204 } 3205 3206 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 3207 3208 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 3209 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 3210 3211 if (skb->len < sizeof(*rp)) { 3212 mgmt_cmd_status(cmd->sk, hdev->id, 3213 MGMT_OP_READ_LOCAL_OOB_DATA, 3214 MGMT_STATUS_FAILED); 3215 goto remove; 3216 } 3217 3218 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 3219 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 3220 3221 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 3222 } else { 3223 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 3224 3225 if (skb->len < sizeof(*rp)) { 3226 mgmt_cmd_status(cmd->sk, hdev->id, 3227 MGMT_OP_READ_LOCAL_OOB_DATA, 3228 MGMT_STATUS_FAILED); 3229 goto remove; 3230 } 3231 3232 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 3233 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 3234 3235 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 3236 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 3237 } 3238 3239 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3240 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 3241 3242 remove: 3243 mgmt_pending_remove(cmd); 3244 } 3245 3246 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 3247 void *data, u16 data_len) 3248 { 3249 struct mgmt_pending_cmd *cmd; 3250 struct hci_request req; 3251 int err; 3252 3253 BT_DBG("%s", hdev->name); 3254 3255 hci_dev_lock(hdev); 3256 3257 if (!hdev_is_powered(hdev)) { 3258 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3259 MGMT_STATUS_NOT_POWERED); 3260 goto unlock; 3261 } 3262 3263 if (!lmp_ssp_capable(hdev)) { 3264 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3265 MGMT_STATUS_NOT_SUPPORTED); 3266 goto unlock; 3267 } 3268 3269 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 3270 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3271 MGMT_STATUS_BUSY); 3272 goto unlock; 3273 } 3274 3275 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 3276 if (!cmd) { 3277 err = -ENOMEM; 3278 goto unlock; 3279 } 3280 3281 hci_req_init(&req, hdev); 3282 3283 if (bredr_sc_enabled(hdev)) 3284 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 3285 else 3286 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 3287 3288 err = hci_req_run_skb(&req, read_local_oob_data_complete); 3289 if (err < 0) 3290 mgmt_pending_remove(cmd); 3291 3292 unlock: 3293 hci_dev_unlock(hdev); 3294 return err; 3295 } 3296 3297 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 3298 void *data, u16 len) 3299 { 3300 struct mgmt_addr_info *addr = data; 3301 int err; 3302 3303 BT_DBG("%s ", hdev->name); 3304 3305 if (!bdaddr_type_is_valid(addr->type)) 3306 return mgmt_cmd_complete(sk, hdev->id, 3307 MGMT_OP_ADD_REMOTE_OOB_DATA, 3308 MGMT_STATUS_INVALID_PARAMS, 3309 addr, sizeof(*addr)); 3310 3311 hci_dev_lock(hdev); 3312 3313 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 3314 struct mgmt_cp_add_remote_oob_data *cp = data; 3315 u8 status; 3316 3317 if (cp->addr.type != BDADDR_BREDR) { 3318 err = mgmt_cmd_complete(sk, hdev->id, 3319 MGMT_OP_ADD_REMOTE_OOB_DATA, 3320 MGMT_STATUS_INVALID_PARAMS, 3321 &cp->addr, sizeof(cp->addr)); 3322 goto unlock; 3323 } 3324 3325 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 3326 cp->addr.type, cp->hash, 3327 cp->rand, NULL, NULL); 3328 if (err < 0) 3329 status = MGMT_STATUS_FAILED; 3330 else 3331 status = MGMT_STATUS_SUCCESS; 3332 3333 err = mgmt_cmd_complete(sk, hdev->id, 3334 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 3335 &cp->addr, sizeof(cp->addr)); 3336 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 3337 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 3338 u8 *rand192, *hash192, *rand256, *hash256; 3339 u8 status; 3340 3341 if (bdaddr_type_is_le(cp->addr.type)) { 3342 /* Enforce zero-valued 192-bit parameters as 3343 * long as legacy SMP OOB isn't implemented. 3344 */ 3345 if (memcmp(cp->rand192, ZERO_KEY, 16) || 3346 memcmp(cp->hash192, ZERO_KEY, 16)) { 3347 err = mgmt_cmd_complete(sk, hdev->id, 3348 MGMT_OP_ADD_REMOTE_OOB_DATA, 3349 MGMT_STATUS_INVALID_PARAMS, 3350 addr, sizeof(*addr)); 3351 goto unlock; 3352 } 3353 3354 rand192 = NULL; 3355 hash192 = NULL; 3356 } else { 3357 /* In case one of the P-192 values is set to zero, 3358 * then just disable OOB data for P-192. 3359 */ 3360 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 3361 !memcmp(cp->hash192, ZERO_KEY, 16)) { 3362 rand192 = NULL; 3363 hash192 = NULL; 3364 } else { 3365 rand192 = cp->rand192; 3366 hash192 = cp->hash192; 3367 } 3368 } 3369 3370 /* In case one of the P-256 values is set to zero, then just 3371 * disable OOB data for P-256. 3372 */ 3373 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 3374 !memcmp(cp->hash256, ZERO_KEY, 16)) { 3375 rand256 = NULL; 3376 hash256 = NULL; 3377 } else { 3378 rand256 = cp->rand256; 3379 hash256 = cp->hash256; 3380 } 3381 3382 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 3383 cp->addr.type, hash192, rand192, 3384 hash256, rand256); 3385 if (err < 0) 3386 status = MGMT_STATUS_FAILED; 3387 else 3388 status = MGMT_STATUS_SUCCESS; 3389 3390 err = mgmt_cmd_complete(sk, hdev->id, 3391 MGMT_OP_ADD_REMOTE_OOB_DATA, 3392 status, &cp->addr, sizeof(cp->addr)); 3393 } else { 3394 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 3395 len); 3396 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 3397 MGMT_STATUS_INVALID_PARAMS); 3398 } 3399 3400 unlock: 3401 hci_dev_unlock(hdev); 3402 return err; 3403 } 3404 3405 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 3406 void *data, u16 len) 3407 { 3408 struct mgmt_cp_remove_remote_oob_data *cp = data; 3409 u8 status; 3410 int err; 3411 3412 BT_DBG("%s", hdev->name); 3413 3414 if (cp->addr.type != BDADDR_BREDR) 3415 return mgmt_cmd_complete(sk, hdev->id, 3416 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 3417 MGMT_STATUS_INVALID_PARAMS, 3418 &cp->addr, sizeof(cp->addr)); 3419 3420 hci_dev_lock(hdev); 3421 3422 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 3423 hci_remote_oob_data_clear(hdev); 3424 status = MGMT_STATUS_SUCCESS; 3425 goto done; 3426 } 3427 3428 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 3429 if (err < 0) 3430 status = MGMT_STATUS_INVALID_PARAMS; 3431 else 3432 status = MGMT_STATUS_SUCCESS; 3433 3434 done: 3435 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 3436 status, &cp->addr, sizeof(cp->addr)); 3437 3438 hci_dev_unlock(hdev); 3439 return err; 3440 } 3441 3442 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 3443 { 3444 struct mgmt_pending_cmd *cmd; 3445 3446 BT_DBG("status %d", status); 3447 3448 hci_dev_lock(hdev); 3449 3450 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 3451 if (!cmd) 3452 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 3453 3454 if (!cmd) 3455 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 3456 3457 if (cmd) { 3458 cmd->cmd_complete(cmd, mgmt_status(status)); 3459 mgmt_pending_remove(cmd); 3460 } 3461 3462 hci_dev_unlock(hdev); 3463 } 3464 3465 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 3466 uint8_t *mgmt_status) 3467 { 3468 switch (type) { 3469 case DISCOV_TYPE_LE: 3470 *mgmt_status = mgmt_le_support(hdev); 3471 if (*mgmt_status) 3472 return false; 3473 break; 3474 case DISCOV_TYPE_INTERLEAVED: 3475 *mgmt_status = mgmt_le_support(hdev); 3476 if (*mgmt_status) 3477 return false; 3478 /* Intentional fall-through */ 3479 case DISCOV_TYPE_BREDR: 3480 *mgmt_status = mgmt_bredr_support(hdev); 3481 if (*mgmt_status) 3482 return false; 3483 break; 3484 default: 3485 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 3486 return false; 3487 } 3488 3489 return true; 3490 } 3491 3492 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 3493 u16 op, void *data, u16 len) 3494 { 3495 struct mgmt_cp_start_discovery *cp = data; 3496 struct mgmt_pending_cmd *cmd; 3497 u8 status; 3498 int err; 3499 3500 BT_DBG("%s", hdev->name); 3501 3502 hci_dev_lock(hdev); 3503 3504 if (!hdev_is_powered(hdev)) { 3505 err = mgmt_cmd_complete(sk, hdev->id, op, 3506 MGMT_STATUS_NOT_POWERED, 3507 &cp->type, sizeof(cp->type)); 3508 goto failed; 3509 } 3510 3511 if (hdev->discovery.state != DISCOVERY_STOPPED || 3512 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 3513 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 3514 &cp->type, sizeof(cp->type)); 3515 goto failed; 3516 } 3517 3518 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 3519 err = mgmt_cmd_complete(sk, hdev->id, op, status, 3520 &cp->type, sizeof(cp->type)); 3521 goto failed; 3522 } 3523 3524 /* Clear the discovery filter first to free any previously 3525 * allocated memory for the UUID list. 3526 */ 3527 hci_discovery_filter_clear(hdev); 3528 3529 hdev->discovery.type = cp->type; 3530 hdev->discovery.report_invalid_rssi = false; 3531 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 3532 hdev->discovery.limited = true; 3533 else 3534 hdev->discovery.limited = false; 3535 3536 cmd = mgmt_pending_add(sk, op, hdev, data, len); 3537 if (!cmd) { 3538 err = -ENOMEM; 3539 goto failed; 3540 } 3541 3542 cmd->cmd_complete = generic_cmd_complete; 3543 3544 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 3545 queue_work(hdev->req_workqueue, &hdev->discov_update); 3546 err = 0; 3547 3548 failed: 3549 hci_dev_unlock(hdev); 3550 return err; 3551 } 3552 3553 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 3554 void *data, u16 len) 3555 { 3556 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 3557 data, len); 3558 } 3559 3560 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 3561 void *data, u16 len) 3562 { 3563 return start_discovery_internal(sk, hdev, 3564 MGMT_OP_START_LIMITED_DISCOVERY, 3565 data, len); 3566 } 3567 3568 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd, 3569 u8 status) 3570 { 3571 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 3572 cmd->param, 1); 3573 } 3574 3575 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 3576 void *data, u16 len) 3577 { 3578 struct mgmt_cp_start_service_discovery *cp = data; 3579 struct mgmt_pending_cmd *cmd; 3580 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 3581 u16 uuid_count, expected_len; 3582 u8 status; 3583 int err; 3584 3585 BT_DBG("%s", hdev->name); 3586 3587 hci_dev_lock(hdev); 3588 3589 if (!hdev_is_powered(hdev)) { 3590 err = mgmt_cmd_complete(sk, hdev->id, 3591 MGMT_OP_START_SERVICE_DISCOVERY, 3592 MGMT_STATUS_NOT_POWERED, 3593 &cp->type, sizeof(cp->type)); 3594 goto failed; 3595 } 3596 3597 if (hdev->discovery.state != DISCOVERY_STOPPED || 3598 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 3599 err = mgmt_cmd_complete(sk, hdev->id, 3600 MGMT_OP_START_SERVICE_DISCOVERY, 3601 MGMT_STATUS_BUSY, &cp->type, 3602 sizeof(cp->type)); 3603 goto failed; 3604 } 3605 3606 uuid_count = __le16_to_cpu(cp->uuid_count); 3607 if (uuid_count > max_uuid_count) { 3608 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 3609 uuid_count); 3610 err = mgmt_cmd_complete(sk, hdev->id, 3611 MGMT_OP_START_SERVICE_DISCOVERY, 3612 MGMT_STATUS_INVALID_PARAMS, &cp->type, 3613 sizeof(cp->type)); 3614 goto failed; 3615 } 3616 3617 expected_len = sizeof(*cp) + uuid_count * 16; 3618 if (expected_len != len) { 3619 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 3620 expected_len, len); 3621 err = mgmt_cmd_complete(sk, hdev->id, 3622 MGMT_OP_START_SERVICE_DISCOVERY, 3623 MGMT_STATUS_INVALID_PARAMS, &cp->type, 3624 sizeof(cp->type)); 3625 goto failed; 3626 } 3627 3628 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 3629 err = mgmt_cmd_complete(sk, hdev->id, 3630 MGMT_OP_START_SERVICE_DISCOVERY, 3631 status, &cp->type, sizeof(cp->type)); 3632 goto failed; 3633 } 3634 3635 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 3636 hdev, data, len); 3637 if (!cmd) { 3638 err = -ENOMEM; 3639 goto failed; 3640 } 3641 3642 cmd->cmd_complete = service_discovery_cmd_complete; 3643 3644 /* Clear the discovery filter first to free any previously 3645 * allocated memory for the UUID list. 3646 */ 3647 hci_discovery_filter_clear(hdev); 3648 3649 hdev->discovery.result_filtering = true; 3650 hdev->discovery.type = cp->type; 3651 hdev->discovery.rssi = cp->rssi; 3652 hdev->discovery.uuid_count = uuid_count; 3653 3654 if (uuid_count > 0) { 3655 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 3656 GFP_KERNEL); 3657 if (!hdev->discovery.uuids) { 3658 err = mgmt_cmd_complete(sk, hdev->id, 3659 MGMT_OP_START_SERVICE_DISCOVERY, 3660 MGMT_STATUS_FAILED, 3661 &cp->type, sizeof(cp->type)); 3662 mgmt_pending_remove(cmd); 3663 goto failed; 3664 } 3665 } 3666 3667 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 3668 queue_work(hdev->req_workqueue, &hdev->discov_update); 3669 err = 0; 3670 3671 failed: 3672 hci_dev_unlock(hdev); 3673 return err; 3674 } 3675 3676 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 3677 { 3678 struct mgmt_pending_cmd *cmd; 3679 3680 BT_DBG("status %d", status); 3681 3682 hci_dev_lock(hdev); 3683 3684 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 3685 if (cmd) { 3686 cmd->cmd_complete(cmd, mgmt_status(status)); 3687 mgmt_pending_remove(cmd); 3688 } 3689 3690 hci_dev_unlock(hdev); 3691 } 3692 3693 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 3694 u16 len) 3695 { 3696 struct mgmt_cp_stop_discovery *mgmt_cp = data; 3697 struct mgmt_pending_cmd *cmd; 3698 int err; 3699 3700 BT_DBG("%s", hdev->name); 3701 3702 hci_dev_lock(hdev); 3703 3704 if (!hci_discovery_active(hdev)) { 3705 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3706 MGMT_STATUS_REJECTED, &mgmt_cp->type, 3707 sizeof(mgmt_cp->type)); 3708 goto unlock; 3709 } 3710 3711 if (hdev->discovery.type != mgmt_cp->type) { 3712 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3713 MGMT_STATUS_INVALID_PARAMS, 3714 &mgmt_cp->type, sizeof(mgmt_cp->type)); 3715 goto unlock; 3716 } 3717 3718 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 3719 if (!cmd) { 3720 err = -ENOMEM; 3721 goto unlock; 3722 } 3723 3724 cmd->cmd_complete = generic_cmd_complete; 3725 3726 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 3727 queue_work(hdev->req_workqueue, &hdev->discov_update); 3728 err = 0; 3729 3730 unlock: 3731 hci_dev_unlock(hdev); 3732 return err; 3733 } 3734 3735 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 3736 u16 len) 3737 { 3738 struct mgmt_cp_confirm_name *cp = data; 3739 struct inquiry_entry *e; 3740 int err; 3741 3742 BT_DBG("%s", hdev->name); 3743 3744 hci_dev_lock(hdev); 3745 3746 if (!hci_discovery_active(hdev)) { 3747 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 3748 MGMT_STATUS_FAILED, &cp->addr, 3749 sizeof(cp->addr)); 3750 goto failed; 3751 } 3752 3753 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 3754 if (!e) { 3755 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 3756 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 3757 sizeof(cp->addr)); 3758 goto failed; 3759 } 3760 3761 if (cp->name_known) { 3762 e->name_state = NAME_KNOWN; 3763 list_del(&e->list); 3764 } else { 3765 e->name_state = NAME_NEEDED; 3766 hci_inquiry_cache_update_resolve(hdev, e); 3767 } 3768 3769 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 3770 &cp->addr, sizeof(cp->addr)); 3771 3772 failed: 3773 hci_dev_unlock(hdev); 3774 return err; 3775 } 3776 3777 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 3778 u16 len) 3779 { 3780 struct mgmt_cp_block_device *cp = data; 3781 u8 status; 3782 int err; 3783 3784 BT_DBG("%s", hdev->name); 3785 3786 if (!bdaddr_type_is_valid(cp->addr.type)) 3787 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 3788 MGMT_STATUS_INVALID_PARAMS, 3789 &cp->addr, sizeof(cp->addr)); 3790 3791 hci_dev_lock(hdev); 3792 3793 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr, 3794 cp->addr.type); 3795 if (err < 0) { 3796 status = MGMT_STATUS_FAILED; 3797 goto done; 3798 } 3799 3800 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 3801 sk); 3802 status = MGMT_STATUS_SUCCESS; 3803 3804 done: 3805 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 3806 &cp->addr, sizeof(cp->addr)); 3807 3808 hci_dev_unlock(hdev); 3809 3810 return err; 3811 } 3812 3813 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 3814 u16 len) 3815 { 3816 struct mgmt_cp_unblock_device *cp = data; 3817 u8 status; 3818 int err; 3819 3820 BT_DBG("%s", hdev->name); 3821 3822 if (!bdaddr_type_is_valid(cp->addr.type)) 3823 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 3824 MGMT_STATUS_INVALID_PARAMS, 3825 &cp->addr, sizeof(cp->addr)); 3826 3827 hci_dev_lock(hdev); 3828 3829 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr, 3830 cp->addr.type); 3831 if (err < 0) { 3832 status = MGMT_STATUS_INVALID_PARAMS; 3833 goto done; 3834 } 3835 3836 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 3837 sk); 3838 status = MGMT_STATUS_SUCCESS; 3839 3840 done: 3841 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 3842 &cp->addr, sizeof(cp->addr)); 3843 3844 hci_dev_unlock(hdev); 3845 3846 return err; 3847 } 3848 3849 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 3850 u16 len) 3851 { 3852 struct mgmt_cp_set_device_id *cp = data; 3853 struct hci_request req; 3854 int err; 3855 __u16 source; 3856 3857 BT_DBG("%s", hdev->name); 3858 3859 source = __le16_to_cpu(cp->source); 3860 3861 if (source > 0x0002) 3862 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 3863 MGMT_STATUS_INVALID_PARAMS); 3864 3865 hci_dev_lock(hdev); 3866 3867 hdev->devid_source = source; 3868 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 3869 hdev->devid_product = __le16_to_cpu(cp->product); 3870 hdev->devid_version = __le16_to_cpu(cp->version); 3871 3872 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 3873 NULL, 0); 3874 3875 hci_req_init(&req, hdev); 3876 __hci_req_update_eir(&req); 3877 hci_req_run(&req, NULL); 3878 3879 hci_dev_unlock(hdev); 3880 3881 return err; 3882 } 3883 3884 static void enable_advertising_instance(struct hci_dev *hdev, u8 status, 3885 u16 opcode) 3886 { 3887 BT_DBG("status %d", status); 3888 } 3889 3890 static void set_advertising_complete(struct hci_dev *hdev, u8 status, 3891 u16 opcode) 3892 { 3893 struct cmd_lookup match = { NULL, hdev }; 3894 struct hci_request req; 3895 u8 instance; 3896 struct adv_info *adv_instance; 3897 int err; 3898 3899 hci_dev_lock(hdev); 3900 3901 if (status) { 3902 u8 mgmt_err = mgmt_status(status); 3903 3904 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 3905 cmd_status_rsp, &mgmt_err); 3906 goto unlock; 3907 } 3908 3909 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3910 hci_dev_set_flag(hdev, HCI_ADVERTISING); 3911 else 3912 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 3913 3914 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 3915 &match); 3916 3917 new_settings(hdev, match.sk); 3918 3919 if (match.sk) 3920 sock_put(match.sk); 3921 3922 /* If "Set Advertising" was just disabled and instance advertising was 3923 * set up earlier, then re-enable multi-instance advertising. 3924 */ 3925 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 3926 list_empty(&hdev->adv_instances)) 3927 goto unlock; 3928 3929 instance = hdev->cur_adv_instance; 3930 if (!instance) { 3931 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 3932 struct adv_info, list); 3933 if (!adv_instance) 3934 goto unlock; 3935 3936 instance = adv_instance->instance; 3937 } 3938 3939 hci_req_init(&req, hdev); 3940 3941 err = __hci_req_schedule_adv_instance(&req, instance, true); 3942 3943 if (!err) 3944 err = hci_req_run(&req, enable_advertising_instance); 3945 3946 if (err) 3947 bt_dev_err(hdev, "failed to re-configure advertising"); 3948 3949 unlock: 3950 hci_dev_unlock(hdev); 3951 } 3952 3953 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 3954 u16 len) 3955 { 3956 struct mgmt_mode *cp = data; 3957 struct mgmt_pending_cmd *cmd; 3958 struct hci_request req; 3959 u8 val, status; 3960 int err; 3961 3962 BT_DBG("request for %s", hdev->name); 3963 3964 status = mgmt_le_support(hdev); 3965 if (status) 3966 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3967 status); 3968 3969 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 3970 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3971 MGMT_STATUS_INVALID_PARAMS); 3972 3973 hci_dev_lock(hdev); 3974 3975 val = !!cp->val; 3976 3977 /* The following conditions are ones which mean that we should 3978 * not do any HCI communication but directly send a mgmt 3979 * response to user space (after toggling the flag if 3980 * necessary). 3981 */ 3982 if (!hdev_is_powered(hdev) || 3983 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 3984 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 3985 hci_conn_num(hdev, LE_LINK) > 0 || 3986 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 3987 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 3988 bool changed; 3989 3990 if (cp->val) { 3991 hdev->cur_adv_instance = 0x00; 3992 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 3993 if (cp->val == 0x02) 3994 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 3995 else 3996 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 3997 } else { 3998 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 3999 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4000 } 4001 4002 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 4003 if (err < 0) 4004 goto unlock; 4005 4006 if (changed) 4007 err = new_settings(hdev, sk); 4008 4009 goto unlock; 4010 } 4011 4012 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 4013 pending_find(MGMT_OP_SET_LE, hdev)) { 4014 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 4015 MGMT_STATUS_BUSY); 4016 goto unlock; 4017 } 4018 4019 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 4020 if (!cmd) { 4021 err = -ENOMEM; 4022 goto unlock; 4023 } 4024 4025 hci_req_init(&req, hdev); 4026 4027 if (cp->val == 0x02) 4028 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4029 else 4030 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4031 4032 cancel_adv_timeout(hdev); 4033 4034 if (val) { 4035 /* Switch to instance "0" for the Set Advertising setting. 4036 * We cannot use update_[adv|scan_rsp]_data() here as the 4037 * HCI_ADVERTISING flag is not yet set. 4038 */ 4039 hdev->cur_adv_instance = 0x00; 4040 __hci_req_update_adv_data(&req, 0x00); 4041 __hci_req_update_scan_rsp_data(&req, 0x00); 4042 __hci_req_enable_advertising(&req); 4043 } else { 4044 __hci_req_disable_advertising(&req); 4045 } 4046 4047 err = hci_req_run(&req, set_advertising_complete); 4048 if (err < 0) 4049 mgmt_pending_remove(cmd); 4050 4051 unlock: 4052 hci_dev_unlock(hdev); 4053 return err; 4054 } 4055 4056 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 4057 void *data, u16 len) 4058 { 4059 struct mgmt_cp_set_static_address *cp = data; 4060 int err; 4061 4062 BT_DBG("%s", hdev->name); 4063 4064 if (!lmp_le_capable(hdev)) 4065 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 4066 MGMT_STATUS_NOT_SUPPORTED); 4067 4068 if (hdev_is_powered(hdev)) 4069 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 4070 MGMT_STATUS_REJECTED); 4071 4072 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 4073 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 4074 return mgmt_cmd_status(sk, hdev->id, 4075 MGMT_OP_SET_STATIC_ADDRESS, 4076 MGMT_STATUS_INVALID_PARAMS); 4077 4078 /* Two most significant bits shall be set */ 4079 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 4080 return mgmt_cmd_status(sk, hdev->id, 4081 MGMT_OP_SET_STATIC_ADDRESS, 4082 MGMT_STATUS_INVALID_PARAMS); 4083 } 4084 4085 hci_dev_lock(hdev); 4086 4087 bacpy(&hdev->static_addr, &cp->bdaddr); 4088 4089 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 4090 if (err < 0) 4091 goto unlock; 4092 4093 err = new_settings(hdev, sk); 4094 4095 unlock: 4096 hci_dev_unlock(hdev); 4097 return err; 4098 } 4099 4100 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 4101 void *data, u16 len) 4102 { 4103 struct mgmt_cp_set_scan_params *cp = data; 4104 __u16 interval, window; 4105 int err; 4106 4107 BT_DBG("%s", hdev->name); 4108 4109 if (!lmp_le_capable(hdev)) 4110 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4111 MGMT_STATUS_NOT_SUPPORTED); 4112 4113 interval = __le16_to_cpu(cp->interval); 4114 4115 if (interval < 0x0004 || interval > 0x4000) 4116 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4117 MGMT_STATUS_INVALID_PARAMS); 4118 4119 window = __le16_to_cpu(cp->window); 4120 4121 if (window < 0x0004 || window > 0x4000) 4122 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4123 MGMT_STATUS_INVALID_PARAMS); 4124 4125 if (window > interval) 4126 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4127 MGMT_STATUS_INVALID_PARAMS); 4128 4129 hci_dev_lock(hdev); 4130 4131 hdev->le_scan_interval = interval; 4132 hdev->le_scan_window = window; 4133 4134 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 4135 NULL, 0); 4136 4137 /* If background scan is running, restart it so new parameters are 4138 * loaded. 4139 */ 4140 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 4141 hdev->discovery.state == DISCOVERY_STOPPED) { 4142 struct hci_request req; 4143 4144 hci_req_init(&req, hdev); 4145 4146 hci_req_add_le_scan_disable(&req); 4147 hci_req_add_le_passive_scan(&req); 4148 4149 hci_req_run(&req, NULL); 4150 } 4151 4152 hci_dev_unlock(hdev); 4153 4154 return err; 4155 } 4156 4157 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, 4158 u16 opcode) 4159 { 4160 struct mgmt_pending_cmd *cmd; 4161 4162 BT_DBG("status 0x%02x", status); 4163 4164 hci_dev_lock(hdev); 4165 4166 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 4167 if (!cmd) 4168 goto unlock; 4169 4170 if (status) { 4171 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4172 mgmt_status(status)); 4173 } else { 4174 struct mgmt_mode *cp = cmd->param; 4175 4176 if (cp->val) 4177 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 4178 else 4179 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 4180 4181 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 4182 new_settings(hdev, cmd->sk); 4183 } 4184 4185 mgmt_pending_remove(cmd); 4186 4187 unlock: 4188 hci_dev_unlock(hdev); 4189 } 4190 4191 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 4192 void *data, u16 len) 4193 { 4194 struct mgmt_mode *cp = data; 4195 struct mgmt_pending_cmd *cmd; 4196 struct hci_request req; 4197 int err; 4198 4199 BT_DBG("%s", hdev->name); 4200 4201 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 4202 hdev->hci_ver < BLUETOOTH_VER_1_2) 4203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4204 MGMT_STATUS_NOT_SUPPORTED); 4205 4206 if (cp->val != 0x00 && cp->val != 0x01) 4207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4208 MGMT_STATUS_INVALID_PARAMS); 4209 4210 hci_dev_lock(hdev); 4211 4212 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 4213 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4214 MGMT_STATUS_BUSY); 4215 goto unlock; 4216 } 4217 4218 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 4219 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 4220 hdev); 4221 goto unlock; 4222 } 4223 4224 if (!hdev_is_powered(hdev)) { 4225 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 4226 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 4227 hdev); 4228 new_settings(hdev, sk); 4229 goto unlock; 4230 } 4231 4232 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 4233 data, len); 4234 if (!cmd) { 4235 err = -ENOMEM; 4236 goto unlock; 4237 } 4238 4239 hci_req_init(&req, hdev); 4240 4241 __hci_req_write_fast_connectable(&req, cp->val); 4242 4243 err = hci_req_run(&req, fast_connectable_complete); 4244 if (err < 0) { 4245 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4246 MGMT_STATUS_FAILED); 4247 mgmt_pending_remove(cmd); 4248 } 4249 4250 unlock: 4251 hci_dev_unlock(hdev); 4252 4253 return err; 4254 } 4255 4256 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode) 4257 { 4258 struct mgmt_pending_cmd *cmd; 4259 4260 BT_DBG("status 0x%02x", status); 4261 4262 hci_dev_lock(hdev); 4263 4264 cmd = pending_find(MGMT_OP_SET_BREDR, hdev); 4265 if (!cmd) 4266 goto unlock; 4267 4268 if (status) { 4269 u8 mgmt_err = mgmt_status(status); 4270 4271 /* We need to restore the flag if related HCI commands 4272 * failed. 4273 */ 4274 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 4275 4276 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 4277 } else { 4278 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 4279 new_settings(hdev, cmd->sk); 4280 } 4281 4282 mgmt_pending_remove(cmd); 4283 4284 unlock: 4285 hci_dev_unlock(hdev); 4286 } 4287 4288 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 4289 { 4290 struct mgmt_mode *cp = data; 4291 struct mgmt_pending_cmd *cmd; 4292 struct hci_request req; 4293 int err; 4294 4295 BT_DBG("request for %s", hdev->name); 4296 4297 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 4298 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4299 MGMT_STATUS_NOT_SUPPORTED); 4300 4301 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 4302 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4303 MGMT_STATUS_REJECTED); 4304 4305 if (cp->val != 0x00 && cp->val != 0x01) 4306 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4307 MGMT_STATUS_INVALID_PARAMS); 4308 4309 hci_dev_lock(hdev); 4310 4311 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 4312 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 4313 goto unlock; 4314 } 4315 4316 if (!hdev_is_powered(hdev)) { 4317 if (!cp->val) { 4318 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 4319 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 4320 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 4321 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 4322 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 4323 } 4324 4325 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 4326 4327 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 4328 if (err < 0) 4329 goto unlock; 4330 4331 err = new_settings(hdev, sk); 4332 goto unlock; 4333 } 4334 4335 /* Reject disabling when powered on */ 4336 if (!cp->val) { 4337 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4338 MGMT_STATUS_REJECTED); 4339 goto unlock; 4340 } else { 4341 /* When configuring a dual-mode controller to operate 4342 * with LE only and using a static address, then switching 4343 * BR/EDR back on is not allowed. 4344 * 4345 * Dual-mode controllers shall operate with the public 4346 * address as its identity address for BR/EDR and LE. So 4347 * reject the attempt to create an invalid configuration. 4348 * 4349 * The same restrictions applies when secure connections 4350 * has been enabled. For BR/EDR this is a controller feature 4351 * while for LE it is a host stack feature. This means that 4352 * switching BR/EDR back on when secure connections has been 4353 * enabled is not a supported transaction. 4354 */ 4355 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 4356 (bacmp(&hdev->static_addr, BDADDR_ANY) || 4357 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 4358 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4359 MGMT_STATUS_REJECTED); 4360 goto unlock; 4361 } 4362 } 4363 4364 if (pending_find(MGMT_OP_SET_BREDR, hdev)) { 4365 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4366 MGMT_STATUS_BUSY); 4367 goto unlock; 4368 } 4369 4370 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 4371 if (!cmd) { 4372 err = -ENOMEM; 4373 goto unlock; 4374 } 4375 4376 /* We need to flip the bit already here so that 4377 * hci_req_update_adv_data generates the correct flags. 4378 */ 4379 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 4380 4381 hci_req_init(&req, hdev); 4382 4383 __hci_req_write_fast_connectable(&req, false); 4384 __hci_req_update_scan(&req); 4385 4386 /* Since only the advertising data flags will change, there 4387 * is no need to update the scan response data. 4388 */ 4389 __hci_req_update_adv_data(&req, hdev->cur_adv_instance); 4390 4391 err = hci_req_run(&req, set_bredr_complete); 4392 if (err < 0) 4393 mgmt_pending_remove(cmd); 4394 4395 unlock: 4396 hci_dev_unlock(hdev); 4397 return err; 4398 } 4399 4400 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 4401 { 4402 struct mgmt_pending_cmd *cmd; 4403 struct mgmt_mode *cp; 4404 4405 BT_DBG("%s status %u", hdev->name, status); 4406 4407 hci_dev_lock(hdev); 4408 4409 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev); 4410 if (!cmd) 4411 goto unlock; 4412 4413 if (status) { 4414 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 4415 mgmt_status(status)); 4416 goto remove; 4417 } 4418 4419 cp = cmd->param; 4420 4421 switch (cp->val) { 4422 case 0x00: 4423 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 4424 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4425 break; 4426 case 0x01: 4427 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 4428 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4429 break; 4430 case 0x02: 4431 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 4432 hci_dev_set_flag(hdev, HCI_SC_ONLY); 4433 break; 4434 } 4435 4436 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev); 4437 new_settings(hdev, cmd->sk); 4438 4439 remove: 4440 mgmt_pending_remove(cmd); 4441 unlock: 4442 hci_dev_unlock(hdev); 4443 } 4444 4445 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 4446 void *data, u16 len) 4447 { 4448 struct mgmt_mode *cp = data; 4449 struct mgmt_pending_cmd *cmd; 4450 struct hci_request req; 4451 u8 val; 4452 int err; 4453 4454 BT_DBG("request for %s", hdev->name); 4455 4456 if (!lmp_sc_capable(hdev) && 4457 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 4458 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4459 MGMT_STATUS_NOT_SUPPORTED); 4460 4461 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 4462 lmp_sc_capable(hdev) && 4463 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 4464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4465 MGMT_STATUS_REJECTED); 4466 4467 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 4468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4469 MGMT_STATUS_INVALID_PARAMS); 4470 4471 hci_dev_lock(hdev); 4472 4473 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 4474 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 4475 bool changed; 4476 4477 if (cp->val) { 4478 changed = !hci_dev_test_and_set_flag(hdev, 4479 HCI_SC_ENABLED); 4480 if (cp->val == 0x02) 4481 hci_dev_set_flag(hdev, HCI_SC_ONLY); 4482 else 4483 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4484 } else { 4485 changed = hci_dev_test_and_clear_flag(hdev, 4486 HCI_SC_ENABLED); 4487 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4488 } 4489 4490 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 4491 if (err < 0) 4492 goto failed; 4493 4494 if (changed) 4495 err = new_settings(hdev, sk); 4496 4497 goto failed; 4498 } 4499 4500 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) { 4501 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4502 MGMT_STATUS_BUSY); 4503 goto failed; 4504 } 4505 4506 val = !!cp->val; 4507 4508 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 4509 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 4510 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 4511 goto failed; 4512 } 4513 4514 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 4515 if (!cmd) { 4516 err = -ENOMEM; 4517 goto failed; 4518 } 4519 4520 hci_req_init(&req, hdev); 4521 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val); 4522 err = hci_req_run(&req, sc_enable_complete); 4523 if (err < 0) { 4524 mgmt_pending_remove(cmd); 4525 goto failed; 4526 } 4527 4528 failed: 4529 hci_dev_unlock(hdev); 4530 return err; 4531 } 4532 4533 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 4534 void *data, u16 len) 4535 { 4536 struct mgmt_mode *cp = data; 4537 bool changed, use_changed; 4538 int err; 4539 4540 BT_DBG("request for %s", hdev->name); 4541 4542 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 4543 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 4544 MGMT_STATUS_INVALID_PARAMS); 4545 4546 hci_dev_lock(hdev); 4547 4548 if (cp->val) 4549 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 4550 else 4551 changed = hci_dev_test_and_clear_flag(hdev, 4552 HCI_KEEP_DEBUG_KEYS); 4553 4554 if (cp->val == 0x02) 4555 use_changed = !hci_dev_test_and_set_flag(hdev, 4556 HCI_USE_DEBUG_KEYS); 4557 else 4558 use_changed = hci_dev_test_and_clear_flag(hdev, 4559 HCI_USE_DEBUG_KEYS); 4560 4561 if (hdev_is_powered(hdev) && use_changed && 4562 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 4563 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 4564 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 4565 sizeof(mode), &mode); 4566 } 4567 4568 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 4569 if (err < 0) 4570 goto unlock; 4571 4572 if (changed) 4573 err = new_settings(hdev, sk); 4574 4575 unlock: 4576 hci_dev_unlock(hdev); 4577 return err; 4578 } 4579 4580 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 4581 u16 len) 4582 { 4583 struct mgmt_cp_set_privacy *cp = cp_data; 4584 bool changed; 4585 int err; 4586 4587 BT_DBG("request for %s", hdev->name); 4588 4589 if (!lmp_le_capable(hdev)) 4590 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 4591 MGMT_STATUS_NOT_SUPPORTED); 4592 4593 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 4594 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 4595 MGMT_STATUS_INVALID_PARAMS); 4596 4597 if (hdev_is_powered(hdev)) 4598 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 4599 MGMT_STATUS_REJECTED); 4600 4601 hci_dev_lock(hdev); 4602 4603 /* If user space supports this command it is also expected to 4604 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 4605 */ 4606 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 4607 4608 if (cp->privacy) { 4609 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 4610 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 4611 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 4612 if (cp->privacy == 0x02) 4613 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 4614 else 4615 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 4616 } else { 4617 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 4618 memset(hdev->irk, 0, sizeof(hdev->irk)); 4619 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 4620 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 4621 } 4622 4623 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 4624 if (err < 0) 4625 goto unlock; 4626 4627 if (changed) 4628 err = new_settings(hdev, sk); 4629 4630 unlock: 4631 hci_dev_unlock(hdev); 4632 return err; 4633 } 4634 4635 static bool irk_is_valid(struct mgmt_irk_info *irk) 4636 { 4637 switch (irk->addr.type) { 4638 case BDADDR_LE_PUBLIC: 4639 return true; 4640 4641 case BDADDR_LE_RANDOM: 4642 /* Two most significant bits shall be set */ 4643 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 4644 return false; 4645 return true; 4646 } 4647 4648 return false; 4649 } 4650 4651 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 4652 u16 len) 4653 { 4654 struct mgmt_cp_load_irks *cp = cp_data; 4655 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 4656 sizeof(struct mgmt_irk_info)); 4657 u16 irk_count, expected_len; 4658 int i, err; 4659 4660 BT_DBG("request for %s", hdev->name); 4661 4662 if (!lmp_le_capable(hdev)) 4663 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 4664 MGMT_STATUS_NOT_SUPPORTED); 4665 4666 irk_count = __le16_to_cpu(cp->irk_count); 4667 if (irk_count > max_irk_count) { 4668 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 4669 irk_count); 4670 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 4671 MGMT_STATUS_INVALID_PARAMS); 4672 } 4673 4674 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info); 4675 if (expected_len != len) { 4676 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 4677 expected_len, len); 4678 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 4679 MGMT_STATUS_INVALID_PARAMS); 4680 } 4681 4682 BT_DBG("%s irk_count %u", hdev->name, irk_count); 4683 4684 for (i = 0; i < irk_count; i++) { 4685 struct mgmt_irk_info *key = &cp->irks[i]; 4686 4687 if (!irk_is_valid(key)) 4688 return mgmt_cmd_status(sk, hdev->id, 4689 MGMT_OP_LOAD_IRKS, 4690 MGMT_STATUS_INVALID_PARAMS); 4691 } 4692 4693 hci_dev_lock(hdev); 4694 4695 hci_smp_irks_clear(hdev); 4696 4697 for (i = 0; i < irk_count; i++) { 4698 struct mgmt_irk_info *irk = &cp->irks[i]; 4699 4700 hci_add_irk(hdev, &irk->addr.bdaddr, 4701 le_addr_type(irk->addr.type), irk->val, 4702 BDADDR_ANY); 4703 } 4704 4705 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 4706 4707 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 4708 4709 hci_dev_unlock(hdev); 4710 4711 return err; 4712 } 4713 4714 static bool ltk_is_valid(struct mgmt_ltk_info *key) 4715 { 4716 if (key->master != 0x00 && key->master != 0x01) 4717 return false; 4718 4719 switch (key->addr.type) { 4720 case BDADDR_LE_PUBLIC: 4721 return true; 4722 4723 case BDADDR_LE_RANDOM: 4724 /* Two most significant bits shall be set */ 4725 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 4726 return false; 4727 return true; 4728 } 4729 4730 return false; 4731 } 4732 4733 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 4734 void *cp_data, u16 len) 4735 { 4736 struct mgmt_cp_load_long_term_keys *cp = cp_data; 4737 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 4738 sizeof(struct mgmt_ltk_info)); 4739 u16 key_count, expected_len; 4740 int i, err; 4741 4742 BT_DBG("request for %s", hdev->name); 4743 4744 if (!lmp_le_capable(hdev)) 4745 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 4746 MGMT_STATUS_NOT_SUPPORTED); 4747 4748 key_count = __le16_to_cpu(cp->key_count); 4749 if (key_count > max_key_count) { 4750 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 4751 key_count); 4752 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 4753 MGMT_STATUS_INVALID_PARAMS); 4754 } 4755 4756 expected_len = sizeof(*cp) + key_count * 4757 sizeof(struct mgmt_ltk_info); 4758 if (expected_len != len) { 4759 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 4760 expected_len, len); 4761 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 4762 MGMT_STATUS_INVALID_PARAMS); 4763 } 4764 4765 BT_DBG("%s key_count %u", hdev->name, key_count); 4766 4767 for (i = 0; i < key_count; i++) { 4768 struct mgmt_ltk_info *key = &cp->keys[i]; 4769 4770 if (!ltk_is_valid(key)) 4771 return mgmt_cmd_status(sk, hdev->id, 4772 MGMT_OP_LOAD_LONG_TERM_KEYS, 4773 MGMT_STATUS_INVALID_PARAMS); 4774 } 4775 4776 hci_dev_lock(hdev); 4777 4778 hci_smp_ltks_clear(hdev); 4779 4780 for (i = 0; i < key_count; i++) { 4781 struct mgmt_ltk_info *key = &cp->keys[i]; 4782 u8 type, authenticated; 4783 4784 switch (key->type) { 4785 case MGMT_LTK_UNAUTHENTICATED: 4786 authenticated = 0x00; 4787 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 4788 break; 4789 case MGMT_LTK_AUTHENTICATED: 4790 authenticated = 0x01; 4791 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 4792 break; 4793 case MGMT_LTK_P256_UNAUTH: 4794 authenticated = 0x00; 4795 type = SMP_LTK_P256; 4796 break; 4797 case MGMT_LTK_P256_AUTH: 4798 authenticated = 0x01; 4799 type = SMP_LTK_P256; 4800 break; 4801 case MGMT_LTK_P256_DEBUG: 4802 authenticated = 0x00; 4803 type = SMP_LTK_P256_DEBUG; 4804 default: 4805 continue; 4806 } 4807 4808 hci_add_ltk(hdev, &key->addr.bdaddr, 4809 le_addr_type(key->addr.type), type, authenticated, 4810 key->val, key->enc_size, key->ediv, key->rand); 4811 } 4812 4813 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 4814 NULL, 0); 4815 4816 hci_dev_unlock(hdev); 4817 4818 return err; 4819 } 4820 4821 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 4822 { 4823 struct hci_conn *conn = cmd->user_data; 4824 struct mgmt_rp_get_conn_info rp; 4825 int err; 4826 4827 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 4828 4829 if (status == MGMT_STATUS_SUCCESS) { 4830 rp.rssi = conn->rssi; 4831 rp.tx_power = conn->tx_power; 4832 rp.max_tx_power = conn->max_tx_power; 4833 } else { 4834 rp.rssi = HCI_RSSI_INVALID; 4835 rp.tx_power = HCI_TX_POWER_INVALID; 4836 rp.max_tx_power = HCI_TX_POWER_INVALID; 4837 } 4838 4839 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, 4840 status, &rp, sizeof(rp)); 4841 4842 hci_conn_drop(conn); 4843 hci_conn_put(conn); 4844 4845 return err; 4846 } 4847 4848 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status, 4849 u16 opcode) 4850 { 4851 struct hci_cp_read_rssi *cp; 4852 struct mgmt_pending_cmd *cmd; 4853 struct hci_conn *conn; 4854 u16 handle; 4855 u8 status; 4856 4857 BT_DBG("status 0x%02x", hci_status); 4858 4859 hci_dev_lock(hdev); 4860 4861 /* Commands sent in request are either Read RSSI or Read Transmit Power 4862 * Level so we check which one was last sent to retrieve connection 4863 * handle. Both commands have handle as first parameter so it's safe to 4864 * cast data on the same command struct. 4865 * 4866 * First command sent is always Read RSSI and we fail only if it fails. 4867 * In other case we simply override error to indicate success as we 4868 * already remembered if TX power value is actually valid. 4869 */ 4870 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI); 4871 if (!cp) { 4872 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 4873 status = MGMT_STATUS_SUCCESS; 4874 } else { 4875 status = mgmt_status(hci_status); 4876 } 4877 4878 if (!cp) { 4879 bt_dev_err(hdev, "invalid sent_cmd in conn_info response"); 4880 goto unlock; 4881 } 4882 4883 handle = __le16_to_cpu(cp->handle); 4884 conn = hci_conn_hash_lookup_handle(hdev, handle); 4885 if (!conn) { 4886 bt_dev_err(hdev, "unknown handle (%d) in conn_info response", 4887 handle); 4888 goto unlock; 4889 } 4890 4891 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn); 4892 if (!cmd) 4893 goto unlock; 4894 4895 cmd->cmd_complete(cmd, status); 4896 mgmt_pending_remove(cmd); 4897 4898 unlock: 4899 hci_dev_unlock(hdev); 4900 } 4901 4902 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 4903 u16 len) 4904 { 4905 struct mgmt_cp_get_conn_info *cp = data; 4906 struct mgmt_rp_get_conn_info rp; 4907 struct hci_conn *conn; 4908 unsigned long conn_info_age; 4909 int err = 0; 4910 4911 BT_DBG("%s", hdev->name); 4912 4913 memset(&rp, 0, sizeof(rp)); 4914 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4915 rp.addr.type = cp->addr.type; 4916 4917 if (!bdaddr_type_is_valid(cp->addr.type)) 4918 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 4919 MGMT_STATUS_INVALID_PARAMS, 4920 &rp, sizeof(rp)); 4921 4922 hci_dev_lock(hdev); 4923 4924 if (!hdev_is_powered(hdev)) { 4925 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 4926 MGMT_STATUS_NOT_POWERED, &rp, 4927 sizeof(rp)); 4928 goto unlock; 4929 } 4930 4931 if (cp->addr.type == BDADDR_BREDR) 4932 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 4933 &cp->addr.bdaddr); 4934 else 4935 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 4936 4937 if (!conn || conn->state != BT_CONNECTED) { 4938 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 4939 MGMT_STATUS_NOT_CONNECTED, &rp, 4940 sizeof(rp)); 4941 goto unlock; 4942 } 4943 4944 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) { 4945 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 4946 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 4947 goto unlock; 4948 } 4949 4950 /* To avoid client trying to guess when to poll again for information we 4951 * calculate conn info age as random value between min/max set in hdev. 4952 */ 4953 conn_info_age = hdev->conn_info_min_age + 4954 prandom_u32_max(hdev->conn_info_max_age - 4955 hdev->conn_info_min_age); 4956 4957 /* Query controller to refresh cached values if they are too old or were 4958 * never read. 4959 */ 4960 if (time_after(jiffies, conn->conn_info_timestamp + 4961 msecs_to_jiffies(conn_info_age)) || 4962 !conn->conn_info_timestamp) { 4963 struct hci_request req; 4964 struct hci_cp_read_tx_power req_txp_cp; 4965 struct hci_cp_read_rssi req_rssi_cp; 4966 struct mgmt_pending_cmd *cmd; 4967 4968 hci_req_init(&req, hdev); 4969 req_rssi_cp.handle = cpu_to_le16(conn->handle); 4970 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp), 4971 &req_rssi_cp); 4972 4973 /* For LE links TX power does not change thus we don't need to 4974 * query for it once value is known. 4975 */ 4976 if (!bdaddr_type_is_le(cp->addr.type) || 4977 conn->tx_power == HCI_TX_POWER_INVALID) { 4978 req_txp_cp.handle = cpu_to_le16(conn->handle); 4979 req_txp_cp.type = 0x00; 4980 hci_req_add(&req, HCI_OP_READ_TX_POWER, 4981 sizeof(req_txp_cp), &req_txp_cp); 4982 } 4983 4984 /* Max TX power needs to be read only once per connection */ 4985 if (conn->max_tx_power == HCI_TX_POWER_INVALID) { 4986 req_txp_cp.handle = cpu_to_le16(conn->handle); 4987 req_txp_cp.type = 0x01; 4988 hci_req_add(&req, HCI_OP_READ_TX_POWER, 4989 sizeof(req_txp_cp), &req_txp_cp); 4990 } 4991 4992 err = hci_req_run(&req, conn_info_refresh_complete); 4993 if (err < 0) 4994 goto unlock; 4995 4996 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev, 4997 data, len); 4998 if (!cmd) { 4999 err = -ENOMEM; 5000 goto unlock; 5001 } 5002 5003 hci_conn_hold(conn); 5004 cmd->user_data = hci_conn_get(conn); 5005 cmd->cmd_complete = conn_info_cmd_complete; 5006 5007 conn->conn_info_timestamp = jiffies; 5008 } else { 5009 /* Cache is valid, just reply with values cached in hci_conn */ 5010 rp.rssi = conn->rssi; 5011 rp.tx_power = conn->tx_power; 5012 rp.max_tx_power = conn->max_tx_power; 5013 5014 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 5015 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 5016 } 5017 5018 unlock: 5019 hci_dev_unlock(hdev); 5020 return err; 5021 } 5022 5023 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 5024 { 5025 struct hci_conn *conn = cmd->user_data; 5026 struct mgmt_rp_get_clock_info rp; 5027 struct hci_dev *hdev; 5028 int err; 5029 5030 memset(&rp, 0, sizeof(rp)); 5031 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 5032 5033 if (status) 5034 goto complete; 5035 5036 hdev = hci_dev_get(cmd->index); 5037 if (hdev) { 5038 rp.local_clock = cpu_to_le32(hdev->clock); 5039 hci_dev_put(hdev); 5040 } 5041 5042 if (conn) { 5043 rp.piconet_clock = cpu_to_le32(conn->clock); 5044 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 5045 } 5046 5047 complete: 5048 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 5049 sizeof(rp)); 5050 5051 if (conn) { 5052 hci_conn_drop(conn); 5053 hci_conn_put(conn); 5054 } 5055 5056 return err; 5057 } 5058 5059 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5060 { 5061 struct hci_cp_read_clock *hci_cp; 5062 struct mgmt_pending_cmd *cmd; 5063 struct hci_conn *conn; 5064 5065 BT_DBG("%s status %u", hdev->name, status); 5066 5067 hci_dev_lock(hdev); 5068 5069 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 5070 if (!hci_cp) 5071 goto unlock; 5072 5073 if (hci_cp->which) { 5074 u16 handle = __le16_to_cpu(hci_cp->handle); 5075 conn = hci_conn_hash_lookup_handle(hdev, handle); 5076 } else { 5077 conn = NULL; 5078 } 5079 5080 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn); 5081 if (!cmd) 5082 goto unlock; 5083 5084 cmd->cmd_complete(cmd, mgmt_status(status)); 5085 mgmt_pending_remove(cmd); 5086 5087 unlock: 5088 hci_dev_unlock(hdev); 5089 } 5090 5091 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 5092 u16 len) 5093 { 5094 struct mgmt_cp_get_clock_info *cp = data; 5095 struct mgmt_rp_get_clock_info rp; 5096 struct hci_cp_read_clock hci_cp; 5097 struct mgmt_pending_cmd *cmd; 5098 struct hci_request req; 5099 struct hci_conn *conn; 5100 int err; 5101 5102 BT_DBG("%s", hdev->name); 5103 5104 memset(&rp, 0, sizeof(rp)); 5105 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5106 rp.addr.type = cp->addr.type; 5107 5108 if (cp->addr.type != BDADDR_BREDR) 5109 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 5110 MGMT_STATUS_INVALID_PARAMS, 5111 &rp, sizeof(rp)); 5112 5113 hci_dev_lock(hdev); 5114 5115 if (!hdev_is_powered(hdev)) { 5116 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 5117 MGMT_STATUS_NOT_POWERED, &rp, 5118 sizeof(rp)); 5119 goto unlock; 5120 } 5121 5122 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5123 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 5124 &cp->addr.bdaddr); 5125 if (!conn || conn->state != BT_CONNECTED) { 5126 err = mgmt_cmd_complete(sk, hdev->id, 5127 MGMT_OP_GET_CLOCK_INFO, 5128 MGMT_STATUS_NOT_CONNECTED, 5129 &rp, sizeof(rp)); 5130 goto unlock; 5131 } 5132 } else { 5133 conn = NULL; 5134 } 5135 5136 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 5137 if (!cmd) { 5138 err = -ENOMEM; 5139 goto unlock; 5140 } 5141 5142 cmd->cmd_complete = clock_info_cmd_complete; 5143 5144 hci_req_init(&req, hdev); 5145 5146 memset(&hci_cp, 0, sizeof(hci_cp)); 5147 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 5148 5149 if (conn) { 5150 hci_conn_hold(conn); 5151 cmd->user_data = hci_conn_get(conn); 5152 5153 hci_cp.handle = cpu_to_le16(conn->handle); 5154 hci_cp.which = 0x01; /* Piconet clock */ 5155 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 5156 } 5157 5158 err = hci_req_run(&req, get_clock_info_complete); 5159 if (err < 0) 5160 mgmt_pending_remove(cmd); 5161 5162 unlock: 5163 hci_dev_unlock(hdev); 5164 return err; 5165 } 5166 5167 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5168 { 5169 struct hci_conn *conn; 5170 5171 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5172 if (!conn) 5173 return false; 5174 5175 if (conn->dst_type != type) 5176 return false; 5177 5178 if (conn->state != BT_CONNECTED) 5179 return false; 5180 5181 return true; 5182 } 5183 5184 /* This function requires the caller holds hdev->lock */ 5185 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 5186 u8 addr_type, u8 auto_connect) 5187 { 5188 struct hci_conn_params *params; 5189 5190 params = hci_conn_params_add(hdev, addr, addr_type); 5191 if (!params) 5192 return -EIO; 5193 5194 if (params->auto_connect == auto_connect) 5195 return 0; 5196 5197 list_del_init(¶ms->action); 5198 5199 switch (auto_connect) { 5200 case HCI_AUTO_CONN_DISABLED: 5201 case HCI_AUTO_CONN_LINK_LOSS: 5202 /* If auto connect is being disabled when we're trying to 5203 * connect to device, keep connecting. 5204 */ 5205 if (params->explicit_connect) 5206 list_add(¶ms->action, &hdev->pend_le_conns); 5207 break; 5208 case HCI_AUTO_CONN_REPORT: 5209 if (params->explicit_connect) 5210 list_add(¶ms->action, &hdev->pend_le_conns); 5211 else 5212 list_add(¶ms->action, &hdev->pend_le_reports); 5213 break; 5214 case HCI_AUTO_CONN_DIRECT: 5215 case HCI_AUTO_CONN_ALWAYS: 5216 if (!is_connected(hdev, addr, addr_type)) 5217 list_add(¶ms->action, &hdev->pend_le_conns); 5218 break; 5219 } 5220 5221 params->auto_connect = auto_connect; 5222 5223 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type, 5224 auto_connect); 5225 5226 return 0; 5227 } 5228 5229 static void device_added(struct sock *sk, struct hci_dev *hdev, 5230 bdaddr_t *bdaddr, u8 type, u8 action) 5231 { 5232 struct mgmt_ev_device_added ev; 5233 5234 bacpy(&ev.addr.bdaddr, bdaddr); 5235 ev.addr.type = type; 5236 ev.action = action; 5237 5238 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 5239 } 5240 5241 static int add_device(struct sock *sk, struct hci_dev *hdev, 5242 void *data, u16 len) 5243 { 5244 struct mgmt_cp_add_device *cp = data; 5245 u8 auto_conn, addr_type; 5246 int err; 5247 5248 BT_DBG("%s", hdev->name); 5249 5250 if (!bdaddr_type_is_valid(cp->addr.type) || 5251 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 5252 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5253 MGMT_STATUS_INVALID_PARAMS, 5254 &cp->addr, sizeof(cp->addr)); 5255 5256 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 5257 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5258 MGMT_STATUS_INVALID_PARAMS, 5259 &cp->addr, sizeof(cp->addr)); 5260 5261 hci_dev_lock(hdev); 5262 5263 if (cp->addr.type == BDADDR_BREDR) { 5264 /* Only incoming connections action is supported for now */ 5265 if (cp->action != 0x01) { 5266 err = mgmt_cmd_complete(sk, hdev->id, 5267 MGMT_OP_ADD_DEVICE, 5268 MGMT_STATUS_INVALID_PARAMS, 5269 &cp->addr, sizeof(cp->addr)); 5270 goto unlock; 5271 } 5272 5273 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr, 5274 cp->addr.type); 5275 if (err) 5276 goto unlock; 5277 5278 hci_req_update_scan(hdev); 5279 5280 goto added; 5281 } 5282 5283 addr_type = le_addr_type(cp->addr.type); 5284 5285 if (cp->action == 0x02) 5286 auto_conn = HCI_AUTO_CONN_ALWAYS; 5287 else if (cp->action == 0x01) 5288 auto_conn = HCI_AUTO_CONN_DIRECT; 5289 else 5290 auto_conn = HCI_AUTO_CONN_REPORT; 5291 5292 /* Kernel internally uses conn_params with resolvable private 5293 * address, but Add Device allows only identity addresses. 5294 * Make sure it is enforced before calling 5295 * hci_conn_params_lookup. 5296 */ 5297 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 5298 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5299 MGMT_STATUS_INVALID_PARAMS, 5300 &cp->addr, sizeof(cp->addr)); 5301 goto unlock; 5302 } 5303 5304 /* If the connection parameters don't exist for this device, 5305 * they will be created and configured with defaults. 5306 */ 5307 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 5308 auto_conn) < 0) { 5309 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5310 MGMT_STATUS_FAILED, &cp->addr, 5311 sizeof(cp->addr)); 5312 goto unlock; 5313 } 5314 5315 hci_update_background_scan(hdev); 5316 5317 added: 5318 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 5319 5320 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5321 MGMT_STATUS_SUCCESS, &cp->addr, 5322 sizeof(cp->addr)); 5323 5324 unlock: 5325 hci_dev_unlock(hdev); 5326 return err; 5327 } 5328 5329 static void device_removed(struct sock *sk, struct hci_dev *hdev, 5330 bdaddr_t *bdaddr, u8 type) 5331 { 5332 struct mgmt_ev_device_removed ev; 5333 5334 bacpy(&ev.addr.bdaddr, bdaddr); 5335 ev.addr.type = type; 5336 5337 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 5338 } 5339 5340 static int remove_device(struct sock *sk, struct hci_dev *hdev, 5341 void *data, u16 len) 5342 { 5343 struct mgmt_cp_remove_device *cp = data; 5344 int err; 5345 5346 BT_DBG("%s", hdev->name); 5347 5348 hci_dev_lock(hdev); 5349 5350 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5351 struct hci_conn_params *params; 5352 u8 addr_type; 5353 5354 if (!bdaddr_type_is_valid(cp->addr.type)) { 5355 err = mgmt_cmd_complete(sk, hdev->id, 5356 MGMT_OP_REMOVE_DEVICE, 5357 MGMT_STATUS_INVALID_PARAMS, 5358 &cp->addr, sizeof(cp->addr)); 5359 goto unlock; 5360 } 5361 5362 if (cp->addr.type == BDADDR_BREDR) { 5363 err = hci_bdaddr_list_del(&hdev->whitelist, 5364 &cp->addr.bdaddr, 5365 cp->addr.type); 5366 if (err) { 5367 err = mgmt_cmd_complete(sk, hdev->id, 5368 MGMT_OP_REMOVE_DEVICE, 5369 MGMT_STATUS_INVALID_PARAMS, 5370 &cp->addr, 5371 sizeof(cp->addr)); 5372 goto unlock; 5373 } 5374 5375 hci_req_update_scan(hdev); 5376 5377 device_removed(sk, hdev, &cp->addr.bdaddr, 5378 cp->addr.type); 5379 goto complete; 5380 } 5381 5382 addr_type = le_addr_type(cp->addr.type); 5383 5384 /* Kernel internally uses conn_params with resolvable private 5385 * address, but Remove Device allows only identity addresses. 5386 * Make sure it is enforced before calling 5387 * hci_conn_params_lookup. 5388 */ 5389 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 5390 err = mgmt_cmd_complete(sk, hdev->id, 5391 MGMT_OP_REMOVE_DEVICE, 5392 MGMT_STATUS_INVALID_PARAMS, 5393 &cp->addr, sizeof(cp->addr)); 5394 goto unlock; 5395 } 5396 5397 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5398 addr_type); 5399 if (!params) { 5400 err = mgmt_cmd_complete(sk, hdev->id, 5401 MGMT_OP_REMOVE_DEVICE, 5402 MGMT_STATUS_INVALID_PARAMS, 5403 &cp->addr, sizeof(cp->addr)); 5404 goto unlock; 5405 } 5406 5407 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 5408 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 5409 err = mgmt_cmd_complete(sk, hdev->id, 5410 MGMT_OP_REMOVE_DEVICE, 5411 MGMT_STATUS_INVALID_PARAMS, 5412 &cp->addr, sizeof(cp->addr)); 5413 goto unlock; 5414 } 5415 5416 list_del(¶ms->action); 5417 list_del(¶ms->list); 5418 kfree(params); 5419 hci_update_background_scan(hdev); 5420 5421 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 5422 } else { 5423 struct hci_conn_params *p, *tmp; 5424 struct bdaddr_list *b, *btmp; 5425 5426 if (cp->addr.type) { 5427 err = mgmt_cmd_complete(sk, hdev->id, 5428 MGMT_OP_REMOVE_DEVICE, 5429 MGMT_STATUS_INVALID_PARAMS, 5430 &cp->addr, sizeof(cp->addr)); 5431 goto unlock; 5432 } 5433 5434 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) { 5435 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 5436 list_del(&b->list); 5437 kfree(b); 5438 } 5439 5440 hci_req_update_scan(hdev); 5441 5442 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 5443 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 5444 continue; 5445 device_removed(sk, hdev, &p->addr, p->addr_type); 5446 if (p->explicit_connect) { 5447 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 5448 continue; 5449 } 5450 list_del(&p->action); 5451 list_del(&p->list); 5452 kfree(p); 5453 } 5454 5455 BT_DBG("All LE connection parameters were removed"); 5456 5457 hci_update_background_scan(hdev); 5458 } 5459 5460 complete: 5461 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 5462 MGMT_STATUS_SUCCESS, &cp->addr, 5463 sizeof(cp->addr)); 5464 unlock: 5465 hci_dev_unlock(hdev); 5466 return err; 5467 } 5468 5469 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 5470 u16 len) 5471 { 5472 struct mgmt_cp_load_conn_param *cp = data; 5473 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 5474 sizeof(struct mgmt_conn_param)); 5475 u16 param_count, expected_len; 5476 int i; 5477 5478 if (!lmp_le_capable(hdev)) 5479 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 5480 MGMT_STATUS_NOT_SUPPORTED); 5481 5482 param_count = __le16_to_cpu(cp->param_count); 5483 if (param_count > max_param_count) { 5484 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 5485 param_count); 5486 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 5487 MGMT_STATUS_INVALID_PARAMS); 5488 } 5489 5490 expected_len = sizeof(*cp) + param_count * 5491 sizeof(struct mgmt_conn_param); 5492 if (expected_len != len) { 5493 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 5494 expected_len, len); 5495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 5496 MGMT_STATUS_INVALID_PARAMS); 5497 } 5498 5499 BT_DBG("%s param_count %u", hdev->name, param_count); 5500 5501 hci_dev_lock(hdev); 5502 5503 hci_conn_params_clear_disabled(hdev); 5504 5505 for (i = 0; i < param_count; i++) { 5506 struct mgmt_conn_param *param = &cp->params[i]; 5507 struct hci_conn_params *hci_param; 5508 u16 min, max, latency, timeout; 5509 u8 addr_type; 5510 5511 BT_DBG("Adding %pMR (type %u)", ¶m->addr.bdaddr, 5512 param->addr.type); 5513 5514 if (param->addr.type == BDADDR_LE_PUBLIC) { 5515 addr_type = ADDR_LE_DEV_PUBLIC; 5516 } else if (param->addr.type == BDADDR_LE_RANDOM) { 5517 addr_type = ADDR_LE_DEV_RANDOM; 5518 } else { 5519 bt_dev_err(hdev, "ignoring invalid connection parameters"); 5520 continue; 5521 } 5522 5523 min = le16_to_cpu(param->min_interval); 5524 max = le16_to_cpu(param->max_interval); 5525 latency = le16_to_cpu(param->latency); 5526 timeout = le16_to_cpu(param->timeout); 5527 5528 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 5529 min, max, latency, timeout); 5530 5531 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 5532 bt_dev_err(hdev, "ignoring invalid connection parameters"); 5533 continue; 5534 } 5535 5536 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 5537 addr_type); 5538 if (!hci_param) { 5539 bt_dev_err(hdev, "failed to add connection parameters"); 5540 continue; 5541 } 5542 5543 hci_param->conn_min_interval = min; 5544 hci_param->conn_max_interval = max; 5545 hci_param->conn_latency = latency; 5546 hci_param->supervision_timeout = timeout; 5547 } 5548 5549 hci_dev_unlock(hdev); 5550 5551 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 5552 NULL, 0); 5553 } 5554 5555 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 5556 void *data, u16 len) 5557 { 5558 struct mgmt_cp_set_external_config *cp = data; 5559 bool changed; 5560 int err; 5561 5562 BT_DBG("%s", hdev->name); 5563 5564 if (hdev_is_powered(hdev)) 5565 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 5566 MGMT_STATUS_REJECTED); 5567 5568 if (cp->config != 0x00 && cp->config != 0x01) 5569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 5570 MGMT_STATUS_INVALID_PARAMS); 5571 5572 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 5573 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 5574 MGMT_STATUS_NOT_SUPPORTED); 5575 5576 hci_dev_lock(hdev); 5577 5578 if (cp->config) 5579 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 5580 else 5581 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 5582 5583 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 5584 if (err < 0) 5585 goto unlock; 5586 5587 if (!changed) 5588 goto unlock; 5589 5590 err = new_options(hdev, sk); 5591 5592 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 5593 mgmt_index_removed(hdev); 5594 5595 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 5596 hci_dev_set_flag(hdev, HCI_CONFIG); 5597 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 5598 5599 queue_work(hdev->req_workqueue, &hdev->power_on); 5600 } else { 5601 set_bit(HCI_RAW, &hdev->flags); 5602 mgmt_index_added(hdev); 5603 } 5604 } 5605 5606 unlock: 5607 hci_dev_unlock(hdev); 5608 return err; 5609 } 5610 5611 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 5612 void *data, u16 len) 5613 { 5614 struct mgmt_cp_set_public_address *cp = data; 5615 bool changed; 5616 int err; 5617 5618 BT_DBG("%s", hdev->name); 5619 5620 if (hdev_is_powered(hdev)) 5621 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 5622 MGMT_STATUS_REJECTED); 5623 5624 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 5625 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 5626 MGMT_STATUS_INVALID_PARAMS); 5627 5628 if (!hdev->set_bdaddr) 5629 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 5630 MGMT_STATUS_NOT_SUPPORTED); 5631 5632 hci_dev_lock(hdev); 5633 5634 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 5635 bacpy(&hdev->public_addr, &cp->bdaddr); 5636 5637 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 5638 if (err < 0) 5639 goto unlock; 5640 5641 if (!changed) 5642 goto unlock; 5643 5644 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5645 err = new_options(hdev, sk); 5646 5647 if (is_configured(hdev)) { 5648 mgmt_index_removed(hdev); 5649 5650 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 5651 5652 hci_dev_set_flag(hdev, HCI_CONFIG); 5653 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 5654 5655 queue_work(hdev->req_workqueue, &hdev->power_on); 5656 } 5657 5658 unlock: 5659 hci_dev_unlock(hdev); 5660 return err; 5661 } 5662 5663 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status, 5664 u16 opcode, struct sk_buff *skb) 5665 { 5666 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 5667 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 5668 u8 *h192, *r192, *h256, *r256; 5669 struct mgmt_pending_cmd *cmd; 5670 u16 eir_len; 5671 int err; 5672 5673 BT_DBG("%s status %u", hdev->name, status); 5674 5675 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev); 5676 if (!cmd) 5677 return; 5678 5679 mgmt_cp = cmd->param; 5680 5681 if (status) { 5682 status = mgmt_status(status); 5683 eir_len = 0; 5684 5685 h192 = NULL; 5686 r192 = NULL; 5687 h256 = NULL; 5688 r256 = NULL; 5689 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 5690 struct hci_rp_read_local_oob_data *rp; 5691 5692 if (skb->len != sizeof(*rp)) { 5693 status = MGMT_STATUS_FAILED; 5694 eir_len = 0; 5695 } else { 5696 status = MGMT_STATUS_SUCCESS; 5697 rp = (void *)skb->data; 5698 5699 eir_len = 5 + 18 + 18; 5700 h192 = rp->hash; 5701 r192 = rp->rand; 5702 h256 = NULL; 5703 r256 = NULL; 5704 } 5705 } else { 5706 struct hci_rp_read_local_oob_ext_data *rp; 5707 5708 if (skb->len != sizeof(*rp)) { 5709 status = MGMT_STATUS_FAILED; 5710 eir_len = 0; 5711 } else { 5712 status = MGMT_STATUS_SUCCESS; 5713 rp = (void *)skb->data; 5714 5715 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 5716 eir_len = 5 + 18 + 18; 5717 h192 = NULL; 5718 r192 = NULL; 5719 } else { 5720 eir_len = 5 + 18 + 18 + 18 + 18; 5721 h192 = rp->hash192; 5722 r192 = rp->rand192; 5723 } 5724 5725 h256 = rp->hash256; 5726 r256 = rp->rand256; 5727 } 5728 } 5729 5730 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 5731 if (!mgmt_rp) 5732 goto done; 5733 5734 if (status) 5735 goto send_rsp; 5736 5737 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 5738 hdev->dev_class, 3); 5739 5740 if (h192 && r192) { 5741 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 5742 EIR_SSP_HASH_C192, h192, 16); 5743 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 5744 EIR_SSP_RAND_R192, r192, 16); 5745 } 5746 5747 if (h256 && r256) { 5748 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 5749 EIR_SSP_HASH_C256, h256, 16); 5750 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 5751 EIR_SSP_RAND_R256, r256, 16); 5752 } 5753 5754 send_rsp: 5755 mgmt_rp->type = mgmt_cp->type; 5756 mgmt_rp->eir_len = cpu_to_le16(eir_len); 5757 5758 err = mgmt_cmd_complete(cmd->sk, hdev->id, 5759 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 5760 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 5761 if (err < 0 || status) 5762 goto done; 5763 5764 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 5765 5766 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 5767 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 5768 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 5769 done: 5770 kfree(mgmt_rp); 5771 mgmt_pending_remove(cmd); 5772 } 5773 5774 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 5775 struct mgmt_cp_read_local_oob_ext_data *cp) 5776 { 5777 struct mgmt_pending_cmd *cmd; 5778 struct hci_request req; 5779 int err; 5780 5781 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 5782 cp, sizeof(*cp)); 5783 if (!cmd) 5784 return -ENOMEM; 5785 5786 hci_req_init(&req, hdev); 5787 5788 if (bredr_sc_enabled(hdev)) 5789 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 5790 else 5791 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 5792 5793 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete); 5794 if (err < 0) { 5795 mgmt_pending_remove(cmd); 5796 return err; 5797 } 5798 5799 return 0; 5800 } 5801 5802 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 5803 void *data, u16 data_len) 5804 { 5805 struct mgmt_cp_read_local_oob_ext_data *cp = data; 5806 struct mgmt_rp_read_local_oob_ext_data *rp; 5807 size_t rp_len; 5808 u16 eir_len; 5809 u8 status, flags, role, addr[7], hash[16], rand[16]; 5810 int err; 5811 5812 BT_DBG("%s", hdev->name); 5813 5814 if (hdev_is_powered(hdev)) { 5815 switch (cp->type) { 5816 case BIT(BDADDR_BREDR): 5817 status = mgmt_bredr_support(hdev); 5818 if (status) 5819 eir_len = 0; 5820 else 5821 eir_len = 5; 5822 break; 5823 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 5824 status = mgmt_le_support(hdev); 5825 if (status) 5826 eir_len = 0; 5827 else 5828 eir_len = 9 + 3 + 18 + 18 + 3; 5829 break; 5830 default: 5831 status = MGMT_STATUS_INVALID_PARAMS; 5832 eir_len = 0; 5833 break; 5834 } 5835 } else { 5836 status = MGMT_STATUS_NOT_POWERED; 5837 eir_len = 0; 5838 } 5839 5840 rp_len = sizeof(*rp) + eir_len; 5841 rp = kmalloc(rp_len, GFP_ATOMIC); 5842 if (!rp) 5843 return -ENOMEM; 5844 5845 if (status) 5846 goto complete; 5847 5848 hci_dev_lock(hdev); 5849 5850 eir_len = 0; 5851 switch (cp->type) { 5852 case BIT(BDADDR_BREDR): 5853 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 5854 err = read_local_ssp_oob_req(hdev, sk, cp); 5855 hci_dev_unlock(hdev); 5856 if (!err) 5857 goto done; 5858 5859 status = MGMT_STATUS_FAILED; 5860 goto complete; 5861 } else { 5862 eir_len = eir_append_data(rp->eir, eir_len, 5863 EIR_CLASS_OF_DEV, 5864 hdev->dev_class, 3); 5865 } 5866 break; 5867 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 5868 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 5869 smp_generate_oob(hdev, hash, rand) < 0) { 5870 hci_dev_unlock(hdev); 5871 status = MGMT_STATUS_FAILED; 5872 goto complete; 5873 } 5874 5875 /* This should return the active RPA, but since the RPA 5876 * is only programmed on demand, it is really hard to fill 5877 * this in at the moment. For now disallow retrieving 5878 * local out-of-band data when privacy is in use. 5879 * 5880 * Returning the identity address will not help here since 5881 * pairing happens before the identity resolving key is 5882 * known and thus the connection establishment happens 5883 * based on the RPA and not the identity address. 5884 */ 5885 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 5886 hci_dev_unlock(hdev); 5887 status = MGMT_STATUS_REJECTED; 5888 goto complete; 5889 } 5890 5891 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 5892 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 5893 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5894 bacmp(&hdev->static_addr, BDADDR_ANY))) { 5895 memcpy(addr, &hdev->static_addr, 6); 5896 addr[6] = 0x01; 5897 } else { 5898 memcpy(addr, &hdev->bdaddr, 6); 5899 addr[6] = 0x00; 5900 } 5901 5902 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 5903 addr, sizeof(addr)); 5904 5905 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 5906 role = 0x02; 5907 else 5908 role = 0x01; 5909 5910 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 5911 &role, sizeof(role)); 5912 5913 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 5914 eir_len = eir_append_data(rp->eir, eir_len, 5915 EIR_LE_SC_CONFIRM, 5916 hash, sizeof(hash)); 5917 5918 eir_len = eir_append_data(rp->eir, eir_len, 5919 EIR_LE_SC_RANDOM, 5920 rand, sizeof(rand)); 5921 } 5922 5923 flags = mgmt_get_adv_discov_flags(hdev); 5924 5925 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 5926 flags |= LE_AD_NO_BREDR; 5927 5928 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 5929 &flags, sizeof(flags)); 5930 break; 5931 } 5932 5933 hci_dev_unlock(hdev); 5934 5935 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 5936 5937 status = MGMT_STATUS_SUCCESS; 5938 5939 complete: 5940 rp->type = cp->type; 5941 rp->eir_len = cpu_to_le16(eir_len); 5942 5943 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 5944 status, rp, sizeof(*rp) + eir_len); 5945 if (err < 0 || status) 5946 goto done; 5947 5948 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 5949 rp, sizeof(*rp) + eir_len, 5950 HCI_MGMT_OOB_DATA_EVENTS, sk); 5951 5952 done: 5953 kfree(rp); 5954 5955 return err; 5956 } 5957 5958 static u32 get_supported_adv_flags(struct hci_dev *hdev) 5959 { 5960 u32 flags = 0; 5961 5962 flags |= MGMT_ADV_FLAG_CONNECTABLE; 5963 flags |= MGMT_ADV_FLAG_DISCOV; 5964 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 5965 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 5966 flags |= MGMT_ADV_FLAG_APPEARANCE; 5967 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 5968 5969 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) 5970 flags |= MGMT_ADV_FLAG_TX_POWER; 5971 5972 return flags; 5973 } 5974 5975 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 5976 void *data, u16 data_len) 5977 { 5978 struct mgmt_rp_read_adv_features *rp; 5979 size_t rp_len; 5980 int err; 5981 struct adv_info *adv_instance; 5982 u32 supported_flags; 5983 u8 *instance; 5984 5985 BT_DBG("%s", hdev->name); 5986 5987 if (!lmp_le_capable(hdev)) 5988 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 5989 MGMT_STATUS_REJECTED); 5990 5991 hci_dev_lock(hdev); 5992 5993 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 5994 rp = kmalloc(rp_len, GFP_ATOMIC); 5995 if (!rp) { 5996 hci_dev_unlock(hdev); 5997 return -ENOMEM; 5998 } 5999 6000 supported_flags = get_supported_adv_flags(hdev); 6001 6002 rp->supported_flags = cpu_to_le32(supported_flags); 6003 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 6004 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 6005 rp->max_instances = HCI_MAX_ADV_INSTANCES; 6006 rp->num_instances = hdev->adv_instance_cnt; 6007 6008 instance = rp->instance; 6009 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 6010 *instance = adv_instance->instance; 6011 instance++; 6012 } 6013 6014 hci_dev_unlock(hdev); 6015 6016 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 6017 MGMT_STATUS_SUCCESS, rp, rp_len); 6018 6019 kfree(rp); 6020 6021 return err; 6022 } 6023 6024 static u8 calculate_name_len(struct hci_dev *hdev) 6025 { 6026 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 6027 6028 return append_local_name(hdev, buf, 0); 6029 } 6030 6031 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 6032 bool is_adv_data) 6033 { 6034 u8 max_len = HCI_MAX_AD_LENGTH; 6035 6036 if (is_adv_data) { 6037 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 6038 MGMT_ADV_FLAG_LIMITED_DISCOV | 6039 MGMT_ADV_FLAG_MANAGED_FLAGS)) 6040 max_len -= 3; 6041 6042 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 6043 max_len -= 3; 6044 } else { 6045 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 6046 max_len -= calculate_name_len(hdev); 6047 6048 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 6049 max_len -= 4; 6050 } 6051 6052 return max_len; 6053 } 6054 6055 static bool flags_managed(u32 adv_flags) 6056 { 6057 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 6058 MGMT_ADV_FLAG_LIMITED_DISCOV | 6059 MGMT_ADV_FLAG_MANAGED_FLAGS); 6060 } 6061 6062 static bool tx_power_managed(u32 adv_flags) 6063 { 6064 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 6065 } 6066 6067 static bool name_managed(u32 adv_flags) 6068 { 6069 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 6070 } 6071 6072 static bool appearance_managed(u32 adv_flags) 6073 { 6074 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 6075 } 6076 6077 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 6078 u8 len, bool is_adv_data) 6079 { 6080 int i, cur_len; 6081 u8 max_len; 6082 6083 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 6084 6085 if (len > max_len) 6086 return false; 6087 6088 /* Make sure that the data is correctly formatted. */ 6089 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 6090 cur_len = data[i]; 6091 6092 if (data[i + 1] == EIR_FLAGS && 6093 (!is_adv_data || flags_managed(adv_flags))) 6094 return false; 6095 6096 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 6097 return false; 6098 6099 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 6100 return false; 6101 6102 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 6103 return false; 6104 6105 if (data[i + 1] == EIR_APPEARANCE && 6106 appearance_managed(adv_flags)) 6107 return false; 6108 6109 /* If the current field length would exceed the total data 6110 * length, then it's invalid. 6111 */ 6112 if (i + cur_len >= len) 6113 return false; 6114 } 6115 6116 return true; 6117 } 6118 6119 static void add_advertising_complete(struct hci_dev *hdev, u8 status, 6120 u16 opcode) 6121 { 6122 struct mgmt_pending_cmd *cmd; 6123 struct mgmt_cp_add_advertising *cp; 6124 struct mgmt_rp_add_advertising rp; 6125 struct adv_info *adv_instance, *n; 6126 u8 instance; 6127 6128 BT_DBG("status %d", status); 6129 6130 hci_dev_lock(hdev); 6131 6132 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev); 6133 6134 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 6135 if (!adv_instance->pending) 6136 continue; 6137 6138 if (!status) { 6139 adv_instance->pending = false; 6140 continue; 6141 } 6142 6143 instance = adv_instance->instance; 6144 6145 if (hdev->cur_adv_instance == instance) 6146 cancel_adv_timeout(hdev); 6147 6148 hci_remove_adv_instance(hdev, instance); 6149 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance); 6150 } 6151 6152 if (!cmd) 6153 goto unlock; 6154 6155 cp = cmd->param; 6156 rp.instance = cp->instance; 6157 6158 if (status) 6159 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 6160 mgmt_status(status)); 6161 else 6162 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 6163 mgmt_status(status), &rp, sizeof(rp)); 6164 6165 mgmt_pending_remove(cmd); 6166 6167 unlock: 6168 hci_dev_unlock(hdev); 6169 } 6170 6171 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 6172 void *data, u16 data_len) 6173 { 6174 struct mgmt_cp_add_advertising *cp = data; 6175 struct mgmt_rp_add_advertising rp; 6176 u32 flags; 6177 u32 supported_flags; 6178 u8 status; 6179 u16 timeout, duration; 6180 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 6181 u8 schedule_instance = 0; 6182 struct adv_info *next_instance; 6183 int err; 6184 struct mgmt_pending_cmd *cmd; 6185 struct hci_request req; 6186 6187 BT_DBG("%s", hdev->name); 6188 6189 status = mgmt_le_support(hdev); 6190 if (status) 6191 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6192 status); 6193 6194 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES) 6195 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6196 MGMT_STATUS_INVALID_PARAMS); 6197 6198 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 6199 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6200 MGMT_STATUS_INVALID_PARAMS); 6201 6202 flags = __le32_to_cpu(cp->flags); 6203 timeout = __le16_to_cpu(cp->timeout); 6204 duration = __le16_to_cpu(cp->duration); 6205 6206 /* The current implementation only supports a subset of the specified 6207 * flags. 6208 */ 6209 supported_flags = get_supported_adv_flags(hdev); 6210 if (flags & ~supported_flags) 6211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6212 MGMT_STATUS_INVALID_PARAMS); 6213 6214 hci_dev_lock(hdev); 6215 6216 if (timeout && !hdev_is_powered(hdev)) { 6217 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6218 MGMT_STATUS_REJECTED); 6219 goto unlock; 6220 } 6221 6222 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 6223 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 6224 pending_find(MGMT_OP_SET_LE, hdev)) { 6225 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6226 MGMT_STATUS_BUSY); 6227 goto unlock; 6228 } 6229 6230 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 6231 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 6232 cp->scan_rsp_len, false)) { 6233 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6234 MGMT_STATUS_INVALID_PARAMS); 6235 goto unlock; 6236 } 6237 6238 err = hci_add_adv_instance(hdev, cp->instance, flags, 6239 cp->adv_data_len, cp->data, 6240 cp->scan_rsp_len, 6241 cp->data + cp->adv_data_len, 6242 timeout, duration); 6243 if (err < 0) { 6244 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6245 MGMT_STATUS_FAILED); 6246 goto unlock; 6247 } 6248 6249 /* Only trigger an advertising added event if a new instance was 6250 * actually added. 6251 */ 6252 if (hdev->adv_instance_cnt > prev_instance_cnt) 6253 mgmt_advertising_added(sk, hdev, cp->instance); 6254 6255 if (hdev->cur_adv_instance == cp->instance) { 6256 /* If the currently advertised instance is being changed then 6257 * cancel the current advertising and schedule the next 6258 * instance. If there is only one instance then the overridden 6259 * advertising data will be visible right away. 6260 */ 6261 cancel_adv_timeout(hdev); 6262 6263 next_instance = hci_get_next_instance(hdev, cp->instance); 6264 if (next_instance) 6265 schedule_instance = next_instance->instance; 6266 } else if (!hdev->adv_instance_timeout) { 6267 /* Immediately advertise the new instance if no other 6268 * instance is currently being advertised. 6269 */ 6270 schedule_instance = cp->instance; 6271 } 6272 6273 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 6274 * there is no instance to be advertised then we have no HCI 6275 * communication to make. Simply return. 6276 */ 6277 if (!hdev_is_powered(hdev) || 6278 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6279 !schedule_instance) { 6280 rp.instance = cp->instance; 6281 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6282 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6283 goto unlock; 6284 } 6285 6286 /* We're good to go, update advertising data, parameters, and start 6287 * advertising. 6288 */ 6289 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 6290 data_len); 6291 if (!cmd) { 6292 err = -ENOMEM; 6293 goto unlock; 6294 } 6295 6296 hci_req_init(&req, hdev); 6297 6298 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true); 6299 6300 if (!err) 6301 err = hci_req_run(&req, add_advertising_complete); 6302 6303 if (err < 0) 6304 mgmt_pending_remove(cmd); 6305 6306 unlock: 6307 hci_dev_unlock(hdev); 6308 6309 return err; 6310 } 6311 6312 static void remove_advertising_complete(struct hci_dev *hdev, u8 status, 6313 u16 opcode) 6314 { 6315 struct mgmt_pending_cmd *cmd; 6316 struct mgmt_cp_remove_advertising *cp; 6317 struct mgmt_rp_remove_advertising rp; 6318 6319 BT_DBG("status %d", status); 6320 6321 hci_dev_lock(hdev); 6322 6323 /* A failure status here only means that we failed to disable 6324 * advertising. Otherwise, the advertising instance has been removed, 6325 * so report success. 6326 */ 6327 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev); 6328 if (!cmd) 6329 goto unlock; 6330 6331 cp = cmd->param; 6332 rp.instance = cp->instance; 6333 6334 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS, 6335 &rp, sizeof(rp)); 6336 mgmt_pending_remove(cmd); 6337 6338 unlock: 6339 hci_dev_unlock(hdev); 6340 } 6341 6342 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 6343 void *data, u16 data_len) 6344 { 6345 struct mgmt_cp_remove_advertising *cp = data; 6346 struct mgmt_rp_remove_advertising rp; 6347 struct mgmt_pending_cmd *cmd; 6348 struct hci_request req; 6349 int err; 6350 6351 BT_DBG("%s", hdev->name); 6352 6353 hci_dev_lock(hdev); 6354 6355 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 6356 err = mgmt_cmd_status(sk, hdev->id, 6357 MGMT_OP_REMOVE_ADVERTISING, 6358 MGMT_STATUS_INVALID_PARAMS); 6359 goto unlock; 6360 } 6361 6362 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 6363 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 6364 pending_find(MGMT_OP_SET_LE, hdev)) { 6365 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 6366 MGMT_STATUS_BUSY); 6367 goto unlock; 6368 } 6369 6370 if (list_empty(&hdev->adv_instances)) { 6371 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 6372 MGMT_STATUS_INVALID_PARAMS); 6373 goto unlock; 6374 } 6375 6376 hci_req_init(&req, hdev); 6377 6378 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true); 6379 6380 if (list_empty(&hdev->adv_instances)) 6381 __hci_req_disable_advertising(&req); 6382 6383 /* If no HCI commands have been collected so far or the HCI_ADVERTISING 6384 * flag is set or the device isn't powered then we have no HCI 6385 * communication to make. Simply return. 6386 */ 6387 if (skb_queue_empty(&req.cmd_q) || 6388 !hdev_is_powered(hdev) || 6389 hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 6390 hci_req_purge(&req); 6391 rp.instance = cp->instance; 6392 err = mgmt_cmd_complete(sk, hdev->id, 6393 MGMT_OP_REMOVE_ADVERTISING, 6394 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6395 goto unlock; 6396 } 6397 6398 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 6399 data_len); 6400 if (!cmd) { 6401 err = -ENOMEM; 6402 goto unlock; 6403 } 6404 6405 err = hci_req_run(&req, remove_advertising_complete); 6406 if (err < 0) 6407 mgmt_pending_remove(cmd); 6408 6409 unlock: 6410 hci_dev_unlock(hdev); 6411 6412 return err; 6413 } 6414 6415 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 6416 void *data, u16 data_len) 6417 { 6418 struct mgmt_cp_get_adv_size_info *cp = data; 6419 struct mgmt_rp_get_adv_size_info rp; 6420 u32 flags, supported_flags; 6421 int err; 6422 6423 BT_DBG("%s", hdev->name); 6424 6425 if (!lmp_le_capable(hdev)) 6426 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6427 MGMT_STATUS_REJECTED); 6428 6429 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES) 6430 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6431 MGMT_STATUS_INVALID_PARAMS); 6432 6433 flags = __le32_to_cpu(cp->flags); 6434 6435 /* The current implementation only supports a subset of the specified 6436 * flags. 6437 */ 6438 supported_flags = get_supported_adv_flags(hdev); 6439 if (flags & ~supported_flags) 6440 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6441 MGMT_STATUS_INVALID_PARAMS); 6442 6443 rp.instance = cp->instance; 6444 rp.flags = cp->flags; 6445 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 6446 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 6447 6448 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6449 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6450 6451 return err; 6452 } 6453 6454 static const struct hci_mgmt_handler mgmt_handlers[] = { 6455 { NULL }, /* 0x0000 (no command) */ 6456 { read_version, MGMT_READ_VERSION_SIZE, 6457 HCI_MGMT_NO_HDEV | 6458 HCI_MGMT_UNTRUSTED }, 6459 { read_commands, MGMT_READ_COMMANDS_SIZE, 6460 HCI_MGMT_NO_HDEV | 6461 HCI_MGMT_UNTRUSTED }, 6462 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 6463 HCI_MGMT_NO_HDEV | 6464 HCI_MGMT_UNTRUSTED }, 6465 { read_controller_info, MGMT_READ_INFO_SIZE, 6466 HCI_MGMT_UNTRUSTED }, 6467 { set_powered, MGMT_SETTING_SIZE }, 6468 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 6469 { set_connectable, MGMT_SETTING_SIZE }, 6470 { set_fast_connectable, MGMT_SETTING_SIZE }, 6471 { set_bondable, MGMT_SETTING_SIZE }, 6472 { set_link_security, MGMT_SETTING_SIZE }, 6473 { set_ssp, MGMT_SETTING_SIZE }, 6474 { set_hs, MGMT_SETTING_SIZE }, 6475 { set_le, MGMT_SETTING_SIZE }, 6476 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 6477 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 6478 { add_uuid, MGMT_ADD_UUID_SIZE }, 6479 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 6480 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 6481 HCI_MGMT_VAR_LEN }, 6482 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 6483 HCI_MGMT_VAR_LEN }, 6484 { disconnect, MGMT_DISCONNECT_SIZE }, 6485 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 6486 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 6487 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 6488 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 6489 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 6490 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 6491 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 6492 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 6493 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 6494 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 6495 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 6496 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 6497 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 6498 HCI_MGMT_VAR_LEN }, 6499 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 6500 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 6501 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 6502 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 6503 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 6504 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 6505 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 6506 { set_advertising, MGMT_SETTING_SIZE }, 6507 { set_bredr, MGMT_SETTING_SIZE }, 6508 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 6509 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 6510 { set_secure_conn, MGMT_SETTING_SIZE }, 6511 { set_debug_keys, MGMT_SETTING_SIZE }, 6512 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 6513 { load_irks, MGMT_LOAD_IRKS_SIZE, 6514 HCI_MGMT_VAR_LEN }, 6515 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 6516 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 6517 { add_device, MGMT_ADD_DEVICE_SIZE }, 6518 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 6519 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 6520 HCI_MGMT_VAR_LEN }, 6521 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 6522 HCI_MGMT_NO_HDEV | 6523 HCI_MGMT_UNTRUSTED }, 6524 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 6525 HCI_MGMT_UNCONFIGURED | 6526 HCI_MGMT_UNTRUSTED }, 6527 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 6528 HCI_MGMT_UNCONFIGURED }, 6529 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 6530 HCI_MGMT_UNCONFIGURED }, 6531 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 6532 HCI_MGMT_VAR_LEN }, 6533 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 6534 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 6535 HCI_MGMT_NO_HDEV | 6536 HCI_MGMT_UNTRUSTED }, 6537 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 6538 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 6539 HCI_MGMT_VAR_LEN }, 6540 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 6541 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 6542 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 6543 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 6544 HCI_MGMT_UNTRUSTED }, 6545 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 6546 }; 6547 6548 void mgmt_index_added(struct hci_dev *hdev) 6549 { 6550 struct mgmt_ev_ext_index ev; 6551 6552 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 6553 return; 6554 6555 switch (hdev->dev_type) { 6556 case HCI_PRIMARY: 6557 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 6558 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 6559 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 6560 ev.type = 0x01; 6561 } else { 6562 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 6563 HCI_MGMT_INDEX_EVENTS); 6564 ev.type = 0x00; 6565 } 6566 break; 6567 case HCI_AMP: 6568 ev.type = 0x02; 6569 break; 6570 default: 6571 return; 6572 } 6573 6574 ev.bus = hdev->bus; 6575 6576 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 6577 HCI_MGMT_EXT_INDEX_EVENTS); 6578 } 6579 6580 void mgmt_index_removed(struct hci_dev *hdev) 6581 { 6582 struct mgmt_ev_ext_index ev; 6583 u8 status = MGMT_STATUS_INVALID_INDEX; 6584 6585 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 6586 return; 6587 6588 switch (hdev->dev_type) { 6589 case HCI_PRIMARY: 6590 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 6591 6592 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 6593 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 6594 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 6595 ev.type = 0x01; 6596 } else { 6597 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 6598 HCI_MGMT_INDEX_EVENTS); 6599 ev.type = 0x00; 6600 } 6601 break; 6602 case HCI_AMP: 6603 ev.type = 0x02; 6604 break; 6605 default: 6606 return; 6607 } 6608 6609 ev.bus = hdev->bus; 6610 6611 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 6612 HCI_MGMT_EXT_INDEX_EVENTS); 6613 } 6614 6615 /* This function requires the caller holds hdev->lock */ 6616 static void restart_le_actions(struct hci_dev *hdev) 6617 { 6618 struct hci_conn_params *p; 6619 6620 list_for_each_entry(p, &hdev->le_conn_params, list) { 6621 /* Needed for AUTO_OFF case where might not "really" 6622 * have been powered off. 6623 */ 6624 list_del_init(&p->action); 6625 6626 switch (p->auto_connect) { 6627 case HCI_AUTO_CONN_DIRECT: 6628 case HCI_AUTO_CONN_ALWAYS: 6629 list_add(&p->action, &hdev->pend_le_conns); 6630 break; 6631 case HCI_AUTO_CONN_REPORT: 6632 list_add(&p->action, &hdev->pend_le_reports); 6633 break; 6634 default: 6635 break; 6636 } 6637 } 6638 } 6639 6640 void mgmt_power_on(struct hci_dev *hdev, int err) 6641 { 6642 struct cmd_lookup match = { NULL, hdev }; 6643 6644 BT_DBG("err %d", err); 6645 6646 hci_dev_lock(hdev); 6647 6648 if (!err) { 6649 restart_le_actions(hdev); 6650 hci_update_background_scan(hdev); 6651 } 6652 6653 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 6654 6655 new_settings(hdev, match.sk); 6656 6657 if (match.sk) 6658 sock_put(match.sk); 6659 6660 hci_dev_unlock(hdev); 6661 } 6662 6663 void __mgmt_power_off(struct hci_dev *hdev) 6664 { 6665 struct cmd_lookup match = { NULL, hdev }; 6666 u8 status, zero_cod[] = { 0, 0, 0 }; 6667 6668 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 6669 6670 /* If the power off is because of hdev unregistration let 6671 * use the appropriate INVALID_INDEX status. Otherwise use 6672 * NOT_POWERED. We cover both scenarios here since later in 6673 * mgmt_index_removed() any hci_conn callbacks will have already 6674 * been triggered, potentially causing misleading DISCONNECTED 6675 * status responses. 6676 */ 6677 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 6678 status = MGMT_STATUS_INVALID_INDEX; 6679 else 6680 status = MGMT_STATUS_NOT_POWERED; 6681 6682 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 6683 6684 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 6685 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 6686 zero_cod, sizeof(zero_cod), 6687 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 6688 ext_info_changed(hdev, NULL); 6689 } 6690 6691 new_settings(hdev, match.sk); 6692 6693 if (match.sk) 6694 sock_put(match.sk); 6695 } 6696 6697 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 6698 { 6699 struct mgmt_pending_cmd *cmd; 6700 u8 status; 6701 6702 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 6703 if (!cmd) 6704 return; 6705 6706 if (err == -ERFKILL) 6707 status = MGMT_STATUS_RFKILLED; 6708 else 6709 status = MGMT_STATUS_FAILED; 6710 6711 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 6712 6713 mgmt_pending_remove(cmd); 6714 } 6715 6716 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 6717 bool persistent) 6718 { 6719 struct mgmt_ev_new_link_key ev; 6720 6721 memset(&ev, 0, sizeof(ev)); 6722 6723 ev.store_hint = persistent; 6724 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 6725 ev.key.addr.type = BDADDR_BREDR; 6726 ev.key.type = key->type; 6727 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 6728 ev.key.pin_len = key->pin_len; 6729 6730 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 6731 } 6732 6733 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 6734 { 6735 switch (ltk->type) { 6736 case SMP_LTK: 6737 case SMP_LTK_SLAVE: 6738 if (ltk->authenticated) 6739 return MGMT_LTK_AUTHENTICATED; 6740 return MGMT_LTK_UNAUTHENTICATED; 6741 case SMP_LTK_P256: 6742 if (ltk->authenticated) 6743 return MGMT_LTK_P256_AUTH; 6744 return MGMT_LTK_P256_UNAUTH; 6745 case SMP_LTK_P256_DEBUG: 6746 return MGMT_LTK_P256_DEBUG; 6747 } 6748 6749 return MGMT_LTK_UNAUTHENTICATED; 6750 } 6751 6752 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 6753 { 6754 struct mgmt_ev_new_long_term_key ev; 6755 6756 memset(&ev, 0, sizeof(ev)); 6757 6758 /* Devices using resolvable or non-resolvable random addresses 6759 * without providing an identity resolving key don't require 6760 * to store long term keys. Their addresses will change the 6761 * next time around. 6762 * 6763 * Only when a remote device provides an identity address 6764 * make sure the long term key is stored. If the remote 6765 * identity is known, the long term keys are internally 6766 * mapped to the identity address. So allow static random 6767 * and public addresses here. 6768 */ 6769 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 6770 (key->bdaddr.b[5] & 0xc0) != 0xc0) 6771 ev.store_hint = 0x00; 6772 else 6773 ev.store_hint = persistent; 6774 6775 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 6776 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 6777 ev.key.type = mgmt_ltk_type(key); 6778 ev.key.enc_size = key->enc_size; 6779 ev.key.ediv = key->ediv; 6780 ev.key.rand = key->rand; 6781 6782 if (key->type == SMP_LTK) 6783 ev.key.master = 1; 6784 6785 /* Make sure we copy only the significant bytes based on the 6786 * encryption key size, and set the rest of the value to zeroes. 6787 */ 6788 memcpy(ev.key.val, key->val, key->enc_size); 6789 memset(ev.key.val + key->enc_size, 0, 6790 sizeof(ev.key.val) - key->enc_size); 6791 6792 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 6793 } 6794 6795 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 6796 { 6797 struct mgmt_ev_new_irk ev; 6798 6799 memset(&ev, 0, sizeof(ev)); 6800 6801 ev.store_hint = persistent; 6802 6803 bacpy(&ev.rpa, &irk->rpa); 6804 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 6805 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 6806 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 6807 6808 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 6809 } 6810 6811 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 6812 bool persistent) 6813 { 6814 struct mgmt_ev_new_csrk ev; 6815 6816 memset(&ev, 0, sizeof(ev)); 6817 6818 /* Devices using resolvable or non-resolvable random addresses 6819 * without providing an identity resolving key don't require 6820 * to store signature resolving keys. Their addresses will change 6821 * the next time around. 6822 * 6823 * Only when a remote device provides an identity address 6824 * make sure the signature resolving key is stored. So allow 6825 * static random and public addresses here. 6826 */ 6827 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 6828 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 6829 ev.store_hint = 0x00; 6830 else 6831 ev.store_hint = persistent; 6832 6833 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 6834 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 6835 ev.key.type = csrk->type; 6836 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 6837 6838 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 6839 } 6840 6841 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 6842 u8 bdaddr_type, u8 store_hint, u16 min_interval, 6843 u16 max_interval, u16 latency, u16 timeout) 6844 { 6845 struct mgmt_ev_new_conn_param ev; 6846 6847 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 6848 return; 6849 6850 memset(&ev, 0, sizeof(ev)); 6851 bacpy(&ev.addr.bdaddr, bdaddr); 6852 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 6853 ev.store_hint = store_hint; 6854 ev.min_interval = cpu_to_le16(min_interval); 6855 ev.max_interval = cpu_to_le16(max_interval); 6856 ev.latency = cpu_to_le16(latency); 6857 ev.timeout = cpu_to_le16(timeout); 6858 6859 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 6860 } 6861 6862 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 6863 u32 flags, u8 *name, u8 name_len) 6864 { 6865 char buf[512]; 6866 struct mgmt_ev_device_connected *ev = (void *) buf; 6867 u16 eir_len = 0; 6868 6869 bacpy(&ev->addr.bdaddr, &conn->dst); 6870 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 6871 6872 ev->flags = __cpu_to_le32(flags); 6873 6874 /* We must ensure that the EIR Data fields are ordered and 6875 * unique. Keep it simple for now and avoid the problem by not 6876 * adding any BR/EDR data to the LE adv. 6877 */ 6878 if (conn->le_adv_data_len > 0) { 6879 memcpy(&ev->eir[eir_len], 6880 conn->le_adv_data, conn->le_adv_data_len); 6881 eir_len = conn->le_adv_data_len; 6882 } else { 6883 if (name_len > 0) 6884 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 6885 name, name_len); 6886 6887 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) 6888 eir_len = eir_append_data(ev->eir, eir_len, 6889 EIR_CLASS_OF_DEV, 6890 conn->dev_class, 3); 6891 } 6892 6893 ev->eir_len = cpu_to_le16(eir_len); 6894 6895 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 6896 sizeof(*ev) + eir_len, NULL); 6897 } 6898 6899 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 6900 { 6901 struct sock **sk = data; 6902 6903 cmd->cmd_complete(cmd, 0); 6904 6905 *sk = cmd->sk; 6906 sock_hold(*sk); 6907 6908 mgmt_pending_remove(cmd); 6909 } 6910 6911 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 6912 { 6913 struct hci_dev *hdev = data; 6914 struct mgmt_cp_unpair_device *cp = cmd->param; 6915 6916 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 6917 6918 cmd->cmd_complete(cmd, 0); 6919 mgmt_pending_remove(cmd); 6920 } 6921 6922 bool mgmt_powering_down(struct hci_dev *hdev) 6923 { 6924 struct mgmt_pending_cmd *cmd; 6925 struct mgmt_mode *cp; 6926 6927 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 6928 if (!cmd) 6929 return false; 6930 6931 cp = cmd->param; 6932 if (!cp->val) 6933 return true; 6934 6935 return false; 6936 } 6937 6938 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 6939 u8 link_type, u8 addr_type, u8 reason, 6940 bool mgmt_connected) 6941 { 6942 struct mgmt_ev_device_disconnected ev; 6943 struct sock *sk = NULL; 6944 6945 /* The connection is still in hci_conn_hash so test for 1 6946 * instead of 0 to know if this is the last one. 6947 */ 6948 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 6949 cancel_delayed_work(&hdev->power_off); 6950 queue_work(hdev->req_workqueue, &hdev->power_off.work); 6951 } 6952 6953 if (!mgmt_connected) 6954 return; 6955 6956 if (link_type != ACL_LINK && link_type != LE_LINK) 6957 return; 6958 6959 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 6960 6961 bacpy(&ev.addr.bdaddr, bdaddr); 6962 ev.addr.type = link_to_bdaddr(link_type, addr_type); 6963 ev.reason = reason; 6964 6965 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 6966 6967 if (sk) 6968 sock_put(sk); 6969 6970 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 6971 hdev); 6972 } 6973 6974 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 6975 u8 link_type, u8 addr_type, u8 status) 6976 { 6977 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 6978 struct mgmt_cp_disconnect *cp; 6979 struct mgmt_pending_cmd *cmd; 6980 6981 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 6982 hdev); 6983 6984 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 6985 if (!cmd) 6986 return; 6987 6988 cp = cmd->param; 6989 6990 if (bacmp(bdaddr, &cp->addr.bdaddr)) 6991 return; 6992 6993 if (cp->addr.type != bdaddr_type) 6994 return; 6995 6996 cmd->cmd_complete(cmd, mgmt_status(status)); 6997 mgmt_pending_remove(cmd); 6998 } 6999 7000 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 7001 u8 addr_type, u8 status) 7002 { 7003 struct mgmt_ev_connect_failed ev; 7004 7005 /* The connection is still in hci_conn_hash so test for 1 7006 * instead of 0 to know if this is the last one. 7007 */ 7008 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 7009 cancel_delayed_work(&hdev->power_off); 7010 queue_work(hdev->req_workqueue, &hdev->power_off.work); 7011 } 7012 7013 bacpy(&ev.addr.bdaddr, bdaddr); 7014 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7015 ev.status = mgmt_status(status); 7016 7017 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 7018 } 7019 7020 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 7021 { 7022 struct mgmt_ev_pin_code_request ev; 7023 7024 bacpy(&ev.addr.bdaddr, bdaddr); 7025 ev.addr.type = BDADDR_BREDR; 7026 ev.secure = secure; 7027 7028 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 7029 } 7030 7031 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7032 u8 status) 7033 { 7034 struct mgmt_pending_cmd *cmd; 7035 7036 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 7037 if (!cmd) 7038 return; 7039 7040 cmd->cmd_complete(cmd, mgmt_status(status)); 7041 mgmt_pending_remove(cmd); 7042 } 7043 7044 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7045 u8 status) 7046 { 7047 struct mgmt_pending_cmd *cmd; 7048 7049 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 7050 if (!cmd) 7051 return; 7052 7053 cmd->cmd_complete(cmd, mgmt_status(status)); 7054 mgmt_pending_remove(cmd); 7055 } 7056 7057 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 7058 u8 link_type, u8 addr_type, u32 value, 7059 u8 confirm_hint) 7060 { 7061 struct mgmt_ev_user_confirm_request ev; 7062 7063 BT_DBG("%s", hdev->name); 7064 7065 bacpy(&ev.addr.bdaddr, bdaddr); 7066 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7067 ev.confirm_hint = confirm_hint; 7068 ev.value = cpu_to_le32(value); 7069 7070 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 7071 NULL); 7072 } 7073 7074 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 7075 u8 link_type, u8 addr_type) 7076 { 7077 struct mgmt_ev_user_passkey_request ev; 7078 7079 BT_DBG("%s", hdev->name); 7080 7081 bacpy(&ev.addr.bdaddr, bdaddr); 7082 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7083 7084 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 7085 NULL); 7086 } 7087 7088 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7089 u8 link_type, u8 addr_type, u8 status, 7090 u8 opcode) 7091 { 7092 struct mgmt_pending_cmd *cmd; 7093 7094 cmd = pending_find(opcode, hdev); 7095 if (!cmd) 7096 return -ENOENT; 7097 7098 cmd->cmd_complete(cmd, mgmt_status(status)); 7099 mgmt_pending_remove(cmd); 7100 7101 return 0; 7102 } 7103 7104 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7105 u8 link_type, u8 addr_type, u8 status) 7106 { 7107 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7108 status, MGMT_OP_USER_CONFIRM_REPLY); 7109 } 7110 7111 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7112 u8 link_type, u8 addr_type, u8 status) 7113 { 7114 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7115 status, 7116 MGMT_OP_USER_CONFIRM_NEG_REPLY); 7117 } 7118 7119 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7120 u8 link_type, u8 addr_type, u8 status) 7121 { 7122 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7123 status, MGMT_OP_USER_PASSKEY_REPLY); 7124 } 7125 7126 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7127 u8 link_type, u8 addr_type, u8 status) 7128 { 7129 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7130 status, 7131 MGMT_OP_USER_PASSKEY_NEG_REPLY); 7132 } 7133 7134 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 7135 u8 link_type, u8 addr_type, u32 passkey, 7136 u8 entered) 7137 { 7138 struct mgmt_ev_passkey_notify ev; 7139 7140 BT_DBG("%s", hdev->name); 7141 7142 bacpy(&ev.addr.bdaddr, bdaddr); 7143 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7144 ev.passkey = __cpu_to_le32(passkey); 7145 ev.entered = entered; 7146 7147 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 7148 } 7149 7150 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 7151 { 7152 struct mgmt_ev_auth_failed ev; 7153 struct mgmt_pending_cmd *cmd; 7154 u8 status = mgmt_status(hci_status); 7155 7156 bacpy(&ev.addr.bdaddr, &conn->dst); 7157 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 7158 ev.status = status; 7159 7160 cmd = find_pairing(conn); 7161 7162 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 7163 cmd ? cmd->sk : NULL); 7164 7165 if (cmd) { 7166 cmd->cmd_complete(cmd, status); 7167 mgmt_pending_remove(cmd); 7168 } 7169 } 7170 7171 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 7172 { 7173 struct cmd_lookup match = { NULL, hdev }; 7174 bool changed; 7175 7176 if (status) { 7177 u8 mgmt_err = mgmt_status(status); 7178 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 7179 cmd_status_rsp, &mgmt_err); 7180 return; 7181 } 7182 7183 if (test_bit(HCI_AUTH, &hdev->flags)) 7184 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 7185 else 7186 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 7187 7188 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 7189 &match); 7190 7191 if (changed) 7192 new_settings(hdev, match.sk); 7193 7194 if (match.sk) 7195 sock_put(match.sk); 7196 } 7197 7198 static void clear_eir(struct hci_request *req) 7199 { 7200 struct hci_dev *hdev = req->hdev; 7201 struct hci_cp_write_eir cp; 7202 7203 if (!lmp_ext_inq_capable(hdev)) 7204 return; 7205 7206 memset(hdev->eir, 0, sizeof(hdev->eir)); 7207 7208 memset(&cp, 0, sizeof(cp)); 7209 7210 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 7211 } 7212 7213 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 7214 { 7215 struct cmd_lookup match = { NULL, hdev }; 7216 struct hci_request req; 7217 bool changed = false; 7218 7219 if (status) { 7220 u8 mgmt_err = mgmt_status(status); 7221 7222 if (enable && hci_dev_test_and_clear_flag(hdev, 7223 HCI_SSP_ENABLED)) { 7224 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 7225 new_settings(hdev, NULL); 7226 } 7227 7228 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 7229 &mgmt_err); 7230 return; 7231 } 7232 7233 if (enable) { 7234 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 7235 } else { 7236 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 7237 if (!changed) 7238 changed = hci_dev_test_and_clear_flag(hdev, 7239 HCI_HS_ENABLED); 7240 else 7241 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 7242 } 7243 7244 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 7245 7246 if (changed) 7247 new_settings(hdev, match.sk); 7248 7249 if (match.sk) 7250 sock_put(match.sk); 7251 7252 hci_req_init(&req, hdev); 7253 7254 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7255 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 7256 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE, 7257 sizeof(enable), &enable); 7258 __hci_req_update_eir(&req); 7259 } else { 7260 clear_eir(&req); 7261 } 7262 7263 hci_req_run(&req, NULL); 7264 } 7265 7266 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 7267 { 7268 struct cmd_lookup *match = data; 7269 7270 if (match->sk == NULL) { 7271 match->sk = cmd->sk; 7272 sock_hold(match->sk); 7273 } 7274 } 7275 7276 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 7277 u8 status) 7278 { 7279 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 7280 7281 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 7282 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 7283 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 7284 7285 if (!status) { 7286 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 7287 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 7288 ext_info_changed(hdev, NULL); 7289 } 7290 7291 if (match.sk) 7292 sock_put(match.sk); 7293 } 7294 7295 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 7296 { 7297 struct mgmt_cp_set_local_name ev; 7298 struct mgmt_pending_cmd *cmd; 7299 7300 if (status) 7301 return; 7302 7303 memset(&ev, 0, sizeof(ev)); 7304 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 7305 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 7306 7307 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 7308 if (!cmd) { 7309 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 7310 7311 /* If this is a HCI command related to powering on the 7312 * HCI dev don't send any mgmt signals. 7313 */ 7314 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 7315 return; 7316 } 7317 7318 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 7319 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 7320 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 7321 } 7322 7323 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 7324 { 7325 int i; 7326 7327 for (i = 0; i < uuid_count; i++) { 7328 if (!memcmp(uuid, uuids[i], 16)) 7329 return true; 7330 } 7331 7332 return false; 7333 } 7334 7335 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 7336 { 7337 u16 parsed = 0; 7338 7339 while (parsed < eir_len) { 7340 u8 field_len = eir[0]; 7341 u8 uuid[16]; 7342 int i; 7343 7344 if (field_len == 0) 7345 break; 7346 7347 if (eir_len - parsed < field_len + 1) 7348 break; 7349 7350 switch (eir[1]) { 7351 case EIR_UUID16_ALL: 7352 case EIR_UUID16_SOME: 7353 for (i = 0; i + 3 <= field_len; i += 2) { 7354 memcpy(uuid, bluetooth_base_uuid, 16); 7355 uuid[13] = eir[i + 3]; 7356 uuid[12] = eir[i + 2]; 7357 if (has_uuid(uuid, uuid_count, uuids)) 7358 return true; 7359 } 7360 break; 7361 case EIR_UUID32_ALL: 7362 case EIR_UUID32_SOME: 7363 for (i = 0; i + 5 <= field_len; i += 4) { 7364 memcpy(uuid, bluetooth_base_uuid, 16); 7365 uuid[15] = eir[i + 5]; 7366 uuid[14] = eir[i + 4]; 7367 uuid[13] = eir[i + 3]; 7368 uuid[12] = eir[i + 2]; 7369 if (has_uuid(uuid, uuid_count, uuids)) 7370 return true; 7371 } 7372 break; 7373 case EIR_UUID128_ALL: 7374 case EIR_UUID128_SOME: 7375 for (i = 0; i + 17 <= field_len; i += 16) { 7376 memcpy(uuid, eir + i + 2, 16); 7377 if (has_uuid(uuid, uuid_count, uuids)) 7378 return true; 7379 } 7380 break; 7381 } 7382 7383 parsed += field_len + 1; 7384 eir += field_len + 1; 7385 } 7386 7387 return false; 7388 } 7389 7390 static void restart_le_scan(struct hci_dev *hdev) 7391 { 7392 /* If controller is not scanning we are done. */ 7393 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 7394 return; 7395 7396 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 7397 hdev->discovery.scan_start + 7398 hdev->discovery.scan_duration)) 7399 return; 7400 7401 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 7402 DISCOV_LE_RESTART_DELAY); 7403 } 7404 7405 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 7406 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 7407 { 7408 /* If a RSSI threshold has been specified, and 7409 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 7410 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 7411 * is set, let it through for further processing, as we might need to 7412 * restart the scan. 7413 * 7414 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 7415 * the results are also dropped. 7416 */ 7417 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 7418 (rssi == HCI_RSSI_INVALID || 7419 (rssi < hdev->discovery.rssi && 7420 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 7421 return false; 7422 7423 if (hdev->discovery.uuid_count != 0) { 7424 /* If a list of UUIDs is provided in filter, results with no 7425 * matching UUID should be dropped. 7426 */ 7427 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 7428 hdev->discovery.uuids) && 7429 !eir_has_uuids(scan_rsp, scan_rsp_len, 7430 hdev->discovery.uuid_count, 7431 hdev->discovery.uuids)) 7432 return false; 7433 } 7434 7435 /* If duplicate filtering does not report RSSI changes, then restart 7436 * scanning to ensure updated result with updated RSSI values. 7437 */ 7438 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 7439 restart_le_scan(hdev); 7440 7441 /* Validate RSSI value against the RSSI threshold once more. */ 7442 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 7443 rssi < hdev->discovery.rssi) 7444 return false; 7445 } 7446 7447 return true; 7448 } 7449 7450 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 7451 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 7452 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 7453 { 7454 char buf[512]; 7455 struct mgmt_ev_device_found *ev = (void *)buf; 7456 size_t ev_size; 7457 7458 /* Don't send events for a non-kernel initiated discovery. With 7459 * LE one exception is if we have pend_le_reports > 0 in which 7460 * case we're doing passive scanning and want these events. 7461 */ 7462 if (!hci_discovery_active(hdev)) { 7463 if (link_type == ACL_LINK) 7464 return; 7465 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports)) 7466 return; 7467 } 7468 7469 if (hdev->discovery.result_filtering) { 7470 /* We are using service discovery */ 7471 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 7472 scan_rsp_len)) 7473 return; 7474 } 7475 7476 if (hdev->discovery.limited) { 7477 /* Check for limited discoverable bit */ 7478 if (dev_class) { 7479 if (!(dev_class[1] & 0x20)) 7480 return; 7481 } else { 7482 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 7483 if (!flags || !(flags[0] & LE_AD_LIMITED)) 7484 return; 7485 } 7486 } 7487 7488 /* Make sure that the buffer is big enough. The 5 extra bytes 7489 * are for the potential CoD field. 7490 */ 7491 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf)) 7492 return; 7493 7494 memset(buf, 0, sizeof(buf)); 7495 7496 /* In case of device discovery with BR/EDR devices (pre 1.2), the 7497 * RSSI value was reported as 0 when not available. This behavior 7498 * is kept when using device discovery. This is required for full 7499 * backwards compatibility with the API. 7500 * 7501 * However when using service discovery, the value 127 will be 7502 * returned when the RSSI is not available. 7503 */ 7504 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 7505 link_type == ACL_LINK) 7506 rssi = 0; 7507 7508 bacpy(&ev->addr.bdaddr, bdaddr); 7509 ev->addr.type = link_to_bdaddr(link_type, addr_type); 7510 ev->rssi = rssi; 7511 ev->flags = cpu_to_le32(flags); 7512 7513 if (eir_len > 0) 7514 /* Copy EIR or advertising data into event */ 7515 memcpy(ev->eir, eir, eir_len); 7516 7517 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 7518 NULL)) 7519 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 7520 dev_class, 3); 7521 7522 if (scan_rsp_len > 0) 7523 /* Append scan response data to event */ 7524 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len); 7525 7526 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 7527 ev_size = sizeof(*ev) + eir_len + scan_rsp_len; 7528 7529 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 7530 } 7531 7532 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 7533 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 7534 { 7535 struct mgmt_ev_device_found *ev; 7536 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 7537 u16 eir_len; 7538 7539 ev = (struct mgmt_ev_device_found *) buf; 7540 7541 memset(buf, 0, sizeof(buf)); 7542 7543 bacpy(&ev->addr.bdaddr, bdaddr); 7544 ev->addr.type = link_to_bdaddr(link_type, addr_type); 7545 ev->rssi = rssi; 7546 7547 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 7548 name_len); 7549 7550 ev->eir_len = cpu_to_le16(eir_len); 7551 7552 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 7553 } 7554 7555 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 7556 { 7557 struct mgmt_ev_discovering ev; 7558 7559 BT_DBG("%s discovering %u", hdev->name, discovering); 7560 7561 memset(&ev, 0, sizeof(ev)); 7562 ev.type = hdev->discovery.type; 7563 ev.discovering = discovering; 7564 7565 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 7566 } 7567 7568 static struct hci_mgmt_chan chan = { 7569 .channel = HCI_CHANNEL_CONTROL, 7570 .handler_count = ARRAY_SIZE(mgmt_handlers), 7571 .handlers = mgmt_handlers, 7572 .hdev_init = mgmt_init_hdev, 7573 }; 7574 7575 int mgmt_init(void) 7576 { 7577 return hci_mgmt_chan_register(&chan); 7578 } 7579 7580 void mgmt_exit(void) 7581 { 7582 hci_mgmt_chan_unregister(&chan); 7583 } 7584