1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 14 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 }; 110 111 static const u16 mgmt_events[] = { 112 MGMT_EV_CONTROLLER_ERROR, 113 MGMT_EV_INDEX_ADDED, 114 MGMT_EV_INDEX_REMOVED, 115 MGMT_EV_NEW_SETTINGS, 116 MGMT_EV_CLASS_OF_DEV_CHANGED, 117 MGMT_EV_LOCAL_NAME_CHANGED, 118 MGMT_EV_NEW_LINK_KEY, 119 MGMT_EV_NEW_LONG_TERM_KEY, 120 MGMT_EV_DEVICE_CONNECTED, 121 MGMT_EV_DEVICE_DISCONNECTED, 122 MGMT_EV_CONNECT_FAILED, 123 MGMT_EV_PIN_CODE_REQUEST, 124 MGMT_EV_USER_CONFIRM_REQUEST, 125 MGMT_EV_USER_PASSKEY_REQUEST, 126 MGMT_EV_AUTH_FAILED, 127 MGMT_EV_DEVICE_FOUND, 128 MGMT_EV_DISCOVERING, 129 MGMT_EV_DEVICE_BLOCKED, 130 MGMT_EV_DEVICE_UNBLOCKED, 131 MGMT_EV_DEVICE_UNPAIRED, 132 MGMT_EV_PASSKEY_NOTIFY, 133 MGMT_EV_NEW_IRK, 134 MGMT_EV_NEW_CSRK, 135 MGMT_EV_DEVICE_ADDED, 136 MGMT_EV_DEVICE_REMOVED, 137 MGMT_EV_NEW_CONN_PARAM, 138 MGMT_EV_UNCONF_INDEX_ADDED, 139 MGMT_EV_UNCONF_INDEX_REMOVED, 140 MGMT_EV_NEW_CONFIG_OPTIONS, 141 MGMT_EV_EXT_INDEX_ADDED, 142 MGMT_EV_EXT_INDEX_REMOVED, 143 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 144 MGMT_EV_ADVERTISING_ADDED, 145 MGMT_EV_ADVERTISING_REMOVED, 146 MGMT_EV_EXT_INFO_CHANGED, 147 }; 148 149 static const u16 mgmt_untrusted_commands[] = { 150 MGMT_OP_READ_INDEX_LIST, 151 MGMT_OP_READ_INFO, 152 MGMT_OP_READ_UNCONF_INDEX_LIST, 153 MGMT_OP_READ_CONFIG_INFO, 154 MGMT_OP_READ_EXT_INDEX_LIST, 155 MGMT_OP_READ_EXT_INFO, 156 }; 157 158 static const u16 mgmt_untrusted_events[] = { 159 MGMT_EV_INDEX_ADDED, 160 MGMT_EV_INDEX_REMOVED, 161 MGMT_EV_NEW_SETTINGS, 162 MGMT_EV_CLASS_OF_DEV_CHANGED, 163 MGMT_EV_LOCAL_NAME_CHANGED, 164 MGMT_EV_UNCONF_INDEX_ADDED, 165 MGMT_EV_UNCONF_INDEX_REMOVED, 166 MGMT_EV_NEW_CONFIG_OPTIONS, 167 MGMT_EV_EXT_INDEX_ADDED, 168 MGMT_EV_EXT_INDEX_REMOVED, 169 MGMT_EV_EXT_INFO_CHANGED, 170 }; 171 172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 173 174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 175 "\x00\x00\x00\x00\x00\x00\x00\x00" 176 177 /* HCI to MGMT error code conversion table */ 178 static u8 mgmt_status_table[] = { 179 MGMT_STATUS_SUCCESS, 180 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 181 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 182 MGMT_STATUS_FAILED, /* Hardware Failure */ 183 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 184 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 185 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 186 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 187 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 188 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 189 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 190 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 191 MGMT_STATUS_BUSY, /* Command Disallowed */ 192 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 193 MGMT_STATUS_REJECTED, /* Rejected Security */ 194 MGMT_STATUS_REJECTED, /* Rejected Personal */ 195 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 196 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 197 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 198 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 199 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 200 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 201 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 202 MGMT_STATUS_BUSY, /* Repeated Attempts */ 203 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 204 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 205 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 206 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 207 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 208 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 209 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 210 MGMT_STATUS_FAILED, /* Unspecified Error */ 211 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 212 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 213 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 214 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 215 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 216 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 217 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 218 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 219 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 220 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 221 MGMT_STATUS_FAILED, /* Transaction Collision */ 222 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 223 MGMT_STATUS_REJECTED, /* QoS Rejected */ 224 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 225 MGMT_STATUS_REJECTED, /* Insufficient Security */ 226 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 227 MGMT_STATUS_BUSY, /* Role Switch Pending */ 228 MGMT_STATUS_FAILED, /* Slot Violation */ 229 MGMT_STATUS_FAILED, /* Role Switch Failed */ 230 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 231 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 232 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 233 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 234 MGMT_STATUS_BUSY, /* Controller Busy */ 235 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 236 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 237 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 238 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 239 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 240 }; 241 242 static u8 mgmt_status(u8 hci_status) 243 { 244 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 245 return mgmt_status_table[hci_status]; 246 247 return MGMT_STATUS_FAILED; 248 } 249 250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 251 u16 len, int flag) 252 { 253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 254 flag, NULL); 255 } 256 257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 258 u16 len, int flag, struct sock *skip_sk) 259 { 260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 261 flag, skip_sk); 262 } 263 264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 265 struct sock *skip_sk) 266 { 267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 268 HCI_SOCK_TRUSTED, skip_sk); 269 } 270 271 static u8 le_addr_type(u8 mgmt_addr_type) 272 { 273 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 274 return ADDR_LE_DEV_PUBLIC; 275 else 276 return ADDR_LE_DEV_RANDOM; 277 } 278 279 void mgmt_fill_version_info(void *ver) 280 { 281 struct mgmt_rp_read_version *rp = ver; 282 283 rp->version = MGMT_VERSION; 284 rp->revision = cpu_to_le16(MGMT_REVISION); 285 } 286 287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 288 u16 data_len) 289 { 290 struct mgmt_rp_read_version rp; 291 292 BT_DBG("sock %p", sk); 293 294 mgmt_fill_version_info(&rp); 295 296 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 297 &rp, sizeof(rp)); 298 } 299 300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 301 u16 data_len) 302 { 303 struct mgmt_rp_read_commands *rp; 304 u16 num_commands, num_events; 305 size_t rp_size; 306 int i, err; 307 308 BT_DBG("sock %p", sk); 309 310 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 311 num_commands = ARRAY_SIZE(mgmt_commands); 312 num_events = ARRAY_SIZE(mgmt_events); 313 } else { 314 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 315 num_events = ARRAY_SIZE(mgmt_untrusted_events); 316 } 317 318 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 319 320 rp = kmalloc(rp_size, GFP_KERNEL); 321 if (!rp) 322 return -ENOMEM; 323 324 rp->num_commands = cpu_to_le16(num_commands); 325 rp->num_events = cpu_to_le16(num_events); 326 327 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 328 __le16 *opcode = rp->opcodes; 329 330 for (i = 0; i < num_commands; i++, opcode++) 331 put_unaligned_le16(mgmt_commands[i], opcode); 332 333 for (i = 0; i < num_events; i++, opcode++) 334 put_unaligned_le16(mgmt_events[i], opcode); 335 } else { 336 __le16 *opcode = rp->opcodes; 337 338 for (i = 0; i < num_commands; i++, opcode++) 339 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 340 341 for (i = 0; i < num_events; i++, opcode++) 342 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 343 } 344 345 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 346 rp, rp_size); 347 kfree(rp); 348 349 return err; 350 } 351 352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 353 u16 data_len) 354 { 355 struct mgmt_rp_read_index_list *rp; 356 struct hci_dev *d; 357 size_t rp_len; 358 u16 count; 359 int err; 360 361 BT_DBG("sock %p", sk); 362 363 read_lock(&hci_dev_list_lock); 364 365 count = 0; 366 list_for_each_entry(d, &hci_dev_list, list) { 367 if (d->dev_type == HCI_PRIMARY && 368 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 369 count++; 370 } 371 372 rp_len = sizeof(*rp) + (2 * count); 373 rp = kmalloc(rp_len, GFP_ATOMIC); 374 if (!rp) { 375 read_unlock(&hci_dev_list_lock); 376 return -ENOMEM; 377 } 378 379 count = 0; 380 list_for_each_entry(d, &hci_dev_list, list) { 381 if (hci_dev_test_flag(d, HCI_SETUP) || 382 hci_dev_test_flag(d, HCI_CONFIG) || 383 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 384 continue; 385 386 /* Devices marked as raw-only are neither configured 387 * nor unconfigured controllers. 388 */ 389 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 390 continue; 391 392 if (d->dev_type == HCI_PRIMARY && 393 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 394 rp->index[count++] = cpu_to_le16(d->id); 395 BT_DBG("Added hci%u", d->id); 396 } 397 } 398 399 rp->num_controllers = cpu_to_le16(count); 400 rp_len = sizeof(*rp) + (2 * count); 401 402 read_unlock(&hci_dev_list_lock); 403 404 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 405 0, rp, rp_len); 406 407 kfree(rp); 408 409 return err; 410 } 411 412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 413 void *data, u16 data_len) 414 { 415 struct mgmt_rp_read_unconf_index_list *rp; 416 struct hci_dev *d; 417 size_t rp_len; 418 u16 count; 419 int err; 420 421 BT_DBG("sock %p", sk); 422 423 read_lock(&hci_dev_list_lock); 424 425 count = 0; 426 list_for_each_entry(d, &hci_dev_list, list) { 427 if (d->dev_type == HCI_PRIMARY && 428 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 429 count++; 430 } 431 432 rp_len = sizeof(*rp) + (2 * count); 433 rp = kmalloc(rp_len, GFP_ATOMIC); 434 if (!rp) { 435 read_unlock(&hci_dev_list_lock); 436 return -ENOMEM; 437 } 438 439 count = 0; 440 list_for_each_entry(d, &hci_dev_list, list) { 441 if (hci_dev_test_flag(d, HCI_SETUP) || 442 hci_dev_test_flag(d, HCI_CONFIG) || 443 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 444 continue; 445 446 /* Devices marked as raw-only are neither configured 447 * nor unconfigured controllers. 448 */ 449 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 450 continue; 451 452 if (d->dev_type == HCI_PRIMARY && 453 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 454 rp->index[count++] = cpu_to_le16(d->id); 455 BT_DBG("Added hci%u", d->id); 456 } 457 } 458 459 rp->num_controllers = cpu_to_le16(count); 460 rp_len = sizeof(*rp) + (2 * count); 461 462 read_unlock(&hci_dev_list_lock); 463 464 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 465 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 466 467 kfree(rp); 468 469 return err; 470 } 471 472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 473 void *data, u16 data_len) 474 { 475 struct mgmt_rp_read_ext_index_list *rp; 476 struct hci_dev *d; 477 size_t rp_len; 478 u16 count; 479 int err; 480 481 BT_DBG("sock %p", sk); 482 483 read_lock(&hci_dev_list_lock); 484 485 count = 0; 486 list_for_each_entry(d, &hci_dev_list, list) { 487 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 488 count++; 489 } 490 491 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count); 492 rp = kmalloc(rp_len, GFP_ATOMIC); 493 if (!rp) { 494 read_unlock(&hci_dev_list_lock); 495 return -ENOMEM; 496 } 497 498 count = 0; 499 list_for_each_entry(d, &hci_dev_list, list) { 500 if (hci_dev_test_flag(d, HCI_SETUP) || 501 hci_dev_test_flag(d, HCI_CONFIG) || 502 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 503 continue; 504 505 /* Devices marked as raw-only are neither configured 506 * nor unconfigured controllers. 507 */ 508 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 509 continue; 510 511 if (d->dev_type == HCI_PRIMARY) { 512 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 513 rp->entry[count].type = 0x01; 514 else 515 rp->entry[count].type = 0x00; 516 } else if (d->dev_type == HCI_AMP) { 517 rp->entry[count].type = 0x02; 518 } else { 519 continue; 520 } 521 522 rp->entry[count].bus = d->bus; 523 rp->entry[count++].index = cpu_to_le16(d->id); 524 BT_DBG("Added hci%u", d->id); 525 } 526 527 rp->num_controllers = cpu_to_le16(count); 528 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count); 529 530 read_unlock(&hci_dev_list_lock); 531 532 /* If this command is called at least once, then all the 533 * default index and unconfigured index events are disabled 534 * and from now on only extended index events are used. 535 */ 536 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 537 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 538 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 539 540 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 541 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len); 542 543 kfree(rp); 544 545 return err; 546 } 547 548 static bool is_configured(struct hci_dev *hdev) 549 { 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 552 return false; 553 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) && 555 !bacmp(&hdev->public_addr, BDADDR_ANY)) 556 return false; 557 558 return true; 559 } 560 561 static __le32 get_missing_options(struct hci_dev *hdev) 562 { 563 u32 options = 0; 564 565 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 566 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 567 options |= MGMT_OPTION_EXTERNAL_CONFIG; 568 569 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) && 570 !bacmp(&hdev->public_addr, BDADDR_ANY)) 571 options |= MGMT_OPTION_PUBLIC_ADDRESS; 572 573 return cpu_to_le32(options); 574 } 575 576 static int new_options(struct hci_dev *hdev, struct sock *skip) 577 { 578 __le32 options = get_missing_options(hdev); 579 580 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 581 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 582 } 583 584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 585 { 586 __le32 options = get_missing_options(hdev); 587 588 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 589 sizeof(options)); 590 } 591 592 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 593 void *data, u16 data_len) 594 { 595 struct mgmt_rp_read_config_info rp; 596 u32 options = 0; 597 598 BT_DBG("sock %p %s", sk, hdev->name); 599 600 hci_dev_lock(hdev); 601 602 memset(&rp, 0, sizeof(rp)); 603 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 604 605 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 606 options |= MGMT_OPTION_EXTERNAL_CONFIG; 607 608 if (hdev->set_bdaddr) 609 options |= MGMT_OPTION_PUBLIC_ADDRESS; 610 611 rp.supported_options = cpu_to_le32(options); 612 rp.missing_options = get_missing_options(hdev); 613 614 hci_dev_unlock(hdev); 615 616 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 617 &rp, sizeof(rp)); 618 } 619 620 static u32 get_supported_phys(struct hci_dev *hdev) 621 { 622 u32 supported_phys = 0; 623 624 if (lmp_bredr_capable(hdev)) { 625 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 626 627 if (hdev->features[0][0] & LMP_3SLOT) 628 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 629 630 if (hdev->features[0][0] & LMP_5SLOT) 631 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 632 633 if (lmp_edr_2m_capable(hdev)) { 634 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 635 636 if (lmp_edr_3slot_capable(hdev)) 637 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 638 639 if (lmp_edr_5slot_capable(hdev)) 640 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 641 642 if (lmp_edr_3m_capable(hdev)) { 643 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 644 645 if (lmp_edr_3slot_capable(hdev)) 646 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 647 648 if (lmp_edr_5slot_capable(hdev)) 649 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 650 } 651 } 652 } 653 654 if (lmp_le_capable(hdev)) { 655 supported_phys |= MGMT_PHY_LE_1M_TX; 656 supported_phys |= MGMT_PHY_LE_1M_RX; 657 658 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 659 supported_phys |= MGMT_PHY_LE_2M_TX; 660 supported_phys |= MGMT_PHY_LE_2M_RX; 661 } 662 663 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 664 supported_phys |= MGMT_PHY_LE_CODED_TX; 665 supported_phys |= MGMT_PHY_LE_CODED_RX; 666 } 667 } 668 669 return supported_phys; 670 } 671 672 static u32 get_selected_phys(struct hci_dev *hdev) 673 { 674 u32 selected_phys = 0; 675 676 if (lmp_bredr_capable(hdev)) { 677 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 678 679 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 680 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 681 682 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 683 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 684 685 if (lmp_edr_2m_capable(hdev)) { 686 if (!(hdev->pkt_type & HCI_2DH1)) 687 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 688 689 if (lmp_edr_3slot_capable(hdev) && 690 !(hdev->pkt_type & HCI_2DH3)) 691 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 692 693 if (lmp_edr_5slot_capable(hdev) && 694 !(hdev->pkt_type & HCI_2DH5)) 695 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 696 697 if (lmp_edr_3m_capable(hdev)) { 698 if (!(hdev->pkt_type & HCI_3DH1)) 699 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 700 701 if (lmp_edr_3slot_capable(hdev) && 702 !(hdev->pkt_type & HCI_3DH3)) 703 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 704 705 if (lmp_edr_5slot_capable(hdev) && 706 !(hdev->pkt_type & HCI_3DH5)) 707 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 708 } 709 } 710 } 711 712 if (lmp_le_capable(hdev)) { 713 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 714 selected_phys |= MGMT_PHY_LE_1M_TX; 715 716 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 717 selected_phys |= MGMT_PHY_LE_1M_RX; 718 719 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 720 selected_phys |= MGMT_PHY_LE_2M_TX; 721 722 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 723 selected_phys |= MGMT_PHY_LE_2M_RX; 724 725 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 726 selected_phys |= MGMT_PHY_LE_CODED_TX; 727 728 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 729 selected_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 732 return selected_phys; 733 } 734 735 static u32 get_configurable_phys(struct hci_dev *hdev) 736 { 737 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 738 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 739 } 740 741 static u32 get_supported_settings(struct hci_dev *hdev) 742 { 743 u32 settings = 0; 744 745 settings |= MGMT_SETTING_POWERED; 746 settings |= MGMT_SETTING_BONDABLE; 747 settings |= MGMT_SETTING_DEBUG_KEYS; 748 settings |= MGMT_SETTING_CONNECTABLE; 749 settings |= MGMT_SETTING_DISCOVERABLE; 750 751 if (lmp_bredr_capable(hdev)) { 752 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 753 settings |= MGMT_SETTING_FAST_CONNECTABLE; 754 settings |= MGMT_SETTING_BREDR; 755 settings |= MGMT_SETTING_LINK_SECURITY; 756 757 if (lmp_ssp_capable(hdev)) { 758 settings |= MGMT_SETTING_SSP; 759 settings |= MGMT_SETTING_HS; 760 } 761 762 if (lmp_sc_capable(hdev)) 763 settings |= MGMT_SETTING_SECURE_CONN; 764 } 765 766 if (lmp_le_capable(hdev)) { 767 settings |= MGMT_SETTING_LE; 768 settings |= MGMT_SETTING_ADVERTISING; 769 settings |= MGMT_SETTING_SECURE_CONN; 770 settings |= MGMT_SETTING_PRIVACY; 771 settings |= MGMT_SETTING_STATIC_ADDRESS; 772 } 773 774 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 775 hdev->set_bdaddr) 776 settings |= MGMT_SETTING_CONFIGURATION; 777 778 settings |= MGMT_SETTING_PHY_CONFIGURATION; 779 780 return settings; 781 } 782 783 static u32 get_current_settings(struct hci_dev *hdev) 784 { 785 u32 settings = 0; 786 787 if (hdev_is_powered(hdev)) 788 settings |= MGMT_SETTING_POWERED; 789 790 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 791 settings |= MGMT_SETTING_CONNECTABLE; 792 793 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 794 settings |= MGMT_SETTING_FAST_CONNECTABLE; 795 796 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 797 settings |= MGMT_SETTING_DISCOVERABLE; 798 799 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 800 settings |= MGMT_SETTING_BONDABLE; 801 802 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 803 settings |= MGMT_SETTING_BREDR; 804 805 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 806 settings |= MGMT_SETTING_LE; 807 808 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 809 settings |= MGMT_SETTING_LINK_SECURITY; 810 811 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 812 settings |= MGMT_SETTING_SSP; 813 814 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 815 settings |= MGMT_SETTING_HS; 816 817 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 818 settings |= MGMT_SETTING_ADVERTISING; 819 820 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 821 settings |= MGMT_SETTING_SECURE_CONN; 822 823 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 824 settings |= MGMT_SETTING_DEBUG_KEYS; 825 826 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 827 settings |= MGMT_SETTING_PRIVACY; 828 829 /* The current setting for static address has two purposes. The 830 * first is to indicate if the static address will be used and 831 * the second is to indicate if it is actually set. 832 * 833 * This means if the static address is not configured, this flag 834 * will never be set. If the address is configured, then if the 835 * address is actually used decides if the flag is set or not. 836 * 837 * For single mode LE only controllers and dual-mode controllers 838 * with BR/EDR disabled, the existence of the static address will 839 * be evaluated. 840 */ 841 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 842 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 843 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 844 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 845 settings |= MGMT_SETTING_STATIC_ADDRESS; 846 } 847 848 return settings; 849 } 850 851 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 852 { 853 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 854 } 855 856 static struct mgmt_pending_cmd *pending_find_data(u16 opcode, 857 struct hci_dev *hdev, 858 const void *data) 859 { 860 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data); 861 } 862 863 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 864 { 865 struct mgmt_pending_cmd *cmd; 866 867 /* If there's a pending mgmt command the flags will not yet have 868 * their final values, so check for this first. 869 */ 870 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 871 if (cmd) { 872 struct mgmt_mode *cp = cmd->param; 873 if (cp->val == 0x01) 874 return LE_AD_GENERAL; 875 else if (cp->val == 0x02) 876 return LE_AD_LIMITED; 877 } else { 878 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 879 return LE_AD_LIMITED; 880 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 881 return LE_AD_GENERAL; 882 } 883 884 return 0; 885 } 886 887 bool mgmt_get_connectable(struct hci_dev *hdev) 888 { 889 struct mgmt_pending_cmd *cmd; 890 891 /* If there's a pending mgmt command the flag will not yet have 892 * it's final value, so check for this first. 893 */ 894 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 895 if (cmd) { 896 struct mgmt_mode *cp = cmd->param; 897 898 return cp->val; 899 } 900 901 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 902 } 903 904 static void service_cache_off(struct work_struct *work) 905 { 906 struct hci_dev *hdev = container_of(work, struct hci_dev, 907 service_cache.work); 908 struct hci_request req; 909 910 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 911 return; 912 913 hci_req_init(&req, hdev); 914 915 hci_dev_lock(hdev); 916 917 __hci_req_update_eir(&req); 918 __hci_req_update_class(&req); 919 920 hci_dev_unlock(hdev); 921 922 hci_req_run(&req, NULL); 923 } 924 925 static void rpa_expired(struct work_struct *work) 926 { 927 struct hci_dev *hdev = container_of(work, struct hci_dev, 928 rpa_expired.work); 929 struct hci_request req; 930 931 BT_DBG(""); 932 933 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 934 935 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 936 return; 937 938 /* The generation of a new RPA and programming it into the 939 * controller happens in the hci_req_enable_advertising() 940 * function. 941 */ 942 hci_req_init(&req, hdev); 943 if (ext_adv_capable(hdev)) 944 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance); 945 else 946 __hci_req_enable_advertising(&req); 947 hci_req_run(&req, NULL); 948 } 949 950 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 951 { 952 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 953 return; 954 955 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 956 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 957 958 /* Non-mgmt controlled devices get this bit set 959 * implicitly so that pairing works for them, however 960 * for mgmt we require user-space to explicitly enable 961 * it 962 */ 963 hci_dev_clear_flag(hdev, HCI_BONDABLE); 964 } 965 966 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 967 void *data, u16 data_len) 968 { 969 struct mgmt_rp_read_info rp; 970 971 BT_DBG("sock %p %s", sk, hdev->name); 972 973 hci_dev_lock(hdev); 974 975 memset(&rp, 0, sizeof(rp)); 976 977 bacpy(&rp.bdaddr, &hdev->bdaddr); 978 979 rp.version = hdev->hci_ver; 980 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 981 982 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 983 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 984 985 memcpy(rp.dev_class, hdev->dev_class, 3); 986 987 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 988 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 989 990 hci_dev_unlock(hdev); 991 992 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 993 sizeof(rp)); 994 } 995 996 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 997 { 998 u16 eir_len = 0; 999 size_t name_len; 1000 1001 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1002 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1003 hdev->dev_class, 3); 1004 1005 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1006 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1007 hdev->appearance); 1008 1009 name_len = strlen(hdev->dev_name); 1010 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1011 hdev->dev_name, name_len); 1012 1013 name_len = strlen(hdev->short_name); 1014 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1015 hdev->short_name, name_len); 1016 1017 return eir_len; 1018 } 1019 1020 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1021 void *data, u16 data_len) 1022 { 1023 char buf[512]; 1024 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1025 u16 eir_len; 1026 1027 BT_DBG("sock %p %s", sk, hdev->name); 1028 1029 memset(&buf, 0, sizeof(buf)); 1030 1031 hci_dev_lock(hdev); 1032 1033 bacpy(&rp->bdaddr, &hdev->bdaddr); 1034 1035 rp->version = hdev->hci_ver; 1036 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1037 1038 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1039 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1040 1041 1042 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1043 rp->eir_len = cpu_to_le16(eir_len); 1044 1045 hci_dev_unlock(hdev); 1046 1047 /* If this command is called at least once, then the events 1048 * for class of device and local name changes are disabled 1049 * and only the new extended controller information event 1050 * is used. 1051 */ 1052 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1053 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1054 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1055 1056 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1057 sizeof(*rp) + eir_len); 1058 } 1059 1060 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1061 { 1062 char buf[512]; 1063 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1064 u16 eir_len; 1065 1066 memset(buf, 0, sizeof(buf)); 1067 1068 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1069 ev->eir_len = cpu_to_le16(eir_len); 1070 1071 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1072 sizeof(*ev) + eir_len, 1073 HCI_MGMT_EXT_INFO_EVENTS, skip); 1074 } 1075 1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1077 { 1078 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1079 1080 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1081 sizeof(settings)); 1082 } 1083 1084 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1085 { 1086 BT_DBG("%s status 0x%02x", hdev->name, status); 1087 1088 if (hci_conn_count(hdev) == 0) { 1089 cancel_delayed_work(&hdev->power_off); 1090 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1091 } 1092 } 1093 1094 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1095 { 1096 struct mgmt_ev_advertising_added ev; 1097 1098 ev.instance = instance; 1099 1100 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1101 } 1102 1103 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1104 u8 instance) 1105 { 1106 struct mgmt_ev_advertising_removed ev; 1107 1108 ev.instance = instance; 1109 1110 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1111 } 1112 1113 static void cancel_adv_timeout(struct hci_dev *hdev) 1114 { 1115 if (hdev->adv_instance_timeout) { 1116 hdev->adv_instance_timeout = 0; 1117 cancel_delayed_work(&hdev->adv_instance_expire); 1118 } 1119 } 1120 1121 static int clean_up_hci_state(struct hci_dev *hdev) 1122 { 1123 struct hci_request req; 1124 struct hci_conn *conn; 1125 bool discov_stopped; 1126 int err; 1127 1128 hci_req_init(&req, hdev); 1129 1130 if (test_bit(HCI_ISCAN, &hdev->flags) || 1131 test_bit(HCI_PSCAN, &hdev->flags)) { 1132 u8 scan = 0x00; 1133 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1134 } 1135 1136 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false); 1137 1138 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1139 __hci_req_disable_advertising(&req); 1140 1141 discov_stopped = hci_req_stop_discovery(&req); 1142 1143 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1144 /* 0x15 == Terminated due to Power Off */ 1145 __hci_abort_conn(&req, conn, 0x15); 1146 } 1147 1148 err = hci_req_run(&req, clean_up_hci_complete); 1149 if (!err && discov_stopped) 1150 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 1151 1152 return err; 1153 } 1154 1155 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1156 u16 len) 1157 { 1158 struct mgmt_mode *cp = data; 1159 struct mgmt_pending_cmd *cmd; 1160 int err; 1161 1162 BT_DBG("request for %s", hdev->name); 1163 1164 if (cp->val != 0x00 && cp->val != 0x01) 1165 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1166 MGMT_STATUS_INVALID_PARAMS); 1167 1168 hci_dev_lock(hdev); 1169 1170 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1171 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1172 MGMT_STATUS_BUSY); 1173 goto failed; 1174 } 1175 1176 if (!!cp->val == hdev_is_powered(hdev)) { 1177 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1178 goto failed; 1179 } 1180 1181 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1182 if (!cmd) { 1183 err = -ENOMEM; 1184 goto failed; 1185 } 1186 1187 if (cp->val) { 1188 queue_work(hdev->req_workqueue, &hdev->power_on); 1189 err = 0; 1190 } else { 1191 /* Disconnect connections, stop scans, etc */ 1192 err = clean_up_hci_state(hdev); 1193 if (!err) 1194 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1195 HCI_POWER_OFF_TIMEOUT); 1196 1197 /* ENODATA means there were no HCI commands queued */ 1198 if (err == -ENODATA) { 1199 cancel_delayed_work(&hdev->power_off); 1200 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1201 err = 0; 1202 } 1203 } 1204 1205 failed: 1206 hci_dev_unlock(hdev); 1207 return err; 1208 } 1209 1210 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1211 { 1212 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1213 1214 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1215 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1216 } 1217 1218 int mgmt_new_settings(struct hci_dev *hdev) 1219 { 1220 return new_settings(hdev, NULL); 1221 } 1222 1223 struct cmd_lookup { 1224 struct sock *sk; 1225 struct hci_dev *hdev; 1226 u8 mgmt_status; 1227 }; 1228 1229 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1230 { 1231 struct cmd_lookup *match = data; 1232 1233 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1234 1235 list_del(&cmd->list); 1236 1237 if (match->sk == NULL) { 1238 match->sk = cmd->sk; 1239 sock_hold(match->sk); 1240 } 1241 1242 mgmt_pending_free(cmd); 1243 } 1244 1245 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1246 { 1247 u8 *status = data; 1248 1249 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1250 mgmt_pending_remove(cmd); 1251 } 1252 1253 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1254 { 1255 if (cmd->cmd_complete) { 1256 u8 *status = data; 1257 1258 cmd->cmd_complete(cmd, *status); 1259 mgmt_pending_remove(cmd); 1260 1261 return; 1262 } 1263 1264 cmd_status_rsp(cmd, data); 1265 } 1266 1267 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1268 { 1269 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1270 cmd->param, cmd->param_len); 1271 } 1272 1273 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1274 { 1275 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1276 cmd->param, sizeof(struct mgmt_addr_info)); 1277 } 1278 1279 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1280 { 1281 if (!lmp_bredr_capable(hdev)) 1282 return MGMT_STATUS_NOT_SUPPORTED; 1283 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1284 return MGMT_STATUS_REJECTED; 1285 else 1286 return MGMT_STATUS_SUCCESS; 1287 } 1288 1289 static u8 mgmt_le_support(struct hci_dev *hdev) 1290 { 1291 if (!lmp_le_capable(hdev)) 1292 return MGMT_STATUS_NOT_SUPPORTED; 1293 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1294 return MGMT_STATUS_REJECTED; 1295 else 1296 return MGMT_STATUS_SUCCESS; 1297 } 1298 1299 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status) 1300 { 1301 struct mgmt_pending_cmd *cmd; 1302 1303 BT_DBG("status 0x%02x", status); 1304 1305 hci_dev_lock(hdev); 1306 1307 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1308 if (!cmd) 1309 goto unlock; 1310 1311 if (status) { 1312 u8 mgmt_err = mgmt_status(status); 1313 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1314 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1315 goto remove_cmd; 1316 } 1317 1318 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1319 hdev->discov_timeout > 0) { 1320 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1321 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1322 } 1323 1324 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1325 new_settings(hdev, cmd->sk); 1326 1327 remove_cmd: 1328 mgmt_pending_remove(cmd); 1329 1330 unlock: 1331 hci_dev_unlock(hdev); 1332 } 1333 1334 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1335 u16 len) 1336 { 1337 struct mgmt_cp_set_discoverable *cp = data; 1338 struct mgmt_pending_cmd *cmd; 1339 u16 timeout; 1340 int err; 1341 1342 BT_DBG("request for %s", hdev->name); 1343 1344 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1345 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1346 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1347 MGMT_STATUS_REJECTED); 1348 1349 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1351 MGMT_STATUS_INVALID_PARAMS); 1352 1353 timeout = __le16_to_cpu(cp->timeout); 1354 1355 /* Disabling discoverable requires that no timeout is set, 1356 * and enabling limited discoverable requires a timeout. 1357 */ 1358 if ((cp->val == 0x00 && timeout > 0) || 1359 (cp->val == 0x02 && timeout == 0)) 1360 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1361 MGMT_STATUS_INVALID_PARAMS); 1362 1363 hci_dev_lock(hdev); 1364 1365 if (!hdev_is_powered(hdev) && timeout > 0) { 1366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1367 MGMT_STATUS_NOT_POWERED); 1368 goto failed; 1369 } 1370 1371 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1372 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1373 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1374 MGMT_STATUS_BUSY); 1375 goto failed; 1376 } 1377 1378 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1379 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1380 MGMT_STATUS_REJECTED); 1381 goto failed; 1382 } 1383 1384 if (!hdev_is_powered(hdev)) { 1385 bool changed = false; 1386 1387 /* Setting limited discoverable when powered off is 1388 * not a valid operation since it requires a timeout 1389 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1390 */ 1391 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1392 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1393 changed = true; 1394 } 1395 1396 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1397 if (err < 0) 1398 goto failed; 1399 1400 if (changed) 1401 err = new_settings(hdev, sk); 1402 1403 goto failed; 1404 } 1405 1406 /* If the current mode is the same, then just update the timeout 1407 * value with the new value. And if only the timeout gets updated, 1408 * then no need for any HCI transactions. 1409 */ 1410 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1411 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1412 HCI_LIMITED_DISCOVERABLE)) { 1413 cancel_delayed_work(&hdev->discov_off); 1414 hdev->discov_timeout = timeout; 1415 1416 if (cp->val && hdev->discov_timeout > 0) { 1417 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1418 queue_delayed_work(hdev->req_workqueue, 1419 &hdev->discov_off, to); 1420 } 1421 1422 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1423 goto failed; 1424 } 1425 1426 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1427 if (!cmd) { 1428 err = -ENOMEM; 1429 goto failed; 1430 } 1431 1432 /* Cancel any potential discoverable timeout that might be 1433 * still active and store new timeout value. The arming of 1434 * the timeout happens in the complete handler. 1435 */ 1436 cancel_delayed_work(&hdev->discov_off); 1437 hdev->discov_timeout = timeout; 1438 1439 if (cp->val) 1440 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1441 else 1442 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1443 1444 /* Limited discoverable mode */ 1445 if (cp->val == 0x02) 1446 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1447 else 1448 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1449 1450 queue_work(hdev->req_workqueue, &hdev->discoverable_update); 1451 err = 0; 1452 1453 failed: 1454 hci_dev_unlock(hdev); 1455 return err; 1456 } 1457 1458 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status) 1459 { 1460 struct mgmt_pending_cmd *cmd; 1461 1462 BT_DBG("status 0x%02x", status); 1463 1464 hci_dev_lock(hdev); 1465 1466 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1467 if (!cmd) 1468 goto unlock; 1469 1470 if (status) { 1471 u8 mgmt_err = mgmt_status(status); 1472 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1473 goto remove_cmd; 1474 } 1475 1476 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1477 new_settings(hdev, cmd->sk); 1478 1479 remove_cmd: 1480 mgmt_pending_remove(cmd); 1481 1482 unlock: 1483 hci_dev_unlock(hdev); 1484 } 1485 1486 static int set_connectable_update_settings(struct hci_dev *hdev, 1487 struct sock *sk, u8 val) 1488 { 1489 bool changed = false; 1490 int err; 1491 1492 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1493 changed = true; 1494 1495 if (val) { 1496 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1497 } else { 1498 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1499 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1500 } 1501 1502 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1503 if (err < 0) 1504 return err; 1505 1506 if (changed) { 1507 hci_req_update_scan(hdev); 1508 hci_update_background_scan(hdev); 1509 return new_settings(hdev, sk); 1510 } 1511 1512 return 0; 1513 } 1514 1515 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1516 u16 len) 1517 { 1518 struct mgmt_mode *cp = data; 1519 struct mgmt_pending_cmd *cmd; 1520 int err; 1521 1522 BT_DBG("request for %s", hdev->name); 1523 1524 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1525 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1526 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1527 MGMT_STATUS_REJECTED); 1528 1529 if (cp->val != 0x00 && cp->val != 0x01) 1530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1531 MGMT_STATUS_INVALID_PARAMS); 1532 1533 hci_dev_lock(hdev); 1534 1535 if (!hdev_is_powered(hdev)) { 1536 err = set_connectable_update_settings(hdev, sk, cp->val); 1537 goto failed; 1538 } 1539 1540 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1541 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1542 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1543 MGMT_STATUS_BUSY); 1544 goto failed; 1545 } 1546 1547 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1548 if (!cmd) { 1549 err = -ENOMEM; 1550 goto failed; 1551 } 1552 1553 if (cp->val) { 1554 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1555 } else { 1556 if (hdev->discov_timeout > 0) 1557 cancel_delayed_work(&hdev->discov_off); 1558 1559 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1560 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1561 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1562 } 1563 1564 queue_work(hdev->req_workqueue, &hdev->connectable_update); 1565 err = 0; 1566 1567 failed: 1568 hci_dev_unlock(hdev); 1569 return err; 1570 } 1571 1572 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1573 u16 len) 1574 { 1575 struct mgmt_mode *cp = data; 1576 bool changed; 1577 int err; 1578 1579 BT_DBG("request for %s", hdev->name); 1580 1581 if (cp->val != 0x00 && cp->val != 0x01) 1582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1583 MGMT_STATUS_INVALID_PARAMS); 1584 1585 hci_dev_lock(hdev); 1586 1587 if (cp->val) 1588 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1589 else 1590 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1591 1592 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1593 if (err < 0) 1594 goto unlock; 1595 1596 if (changed) { 1597 /* In limited privacy mode the change of bondable mode 1598 * may affect the local advertising address. 1599 */ 1600 if (hdev_is_powered(hdev) && 1601 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1602 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1603 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1604 queue_work(hdev->req_workqueue, 1605 &hdev->discoverable_update); 1606 1607 err = new_settings(hdev, sk); 1608 } 1609 1610 unlock: 1611 hci_dev_unlock(hdev); 1612 return err; 1613 } 1614 1615 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1616 u16 len) 1617 { 1618 struct mgmt_mode *cp = data; 1619 struct mgmt_pending_cmd *cmd; 1620 u8 val, status; 1621 int err; 1622 1623 BT_DBG("request for %s", hdev->name); 1624 1625 status = mgmt_bredr_support(hdev); 1626 if (status) 1627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1628 status); 1629 1630 if (cp->val != 0x00 && cp->val != 0x01) 1631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1632 MGMT_STATUS_INVALID_PARAMS); 1633 1634 hci_dev_lock(hdev); 1635 1636 if (!hdev_is_powered(hdev)) { 1637 bool changed = false; 1638 1639 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1640 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1641 changed = true; 1642 } 1643 1644 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1645 if (err < 0) 1646 goto failed; 1647 1648 if (changed) 1649 err = new_settings(hdev, sk); 1650 1651 goto failed; 1652 } 1653 1654 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1655 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1656 MGMT_STATUS_BUSY); 1657 goto failed; 1658 } 1659 1660 val = !!cp->val; 1661 1662 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1663 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1664 goto failed; 1665 } 1666 1667 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1668 if (!cmd) { 1669 err = -ENOMEM; 1670 goto failed; 1671 } 1672 1673 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1674 if (err < 0) { 1675 mgmt_pending_remove(cmd); 1676 goto failed; 1677 } 1678 1679 failed: 1680 hci_dev_unlock(hdev); 1681 return err; 1682 } 1683 1684 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1685 { 1686 struct mgmt_mode *cp = data; 1687 struct mgmt_pending_cmd *cmd; 1688 u8 status; 1689 int err; 1690 1691 BT_DBG("request for %s", hdev->name); 1692 1693 status = mgmt_bredr_support(hdev); 1694 if (status) 1695 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1696 1697 if (!lmp_ssp_capable(hdev)) 1698 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1699 MGMT_STATUS_NOT_SUPPORTED); 1700 1701 if (cp->val != 0x00 && cp->val != 0x01) 1702 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1703 MGMT_STATUS_INVALID_PARAMS); 1704 1705 hci_dev_lock(hdev); 1706 1707 if (!hdev_is_powered(hdev)) { 1708 bool changed; 1709 1710 if (cp->val) { 1711 changed = !hci_dev_test_and_set_flag(hdev, 1712 HCI_SSP_ENABLED); 1713 } else { 1714 changed = hci_dev_test_and_clear_flag(hdev, 1715 HCI_SSP_ENABLED); 1716 if (!changed) 1717 changed = hci_dev_test_and_clear_flag(hdev, 1718 HCI_HS_ENABLED); 1719 else 1720 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1721 } 1722 1723 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1724 if (err < 0) 1725 goto failed; 1726 1727 if (changed) 1728 err = new_settings(hdev, sk); 1729 1730 goto failed; 1731 } 1732 1733 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1734 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1735 MGMT_STATUS_BUSY); 1736 goto failed; 1737 } 1738 1739 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1740 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1741 goto failed; 1742 } 1743 1744 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1745 if (!cmd) { 1746 err = -ENOMEM; 1747 goto failed; 1748 } 1749 1750 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 1751 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 1752 sizeof(cp->val), &cp->val); 1753 1754 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1755 if (err < 0) { 1756 mgmt_pending_remove(cmd); 1757 goto failed; 1758 } 1759 1760 failed: 1761 hci_dev_unlock(hdev); 1762 return err; 1763 } 1764 1765 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1766 { 1767 struct mgmt_mode *cp = data; 1768 bool changed; 1769 u8 status; 1770 int err; 1771 1772 BT_DBG("request for %s", hdev->name); 1773 1774 status = mgmt_bredr_support(hdev); 1775 if (status) 1776 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1777 1778 if (!lmp_ssp_capable(hdev)) 1779 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1780 MGMT_STATUS_NOT_SUPPORTED); 1781 1782 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1783 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1784 MGMT_STATUS_REJECTED); 1785 1786 if (cp->val != 0x00 && cp->val != 0x01) 1787 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1788 MGMT_STATUS_INVALID_PARAMS); 1789 1790 hci_dev_lock(hdev); 1791 1792 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1793 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1794 MGMT_STATUS_BUSY); 1795 goto unlock; 1796 } 1797 1798 if (cp->val) { 1799 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1800 } else { 1801 if (hdev_is_powered(hdev)) { 1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1803 MGMT_STATUS_REJECTED); 1804 goto unlock; 1805 } 1806 1807 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1808 } 1809 1810 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1811 if (err < 0) 1812 goto unlock; 1813 1814 if (changed) 1815 err = new_settings(hdev, sk); 1816 1817 unlock: 1818 hci_dev_unlock(hdev); 1819 return err; 1820 } 1821 1822 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1823 { 1824 struct cmd_lookup match = { NULL, hdev }; 1825 1826 hci_dev_lock(hdev); 1827 1828 if (status) { 1829 u8 mgmt_err = mgmt_status(status); 1830 1831 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1832 &mgmt_err); 1833 goto unlock; 1834 } 1835 1836 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1837 1838 new_settings(hdev, match.sk); 1839 1840 if (match.sk) 1841 sock_put(match.sk); 1842 1843 /* Make sure the controller has a good default for 1844 * advertising data. Restrict the update to when LE 1845 * has actually been enabled. During power on, the 1846 * update in powered_update_hci will take care of it. 1847 */ 1848 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1849 struct hci_request req; 1850 hci_req_init(&req, hdev); 1851 if (ext_adv_capable(hdev)) { 1852 int err; 1853 1854 err = __hci_req_setup_ext_adv_instance(&req, 0x00); 1855 if (!err) 1856 __hci_req_update_scan_rsp_data(&req, 0x00); 1857 } else { 1858 __hci_req_update_adv_data(&req, 0x00); 1859 __hci_req_update_scan_rsp_data(&req, 0x00); 1860 } 1861 hci_req_run(&req, NULL); 1862 hci_update_background_scan(hdev); 1863 } 1864 1865 unlock: 1866 hci_dev_unlock(hdev); 1867 } 1868 1869 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1870 { 1871 struct mgmt_mode *cp = data; 1872 struct hci_cp_write_le_host_supported hci_cp; 1873 struct mgmt_pending_cmd *cmd; 1874 struct hci_request req; 1875 int err; 1876 u8 val, enabled; 1877 1878 BT_DBG("request for %s", hdev->name); 1879 1880 if (!lmp_le_capable(hdev)) 1881 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1882 MGMT_STATUS_NOT_SUPPORTED); 1883 1884 if (cp->val != 0x00 && cp->val != 0x01) 1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1886 MGMT_STATUS_INVALID_PARAMS); 1887 1888 /* Bluetooth single mode LE only controllers or dual-mode 1889 * controllers configured as LE only devices, do not allow 1890 * switching LE off. These have either LE enabled explicitly 1891 * or BR/EDR has been previously switched off. 1892 * 1893 * When trying to enable an already enabled LE, then gracefully 1894 * send a positive response. Trying to disable it however will 1895 * result into rejection. 1896 */ 1897 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1898 if (cp->val == 0x01) 1899 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1900 1901 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1902 MGMT_STATUS_REJECTED); 1903 } 1904 1905 hci_dev_lock(hdev); 1906 1907 val = !!cp->val; 1908 enabled = lmp_host_le_capable(hdev); 1909 1910 if (!val) 1911 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 1912 1913 if (!hdev_is_powered(hdev) || val == enabled) { 1914 bool changed = false; 1915 1916 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1917 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 1918 changed = true; 1919 } 1920 1921 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 1922 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 1923 changed = true; 1924 } 1925 1926 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1927 if (err < 0) 1928 goto unlock; 1929 1930 if (changed) 1931 err = new_settings(hdev, sk); 1932 1933 goto unlock; 1934 } 1935 1936 if (pending_find(MGMT_OP_SET_LE, hdev) || 1937 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1939 MGMT_STATUS_BUSY); 1940 goto unlock; 1941 } 1942 1943 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1944 if (!cmd) { 1945 err = -ENOMEM; 1946 goto unlock; 1947 } 1948 1949 hci_req_init(&req, hdev); 1950 1951 memset(&hci_cp, 0, sizeof(hci_cp)); 1952 1953 if (val) { 1954 hci_cp.le = val; 1955 hci_cp.simul = 0x00; 1956 } else { 1957 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1958 __hci_req_disable_advertising(&req); 1959 1960 if (ext_adv_capable(hdev)) 1961 __hci_req_clear_ext_adv_sets(&req); 1962 } 1963 1964 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 1965 &hci_cp); 1966 1967 err = hci_req_run(&req, le_enable_complete); 1968 if (err < 0) 1969 mgmt_pending_remove(cmd); 1970 1971 unlock: 1972 hci_dev_unlock(hdev); 1973 return err; 1974 } 1975 1976 /* This is a helper function to test for pending mgmt commands that can 1977 * cause CoD or EIR HCI commands. We can only allow one such pending 1978 * mgmt command at a time since otherwise we cannot easily track what 1979 * the current values are, will be, and based on that calculate if a new 1980 * HCI command needs to be sent and if yes with what value. 1981 */ 1982 static bool pending_eir_or_class(struct hci_dev *hdev) 1983 { 1984 struct mgmt_pending_cmd *cmd; 1985 1986 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 1987 switch (cmd->opcode) { 1988 case MGMT_OP_ADD_UUID: 1989 case MGMT_OP_REMOVE_UUID: 1990 case MGMT_OP_SET_DEV_CLASS: 1991 case MGMT_OP_SET_POWERED: 1992 return true; 1993 } 1994 } 1995 1996 return false; 1997 } 1998 1999 static const u8 bluetooth_base_uuid[] = { 2000 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2001 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2002 }; 2003 2004 static u8 get_uuid_size(const u8 *uuid) 2005 { 2006 u32 val; 2007 2008 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2009 return 128; 2010 2011 val = get_unaligned_le32(&uuid[12]); 2012 if (val > 0xffff) 2013 return 32; 2014 2015 return 16; 2016 } 2017 2018 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 2019 { 2020 struct mgmt_pending_cmd *cmd; 2021 2022 hci_dev_lock(hdev); 2023 2024 cmd = pending_find(mgmt_op, hdev); 2025 if (!cmd) 2026 goto unlock; 2027 2028 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2029 mgmt_status(status), hdev->dev_class, 3); 2030 2031 mgmt_pending_remove(cmd); 2032 2033 unlock: 2034 hci_dev_unlock(hdev); 2035 } 2036 2037 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2038 { 2039 BT_DBG("status 0x%02x", status); 2040 2041 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 2042 } 2043 2044 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2045 { 2046 struct mgmt_cp_add_uuid *cp = data; 2047 struct mgmt_pending_cmd *cmd; 2048 struct hci_request req; 2049 struct bt_uuid *uuid; 2050 int err; 2051 2052 BT_DBG("request for %s", hdev->name); 2053 2054 hci_dev_lock(hdev); 2055 2056 if (pending_eir_or_class(hdev)) { 2057 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2058 MGMT_STATUS_BUSY); 2059 goto failed; 2060 } 2061 2062 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2063 if (!uuid) { 2064 err = -ENOMEM; 2065 goto failed; 2066 } 2067 2068 memcpy(uuid->uuid, cp->uuid, 16); 2069 uuid->svc_hint = cp->svc_hint; 2070 uuid->size = get_uuid_size(cp->uuid); 2071 2072 list_add_tail(&uuid->list, &hdev->uuids); 2073 2074 hci_req_init(&req, hdev); 2075 2076 __hci_req_update_class(&req); 2077 __hci_req_update_eir(&req); 2078 2079 err = hci_req_run(&req, add_uuid_complete); 2080 if (err < 0) { 2081 if (err != -ENODATA) 2082 goto failed; 2083 2084 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 2085 hdev->dev_class, 3); 2086 goto failed; 2087 } 2088 2089 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2090 if (!cmd) { 2091 err = -ENOMEM; 2092 goto failed; 2093 } 2094 2095 err = 0; 2096 2097 failed: 2098 hci_dev_unlock(hdev); 2099 return err; 2100 } 2101 2102 static bool enable_service_cache(struct hci_dev *hdev) 2103 { 2104 if (!hdev_is_powered(hdev)) 2105 return false; 2106 2107 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2108 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2109 CACHE_TIMEOUT); 2110 return true; 2111 } 2112 2113 return false; 2114 } 2115 2116 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2117 { 2118 BT_DBG("status 0x%02x", status); 2119 2120 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 2121 } 2122 2123 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2124 u16 len) 2125 { 2126 struct mgmt_cp_remove_uuid *cp = data; 2127 struct mgmt_pending_cmd *cmd; 2128 struct bt_uuid *match, *tmp; 2129 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 2130 struct hci_request req; 2131 int err, found; 2132 2133 BT_DBG("request for %s", hdev->name); 2134 2135 hci_dev_lock(hdev); 2136 2137 if (pending_eir_or_class(hdev)) { 2138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2139 MGMT_STATUS_BUSY); 2140 goto unlock; 2141 } 2142 2143 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2144 hci_uuids_clear(hdev); 2145 2146 if (enable_service_cache(hdev)) { 2147 err = mgmt_cmd_complete(sk, hdev->id, 2148 MGMT_OP_REMOVE_UUID, 2149 0, hdev->dev_class, 3); 2150 goto unlock; 2151 } 2152 2153 goto update_class; 2154 } 2155 2156 found = 0; 2157 2158 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2159 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2160 continue; 2161 2162 list_del(&match->list); 2163 kfree(match); 2164 found++; 2165 } 2166 2167 if (found == 0) { 2168 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2169 MGMT_STATUS_INVALID_PARAMS); 2170 goto unlock; 2171 } 2172 2173 update_class: 2174 hci_req_init(&req, hdev); 2175 2176 __hci_req_update_class(&req); 2177 __hci_req_update_eir(&req); 2178 2179 err = hci_req_run(&req, remove_uuid_complete); 2180 if (err < 0) { 2181 if (err != -ENODATA) 2182 goto unlock; 2183 2184 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 2185 hdev->dev_class, 3); 2186 goto unlock; 2187 } 2188 2189 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2190 if (!cmd) { 2191 err = -ENOMEM; 2192 goto unlock; 2193 } 2194 2195 err = 0; 2196 2197 unlock: 2198 hci_dev_unlock(hdev); 2199 return err; 2200 } 2201 2202 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2203 { 2204 BT_DBG("status 0x%02x", status); 2205 2206 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 2207 } 2208 2209 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2210 u16 len) 2211 { 2212 struct mgmt_cp_set_dev_class *cp = data; 2213 struct mgmt_pending_cmd *cmd; 2214 struct hci_request req; 2215 int err; 2216 2217 BT_DBG("request for %s", hdev->name); 2218 2219 if (!lmp_bredr_capable(hdev)) 2220 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2221 MGMT_STATUS_NOT_SUPPORTED); 2222 2223 hci_dev_lock(hdev); 2224 2225 if (pending_eir_or_class(hdev)) { 2226 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2227 MGMT_STATUS_BUSY); 2228 goto unlock; 2229 } 2230 2231 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2232 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2233 MGMT_STATUS_INVALID_PARAMS); 2234 goto unlock; 2235 } 2236 2237 hdev->major_class = cp->major; 2238 hdev->minor_class = cp->minor; 2239 2240 if (!hdev_is_powered(hdev)) { 2241 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2242 hdev->dev_class, 3); 2243 goto unlock; 2244 } 2245 2246 hci_req_init(&req, hdev); 2247 2248 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2249 hci_dev_unlock(hdev); 2250 cancel_delayed_work_sync(&hdev->service_cache); 2251 hci_dev_lock(hdev); 2252 __hci_req_update_eir(&req); 2253 } 2254 2255 __hci_req_update_class(&req); 2256 2257 err = hci_req_run(&req, set_class_complete); 2258 if (err < 0) { 2259 if (err != -ENODATA) 2260 goto unlock; 2261 2262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2263 hdev->dev_class, 3); 2264 goto unlock; 2265 } 2266 2267 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2268 if (!cmd) { 2269 err = -ENOMEM; 2270 goto unlock; 2271 } 2272 2273 err = 0; 2274 2275 unlock: 2276 hci_dev_unlock(hdev); 2277 return err; 2278 } 2279 2280 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2281 u16 len) 2282 { 2283 struct mgmt_cp_load_link_keys *cp = data; 2284 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2285 sizeof(struct mgmt_link_key_info)); 2286 u16 key_count, expected_len; 2287 bool changed; 2288 int i; 2289 2290 BT_DBG("request for %s", hdev->name); 2291 2292 if (!lmp_bredr_capable(hdev)) 2293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2294 MGMT_STATUS_NOT_SUPPORTED); 2295 2296 key_count = __le16_to_cpu(cp->key_count); 2297 if (key_count > max_key_count) { 2298 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2299 key_count); 2300 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2301 MGMT_STATUS_INVALID_PARAMS); 2302 } 2303 2304 expected_len = sizeof(*cp) + key_count * 2305 sizeof(struct mgmt_link_key_info); 2306 if (expected_len != len) { 2307 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2308 expected_len, len); 2309 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2310 MGMT_STATUS_INVALID_PARAMS); 2311 } 2312 2313 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2314 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2315 MGMT_STATUS_INVALID_PARAMS); 2316 2317 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys, 2318 key_count); 2319 2320 for (i = 0; i < key_count; i++) { 2321 struct mgmt_link_key_info *key = &cp->keys[i]; 2322 2323 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2324 return mgmt_cmd_status(sk, hdev->id, 2325 MGMT_OP_LOAD_LINK_KEYS, 2326 MGMT_STATUS_INVALID_PARAMS); 2327 } 2328 2329 hci_dev_lock(hdev); 2330 2331 hci_link_keys_clear(hdev); 2332 2333 if (cp->debug_keys) 2334 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2335 else 2336 changed = hci_dev_test_and_clear_flag(hdev, 2337 HCI_KEEP_DEBUG_KEYS); 2338 2339 if (changed) 2340 new_settings(hdev, NULL); 2341 2342 for (i = 0; i < key_count; i++) { 2343 struct mgmt_link_key_info *key = &cp->keys[i]; 2344 2345 /* Always ignore debug keys and require a new pairing if 2346 * the user wants to use them. 2347 */ 2348 if (key->type == HCI_LK_DEBUG_COMBINATION) 2349 continue; 2350 2351 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2352 key->type, key->pin_len, NULL); 2353 } 2354 2355 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2356 2357 hci_dev_unlock(hdev); 2358 2359 return 0; 2360 } 2361 2362 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2363 u8 addr_type, struct sock *skip_sk) 2364 { 2365 struct mgmt_ev_device_unpaired ev; 2366 2367 bacpy(&ev.addr.bdaddr, bdaddr); 2368 ev.addr.type = addr_type; 2369 2370 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2371 skip_sk); 2372 } 2373 2374 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2375 u16 len) 2376 { 2377 struct mgmt_cp_unpair_device *cp = data; 2378 struct mgmt_rp_unpair_device rp; 2379 struct hci_conn_params *params; 2380 struct mgmt_pending_cmd *cmd; 2381 struct hci_conn *conn; 2382 u8 addr_type; 2383 int err; 2384 2385 memset(&rp, 0, sizeof(rp)); 2386 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2387 rp.addr.type = cp->addr.type; 2388 2389 if (!bdaddr_type_is_valid(cp->addr.type)) 2390 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2391 MGMT_STATUS_INVALID_PARAMS, 2392 &rp, sizeof(rp)); 2393 2394 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2395 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2396 MGMT_STATUS_INVALID_PARAMS, 2397 &rp, sizeof(rp)); 2398 2399 hci_dev_lock(hdev); 2400 2401 if (!hdev_is_powered(hdev)) { 2402 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2403 MGMT_STATUS_NOT_POWERED, &rp, 2404 sizeof(rp)); 2405 goto unlock; 2406 } 2407 2408 if (cp->addr.type == BDADDR_BREDR) { 2409 /* If disconnection is requested, then look up the 2410 * connection. If the remote device is connected, it 2411 * will be later used to terminate the link. 2412 * 2413 * Setting it to NULL explicitly will cause no 2414 * termination of the link. 2415 */ 2416 if (cp->disconnect) 2417 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2418 &cp->addr.bdaddr); 2419 else 2420 conn = NULL; 2421 2422 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2423 if (err < 0) { 2424 err = mgmt_cmd_complete(sk, hdev->id, 2425 MGMT_OP_UNPAIR_DEVICE, 2426 MGMT_STATUS_NOT_PAIRED, &rp, 2427 sizeof(rp)); 2428 goto unlock; 2429 } 2430 2431 goto done; 2432 } 2433 2434 /* LE address type */ 2435 addr_type = le_addr_type(cp->addr.type); 2436 2437 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2438 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2439 if (err < 0) { 2440 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2441 MGMT_STATUS_NOT_PAIRED, &rp, 2442 sizeof(rp)); 2443 goto unlock; 2444 } 2445 2446 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2447 if (!conn) { 2448 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2449 goto done; 2450 } 2451 2452 2453 /* Defer clearing up the connection parameters until closing to 2454 * give a chance of keeping them if a repairing happens. 2455 */ 2456 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2457 2458 /* Disable auto-connection parameters if present */ 2459 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2460 if (params) { 2461 if (params->explicit_connect) 2462 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2463 else 2464 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2465 } 2466 2467 /* If disconnection is not requested, then clear the connection 2468 * variable so that the link is not terminated. 2469 */ 2470 if (!cp->disconnect) 2471 conn = NULL; 2472 2473 done: 2474 /* If the connection variable is set, then termination of the 2475 * link is requested. 2476 */ 2477 if (!conn) { 2478 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2479 &rp, sizeof(rp)); 2480 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2481 goto unlock; 2482 } 2483 2484 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2485 sizeof(*cp)); 2486 if (!cmd) { 2487 err = -ENOMEM; 2488 goto unlock; 2489 } 2490 2491 cmd->cmd_complete = addr_cmd_complete; 2492 2493 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2494 if (err < 0) 2495 mgmt_pending_remove(cmd); 2496 2497 unlock: 2498 hci_dev_unlock(hdev); 2499 return err; 2500 } 2501 2502 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2503 u16 len) 2504 { 2505 struct mgmt_cp_disconnect *cp = data; 2506 struct mgmt_rp_disconnect rp; 2507 struct mgmt_pending_cmd *cmd; 2508 struct hci_conn *conn; 2509 int err; 2510 2511 BT_DBG(""); 2512 2513 memset(&rp, 0, sizeof(rp)); 2514 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2515 rp.addr.type = cp->addr.type; 2516 2517 if (!bdaddr_type_is_valid(cp->addr.type)) 2518 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2519 MGMT_STATUS_INVALID_PARAMS, 2520 &rp, sizeof(rp)); 2521 2522 hci_dev_lock(hdev); 2523 2524 if (!test_bit(HCI_UP, &hdev->flags)) { 2525 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2526 MGMT_STATUS_NOT_POWERED, &rp, 2527 sizeof(rp)); 2528 goto failed; 2529 } 2530 2531 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2532 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2533 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2534 goto failed; 2535 } 2536 2537 if (cp->addr.type == BDADDR_BREDR) 2538 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2539 &cp->addr.bdaddr); 2540 else 2541 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2542 le_addr_type(cp->addr.type)); 2543 2544 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2545 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2546 MGMT_STATUS_NOT_CONNECTED, &rp, 2547 sizeof(rp)); 2548 goto failed; 2549 } 2550 2551 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2552 if (!cmd) { 2553 err = -ENOMEM; 2554 goto failed; 2555 } 2556 2557 cmd->cmd_complete = generic_cmd_complete; 2558 2559 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2560 if (err < 0) 2561 mgmt_pending_remove(cmd); 2562 2563 failed: 2564 hci_dev_unlock(hdev); 2565 return err; 2566 } 2567 2568 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2569 { 2570 switch (link_type) { 2571 case LE_LINK: 2572 switch (addr_type) { 2573 case ADDR_LE_DEV_PUBLIC: 2574 return BDADDR_LE_PUBLIC; 2575 2576 default: 2577 /* Fallback to LE Random address type */ 2578 return BDADDR_LE_RANDOM; 2579 } 2580 2581 default: 2582 /* Fallback to BR/EDR type */ 2583 return BDADDR_BREDR; 2584 } 2585 } 2586 2587 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2588 u16 data_len) 2589 { 2590 struct mgmt_rp_get_connections *rp; 2591 struct hci_conn *c; 2592 size_t rp_len; 2593 int err; 2594 u16 i; 2595 2596 BT_DBG(""); 2597 2598 hci_dev_lock(hdev); 2599 2600 if (!hdev_is_powered(hdev)) { 2601 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2602 MGMT_STATUS_NOT_POWERED); 2603 goto unlock; 2604 } 2605 2606 i = 0; 2607 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2608 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2609 i++; 2610 } 2611 2612 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2613 rp = kmalloc(rp_len, GFP_KERNEL); 2614 if (!rp) { 2615 err = -ENOMEM; 2616 goto unlock; 2617 } 2618 2619 i = 0; 2620 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2621 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2622 continue; 2623 bacpy(&rp->addr[i].bdaddr, &c->dst); 2624 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2625 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2626 continue; 2627 i++; 2628 } 2629 2630 rp->conn_count = cpu_to_le16(i); 2631 2632 /* Recalculate length in case of filtered SCO connections, etc */ 2633 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2634 2635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2636 rp_len); 2637 2638 kfree(rp); 2639 2640 unlock: 2641 hci_dev_unlock(hdev); 2642 return err; 2643 } 2644 2645 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2646 struct mgmt_cp_pin_code_neg_reply *cp) 2647 { 2648 struct mgmt_pending_cmd *cmd; 2649 int err; 2650 2651 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2652 sizeof(*cp)); 2653 if (!cmd) 2654 return -ENOMEM; 2655 2656 cmd->cmd_complete = addr_cmd_complete; 2657 2658 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2659 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2660 if (err < 0) 2661 mgmt_pending_remove(cmd); 2662 2663 return err; 2664 } 2665 2666 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2667 u16 len) 2668 { 2669 struct hci_conn *conn; 2670 struct mgmt_cp_pin_code_reply *cp = data; 2671 struct hci_cp_pin_code_reply reply; 2672 struct mgmt_pending_cmd *cmd; 2673 int err; 2674 2675 BT_DBG(""); 2676 2677 hci_dev_lock(hdev); 2678 2679 if (!hdev_is_powered(hdev)) { 2680 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2681 MGMT_STATUS_NOT_POWERED); 2682 goto failed; 2683 } 2684 2685 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2686 if (!conn) { 2687 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2688 MGMT_STATUS_NOT_CONNECTED); 2689 goto failed; 2690 } 2691 2692 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2693 struct mgmt_cp_pin_code_neg_reply ncp; 2694 2695 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2696 2697 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2698 2699 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2700 if (err >= 0) 2701 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2702 MGMT_STATUS_INVALID_PARAMS); 2703 2704 goto failed; 2705 } 2706 2707 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2708 if (!cmd) { 2709 err = -ENOMEM; 2710 goto failed; 2711 } 2712 2713 cmd->cmd_complete = addr_cmd_complete; 2714 2715 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2716 reply.pin_len = cp->pin_len; 2717 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2718 2719 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2720 if (err < 0) 2721 mgmt_pending_remove(cmd); 2722 2723 failed: 2724 hci_dev_unlock(hdev); 2725 return err; 2726 } 2727 2728 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2729 u16 len) 2730 { 2731 struct mgmt_cp_set_io_capability *cp = data; 2732 2733 BT_DBG(""); 2734 2735 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2736 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2737 MGMT_STATUS_INVALID_PARAMS); 2738 2739 hci_dev_lock(hdev); 2740 2741 hdev->io_capability = cp->io_capability; 2742 2743 BT_DBG("%s IO capability set to 0x%02x", hdev->name, 2744 hdev->io_capability); 2745 2746 hci_dev_unlock(hdev); 2747 2748 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2749 NULL, 0); 2750 } 2751 2752 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2753 { 2754 struct hci_dev *hdev = conn->hdev; 2755 struct mgmt_pending_cmd *cmd; 2756 2757 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2758 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2759 continue; 2760 2761 if (cmd->user_data != conn) 2762 continue; 2763 2764 return cmd; 2765 } 2766 2767 return NULL; 2768 } 2769 2770 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2771 { 2772 struct mgmt_rp_pair_device rp; 2773 struct hci_conn *conn = cmd->user_data; 2774 int err; 2775 2776 bacpy(&rp.addr.bdaddr, &conn->dst); 2777 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2778 2779 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2780 status, &rp, sizeof(rp)); 2781 2782 /* So we don't get further callbacks for this connection */ 2783 conn->connect_cfm_cb = NULL; 2784 conn->security_cfm_cb = NULL; 2785 conn->disconn_cfm_cb = NULL; 2786 2787 hci_conn_drop(conn); 2788 2789 /* The device is paired so there is no need to remove 2790 * its connection parameters anymore. 2791 */ 2792 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2793 2794 hci_conn_put(conn); 2795 2796 return err; 2797 } 2798 2799 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2800 { 2801 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2802 struct mgmt_pending_cmd *cmd; 2803 2804 cmd = find_pairing(conn); 2805 if (cmd) { 2806 cmd->cmd_complete(cmd, status); 2807 mgmt_pending_remove(cmd); 2808 } 2809 } 2810 2811 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2812 { 2813 struct mgmt_pending_cmd *cmd; 2814 2815 BT_DBG("status %u", status); 2816 2817 cmd = find_pairing(conn); 2818 if (!cmd) { 2819 BT_DBG("Unable to find a pending command"); 2820 return; 2821 } 2822 2823 cmd->cmd_complete(cmd, mgmt_status(status)); 2824 mgmt_pending_remove(cmd); 2825 } 2826 2827 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2828 { 2829 struct mgmt_pending_cmd *cmd; 2830 2831 BT_DBG("status %u", status); 2832 2833 if (!status) 2834 return; 2835 2836 cmd = find_pairing(conn); 2837 if (!cmd) { 2838 BT_DBG("Unable to find a pending command"); 2839 return; 2840 } 2841 2842 cmd->cmd_complete(cmd, mgmt_status(status)); 2843 mgmt_pending_remove(cmd); 2844 } 2845 2846 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2847 u16 len) 2848 { 2849 struct mgmt_cp_pair_device *cp = data; 2850 struct mgmt_rp_pair_device rp; 2851 struct mgmt_pending_cmd *cmd; 2852 u8 sec_level, auth_type; 2853 struct hci_conn *conn; 2854 int err; 2855 2856 BT_DBG(""); 2857 2858 memset(&rp, 0, sizeof(rp)); 2859 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2860 rp.addr.type = cp->addr.type; 2861 2862 if (!bdaddr_type_is_valid(cp->addr.type)) 2863 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2864 MGMT_STATUS_INVALID_PARAMS, 2865 &rp, sizeof(rp)); 2866 2867 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 2868 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2869 MGMT_STATUS_INVALID_PARAMS, 2870 &rp, sizeof(rp)); 2871 2872 hci_dev_lock(hdev); 2873 2874 if (!hdev_is_powered(hdev)) { 2875 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2876 MGMT_STATUS_NOT_POWERED, &rp, 2877 sizeof(rp)); 2878 goto unlock; 2879 } 2880 2881 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 2882 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2883 MGMT_STATUS_ALREADY_PAIRED, &rp, 2884 sizeof(rp)); 2885 goto unlock; 2886 } 2887 2888 sec_level = BT_SECURITY_MEDIUM; 2889 auth_type = HCI_AT_DEDICATED_BONDING; 2890 2891 if (cp->addr.type == BDADDR_BREDR) { 2892 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 2893 auth_type); 2894 } else { 2895 u8 addr_type = le_addr_type(cp->addr.type); 2896 struct hci_conn_params *p; 2897 2898 /* When pairing a new device, it is expected to remember 2899 * this device for future connections. Adding the connection 2900 * parameter information ahead of time allows tracking 2901 * of the slave preferred values and will speed up any 2902 * further connection establishment. 2903 * 2904 * If connection parameters already exist, then they 2905 * will be kept and this function does nothing. 2906 */ 2907 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 2908 2909 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 2910 p->auto_connect = HCI_AUTO_CONN_DISABLED; 2911 2912 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, 2913 addr_type, sec_level, 2914 HCI_LE_CONN_TIMEOUT); 2915 } 2916 2917 if (IS_ERR(conn)) { 2918 int status; 2919 2920 if (PTR_ERR(conn) == -EBUSY) 2921 status = MGMT_STATUS_BUSY; 2922 else if (PTR_ERR(conn) == -EOPNOTSUPP) 2923 status = MGMT_STATUS_NOT_SUPPORTED; 2924 else if (PTR_ERR(conn) == -ECONNREFUSED) 2925 status = MGMT_STATUS_REJECTED; 2926 else 2927 status = MGMT_STATUS_CONNECT_FAILED; 2928 2929 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2930 status, &rp, sizeof(rp)); 2931 goto unlock; 2932 } 2933 2934 if (conn->connect_cfm_cb) { 2935 hci_conn_drop(conn); 2936 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2937 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2938 goto unlock; 2939 } 2940 2941 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 2942 if (!cmd) { 2943 err = -ENOMEM; 2944 hci_conn_drop(conn); 2945 goto unlock; 2946 } 2947 2948 cmd->cmd_complete = pairing_complete; 2949 2950 /* For LE, just connecting isn't a proof that the pairing finished */ 2951 if (cp->addr.type == BDADDR_BREDR) { 2952 conn->connect_cfm_cb = pairing_complete_cb; 2953 conn->security_cfm_cb = pairing_complete_cb; 2954 conn->disconn_cfm_cb = pairing_complete_cb; 2955 } else { 2956 conn->connect_cfm_cb = le_pairing_complete_cb; 2957 conn->security_cfm_cb = le_pairing_complete_cb; 2958 conn->disconn_cfm_cb = le_pairing_complete_cb; 2959 } 2960 2961 conn->io_capability = cp->io_cap; 2962 cmd->user_data = hci_conn_get(conn); 2963 2964 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 2965 hci_conn_security(conn, sec_level, auth_type, true)) { 2966 cmd->cmd_complete(cmd, 0); 2967 mgmt_pending_remove(cmd); 2968 } 2969 2970 err = 0; 2971 2972 unlock: 2973 hci_dev_unlock(hdev); 2974 return err; 2975 } 2976 2977 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2978 u16 len) 2979 { 2980 struct mgmt_addr_info *addr = data; 2981 struct mgmt_pending_cmd *cmd; 2982 struct hci_conn *conn; 2983 int err; 2984 2985 BT_DBG(""); 2986 2987 hci_dev_lock(hdev); 2988 2989 if (!hdev_is_powered(hdev)) { 2990 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2991 MGMT_STATUS_NOT_POWERED); 2992 goto unlock; 2993 } 2994 2995 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 2996 if (!cmd) { 2997 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2998 MGMT_STATUS_INVALID_PARAMS); 2999 goto unlock; 3000 } 3001 3002 conn = cmd->user_data; 3003 3004 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3005 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3006 MGMT_STATUS_INVALID_PARAMS); 3007 goto unlock; 3008 } 3009 3010 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3011 mgmt_pending_remove(cmd); 3012 3013 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3014 addr, sizeof(*addr)); 3015 unlock: 3016 hci_dev_unlock(hdev); 3017 return err; 3018 } 3019 3020 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3021 struct mgmt_addr_info *addr, u16 mgmt_op, 3022 u16 hci_op, __le32 passkey) 3023 { 3024 struct mgmt_pending_cmd *cmd; 3025 struct hci_conn *conn; 3026 int err; 3027 3028 hci_dev_lock(hdev); 3029 3030 if (!hdev_is_powered(hdev)) { 3031 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3032 MGMT_STATUS_NOT_POWERED, addr, 3033 sizeof(*addr)); 3034 goto done; 3035 } 3036 3037 if (addr->type == BDADDR_BREDR) 3038 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3039 else 3040 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3041 le_addr_type(addr->type)); 3042 3043 if (!conn) { 3044 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3045 MGMT_STATUS_NOT_CONNECTED, addr, 3046 sizeof(*addr)); 3047 goto done; 3048 } 3049 3050 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3051 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3052 if (!err) 3053 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3054 MGMT_STATUS_SUCCESS, addr, 3055 sizeof(*addr)); 3056 else 3057 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3058 MGMT_STATUS_FAILED, addr, 3059 sizeof(*addr)); 3060 3061 goto done; 3062 } 3063 3064 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3065 if (!cmd) { 3066 err = -ENOMEM; 3067 goto done; 3068 } 3069 3070 cmd->cmd_complete = addr_cmd_complete; 3071 3072 /* Continue with pairing via HCI */ 3073 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3074 struct hci_cp_user_passkey_reply cp; 3075 3076 bacpy(&cp.bdaddr, &addr->bdaddr); 3077 cp.passkey = passkey; 3078 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3079 } else 3080 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3081 &addr->bdaddr); 3082 3083 if (err < 0) 3084 mgmt_pending_remove(cmd); 3085 3086 done: 3087 hci_dev_unlock(hdev); 3088 return err; 3089 } 3090 3091 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3092 void *data, u16 len) 3093 { 3094 struct mgmt_cp_pin_code_neg_reply *cp = data; 3095 3096 BT_DBG(""); 3097 3098 return user_pairing_resp(sk, hdev, &cp->addr, 3099 MGMT_OP_PIN_CODE_NEG_REPLY, 3100 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3101 } 3102 3103 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3104 u16 len) 3105 { 3106 struct mgmt_cp_user_confirm_reply *cp = data; 3107 3108 BT_DBG(""); 3109 3110 if (len != sizeof(*cp)) 3111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3112 MGMT_STATUS_INVALID_PARAMS); 3113 3114 return user_pairing_resp(sk, hdev, &cp->addr, 3115 MGMT_OP_USER_CONFIRM_REPLY, 3116 HCI_OP_USER_CONFIRM_REPLY, 0); 3117 } 3118 3119 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3120 void *data, u16 len) 3121 { 3122 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3123 3124 BT_DBG(""); 3125 3126 return user_pairing_resp(sk, hdev, &cp->addr, 3127 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3128 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3129 } 3130 3131 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3132 u16 len) 3133 { 3134 struct mgmt_cp_user_passkey_reply *cp = data; 3135 3136 BT_DBG(""); 3137 3138 return user_pairing_resp(sk, hdev, &cp->addr, 3139 MGMT_OP_USER_PASSKEY_REPLY, 3140 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3141 } 3142 3143 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3144 void *data, u16 len) 3145 { 3146 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3147 3148 BT_DBG(""); 3149 3150 return user_pairing_resp(sk, hdev, &cp->addr, 3151 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3152 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3153 } 3154 3155 static void adv_expire(struct hci_dev *hdev, u32 flags) 3156 { 3157 struct adv_info *adv_instance; 3158 struct hci_request req; 3159 int err; 3160 3161 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3162 if (!adv_instance) 3163 return; 3164 3165 /* stop if current instance doesn't need to be changed */ 3166 if (!(adv_instance->flags & flags)) 3167 return; 3168 3169 cancel_adv_timeout(hdev); 3170 3171 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3172 if (!adv_instance) 3173 return; 3174 3175 hci_req_init(&req, hdev); 3176 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance, 3177 true); 3178 if (err) 3179 return; 3180 3181 hci_req_run(&req, NULL); 3182 } 3183 3184 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3185 { 3186 struct mgmt_cp_set_local_name *cp; 3187 struct mgmt_pending_cmd *cmd; 3188 3189 BT_DBG("status 0x%02x", status); 3190 3191 hci_dev_lock(hdev); 3192 3193 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3194 if (!cmd) 3195 goto unlock; 3196 3197 cp = cmd->param; 3198 3199 if (status) { 3200 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3201 mgmt_status(status)); 3202 } else { 3203 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3204 cp, sizeof(*cp)); 3205 3206 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3207 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3208 } 3209 3210 mgmt_pending_remove(cmd); 3211 3212 unlock: 3213 hci_dev_unlock(hdev); 3214 } 3215 3216 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3217 u16 len) 3218 { 3219 struct mgmt_cp_set_local_name *cp = data; 3220 struct mgmt_pending_cmd *cmd; 3221 struct hci_request req; 3222 int err; 3223 3224 BT_DBG(""); 3225 3226 hci_dev_lock(hdev); 3227 3228 /* If the old values are the same as the new ones just return a 3229 * direct command complete event. 3230 */ 3231 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3232 !memcmp(hdev->short_name, cp->short_name, 3233 sizeof(hdev->short_name))) { 3234 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3235 data, len); 3236 goto failed; 3237 } 3238 3239 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3240 3241 if (!hdev_is_powered(hdev)) { 3242 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3243 3244 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3245 data, len); 3246 if (err < 0) 3247 goto failed; 3248 3249 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3250 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3251 ext_info_changed(hdev, sk); 3252 3253 goto failed; 3254 } 3255 3256 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3257 if (!cmd) { 3258 err = -ENOMEM; 3259 goto failed; 3260 } 3261 3262 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3263 3264 hci_req_init(&req, hdev); 3265 3266 if (lmp_bredr_capable(hdev)) { 3267 __hci_req_update_name(&req); 3268 __hci_req_update_eir(&req); 3269 } 3270 3271 /* The name is stored in the scan response data and so 3272 * no need to udpate the advertising data here. 3273 */ 3274 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3275 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance); 3276 3277 err = hci_req_run(&req, set_name_complete); 3278 if (err < 0) 3279 mgmt_pending_remove(cmd); 3280 3281 failed: 3282 hci_dev_unlock(hdev); 3283 return err; 3284 } 3285 3286 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3287 u16 len) 3288 { 3289 struct mgmt_cp_set_appearance *cp = data; 3290 u16 apperance; 3291 int err; 3292 3293 BT_DBG(""); 3294 3295 if (!lmp_le_capable(hdev)) 3296 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3297 MGMT_STATUS_NOT_SUPPORTED); 3298 3299 apperance = le16_to_cpu(cp->appearance); 3300 3301 hci_dev_lock(hdev); 3302 3303 if (hdev->appearance != apperance) { 3304 hdev->appearance = apperance; 3305 3306 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3307 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE); 3308 3309 ext_info_changed(hdev, sk); 3310 } 3311 3312 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3313 0); 3314 3315 hci_dev_unlock(hdev); 3316 3317 return err; 3318 } 3319 3320 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3321 void *data, u16 len) 3322 { 3323 struct mgmt_rp_get_phy_confguration rp; 3324 3325 BT_DBG("sock %p %s", sk, hdev->name); 3326 3327 hci_dev_lock(hdev); 3328 3329 memset(&rp, 0, sizeof(rp)); 3330 3331 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3332 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3333 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3334 3335 hci_dev_unlock(hdev); 3336 3337 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3338 &rp, sizeof(rp)); 3339 } 3340 3341 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3342 { 3343 struct mgmt_ev_phy_configuration_changed ev; 3344 3345 memset(&ev, 0, sizeof(ev)); 3346 3347 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3348 3349 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3350 sizeof(ev), skip); 3351 } 3352 3353 static void set_default_phy_complete(struct hci_dev *hdev, u8 status, 3354 u16 opcode, struct sk_buff *skb) 3355 { 3356 struct mgmt_pending_cmd *cmd; 3357 3358 BT_DBG("status 0x%02x", status); 3359 3360 hci_dev_lock(hdev); 3361 3362 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev); 3363 if (!cmd) 3364 goto unlock; 3365 3366 if (status) { 3367 mgmt_cmd_status(cmd->sk, hdev->id, 3368 MGMT_OP_SET_PHY_CONFIGURATION, 3369 mgmt_status(status)); 3370 } else { 3371 mgmt_cmd_complete(cmd->sk, hdev->id, 3372 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3373 NULL, 0); 3374 3375 mgmt_phy_configuration_changed(hdev, cmd->sk); 3376 } 3377 3378 mgmt_pending_remove(cmd); 3379 3380 unlock: 3381 hci_dev_unlock(hdev); 3382 } 3383 3384 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3385 void *data, u16 len) 3386 { 3387 struct mgmt_cp_set_phy_confguration *cp = data; 3388 struct hci_cp_le_set_default_phy cp_phy; 3389 struct mgmt_pending_cmd *cmd; 3390 struct hci_request req; 3391 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3392 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3393 bool changed = false; 3394 int err; 3395 3396 BT_DBG("sock %p %s", sk, hdev->name); 3397 3398 configurable_phys = get_configurable_phys(hdev); 3399 supported_phys = get_supported_phys(hdev); 3400 selected_phys = __le32_to_cpu(cp->selected_phys); 3401 3402 if (selected_phys & ~supported_phys) 3403 return mgmt_cmd_status(sk, hdev->id, 3404 MGMT_OP_SET_PHY_CONFIGURATION, 3405 MGMT_STATUS_INVALID_PARAMS); 3406 3407 unconfigure_phys = supported_phys & ~configurable_phys; 3408 3409 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3410 return mgmt_cmd_status(sk, hdev->id, 3411 MGMT_OP_SET_PHY_CONFIGURATION, 3412 MGMT_STATUS_INVALID_PARAMS); 3413 3414 if (selected_phys == get_selected_phys(hdev)) 3415 return mgmt_cmd_complete(sk, hdev->id, 3416 MGMT_OP_SET_PHY_CONFIGURATION, 3417 0, NULL, 0); 3418 3419 hci_dev_lock(hdev); 3420 3421 if (!hdev_is_powered(hdev)) { 3422 err = mgmt_cmd_status(sk, hdev->id, 3423 MGMT_OP_SET_PHY_CONFIGURATION, 3424 MGMT_STATUS_REJECTED); 3425 goto unlock; 3426 } 3427 3428 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3429 err = mgmt_cmd_status(sk, hdev->id, 3430 MGMT_OP_SET_PHY_CONFIGURATION, 3431 MGMT_STATUS_BUSY); 3432 goto unlock; 3433 } 3434 3435 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3436 pkt_type |= (HCI_DH3 | HCI_DM3); 3437 else 3438 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3439 3440 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3441 pkt_type |= (HCI_DH5 | HCI_DM5); 3442 else 3443 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3444 3445 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3446 pkt_type &= ~HCI_2DH1; 3447 else 3448 pkt_type |= HCI_2DH1; 3449 3450 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3451 pkt_type &= ~HCI_2DH3; 3452 else 3453 pkt_type |= HCI_2DH3; 3454 3455 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3456 pkt_type &= ~HCI_2DH5; 3457 else 3458 pkt_type |= HCI_2DH5; 3459 3460 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3461 pkt_type &= ~HCI_3DH1; 3462 else 3463 pkt_type |= HCI_3DH1; 3464 3465 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3466 pkt_type &= ~HCI_3DH3; 3467 else 3468 pkt_type |= HCI_3DH3; 3469 3470 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3471 pkt_type &= ~HCI_3DH5; 3472 else 3473 pkt_type |= HCI_3DH5; 3474 3475 if (pkt_type != hdev->pkt_type) { 3476 hdev->pkt_type = pkt_type; 3477 changed = true; 3478 } 3479 3480 if ((selected_phys & MGMT_PHY_LE_MASK) == 3481 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3482 if (changed) 3483 mgmt_phy_configuration_changed(hdev, sk); 3484 3485 err = mgmt_cmd_complete(sk, hdev->id, 3486 MGMT_OP_SET_PHY_CONFIGURATION, 3487 0, NULL, 0); 3488 3489 goto unlock; 3490 } 3491 3492 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3493 len); 3494 if (!cmd) { 3495 err = -ENOMEM; 3496 goto unlock; 3497 } 3498 3499 hci_req_init(&req, hdev); 3500 3501 memset(&cp_phy, 0, sizeof(cp_phy)); 3502 3503 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3504 cp_phy.all_phys |= 0x01; 3505 3506 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3507 cp_phy.all_phys |= 0x02; 3508 3509 if (selected_phys & MGMT_PHY_LE_1M_TX) 3510 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3511 3512 if (selected_phys & MGMT_PHY_LE_2M_TX) 3513 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3514 3515 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3516 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3517 3518 if (selected_phys & MGMT_PHY_LE_1M_RX) 3519 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3520 3521 if (selected_phys & MGMT_PHY_LE_2M_RX) 3522 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3523 3524 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3525 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3526 3527 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy); 3528 3529 err = hci_req_run_skb(&req, set_default_phy_complete); 3530 if (err < 0) 3531 mgmt_pending_remove(cmd); 3532 3533 unlock: 3534 hci_dev_unlock(hdev); 3535 3536 return err; 3537 } 3538 3539 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status, 3540 u16 opcode, struct sk_buff *skb) 3541 { 3542 struct mgmt_rp_read_local_oob_data mgmt_rp; 3543 size_t rp_size = sizeof(mgmt_rp); 3544 struct mgmt_pending_cmd *cmd; 3545 3546 BT_DBG("%s status %u", hdev->name, status); 3547 3548 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 3549 if (!cmd) 3550 return; 3551 3552 if (status || !skb) { 3553 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3554 status ? mgmt_status(status) : MGMT_STATUS_FAILED); 3555 goto remove; 3556 } 3557 3558 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 3559 3560 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 3561 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 3562 3563 if (skb->len < sizeof(*rp)) { 3564 mgmt_cmd_status(cmd->sk, hdev->id, 3565 MGMT_OP_READ_LOCAL_OOB_DATA, 3566 MGMT_STATUS_FAILED); 3567 goto remove; 3568 } 3569 3570 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 3571 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 3572 3573 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 3574 } else { 3575 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 3576 3577 if (skb->len < sizeof(*rp)) { 3578 mgmt_cmd_status(cmd->sk, hdev->id, 3579 MGMT_OP_READ_LOCAL_OOB_DATA, 3580 MGMT_STATUS_FAILED); 3581 goto remove; 3582 } 3583 3584 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 3585 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 3586 3587 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 3588 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 3589 } 3590 3591 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3592 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 3593 3594 remove: 3595 mgmt_pending_remove(cmd); 3596 } 3597 3598 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 3599 void *data, u16 data_len) 3600 { 3601 struct mgmt_pending_cmd *cmd; 3602 struct hci_request req; 3603 int err; 3604 3605 BT_DBG("%s", hdev->name); 3606 3607 hci_dev_lock(hdev); 3608 3609 if (!hdev_is_powered(hdev)) { 3610 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3611 MGMT_STATUS_NOT_POWERED); 3612 goto unlock; 3613 } 3614 3615 if (!lmp_ssp_capable(hdev)) { 3616 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3617 MGMT_STATUS_NOT_SUPPORTED); 3618 goto unlock; 3619 } 3620 3621 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 3622 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3623 MGMT_STATUS_BUSY); 3624 goto unlock; 3625 } 3626 3627 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 3628 if (!cmd) { 3629 err = -ENOMEM; 3630 goto unlock; 3631 } 3632 3633 hci_req_init(&req, hdev); 3634 3635 if (bredr_sc_enabled(hdev)) 3636 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 3637 else 3638 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 3639 3640 err = hci_req_run_skb(&req, read_local_oob_data_complete); 3641 if (err < 0) 3642 mgmt_pending_remove(cmd); 3643 3644 unlock: 3645 hci_dev_unlock(hdev); 3646 return err; 3647 } 3648 3649 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 3650 void *data, u16 len) 3651 { 3652 struct mgmt_addr_info *addr = data; 3653 int err; 3654 3655 BT_DBG("%s ", hdev->name); 3656 3657 if (!bdaddr_type_is_valid(addr->type)) 3658 return mgmt_cmd_complete(sk, hdev->id, 3659 MGMT_OP_ADD_REMOTE_OOB_DATA, 3660 MGMT_STATUS_INVALID_PARAMS, 3661 addr, sizeof(*addr)); 3662 3663 hci_dev_lock(hdev); 3664 3665 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 3666 struct mgmt_cp_add_remote_oob_data *cp = data; 3667 u8 status; 3668 3669 if (cp->addr.type != BDADDR_BREDR) { 3670 err = mgmt_cmd_complete(sk, hdev->id, 3671 MGMT_OP_ADD_REMOTE_OOB_DATA, 3672 MGMT_STATUS_INVALID_PARAMS, 3673 &cp->addr, sizeof(cp->addr)); 3674 goto unlock; 3675 } 3676 3677 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 3678 cp->addr.type, cp->hash, 3679 cp->rand, NULL, NULL); 3680 if (err < 0) 3681 status = MGMT_STATUS_FAILED; 3682 else 3683 status = MGMT_STATUS_SUCCESS; 3684 3685 err = mgmt_cmd_complete(sk, hdev->id, 3686 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 3687 &cp->addr, sizeof(cp->addr)); 3688 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 3689 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 3690 u8 *rand192, *hash192, *rand256, *hash256; 3691 u8 status; 3692 3693 if (bdaddr_type_is_le(cp->addr.type)) { 3694 /* Enforce zero-valued 192-bit parameters as 3695 * long as legacy SMP OOB isn't implemented. 3696 */ 3697 if (memcmp(cp->rand192, ZERO_KEY, 16) || 3698 memcmp(cp->hash192, ZERO_KEY, 16)) { 3699 err = mgmt_cmd_complete(sk, hdev->id, 3700 MGMT_OP_ADD_REMOTE_OOB_DATA, 3701 MGMT_STATUS_INVALID_PARAMS, 3702 addr, sizeof(*addr)); 3703 goto unlock; 3704 } 3705 3706 rand192 = NULL; 3707 hash192 = NULL; 3708 } else { 3709 /* In case one of the P-192 values is set to zero, 3710 * then just disable OOB data for P-192. 3711 */ 3712 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 3713 !memcmp(cp->hash192, ZERO_KEY, 16)) { 3714 rand192 = NULL; 3715 hash192 = NULL; 3716 } else { 3717 rand192 = cp->rand192; 3718 hash192 = cp->hash192; 3719 } 3720 } 3721 3722 /* In case one of the P-256 values is set to zero, then just 3723 * disable OOB data for P-256. 3724 */ 3725 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 3726 !memcmp(cp->hash256, ZERO_KEY, 16)) { 3727 rand256 = NULL; 3728 hash256 = NULL; 3729 } else { 3730 rand256 = cp->rand256; 3731 hash256 = cp->hash256; 3732 } 3733 3734 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 3735 cp->addr.type, hash192, rand192, 3736 hash256, rand256); 3737 if (err < 0) 3738 status = MGMT_STATUS_FAILED; 3739 else 3740 status = MGMT_STATUS_SUCCESS; 3741 3742 err = mgmt_cmd_complete(sk, hdev->id, 3743 MGMT_OP_ADD_REMOTE_OOB_DATA, 3744 status, &cp->addr, sizeof(cp->addr)); 3745 } else { 3746 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 3747 len); 3748 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 3749 MGMT_STATUS_INVALID_PARAMS); 3750 } 3751 3752 unlock: 3753 hci_dev_unlock(hdev); 3754 return err; 3755 } 3756 3757 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 3758 void *data, u16 len) 3759 { 3760 struct mgmt_cp_remove_remote_oob_data *cp = data; 3761 u8 status; 3762 int err; 3763 3764 BT_DBG("%s", hdev->name); 3765 3766 if (cp->addr.type != BDADDR_BREDR) 3767 return mgmt_cmd_complete(sk, hdev->id, 3768 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 3769 MGMT_STATUS_INVALID_PARAMS, 3770 &cp->addr, sizeof(cp->addr)); 3771 3772 hci_dev_lock(hdev); 3773 3774 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 3775 hci_remote_oob_data_clear(hdev); 3776 status = MGMT_STATUS_SUCCESS; 3777 goto done; 3778 } 3779 3780 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 3781 if (err < 0) 3782 status = MGMT_STATUS_INVALID_PARAMS; 3783 else 3784 status = MGMT_STATUS_SUCCESS; 3785 3786 done: 3787 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 3788 status, &cp->addr, sizeof(cp->addr)); 3789 3790 hci_dev_unlock(hdev); 3791 return err; 3792 } 3793 3794 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 3795 { 3796 struct mgmt_pending_cmd *cmd; 3797 3798 BT_DBG("status %d", status); 3799 3800 hci_dev_lock(hdev); 3801 3802 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 3803 if (!cmd) 3804 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 3805 3806 if (!cmd) 3807 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 3808 3809 if (cmd) { 3810 cmd->cmd_complete(cmd, mgmt_status(status)); 3811 mgmt_pending_remove(cmd); 3812 } 3813 3814 hci_dev_unlock(hdev); 3815 } 3816 3817 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 3818 uint8_t *mgmt_status) 3819 { 3820 switch (type) { 3821 case DISCOV_TYPE_LE: 3822 *mgmt_status = mgmt_le_support(hdev); 3823 if (*mgmt_status) 3824 return false; 3825 break; 3826 case DISCOV_TYPE_INTERLEAVED: 3827 *mgmt_status = mgmt_le_support(hdev); 3828 if (*mgmt_status) 3829 return false; 3830 /* Intentional fall-through */ 3831 case DISCOV_TYPE_BREDR: 3832 *mgmt_status = mgmt_bredr_support(hdev); 3833 if (*mgmt_status) 3834 return false; 3835 break; 3836 default: 3837 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 3838 return false; 3839 } 3840 3841 return true; 3842 } 3843 3844 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 3845 u16 op, void *data, u16 len) 3846 { 3847 struct mgmt_cp_start_discovery *cp = data; 3848 struct mgmt_pending_cmd *cmd; 3849 u8 status; 3850 int err; 3851 3852 BT_DBG("%s", hdev->name); 3853 3854 hci_dev_lock(hdev); 3855 3856 if (!hdev_is_powered(hdev)) { 3857 err = mgmt_cmd_complete(sk, hdev->id, op, 3858 MGMT_STATUS_NOT_POWERED, 3859 &cp->type, sizeof(cp->type)); 3860 goto failed; 3861 } 3862 3863 if (hdev->discovery.state != DISCOVERY_STOPPED || 3864 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 3865 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 3866 &cp->type, sizeof(cp->type)); 3867 goto failed; 3868 } 3869 3870 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 3871 err = mgmt_cmd_complete(sk, hdev->id, op, status, 3872 &cp->type, sizeof(cp->type)); 3873 goto failed; 3874 } 3875 3876 /* Clear the discovery filter first to free any previously 3877 * allocated memory for the UUID list. 3878 */ 3879 hci_discovery_filter_clear(hdev); 3880 3881 hdev->discovery.type = cp->type; 3882 hdev->discovery.report_invalid_rssi = false; 3883 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 3884 hdev->discovery.limited = true; 3885 else 3886 hdev->discovery.limited = false; 3887 3888 cmd = mgmt_pending_add(sk, op, hdev, data, len); 3889 if (!cmd) { 3890 err = -ENOMEM; 3891 goto failed; 3892 } 3893 3894 cmd->cmd_complete = generic_cmd_complete; 3895 3896 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 3897 queue_work(hdev->req_workqueue, &hdev->discov_update); 3898 err = 0; 3899 3900 failed: 3901 hci_dev_unlock(hdev); 3902 return err; 3903 } 3904 3905 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 3906 void *data, u16 len) 3907 { 3908 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 3909 data, len); 3910 } 3911 3912 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 3913 void *data, u16 len) 3914 { 3915 return start_discovery_internal(sk, hdev, 3916 MGMT_OP_START_LIMITED_DISCOVERY, 3917 data, len); 3918 } 3919 3920 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd, 3921 u8 status) 3922 { 3923 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 3924 cmd->param, 1); 3925 } 3926 3927 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 3928 void *data, u16 len) 3929 { 3930 struct mgmt_cp_start_service_discovery *cp = data; 3931 struct mgmt_pending_cmd *cmd; 3932 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 3933 u16 uuid_count, expected_len; 3934 u8 status; 3935 int err; 3936 3937 BT_DBG("%s", hdev->name); 3938 3939 hci_dev_lock(hdev); 3940 3941 if (!hdev_is_powered(hdev)) { 3942 err = mgmt_cmd_complete(sk, hdev->id, 3943 MGMT_OP_START_SERVICE_DISCOVERY, 3944 MGMT_STATUS_NOT_POWERED, 3945 &cp->type, sizeof(cp->type)); 3946 goto failed; 3947 } 3948 3949 if (hdev->discovery.state != DISCOVERY_STOPPED || 3950 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 3951 err = mgmt_cmd_complete(sk, hdev->id, 3952 MGMT_OP_START_SERVICE_DISCOVERY, 3953 MGMT_STATUS_BUSY, &cp->type, 3954 sizeof(cp->type)); 3955 goto failed; 3956 } 3957 3958 uuid_count = __le16_to_cpu(cp->uuid_count); 3959 if (uuid_count > max_uuid_count) { 3960 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 3961 uuid_count); 3962 err = mgmt_cmd_complete(sk, hdev->id, 3963 MGMT_OP_START_SERVICE_DISCOVERY, 3964 MGMT_STATUS_INVALID_PARAMS, &cp->type, 3965 sizeof(cp->type)); 3966 goto failed; 3967 } 3968 3969 expected_len = sizeof(*cp) + uuid_count * 16; 3970 if (expected_len != len) { 3971 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 3972 expected_len, len); 3973 err = mgmt_cmd_complete(sk, hdev->id, 3974 MGMT_OP_START_SERVICE_DISCOVERY, 3975 MGMT_STATUS_INVALID_PARAMS, &cp->type, 3976 sizeof(cp->type)); 3977 goto failed; 3978 } 3979 3980 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 3981 err = mgmt_cmd_complete(sk, hdev->id, 3982 MGMT_OP_START_SERVICE_DISCOVERY, 3983 status, &cp->type, sizeof(cp->type)); 3984 goto failed; 3985 } 3986 3987 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 3988 hdev, data, len); 3989 if (!cmd) { 3990 err = -ENOMEM; 3991 goto failed; 3992 } 3993 3994 cmd->cmd_complete = service_discovery_cmd_complete; 3995 3996 /* Clear the discovery filter first to free any previously 3997 * allocated memory for the UUID list. 3998 */ 3999 hci_discovery_filter_clear(hdev); 4000 4001 hdev->discovery.result_filtering = true; 4002 hdev->discovery.type = cp->type; 4003 hdev->discovery.rssi = cp->rssi; 4004 hdev->discovery.uuid_count = uuid_count; 4005 4006 if (uuid_count > 0) { 4007 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 4008 GFP_KERNEL); 4009 if (!hdev->discovery.uuids) { 4010 err = mgmt_cmd_complete(sk, hdev->id, 4011 MGMT_OP_START_SERVICE_DISCOVERY, 4012 MGMT_STATUS_FAILED, 4013 &cp->type, sizeof(cp->type)); 4014 mgmt_pending_remove(cmd); 4015 goto failed; 4016 } 4017 } 4018 4019 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 4020 queue_work(hdev->req_workqueue, &hdev->discov_update); 4021 err = 0; 4022 4023 failed: 4024 hci_dev_unlock(hdev); 4025 return err; 4026 } 4027 4028 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 4029 { 4030 struct mgmt_pending_cmd *cmd; 4031 4032 BT_DBG("status %d", status); 4033 4034 hci_dev_lock(hdev); 4035 4036 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 4037 if (cmd) { 4038 cmd->cmd_complete(cmd, mgmt_status(status)); 4039 mgmt_pending_remove(cmd); 4040 } 4041 4042 hci_dev_unlock(hdev); 4043 } 4044 4045 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 4046 u16 len) 4047 { 4048 struct mgmt_cp_stop_discovery *mgmt_cp = data; 4049 struct mgmt_pending_cmd *cmd; 4050 int err; 4051 4052 BT_DBG("%s", hdev->name); 4053 4054 hci_dev_lock(hdev); 4055 4056 if (!hci_discovery_active(hdev)) { 4057 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 4058 MGMT_STATUS_REJECTED, &mgmt_cp->type, 4059 sizeof(mgmt_cp->type)); 4060 goto unlock; 4061 } 4062 4063 if (hdev->discovery.type != mgmt_cp->type) { 4064 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 4065 MGMT_STATUS_INVALID_PARAMS, 4066 &mgmt_cp->type, sizeof(mgmt_cp->type)); 4067 goto unlock; 4068 } 4069 4070 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 4071 if (!cmd) { 4072 err = -ENOMEM; 4073 goto unlock; 4074 } 4075 4076 cmd->cmd_complete = generic_cmd_complete; 4077 4078 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 4079 queue_work(hdev->req_workqueue, &hdev->discov_update); 4080 err = 0; 4081 4082 unlock: 4083 hci_dev_unlock(hdev); 4084 return err; 4085 } 4086 4087 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 4088 u16 len) 4089 { 4090 struct mgmt_cp_confirm_name *cp = data; 4091 struct inquiry_entry *e; 4092 int err; 4093 4094 BT_DBG("%s", hdev->name); 4095 4096 hci_dev_lock(hdev); 4097 4098 if (!hci_discovery_active(hdev)) { 4099 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 4100 MGMT_STATUS_FAILED, &cp->addr, 4101 sizeof(cp->addr)); 4102 goto failed; 4103 } 4104 4105 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 4106 if (!e) { 4107 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 4108 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 4109 sizeof(cp->addr)); 4110 goto failed; 4111 } 4112 4113 if (cp->name_known) { 4114 e->name_state = NAME_KNOWN; 4115 list_del(&e->list); 4116 } else { 4117 e->name_state = NAME_NEEDED; 4118 hci_inquiry_cache_update_resolve(hdev, e); 4119 } 4120 4121 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 4122 &cp->addr, sizeof(cp->addr)); 4123 4124 failed: 4125 hci_dev_unlock(hdev); 4126 return err; 4127 } 4128 4129 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 4130 u16 len) 4131 { 4132 struct mgmt_cp_block_device *cp = data; 4133 u8 status; 4134 int err; 4135 4136 BT_DBG("%s", hdev->name); 4137 4138 if (!bdaddr_type_is_valid(cp->addr.type)) 4139 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 4140 MGMT_STATUS_INVALID_PARAMS, 4141 &cp->addr, sizeof(cp->addr)); 4142 4143 hci_dev_lock(hdev); 4144 4145 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr, 4146 cp->addr.type); 4147 if (err < 0) { 4148 status = MGMT_STATUS_FAILED; 4149 goto done; 4150 } 4151 4152 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 4153 sk); 4154 status = MGMT_STATUS_SUCCESS; 4155 4156 done: 4157 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 4158 &cp->addr, sizeof(cp->addr)); 4159 4160 hci_dev_unlock(hdev); 4161 4162 return err; 4163 } 4164 4165 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 4166 u16 len) 4167 { 4168 struct mgmt_cp_unblock_device *cp = data; 4169 u8 status; 4170 int err; 4171 4172 BT_DBG("%s", hdev->name); 4173 4174 if (!bdaddr_type_is_valid(cp->addr.type)) 4175 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 4176 MGMT_STATUS_INVALID_PARAMS, 4177 &cp->addr, sizeof(cp->addr)); 4178 4179 hci_dev_lock(hdev); 4180 4181 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr, 4182 cp->addr.type); 4183 if (err < 0) { 4184 status = MGMT_STATUS_INVALID_PARAMS; 4185 goto done; 4186 } 4187 4188 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 4189 sk); 4190 status = MGMT_STATUS_SUCCESS; 4191 4192 done: 4193 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 4194 &cp->addr, sizeof(cp->addr)); 4195 4196 hci_dev_unlock(hdev); 4197 4198 return err; 4199 } 4200 4201 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 4202 u16 len) 4203 { 4204 struct mgmt_cp_set_device_id *cp = data; 4205 struct hci_request req; 4206 int err; 4207 __u16 source; 4208 4209 BT_DBG("%s", hdev->name); 4210 4211 source = __le16_to_cpu(cp->source); 4212 4213 if (source > 0x0002) 4214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 4215 MGMT_STATUS_INVALID_PARAMS); 4216 4217 hci_dev_lock(hdev); 4218 4219 hdev->devid_source = source; 4220 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 4221 hdev->devid_product = __le16_to_cpu(cp->product); 4222 hdev->devid_version = __le16_to_cpu(cp->version); 4223 4224 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 4225 NULL, 0); 4226 4227 hci_req_init(&req, hdev); 4228 __hci_req_update_eir(&req); 4229 hci_req_run(&req, NULL); 4230 4231 hci_dev_unlock(hdev); 4232 4233 return err; 4234 } 4235 4236 static void enable_advertising_instance(struct hci_dev *hdev, u8 status, 4237 u16 opcode) 4238 { 4239 BT_DBG("status %d", status); 4240 } 4241 4242 static void set_advertising_complete(struct hci_dev *hdev, u8 status, 4243 u16 opcode) 4244 { 4245 struct cmd_lookup match = { NULL, hdev }; 4246 struct hci_request req; 4247 u8 instance; 4248 struct adv_info *adv_instance; 4249 int err; 4250 4251 hci_dev_lock(hdev); 4252 4253 if (status) { 4254 u8 mgmt_err = mgmt_status(status); 4255 4256 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 4257 cmd_status_rsp, &mgmt_err); 4258 goto unlock; 4259 } 4260 4261 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4262 hci_dev_set_flag(hdev, HCI_ADVERTISING); 4263 else 4264 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4265 4266 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 4267 &match); 4268 4269 new_settings(hdev, match.sk); 4270 4271 if (match.sk) 4272 sock_put(match.sk); 4273 4274 /* If "Set Advertising" was just disabled and instance advertising was 4275 * set up earlier, then re-enable multi-instance advertising. 4276 */ 4277 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 4278 list_empty(&hdev->adv_instances)) 4279 goto unlock; 4280 4281 instance = hdev->cur_adv_instance; 4282 if (!instance) { 4283 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 4284 struct adv_info, list); 4285 if (!adv_instance) 4286 goto unlock; 4287 4288 instance = adv_instance->instance; 4289 } 4290 4291 hci_req_init(&req, hdev); 4292 4293 err = __hci_req_schedule_adv_instance(&req, instance, true); 4294 4295 if (!err) 4296 err = hci_req_run(&req, enable_advertising_instance); 4297 4298 if (err) 4299 bt_dev_err(hdev, "failed to re-configure advertising"); 4300 4301 unlock: 4302 hci_dev_unlock(hdev); 4303 } 4304 4305 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 4306 u16 len) 4307 { 4308 struct mgmt_mode *cp = data; 4309 struct mgmt_pending_cmd *cmd; 4310 struct hci_request req; 4311 u8 val, status; 4312 int err; 4313 4314 BT_DBG("request for %s", hdev->name); 4315 4316 status = mgmt_le_support(hdev); 4317 if (status) 4318 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 4319 status); 4320 4321 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 4322 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 4323 MGMT_STATUS_INVALID_PARAMS); 4324 4325 hci_dev_lock(hdev); 4326 4327 val = !!cp->val; 4328 4329 /* The following conditions are ones which mean that we should 4330 * not do any HCI communication but directly send a mgmt 4331 * response to user space (after toggling the flag if 4332 * necessary). 4333 */ 4334 if (!hdev_is_powered(hdev) || 4335 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 4336 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 4337 hci_conn_num(hdev, LE_LINK) > 0 || 4338 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 4339 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 4340 bool changed; 4341 4342 if (cp->val) { 4343 hdev->cur_adv_instance = 0x00; 4344 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 4345 if (cp->val == 0x02) 4346 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4347 else 4348 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4349 } else { 4350 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 4351 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4352 } 4353 4354 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 4355 if (err < 0) 4356 goto unlock; 4357 4358 if (changed) 4359 err = new_settings(hdev, sk); 4360 4361 goto unlock; 4362 } 4363 4364 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 4365 pending_find(MGMT_OP_SET_LE, hdev)) { 4366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 4367 MGMT_STATUS_BUSY); 4368 goto unlock; 4369 } 4370 4371 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 4372 if (!cmd) { 4373 err = -ENOMEM; 4374 goto unlock; 4375 } 4376 4377 hci_req_init(&req, hdev); 4378 4379 if (cp->val == 0x02) 4380 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4381 else 4382 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 4383 4384 cancel_adv_timeout(hdev); 4385 4386 if (val) { 4387 /* Switch to instance "0" for the Set Advertising setting. 4388 * We cannot use update_[adv|scan_rsp]_data() here as the 4389 * HCI_ADVERTISING flag is not yet set. 4390 */ 4391 hdev->cur_adv_instance = 0x00; 4392 4393 if (ext_adv_capable(hdev)) { 4394 __hci_req_start_ext_adv(&req, 0x00); 4395 } else { 4396 __hci_req_update_adv_data(&req, 0x00); 4397 __hci_req_update_scan_rsp_data(&req, 0x00); 4398 __hci_req_enable_advertising(&req); 4399 } 4400 } else { 4401 __hci_req_disable_advertising(&req); 4402 } 4403 4404 err = hci_req_run(&req, set_advertising_complete); 4405 if (err < 0) 4406 mgmt_pending_remove(cmd); 4407 4408 unlock: 4409 hci_dev_unlock(hdev); 4410 return err; 4411 } 4412 4413 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 4414 void *data, u16 len) 4415 { 4416 struct mgmt_cp_set_static_address *cp = data; 4417 int err; 4418 4419 BT_DBG("%s", hdev->name); 4420 4421 if (!lmp_le_capable(hdev)) 4422 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 4423 MGMT_STATUS_NOT_SUPPORTED); 4424 4425 if (hdev_is_powered(hdev)) 4426 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 4427 MGMT_STATUS_REJECTED); 4428 4429 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 4430 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 4431 return mgmt_cmd_status(sk, hdev->id, 4432 MGMT_OP_SET_STATIC_ADDRESS, 4433 MGMT_STATUS_INVALID_PARAMS); 4434 4435 /* Two most significant bits shall be set */ 4436 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 4437 return mgmt_cmd_status(sk, hdev->id, 4438 MGMT_OP_SET_STATIC_ADDRESS, 4439 MGMT_STATUS_INVALID_PARAMS); 4440 } 4441 4442 hci_dev_lock(hdev); 4443 4444 bacpy(&hdev->static_addr, &cp->bdaddr); 4445 4446 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 4447 if (err < 0) 4448 goto unlock; 4449 4450 err = new_settings(hdev, sk); 4451 4452 unlock: 4453 hci_dev_unlock(hdev); 4454 return err; 4455 } 4456 4457 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 4458 void *data, u16 len) 4459 { 4460 struct mgmt_cp_set_scan_params *cp = data; 4461 __u16 interval, window; 4462 int err; 4463 4464 BT_DBG("%s", hdev->name); 4465 4466 if (!lmp_le_capable(hdev)) 4467 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4468 MGMT_STATUS_NOT_SUPPORTED); 4469 4470 interval = __le16_to_cpu(cp->interval); 4471 4472 if (interval < 0x0004 || interval > 0x4000) 4473 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4474 MGMT_STATUS_INVALID_PARAMS); 4475 4476 window = __le16_to_cpu(cp->window); 4477 4478 if (window < 0x0004 || window > 0x4000) 4479 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4480 MGMT_STATUS_INVALID_PARAMS); 4481 4482 if (window > interval) 4483 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 4484 MGMT_STATUS_INVALID_PARAMS); 4485 4486 hci_dev_lock(hdev); 4487 4488 hdev->le_scan_interval = interval; 4489 hdev->le_scan_window = window; 4490 4491 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 4492 NULL, 0); 4493 4494 /* If background scan is running, restart it so new parameters are 4495 * loaded. 4496 */ 4497 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 4498 hdev->discovery.state == DISCOVERY_STOPPED) { 4499 struct hci_request req; 4500 4501 hci_req_init(&req, hdev); 4502 4503 hci_req_add_le_scan_disable(&req); 4504 hci_req_add_le_passive_scan(&req); 4505 4506 hci_req_run(&req, NULL); 4507 } 4508 4509 hci_dev_unlock(hdev); 4510 4511 return err; 4512 } 4513 4514 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, 4515 u16 opcode) 4516 { 4517 struct mgmt_pending_cmd *cmd; 4518 4519 BT_DBG("status 0x%02x", status); 4520 4521 hci_dev_lock(hdev); 4522 4523 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 4524 if (!cmd) 4525 goto unlock; 4526 4527 if (status) { 4528 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4529 mgmt_status(status)); 4530 } else { 4531 struct mgmt_mode *cp = cmd->param; 4532 4533 if (cp->val) 4534 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 4535 else 4536 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 4537 4538 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 4539 new_settings(hdev, cmd->sk); 4540 } 4541 4542 mgmt_pending_remove(cmd); 4543 4544 unlock: 4545 hci_dev_unlock(hdev); 4546 } 4547 4548 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 4549 void *data, u16 len) 4550 { 4551 struct mgmt_mode *cp = data; 4552 struct mgmt_pending_cmd *cmd; 4553 struct hci_request req; 4554 int err; 4555 4556 BT_DBG("%s", hdev->name); 4557 4558 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 4559 hdev->hci_ver < BLUETOOTH_VER_1_2) 4560 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4561 MGMT_STATUS_NOT_SUPPORTED); 4562 4563 if (cp->val != 0x00 && cp->val != 0x01) 4564 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4565 MGMT_STATUS_INVALID_PARAMS); 4566 4567 hci_dev_lock(hdev); 4568 4569 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 4570 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4571 MGMT_STATUS_BUSY); 4572 goto unlock; 4573 } 4574 4575 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 4576 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 4577 hdev); 4578 goto unlock; 4579 } 4580 4581 if (!hdev_is_powered(hdev)) { 4582 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 4583 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 4584 hdev); 4585 new_settings(hdev, sk); 4586 goto unlock; 4587 } 4588 4589 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 4590 data, len); 4591 if (!cmd) { 4592 err = -ENOMEM; 4593 goto unlock; 4594 } 4595 4596 hci_req_init(&req, hdev); 4597 4598 __hci_req_write_fast_connectable(&req, cp->val); 4599 4600 err = hci_req_run(&req, fast_connectable_complete); 4601 if (err < 0) { 4602 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 4603 MGMT_STATUS_FAILED); 4604 mgmt_pending_remove(cmd); 4605 } 4606 4607 unlock: 4608 hci_dev_unlock(hdev); 4609 4610 return err; 4611 } 4612 4613 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode) 4614 { 4615 struct mgmt_pending_cmd *cmd; 4616 4617 BT_DBG("status 0x%02x", status); 4618 4619 hci_dev_lock(hdev); 4620 4621 cmd = pending_find(MGMT_OP_SET_BREDR, hdev); 4622 if (!cmd) 4623 goto unlock; 4624 4625 if (status) { 4626 u8 mgmt_err = mgmt_status(status); 4627 4628 /* We need to restore the flag if related HCI commands 4629 * failed. 4630 */ 4631 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 4632 4633 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 4634 } else { 4635 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 4636 new_settings(hdev, cmd->sk); 4637 } 4638 4639 mgmt_pending_remove(cmd); 4640 4641 unlock: 4642 hci_dev_unlock(hdev); 4643 } 4644 4645 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 4646 { 4647 struct mgmt_mode *cp = data; 4648 struct mgmt_pending_cmd *cmd; 4649 struct hci_request req; 4650 int err; 4651 4652 BT_DBG("request for %s", hdev->name); 4653 4654 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 4655 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4656 MGMT_STATUS_NOT_SUPPORTED); 4657 4658 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 4659 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4660 MGMT_STATUS_REJECTED); 4661 4662 if (cp->val != 0x00 && cp->val != 0x01) 4663 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4664 MGMT_STATUS_INVALID_PARAMS); 4665 4666 hci_dev_lock(hdev); 4667 4668 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 4669 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 4670 goto unlock; 4671 } 4672 4673 if (!hdev_is_powered(hdev)) { 4674 if (!cp->val) { 4675 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 4676 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 4677 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 4678 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 4679 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 4680 } 4681 4682 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 4683 4684 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 4685 if (err < 0) 4686 goto unlock; 4687 4688 err = new_settings(hdev, sk); 4689 goto unlock; 4690 } 4691 4692 /* Reject disabling when powered on */ 4693 if (!cp->val) { 4694 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4695 MGMT_STATUS_REJECTED); 4696 goto unlock; 4697 } else { 4698 /* When configuring a dual-mode controller to operate 4699 * with LE only and using a static address, then switching 4700 * BR/EDR back on is not allowed. 4701 * 4702 * Dual-mode controllers shall operate with the public 4703 * address as its identity address for BR/EDR and LE. So 4704 * reject the attempt to create an invalid configuration. 4705 * 4706 * The same restrictions applies when secure connections 4707 * has been enabled. For BR/EDR this is a controller feature 4708 * while for LE it is a host stack feature. This means that 4709 * switching BR/EDR back on when secure connections has been 4710 * enabled is not a supported transaction. 4711 */ 4712 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 4713 (bacmp(&hdev->static_addr, BDADDR_ANY) || 4714 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 4715 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4716 MGMT_STATUS_REJECTED); 4717 goto unlock; 4718 } 4719 } 4720 4721 if (pending_find(MGMT_OP_SET_BREDR, hdev)) { 4722 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 4723 MGMT_STATUS_BUSY); 4724 goto unlock; 4725 } 4726 4727 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 4728 if (!cmd) { 4729 err = -ENOMEM; 4730 goto unlock; 4731 } 4732 4733 /* We need to flip the bit already here so that 4734 * hci_req_update_adv_data generates the correct flags. 4735 */ 4736 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 4737 4738 hci_req_init(&req, hdev); 4739 4740 __hci_req_write_fast_connectable(&req, false); 4741 __hci_req_update_scan(&req); 4742 4743 /* Since only the advertising data flags will change, there 4744 * is no need to update the scan response data. 4745 */ 4746 __hci_req_update_adv_data(&req, hdev->cur_adv_instance); 4747 4748 err = hci_req_run(&req, set_bredr_complete); 4749 if (err < 0) 4750 mgmt_pending_remove(cmd); 4751 4752 unlock: 4753 hci_dev_unlock(hdev); 4754 return err; 4755 } 4756 4757 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 4758 { 4759 struct mgmt_pending_cmd *cmd; 4760 struct mgmt_mode *cp; 4761 4762 BT_DBG("%s status %u", hdev->name, status); 4763 4764 hci_dev_lock(hdev); 4765 4766 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev); 4767 if (!cmd) 4768 goto unlock; 4769 4770 if (status) { 4771 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 4772 mgmt_status(status)); 4773 goto remove; 4774 } 4775 4776 cp = cmd->param; 4777 4778 switch (cp->val) { 4779 case 0x00: 4780 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 4781 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4782 break; 4783 case 0x01: 4784 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 4785 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4786 break; 4787 case 0x02: 4788 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 4789 hci_dev_set_flag(hdev, HCI_SC_ONLY); 4790 break; 4791 } 4792 4793 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev); 4794 new_settings(hdev, cmd->sk); 4795 4796 remove: 4797 mgmt_pending_remove(cmd); 4798 unlock: 4799 hci_dev_unlock(hdev); 4800 } 4801 4802 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 4803 void *data, u16 len) 4804 { 4805 struct mgmt_mode *cp = data; 4806 struct mgmt_pending_cmd *cmd; 4807 struct hci_request req; 4808 u8 val; 4809 int err; 4810 4811 BT_DBG("request for %s", hdev->name); 4812 4813 if (!lmp_sc_capable(hdev) && 4814 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 4815 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4816 MGMT_STATUS_NOT_SUPPORTED); 4817 4818 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 4819 lmp_sc_capable(hdev) && 4820 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 4821 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4822 MGMT_STATUS_REJECTED); 4823 4824 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 4825 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4826 MGMT_STATUS_INVALID_PARAMS); 4827 4828 hci_dev_lock(hdev); 4829 4830 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 4831 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 4832 bool changed; 4833 4834 if (cp->val) { 4835 changed = !hci_dev_test_and_set_flag(hdev, 4836 HCI_SC_ENABLED); 4837 if (cp->val == 0x02) 4838 hci_dev_set_flag(hdev, HCI_SC_ONLY); 4839 else 4840 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4841 } else { 4842 changed = hci_dev_test_and_clear_flag(hdev, 4843 HCI_SC_ENABLED); 4844 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 4845 } 4846 4847 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 4848 if (err < 0) 4849 goto failed; 4850 4851 if (changed) 4852 err = new_settings(hdev, sk); 4853 4854 goto failed; 4855 } 4856 4857 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) { 4858 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 4859 MGMT_STATUS_BUSY); 4860 goto failed; 4861 } 4862 4863 val = !!cp->val; 4864 4865 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 4866 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 4867 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 4868 goto failed; 4869 } 4870 4871 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 4872 if (!cmd) { 4873 err = -ENOMEM; 4874 goto failed; 4875 } 4876 4877 hci_req_init(&req, hdev); 4878 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val); 4879 err = hci_req_run(&req, sc_enable_complete); 4880 if (err < 0) { 4881 mgmt_pending_remove(cmd); 4882 goto failed; 4883 } 4884 4885 failed: 4886 hci_dev_unlock(hdev); 4887 return err; 4888 } 4889 4890 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 4891 void *data, u16 len) 4892 { 4893 struct mgmt_mode *cp = data; 4894 bool changed, use_changed; 4895 int err; 4896 4897 BT_DBG("request for %s", hdev->name); 4898 4899 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 4900 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 4901 MGMT_STATUS_INVALID_PARAMS); 4902 4903 hci_dev_lock(hdev); 4904 4905 if (cp->val) 4906 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 4907 else 4908 changed = hci_dev_test_and_clear_flag(hdev, 4909 HCI_KEEP_DEBUG_KEYS); 4910 4911 if (cp->val == 0x02) 4912 use_changed = !hci_dev_test_and_set_flag(hdev, 4913 HCI_USE_DEBUG_KEYS); 4914 else 4915 use_changed = hci_dev_test_and_clear_flag(hdev, 4916 HCI_USE_DEBUG_KEYS); 4917 4918 if (hdev_is_powered(hdev) && use_changed && 4919 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 4920 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 4921 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 4922 sizeof(mode), &mode); 4923 } 4924 4925 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 4926 if (err < 0) 4927 goto unlock; 4928 4929 if (changed) 4930 err = new_settings(hdev, sk); 4931 4932 unlock: 4933 hci_dev_unlock(hdev); 4934 return err; 4935 } 4936 4937 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 4938 u16 len) 4939 { 4940 struct mgmt_cp_set_privacy *cp = cp_data; 4941 bool changed; 4942 int err; 4943 4944 BT_DBG("request for %s", hdev->name); 4945 4946 if (!lmp_le_capable(hdev)) 4947 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 4948 MGMT_STATUS_NOT_SUPPORTED); 4949 4950 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 4951 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 4952 MGMT_STATUS_INVALID_PARAMS); 4953 4954 if (hdev_is_powered(hdev)) 4955 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 4956 MGMT_STATUS_REJECTED); 4957 4958 hci_dev_lock(hdev); 4959 4960 /* If user space supports this command it is also expected to 4961 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 4962 */ 4963 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 4964 4965 if (cp->privacy) { 4966 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 4967 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 4968 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 4969 hci_adv_instances_set_rpa_expired(hdev, true); 4970 if (cp->privacy == 0x02) 4971 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 4972 else 4973 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 4974 } else { 4975 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 4976 memset(hdev->irk, 0, sizeof(hdev->irk)); 4977 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 4978 hci_adv_instances_set_rpa_expired(hdev, false); 4979 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 4980 } 4981 4982 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 4983 if (err < 0) 4984 goto unlock; 4985 4986 if (changed) 4987 err = new_settings(hdev, sk); 4988 4989 unlock: 4990 hci_dev_unlock(hdev); 4991 return err; 4992 } 4993 4994 static bool irk_is_valid(struct mgmt_irk_info *irk) 4995 { 4996 switch (irk->addr.type) { 4997 case BDADDR_LE_PUBLIC: 4998 return true; 4999 5000 case BDADDR_LE_RANDOM: 5001 /* Two most significant bits shall be set */ 5002 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 5003 return false; 5004 return true; 5005 } 5006 5007 return false; 5008 } 5009 5010 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 5011 u16 len) 5012 { 5013 struct mgmt_cp_load_irks *cp = cp_data; 5014 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 5015 sizeof(struct mgmt_irk_info)); 5016 u16 irk_count, expected_len; 5017 int i, err; 5018 5019 BT_DBG("request for %s", hdev->name); 5020 5021 if (!lmp_le_capable(hdev)) 5022 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 5023 MGMT_STATUS_NOT_SUPPORTED); 5024 5025 irk_count = __le16_to_cpu(cp->irk_count); 5026 if (irk_count > max_irk_count) { 5027 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 5028 irk_count); 5029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 5030 MGMT_STATUS_INVALID_PARAMS); 5031 } 5032 5033 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info); 5034 if (expected_len != len) { 5035 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 5036 expected_len, len); 5037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 5038 MGMT_STATUS_INVALID_PARAMS); 5039 } 5040 5041 BT_DBG("%s irk_count %u", hdev->name, irk_count); 5042 5043 for (i = 0; i < irk_count; i++) { 5044 struct mgmt_irk_info *key = &cp->irks[i]; 5045 5046 if (!irk_is_valid(key)) 5047 return mgmt_cmd_status(sk, hdev->id, 5048 MGMT_OP_LOAD_IRKS, 5049 MGMT_STATUS_INVALID_PARAMS); 5050 } 5051 5052 hci_dev_lock(hdev); 5053 5054 hci_smp_irks_clear(hdev); 5055 5056 for (i = 0; i < irk_count; i++) { 5057 struct mgmt_irk_info *irk = &cp->irks[i]; 5058 5059 hci_add_irk(hdev, &irk->addr.bdaddr, 5060 le_addr_type(irk->addr.type), irk->val, 5061 BDADDR_ANY); 5062 } 5063 5064 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 5065 5066 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 5067 5068 hci_dev_unlock(hdev); 5069 5070 return err; 5071 } 5072 5073 static bool ltk_is_valid(struct mgmt_ltk_info *key) 5074 { 5075 if (key->master != 0x00 && key->master != 0x01) 5076 return false; 5077 5078 switch (key->addr.type) { 5079 case BDADDR_LE_PUBLIC: 5080 return true; 5081 5082 case BDADDR_LE_RANDOM: 5083 /* Two most significant bits shall be set */ 5084 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 5085 return false; 5086 return true; 5087 } 5088 5089 return false; 5090 } 5091 5092 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 5093 void *cp_data, u16 len) 5094 { 5095 struct mgmt_cp_load_long_term_keys *cp = cp_data; 5096 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 5097 sizeof(struct mgmt_ltk_info)); 5098 u16 key_count, expected_len; 5099 int i, err; 5100 5101 BT_DBG("request for %s", hdev->name); 5102 5103 if (!lmp_le_capable(hdev)) 5104 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 5105 MGMT_STATUS_NOT_SUPPORTED); 5106 5107 key_count = __le16_to_cpu(cp->key_count); 5108 if (key_count > max_key_count) { 5109 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 5110 key_count); 5111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 5112 MGMT_STATUS_INVALID_PARAMS); 5113 } 5114 5115 expected_len = sizeof(*cp) + key_count * 5116 sizeof(struct mgmt_ltk_info); 5117 if (expected_len != len) { 5118 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 5119 expected_len, len); 5120 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 5121 MGMT_STATUS_INVALID_PARAMS); 5122 } 5123 5124 BT_DBG("%s key_count %u", hdev->name, key_count); 5125 5126 for (i = 0; i < key_count; i++) { 5127 struct mgmt_ltk_info *key = &cp->keys[i]; 5128 5129 if (!ltk_is_valid(key)) 5130 return mgmt_cmd_status(sk, hdev->id, 5131 MGMT_OP_LOAD_LONG_TERM_KEYS, 5132 MGMT_STATUS_INVALID_PARAMS); 5133 } 5134 5135 hci_dev_lock(hdev); 5136 5137 hci_smp_ltks_clear(hdev); 5138 5139 for (i = 0; i < key_count; i++) { 5140 struct mgmt_ltk_info *key = &cp->keys[i]; 5141 u8 type, authenticated; 5142 5143 switch (key->type) { 5144 case MGMT_LTK_UNAUTHENTICATED: 5145 authenticated = 0x00; 5146 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 5147 break; 5148 case MGMT_LTK_AUTHENTICATED: 5149 authenticated = 0x01; 5150 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 5151 break; 5152 case MGMT_LTK_P256_UNAUTH: 5153 authenticated = 0x00; 5154 type = SMP_LTK_P256; 5155 break; 5156 case MGMT_LTK_P256_AUTH: 5157 authenticated = 0x01; 5158 type = SMP_LTK_P256; 5159 break; 5160 case MGMT_LTK_P256_DEBUG: 5161 authenticated = 0x00; 5162 type = SMP_LTK_P256_DEBUG; 5163 /* fall through */ 5164 default: 5165 continue; 5166 } 5167 5168 hci_add_ltk(hdev, &key->addr.bdaddr, 5169 le_addr_type(key->addr.type), type, authenticated, 5170 key->val, key->enc_size, key->ediv, key->rand); 5171 } 5172 5173 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 5174 NULL, 0); 5175 5176 hci_dev_unlock(hdev); 5177 5178 return err; 5179 } 5180 5181 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 5182 { 5183 struct hci_conn *conn = cmd->user_data; 5184 struct mgmt_rp_get_conn_info rp; 5185 int err; 5186 5187 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 5188 5189 if (status == MGMT_STATUS_SUCCESS) { 5190 rp.rssi = conn->rssi; 5191 rp.tx_power = conn->tx_power; 5192 rp.max_tx_power = conn->max_tx_power; 5193 } else { 5194 rp.rssi = HCI_RSSI_INVALID; 5195 rp.tx_power = HCI_TX_POWER_INVALID; 5196 rp.max_tx_power = HCI_TX_POWER_INVALID; 5197 } 5198 5199 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, 5200 status, &rp, sizeof(rp)); 5201 5202 hci_conn_drop(conn); 5203 hci_conn_put(conn); 5204 5205 return err; 5206 } 5207 5208 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status, 5209 u16 opcode) 5210 { 5211 struct hci_cp_read_rssi *cp; 5212 struct mgmt_pending_cmd *cmd; 5213 struct hci_conn *conn; 5214 u16 handle; 5215 u8 status; 5216 5217 BT_DBG("status 0x%02x", hci_status); 5218 5219 hci_dev_lock(hdev); 5220 5221 /* Commands sent in request are either Read RSSI or Read Transmit Power 5222 * Level so we check which one was last sent to retrieve connection 5223 * handle. Both commands have handle as first parameter so it's safe to 5224 * cast data on the same command struct. 5225 * 5226 * First command sent is always Read RSSI and we fail only if it fails. 5227 * In other case we simply override error to indicate success as we 5228 * already remembered if TX power value is actually valid. 5229 */ 5230 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI); 5231 if (!cp) { 5232 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 5233 status = MGMT_STATUS_SUCCESS; 5234 } else { 5235 status = mgmt_status(hci_status); 5236 } 5237 5238 if (!cp) { 5239 bt_dev_err(hdev, "invalid sent_cmd in conn_info response"); 5240 goto unlock; 5241 } 5242 5243 handle = __le16_to_cpu(cp->handle); 5244 conn = hci_conn_hash_lookup_handle(hdev, handle); 5245 if (!conn) { 5246 bt_dev_err(hdev, "unknown handle (%d) in conn_info response", 5247 handle); 5248 goto unlock; 5249 } 5250 5251 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn); 5252 if (!cmd) 5253 goto unlock; 5254 5255 cmd->cmd_complete(cmd, status); 5256 mgmt_pending_remove(cmd); 5257 5258 unlock: 5259 hci_dev_unlock(hdev); 5260 } 5261 5262 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 5263 u16 len) 5264 { 5265 struct mgmt_cp_get_conn_info *cp = data; 5266 struct mgmt_rp_get_conn_info rp; 5267 struct hci_conn *conn; 5268 unsigned long conn_info_age; 5269 int err = 0; 5270 5271 BT_DBG("%s", hdev->name); 5272 5273 memset(&rp, 0, sizeof(rp)); 5274 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5275 rp.addr.type = cp->addr.type; 5276 5277 if (!bdaddr_type_is_valid(cp->addr.type)) 5278 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 5279 MGMT_STATUS_INVALID_PARAMS, 5280 &rp, sizeof(rp)); 5281 5282 hci_dev_lock(hdev); 5283 5284 if (!hdev_is_powered(hdev)) { 5285 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 5286 MGMT_STATUS_NOT_POWERED, &rp, 5287 sizeof(rp)); 5288 goto unlock; 5289 } 5290 5291 if (cp->addr.type == BDADDR_BREDR) 5292 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 5293 &cp->addr.bdaddr); 5294 else 5295 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 5296 5297 if (!conn || conn->state != BT_CONNECTED) { 5298 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 5299 MGMT_STATUS_NOT_CONNECTED, &rp, 5300 sizeof(rp)); 5301 goto unlock; 5302 } 5303 5304 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) { 5305 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 5306 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 5307 goto unlock; 5308 } 5309 5310 /* To avoid client trying to guess when to poll again for information we 5311 * calculate conn info age as random value between min/max set in hdev. 5312 */ 5313 conn_info_age = hdev->conn_info_min_age + 5314 prandom_u32_max(hdev->conn_info_max_age - 5315 hdev->conn_info_min_age); 5316 5317 /* Query controller to refresh cached values if they are too old or were 5318 * never read. 5319 */ 5320 if (time_after(jiffies, conn->conn_info_timestamp + 5321 msecs_to_jiffies(conn_info_age)) || 5322 !conn->conn_info_timestamp) { 5323 struct hci_request req; 5324 struct hci_cp_read_tx_power req_txp_cp; 5325 struct hci_cp_read_rssi req_rssi_cp; 5326 struct mgmt_pending_cmd *cmd; 5327 5328 hci_req_init(&req, hdev); 5329 req_rssi_cp.handle = cpu_to_le16(conn->handle); 5330 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp), 5331 &req_rssi_cp); 5332 5333 /* For LE links TX power does not change thus we don't need to 5334 * query for it once value is known. 5335 */ 5336 if (!bdaddr_type_is_le(cp->addr.type) || 5337 conn->tx_power == HCI_TX_POWER_INVALID) { 5338 req_txp_cp.handle = cpu_to_le16(conn->handle); 5339 req_txp_cp.type = 0x00; 5340 hci_req_add(&req, HCI_OP_READ_TX_POWER, 5341 sizeof(req_txp_cp), &req_txp_cp); 5342 } 5343 5344 /* Max TX power needs to be read only once per connection */ 5345 if (conn->max_tx_power == HCI_TX_POWER_INVALID) { 5346 req_txp_cp.handle = cpu_to_le16(conn->handle); 5347 req_txp_cp.type = 0x01; 5348 hci_req_add(&req, HCI_OP_READ_TX_POWER, 5349 sizeof(req_txp_cp), &req_txp_cp); 5350 } 5351 5352 err = hci_req_run(&req, conn_info_refresh_complete); 5353 if (err < 0) 5354 goto unlock; 5355 5356 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev, 5357 data, len); 5358 if (!cmd) { 5359 err = -ENOMEM; 5360 goto unlock; 5361 } 5362 5363 hci_conn_hold(conn); 5364 cmd->user_data = hci_conn_get(conn); 5365 cmd->cmd_complete = conn_info_cmd_complete; 5366 5367 conn->conn_info_timestamp = jiffies; 5368 } else { 5369 /* Cache is valid, just reply with values cached in hci_conn */ 5370 rp.rssi = conn->rssi; 5371 rp.tx_power = conn->tx_power; 5372 rp.max_tx_power = conn->max_tx_power; 5373 5374 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 5375 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 5376 } 5377 5378 unlock: 5379 hci_dev_unlock(hdev); 5380 return err; 5381 } 5382 5383 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 5384 { 5385 struct hci_conn *conn = cmd->user_data; 5386 struct mgmt_rp_get_clock_info rp; 5387 struct hci_dev *hdev; 5388 int err; 5389 5390 memset(&rp, 0, sizeof(rp)); 5391 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 5392 5393 if (status) 5394 goto complete; 5395 5396 hdev = hci_dev_get(cmd->index); 5397 if (hdev) { 5398 rp.local_clock = cpu_to_le32(hdev->clock); 5399 hci_dev_put(hdev); 5400 } 5401 5402 if (conn) { 5403 rp.piconet_clock = cpu_to_le32(conn->clock); 5404 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 5405 } 5406 5407 complete: 5408 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 5409 sizeof(rp)); 5410 5411 if (conn) { 5412 hci_conn_drop(conn); 5413 hci_conn_put(conn); 5414 } 5415 5416 return err; 5417 } 5418 5419 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5420 { 5421 struct hci_cp_read_clock *hci_cp; 5422 struct mgmt_pending_cmd *cmd; 5423 struct hci_conn *conn; 5424 5425 BT_DBG("%s status %u", hdev->name, status); 5426 5427 hci_dev_lock(hdev); 5428 5429 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 5430 if (!hci_cp) 5431 goto unlock; 5432 5433 if (hci_cp->which) { 5434 u16 handle = __le16_to_cpu(hci_cp->handle); 5435 conn = hci_conn_hash_lookup_handle(hdev, handle); 5436 } else { 5437 conn = NULL; 5438 } 5439 5440 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn); 5441 if (!cmd) 5442 goto unlock; 5443 5444 cmd->cmd_complete(cmd, mgmt_status(status)); 5445 mgmt_pending_remove(cmd); 5446 5447 unlock: 5448 hci_dev_unlock(hdev); 5449 } 5450 5451 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 5452 u16 len) 5453 { 5454 struct mgmt_cp_get_clock_info *cp = data; 5455 struct mgmt_rp_get_clock_info rp; 5456 struct hci_cp_read_clock hci_cp; 5457 struct mgmt_pending_cmd *cmd; 5458 struct hci_request req; 5459 struct hci_conn *conn; 5460 int err; 5461 5462 BT_DBG("%s", hdev->name); 5463 5464 memset(&rp, 0, sizeof(rp)); 5465 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5466 rp.addr.type = cp->addr.type; 5467 5468 if (cp->addr.type != BDADDR_BREDR) 5469 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 5470 MGMT_STATUS_INVALID_PARAMS, 5471 &rp, sizeof(rp)); 5472 5473 hci_dev_lock(hdev); 5474 5475 if (!hdev_is_powered(hdev)) { 5476 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 5477 MGMT_STATUS_NOT_POWERED, &rp, 5478 sizeof(rp)); 5479 goto unlock; 5480 } 5481 5482 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 5484 &cp->addr.bdaddr); 5485 if (!conn || conn->state != BT_CONNECTED) { 5486 err = mgmt_cmd_complete(sk, hdev->id, 5487 MGMT_OP_GET_CLOCK_INFO, 5488 MGMT_STATUS_NOT_CONNECTED, 5489 &rp, sizeof(rp)); 5490 goto unlock; 5491 } 5492 } else { 5493 conn = NULL; 5494 } 5495 5496 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 5497 if (!cmd) { 5498 err = -ENOMEM; 5499 goto unlock; 5500 } 5501 5502 cmd->cmd_complete = clock_info_cmd_complete; 5503 5504 hci_req_init(&req, hdev); 5505 5506 memset(&hci_cp, 0, sizeof(hci_cp)); 5507 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 5508 5509 if (conn) { 5510 hci_conn_hold(conn); 5511 cmd->user_data = hci_conn_get(conn); 5512 5513 hci_cp.handle = cpu_to_le16(conn->handle); 5514 hci_cp.which = 0x01; /* Piconet clock */ 5515 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 5516 } 5517 5518 err = hci_req_run(&req, get_clock_info_complete); 5519 if (err < 0) 5520 mgmt_pending_remove(cmd); 5521 5522 unlock: 5523 hci_dev_unlock(hdev); 5524 return err; 5525 } 5526 5527 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5528 { 5529 struct hci_conn *conn; 5530 5531 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5532 if (!conn) 5533 return false; 5534 5535 if (conn->dst_type != type) 5536 return false; 5537 5538 if (conn->state != BT_CONNECTED) 5539 return false; 5540 5541 return true; 5542 } 5543 5544 /* This function requires the caller holds hdev->lock */ 5545 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 5546 u8 addr_type, u8 auto_connect) 5547 { 5548 struct hci_conn_params *params; 5549 5550 params = hci_conn_params_add(hdev, addr, addr_type); 5551 if (!params) 5552 return -EIO; 5553 5554 if (params->auto_connect == auto_connect) 5555 return 0; 5556 5557 list_del_init(¶ms->action); 5558 5559 switch (auto_connect) { 5560 case HCI_AUTO_CONN_DISABLED: 5561 case HCI_AUTO_CONN_LINK_LOSS: 5562 /* If auto connect is being disabled when we're trying to 5563 * connect to device, keep connecting. 5564 */ 5565 if (params->explicit_connect) 5566 list_add(¶ms->action, &hdev->pend_le_conns); 5567 break; 5568 case HCI_AUTO_CONN_REPORT: 5569 if (params->explicit_connect) 5570 list_add(¶ms->action, &hdev->pend_le_conns); 5571 else 5572 list_add(¶ms->action, &hdev->pend_le_reports); 5573 break; 5574 case HCI_AUTO_CONN_DIRECT: 5575 case HCI_AUTO_CONN_ALWAYS: 5576 if (!is_connected(hdev, addr, addr_type)) 5577 list_add(¶ms->action, &hdev->pend_le_conns); 5578 break; 5579 } 5580 5581 params->auto_connect = auto_connect; 5582 5583 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type, 5584 auto_connect); 5585 5586 return 0; 5587 } 5588 5589 static void device_added(struct sock *sk, struct hci_dev *hdev, 5590 bdaddr_t *bdaddr, u8 type, u8 action) 5591 { 5592 struct mgmt_ev_device_added ev; 5593 5594 bacpy(&ev.addr.bdaddr, bdaddr); 5595 ev.addr.type = type; 5596 ev.action = action; 5597 5598 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 5599 } 5600 5601 static int add_device(struct sock *sk, struct hci_dev *hdev, 5602 void *data, u16 len) 5603 { 5604 struct mgmt_cp_add_device *cp = data; 5605 u8 auto_conn, addr_type; 5606 int err; 5607 5608 BT_DBG("%s", hdev->name); 5609 5610 if (!bdaddr_type_is_valid(cp->addr.type) || 5611 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 5612 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5613 MGMT_STATUS_INVALID_PARAMS, 5614 &cp->addr, sizeof(cp->addr)); 5615 5616 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 5617 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5618 MGMT_STATUS_INVALID_PARAMS, 5619 &cp->addr, sizeof(cp->addr)); 5620 5621 hci_dev_lock(hdev); 5622 5623 if (cp->addr.type == BDADDR_BREDR) { 5624 /* Only incoming connections action is supported for now */ 5625 if (cp->action != 0x01) { 5626 err = mgmt_cmd_complete(sk, hdev->id, 5627 MGMT_OP_ADD_DEVICE, 5628 MGMT_STATUS_INVALID_PARAMS, 5629 &cp->addr, sizeof(cp->addr)); 5630 goto unlock; 5631 } 5632 5633 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr, 5634 cp->addr.type); 5635 if (err) 5636 goto unlock; 5637 5638 hci_req_update_scan(hdev); 5639 5640 goto added; 5641 } 5642 5643 addr_type = le_addr_type(cp->addr.type); 5644 5645 if (cp->action == 0x02) 5646 auto_conn = HCI_AUTO_CONN_ALWAYS; 5647 else if (cp->action == 0x01) 5648 auto_conn = HCI_AUTO_CONN_DIRECT; 5649 else 5650 auto_conn = HCI_AUTO_CONN_REPORT; 5651 5652 /* Kernel internally uses conn_params with resolvable private 5653 * address, but Add Device allows only identity addresses. 5654 * Make sure it is enforced before calling 5655 * hci_conn_params_lookup. 5656 */ 5657 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 5658 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5659 MGMT_STATUS_INVALID_PARAMS, 5660 &cp->addr, sizeof(cp->addr)); 5661 goto unlock; 5662 } 5663 5664 /* If the connection parameters don't exist for this device, 5665 * they will be created and configured with defaults. 5666 */ 5667 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 5668 auto_conn) < 0) { 5669 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5670 MGMT_STATUS_FAILED, &cp->addr, 5671 sizeof(cp->addr)); 5672 goto unlock; 5673 } 5674 5675 hci_update_background_scan(hdev); 5676 5677 added: 5678 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 5679 5680 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 5681 MGMT_STATUS_SUCCESS, &cp->addr, 5682 sizeof(cp->addr)); 5683 5684 unlock: 5685 hci_dev_unlock(hdev); 5686 return err; 5687 } 5688 5689 static void device_removed(struct sock *sk, struct hci_dev *hdev, 5690 bdaddr_t *bdaddr, u8 type) 5691 { 5692 struct mgmt_ev_device_removed ev; 5693 5694 bacpy(&ev.addr.bdaddr, bdaddr); 5695 ev.addr.type = type; 5696 5697 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 5698 } 5699 5700 static int remove_device(struct sock *sk, struct hci_dev *hdev, 5701 void *data, u16 len) 5702 { 5703 struct mgmt_cp_remove_device *cp = data; 5704 int err; 5705 5706 BT_DBG("%s", hdev->name); 5707 5708 hci_dev_lock(hdev); 5709 5710 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5711 struct hci_conn_params *params; 5712 u8 addr_type; 5713 5714 if (!bdaddr_type_is_valid(cp->addr.type)) { 5715 err = mgmt_cmd_complete(sk, hdev->id, 5716 MGMT_OP_REMOVE_DEVICE, 5717 MGMT_STATUS_INVALID_PARAMS, 5718 &cp->addr, sizeof(cp->addr)); 5719 goto unlock; 5720 } 5721 5722 if (cp->addr.type == BDADDR_BREDR) { 5723 err = hci_bdaddr_list_del(&hdev->whitelist, 5724 &cp->addr.bdaddr, 5725 cp->addr.type); 5726 if (err) { 5727 err = mgmt_cmd_complete(sk, hdev->id, 5728 MGMT_OP_REMOVE_DEVICE, 5729 MGMT_STATUS_INVALID_PARAMS, 5730 &cp->addr, 5731 sizeof(cp->addr)); 5732 goto unlock; 5733 } 5734 5735 hci_req_update_scan(hdev); 5736 5737 device_removed(sk, hdev, &cp->addr.bdaddr, 5738 cp->addr.type); 5739 goto complete; 5740 } 5741 5742 addr_type = le_addr_type(cp->addr.type); 5743 5744 /* Kernel internally uses conn_params with resolvable private 5745 * address, but Remove Device allows only identity addresses. 5746 * Make sure it is enforced before calling 5747 * hci_conn_params_lookup. 5748 */ 5749 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 5750 err = mgmt_cmd_complete(sk, hdev->id, 5751 MGMT_OP_REMOVE_DEVICE, 5752 MGMT_STATUS_INVALID_PARAMS, 5753 &cp->addr, sizeof(cp->addr)); 5754 goto unlock; 5755 } 5756 5757 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5758 addr_type); 5759 if (!params) { 5760 err = mgmt_cmd_complete(sk, hdev->id, 5761 MGMT_OP_REMOVE_DEVICE, 5762 MGMT_STATUS_INVALID_PARAMS, 5763 &cp->addr, sizeof(cp->addr)); 5764 goto unlock; 5765 } 5766 5767 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 5768 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 5769 err = mgmt_cmd_complete(sk, hdev->id, 5770 MGMT_OP_REMOVE_DEVICE, 5771 MGMT_STATUS_INVALID_PARAMS, 5772 &cp->addr, sizeof(cp->addr)); 5773 goto unlock; 5774 } 5775 5776 list_del(¶ms->action); 5777 list_del(¶ms->list); 5778 kfree(params); 5779 hci_update_background_scan(hdev); 5780 5781 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 5782 } else { 5783 struct hci_conn_params *p, *tmp; 5784 struct bdaddr_list *b, *btmp; 5785 5786 if (cp->addr.type) { 5787 err = mgmt_cmd_complete(sk, hdev->id, 5788 MGMT_OP_REMOVE_DEVICE, 5789 MGMT_STATUS_INVALID_PARAMS, 5790 &cp->addr, sizeof(cp->addr)); 5791 goto unlock; 5792 } 5793 5794 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) { 5795 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 5796 list_del(&b->list); 5797 kfree(b); 5798 } 5799 5800 hci_req_update_scan(hdev); 5801 5802 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 5803 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 5804 continue; 5805 device_removed(sk, hdev, &p->addr, p->addr_type); 5806 if (p->explicit_connect) { 5807 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 5808 continue; 5809 } 5810 list_del(&p->action); 5811 list_del(&p->list); 5812 kfree(p); 5813 } 5814 5815 BT_DBG("All LE connection parameters were removed"); 5816 5817 hci_update_background_scan(hdev); 5818 } 5819 5820 complete: 5821 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 5822 MGMT_STATUS_SUCCESS, &cp->addr, 5823 sizeof(cp->addr)); 5824 unlock: 5825 hci_dev_unlock(hdev); 5826 return err; 5827 } 5828 5829 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 5830 u16 len) 5831 { 5832 struct mgmt_cp_load_conn_param *cp = data; 5833 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 5834 sizeof(struct mgmt_conn_param)); 5835 u16 param_count, expected_len; 5836 int i; 5837 5838 if (!lmp_le_capable(hdev)) 5839 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 5840 MGMT_STATUS_NOT_SUPPORTED); 5841 5842 param_count = __le16_to_cpu(cp->param_count); 5843 if (param_count > max_param_count) { 5844 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 5845 param_count); 5846 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 5847 MGMT_STATUS_INVALID_PARAMS); 5848 } 5849 5850 expected_len = sizeof(*cp) + param_count * 5851 sizeof(struct mgmt_conn_param); 5852 if (expected_len != len) { 5853 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 5854 expected_len, len); 5855 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 5856 MGMT_STATUS_INVALID_PARAMS); 5857 } 5858 5859 BT_DBG("%s param_count %u", hdev->name, param_count); 5860 5861 hci_dev_lock(hdev); 5862 5863 hci_conn_params_clear_disabled(hdev); 5864 5865 for (i = 0; i < param_count; i++) { 5866 struct mgmt_conn_param *param = &cp->params[i]; 5867 struct hci_conn_params *hci_param; 5868 u16 min, max, latency, timeout; 5869 u8 addr_type; 5870 5871 BT_DBG("Adding %pMR (type %u)", ¶m->addr.bdaddr, 5872 param->addr.type); 5873 5874 if (param->addr.type == BDADDR_LE_PUBLIC) { 5875 addr_type = ADDR_LE_DEV_PUBLIC; 5876 } else if (param->addr.type == BDADDR_LE_RANDOM) { 5877 addr_type = ADDR_LE_DEV_RANDOM; 5878 } else { 5879 bt_dev_err(hdev, "ignoring invalid connection parameters"); 5880 continue; 5881 } 5882 5883 min = le16_to_cpu(param->min_interval); 5884 max = le16_to_cpu(param->max_interval); 5885 latency = le16_to_cpu(param->latency); 5886 timeout = le16_to_cpu(param->timeout); 5887 5888 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 5889 min, max, latency, timeout); 5890 5891 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 5892 bt_dev_err(hdev, "ignoring invalid connection parameters"); 5893 continue; 5894 } 5895 5896 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 5897 addr_type); 5898 if (!hci_param) { 5899 bt_dev_err(hdev, "failed to add connection parameters"); 5900 continue; 5901 } 5902 5903 hci_param->conn_min_interval = min; 5904 hci_param->conn_max_interval = max; 5905 hci_param->conn_latency = latency; 5906 hci_param->supervision_timeout = timeout; 5907 } 5908 5909 hci_dev_unlock(hdev); 5910 5911 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 5912 NULL, 0); 5913 } 5914 5915 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 5916 void *data, u16 len) 5917 { 5918 struct mgmt_cp_set_external_config *cp = data; 5919 bool changed; 5920 int err; 5921 5922 BT_DBG("%s", hdev->name); 5923 5924 if (hdev_is_powered(hdev)) 5925 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 5926 MGMT_STATUS_REJECTED); 5927 5928 if (cp->config != 0x00 && cp->config != 0x01) 5929 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 5930 MGMT_STATUS_INVALID_PARAMS); 5931 5932 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 5933 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 5934 MGMT_STATUS_NOT_SUPPORTED); 5935 5936 hci_dev_lock(hdev); 5937 5938 if (cp->config) 5939 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 5940 else 5941 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 5942 5943 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 5944 if (err < 0) 5945 goto unlock; 5946 5947 if (!changed) 5948 goto unlock; 5949 5950 err = new_options(hdev, sk); 5951 5952 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 5953 mgmt_index_removed(hdev); 5954 5955 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 5956 hci_dev_set_flag(hdev, HCI_CONFIG); 5957 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 5958 5959 queue_work(hdev->req_workqueue, &hdev->power_on); 5960 } else { 5961 set_bit(HCI_RAW, &hdev->flags); 5962 mgmt_index_added(hdev); 5963 } 5964 } 5965 5966 unlock: 5967 hci_dev_unlock(hdev); 5968 return err; 5969 } 5970 5971 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 5972 void *data, u16 len) 5973 { 5974 struct mgmt_cp_set_public_address *cp = data; 5975 bool changed; 5976 int err; 5977 5978 BT_DBG("%s", hdev->name); 5979 5980 if (hdev_is_powered(hdev)) 5981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 5982 MGMT_STATUS_REJECTED); 5983 5984 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 5985 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 5986 MGMT_STATUS_INVALID_PARAMS); 5987 5988 if (!hdev->set_bdaddr) 5989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 5990 MGMT_STATUS_NOT_SUPPORTED); 5991 5992 hci_dev_lock(hdev); 5993 5994 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 5995 bacpy(&hdev->public_addr, &cp->bdaddr); 5996 5997 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 5998 if (err < 0) 5999 goto unlock; 6000 6001 if (!changed) 6002 goto unlock; 6003 6004 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 6005 err = new_options(hdev, sk); 6006 6007 if (is_configured(hdev)) { 6008 mgmt_index_removed(hdev); 6009 6010 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 6011 6012 hci_dev_set_flag(hdev, HCI_CONFIG); 6013 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 6014 6015 queue_work(hdev->req_workqueue, &hdev->power_on); 6016 } 6017 6018 unlock: 6019 hci_dev_unlock(hdev); 6020 return err; 6021 } 6022 6023 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status, 6024 u16 opcode, struct sk_buff *skb) 6025 { 6026 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 6027 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 6028 u8 *h192, *r192, *h256, *r256; 6029 struct mgmt_pending_cmd *cmd; 6030 u16 eir_len; 6031 int err; 6032 6033 BT_DBG("%s status %u", hdev->name, status); 6034 6035 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev); 6036 if (!cmd) 6037 return; 6038 6039 mgmt_cp = cmd->param; 6040 6041 if (status) { 6042 status = mgmt_status(status); 6043 eir_len = 0; 6044 6045 h192 = NULL; 6046 r192 = NULL; 6047 h256 = NULL; 6048 r256 = NULL; 6049 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 6050 struct hci_rp_read_local_oob_data *rp; 6051 6052 if (skb->len != sizeof(*rp)) { 6053 status = MGMT_STATUS_FAILED; 6054 eir_len = 0; 6055 } else { 6056 status = MGMT_STATUS_SUCCESS; 6057 rp = (void *)skb->data; 6058 6059 eir_len = 5 + 18 + 18; 6060 h192 = rp->hash; 6061 r192 = rp->rand; 6062 h256 = NULL; 6063 r256 = NULL; 6064 } 6065 } else { 6066 struct hci_rp_read_local_oob_ext_data *rp; 6067 6068 if (skb->len != sizeof(*rp)) { 6069 status = MGMT_STATUS_FAILED; 6070 eir_len = 0; 6071 } else { 6072 status = MGMT_STATUS_SUCCESS; 6073 rp = (void *)skb->data; 6074 6075 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6076 eir_len = 5 + 18 + 18; 6077 h192 = NULL; 6078 r192 = NULL; 6079 } else { 6080 eir_len = 5 + 18 + 18 + 18 + 18; 6081 h192 = rp->hash192; 6082 r192 = rp->rand192; 6083 } 6084 6085 h256 = rp->hash256; 6086 r256 = rp->rand256; 6087 } 6088 } 6089 6090 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 6091 if (!mgmt_rp) 6092 goto done; 6093 6094 if (status) 6095 goto send_rsp; 6096 6097 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 6098 hdev->dev_class, 3); 6099 6100 if (h192 && r192) { 6101 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6102 EIR_SSP_HASH_C192, h192, 16); 6103 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6104 EIR_SSP_RAND_R192, r192, 16); 6105 } 6106 6107 if (h256 && r256) { 6108 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6109 EIR_SSP_HASH_C256, h256, 16); 6110 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6111 EIR_SSP_RAND_R256, r256, 16); 6112 } 6113 6114 send_rsp: 6115 mgmt_rp->type = mgmt_cp->type; 6116 mgmt_rp->eir_len = cpu_to_le16(eir_len); 6117 6118 err = mgmt_cmd_complete(cmd->sk, hdev->id, 6119 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 6120 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 6121 if (err < 0 || status) 6122 goto done; 6123 6124 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 6125 6126 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 6127 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 6128 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 6129 done: 6130 kfree(mgmt_rp); 6131 mgmt_pending_remove(cmd); 6132 } 6133 6134 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 6135 struct mgmt_cp_read_local_oob_ext_data *cp) 6136 { 6137 struct mgmt_pending_cmd *cmd; 6138 struct hci_request req; 6139 int err; 6140 6141 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 6142 cp, sizeof(*cp)); 6143 if (!cmd) 6144 return -ENOMEM; 6145 6146 hci_req_init(&req, hdev); 6147 6148 if (bredr_sc_enabled(hdev)) 6149 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 6150 else 6151 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 6152 6153 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete); 6154 if (err < 0) { 6155 mgmt_pending_remove(cmd); 6156 return err; 6157 } 6158 6159 return 0; 6160 } 6161 6162 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 6163 void *data, u16 data_len) 6164 { 6165 struct mgmt_cp_read_local_oob_ext_data *cp = data; 6166 struct mgmt_rp_read_local_oob_ext_data *rp; 6167 size_t rp_len; 6168 u16 eir_len; 6169 u8 status, flags, role, addr[7], hash[16], rand[16]; 6170 int err; 6171 6172 BT_DBG("%s", hdev->name); 6173 6174 if (hdev_is_powered(hdev)) { 6175 switch (cp->type) { 6176 case BIT(BDADDR_BREDR): 6177 status = mgmt_bredr_support(hdev); 6178 if (status) 6179 eir_len = 0; 6180 else 6181 eir_len = 5; 6182 break; 6183 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 6184 status = mgmt_le_support(hdev); 6185 if (status) 6186 eir_len = 0; 6187 else 6188 eir_len = 9 + 3 + 18 + 18 + 3; 6189 break; 6190 default: 6191 status = MGMT_STATUS_INVALID_PARAMS; 6192 eir_len = 0; 6193 break; 6194 } 6195 } else { 6196 status = MGMT_STATUS_NOT_POWERED; 6197 eir_len = 0; 6198 } 6199 6200 rp_len = sizeof(*rp) + eir_len; 6201 rp = kmalloc(rp_len, GFP_ATOMIC); 6202 if (!rp) 6203 return -ENOMEM; 6204 6205 if (status) 6206 goto complete; 6207 6208 hci_dev_lock(hdev); 6209 6210 eir_len = 0; 6211 switch (cp->type) { 6212 case BIT(BDADDR_BREDR): 6213 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6214 err = read_local_ssp_oob_req(hdev, sk, cp); 6215 hci_dev_unlock(hdev); 6216 if (!err) 6217 goto done; 6218 6219 status = MGMT_STATUS_FAILED; 6220 goto complete; 6221 } else { 6222 eir_len = eir_append_data(rp->eir, eir_len, 6223 EIR_CLASS_OF_DEV, 6224 hdev->dev_class, 3); 6225 } 6226 break; 6227 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 6228 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6229 smp_generate_oob(hdev, hash, rand) < 0) { 6230 hci_dev_unlock(hdev); 6231 status = MGMT_STATUS_FAILED; 6232 goto complete; 6233 } 6234 6235 /* This should return the active RPA, but since the RPA 6236 * is only programmed on demand, it is really hard to fill 6237 * this in at the moment. For now disallow retrieving 6238 * local out-of-band data when privacy is in use. 6239 * 6240 * Returning the identity address will not help here since 6241 * pairing happens before the identity resolving key is 6242 * known and thus the connection establishment happens 6243 * based on the RPA and not the identity address. 6244 */ 6245 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 6246 hci_dev_unlock(hdev); 6247 status = MGMT_STATUS_REJECTED; 6248 goto complete; 6249 } 6250 6251 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 6252 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 6253 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6254 bacmp(&hdev->static_addr, BDADDR_ANY))) { 6255 memcpy(addr, &hdev->static_addr, 6); 6256 addr[6] = 0x01; 6257 } else { 6258 memcpy(addr, &hdev->bdaddr, 6); 6259 addr[6] = 0x00; 6260 } 6261 6262 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 6263 addr, sizeof(addr)); 6264 6265 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 6266 role = 0x02; 6267 else 6268 role = 0x01; 6269 6270 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 6271 &role, sizeof(role)); 6272 6273 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 6274 eir_len = eir_append_data(rp->eir, eir_len, 6275 EIR_LE_SC_CONFIRM, 6276 hash, sizeof(hash)); 6277 6278 eir_len = eir_append_data(rp->eir, eir_len, 6279 EIR_LE_SC_RANDOM, 6280 rand, sizeof(rand)); 6281 } 6282 6283 flags = mgmt_get_adv_discov_flags(hdev); 6284 6285 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 6286 flags |= LE_AD_NO_BREDR; 6287 6288 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 6289 &flags, sizeof(flags)); 6290 break; 6291 } 6292 6293 hci_dev_unlock(hdev); 6294 6295 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 6296 6297 status = MGMT_STATUS_SUCCESS; 6298 6299 complete: 6300 rp->type = cp->type; 6301 rp->eir_len = cpu_to_le16(eir_len); 6302 6303 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 6304 status, rp, sizeof(*rp) + eir_len); 6305 if (err < 0 || status) 6306 goto done; 6307 6308 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 6309 rp, sizeof(*rp) + eir_len, 6310 HCI_MGMT_OOB_DATA_EVENTS, sk); 6311 6312 done: 6313 kfree(rp); 6314 6315 return err; 6316 } 6317 6318 static u32 get_supported_adv_flags(struct hci_dev *hdev) 6319 { 6320 u32 flags = 0; 6321 6322 flags |= MGMT_ADV_FLAG_CONNECTABLE; 6323 flags |= MGMT_ADV_FLAG_DISCOV; 6324 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 6325 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 6326 flags |= MGMT_ADV_FLAG_APPEARANCE; 6327 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 6328 6329 /* In extended adv TX_POWER returned from Set Adv Param 6330 * will be always valid. 6331 */ 6332 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 6333 ext_adv_capable(hdev)) 6334 flags |= MGMT_ADV_FLAG_TX_POWER; 6335 6336 if (ext_adv_capable(hdev)) { 6337 flags |= MGMT_ADV_FLAG_SEC_1M; 6338 6339 if (hdev->le_features[1] & HCI_LE_PHY_2M) 6340 flags |= MGMT_ADV_FLAG_SEC_2M; 6341 6342 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 6343 flags |= MGMT_ADV_FLAG_SEC_CODED; 6344 } 6345 6346 return flags; 6347 } 6348 6349 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 6350 void *data, u16 data_len) 6351 { 6352 struct mgmt_rp_read_adv_features *rp; 6353 size_t rp_len; 6354 int err; 6355 struct adv_info *adv_instance; 6356 u32 supported_flags; 6357 u8 *instance; 6358 6359 BT_DBG("%s", hdev->name); 6360 6361 if (!lmp_le_capable(hdev)) 6362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 6363 MGMT_STATUS_REJECTED); 6364 6365 hci_dev_lock(hdev); 6366 6367 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 6368 rp = kmalloc(rp_len, GFP_ATOMIC); 6369 if (!rp) { 6370 hci_dev_unlock(hdev); 6371 return -ENOMEM; 6372 } 6373 6374 supported_flags = get_supported_adv_flags(hdev); 6375 6376 rp->supported_flags = cpu_to_le32(supported_flags); 6377 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 6378 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 6379 rp->max_instances = HCI_MAX_ADV_INSTANCES; 6380 rp->num_instances = hdev->adv_instance_cnt; 6381 6382 instance = rp->instance; 6383 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 6384 *instance = adv_instance->instance; 6385 instance++; 6386 } 6387 6388 hci_dev_unlock(hdev); 6389 6390 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 6391 MGMT_STATUS_SUCCESS, rp, rp_len); 6392 6393 kfree(rp); 6394 6395 return err; 6396 } 6397 6398 static u8 calculate_name_len(struct hci_dev *hdev) 6399 { 6400 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 6401 6402 return append_local_name(hdev, buf, 0); 6403 } 6404 6405 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 6406 bool is_adv_data) 6407 { 6408 u8 max_len = HCI_MAX_AD_LENGTH; 6409 6410 if (is_adv_data) { 6411 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 6412 MGMT_ADV_FLAG_LIMITED_DISCOV | 6413 MGMT_ADV_FLAG_MANAGED_FLAGS)) 6414 max_len -= 3; 6415 6416 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 6417 max_len -= 3; 6418 } else { 6419 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 6420 max_len -= calculate_name_len(hdev); 6421 6422 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 6423 max_len -= 4; 6424 } 6425 6426 return max_len; 6427 } 6428 6429 static bool flags_managed(u32 adv_flags) 6430 { 6431 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 6432 MGMT_ADV_FLAG_LIMITED_DISCOV | 6433 MGMT_ADV_FLAG_MANAGED_FLAGS); 6434 } 6435 6436 static bool tx_power_managed(u32 adv_flags) 6437 { 6438 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 6439 } 6440 6441 static bool name_managed(u32 adv_flags) 6442 { 6443 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 6444 } 6445 6446 static bool appearance_managed(u32 adv_flags) 6447 { 6448 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 6449 } 6450 6451 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 6452 u8 len, bool is_adv_data) 6453 { 6454 int i, cur_len; 6455 u8 max_len; 6456 6457 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 6458 6459 if (len > max_len) 6460 return false; 6461 6462 /* Make sure that the data is correctly formatted. */ 6463 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 6464 cur_len = data[i]; 6465 6466 if (data[i + 1] == EIR_FLAGS && 6467 (!is_adv_data || flags_managed(adv_flags))) 6468 return false; 6469 6470 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 6471 return false; 6472 6473 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 6474 return false; 6475 6476 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 6477 return false; 6478 6479 if (data[i + 1] == EIR_APPEARANCE && 6480 appearance_managed(adv_flags)) 6481 return false; 6482 6483 /* If the current field length would exceed the total data 6484 * length, then it's invalid. 6485 */ 6486 if (i + cur_len >= len) 6487 return false; 6488 } 6489 6490 return true; 6491 } 6492 6493 static void add_advertising_complete(struct hci_dev *hdev, u8 status, 6494 u16 opcode) 6495 { 6496 struct mgmt_pending_cmd *cmd; 6497 struct mgmt_cp_add_advertising *cp; 6498 struct mgmt_rp_add_advertising rp; 6499 struct adv_info *adv_instance, *n; 6500 u8 instance; 6501 6502 BT_DBG("status %d", status); 6503 6504 hci_dev_lock(hdev); 6505 6506 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev); 6507 6508 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 6509 if (!adv_instance->pending) 6510 continue; 6511 6512 if (!status) { 6513 adv_instance->pending = false; 6514 continue; 6515 } 6516 6517 instance = adv_instance->instance; 6518 6519 if (hdev->cur_adv_instance == instance) 6520 cancel_adv_timeout(hdev); 6521 6522 hci_remove_adv_instance(hdev, instance); 6523 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance); 6524 } 6525 6526 if (!cmd) 6527 goto unlock; 6528 6529 cp = cmd->param; 6530 rp.instance = cp->instance; 6531 6532 if (status) 6533 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 6534 mgmt_status(status)); 6535 else 6536 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 6537 mgmt_status(status), &rp, sizeof(rp)); 6538 6539 mgmt_pending_remove(cmd); 6540 6541 unlock: 6542 hci_dev_unlock(hdev); 6543 } 6544 6545 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 6546 void *data, u16 data_len) 6547 { 6548 struct mgmt_cp_add_advertising *cp = data; 6549 struct mgmt_rp_add_advertising rp; 6550 u32 flags; 6551 u32 supported_flags, phy_flags; 6552 u8 status; 6553 u16 timeout, duration; 6554 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 6555 u8 schedule_instance = 0; 6556 struct adv_info *next_instance; 6557 int err; 6558 struct mgmt_pending_cmd *cmd; 6559 struct hci_request req; 6560 6561 BT_DBG("%s", hdev->name); 6562 6563 status = mgmt_le_support(hdev); 6564 if (status) 6565 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6566 status); 6567 6568 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES) 6569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6570 MGMT_STATUS_INVALID_PARAMS); 6571 6572 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 6573 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6574 MGMT_STATUS_INVALID_PARAMS); 6575 6576 flags = __le32_to_cpu(cp->flags); 6577 timeout = __le16_to_cpu(cp->timeout); 6578 duration = __le16_to_cpu(cp->duration); 6579 6580 /* The current implementation only supports a subset of the specified 6581 * flags. Also need to check mutual exclusiveness of sec flags. 6582 */ 6583 supported_flags = get_supported_adv_flags(hdev); 6584 phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK; 6585 if (flags & ~supported_flags || 6586 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 6587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6588 MGMT_STATUS_INVALID_PARAMS); 6589 6590 hci_dev_lock(hdev); 6591 6592 if (timeout && !hdev_is_powered(hdev)) { 6593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6594 MGMT_STATUS_REJECTED); 6595 goto unlock; 6596 } 6597 6598 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 6599 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 6600 pending_find(MGMT_OP_SET_LE, hdev)) { 6601 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6602 MGMT_STATUS_BUSY); 6603 goto unlock; 6604 } 6605 6606 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 6607 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 6608 cp->scan_rsp_len, false)) { 6609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6610 MGMT_STATUS_INVALID_PARAMS); 6611 goto unlock; 6612 } 6613 6614 err = hci_add_adv_instance(hdev, cp->instance, flags, 6615 cp->adv_data_len, cp->data, 6616 cp->scan_rsp_len, 6617 cp->data + cp->adv_data_len, 6618 timeout, duration); 6619 if (err < 0) { 6620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6621 MGMT_STATUS_FAILED); 6622 goto unlock; 6623 } 6624 6625 /* Only trigger an advertising added event if a new instance was 6626 * actually added. 6627 */ 6628 if (hdev->adv_instance_cnt > prev_instance_cnt) 6629 mgmt_advertising_added(sk, hdev, cp->instance); 6630 6631 if (hdev->cur_adv_instance == cp->instance) { 6632 /* If the currently advertised instance is being changed then 6633 * cancel the current advertising and schedule the next 6634 * instance. If there is only one instance then the overridden 6635 * advertising data will be visible right away. 6636 */ 6637 cancel_adv_timeout(hdev); 6638 6639 next_instance = hci_get_next_instance(hdev, cp->instance); 6640 if (next_instance) 6641 schedule_instance = next_instance->instance; 6642 } else if (!hdev->adv_instance_timeout) { 6643 /* Immediately advertise the new instance if no other 6644 * instance is currently being advertised. 6645 */ 6646 schedule_instance = cp->instance; 6647 } 6648 6649 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 6650 * there is no instance to be advertised then we have no HCI 6651 * communication to make. Simply return. 6652 */ 6653 if (!hdev_is_powered(hdev) || 6654 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6655 !schedule_instance) { 6656 rp.instance = cp->instance; 6657 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 6658 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6659 goto unlock; 6660 } 6661 6662 /* We're good to go, update advertising data, parameters, and start 6663 * advertising. 6664 */ 6665 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 6666 data_len); 6667 if (!cmd) { 6668 err = -ENOMEM; 6669 goto unlock; 6670 } 6671 6672 hci_req_init(&req, hdev); 6673 6674 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true); 6675 6676 if (!err) 6677 err = hci_req_run(&req, add_advertising_complete); 6678 6679 if (err < 0) 6680 mgmt_pending_remove(cmd); 6681 6682 unlock: 6683 hci_dev_unlock(hdev); 6684 6685 return err; 6686 } 6687 6688 static void remove_advertising_complete(struct hci_dev *hdev, u8 status, 6689 u16 opcode) 6690 { 6691 struct mgmt_pending_cmd *cmd; 6692 struct mgmt_cp_remove_advertising *cp; 6693 struct mgmt_rp_remove_advertising rp; 6694 6695 BT_DBG("status %d", status); 6696 6697 hci_dev_lock(hdev); 6698 6699 /* A failure status here only means that we failed to disable 6700 * advertising. Otherwise, the advertising instance has been removed, 6701 * so report success. 6702 */ 6703 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev); 6704 if (!cmd) 6705 goto unlock; 6706 6707 cp = cmd->param; 6708 rp.instance = cp->instance; 6709 6710 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS, 6711 &rp, sizeof(rp)); 6712 mgmt_pending_remove(cmd); 6713 6714 unlock: 6715 hci_dev_unlock(hdev); 6716 } 6717 6718 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 6719 void *data, u16 data_len) 6720 { 6721 struct mgmt_cp_remove_advertising *cp = data; 6722 struct mgmt_rp_remove_advertising rp; 6723 struct mgmt_pending_cmd *cmd; 6724 struct hci_request req; 6725 int err; 6726 6727 BT_DBG("%s", hdev->name); 6728 6729 hci_dev_lock(hdev); 6730 6731 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 6732 err = mgmt_cmd_status(sk, hdev->id, 6733 MGMT_OP_REMOVE_ADVERTISING, 6734 MGMT_STATUS_INVALID_PARAMS); 6735 goto unlock; 6736 } 6737 6738 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 6739 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 6740 pending_find(MGMT_OP_SET_LE, hdev)) { 6741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 6742 MGMT_STATUS_BUSY); 6743 goto unlock; 6744 } 6745 6746 if (list_empty(&hdev->adv_instances)) { 6747 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 6748 MGMT_STATUS_INVALID_PARAMS); 6749 goto unlock; 6750 } 6751 6752 hci_req_init(&req, hdev); 6753 6754 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true); 6755 6756 if (list_empty(&hdev->adv_instances)) 6757 __hci_req_disable_advertising(&req); 6758 6759 /* If no HCI commands have been collected so far or the HCI_ADVERTISING 6760 * flag is set or the device isn't powered then we have no HCI 6761 * communication to make. Simply return. 6762 */ 6763 if (skb_queue_empty(&req.cmd_q) || 6764 !hdev_is_powered(hdev) || 6765 hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 6766 hci_req_purge(&req); 6767 rp.instance = cp->instance; 6768 err = mgmt_cmd_complete(sk, hdev->id, 6769 MGMT_OP_REMOVE_ADVERTISING, 6770 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6771 goto unlock; 6772 } 6773 6774 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 6775 data_len); 6776 if (!cmd) { 6777 err = -ENOMEM; 6778 goto unlock; 6779 } 6780 6781 err = hci_req_run(&req, remove_advertising_complete); 6782 if (err < 0) 6783 mgmt_pending_remove(cmd); 6784 6785 unlock: 6786 hci_dev_unlock(hdev); 6787 6788 return err; 6789 } 6790 6791 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 6792 void *data, u16 data_len) 6793 { 6794 struct mgmt_cp_get_adv_size_info *cp = data; 6795 struct mgmt_rp_get_adv_size_info rp; 6796 u32 flags, supported_flags; 6797 int err; 6798 6799 BT_DBG("%s", hdev->name); 6800 6801 if (!lmp_le_capable(hdev)) 6802 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6803 MGMT_STATUS_REJECTED); 6804 6805 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES) 6806 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6807 MGMT_STATUS_INVALID_PARAMS); 6808 6809 flags = __le32_to_cpu(cp->flags); 6810 6811 /* The current implementation only supports a subset of the specified 6812 * flags. 6813 */ 6814 supported_flags = get_supported_adv_flags(hdev); 6815 if (flags & ~supported_flags) 6816 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6817 MGMT_STATUS_INVALID_PARAMS); 6818 6819 rp.instance = cp->instance; 6820 rp.flags = cp->flags; 6821 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 6822 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 6823 6824 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 6825 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6826 6827 return err; 6828 } 6829 6830 static const struct hci_mgmt_handler mgmt_handlers[] = { 6831 { NULL }, /* 0x0000 (no command) */ 6832 { read_version, MGMT_READ_VERSION_SIZE, 6833 HCI_MGMT_NO_HDEV | 6834 HCI_MGMT_UNTRUSTED }, 6835 { read_commands, MGMT_READ_COMMANDS_SIZE, 6836 HCI_MGMT_NO_HDEV | 6837 HCI_MGMT_UNTRUSTED }, 6838 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 6839 HCI_MGMT_NO_HDEV | 6840 HCI_MGMT_UNTRUSTED }, 6841 { read_controller_info, MGMT_READ_INFO_SIZE, 6842 HCI_MGMT_UNTRUSTED }, 6843 { set_powered, MGMT_SETTING_SIZE }, 6844 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 6845 { set_connectable, MGMT_SETTING_SIZE }, 6846 { set_fast_connectable, MGMT_SETTING_SIZE }, 6847 { set_bondable, MGMT_SETTING_SIZE }, 6848 { set_link_security, MGMT_SETTING_SIZE }, 6849 { set_ssp, MGMT_SETTING_SIZE }, 6850 { set_hs, MGMT_SETTING_SIZE }, 6851 { set_le, MGMT_SETTING_SIZE }, 6852 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 6853 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 6854 { add_uuid, MGMT_ADD_UUID_SIZE }, 6855 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 6856 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 6857 HCI_MGMT_VAR_LEN }, 6858 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 6859 HCI_MGMT_VAR_LEN }, 6860 { disconnect, MGMT_DISCONNECT_SIZE }, 6861 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 6862 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 6863 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 6864 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 6865 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 6866 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 6867 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 6868 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 6869 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 6870 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 6871 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 6872 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 6873 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 6874 HCI_MGMT_VAR_LEN }, 6875 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 6876 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 6877 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 6878 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 6879 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 6880 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 6881 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 6882 { set_advertising, MGMT_SETTING_SIZE }, 6883 { set_bredr, MGMT_SETTING_SIZE }, 6884 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 6885 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 6886 { set_secure_conn, MGMT_SETTING_SIZE }, 6887 { set_debug_keys, MGMT_SETTING_SIZE }, 6888 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 6889 { load_irks, MGMT_LOAD_IRKS_SIZE, 6890 HCI_MGMT_VAR_LEN }, 6891 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 6892 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 6893 { add_device, MGMT_ADD_DEVICE_SIZE }, 6894 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 6895 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 6896 HCI_MGMT_VAR_LEN }, 6897 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 6898 HCI_MGMT_NO_HDEV | 6899 HCI_MGMT_UNTRUSTED }, 6900 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 6901 HCI_MGMT_UNCONFIGURED | 6902 HCI_MGMT_UNTRUSTED }, 6903 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 6904 HCI_MGMT_UNCONFIGURED }, 6905 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 6906 HCI_MGMT_UNCONFIGURED }, 6907 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 6908 HCI_MGMT_VAR_LEN }, 6909 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 6910 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 6911 HCI_MGMT_NO_HDEV | 6912 HCI_MGMT_UNTRUSTED }, 6913 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 6914 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 6915 HCI_MGMT_VAR_LEN }, 6916 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 6917 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 6918 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 6919 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 6920 HCI_MGMT_UNTRUSTED }, 6921 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 6922 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 6923 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 6924 }; 6925 6926 void mgmt_index_added(struct hci_dev *hdev) 6927 { 6928 struct mgmt_ev_ext_index ev; 6929 6930 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 6931 return; 6932 6933 switch (hdev->dev_type) { 6934 case HCI_PRIMARY: 6935 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 6936 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 6937 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 6938 ev.type = 0x01; 6939 } else { 6940 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 6941 HCI_MGMT_INDEX_EVENTS); 6942 ev.type = 0x00; 6943 } 6944 break; 6945 case HCI_AMP: 6946 ev.type = 0x02; 6947 break; 6948 default: 6949 return; 6950 } 6951 6952 ev.bus = hdev->bus; 6953 6954 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 6955 HCI_MGMT_EXT_INDEX_EVENTS); 6956 } 6957 6958 void mgmt_index_removed(struct hci_dev *hdev) 6959 { 6960 struct mgmt_ev_ext_index ev; 6961 u8 status = MGMT_STATUS_INVALID_INDEX; 6962 6963 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 6964 return; 6965 6966 switch (hdev->dev_type) { 6967 case HCI_PRIMARY: 6968 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 6969 6970 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 6971 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 6972 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 6973 ev.type = 0x01; 6974 } else { 6975 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 6976 HCI_MGMT_INDEX_EVENTS); 6977 ev.type = 0x00; 6978 } 6979 break; 6980 case HCI_AMP: 6981 ev.type = 0x02; 6982 break; 6983 default: 6984 return; 6985 } 6986 6987 ev.bus = hdev->bus; 6988 6989 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 6990 HCI_MGMT_EXT_INDEX_EVENTS); 6991 } 6992 6993 /* This function requires the caller holds hdev->lock */ 6994 static void restart_le_actions(struct hci_dev *hdev) 6995 { 6996 struct hci_conn_params *p; 6997 6998 list_for_each_entry(p, &hdev->le_conn_params, list) { 6999 /* Needed for AUTO_OFF case where might not "really" 7000 * have been powered off. 7001 */ 7002 list_del_init(&p->action); 7003 7004 switch (p->auto_connect) { 7005 case HCI_AUTO_CONN_DIRECT: 7006 case HCI_AUTO_CONN_ALWAYS: 7007 list_add(&p->action, &hdev->pend_le_conns); 7008 break; 7009 case HCI_AUTO_CONN_REPORT: 7010 list_add(&p->action, &hdev->pend_le_reports); 7011 break; 7012 default: 7013 break; 7014 } 7015 } 7016 } 7017 7018 void mgmt_power_on(struct hci_dev *hdev, int err) 7019 { 7020 struct cmd_lookup match = { NULL, hdev }; 7021 7022 BT_DBG("err %d", err); 7023 7024 hci_dev_lock(hdev); 7025 7026 if (!err) { 7027 restart_le_actions(hdev); 7028 hci_update_background_scan(hdev); 7029 } 7030 7031 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 7032 7033 new_settings(hdev, match.sk); 7034 7035 if (match.sk) 7036 sock_put(match.sk); 7037 7038 hci_dev_unlock(hdev); 7039 } 7040 7041 void __mgmt_power_off(struct hci_dev *hdev) 7042 { 7043 struct cmd_lookup match = { NULL, hdev }; 7044 u8 status, zero_cod[] = { 0, 0, 0 }; 7045 7046 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 7047 7048 /* If the power off is because of hdev unregistration let 7049 * use the appropriate INVALID_INDEX status. Otherwise use 7050 * NOT_POWERED. We cover both scenarios here since later in 7051 * mgmt_index_removed() any hci_conn callbacks will have already 7052 * been triggered, potentially causing misleading DISCONNECTED 7053 * status responses. 7054 */ 7055 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 7056 status = MGMT_STATUS_INVALID_INDEX; 7057 else 7058 status = MGMT_STATUS_NOT_POWERED; 7059 7060 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 7061 7062 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 7063 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 7064 zero_cod, sizeof(zero_cod), 7065 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 7066 ext_info_changed(hdev, NULL); 7067 } 7068 7069 new_settings(hdev, match.sk); 7070 7071 if (match.sk) 7072 sock_put(match.sk); 7073 } 7074 7075 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 7076 { 7077 struct mgmt_pending_cmd *cmd; 7078 u8 status; 7079 7080 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 7081 if (!cmd) 7082 return; 7083 7084 if (err == -ERFKILL) 7085 status = MGMT_STATUS_RFKILLED; 7086 else 7087 status = MGMT_STATUS_FAILED; 7088 7089 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 7090 7091 mgmt_pending_remove(cmd); 7092 } 7093 7094 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 7095 bool persistent) 7096 { 7097 struct mgmt_ev_new_link_key ev; 7098 7099 memset(&ev, 0, sizeof(ev)); 7100 7101 ev.store_hint = persistent; 7102 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 7103 ev.key.addr.type = BDADDR_BREDR; 7104 ev.key.type = key->type; 7105 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 7106 ev.key.pin_len = key->pin_len; 7107 7108 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 7109 } 7110 7111 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 7112 { 7113 switch (ltk->type) { 7114 case SMP_LTK: 7115 case SMP_LTK_SLAVE: 7116 if (ltk->authenticated) 7117 return MGMT_LTK_AUTHENTICATED; 7118 return MGMT_LTK_UNAUTHENTICATED; 7119 case SMP_LTK_P256: 7120 if (ltk->authenticated) 7121 return MGMT_LTK_P256_AUTH; 7122 return MGMT_LTK_P256_UNAUTH; 7123 case SMP_LTK_P256_DEBUG: 7124 return MGMT_LTK_P256_DEBUG; 7125 } 7126 7127 return MGMT_LTK_UNAUTHENTICATED; 7128 } 7129 7130 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 7131 { 7132 struct mgmt_ev_new_long_term_key ev; 7133 7134 memset(&ev, 0, sizeof(ev)); 7135 7136 /* Devices using resolvable or non-resolvable random addresses 7137 * without providing an identity resolving key don't require 7138 * to store long term keys. Their addresses will change the 7139 * next time around. 7140 * 7141 * Only when a remote device provides an identity address 7142 * make sure the long term key is stored. If the remote 7143 * identity is known, the long term keys are internally 7144 * mapped to the identity address. So allow static random 7145 * and public addresses here. 7146 */ 7147 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 7148 (key->bdaddr.b[5] & 0xc0) != 0xc0) 7149 ev.store_hint = 0x00; 7150 else 7151 ev.store_hint = persistent; 7152 7153 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 7154 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 7155 ev.key.type = mgmt_ltk_type(key); 7156 ev.key.enc_size = key->enc_size; 7157 ev.key.ediv = key->ediv; 7158 ev.key.rand = key->rand; 7159 7160 if (key->type == SMP_LTK) 7161 ev.key.master = 1; 7162 7163 /* Make sure we copy only the significant bytes based on the 7164 * encryption key size, and set the rest of the value to zeroes. 7165 */ 7166 memcpy(ev.key.val, key->val, key->enc_size); 7167 memset(ev.key.val + key->enc_size, 0, 7168 sizeof(ev.key.val) - key->enc_size); 7169 7170 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 7171 } 7172 7173 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 7174 { 7175 struct mgmt_ev_new_irk ev; 7176 7177 memset(&ev, 0, sizeof(ev)); 7178 7179 ev.store_hint = persistent; 7180 7181 bacpy(&ev.rpa, &irk->rpa); 7182 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 7183 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 7184 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 7185 7186 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 7187 } 7188 7189 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 7190 bool persistent) 7191 { 7192 struct mgmt_ev_new_csrk ev; 7193 7194 memset(&ev, 0, sizeof(ev)); 7195 7196 /* Devices using resolvable or non-resolvable random addresses 7197 * without providing an identity resolving key don't require 7198 * to store signature resolving keys. Their addresses will change 7199 * the next time around. 7200 * 7201 * Only when a remote device provides an identity address 7202 * make sure the signature resolving key is stored. So allow 7203 * static random and public addresses here. 7204 */ 7205 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 7206 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 7207 ev.store_hint = 0x00; 7208 else 7209 ev.store_hint = persistent; 7210 7211 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 7212 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 7213 ev.key.type = csrk->type; 7214 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 7215 7216 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 7217 } 7218 7219 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 7220 u8 bdaddr_type, u8 store_hint, u16 min_interval, 7221 u16 max_interval, u16 latency, u16 timeout) 7222 { 7223 struct mgmt_ev_new_conn_param ev; 7224 7225 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 7226 return; 7227 7228 memset(&ev, 0, sizeof(ev)); 7229 bacpy(&ev.addr.bdaddr, bdaddr); 7230 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 7231 ev.store_hint = store_hint; 7232 ev.min_interval = cpu_to_le16(min_interval); 7233 ev.max_interval = cpu_to_le16(max_interval); 7234 ev.latency = cpu_to_le16(latency); 7235 ev.timeout = cpu_to_le16(timeout); 7236 7237 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 7238 } 7239 7240 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 7241 u32 flags, u8 *name, u8 name_len) 7242 { 7243 char buf[512]; 7244 struct mgmt_ev_device_connected *ev = (void *) buf; 7245 u16 eir_len = 0; 7246 7247 bacpy(&ev->addr.bdaddr, &conn->dst); 7248 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 7249 7250 ev->flags = __cpu_to_le32(flags); 7251 7252 /* We must ensure that the EIR Data fields are ordered and 7253 * unique. Keep it simple for now and avoid the problem by not 7254 * adding any BR/EDR data to the LE adv. 7255 */ 7256 if (conn->le_adv_data_len > 0) { 7257 memcpy(&ev->eir[eir_len], 7258 conn->le_adv_data, conn->le_adv_data_len); 7259 eir_len = conn->le_adv_data_len; 7260 } else { 7261 if (name_len > 0) 7262 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 7263 name, name_len); 7264 7265 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) 7266 eir_len = eir_append_data(ev->eir, eir_len, 7267 EIR_CLASS_OF_DEV, 7268 conn->dev_class, 3); 7269 } 7270 7271 ev->eir_len = cpu_to_le16(eir_len); 7272 7273 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 7274 sizeof(*ev) + eir_len, NULL); 7275 } 7276 7277 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 7278 { 7279 struct sock **sk = data; 7280 7281 cmd->cmd_complete(cmd, 0); 7282 7283 *sk = cmd->sk; 7284 sock_hold(*sk); 7285 7286 mgmt_pending_remove(cmd); 7287 } 7288 7289 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 7290 { 7291 struct hci_dev *hdev = data; 7292 struct mgmt_cp_unpair_device *cp = cmd->param; 7293 7294 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 7295 7296 cmd->cmd_complete(cmd, 0); 7297 mgmt_pending_remove(cmd); 7298 } 7299 7300 bool mgmt_powering_down(struct hci_dev *hdev) 7301 { 7302 struct mgmt_pending_cmd *cmd; 7303 struct mgmt_mode *cp; 7304 7305 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 7306 if (!cmd) 7307 return false; 7308 7309 cp = cmd->param; 7310 if (!cp->val) 7311 return true; 7312 7313 return false; 7314 } 7315 7316 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 7317 u8 link_type, u8 addr_type, u8 reason, 7318 bool mgmt_connected) 7319 { 7320 struct mgmt_ev_device_disconnected ev; 7321 struct sock *sk = NULL; 7322 7323 /* The connection is still in hci_conn_hash so test for 1 7324 * instead of 0 to know if this is the last one. 7325 */ 7326 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 7327 cancel_delayed_work(&hdev->power_off); 7328 queue_work(hdev->req_workqueue, &hdev->power_off.work); 7329 } 7330 7331 if (!mgmt_connected) 7332 return; 7333 7334 if (link_type != ACL_LINK && link_type != LE_LINK) 7335 return; 7336 7337 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 7338 7339 bacpy(&ev.addr.bdaddr, bdaddr); 7340 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7341 ev.reason = reason; 7342 7343 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 7344 7345 if (sk) 7346 sock_put(sk); 7347 7348 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 7349 hdev); 7350 } 7351 7352 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 7353 u8 link_type, u8 addr_type, u8 status) 7354 { 7355 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 7356 struct mgmt_cp_disconnect *cp; 7357 struct mgmt_pending_cmd *cmd; 7358 7359 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 7360 hdev); 7361 7362 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 7363 if (!cmd) 7364 return; 7365 7366 cp = cmd->param; 7367 7368 if (bacmp(bdaddr, &cp->addr.bdaddr)) 7369 return; 7370 7371 if (cp->addr.type != bdaddr_type) 7372 return; 7373 7374 cmd->cmd_complete(cmd, mgmt_status(status)); 7375 mgmt_pending_remove(cmd); 7376 } 7377 7378 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 7379 u8 addr_type, u8 status) 7380 { 7381 struct mgmt_ev_connect_failed ev; 7382 7383 /* The connection is still in hci_conn_hash so test for 1 7384 * instead of 0 to know if this is the last one. 7385 */ 7386 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 7387 cancel_delayed_work(&hdev->power_off); 7388 queue_work(hdev->req_workqueue, &hdev->power_off.work); 7389 } 7390 7391 bacpy(&ev.addr.bdaddr, bdaddr); 7392 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7393 ev.status = mgmt_status(status); 7394 7395 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 7396 } 7397 7398 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 7399 { 7400 struct mgmt_ev_pin_code_request ev; 7401 7402 bacpy(&ev.addr.bdaddr, bdaddr); 7403 ev.addr.type = BDADDR_BREDR; 7404 ev.secure = secure; 7405 7406 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 7407 } 7408 7409 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7410 u8 status) 7411 { 7412 struct mgmt_pending_cmd *cmd; 7413 7414 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 7415 if (!cmd) 7416 return; 7417 7418 cmd->cmd_complete(cmd, mgmt_status(status)); 7419 mgmt_pending_remove(cmd); 7420 } 7421 7422 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7423 u8 status) 7424 { 7425 struct mgmt_pending_cmd *cmd; 7426 7427 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 7428 if (!cmd) 7429 return; 7430 7431 cmd->cmd_complete(cmd, mgmt_status(status)); 7432 mgmt_pending_remove(cmd); 7433 } 7434 7435 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 7436 u8 link_type, u8 addr_type, u32 value, 7437 u8 confirm_hint) 7438 { 7439 struct mgmt_ev_user_confirm_request ev; 7440 7441 BT_DBG("%s", hdev->name); 7442 7443 bacpy(&ev.addr.bdaddr, bdaddr); 7444 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7445 ev.confirm_hint = confirm_hint; 7446 ev.value = cpu_to_le32(value); 7447 7448 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 7449 NULL); 7450 } 7451 7452 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 7453 u8 link_type, u8 addr_type) 7454 { 7455 struct mgmt_ev_user_passkey_request ev; 7456 7457 BT_DBG("%s", hdev->name); 7458 7459 bacpy(&ev.addr.bdaddr, bdaddr); 7460 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7461 7462 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 7463 NULL); 7464 } 7465 7466 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7467 u8 link_type, u8 addr_type, u8 status, 7468 u8 opcode) 7469 { 7470 struct mgmt_pending_cmd *cmd; 7471 7472 cmd = pending_find(opcode, hdev); 7473 if (!cmd) 7474 return -ENOENT; 7475 7476 cmd->cmd_complete(cmd, mgmt_status(status)); 7477 mgmt_pending_remove(cmd); 7478 7479 return 0; 7480 } 7481 7482 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7483 u8 link_type, u8 addr_type, u8 status) 7484 { 7485 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7486 status, MGMT_OP_USER_CONFIRM_REPLY); 7487 } 7488 7489 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7490 u8 link_type, u8 addr_type, u8 status) 7491 { 7492 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7493 status, 7494 MGMT_OP_USER_CONFIRM_NEG_REPLY); 7495 } 7496 7497 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7498 u8 link_type, u8 addr_type, u8 status) 7499 { 7500 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7501 status, MGMT_OP_USER_PASSKEY_REPLY); 7502 } 7503 7504 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 7505 u8 link_type, u8 addr_type, u8 status) 7506 { 7507 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 7508 status, 7509 MGMT_OP_USER_PASSKEY_NEG_REPLY); 7510 } 7511 7512 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 7513 u8 link_type, u8 addr_type, u32 passkey, 7514 u8 entered) 7515 { 7516 struct mgmt_ev_passkey_notify ev; 7517 7518 BT_DBG("%s", hdev->name); 7519 7520 bacpy(&ev.addr.bdaddr, bdaddr); 7521 ev.addr.type = link_to_bdaddr(link_type, addr_type); 7522 ev.passkey = __cpu_to_le32(passkey); 7523 ev.entered = entered; 7524 7525 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 7526 } 7527 7528 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 7529 { 7530 struct mgmt_ev_auth_failed ev; 7531 struct mgmt_pending_cmd *cmd; 7532 u8 status = mgmt_status(hci_status); 7533 7534 bacpy(&ev.addr.bdaddr, &conn->dst); 7535 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 7536 ev.status = status; 7537 7538 cmd = find_pairing(conn); 7539 7540 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 7541 cmd ? cmd->sk : NULL); 7542 7543 if (cmd) { 7544 cmd->cmd_complete(cmd, status); 7545 mgmt_pending_remove(cmd); 7546 } 7547 } 7548 7549 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 7550 { 7551 struct cmd_lookup match = { NULL, hdev }; 7552 bool changed; 7553 7554 if (status) { 7555 u8 mgmt_err = mgmt_status(status); 7556 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 7557 cmd_status_rsp, &mgmt_err); 7558 return; 7559 } 7560 7561 if (test_bit(HCI_AUTH, &hdev->flags)) 7562 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 7563 else 7564 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 7565 7566 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 7567 &match); 7568 7569 if (changed) 7570 new_settings(hdev, match.sk); 7571 7572 if (match.sk) 7573 sock_put(match.sk); 7574 } 7575 7576 static void clear_eir(struct hci_request *req) 7577 { 7578 struct hci_dev *hdev = req->hdev; 7579 struct hci_cp_write_eir cp; 7580 7581 if (!lmp_ext_inq_capable(hdev)) 7582 return; 7583 7584 memset(hdev->eir, 0, sizeof(hdev->eir)); 7585 7586 memset(&cp, 0, sizeof(cp)); 7587 7588 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 7589 } 7590 7591 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 7592 { 7593 struct cmd_lookup match = { NULL, hdev }; 7594 struct hci_request req; 7595 bool changed = false; 7596 7597 if (status) { 7598 u8 mgmt_err = mgmt_status(status); 7599 7600 if (enable && hci_dev_test_and_clear_flag(hdev, 7601 HCI_SSP_ENABLED)) { 7602 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 7603 new_settings(hdev, NULL); 7604 } 7605 7606 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 7607 &mgmt_err); 7608 return; 7609 } 7610 7611 if (enable) { 7612 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 7613 } else { 7614 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 7615 if (!changed) 7616 changed = hci_dev_test_and_clear_flag(hdev, 7617 HCI_HS_ENABLED); 7618 else 7619 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 7620 } 7621 7622 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 7623 7624 if (changed) 7625 new_settings(hdev, match.sk); 7626 7627 if (match.sk) 7628 sock_put(match.sk); 7629 7630 hci_req_init(&req, hdev); 7631 7632 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7633 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 7634 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE, 7635 sizeof(enable), &enable); 7636 __hci_req_update_eir(&req); 7637 } else { 7638 clear_eir(&req); 7639 } 7640 7641 hci_req_run(&req, NULL); 7642 } 7643 7644 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 7645 { 7646 struct cmd_lookup *match = data; 7647 7648 if (match->sk == NULL) { 7649 match->sk = cmd->sk; 7650 sock_hold(match->sk); 7651 } 7652 } 7653 7654 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 7655 u8 status) 7656 { 7657 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 7658 7659 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 7660 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 7661 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 7662 7663 if (!status) { 7664 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 7665 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 7666 ext_info_changed(hdev, NULL); 7667 } 7668 7669 if (match.sk) 7670 sock_put(match.sk); 7671 } 7672 7673 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 7674 { 7675 struct mgmt_cp_set_local_name ev; 7676 struct mgmt_pending_cmd *cmd; 7677 7678 if (status) 7679 return; 7680 7681 memset(&ev, 0, sizeof(ev)); 7682 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 7683 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 7684 7685 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 7686 if (!cmd) { 7687 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 7688 7689 /* If this is a HCI command related to powering on the 7690 * HCI dev don't send any mgmt signals. 7691 */ 7692 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 7693 return; 7694 } 7695 7696 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 7697 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 7698 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 7699 } 7700 7701 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 7702 { 7703 int i; 7704 7705 for (i = 0; i < uuid_count; i++) { 7706 if (!memcmp(uuid, uuids[i], 16)) 7707 return true; 7708 } 7709 7710 return false; 7711 } 7712 7713 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 7714 { 7715 u16 parsed = 0; 7716 7717 while (parsed < eir_len) { 7718 u8 field_len = eir[0]; 7719 u8 uuid[16]; 7720 int i; 7721 7722 if (field_len == 0) 7723 break; 7724 7725 if (eir_len - parsed < field_len + 1) 7726 break; 7727 7728 switch (eir[1]) { 7729 case EIR_UUID16_ALL: 7730 case EIR_UUID16_SOME: 7731 for (i = 0; i + 3 <= field_len; i += 2) { 7732 memcpy(uuid, bluetooth_base_uuid, 16); 7733 uuid[13] = eir[i + 3]; 7734 uuid[12] = eir[i + 2]; 7735 if (has_uuid(uuid, uuid_count, uuids)) 7736 return true; 7737 } 7738 break; 7739 case EIR_UUID32_ALL: 7740 case EIR_UUID32_SOME: 7741 for (i = 0; i + 5 <= field_len; i += 4) { 7742 memcpy(uuid, bluetooth_base_uuid, 16); 7743 uuid[15] = eir[i + 5]; 7744 uuid[14] = eir[i + 4]; 7745 uuid[13] = eir[i + 3]; 7746 uuid[12] = eir[i + 2]; 7747 if (has_uuid(uuid, uuid_count, uuids)) 7748 return true; 7749 } 7750 break; 7751 case EIR_UUID128_ALL: 7752 case EIR_UUID128_SOME: 7753 for (i = 0; i + 17 <= field_len; i += 16) { 7754 memcpy(uuid, eir + i + 2, 16); 7755 if (has_uuid(uuid, uuid_count, uuids)) 7756 return true; 7757 } 7758 break; 7759 } 7760 7761 parsed += field_len + 1; 7762 eir += field_len + 1; 7763 } 7764 7765 return false; 7766 } 7767 7768 static void restart_le_scan(struct hci_dev *hdev) 7769 { 7770 /* If controller is not scanning we are done. */ 7771 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 7772 return; 7773 7774 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 7775 hdev->discovery.scan_start + 7776 hdev->discovery.scan_duration)) 7777 return; 7778 7779 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 7780 DISCOV_LE_RESTART_DELAY); 7781 } 7782 7783 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 7784 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 7785 { 7786 /* If a RSSI threshold has been specified, and 7787 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 7788 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 7789 * is set, let it through for further processing, as we might need to 7790 * restart the scan. 7791 * 7792 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 7793 * the results are also dropped. 7794 */ 7795 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 7796 (rssi == HCI_RSSI_INVALID || 7797 (rssi < hdev->discovery.rssi && 7798 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 7799 return false; 7800 7801 if (hdev->discovery.uuid_count != 0) { 7802 /* If a list of UUIDs is provided in filter, results with no 7803 * matching UUID should be dropped. 7804 */ 7805 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 7806 hdev->discovery.uuids) && 7807 !eir_has_uuids(scan_rsp, scan_rsp_len, 7808 hdev->discovery.uuid_count, 7809 hdev->discovery.uuids)) 7810 return false; 7811 } 7812 7813 /* If duplicate filtering does not report RSSI changes, then restart 7814 * scanning to ensure updated result with updated RSSI values. 7815 */ 7816 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 7817 restart_le_scan(hdev); 7818 7819 /* Validate RSSI value against the RSSI threshold once more. */ 7820 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 7821 rssi < hdev->discovery.rssi) 7822 return false; 7823 } 7824 7825 return true; 7826 } 7827 7828 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 7829 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 7830 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 7831 { 7832 char buf[512]; 7833 struct mgmt_ev_device_found *ev = (void *)buf; 7834 size_t ev_size; 7835 7836 /* Don't send events for a non-kernel initiated discovery. With 7837 * LE one exception is if we have pend_le_reports > 0 in which 7838 * case we're doing passive scanning and want these events. 7839 */ 7840 if (!hci_discovery_active(hdev)) { 7841 if (link_type == ACL_LINK) 7842 return; 7843 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports)) 7844 return; 7845 } 7846 7847 if (hdev->discovery.result_filtering) { 7848 /* We are using service discovery */ 7849 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 7850 scan_rsp_len)) 7851 return; 7852 } 7853 7854 if (hdev->discovery.limited) { 7855 /* Check for limited discoverable bit */ 7856 if (dev_class) { 7857 if (!(dev_class[1] & 0x20)) 7858 return; 7859 } else { 7860 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 7861 if (!flags || !(flags[0] & LE_AD_LIMITED)) 7862 return; 7863 } 7864 } 7865 7866 /* Make sure that the buffer is big enough. The 5 extra bytes 7867 * are for the potential CoD field. 7868 */ 7869 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf)) 7870 return; 7871 7872 memset(buf, 0, sizeof(buf)); 7873 7874 /* In case of device discovery with BR/EDR devices (pre 1.2), the 7875 * RSSI value was reported as 0 when not available. This behavior 7876 * is kept when using device discovery. This is required for full 7877 * backwards compatibility with the API. 7878 * 7879 * However when using service discovery, the value 127 will be 7880 * returned when the RSSI is not available. 7881 */ 7882 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 7883 link_type == ACL_LINK) 7884 rssi = 0; 7885 7886 bacpy(&ev->addr.bdaddr, bdaddr); 7887 ev->addr.type = link_to_bdaddr(link_type, addr_type); 7888 ev->rssi = rssi; 7889 ev->flags = cpu_to_le32(flags); 7890 7891 if (eir_len > 0) 7892 /* Copy EIR or advertising data into event */ 7893 memcpy(ev->eir, eir, eir_len); 7894 7895 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 7896 NULL)) 7897 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 7898 dev_class, 3); 7899 7900 if (scan_rsp_len > 0) 7901 /* Append scan response data to event */ 7902 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len); 7903 7904 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 7905 ev_size = sizeof(*ev) + eir_len + scan_rsp_len; 7906 7907 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 7908 } 7909 7910 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 7911 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 7912 { 7913 struct mgmt_ev_device_found *ev; 7914 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 7915 u16 eir_len; 7916 7917 ev = (struct mgmt_ev_device_found *) buf; 7918 7919 memset(buf, 0, sizeof(buf)); 7920 7921 bacpy(&ev->addr.bdaddr, bdaddr); 7922 ev->addr.type = link_to_bdaddr(link_type, addr_type); 7923 ev->rssi = rssi; 7924 7925 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 7926 name_len); 7927 7928 ev->eir_len = cpu_to_le16(eir_len); 7929 7930 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 7931 } 7932 7933 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 7934 { 7935 struct mgmt_ev_discovering ev; 7936 7937 BT_DBG("%s discovering %u", hdev->name, discovering); 7938 7939 memset(&ev, 0, sizeof(ev)); 7940 ev.type = hdev->discovery.type; 7941 ev.discovering = discovering; 7942 7943 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 7944 } 7945 7946 static struct hci_mgmt_chan chan = { 7947 .channel = HCI_CHANNEL_CONTROL, 7948 .handler_count = ARRAY_SIZE(mgmt_handlers), 7949 .handlers = mgmt_handlers, 7950 .hdev_init = mgmt_init_hdev, 7951 }; 7952 7953 int mgmt_init(void) 7954 { 7955 return hci_mgmt_chan_register(&chan); 7956 } 7957 7958 void mgmt_exit(void) 7959 { 7960 hci_mgmt_chan_unregister(&chan); 7961 } 7962