This source file includes following definitions.
- mgmt_status
- mgmt_index_event
- mgmt_limited_event
- mgmt_event
- le_addr_type
- mgmt_fill_version_info
- read_version
- read_commands
- read_index_list
- read_unconf_index_list
- read_ext_index_list
- is_configured
- get_missing_options
- new_options
- send_options_rsp
- read_config_info
- get_supported_phys
- get_selected_phys
- get_configurable_phys
- get_supported_settings
- get_current_settings
- pending_find
- pending_find_data
- mgmt_get_adv_discov_flags
- mgmt_get_connectable
- service_cache_off
- rpa_expired
- mgmt_init_hdev
- read_controller_info
- append_eir_data_to_buf
- read_ext_controller_info
- ext_info_changed
- send_settings_rsp
- clean_up_hci_complete
- mgmt_advertising_added
- mgmt_advertising_removed
- cancel_adv_timeout
- clean_up_hci_state
- set_powered
- new_settings
- mgmt_new_settings
- settings_rsp
- cmd_status_rsp
- cmd_complete_rsp
- generic_cmd_complete
- addr_cmd_complete
- mgmt_bredr_support
- mgmt_le_support
- mgmt_set_discoverable_complete
- set_discoverable
- mgmt_set_connectable_complete
- set_connectable_update_settings
- set_connectable
- set_bondable
- set_link_security
- set_ssp
- set_hs
- le_enable_complete
- set_le
- pending_eir_or_class
- get_uuid_size
- mgmt_class_complete
- add_uuid_complete
- add_uuid
- enable_service_cache
- remove_uuid_complete
- remove_uuid
- set_class_complete
- set_dev_class
- load_link_keys
- device_unpaired
- unpair_device
- disconnect
- link_to_bdaddr
- get_connections
- send_pin_code_neg_reply
- pin_code_reply
- set_io_capability
- find_pairing
- pairing_complete
- mgmt_smp_complete
- pairing_complete_cb
- le_pairing_complete_cb
- pair_device
- cancel_pair_device
- user_pairing_resp
- pin_code_neg_reply
- user_confirm_reply
- user_confirm_neg_reply
- user_passkey_reply
- user_passkey_neg_reply
- adv_expire
- set_name_complete
- set_local_name
- set_appearance
- get_phy_configuration
- mgmt_phy_configuration_changed
- set_default_phy_complete
- set_phy_configuration
- read_local_oob_data_complete
- read_local_oob_data
- add_remote_oob_data
- remove_remote_oob_data
- mgmt_start_discovery_complete
- discovery_type_is_valid
- start_discovery_internal
- start_discovery
- start_limited_discovery
- service_discovery_cmd_complete
- start_service_discovery
- mgmt_stop_discovery_complete
- stop_discovery
- confirm_name
- block_device
- unblock_device
- set_device_id
- enable_advertising_instance
- set_advertising_complete
- set_advertising
- set_static_address
- set_scan_params
- fast_connectable_complete
- set_fast_connectable
- set_bredr_complete
- set_bredr
- sc_enable_complete
- set_secure_conn
- set_debug_keys
- set_privacy
- irk_is_valid
- load_irks
- ltk_is_valid
- load_long_term_keys
- conn_info_cmd_complete
- conn_info_refresh_complete
- get_conn_info
- clock_info_cmd_complete
- get_clock_info_complete
- get_clock_info
- is_connected
- hci_conn_params_set
- device_added
- add_device
- device_removed
- remove_device
- load_conn_param
- set_external_config
- set_public_address
- read_local_oob_ext_data_complete
- read_local_ssp_oob_req
- read_local_oob_ext_data
- get_supported_adv_flags
- read_adv_features
- calculate_name_len
- tlv_data_max_len
- flags_managed
- tx_power_managed
- name_managed
- appearance_managed
- tlv_data_is_valid
- add_advertising_complete
- add_advertising
- remove_advertising_complete
- remove_advertising
- get_adv_size_info
- mgmt_index_added
- mgmt_index_removed
- restart_le_actions
- mgmt_power_on
- __mgmt_power_off
- mgmt_set_powered_failed
- mgmt_new_link_key
- mgmt_ltk_type
- mgmt_new_ltk
- mgmt_new_irk
- mgmt_new_csrk
- mgmt_new_conn_param
- mgmt_device_connected
- disconnect_rsp
- unpair_device_rsp
- mgmt_powering_down
- mgmt_device_disconnected
- mgmt_disconnect_failed
- mgmt_connect_failed
- mgmt_pin_code_request
- mgmt_pin_code_reply_complete
- mgmt_pin_code_neg_reply_complete
- mgmt_user_confirm_request
- mgmt_user_passkey_request
- user_pairing_resp_complete
- mgmt_user_confirm_reply_complete
- mgmt_user_confirm_neg_reply_complete
- mgmt_user_passkey_reply_complete
- mgmt_user_passkey_neg_reply_complete
- mgmt_user_passkey_notify
- mgmt_auth_failed
- mgmt_auth_enable_complete
- clear_eir
- mgmt_ssp_enable_complete
- sk_lookup
- mgmt_set_class_of_dev_complete
- mgmt_set_local_name_complete
- has_uuid
- eir_has_uuids
- restart_le_scan
- is_filter_match
- mgmt_device_found
- mgmt_remote_name
- mgmt_discovering
- mgmt_init
- mgmt_exit
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
35
36 #include "hci_request.h"
37 #include "smp.h"
38 #include "mgmt_util.h"
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 14
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_BONDABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 MGMT_OP_SET_DEVICE_ID,
82 MGMT_OP_SET_ADVERTISING,
83 MGMT_OP_SET_BREDR,
84 MGMT_OP_SET_STATIC_ADDRESS,
85 MGMT_OP_SET_SCAN_PARAMS,
86 MGMT_OP_SET_SECURE_CONN,
87 MGMT_OP_SET_DEBUG_KEYS,
88 MGMT_OP_SET_PRIVACY,
89 MGMT_OP_LOAD_IRKS,
90 MGMT_OP_GET_CONN_INFO,
91 MGMT_OP_GET_CLOCK_INFO,
92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
94 MGMT_OP_LOAD_CONN_PARAM,
95 MGMT_OP_READ_UNCONF_INDEX_LIST,
96 MGMT_OP_READ_CONFIG_INFO,
97 MGMT_OP_SET_EXTERNAL_CONFIG,
98 MGMT_OP_SET_PUBLIC_ADDRESS,
99 MGMT_OP_START_SERVICE_DISCOVERY,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
101 MGMT_OP_READ_EXT_INDEX_LIST,
102 MGMT_OP_READ_ADV_FEATURES,
103 MGMT_OP_ADD_ADVERTISING,
104 MGMT_OP_REMOVE_ADVERTISING,
105 MGMT_OP_GET_ADV_SIZE_INFO,
106 MGMT_OP_START_LIMITED_DISCOVERY,
107 MGMT_OP_READ_EXT_INFO,
108 MGMT_OP_SET_APPEARANCE,
109 };
110
111 static const u16 mgmt_events[] = {
112 MGMT_EV_CONTROLLER_ERROR,
113 MGMT_EV_INDEX_ADDED,
114 MGMT_EV_INDEX_REMOVED,
115 MGMT_EV_NEW_SETTINGS,
116 MGMT_EV_CLASS_OF_DEV_CHANGED,
117 MGMT_EV_LOCAL_NAME_CHANGED,
118 MGMT_EV_NEW_LINK_KEY,
119 MGMT_EV_NEW_LONG_TERM_KEY,
120 MGMT_EV_DEVICE_CONNECTED,
121 MGMT_EV_DEVICE_DISCONNECTED,
122 MGMT_EV_CONNECT_FAILED,
123 MGMT_EV_PIN_CODE_REQUEST,
124 MGMT_EV_USER_CONFIRM_REQUEST,
125 MGMT_EV_USER_PASSKEY_REQUEST,
126 MGMT_EV_AUTH_FAILED,
127 MGMT_EV_DEVICE_FOUND,
128 MGMT_EV_DISCOVERING,
129 MGMT_EV_DEVICE_BLOCKED,
130 MGMT_EV_DEVICE_UNBLOCKED,
131 MGMT_EV_DEVICE_UNPAIRED,
132 MGMT_EV_PASSKEY_NOTIFY,
133 MGMT_EV_NEW_IRK,
134 MGMT_EV_NEW_CSRK,
135 MGMT_EV_DEVICE_ADDED,
136 MGMT_EV_DEVICE_REMOVED,
137 MGMT_EV_NEW_CONN_PARAM,
138 MGMT_EV_UNCONF_INDEX_ADDED,
139 MGMT_EV_UNCONF_INDEX_REMOVED,
140 MGMT_EV_NEW_CONFIG_OPTIONS,
141 MGMT_EV_EXT_INDEX_ADDED,
142 MGMT_EV_EXT_INDEX_REMOVED,
143 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
144 MGMT_EV_ADVERTISING_ADDED,
145 MGMT_EV_ADVERTISING_REMOVED,
146 MGMT_EV_EXT_INFO_CHANGED,
147 };
148
149 static const u16 mgmt_untrusted_commands[] = {
150 MGMT_OP_READ_INDEX_LIST,
151 MGMT_OP_READ_INFO,
152 MGMT_OP_READ_UNCONF_INDEX_LIST,
153 MGMT_OP_READ_CONFIG_INFO,
154 MGMT_OP_READ_EXT_INDEX_LIST,
155 MGMT_OP_READ_EXT_INFO,
156 };
157
158 static const u16 mgmt_untrusted_events[] = {
159 MGMT_EV_INDEX_ADDED,
160 MGMT_EV_INDEX_REMOVED,
161 MGMT_EV_NEW_SETTINGS,
162 MGMT_EV_CLASS_OF_DEV_CHANGED,
163 MGMT_EV_LOCAL_NAME_CHANGED,
164 MGMT_EV_UNCONF_INDEX_ADDED,
165 MGMT_EV_UNCONF_INDEX_REMOVED,
166 MGMT_EV_NEW_CONFIG_OPTIONS,
167 MGMT_EV_EXT_INDEX_ADDED,
168 MGMT_EV_EXT_INDEX_REMOVED,
169 MGMT_EV_EXT_INFO_CHANGED,
170 };
171
172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
173
174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
175 "\x00\x00\x00\x00\x00\x00\x00\x00"
176
177
178 static u8 mgmt_status_table[] = {
179 MGMT_STATUS_SUCCESS,
180 MGMT_STATUS_UNKNOWN_COMMAND,
181 MGMT_STATUS_NOT_CONNECTED,
182 MGMT_STATUS_FAILED,
183 MGMT_STATUS_CONNECT_FAILED,
184 MGMT_STATUS_AUTH_FAILED,
185 MGMT_STATUS_AUTH_FAILED,
186 MGMT_STATUS_NO_RESOURCES,
187 MGMT_STATUS_TIMEOUT,
188 MGMT_STATUS_NO_RESOURCES,
189 MGMT_STATUS_NO_RESOURCES,
190 MGMT_STATUS_ALREADY_CONNECTED,
191 MGMT_STATUS_BUSY,
192 MGMT_STATUS_NO_RESOURCES,
193 MGMT_STATUS_REJECTED,
194 MGMT_STATUS_REJECTED,
195 MGMT_STATUS_TIMEOUT,
196 MGMT_STATUS_NOT_SUPPORTED,
197 MGMT_STATUS_INVALID_PARAMS,
198 MGMT_STATUS_DISCONNECTED,
199 MGMT_STATUS_NO_RESOURCES,
200 MGMT_STATUS_DISCONNECTED,
201 MGMT_STATUS_DISCONNECTED,
202 MGMT_STATUS_BUSY,
203 MGMT_STATUS_REJECTED,
204 MGMT_STATUS_FAILED,
205 MGMT_STATUS_NOT_SUPPORTED,
206 MGMT_STATUS_REJECTED,
207 MGMT_STATUS_REJECTED,
208 MGMT_STATUS_REJECTED,
209 MGMT_STATUS_INVALID_PARAMS,
210 MGMT_STATUS_FAILED,
211 MGMT_STATUS_NOT_SUPPORTED,
212 MGMT_STATUS_FAILED,
213 MGMT_STATUS_TIMEOUT,
214 MGMT_STATUS_FAILED,
215 MGMT_STATUS_FAILED,
216 MGMT_STATUS_REJECTED,
217 MGMT_STATUS_FAILED,
218 MGMT_STATUS_NOT_SUPPORTED,
219 MGMT_STATUS_TIMEOUT,
220 MGMT_STATUS_NOT_SUPPORTED,
221 MGMT_STATUS_FAILED,
222 MGMT_STATUS_INVALID_PARAMS,
223 MGMT_STATUS_REJECTED,
224 MGMT_STATUS_NOT_SUPPORTED,
225 MGMT_STATUS_REJECTED,
226 MGMT_STATUS_INVALID_PARAMS,
227 MGMT_STATUS_BUSY,
228 MGMT_STATUS_FAILED,
229 MGMT_STATUS_FAILED,
230 MGMT_STATUS_INVALID_PARAMS,
231 MGMT_STATUS_NOT_SUPPORTED,
232 MGMT_STATUS_BUSY,
233 MGMT_STATUS_REJECTED,
234 MGMT_STATUS_BUSY,
235 MGMT_STATUS_INVALID_PARAMS,
236 MGMT_STATUS_TIMEOUT,
237 MGMT_STATUS_AUTH_FAILED,
238 MGMT_STATUS_CONNECT_FAILED,
239 MGMT_STATUS_CONNECT_FAILED,
240 };
241
242 static u8 mgmt_status(u8 hci_status)
243 {
244 if (hci_status < ARRAY_SIZE(mgmt_status_table))
245 return mgmt_status_table[hci_status];
246
247 return MGMT_STATUS_FAILED;
248 }
249
250 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag)
252 {
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, NULL);
255 }
256
257 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, int flag, struct sock *skip_sk)
259 {
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 flag, skip_sk);
262 }
263
264 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266 {
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
268 HCI_SOCK_TRUSTED, skip_sk);
269 }
270
271 static u8 le_addr_type(u8 mgmt_addr_type)
272 {
273 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
274 return ADDR_LE_DEV_PUBLIC;
275 else
276 return ADDR_LE_DEV_RANDOM;
277 }
278
279 void mgmt_fill_version_info(void *ver)
280 {
281 struct mgmt_rp_read_version *rp = ver;
282
283 rp->version = MGMT_VERSION;
284 rp->revision = cpu_to_le16(MGMT_REVISION);
285 }
286
287 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
288 u16 data_len)
289 {
290 struct mgmt_rp_read_version rp;
291
292 BT_DBG("sock %p", sk);
293
294 mgmt_fill_version_info(&rp);
295
296 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
297 &rp, sizeof(rp));
298 }
299
300 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
301 u16 data_len)
302 {
303 struct mgmt_rp_read_commands *rp;
304 u16 num_commands, num_events;
305 size_t rp_size;
306 int i, err;
307
308 BT_DBG("sock %p", sk);
309
310 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
311 num_commands = ARRAY_SIZE(mgmt_commands);
312 num_events = ARRAY_SIZE(mgmt_events);
313 } else {
314 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
315 num_events = ARRAY_SIZE(mgmt_untrusted_events);
316 }
317
318 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
319
320 rp = kmalloc(rp_size, GFP_KERNEL);
321 if (!rp)
322 return -ENOMEM;
323
324 rp->num_commands = cpu_to_le16(num_commands);
325 rp->num_events = cpu_to_le16(num_events);
326
327 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
328 __le16 *opcode = rp->opcodes;
329
330 for (i = 0; i < num_commands; i++, opcode++)
331 put_unaligned_le16(mgmt_commands[i], opcode);
332
333 for (i = 0; i < num_events; i++, opcode++)
334 put_unaligned_le16(mgmt_events[i], opcode);
335 } else {
336 __le16 *opcode = rp->opcodes;
337
338 for (i = 0; i < num_commands; i++, opcode++)
339 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
340
341 for (i = 0; i < num_events; i++, opcode++)
342 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
343 }
344
345 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
346 rp, rp_size);
347 kfree(rp);
348
349 return err;
350 }
351
352 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
353 u16 data_len)
354 {
355 struct mgmt_rp_read_index_list *rp;
356 struct hci_dev *d;
357 size_t rp_len;
358 u16 count;
359 int err;
360
361 BT_DBG("sock %p", sk);
362
363 read_lock(&hci_dev_list_lock);
364
365 count = 0;
366 list_for_each_entry(d, &hci_dev_list, list) {
367 if (d->dev_type == HCI_PRIMARY &&
368 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
369 count++;
370 }
371
372 rp_len = sizeof(*rp) + (2 * count);
373 rp = kmalloc(rp_len, GFP_ATOMIC);
374 if (!rp) {
375 read_unlock(&hci_dev_list_lock);
376 return -ENOMEM;
377 }
378
379 count = 0;
380 list_for_each_entry(d, &hci_dev_list, list) {
381 if (hci_dev_test_flag(d, HCI_SETUP) ||
382 hci_dev_test_flag(d, HCI_CONFIG) ||
383 hci_dev_test_flag(d, HCI_USER_CHANNEL))
384 continue;
385
386
387
388
389 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
390 continue;
391
392 if (d->dev_type == HCI_PRIMARY &&
393 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
394 rp->index[count++] = cpu_to_le16(d->id);
395 BT_DBG("Added hci%u", d->id);
396 }
397 }
398
399 rp->num_controllers = cpu_to_le16(count);
400 rp_len = sizeof(*rp) + (2 * count);
401
402 read_unlock(&hci_dev_list_lock);
403
404 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
405 0, rp, rp_len);
406
407 kfree(rp);
408
409 return err;
410 }
411
412 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
413 void *data, u16 data_len)
414 {
415 struct mgmt_rp_read_unconf_index_list *rp;
416 struct hci_dev *d;
417 size_t rp_len;
418 u16 count;
419 int err;
420
421 BT_DBG("sock %p", sk);
422
423 read_lock(&hci_dev_list_lock);
424
425 count = 0;
426 list_for_each_entry(d, &hci_dev_list, list) {
427 if (d->dev_type == HCI_PRIMARY &&
428 hci_dev_test_flag(d, HCI_UNCONFIGURED))
429 count++;
430 }
431
432 rp_len = sizeof(*rp) + (2 * count);
433 rp = kmalloc(rp_len, GFP_ATOMIC);
434 if (!rp) {
435 read_unlock(&hci_dev_list_lock);
436 return -ENOMEM;
437 }
438
439 count = 0;
440 list_for_each_entry(d, &hci_dev_list, list) {
441 if (hci_dev_test_flag(d, HCI_SETUP) ||
442 hci_dev_test_flag(d, HCI_CONFIG) ||
443 hci_dev_test_flag(d, HCI_USER_CHANNEL))
444 continue;
445
446
447
448
449 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
450 continue;
451
452 if (d->dev_type == HCI_PRIMARY &&
453 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
454 rp->index[count++] = cpu_to_le16(d->id);
455 BT_DBG("Added hci%u", d->id);
456 }
457 }
458
459 rp->num_controllers = cpu_to_le16(count);
460 rp_len = sizeof(*rp) + (2 * count);
461
462 read_unlock(&hci_dev_list_lock);
463
464 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
465 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
466
467 kfree(rp);
468
469 return err;
470 }
471
472 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
473 void *data, u16 data_len)
474 {
475 struct mgmt_rp_read_ext_index_list *rp;
476 struct hci_dev *d;
477 u16 count;
478 int err;
479
480 BT_DBG("sock %p", sk);
481
482 read_lock(&hci_dev_list_lock);
483
484 count = 0;
485 list_for_each_entry(d, &hci_dev_list, list) {
486 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP)
487 count++;
488 }
489
490 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC);
491 if (!rp) {
492 read_unlock(&hci_dev_list_lock);
493 return -ENOMEM;
494 }
495
496 count = 0;
497 list_for_each_entry(d, &hci_dev_list, list) {
498 if (hci_dev_test_flag(d, HCI_SETUP) ||
499 hci_dev_test_flag(d, HCI_CONFIG) ||
500 hci_dev_test_flag(d, HCI_USER_CHANNEL))
501 continue;
502
503
504
505
506 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
507 continue;
508
509 if (d->dev_type == HCI_PRIMARY) {
510 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
511 rp->entry[count].type = 0x01;
512 else
513 rp->entry[count].type = 0x00;
514 } else if (d->dev_type == HCI_AMP) {
515 rp->entry[count].type = 0x02;
516 } else {
517 continue;
518 }
519
520 rp->entry[count].bus = d->bus;
521 rp->entry[count++].index = cpu_to_le16(d->id);
522 BT_DBG("Added hci%u", d->id);
523 }
524
525 rp->num_controllers = cpu_to_le16(count);
526
527 read_unlock(&hci_dev_list_lock);
528
529
530
531
532
533 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
534 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
535 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
536
537 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
538 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp,
539 struct_size(rp, entry, count));
540
541 kfree(rp);
542
543 return err;
544 }
545
546 static bool is_configured(struct hci_dev *hdev)
547 {
548 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
549 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
550 return false;
551
552 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
553 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
554 !bacmp(&hdev->public_addr, BDADDR_ANY))
555 return false;
556
557 return true;
558 }
559
560 static __le32 get_missing_options(struct hci_dev *hdev)
561 {
562 u32 options = 0;
563
564 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
565 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
566 options |= MGMT_OPTION_EXTERNAL_CONFIG;
567
568 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
569 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) &&
570 !bacmp(&hdev->public_addr, BDADDR_ANY))
571 options |= MGMT_OPTION_PUBLIC_ADDRESS;
572
573 return cpu_to_le32(options);
574 }
575
576 static int new_options(struct hci_dev *hdev, struct sock *skip)
577 {
578 __le32 options = get_missing_options(hdev);
579
580 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
581 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip);
582 }
583
584 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
585 {
586 __le32 options = get_missing_options(hdev);
587
588 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
589 sizeof(options));
590 }
591
592 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
593 void *data, u16 data_len)
594 {
595 struct mgmt_rp_read_config_info rp;
596 u32 options = 0;
597
598 BT_DBG("sock %p %s", sk, hdev->name);
599
600 hci_dev_lock(hdev);
601
602 memset(&rp, 0, sizeof(rp));
603 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
604
605 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
606 options |= MGMT_OPTION_EXTERNAL_CONFIG;
607
608 if (hdev->set_bdaddr)
609 options |= MGMT_OPTION_PUBLIC_ADDRESS;
610
611 rp.supported_options = cpu_to_le32(options);
612 rp.missing_options = get_missing_options(hdev);
613
614 hci_dev_unlock(hdev);
615
616 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
617 &rp, sizeof(rp));
618 }
619
620 static u32 get_supported_phys(struct hci_dev *hdev)
621 {
622 u32 supported_phys = 0;
623
624 if (lmp_bredr_capable(hdev)) {
625 supported_phys |= MGMT_PHY_BR_1M_1SLOT;
626
627 if (hdev->features[0][0] & LMP_3SLOT)
628 supported_phys |= MGMT_PHY_BR_1M_3SLOT;
629
630 if (hdev->features[0][0] & LMP_5SLOT)
631 supported_phys |= MGMT_PHY_BR_1M_5SLOT;
632
633 if (lmp_edr_2m_capable(hdev)) {
634 supported_phys |= MGMT_PHY_EDR_2M_1SLOT;
635
636 if (lmp_edr_3slot_capable(hdev))
637 supported_phys |= MGMT_PHY_EDR_2M_3SLOT;
638
639 if (lmp_edr_5slot_capable(hdev))
640 supported_phys |= MGMT_PHY_EDR_2M_5SLOT;
641
642 if (lmp_edr_3m_capable(hdev)) {
643 supported_phys |= MGMT_PHY_EDR_3M_1SLOT;
644
645 if (lmp_edr_3slot_capable(hdev))
646 supported_phys |= MGMT_PHY_EDR_3M_3SLOT;
647
648 if (lmp_edr_5slot_capable(hdev))
649 supported_phys |= MGMT_PHY_EDR_3M_5SLOT;
650 }
651 }
652 }
653
654 if (lmp_le_capable(hdev)) {
655 supported_phys |= MGMT_PHY_LE_1M_TX;
656 supported_phys |= MGMT_PHY_LE_1M_RX;
657
658 if (hdev->le_features[1] & HCI_LE_PHY_2M) {
659 supported_phys |= MGMT_PHY_LE_2M_TX;
660 supported_phys |= MGMT_PHY_LE_2M_RX;
661 }
662
663 if (hdev->le_features[1] & HCI_LE_PHY_CODED) {
664 supported_phys |= MGMT_PHY_LE_CODED_TX;
665 supported_phys |= MGMT_PHY_LE_CODED_RX;
666 }
667 }
668
669 return supported_phys;
670 }
671
672 static u32 get_selected_phys(struct hci_dev *hdev)
673 {
674 u32 selected_phys = 0;
675
676 if (lmp_bredr_capable(hdev)) {
677 selected_phys |= MGMT_PHY_BR_1M_1SLOT;
678
679 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3))
680 selected_phys |= MGMT_PHY_BR_1M_3SLOT;
681
682 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5))
683 selected_phys |= MGMT_PHY_BR_1M_5SLOT;
684
685 if (lmp_edr_2m_capable(hdev)) {
686 if (!(hdev->pkt_type & HCI_2DH1))
687 selected_phys |= MGMT_PHY_EDR_2M_1SLOT;
688
689 if (lmp_edr_3slot_capable(hdev) &&
690 !(hdev->pkt_type & HCI_2DH3))
691 selected_phys |= MGMT_PHY_EDR_2M_3SLOT;
692
693 if (lmp_edr_5slot_capable(hdev) &&
694 !(hdev->pkt_type & HCI_2DH5))
695 selected_phys |= MGMT_PHY_EDR_2M_5SLOT;
696
697 if (lmp_edr_3m_capable(hdev)) {
698 if (!(hdev->pkt_type & HCI_3DH1))
699 selected_phys |= MGMT_PHY_EDR_3M_1SLOT;
700
701 if (lmp_edr_3slot_capable(hdev) &&
702 !(hdev->pkt_type & HCI_3DH3))
703 selected_phys |= MGMT_PHY_EDR_3M_3SLOT;
704
705 if (lmp_edr_5slot_capable(hdev) &&
706 !(hdev->pkt_type & HCI_3DH5))
707 selected_phys |= MGMT_PHY_EDR_3M_5SLOT;
708 }
709 }
710 }
711
712 if (lmp_le_capable(hdev)) {
713 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M)
714 selected_phys |= MGMT_PHY_LE_1M_TX;
715
716 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M)
717 selected_phys |= MGMT_PHY_LE_1M_RX;
718
719 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M)
720 selected_phys |= MGMT_PHY_LE_2M_TX;
721
722 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M)
723 selected_phys |= MGMT_PHY_LE_2M_RX;
724
725 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED)
726 selected_phys |= MGMT_PHY_LE_CODED_TX;
727
728 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED)
729 selected_phys |= MGMT_PHY_LE_CODED_RX;
730 }
731
732 return selected_phys;
733 }
734
735 static u32 get_configurable_phys(struct hci_dev *hdev)
736 {
737 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT &
738 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX);
739 }
740
741 static u32 get_supported_settings(struct hci_dev *hdev)
742 {
743 u32 settings = 0;
744
745 settings |= MGMT_SETTING_POWERED;
746 settings |= MGMT_SETTING_BONDABLE;
747 settings |= MGMT_SETTING_DEBUG_KEYS;
748 settings |= MGMT_SETTING_CONNECTABLE;
749 settings |= MGMT_SETTING_DISCOVERABLE;
750
751 if (lmp_bredr_capable(hdev)) {
752 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
753 settings |= MGMT_SETTING_FAST_CONNECTABLE;
754 settings |= MGMT_SETTING_BREDR;
755 settings |= MGMT_SETTING_LINK_SECURITY;
756
757 if (lmp_ssp_capable(hdev)) {
758 settings |= MGMT_SETTING_SSP;
759 settings |= MGMT_SETTING_HS;
760 }
761
762 if (lmp_sc_capable(hdev))
763 settings |= MGMT_SETTING_SECURE_CONN;
764 }
765
766 if (lmp_le_capable(hdev)) {
767 settings |= MGMT_SETTING_LE;
768 settings |= MGMT_SETTING_ADVERTISING;
769 settings |= MGMT_SETTING_SECURE_CONN;
770 settings |= MGMT_SETTING_PRIVACY;
771 settings |= MGMT_SETTING_STATIC_ADDRESS;
772 }
773
774 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
775 hdev->set_bdaddr)
776 settings |= MGMT_SETTING_CONFIGURATION;
777
778 settings |= MGMT_SETTING_PHY_CONFIGURATION;
779
780 return settings;
781 }
782
783 static u32 get_current_settings(struct hci_dev *hdev)
784 {
785 u32 settings = 0;
786
787 if (hdev_is_powered(hdev))
788 settings |= MGMT_SETTING_POWERED;
789
790 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
791 settings |= MGMT_SETTING_CONNECTABLE;
792
793 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
794 settings |= MGMT_SETTING_FAST_CONNECTABLE;
795
796 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
797 settings |= MGMT_SETTING_DISCOVERABLE;
798
799 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
800 settings |= MGMT_SETTING_BONDABLE;
801
802 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
803 settings |= MGMT_SETTING_BREDR;
804
805 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
806 settings |= MGMT_SETTING_LE;
807
808 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
809 settings |= MGMT_SETTING_LINK_SECURITY;
810
811 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
812 settings |= MGMT_SETTING_SSP;
813
814 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
815 settings |= MGMT_SETTING_HS;
816
817 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
818 settings |= MGMT_SETTING_ADVERTISING;
819
820 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
821 settings |= MGMT_SETTING_SECURE_CONN;
822
823 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
824 settings |= MGMT_SETTING_DEBUG_KEYS;
825
826 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
827 settings |= MGMT_SETTING_PRIVACY;
828
829
830
831
832
833
834
835
836
837
838
839
840
841 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
842 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
843 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
844 if (bacmp(&hdev->static_addr, BDADDR_ANY))
845 settings |= MGMT_SETTING_STATIC_ADDRESS;
846 }
847
848 return settings;
849 }
850
851 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
852 {
853 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
854 }
855
856 static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
857 struct hci_dev *hdev,
858 const void *data)
859 {
860 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
861 }
862
863 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev)
864 {
865 struct mgmt_pending_cmd *cmd;
866
867
868
869
870 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
871 if (cmd) {
872 struct mgmt_mode *cp = cmd->param;
873 if (cp->val == 0x01)
874 return LE_AD_GENERAL;
875 else if (cp->val == 0x02)
876 return LE_AD_LIMITED;
877 } else {
878 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
879 return LE_AD_LIMITED;
880 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
881 return LE_AD_GENERAL;
882 }
883
884 return 0;
885 }
886
887 bool mgmt_get_connectable(struct hci_dev *hdev)
888 {
889 struct mgmt_pending_cmd *cmd;
890
891
892
893
894 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
895 if (cmd) {
896 struct mgmt_mode *cp = cmd->param;
897
898 return cp->val;
899 }
900
901 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
902 }
903
904 static void service_cache_off(struct work_struct *work)
905 {
906 struct hci_dev *hdev = container_of(work, struct hci_dev,
907 service_cache.work);
908 struct hci_request req;
909
910 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
911 return;
912
913 hci_req_init(&req, hdev);
914
915 hci_dev_lock(hdev);
916
917 __hci_req_update_eir(&req);
918 __hci_req_update_class(&req);
919
920 hci_dev_unlock(hdev);
921
922 hci_req_run(&req, NULL);
923 }
924
925 static void rpa_expired(struct work_struct *work)
926 {
927 struct hci_dev *hdev = container_of(work, struct hci_dev,
928 rpa_expired.work);
929 struct hci_request req;
930
931 BT_DBG("");
932
933 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
934
935 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
936 return;
937
938
939
940
941
942 hci_req_init(&req, hdev);
943 if (ext_adv_capable(hdev))
944 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance);
945 else
946 __hci_req_enable_advertising(&req);
947 hci_req_run(&req, NULL);
948 }
949
950 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
951 {
952 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
953 return;
954
955 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
956 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
957
958
959
960
961
962
963 hci_dev_clear_flag(hdev, HCI_BONDABLE);
964 }
965
966 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
967 void *data, u16 data_len)
968 {
969 struct mgmt_rp_read_info rp;
970
971 BT_DBG("sock %p %s", sk, hdev->name);
972
973 hci_dev_lock(hdev);
974
975 memset(&rp, 0, sizeof(rp));
976
977 bacpy(&rp.bdaddr, &hdev->bdaddr);
978
979 rp.version = hdev->hci_ver;
980 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
981
982 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
983 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
984
985 memcpy(rp.dev_class, hdev->dev_class, 3);
986
987 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
988 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
989
990 hci_dev_unlock(hdev);
991
992 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
993 sizeof(rp));
994 }
995
996 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir)
997 {
998 u16 eir_len = 0;
999 size_t name_len;
1000
1001 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1002 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
1003 hdev->dev_class, 3);
1004
1005 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1006 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE,
1007 hdev->appearance);
1008
1009 name_len = strlen(hdev->dev_name);
1010 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE,
1011 hdev->dev_name, name_len);
1012
1013 name_len = strlen(hdev->short_name);
1014 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT,
1015 hdev->short_name, name_len);
1016
1017 return eir_len;
1018 }
1019
1020 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev,
1021 void *data, u16 data_len)
1022 {
1023 char buf[512];
1024 struct mgmt_rp_read_ext_info *rp = (void *)buf;
1025 u16 eir_len;
1026
1027 BT_DBG("sock %p %s", sk, hdev->name);
1028
1029 memset(&buf, 0, sizeof(buf));
1030
1031 hci_dev_lock(hdev);
1032
1033 bacpy(&rp->bdaddr, &hdev->bdaddr);
1034
1035 rp->version = hdev->hci_ver;
1036 rp->manufacturer = cpu_to_le16(hdev->manufacturer);
1037
1038 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev));
1039 rp->current_settings = cpu_to_le32(get_current_settings(hdev));
1040
1041
1042 eir_len = append_eir_data_to_buf(hdev, rp->eir);
1043 rp->eir_len = cpu_to_le16(eir_len);
1044
1045 hci_dev_unlock(hdev);
1046
1047
1048
1049
1050
1051
1052 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS);
1053 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1054 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1055
1056 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp,
1057 sizeof(*rp) + eir_len);
1058 }
1059
1060 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip)
1061 {
1062 char buf[512];
1063 struct mgmt_ev_ext_info_changed *ev = (void *)buf;
1064 u16 eir_len;
1065
1066 memset(buf, 0, sizeof(buf));
1067
1068 eir_len = append_eir_data_to_buf(hdev, ev->eir);
1069 ev->eir_len = cpu_to_le16(eir_len);
1070
1071 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev,
1072 sizeof(*ev) + eir_len,
1073 HCI_MGMT_EXT_INFO_EVENTS, skip);
1074 }
1075
1076 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1077 {
1078 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1079
1080 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1081 sizeof(settings));
1082 }
1083
1084 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1085 {
1086 BT_DBG("%s status 0x%02x", hdev->name, status);
1087
1088 if (hci_conn_count(hdev) == 0) {
1089 cancel_delayed_work(&hdev->power_off);
1090 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1091 }
1092 }
1093
1094 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance)
1095 {
1096 struct mgmt_ev_advertising_added ev;
1097
1098 ev.instance = instance;
1099
1100 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1101 }
1102
1103 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
1104 u8 instance)
1105 {
1106 struct mgmt_ev_advertising_removed ev;
1107
1108 ev.instance = instance;
1109
1110 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1111 }
1112
1113 static void cancel_adv_timeout(struct hci_dev *hdev)
1114 {
1115 if (hdev->adv_instance_timeout) {
1116 hdev->adv_instance_timeout = 0;
1117 cancel_delayed_work(&hdev->adv_instance_expire);
1118 }
1119 }
1120
1121 static int clean_up_hci_state(struct hci_dev *hdev)
1122 {
1123 struct hci_request req;
1124 struct hci_conn *conn;
1125 bool discov_stopped;
1126 int err;
1127
1128 hci_req_init(&req, hdev);
1129
1130 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1131 test_bit(HCI_PSCAN, &hdev->flags)) {
1132 u8 scan = 0x00;
1133 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1134 }
1135
1136 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false);
1137
1138 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1139 __hci_req_disable_advertising(&req);
1140
1141 discov_stopped = hci_req_stop_discovery(&req);
1142
1143 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1144
1145 __hci_abort_conn(&req, conn, 0x15);
1146 }
1147
1148 err = hci_req_run(&req, clean_up_hci_complete);
1149 if (!err && discov_stopped)
1150 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1151
1152 return err;
1153 }
1154
1155 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1156 u16 len)
1157 {
1158 struct mgmt_mode *cp = data;
1159 struct mgmt_pending_cmd *cmd;
1160 int err;
1161
1162 BT_DBG("request for %s", hdev->name);
1163
1164 if (cp->val != 0x00 && cp->val != 0x01)
1165 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1166 MGMT_STATUS_INVALID_PARAMS);
1167
1168 hci_dev_lock(hdev);
1169
1170 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
1171 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1172 MGMT_STATUS_BUSY);
1173 goto failed;
1174 }
1175
1176 if (!!cp->val == hdev_is_powered(hdev)) {
1177 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1178 goto failed;
1179 }
1180
1181 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1182 if (!cmd) {
1183 err = -ENOMEM;
1184 goto failed;
1185 }
1186
1187 if (cp->val) {
1188 queue_work(hdev->req_workqueue, &hdev->power_on);
1189 err = 0;
1190 } else {
1191
1192 err = clean_up_hci_state(hdev);
1193 if (!err)
1194 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1195 HCI_POWER_OFF_TIMEOUT);
1196
1197
1198 if (err == -ENODATA) {
1199 cancel_delayed_work(&hdev->power_off);
1200 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1201 err = 0;
1202 }
1203 }
1204
1205 failed:
1206 hci_dev_unlock(hdev);
1207 return err;
1208 }
1209
1210 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1211 {
1212 __le32 ev = cpu_to_le32(get_current_settings(hdev));
1213
1214 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1215 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip);
1216 }
1217
1218 int mgmt_new_settings(struct hci_dev *hdev)
1219 {
1220 return new_settings(hdev, NULL);
1221 }
1222
1223 struct cmd_lookup {
1224 struct sock *sk;
1225 struct hci_dev *hdev;
1226 u8 mgmt_status;
1227 };
1228
1229 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
1230 {
1231 struct cmd_lookup *match = data;
1232
1233 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1234
1235 list_del(&cmd->list);
1236
1237 if (match->sk == NULL) {
1238 match->sk = cmd->sk;
1239 sock_hold(match->sk);
1240 }
1241
1242 mgmt_pending_free(cmd);
1243 }
1244
1245 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
1246 {
1247 u8 *status = data;
1248
1249 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1250 mgmt_pending_remove(cmd);
1251 }
1252
1253 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1254 {
1255 if (cmd->cmd_complete) {
1256 u8 *status = data;
1257
1258 cmd->cmd_complete(cmd, *status);
1259 mgmt_pending_remove(cmd);
1260
1261 return;
1262 }
1263
1264 cmd_status_rsp(cmd, data);
1265 }
1266
1267 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1268 {
1269 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1270 cmd->param, cmd->param_len);
1271 }
1272
1273 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
1274 {
1275 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1276 cmd->param, sizeof(struct mgmt_addr_info));
1277 }
1278
1279 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1280 {
1281 if (!lmp_bredr_capable(hdev))
1282 return MGMT_STATUS_NOT_SUPPORTED;
1283 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1284 return MGMT_STATUS_REJECTED;
1285 else
1286 return MGMT_STATUS_SUCCESS;
1287 }
1288
1289 static u8 mgmt_le_support(struct hci_dev *hdev)
1290 {
1291 if (!lmp_le_capable(hdev))
1292 return MGMT_STATUS_NOT_SUPPORTED;
1293 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1294 return MGMT_STATUS_REJECTED;
1295 else
1296 return MGMT_STATUS_SUCCESS;
1297 }
1298
1299 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status)
1300 {
1301 struct mgmt_pending_cmd *cmd;
1302
1303 BT_DBG("status 0x%02x", status);
1304
1305 hci_dev_lock(hdev);
1306
1307 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1308 if (!cmd)
1309 goto unlock;
1310
1311 if (status) {
1312 u8 mgmt_err = mgmt_status(status);
1313 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1314 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1315 goto remove_cmd;
1316 }
1317
1318 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1319 hdev->discov_timeout > 0) {
1320 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1321 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to);
1322 }
1323
1324 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1325 new_settings(hdev, cmd->sk);
1326
1327 remove_cmd:
1328 mgmt_pending_remove(cmd);
1329
1330 unlock:
1331 hci_dev_unlock(hdev);
1332 }
1333
1334 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1335 u16 len)
1336 {
1337 struct mgmt_cp_set_discoverable *cp = data;
1338 struct mgmt_pending_cmd *cmd;
1339 u16 timeout;
1340 int err;
1341
1342 BT_DBG("request for %s", hdev->name);
1343
1344 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1345 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1346 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1347 MGMT_STATUS_REJECTED);
1348
1349 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1351 MGMT_STATUS_INVALID_PARAMS);
1352
1353 timeout = __le16_to_cpu(cp->timeout);
1354
1355
1356
1357
1358 if ((cp->val == 0x00 && timeout > 0) ||
1359 (cp->val == 0x02 && timeout == 0))
1360 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1361 MGMT_STATUS_INVALID_PARAMS);
1362
1363 hci_dev_lock(hdev);
1364
1365 if (!hdev_is_powered(hdev) && timeout > 0) {
1366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1367 MGMT_STATUS_NOT_POWERED);
1368 goto failed;
1369 }
1370
1371 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1372 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1373 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1374 MGMT_STATUS_BUSY);
1375 goto failed;
1376 }
1377
1378 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
1379 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1380 MGMT_STATUS_REJECTED);
1381 goto failed;
1382 }
1383
1384 if (!hdev_is_powered(hdev)) {
1385 bool changed = false;
1386
1387
1388
1389
1390
1391 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
1392 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
1393 changed = true;
1394 }
1395
1396 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1397 if (err < 0)
1398 goto failed;
1399
1400 if (changed)
1401 err = new_settings(hdev, sk);
1402
1403 goto failed;
1404 }
1405
1406
1407
1408
1409
1410 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1411 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1412 HCI_LIMITED_DISCOVERABLE)) {
1413 cancel_delayed_work(&hdev->discov_off);
1414 hdev->discov_timeout = timeout;
1415
1416 if (cp->val && hdev->discov_timeout > 0) {
1417 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1418 queue_delayed_work(hdev->req_workqueue,
1419 &hdev->discov_off, to);
1420 }
1421
1422 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1423 goto failed;
1424 }
1425
1426 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1427 if (!cmd) {
1428 err = -ENOMEM;
1429 goto failed;
1430 }
1431
1432
1433
1434
1435
1436 cancel_delayed_work(&hdev->discov_off);
1437 hdev->discov_timeout = timeout;
1438
1439 if (cp->val)
1440 hci_dev_set_flag(hdev, HCI_DISCOVERABLE);
1441 else
1442 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1443
1444
1445 if (cp->val == 0x02)
1446 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1447 else
1448 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1449
1450 queue_work(hdev->req_workqueue, &hdev->discoverable_update);
1451 err = 0;
1452
1453 failed:
1454 hci_dev_unlock(hdev);
1455 return err;
1456 }
1457
1458 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status)
1459 {
1460 struct mgmt_pending_cmd *cmd;
1461
1462 BT_DBG("status 0x%02x", status);
1463
1464 hci_dev_lock(hdev);
1465
1466 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1467 if (!cmd)
1468 goto unlock;
1469
1470 if (status) {
1471 u8 mgmt_err = mgmt_status(status);
1472 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1473 goto remove_cmd;
1474 }
1475
1476 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1477 new_settings(hdev, cmd->sk);
1478
1479 remove_cmd:
1480 mgmt_pending_remove(cmd);
1481
1482 unlock:
1483 hci_dev_unlock(hdev);
1484 }
1485
1486 static int set_connectable_update_settings(struct hci_dev *hdev,
1487 struct sock *sk, u8 val)
1488 {
1489 bool changed = false;
1490 int err;
1491
1492 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
1493 changed = true;
1494
1495 if (val) {
1496 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1497 } else {
1498 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1499 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1500 }
1501
1502 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1503 if (err < 0)
1504 return err;
1505
1506 if (changed) {
1507 hci_req_update_scan(hdev);
1508 hci_update_background_scan(hdev);
1509 return new_settings(hdev, sk);
1510 }
1511
1512 return 0;
1513 }
1514
1515 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1516 u16 len)
1517 {
1518 struct mgmt_mode *cp = data;
1519 struct mgmt_pending_cmd *cmd;
1520 int err;
1521
1522 BT_DBG("request for %s", hdev->name);
1523
1524 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1525 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1526 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1527 MGMT_STATUS_REJECTED);
1528
1529 if (cp->val != 0x00 && cp->val != 0x01)
1530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1531 MGMT_STATUS_INVALID_PARAMS);
1532
1533 hci_dev_lock(hdev);
1534
1535 if (!hdev_is_powered(hdev)) {
1536 err = set_connectable_update_settings(hdev, sk, cp->val);
1537 goto failed;
1538 }
1539
1540 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1541 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1542 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1543 MGMT_STATUS_BUSY);
1544 goto failed;
1545 }
1546
1547 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1548 if (!cmd) {
1549 err = -ENOMEM;
1550 goto failed;
1551 }
1552
1553 if (cp->val) {
1554 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
1555 } else {
1556 if (hdev->discov_timeout > 0)
1557 cancel_delayed_work(&hdev->discov_off);
1558
1559 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1560 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1561 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1562 }
1563
1564 queue_work(hdev->req_workqueue, &hdev->connectable_update);
1565 err = 0;
1566
1567 failed:
1568 hci_dev_unlock(hdev);
1569 return err;
1570 }
1571
1572 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1573 u16 len)
1574 {
1575 struct mgmt_mode *cp = data;
1576 bool changed;
1577 int err;
1578
1579 BT_DBG("request for %s", hdev->name);
1580
1581 if (cp->val != 0x00 && cp->val != 0x01)
1582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1583 MGMT_STATUS_INVALID_PARAMS);
1584
1585 hci_dev_lock(hdev);
1586
1587 if (cp->val)
1588 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
1589 else
1590 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
1591
1592 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1593 if (err < 0)
1594 goto unlock;
1595
1596 if (changed) {
1597
1598
1599
1600 if (hdev_is_powered(hdev) &&
1601 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1602 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1603 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1604 queue_work(hdev->req_workqueue,
1605 &hdev->discoverable_update);
1606
1607 err = new_settings(hdev, sk);
1608 }
1609
1610 unlock:
1611 hci_dev_unlock(hdev);
1612 return err;
1613 }
1614
1615 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1616 u16 len)
1617 {
1618 struct mgmt_mode *cp = data;
1619 struct mgmt_pending_cmd *cmd;
1620 u8 val, status;
1621 int err;
1622
1623 BT_DBG("request for %s", hdev->name);
1624
1625 status = mgmt_bredr_support(hdev);
1626 if (status)
1627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1628 status);
1629
1630 if (cp->val != 0x00 && cp->val != 0x01)
1631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1632 MGMT_STATUS_INVALID_PARAMS);
1633
1634 hci_dev_lock(hdev);
1635
1636 if (!hdev_is_powered(hdev)) {
1637 bool changed = false;
1638
1639 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
1640 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
1641 changed = true;
1642 }
1643
1644 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1645 if (err < 0)
1646 goto failed;
1647
1648 if (changed)
1649 err = new_settings(hdev, sk);
1650
1651 goto failed;
1652 }
1653
1654 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1655 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1656 MGMT_STATUS_BUSY);
1657 goto failed;
1658 }
1659
1660 val = !!cp->val;
1661
1662 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1663 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1664 goto failed;
1665 }
1666
1667 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1668 if (!cmd) {
1669 err = -ENOMEM;
1670 goto failed;
1671 }
1672
1673 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1674 if (err < 0) {
1675 mgmt_pending_remove(cmd);
1676 goto failed;
1677 }
1678
1679 failed:
1680 hci_dev_unlock(hdev);
1681 return err;
1682 }
1683
1684 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1685 {
1686 struct mgmt_mode *cp = data;
1687 struct mgmt_pending_cmd *cmd;
1688 u8 status;
1689 int err;
1690
1691 BT_DBG("request for %s", hdev->name);
1692
1693 status = mgmt_bredr_support(hdev);
1694 if (status)
1695 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
1696
1697 if (!lmp_ssp_capable(hdev))
1698 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1699 MGMT_STATUS_NOT_SUPPORTED);
1700
1701 if (cp->val != 0x00 && cp->val != 0x01)
1702 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1703 MGMT_STATUS_INVALID_PARAMS);
1704
1705 hci_dev_lock(hdev);
1706
1707 if (!hdev_is_powered(hdev)) {
1708 bool changed;
1709
1710 if (cp->val) {
1711 changed = !hci_dev_test_and_set_flag(hdev,
1712 HCI_SSP_ENABLED);
1713 } else {
1714 changed = hci_dev_test_and_clear_flag(hdev,
1715 HCI_SSP_ENABLED);
1716 if (!changed)
1717 changed = hci_dev_test_and_clear_flag(hdev,
1718 HCI_HS_ENABLED);
1719 else
1720 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
1721 }
1722
1723 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1724 if (err < 0)
1725 goto failed;
1726
1727 if (changed)
1728 err = new_settings(hdev, sk);
1729
1730 goto failed;
1731 }
1732
1733 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1734 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1735 MGMT_STATUS_BUSY);
1736 goto failed;
1737 }
1738
1739 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
1740 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1741 goto failed;
1742 }
1743
1744 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1745 if (!cmd) {
1746 err = -ENOMEM;
1747 goto failed;
1748 }
1749
1750 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
1751 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
1752 sizeof(cp->val), &cp->val);
1753
1754 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
1755 if (err < 0) {
1756 mgmt_pending_remove(cmd);
1757 goto failed;
1758 }
1759
1760 failed:
1761 hci_dev_unlock(hdev);
1762 return err;
1763 }
1764
1765 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1766 {
1767 struct mgmt_mode *cp = data;
1768 bool changed;
1769 u8 status;
1770 int err;
1771
1772 BT_DBG("request for %s", hdev->name);
1773
1774 status = mgmt_bredr_support(hdev);
1775 if (status)
1776 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
1777
1778 if (!lmp_ssp_capable(hdev))
1779 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1780 MGMT_STATUS_NOT_SUPPORTED);
1781
1782 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
1783 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1784 MGMT_STATUS_REJECTED);
1785
1786 if (cp->val != 0x00 && cp->val != 0x01)
1787 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1788 MGMT_STATUS_INVALID_PARAMS);
1789
1790 hci_dev_lock(hdev);
1791
1792 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
1793 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1794 MGMT_STATUS_BUSY);
1795 goto unlock;
1796 }
1797
1798 if (cp->val) {
1799 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
1800 } else {
1801 if (hdev_is_powered(hdev)) {
1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1803 MGMT_STATUS_REJECTED);
1804 goto unlock;
1805 }
1806
1807 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
1808 }
1809
1810 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1811 if (err < 0)
1812 goto unlock;
1813
1814 if (changed)
1815 err = new_settings(hdev, sk);
1816
1817 unlock:
1818 hci_dev_unlock(hdev);
1819 return err;
1820 }
1821
1822 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1823 {
1824 struct cmd_lookup match = { NULL, hdev };
1825
1826 hci_dev_lock(hdev);
1827
1828 if (status) {
1829 u8 mgmt_err = mgmt_status(status);
1830
1831 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
1832 &mgmt_err);
1833 goto unlock;
1834 }
1835
1836 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
1837
1838 new_settings(hdev, match.sk);
1839
1840 if (match.sk)
1841 sock_put(match.sk);
1842
1843
1844
1845
1846
1847
1848 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1849 struct hci_request req;
1850 hci_req_init(&req, hdev);
1851 if (ext_adv_capable(hdev)) {
1852 int err;
1853
1854 err = __hci_req_setup_ext_adv_instance(&req, 0x00);
1855 if (!err)
1856 __hci_req_update_scan_rsp_data(&req, 0x00);
1857 } else {
1858 __hci_req_update_adv_data(&req, 0x00);
1859 __hci_req_update_scan_rsp_data(&req, 0x00);
1860 }
1861 hci_req_run(&req, NULL);
1862 hci_update_background_scan(hdev);
1863 }
1864
1865 unlock:
1866 hci_dev_unlock(hdev);
1867 }
1868
1869 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1870 {
1871 struct mgmt_mode *cp = data;
1872 struct hci_cp_write_le_host_supported hci_cp;
1873 struct mgmt_pending_cmd *cmd;
1874 struct hci_request req;
1875 int err;
1876 u8 val, enabled;
1877
1878 BT_DBG("request for %s", hdev->name);
1879
1880 if (!lmp_le_capable(hdev))
1881 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1882 MGMT_STATUS_NOT_SUPPORTED);
1883
1884 if (cp->val != 0x00 && cp->val != 0x01)
1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1886 MGMT_STATUS_INVALID_PARAMS);
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1898 if (cp->val == 0x01)
1899 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1900
1901 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1902 MGMT_STATUS_REJECTED);
1903 }
1904
1905 hci_dev_lock(hdev);
1906
1907 val = !!cp->val;
1908 enabled = lmp_host_le_capable(hdev);
1909
1910 if (!val)
1911 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true);
1912
1913 if (!hdev_is_powered(hdev) || val == enabled) {
1914 bool changed = false;
1915
1916 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
1917 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
1918 changed = true;
1919 }
1920
1921 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1922 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1923 changed = true;
1924 }
1925
1926 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1927 if (err < 0)
1928 goto unlock;
1929
1930 if (changed)
1931 err = new_settings(hdev, sk);
1932
1933 goto unlock;
1934 }
1935
1936 if (pending_find(MGMT_OP_SET_LE, hdev) ||
1937 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
1938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1939 MGMT_STATUS_BUSY);
1940 goto unlock;
1941 }
1942
1943 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1944 if (!cmd) {
1945 err = -ENOMEM;
1946 goto unlock;
1947 }
1948
1949 hci_req_init(&req, hdev);
1950
1951 memset(&hci_cp, 0, sizeof(hci_cp));
1952
1953 if (val) {
1954 hci_cp.le = val;
1955 hci_cp.simul = 0x00;
1956 } else {
1957 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1958 __hci_req_disable_advertising(&req);
1959
1960 if (ext_adv_capable(hdev))
1961 __hci_req_clear_ext_adv_sets(&req);
1962 }
1963
1964 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1965 &hci_cp);
1966
1967 err = hci_req_run(&req, le_enable_complete);
1968 if (err < 0)
1969 mgmt_pending_remove(cmd);
1970
1971 unlock:
1972 hci_dev_unlock(hdev);
1973 return err;
1974 }
1975
1976
1977
1978
1979
1980
1981
1982 static bool pending_eir_or_class(struct hci_dev *hdev)
1983 {
1984 struct mgmt_pending_cmd *cmd;
1985
1986 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1987 switch (cmd->opcode) {
1988 case MGMT_OP_ADD_UUID:
1989 case MGMT_OP_REMOVE_UUID:
1990 case MGMT_OP_SET_DEV_CLASS:
1991 case MGMT_OP_SET_POWERED:
1992 return true;
1993 }
1994 }
1995
1996 return false;
1997 }
1998
1999 static const u8 bluetooth_base_uuid[] = {
2000 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2001 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2002 };
2003
2004 static u8 get_uuid_size(const u8 *uuid)
2005 {
2006 u32 val;
2007
2008 if (memcmp(uuid, bluetooth_base_uuid, 12))
2009 return 128;
2010
2011 val = get_unaligned_le32(&uuid[12]);
2012 if (val > 0xffff)
2013 return 32;
2014
2015 return 16;
2016 }
2017
2018 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2019 {
2020 struct mgmt_pending_cmd *cmd;
2021
2022 hci_dev_lock(hdev);
2023
2024 cmd = pending_find(mgmt_op, hdev);
2025 if (!cmd)
2026 goto unlock;
2027
2028 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2029 mgmt_status(status), hdev->dev_class, 3);
2030
2031 mgmt_pending_remove(cmd);
2032
2033 unlock:
2034 hci_dev_unlock(hdev);
2035 }
2036
2037 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2038 {
2039 BT_DBG("status 0x%02x", status);
2040
2041 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2042 }
2043
2044 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2045 {
2046 struct mgmt_cp_add_uuid *cp = data;
2047 struct mgmt_pending_cmd *cmd;
2048 struct hci_request req;
2049 struct bt_uuid *uuid;
2050 int err;
2051
2052 BT_DBG("request for %s", hdev->name);
2053
2054 hci_dev_lock(hdev);
2055
2056 if (pending_eir_or_class(hdev)) {
2057 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2058 MGMT_STATUS_BUSY);
2059 goto failed;
2060 }
2061
2062 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2063 if (!uuid) {
2064 err = -ENOMEM;
2065 goto failed;
2066 }
2067
2068 memcpy(uuid->uuid, cp->uuid, 16);
2069 uuid->svc_hint = cp->svc_hint;
2070 uuid->size = get_uuid_size(cp->uuid);
2071
2072 list_add_tail(&uuid->list, &hdev->uuids);
2073
2074 hci_req_init(&req, hdev);
2075
2076 __hci_req_update_class(&req);
2077 __hci_req_update_eir(&req);
2078
2079 err = hci_req_run(&req, add_uuid_complete);
2080 if (err < 0) {
2081 if (err != -ENODATA)
2082 goto failed;
2083
2084 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2085 hdev->dev_class, 3);
2086 goto failed;
2087 }
2088
2089 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2090 if (!cmd) {
2091 err = -ENOMEM;
2092 goto failed;
2093 }
2094
2095 err = 0;
2096
2097 failed:
2098 hci_dev_unlock(hdev);
2099 return err;
2100 }
2101
2102 static bool enable_service_cache(struct hci_dev *hdev)
2103 {
2104 if (!hdev_is_powered(hdev))
2105 return false;
2106
2107 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
2108 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2109 CACHE_TIMEOUT);
2110 return true;
2111 }
2112
2113 return false;
2114 }
2115
2116 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2117 {
2118 BT_DBG("status 0x%02x", status);
2119
2120 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2121 }
2122
2123 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2124 u16 len)
2125 {
2126 struct mgmt_cp_remove_uuid *cp = data;
2127 struct mgmt_pending_cmd *cmd;
2128 struct bt_uuid *match, *tmp;
2129 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2130 struct hci_request req;
2131 int err, found;
2132
2133 BT_DBG("request for %s", hdev->name);
2134
2135 hci_dev_lock(hdev);
2136
2137 if (pending_eir_or_class(hdev)) {
2138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2139 MGMT_STATUS_BUSY);
2140 goto unlock;
2141 }
2142
2143 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2144 hci_uuids_clear(hdev);
2145
2146 if (enable_service_cache(hdev)) {
2147 err = mgmt_cmd_complete(sk, hdev->id,
2148 MGMT_OP_REMOVE_UUID,
2149 0, hdev->dev_class, 3);
2150 goto unlock;
2151 }
2152
2153 goto update_class;
2154 }
2155
2156 found = 0;
2157
2158 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2159 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2160 continue;
2161
2162 list_del(&match->list);
2163 kfree(match);
2164 found++;
2165 }
2166
2167 if (found == 0) {
2168 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2169 MGMT_STATUS_INVALID_PARAMS);
2170 goto unlock;
2171 }
2172
2173 update_class:
2174 hci_req_init(&req, hdev);
2175
2176 __hci_req_update_class(&req);
2177 __hci_req_update_eir(&req);
2178
2179 err = hci_req_run(&req, remove_uuid_complete);
2180 if (err < 0) {
2181 if (err != -ENODATA)
2182 goto unlock;
2183
2184 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2185 hdev->dev_class, 3);
2186 goto unlock;
2187 }
2188
2189 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2190 if (!cmd) {
2191 err = -ENOMEM;
2192 goto unlock;
2193 }
2194
2195 err = 0;
2196
2197 unlock:
2198 hci_dev_unlock(hdev);
2199 return err;
2200 }
2201
2202 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2203 {
2204 BT_DBG("status 0x%02x", status);
2205
2206 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2207 }
2208
2209 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2210 u16 len)
2211 {
2212 struct mgmt_cp_set_dev_class *cp = data;
2213 struct mgmt_pending_cmd *cmd;
2214 struct hci_request req;
2215 int err;
2216
2217 BT_DBG("request for %s", hdev->name);
2218
2219 if (!lmp_bredr_capable(hdev))
2220 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2221 MGMT_STATUS_NOT_SUPPORTED);
2222
2223 hci_dev_lock(hdev);
2224
2225 if (pending_eir_or_class(hdev)) {
2226 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2227 MGMT_STATUS_BUSY);
2228 goto unlock;
2229 }
2230
2231 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2232 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2233 MGMT_STATUS_INVALID_PARAMS);
2234 goto unlock;
2235 }
2236
2237 hdev->major_class = cp->major;
2238 hdev->minor_class = cp->minor;
2239
2240 if (!hdev_is_powered(hdev)) {
2241 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2242 hdev->dev_class, 3);
2243 goto unlock;
2244 }
2245
2246 hci_req_init(&req, hdev);
2247
2248 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
2249 hci_dev_unlock(hdev);
2250 cancel_delayed_work_sync(&hdev->service_cache);
2251 hci_dev_lock(hdev);
2252 __hci_req_update_eir(&req);
2253 }
2254
2255 __hci_req_update_class(&req);
2256
2257 err = hci_req_run(&req, set_class_complete);
2258 if (err < 0) {
2259 if (err != -ENODATA)
2260 goto unlock;
2261
2262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2263 hdev->dev_class, 3);
2264 goto unlock;
2265 }
2266
2267 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2268 if (!cmd) {
2269 err = -ENOMEM;
2270 goto unlock;
2271 }
2272
2273 err = 0;
2274
2275 unlock:
2276 hci_dev_unlock(hdev);
2277 return err;
2278 }
2279
2280 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2281 u16 len)
2282 {
2283 struct mgmt_cp_load_link_keys *cp = data;
2284 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2285 sizeof(struct mgmt_link_key_info));
2286 u16 key_count, expected_len;
2287 bool changed;
2288 int i;
2289
2290 BT_DBG("request for %s", hdev->name);
2291
2292 if (!lmp_bredr_capable(hdev))
2293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2294 MGMT_STATUS_NOT_SUPPORTED);
2295
2296 key_count = __le16_to_cpu(cp->key_count);
2297 if (key_count > max_key_count) {
2298 bt_dev_err(hdev, "load_link_keys: too big key_count value %u",
2299 key_count);
2300 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2301 MGMT_STATUS_INVALID_PARAMS);
2302 }
2303
2304 expected_len = struct_size(cp, keys, key_count);
2305 if (expected_len != len) {
2306 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes",
2307 expected_len, len);
2308 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2309 MGMT_STATUS_INVALID_PARAMS);
2310 }
2311
2312 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2314 MGMT_STATUS_INVALID_PARAMS);
2315
2316 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2317 key_count);
2318
2319 for (i = 0; i < key_count; i++) {
2320 struct mgmt_link_key_info *key = &cp->keys[i];
2321
2322 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2323 return mgmt_cmd_status(sk, hdev->id,
2324 MGMT_OP_LOAD_LINK_KEYS,
2325 MGMT_STATUS_INVALID_PARAMS);
2326 }
2327
2328 hci_dev_lock(hdev);
2329
2330 hci_link_keys_clear(hdev);
2331
2332 if (cp->debug_keys)
2333 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
2334 else
2335 changed = hci_dev_test_and_clear_flag(hdev,
2336 HCI_KEEP_DEBUG_KEYS);
2337
2338 if (changed)
2339 new_settings(hdev, NULL);
2340
2341 for (i = 0; i < key_count; i++) {
2342 struct mgmt_link_key_info *key = &cp->keys[i];
2343
2344
2345
2346
2347 if (key->type == HCI_LK_DEBUG_COMBINATION)
2348 continue;
2349
2350 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2351 key->type, key->pin_len, NULL);
2352 }
2353
2354 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2355
2356 hci_dev_unlock(hdev);
2357
2358 return 0;
2359 }
2360
2361 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2362 u8 addr_type, struct sock *skip_sk)
2363 {
2364 struct mgmt_ev_device_unpaired ev;
2365
2366 bacpy(&ev.addr.bdaddr, bdaddr);
2367 ev.addr.type = addr_type;
2368
2369 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2370 skip_sk);
2371 }
2372
2373 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2374 u16 len)
2375 {
2376 struct mgmt_cp_unpair_device *cp = data;
2377 struct mgmt_rp_unpair_device rp;
2378 struct hci_conn_params *params;
2379 struct mgmt_pending_cmd *cmd;
2380 struct hci_conn *conn;
2381 u8 addr_type;
2382 int err;
2383
2384 memset(&rp, 0, sizeof(rp));
2385 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2386 rp.addr.type = cp->addr.type;
2387
2388 if (!bdaddr_type_is_valid(cp->addr.type))
2389 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2390 MGMT_STATUS_INVALID_PARAMS,
2391 &rp, sizeof(rp));
2392
2393 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2394 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2395 MGMT_STATUS_INVALID_PARAMS,
2396 &rp, sizeof(rp));
2397
2398 hci_dev_lock(hdev);
2399
2400 if (!hdev_is_powered(hdev)) {
2401 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2402 MGMT_STATUS_NOT_POWERED, &rp,
2403 sizeof(rp));
2404 goto unlock;
2405 }
2406
2407 if (cp->addr.type == BDADDR_BREDR) {
2408
2409
2410
2411
2412
2413
2414
2415 if (cp->disconnect)
2416 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2417 &cp->addr.bdaddr);
2418 else
2419 conn = NULL;
2420
2421 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2422 if (err < 0) {
2423 err = mgmt_cmd_complete(sk, hdev->id,
2424 MGMT_OP_UNPAIR_DEVICE,
2425 MGMT_STATUS_NOT_PAIRED, &rp,
2426 sizeof(rp));
2427 goto unlock;
2428 }
2429
2430 goto done;
2431 }
2432
2433
2434 addr_type = le_addr_type(cp->addr.type);
2435
2436
2437 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
2438 if (err < 0) {
2439 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2440 MGMT_STATUS_NOT_PAIRED, &rp,
2441 sizeof(rp));
2442 goto unlock;
2443 }
2444
2445 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type);
2446 if (!conn) {
2447 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
2448 goto done;
2449 }
2450
2451
2452
2453
2454
2455 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2456
2457
2458 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type);
2459 if (params) {
2460 if (params->explicit_connect)
2461 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2462 else
2463 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2464 }
2465
2466
2467
2468
2469 if (!cp->disconnect)
2470 conn = NULL;
2471
2472 done:
2473
2474
2475
2476 if (!conn) {
2477 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2478 &rp, sizeof(rp));
2479 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2480 goto unlock;
2481 }
2482
2483 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2484 sizeof(*cp));
2485 if (!cmd) {
2486 err = -ENOMEM;
2487 goto unlock;
2488 }
2489
2490 cmd->cmd_complete = addr_cmd_complete;
2491
2492 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM);
2493 if (err < 0)
2494 mgmt_pending_remove(cmd);
2495
2496 unlock:
2497 hci_dev_unlock(hdev);
2498 return err;
2499 }
2500
2501 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2502 u16 len)
2503 {
2504 struct mgmt_cp_disconnect *cp = data;
2505 struct mgmt_rp_disconnect rp;
2506 struct mgmt_pending_cmd *cmd;
2507 struct hci_conn *conn;
2508 int err;
2509
2510 BT_DBG("");
2511
2512 memset(&rp, 0, sizeof(rp));
2513 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2514 rp.addr.type = cp->addr.type;
2515
2516 if (!bdaddr_type_is_valid(cp->addr.type))
2517 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2518 MGMT_STATUS_INVALID_PARAMS,
2519 &rp, sizeof(rp));
2520
2521 hci_dev_lock(hdev);
2522
2523 if (!test_bit(HCI_UP, &hdev->flags)) {
2524 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2525 MGMT_STATUS_NOT_POWERED, &rp,
2526 sizeof(rp));
2527 goto failed;
2528 }
2529
2530 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2531 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2532 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2533 goto failed;
2534 }
2535
2536 if (cp->addr.type == BDADDR_BREDR)
2537 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2538 &cp->addr.bdaddr);
2539 else
2540 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
2541 le_addr_type(cp->addr.type));
2542
2543 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2544 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2545 MGMT_STATUS_NOT_CONNECTED, &rp,
2546 sizeof(rp));
2547 goto failed;
2548 }
2549
2550 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2551 if (!cmd) {
2552 err = -ENOMEM;
2553 goto failed;
2554 }
2555
2556 cmd->cmd_complete = generic_cmd_complete;
2557
2558 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2559 if (err < 0)
2560 mgmt_pending_remove(cmd);
2561
2562 failed:
2563 hci_dev_unlock(hdev);
2564 return err;
2565 }
2566
2567 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2568 {
2569 switch (link_type) {
2570 case LE_LINK:
2571 switch (addr_type) {
2572 case ADDR_LE_DEV_PUBLIC:
2573 return BDADDR_LE_PUBLIC;
2574
2575 default:
2576
2577 return BDADDR_LE_RANDOM;
2578 }
2579
2580 default:
2581
2582 return BDADDR_BREDR;
2583 }
2584 }
2585
2586 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2587 u16 data_len)
2588 {
2589 struct mgmt_rp_get_connections *rp;
2590 struct hci_conn *c;
2591 int err;
2592 u16 i;
2593
2594 BT_DBG("");
2595
2596 hci_dev_lock(hdev);
2597
2598 if (!hdev_is_powered(hdev)) {
2599 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2600 MGMT_STATUS_NOT_POWERED);
2601 goto unlock;
2602 }
2603
2604 i = 0;
2605 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2606 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2607 i++;
2608 }
2609
2610 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL);
2611 if (!rp) {
2612 err = -ENOMEM;
2613 goto unlock;
2614 }
2615
2616 i = 0;
2617 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2618 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2619 continue;
2620 bacpy(&rp->addr[i].bdaddr, &c->dst);
2621 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2622 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2623 continue;
2624 i++;
2625 }
2626
2627 rp->conn_count = cpu_to_le16(i);
2628
2629
2630 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2631 struct_size(rp, addr, i));
2632
2633 kfree(rp);
2634
2635 unlock:
2636 hci_dev_unlock(hdev);
2637 return err;
2638 }
2639
2640 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2641 struct mgmt_cp_pin_code_neg_reply *cp)
2642 {
2643 struct mgmt_pending_cmd *cmd;
2644 int err;
2645
2646 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2647 sizeof(*cp));
2648 if (!cmd)
2649 return -ENOMEM;
2650
2651 cmd->cmd_complete = addr_cmd_complete;
2652
2653 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2654 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2655 if (err < 0)
2656 mgmt_pending_remove(cmd);
2657
2658 return err;
2659 }
2660
2661 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2662 u16 len)
2663 {
2664 struct hci_conn *conn;
2665 struct mgmt_cp_pin_code_reply *cp = data;
2666 struct hci_cp_pin_code_reply reply;
2667 struct mgmt_pending_cmd *cmd;
2668 int err;
2669
2670 BT_DBG("");
2671
2672 hci_dev_lock(hdev);
2673
2674 if (!hdev_is_powered(hdev)) {
2675 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2676 MGMT_STATUS_NOT_POWERED);
2677 goto failed;
2678 }
2679
2680 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2681 if (!conn) {
2682 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2683 MGMT_STATUS_NOT_CONNECTED);
2684 goto failed;
2685 }
2686
2687 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2688 struct mgmt_cp_pin_code_neg_reply ncp;
2689
2690 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2691
2692 bt_dev_err(hdev, "PIN code is not 16 bytes long");
2693
2694 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2695 if (err >= 0)
2696 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2697 MGMT_STATUS_INVALID_PARAMS);
2698
2699 goto failed;
2700 }
2701
2702 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2703 if (!cmd) {
2704 err = -ENOMEM;
2705 goto failed;
2706 }
2707
2708 cmd->cmd_complete = addr_cmd_complete;
2709
2710 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2711 reply.pin_len = cp->pin_len;
2712 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2713
2714 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2715 if (err < 0)
2716 mgmt_pending_remove(cmd);
2717
2718 failed:
2719 hci_dev_unlock(hdev);
2720 return err;
2721 }
2722
2723 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2724 u16 len)
2725 {
2726 struct mgmt_cp_set_io_capability *cp = data;
2727
2728 BT_DBG("");
2729
2730 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2731 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
2732 MGMT_STATUS_INVALID_PARAMS);
2733
2734 hci_dev_lock(hdev);
2735
2736 hdev->io_capability = cp->io_capability;
2737
2738 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2739 hdev->io_capability);
2740
2741 hci_dev_unlock(hdev);
2742
2743 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
2744 NULL, 0);
2745 }
2746
2747 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
2748 {
2749 struct hci_dev *hdev = conn->hdev;
2750 struct mgmt_pending_cmd *cmd;
2751
2752 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2753 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2754 continue;
2755
2756 if (cmd->user_data != conn)
2757 continue;
2758
2759 return cmd;
2760 }
2761
2762 return NULL;
2763 }
2764
2765 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
2766 {
2767 struct mgmt_rp_pair_device rp;
2768 struct hci_conn *conn = cmd->user_data;
2769 int err;
2770
2771 bacpy(&rp.addr.bdaddr, &conn->dst);
2772 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2773
2774 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
2775 status, &rp, sizeof(rp));
2776
2777
2778 conn->connect_cfm_cb = NULL;
2779 conn->security_cfm_cb = NULL;
2780 conn->disconn_cfm_cb = NULL;
2781
2782 hci_conn_drop(conn);
2783
2784
2785
2786
2787 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2788
2789 hci_conn_put(conn);
2790
2791 return err;
2792 }
2793
2794 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
2795 {
2796 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
2797 struct mgmt_pending_cmd *cmd;
2798
2799 cmd = find_pairing(conn);
2800 if (cmd) {
2801 cmd->cmd_complete(cmd, status);
2802 mgmt_pending_remove(cmd);
2803 }
2804 }
2805
2806 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2807 {
2808 struct mgmt_pending_cmd *cmd;
2809
2810 BT_DBG("status %u", status);
2811
2812 cmd = find_pairing(conn);
2813 if (!cmd) {
2814 BT_DBG("Unable to find a pending command");
2815 return;
2816 }
2817
2818 cmd->cmd_complete(cmd, mgmt_status(status));
2819 mgmt_pending_remove(cmd);
2820 }
2821
2822 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
2823 {
2824 struct mgmt_pending_cmd *cmd;
2825
2826 BT_DBG("status %u", status);
2827
2828 if (!status)
2829 return;
2830
2831 cmd = find_pairing(conn);
2832 if (!cmd) {
2833 BT_DBG("Unable to find a pending command");
2834 return;
2835 }
2836
2837 cmd->cmd_complete(cmd, mgmt_status(status));
2838 mgmt_pending_remove(cmd);
2839 }
2840
2841 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2842 u16 len)
2843 {
2844 struct mgmt_cp_pair_device *cp = data;
2845 struct mgmt_rp_pair_device rp;
2846 struct mgmt_pending_cmd *cmd;
2847 u8 sec_level, auth_type;
2848 struct hci_conn *conn;
2849 int err;
2850
2851 BT_DBG("");
2852
2853 memset(&rp, 0, sizeof(rp));
2854 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2855 rp.addr.type = cp->addr.type;
2856
2857 if (!bdaddr_type_is_valid(cp->addr.type))
2858 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2859 MGMT_STATUS_INVALID_PARAMS,
2860 &rp, sizeof(rp));
2861
2862 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2863 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2864 MGMT_STATUS_INVALID_PARAMS,
2865 &rp, sizeof(rp));
2866
2867 hci_dev_lock(hdev);
2868
2869 if (!hdev_is_powered(hdev)) {
2870 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2871 MGMT_STATUS_NOT_POWERED, &rp,
2872 sizeof(rp));
2873 goto unlock;
2874 }
2875
2876 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
2877 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2878 MGMT_STATUS_ALREADY_PAIRED, &rp,
2879 sizeof(rp));
2880 goto unlock;
2881 }
2882
2883 sec_level = BT_SECURITY_MEDIUM;
2884 auth_type = HCI_AT_DEDICATED_BONDING;
2885
2886 if (cp->addr.type == BDADDR_BREDR) {
2887 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
2888 auth_type);
2889 } else {
2890 u8 addr_type = le_addr_type(cp->addr.type);
2891 struct hci_conn_params *p;
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
2903
2904 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
2905 p->auto_connect = HCI_AUTO_CONN_DISABLED;
2906
2907 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
2908 addr_type, sec_level,
2909 HCI_LE_CONN_TIMEOUT);
2910 }
2911
2912 if (IS_ERR(conn)) {
2913 int status;
2914
2915 if (PTR_ERR(conn) == -EBUSY)
2916 status = MGMT_STATUS_BUSY;
2917 else if (PTR_ERR(conn) == -EOPNOTSUPP)
2918 status = MGMT_STATUS_NOT_SUPPORTED;
2919 else if (PTR_ERR(conn) == -ECONNREFUSED)
2920 status = MGMT_STATUS_REJECTED;
2921 else
2922 status = MGMT_STATUS_CONNECT_FAILED;
2923
2924 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2925 status, &rp, sizeof(rp));
2926 goto unlock;
2927 }
2928
2929 if (conn->connect_cfm_cb) {
2930 hci_conn_drop(conn);
2931 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2932 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2933 goto unlock;
2934 }
2935
2936 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2937 if (!cmd) {
2938 err = -ENOMEM;
2939 hci_conn_drop(conn);
2940 goto unlock;
2941 }
2942
2943 cmd->cmd_complete = pairing_complete;
2944
2945
2946 if (cp->addr.type == BDADDR_BREDR) {
2947 conn->connect_cfm_cb = pairing_complete_cb;
2948 conn->security_cfm_cb = pairing_complete_cb;
2949 conn->disconn_cfm_cb = pairing_complete_cb;
2950 } else {
2951 conn->connect_cfm_cb = le_pairing_complete_cb;
2952 conn->security_cfm_cb = le_pairing_complete_cb;
2953 conn->disconn_cfm_cb = le_pairing_complete_cb;
2954 }
2955
2956 conn->io_capability = cp->io_cap;
2957 cmd->user_data = hci_conn_get(conn);
2958
2959 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
2960 hci_conn_security(conn, sec_level, auth_type, true)) {
2961 cmd->cmd_complete(cmd, 0);
2962 mgmt_pending_remove(cmd);
2963 }
2964
2965 err = 0;
2966
2967 unlock:
2968 hci_dev_unlock(hdev);
2969 return err;
2970 }
2971
2972 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2973 u16 len)
2974 {
2975 struct mgmt_addr_info *addr = data;
2976 struct mgmt_pending_cmd *cmd;
2977 struct hci_conn *conn;
2978 int err;
2979
2980 BT_DBG("");
2981
2982 hci_dev_lock(hdev);
2983
2984 if (!hdev_is_powered(hdev)) {
2985 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2986 MGMT_STATUS_NOT_POWERED);
2987 goto unlock;
2988 }
2989
2990 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2991 if (!cmd) {
2992 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2993 MGMT_STATUS_INVALID_PARAMS);
2994 goto unlock;
2995 }
2996
2997 conn = cmd->user_data;
2998
2999 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3000 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3001 MGMT_STATUS_INVALID_PARAMS);
3002 goto unlock;
3003 }
3004
3005 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3006 mgmt_pending_remove(cmd);
3007
3008 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3009 addr, sizeof(*addr));
3010 unlock:
3011 hci_dev_unlock(hdev);
3012 return err;
3013 }
3014
3015 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3016 struct mgmt_addr_info *addr, u16 mgmt_op,
3017 u16 hci_op, __le32 passkey)
3018 {
3019 struct mgmt_pending_cmd *cmd;
3020 struct hci_conn *conn;
3021 int err;
3022
3023 hci_dev_lock(hdev);
3024
3025 if (!hdev_is_powered(hdev)) {
3026 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3027 MGMT_STATUS_NOT_POWERED, addr,
3028 sizeof(*addr));
3029 goto done;
3030 }
3031
3032 if (addr->type == BDADDR_BREDR)
3033 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3034 else
3035 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3036 le_addr_type(addr->type));
3037
3038 if (!conn) {
3039 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3040 MGMT_STATUS_NOT_CONNECTED, addr,
3041 sizeof(*addr));
3042 goto done;
3043 }
3044
3045 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3046 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3047 if (!err)
3048 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3049 MGMT_STATUS_SUCCESS, addr,
3050 sizeof(*addr));
3051 else
3052 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3053 MGMT_STATUS_FAILED, addr,
3054 sizeof(*addr));
3055
3056 goto done;
3057 }
3058
3059 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3060 if (!cmd) {
3061 err = -ENOMEM;
3062 goto done;
3063 }
3064
3065 cmd->cmd_complete = addr_cmd_complete;
3066
3067
3068 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3069 struct hci_cp_user_passkey_reply cp;
3070
3071 bacpy(&cp.bdaddr, &addr->bdaddr);
3072 cp.passkey = passkey;
3073 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3074 } else
3075 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3076 &addr->bdaddr);
3077
3078 if (err < 0)
3079 mgmt_pending_remove(cmd);
3080
3081 done:
3082 hci_dev_unlock(hdev);
3083 return err;
3084 }
3085
3086 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3087 void *data, u16 len)
3088 {
3089 struct mgmt_cp_pin_code_neg_reply *cp = data;
3090
3091 BT_DBG("");
3092
3093 return user_pairing_resp(sk, hdev, &cp->addr,
3094 MGMT_OP_PIN_CODE_NEG_REPLY,
3095 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3096 }
3097
3098 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3099 u16 len)
3100 {
3101 struct mgmt_cp_user_confirm_reply *cp = data;
3102
3103 BT_DBG("");
3104
3105 if (len != sizeof(*cp))
3106 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3107 MGMT_STATUS_INVALID_PARAMS);
3108
3109 return user_pairing_resp(sk, hdev, &cp->addr,
3110 MGMT_OP_USER_CONFIRM_REPLY,
3111 HCI_OP_USER_CONFIRM_REPLY, 0);
3112 }
3113
3114 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3115 void *data, u16 len)
3116 {
3117 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3118
3119 BT_DBG("");
3120
3121 return user_pairing_resp(sk, hdev, &cp->addr,
3122 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3123 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3124 }
3125
3126 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3127 u16 len)
3128 {
3129 struct mgmt_cp_user_passkey_reply *cp = data;
3130
3131 BT_DBG("");
3132
3133 return user_pairing_resp(sk, hdev, &cp->addr,
3134 MGMT_OP_USER_PASSKEY_REPLY,
3135 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3136 }
3137
3138 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3139 void *data, u16 len)
3140 {
3141 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3142
3143 BT_DBG("");
3144
3145 return user_pairing_resp(sk, hdev, &cp->addr,
3146 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3147 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3148 }
3149
3150 static void adv_expire(struct hci_dev *hdev, u32 flags)
3151 {
3152 struct adv_info *adv_instance;
3153 struct hci_request req;
3154 int err;
3155
3156 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
3157 if (!adv_instance)
3158 return;
3159
3160
3161 if (!(adv_instance->flags & flags))
3162 return;
3163
3164 cancel_adv_timeout(hdev);
3165
3166 adv_instance = hci_get_next_instance(hdev, adv_instance->instance);
3167 if (!adv_instance)
3168 return;
3169
3170 hci_req_init(&req, hdev);
3171 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance,
3172 true);
3173 if (err)
3174 return;
3175
3176 hci_req_run(&req, NULL);
3177 }
3178
3179 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3180 {
3181 struct mgmt_cp_set_local_name *cp;
3182 struct mgmt_pending_cmd *cmd;
3183
3184 BT_DBG("status 0x%02x", status);
3185
3186 hci_dev_lock(hdev);
3187
3188 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3189 if (!cmd)
3190 goto unlock;
3191
3192 cp = cmd->param;
3193
3194 if (status) {
3195 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3196 mgmt_status(status));
3197 } else {
3198 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3199 cp, sizeof(*cp));
3200
3201 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3202 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME);
3203 }
3204
3205 mgmt_pending_remove(cmd);
3206
3207 unlock:
3208 hci_dev_unlock(hdev);
3209 }
3210
3211 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3212 u16 len)
3213 {
3214 struct mgmt_cp_set_local_name *cp = data;
3215 struct mgmt_pending_cmd *cmd;
3216 struct hci_request req;
3217 int err;
3218
3219 BT_DBG("");
3220
3221 hci_dev_lock(hdev);
3222
3223
3224
3225
3226 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3227 !memcmp(hdev->short_name, cp->short_name,
3228 sizeof(hdev->short_name))) {
3229 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3230 data, len);
3231 goto failed;
3232 }
3233
3234 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3235
3236 if (!hdev_is_powered(hdev)) {
3237 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3238
3239 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3240 data, len);
3241 if (err < 0)
3242 goto failed;
3243
3244 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data,
3245 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk);
3246 ext_info_changed(hdev, sk);
3247
3248 goto failed;
3249 }
3250
3251 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3252 if (!cmd) {
3253 err = -ENOMEM;
3254 goto failed;
3255 }
3256
3257 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3258
3259 hci_req_init(&req, hdev);
3260
3261 if (lmp_bredr_capable(hdev)) {
3262 __hci_req_update_name(&req);
3263 __hci_req_update_eir(&req);
3264 }
3265
3266
3267
3268
3269 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING))
3270 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance);
3271
3272 err = hci_req_run(&req, set_name_complete);
3273 if (err < 0)
3274 mgmt_pending_remove(cmd);
3275
3276 failed:
3277 hci_dev_unlock(hdev);
3278 return err;
3279 }
3280
3281 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data,
3282 u16 len)
3283 {
3284 struct mgmt_cp_set_appearance *cp = data;
3285 u16 apperance;
3286 int err;
3287
3288 BT_DBG("");
3289
3290 if (!lmp_le_capable(hdev))
3291 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE,
3292 MGMT_STATUS_NOT_SUPPORTED);
3293
3294 apperance = le16_to_cpu(cp->appearance);
3295
3296 hci_dev_lock(hdev);
3297
3298 if (hdev->appearance != apperance) {
3299 hdev->appearance = apperance;
3300
3301 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
3302 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE);
3303
3304 ext_info_changed(hdev, sk);
3305 }
3306
3307 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL,
3308 0);
3309
3310 hci_dev_unlock(hdev);
3311
3312 return err;
3313 }
3314
3315 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3316 void *data, u16 len)
3317 {
3318 struct mgmt_rp_get_phy_confguration rp;
3319
3320 BT_DBG("sock %p %s", sk, hdev->name);
3321
3322 hci_dev_lock(hdev);
3323
3324 memset(&rp, 0, sizeof(rp));
3325
3326 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev));
3327 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3328 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev));
3329
3330 hci_dev_unlock(hdev);
3331
3332 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0,
3333 &rp, sizeof(rp));
3334 }
3335
3336 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
3337 {
3338 struct mgmt_ev_phy_configuration_changed ev;
3339
3340 memset(&ev, 0, sizeof(ev));
3341
3342 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev));
3343
3344 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev,
3345 sizeof(ev), skip);
3346 }
3347
3348 static void set_default_phy_complete(struct hci_dev *hdev, u8 status,
3349 u16 opcode, struct sk_buff *skb)
3350 {
3351 struct mgmt_pending_cmd *cmd;
3352
3353 BT_DBG("status 0x%02x", status);
3354
3355 hci_dev_lock(hdev);
3356
3357 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev);
3358 if (!cmd)
3359 goto unlock;
3360
3361 if (status) {
3362 mgmt_cmd_status(cmd->sk, hdev->id,
3363 MGMT_OP_SET_PHY_CONFIGURATION,
3364 mgmt_status(status));
3365 } else {
3366 mgmt_cmd_complete(cmd->sk, hdev->id,
3367 MGMT_OP_SET_PHY_CONFIGURATION, 0,
3368 NULL, 0);
3369
3370 mgmt_phy_configuration_changed(hdev, cmd->sk);
3371 }
3372
3373 mgmt_pending_remove(cmd);
3374
3375 unlock:
3376 hci_dev_unlock(hdev);
3377 }
3378
3379 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
3380 void *data, u16 len)
3381 {
3382 struct mgmt_cp_set_phy_confguration *cp = data;
3383 struct hci_cp_le_set_default_phy cp_phy;
3384 struct mgmt_pending_cmd *cmd;
3385 struct hci_request req;
3386 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys;
3387 u16 pkt_type = (HCI_DH1 | HCI_DM1);
3388 bool changed = false;
3389 int err;
3390
3391 BT_DBG("sock %p %s", sk, hdev->name);
3392
3393 configurable_phys = get_configurable_phys(hdev);
3394 supported_phys = get_supported_phys(hdev);
3395 selected_phys = __le32_to_cpu(cp->selected_phys);
3396
3397 if (selected_phys & ~supported_phys)
3398 return mgmt_cmd_status(sk, hdev->id,
3399 MGMT_OP_SET_PHY_CONFIGURATION,
3400 MGMT_STATUS_INVALID_PARAMS);
3401
3402 unconfigure_phys = supported_phys & ~configurable_phys;
3403
3404 if ((selected_phys & unconfigure_phys) != unconfigure_phys)
3405 return mgmt_cmd_status(sk, hdev->id,
3406 MGMT_OP_SET_PHY_CONFIGURATION,
3407 MGMT_STATUS_INVALID_PARAMS);
3408
3409 if (selected_phys == get_selected_phys(hdev))
3410 return mgmt_cmd_complete(sk, hdev->id,
3411 MGMT_OP_SET_PHY_CONFIGURATION,
3412 0, NULL, 0);
3413
3414 hci_dev_lock(hdev);
3415
3416 if (!hdev_is_powered(hdev)) {
3417 err = mgmt_cmd_status(sk, hdev->id,
3418 MGMT_OP_SET_PHY_CONFIGURATION,
3419 MGMT_STATUS_REJECTED);
3420 goto unlock;
3421 }
3422
3423 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) {
3424 err = mgmt_cmd_status(sk, hdev->id,
3425 MGMT_OP_SET_PHY_CONFIGURATION,
3426 MGMT_STATUS_BUSY);
3427 goto unlock;
3428 }
3429
3430 if (selected_phys & MGMT_PHY_BR_1M_3SLOT)
3431 pkt_type |= (HCI_DH3 | HCI_DM3);
3432 else
3433 pkt_type &= ~(HCI_DH3 | HCI_DM3);
3434
3435 if (selected_phys & MGMT_PHY_BR_1M_5SLOT)
3436 pkt_type |= (HCI_DH5 | HCI_DM5);
3437 else
3438 pkt_type &= ~(HCI_DH5 | HCI_DM5);
3439
3440 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT)
3441 pkt_type &= ~HCI_2DH1;
3442 else
3443 pkt_type |= HCI_2DH1;
3444
3445 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT)
3446 pkt_type &= ~HCI_2DH3;
3447 else
3448 pkt_type |= HCI_2DH3;
3449
3450 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT)
3451 pkt_type &= ~HCI_2DH5;
3452 else
3453 pkt_type |= HCI_2DH5;
3454
3455 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT)
3456 pkt_type &= ~HCI_3DH1;
3457 else
3458 pkt_type |= HCI_3DH1;
3459
3460 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT)
3461 pkt_type &= ~HCI_3DH3;
3462 else
3463 pkt_type |= HCI_3DH3;
3464
3465 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT)
3466 pkt_type &= ~HCI_3DH5;
3467 else
3468 pkt_type |= HCI_3DH5;
3469
3470 if (pkt_type != hdev->pkt_type) {
3471 hdev->pkt_type = pkt_type;
3472 changed = true;
3473 }
3474
3475 if ((selected_phys & MGMT_PHY_LE_MASK) ==
3476 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) {
3477 if (changed)
3478 mgmt_phy_configuration_changed(hdev, sk);
3479
3480 err = mgmt_cmd_complete(sk, hdev->id,
3481 MGMT_OP_SET_PHY_CONFIGURATION,
3482 0, NULL, 0);
3483
3484 goto unlock;
3485 }
3486
3487 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
3488 len);
3489 if (!cmd) {
3490 err = -ENOMEM;
3491 goto unlock;
3492 }
3493
3494 hci_req_init(&req, hdev);
3495
3496 memset(&cp_phy, 0, sizeof(cp_phy));
3497
3498 if (!(selected_phys & MGMT_PHY_LE_TX_MASK))
3499 cp_phy.all_phys |= 0x01;
3500
3501 if (!(selected_phys & MGMT_PHY_LE_RX_MASK))
3502 cp_phy.all_phys |= 0x02;
3503
3504 if (selected_phys & MGMT_PHY_LE_1M_TX)
3505 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M;
3506
3507 if (selected_phys & MGMT_PHY_LE_2M_TX)
3508 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M;
3509
3510 if (selected_phys & MGMT_PHY_LE_CODED_TX)
3511 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED;
3512
3513 if (selected_phys & MGMT_PHY_LE_1M_RX)
3514 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M;
3515
3516 if (selected_phys & MGMT_PHY_LE_2M_RX)
3517 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M;
3518
3519 if (selected_phys & MGMT_PHY_LE_CODED_RX)
3520 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED;
3521
3522 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy);
3523
3524 err = hci_req_run_skb(&req, set_default_phy_complete);
3525 if (err < 0)
3526 mgmt_pending_remove(cmd);
3527
3528 unlock:
3529 hci_dev_unlock(hdev);
3530
3531 return err;
3532 }
3533
3534 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3535 u16 opcode, struct sk_buff *skb)
3536 {
3537 struct mgmt_rp_read_local_oob_data mgmt_rp;
3538 size_t rp_size = sizeof(mgmt_rp);
3539 struct mgmt_pending_cmd *cmd;
3540
3541 BT_DBG("%s status %u", hdev->name, status);
3542
3543 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3544 if (!cmd)
3545 return;
3546
3547 if (status || !skb) {
3548 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3549 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3550 goto remove;
3551 }
3552
3553 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3554
3555 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3556 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3557
3558 if (skb->len < sizeof(*rp)) {
3559 mgmt_cmd_status(cmd->sk, hdev->id,
3560 MGMT_OP_READ_LOCAL_OOB_DATA,
3561 MGMT_STATUS_FAILED);
3562 goto remove;
3563 }
3564
3565 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3566 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3567
3568 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3569 } else {
3570 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3571
3572 if (skb->len < sizeof(*rp)) {
3573 mgmt_cmd_status(cmd->sk, hdev->id,
3574 MGMT_OP_READ_LOCAL_OOB_DATA,
3575 MGMT_STATUS_FAILED);
3576 goto remove;
3577 }
3578
3579 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3580 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3581
3582 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3583 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3584 }
3585
3586 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3587 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3588
3589 remove:
3590 mgmt_pending_remove(cmd);
3591 }
3592
3593 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3594 void *data, u16 data_len)
3595 {
3596 struct mgmt_pending_cmd *cmd;
3597 struct hci_request req;
3598 int err;
3599
3600 BT_DBG("%s", hdev->name);
3601
3602 hci_dev_lock(hdev);
3603
3604 if (!hdev_is_powered(hdev)) {
3605 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3606 MGMT_STATUS_NOT_POWERED);
3607 goto unlock;
3608 }
3609
3610 if (!lmp_ssp_capable(hdev)) {
3611 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3612 MGMT_STATUS_NOT_SUPPORTED);
3613 goto unlock;
3614 }
3615
3616 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3618 MGMT_STATUS_BUSY);
3619 goto unlock;
3620 }
3621
3622 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3623 if (!cmd) {
3624 err = -ENOMEM;
3625 goto unlock;
3626 }
3627
3628 hci_req_init(&req, hdev);
3629
3630 if (bredr_sc_enabled(hdev))
3631 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
3632 else
3633 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3634
3635 err = hci_req_run_skb(&req, read_local_oob_data_complete);
3636 if (err < 0)
3637 mgmt_pending_remove(cmd);
3638
3639 unlock:
3640 hci_dev_unlock(hdev);
3641 return err;
3642 }
3643
3644 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3645 void *data, u16 len)
3646 {
3647 struct mgmt_addr_info *addr = data;
3648 int err;
3649
3650 BT_DBG("%s ", hdev->name);
3651
3652 if (!bdaddr_type_is_valid(addr->type))
3653 return mgmt_cmd_complete(sk, hdev->id,
3654 MGMT_OP_ADD_REMOTE_OOB_DATA,
3655 MGMT_STATUS_INVALID_PARAMS,
3656 addr, sizeof(*addr));
3657
3658 hci_dev_lock(hdev);
3659
3660 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3661 struct mgmt_cp_add_remote_oob_data *cp = data;
3662 u8 status;
3663
3664 if (cp->addr.type != BDADDR_BREDR) {
3665 err = mgmt_cmd_complete(sk, hdev->id,
3666 MGMT_OP_ADD_REMOTE_OOB_DATA,
3667 MGMT_STATUS_INVALID_PARAMS,
3668 &cp->addr, sizeof(cp->addr));
3669 goto unlock;
3670 }
3671
3672 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3673 cp->addr.type, cp->hash,
3674 cp->rand, NULL, NULL);
3675 if (err < 0)
3676 status = MGMT_STATUS_FAILED;
3677 else
3678 status = MGMT_STATUS_SUCCESS;
3679
3680 err = mgmt_cmd_complete(sk, hdev->id,
3681 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3682 &cp->addr, sizeof(cp->addr));
3683 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3684 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3685 u8 *rand192, *hash192, *rand256, *hash256;
3686 u8 status;
3687
3688 if (bdaddr_type_is_le(cp->addr.type)) {
3689
3690
3691
3692 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3693 memcmp(cp->hash192, ZERO_KEY, 16)) {
3694 err = mgmt_cmd_complete(sk, hdev->id,
3695 MGMT_OP_ADD_REMOTE_OOB_DATA,
3696 MGMT_STATUS_INVALID_PARAMS,
3697 addr, sizeof(*addr));
3698 goto unlock;
3699 }
3700
3701 rand192 = NULL;
3702 hash192 = NULL;
3703 } else {
3704
3705
3706
3707 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3708 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3709 rand192 = NULL;
3710 hash192 = NULL;
3711 } else {
3712 rand192 = cp->rand192;
3713 hash192 = cp->hash192;
3714 }
3715 }
3716
3717
3718
3719
3720 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3721 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3722 rand256 = NULL;
3723 hash256 = NULL;
3724 } else {
3725 rand256 = cp->rand256;
3726 hash256 = cp->hash256;
3727 }
3728
3729 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3730 cp->addr.type, hash192, rand192,
3731 hash256, rand256);
3732 if (err < 0)
3733 status = MGMT_STATUS_FAILED;
3734 else
3735 status = MGMT_STATUS_SUCCESS;
3736
3737 err = mgmt_cmd_complete(sk, hdev->id,
3738 MGMT_OP_ADD_REMOTE_OOB_DATA,
3739 status, &cp->addr, sizeof(cp->addr));
3740 } else {
3741 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes",
3742 len);
3743 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3744 MGMT_STATUS_INVALID_PARAMS);
3745 }
3746
3747 unlock:
3748 hci_dev_unlock(hdev);
3749 return err;
3750 }
3751
3752 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3753 void *data, u16 len)
3754 {
3755 struct mgmt_cp_remove_remote_oob_data *cp = data;
3756 u8 status;
3757 int err;
3758
3759 BT_DBG("%s", hdev->name);
3760
3761 if (cp->addr.type != BDADDR_BREDR)
3762 return mgmt_cmd_complete(sk, hdev->id,
3763 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3764 MGMT_STATUS_INVALID_PARAMS,
3765 &cp->addr, sizeof(cp->addr));
3766
3767 hci_dev_lock(hdev);
3768
3769 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3770 hci_remote_oob_data_clear(hdev);
3771 status = MGMT_STATUS_SUCCESS;
3772 goto done;
3773 }
3774
3775 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3776 if (err < 0)
3777 status = MGMT_STATUS_INVALID_PARAMS;
3778 else
3779 status = MGMT_STATUS_SUCCESS;
3780
3781 done:
3782 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3783 status, &cp->addr, sizeof(cp->addr));
3784
3785 hci_dev_unlock(hdev);
3786 return err;
3787 }
3788
3789 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status)
3790 {
3791 struct mgmt_pending_cmd *cmd;
3792
3793 BT_DBG("status %d", status);
3794
3795 hci_dev_lock(hdev);
3796
3797 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
3798 if (!cmd)
3799 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3800
3801 if (!cmd)
3802 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev);
3803
3804 if (cmd) {
3805 cmd->cmd_complete(cmd, mgmt_status(status));
3806 mgmt_pending_remove(cmd);
3807 }
3808
3809 hci_dev_unlock(hdev);
3810 }
3811
3812 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type,
3813 uint8_t *mgmt_status)
3814 {
3815 switch (type) {
3816 case DISCOV_TYPE_LE:
3817 *mgmt_status = mgmt_le_support(hdev);
3818 if (*mgmt_status)
3819 return false;
3820 break;
3821 case DISCOV_TYPE_INTERLEAVED:
3822 *mgmt_status = mgmt_le_support(hdev);
3823 if (*mgmt_status)
3824 return false;
3825
3826 case DISCOV_TYPE_BREDR:
3827 *mgmt_status = mgmt_bredr_support(hdev);
3828 if (*mgmt_status)
3829 return false;
3830 break;
3831 default:
3832 *mgmt_status = MGMT_STATUS_INVALID_PARAMS;
3833 return false;
3834 }
3835
3836 return true;
3837 }
3838
3839 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev,
3840 u16 op, void *data, u16 len)
3841 {
3842 struct mgmt_cp_start_discovery *cp = data;
3843 struct mgmt_pending_cmd *cmd;
3844 u8 status;
3845 int err;
3846
3847 BT_DBG("%s", hdev->name);
3848
3849 hci_dev_lock(hdev);
3850
3851 if (!hdev_is_powered(hdev)) {
3852 err = mgmt_cmd_complete(sk, hdev->id, op,
3853 MGMT_STATUS_NOT_POWERED,
3854 &cp->type, sizeof(cp->type));
3855 goto failed;
3856 }
3857
3858 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3859 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3860 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY,
3861 &cp->type, sizeof(cp->type));
3862 goto failed;
3863 }
3864
3865 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3866 err = mgmt_cmd_complete(sk, hdev->id, op, status,
3867 &cp->type, sizeof(cp->type));
3868 goto failed;
3869 }
3870
3871
3872
3873
3874 hci_discovery_filter_clear(hdev);
3875
3876 hdev->discovery.type = cp->type;
3877 hdev->discovery.report_invalid_rssi = false;
3878 if (op == MGMT_OP_START_LIMITED_DISCOVERY)
3879 hdev->discovery.limited = true;
3880 else
3881 hdev->discovery.limited = false;
3882
3883 cmd = mgmt_pending_add(sk, op, hdev, data, len);
3884 if (!cmd) {
3885 err = -ENOMEM;
3886 goto failed;
3887 }
3888
3889 cmd->cmd_complete = generic_cmd_complete;
3890
3891 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3892 queue_work(hdev->req_workqueue, &hdev->discov_update);
3893 err = 0;
3894
3895 failed:
3896 hci_dev_unlock(hdev);
3897 return err;
3898 }
3899
3900 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3901 void *data, u16 len)
3902 {
3903 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY,
3904 data, len);
3905 }
3906
3907 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev,
3908 void *data, u16 len)
3909 {
3910 return start_discovery_internal(sk, hdev,
3911 MGMT_OP_START_LIMITED_DISCOVERY,
3912 data, len);
3913 }
3914
3915 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
3916 u8 status)
3917 {
3918 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
3919 cmd->param, 1);
3920 }
3921
3922 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3923 void *data, u16 len)
3924 {
3925 struct mgmt_cp_start_service_discovery *cp = data;
3926 struct mgmt_pending_cmd *cmd;
3927 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3928 u16 uuid_count, expected_len;
3929 u8 status;
3930 int err;
3931
3932 BT_DBG("%s", hdev->name);
3933
3934 hci_dev_lock(hdev);
3935
3936 if (!hdev_is_powered(hdev)) {
3937 err = mgmt_cmd_complete(sk, hdev->id,
3938 MGMT_OP_START_SERVICE_DISCOVERY,
3939 MGMT_STATUS_NOT_POWERED,
3940 &cp->type, sizeof(cp->type));
3941 goto failed;
3942 }
3943
3944 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3945 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
3946 err = mgmt_cmd_complete(sk, hdev->id,
3947 MGMT_OP_START_SERVICE_DISCOVERY,
3948 MGMT_STATUS_BUSY, &cp->type,
3949 sizeof(cp->type));
3950 goto failed;
3951 }
3952
3953 uuid_count = __le16_to_cpu(cp->uuid_count);
3954 if (uuid_count > max_uuid_count) {
3955 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u",
3956 uuid_count);
3957 err = mgmt_cmd_complete(sk, hdev->id,
3958 MGMT_OP_START_SERVICE_DISCOVERY,
3959 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3960 sizeof(cp->type));
3961 goto failed;
3962 }
3963
3964 expected_len = sizeof(*cp) + uuid_count * 16;
3965 if (expected_len != len) {
3966 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes",
3967 expected_len, len);
3968 err = mgmt_cmd_complete(sk, hdev->id,
3969 MGMT_OP_START_SERVICE_DISCOVERY,
3970 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3971 sizeof(cp->type));
3972 goto failed;
3973 }
3974
3975 if (!discovery_type_is_valid(hdev, cp->type, &status)) {
3976 err = mgmt_cmd_complete(sk, hdev->id,
3977 MGMT_OP_START_SERVICE_DISCOVERY,
3978 status, &cp->type, sizeof(cp->type));
3979 goto failed;
3980 }
3981
3982 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
3983 hdev, data, len);
3984 if (!cmd) {
3985 err = -ENOMEM;
3986 goto failed;
3987 }
3988
3989 cmd->cmd_complete = service_discovery_cmd_complete;
3990
3991
3992
3993
3994 hci_discovery_filter_clear(hdev);
3995
3996 hdev->discovery.result_filtering = true;
3997 hdev->discovery.type = cp->type;
3998 hdev->discovery.rssi = cp->rssi;
3999 hdev->discovery.uuid_count = uuid_count;
4000
4001 if (uuid_count > 0) {
4002 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4003 GFP_KERNEL);
4004 if (!hdev->discovery.uuids) {
4005 err = mgmt_cmd_complete(sk, hdev->id,
4006 MGMT_OP_START_SERVICE_DISCOVERY,
4007 MGMT_STATUS_FAILED,
4008 &cp->type, sizeof(cp->type));
4009 mgmt_pending_remove(cmd);
4010 goto failed;
4011 }
4012 }
4013
4014 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4015 queue_work(hdev->req_workqueue, &hdev->discov_update);
4016 err = 0;
4017
4018 failed:
4019 hci_dev_unlock(hdev);
4020 return err;
4021 }
4022
4023 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status)
4024 {
4025 struct mgmt_pending_cmd *cmd;
4026
4027 BT_DBG("status %d", status);
4028
4029 hci_dev_lock(hdev);
4030
4031 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4032 if (cmd) {
4033 cmd->cmd_complete(cmd, mgmt_status(status));
4034 mgmt_pending_remove(cmd);
4035 }
4036
4037 hci_dev_unlock(hdev);
4038 }
4039
4040 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4041 u16 len)
4042 {
4043 struct mgmt_cp_stop_discovery *mgmt_cp = data;
4044 struct mgmt_pending_cmd *cmd;
4045 int err;
4046
4047 BT_DBG("%s", hdev->name);
4048
4049 hci_dev_lock(hdev);
4050
4051 if (!hci_discovery_active(hdev)) {
4052 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4053 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4054 sizeof(mgmt_cp->type));
4055 goto unlock;
4056 }
4057
4058 if (hdev->discovery.type != mgmt_cp->type) {
4059 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4060 MGMT_STATUS_INVALID_PARAMS,
4061 &mgmt_cp->type, sizeof(mgmt_cp->type));
4062 goto unlock;
4063 }
4064
4065 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4066 if (!cmd) {
4067 err = -ENOMEM;
4068 goto unlock;
4069 }
4070
4071 cmd->cmd_complete = generic_cmd_complete;
4072
4073 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4074 queue_work(hdev->req_workqueue, &hdev->discov_update);
4075 err = 0;
4076
4077 unlock:
4078 hci_dev_unlock(hdev);
4079 return err;
4080 }
4081
4082 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4083 u16 len)
4084 {
4085 struct mgmt_cp_confirm_name *cp = data;
4086 struct inquiry_entry *e;
4087 int err;
4088
4089 BT_DBG("%s", hdev->name);
4090
4091 hci_dev_lock(hdev);
4092
4093 if (!hci_discovery_active(hdev)) {
4094 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4095 MGMT_STATUS_FAILED, &cp->addr,
4096 sizeof(cp->addr));
4097 goto failed;
4098 }
4099
4100 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4101 if (!e) {
4102 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4103 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4104 sizeof(cp->addr));
4105 goto failed;
4106 }
4107
4108 if (cp->name_known) {
4109 e->name_state = NAME_KNOWN;
4110 list_del(&e->list);
4111 } else {
4112 e->name_state = NAME_NEEDED;
4113 hci_inquiry_cache_update_resolve(hdev, e);
4114 }
4115
4116 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4117 &cp->addr, sizeof(cp->addr));
4118
4119 failed:
4120 hci_dev_unlock(hdev);
4121 return err;
4122 }
4123
4124 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4125 u16 len)
4126 {
4127 struct mgmt_cp_block_device *cp = data;
4128 u8 status;
4129 int err;
4130
4131 BT_DBG("%s", hdev->name);
4132
4133 if (!bdaddr_type_is_valid(cp->addr.type))
4134 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4135 MGMT_STATUS_INVALID_PARAMS,
4136 &cp->addr, sizeof(cp->addr));
4137
4138 hci_dev_lock(hdev);
4139
4140 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4141 cp->addr.type);
4142 if (err < 0) {
4143 status = MGMT_STATUS_FAILED;
4144 goto done;
4145 }
4146
4147 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4148 sk);
4149 status = MGMT_STATUS_SUCCESS;
4150
4151 done:
4152 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4153 &cp->addr, sizeof(cp->addr));
4154
4155 hci_dev_unlock(hdev);
4156
4157 return err;
4158 }
4159
4160 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4161 u16 len)
4162 {
4163 struct mgmt_cp_unblock_device *cp = data;
4164 u8 status;
4165 int err;
4166
4167 BT_DBG("%s", hdev->name);
4168
4169 if (!bdaddr_type_is_valid(cp->addr.type))
4170 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4171 MGMT_STATUS_INVALID_PARAMS,
4172 &cp->addr, sizeof(cp->addr));
4173
4174 hci_dev_lock(hdev);
4175
4176 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4177 cp->addr.type);
4178 if (err < 0) {
4179 status = MGMT_STATUS_INVALID_PARAMS;
4180 goto done;
4181 }
4182
4183 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4184 sk);
4185 status = MGMT_STATUS_SUCCESS;
4186
4187 done:
4188 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4189 &cp->addr, sizeof(cp->addr));
4190
4191 hci_dev_unlock(hdev);
4192
4193 return err;
4194 }
4195
4196 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4197 u16 len)
4198 {
4199 struct mgmt_cp_set_device_id *cp = data;
4200 struct hci_request req;
4201 int err;
4202 __u16 source;
4203
4204 BT_DBG("%s", hdev->name);
4205
4206 source = __le16_to_cpu(cp->source);
4207
4208 if (source > 0x0002)
4209 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4210 MGMT_STATUS_INVALID_PARAMS);
4211
4212 hci_dev_lock(hdev);
4213
4214 hdev->devid_source = source;
4215 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4216 hdev->devid_product = __le16_to_cpu(cp->product);
4217 hdev->devid_version = __le16_to_cpu(cp->version);
4218
4219 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4220 NULL, 0);
4221
4222 hci_req_init(&req, hdev);
4223 __hci_req_update_eir(&req);
4224 hci_req_run(&req, NULL);
4225
4226 hci_dev_unlock(hdev);
4227
4228 return err;
4229 }
4230
4231 static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4232 u16 opcode)
4233 {
4234 BT_DBG("status %d", status);
4235 }
4236
4237 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4238 u16 opcode)
4239 {
4240 struct cmd_lookup match = { NULL, hdev };
4241 struct hci_request req;
4242 u8 instance;
4243 struct adv_info *adv_instance;
4244 int err;
4245
4246 hci_dev_lock(hdev);
4247
4248 if (status) {
4249 u8 mgmt_err = mgmt_status(status);
4250
4251 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4252 cmd_status_rsp, &mgmt_err);
4253 goto unlock;
4254 }
4255
4256 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
4257 hci_dev_set_flag(hdev, HCI_ADVERTISING);
4258 else
4259 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
4260
4261 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4262 &match);
4263
4264 new_settings(hdev, match.sk);
4265
4266 if (match.sk)
4267 sock_put(match.sk);
4268
4269
4270
4271
4272 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4273 list_empty(&hdev->adv_instances))
4274 goto unlock;
4275
4276 instance = hdev->cur_adv_instance;
4277 if (!instance) {
4278 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4279 struct adv_info, list);
4280 if (!adv_instance)
4281 goto unlock;
4282
4283 instance = adv_instance->instance;
4284 }
4285
4286 hci_req_init(&req, hdev);
4287
4288 err = __hci_req_schedule_adv_instance(&req, instance, true);
4289
4290 if (!err)
4291 err = hci_req_run(&req, enable_advertising_instance);
4292
4293 if (err)
4294 bt_dev_err(hdev, "failed to re-configure advertising");
4295
4296 unlock:
4297 hci_dev_unlock(hdev);
4298 }
4299
4300 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4301 u16 len)
4302 {
4303 struct mgmt_mode *cp = data;
4304 struct mgmt_pending_cmd *cmd;
4305 struct hci_request req;
4306 u8 val, status;
4307 int err;
4308
4309 BT_DBG("request for %s", hdev->name);
4310
4311 status = mgmt_le_support(hdev);
4312 if (status)
4313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4314 status);
4315
4316 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4317 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4318 MGMT_STATUS_INVALID_PARAMS);
4319
4320 hci_dev_lock(hdev);
4321
4322 val = !!cp->val;
4323
4324
4325
4326
4327
4328
4329 if (!hdev_is_powered(hdev) ||
4330 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4331 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
4332 hci_conn_num(hdev, LE_LINK) > 0 ||
4333 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4334 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4335 bool changed;
4336
4337 if (cp->val) {
4338 hdev->cur_adv_instance = 0x00;
4339 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
4340 if (cp->val == 0x02)
4341 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4342 else
4343 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4344 } else {
4345 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
4346 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4347 }
4348
4349 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4350 if (err < 0)
4351 goto unlock;
4352
4353 if (changed)
4354 err = new_settings(hdev, sk);
4355
4356 goto unlock;
4357 }
4358
4359 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4360 pending_find(MGMT_OP_SET_LE, hdev)) {
4361 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4362 MGMT_STATUS_BUSY);
4363 goto unlock;
4364 }
4365
4366 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4367 if (!cmd) {
4368 err = -ENOMEM;
4369 goto unlock;
4370 }
4371
4372 hci_req_init(&req, hdev);
4373
4374 if (cp->val == 0x02)
4375 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4376 else
4377 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4378
4379 cancel_adv_timeout(hdev);
4380
4381 if (val) {
4382
4383
4384
4385
4386 hdev->cur_adv_instance = 0x00;
4387
4388 if (ext_adv_capable(hdev)) {
4389 __hci_req_start_ext_adv(&req, 0x00);
4390 } else {
4391 __hci_req_update_adv_data(&req, 0x00);
4392 __hci_req_update_scan_rsp_data(&req, 0x00);
4393 __hci_req_enable_advertising(&req);
4394 }
4395 } else {
4396 __hci_req_disable_advertising(&req);
4397 }
4398
4399 err = hci_req_run(&req, set_advertising_complete);
4400 if (err < 0)
4401 mgmt_pending_remove(cmd);
4402
4403 unlock:
4404 hci_dev_unlock(hdev);
4405 return err;
4406 }
4407
4408 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4409 void *data, u16 len)
4410 {
4411 struct mgmt_cp_set_static_address *cp = data;
4412 int err;
4413
4414 BT_DBG("%s", hdev->name);
4415
4416 if (!lmp_le_capable(hdev))
4417 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4418 MGMT_STATUS_NOT_SUPPORTED);
4419
4420 if (hdev_is_powered(hdev))
4421 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4422 MGMT_STATUS_REJECTED);
4423
4424 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4425 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4426 return mgmt_cmd_status(sk, hdev->id,
4427 MGMT_OP_SET_STATIC_ADDRESS,
4428 MGMT_STATUS_INVALID_PARAMS);
4429
4430
4431 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4432 return mgmt_cmd_status(sk, hdev->id,
4433 MGMT_OP_SET_STATIC_ADDRESS,
4434 MGMT_STATUS_INVALID_PARAMS);
4435 }
4436
4437 hci_dev_lock(hdev);
4438
4439 bacpy(&hdev->static_addr, &cp->bdaddr);
4440
4441 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4442 if (err < 0)
4443 goto unlock;
4444
4445 err = new_settings(hdev, sk);
4446
4447 unlock:
4448 hci_dev_unlock(hdev);
4449 return err;
4450 }
4451
4452 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4453 void *data, u16 len)
4454 {
4455 struct mgmt_cp_set_scan_params *cp = data;
4456 __u16 interval, window;
4457 int err;
4458
4459 BT_DBG("%s", hdev->name);
4460
4461 if (!lmp_le_capable(hdev))
4462 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4463 MGMT_STATUS_NOT_SUPPORTED);
4464
4465 interval = __le16_to_cpu(cp->interval);
4466
4467 if (interval < 0x0004 || interval > 0x4000)
4468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4469 MGMT_STATUS_INVALID_PARAMS);
4470
4471 window = __le16_to_cpu(cp->window);
4472
4473 if (window < 0x0004 || window > 0x4000)
4474 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4475 MGMT_STATUS_INVALID_PARAMS);
4476
4477 if (window > interval)
4478 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4479 MGMT_STATUS_INVALID_PARAMS);
4480
4481 hci_dev_lock(hdev);
4482
4483 hdev->le_scan_interval = interval;
4484 hdev->le_scan_window = window;
4485
4486 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4487 NULL, 0);
4488
4489
4490
4491
4492 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4493 hdev->discovery.state == DISCOVERY_STOPPED) {
4494 struct hci_request req;
4495
4496 hci_req_init(&req, hdev);
4497
4498 hci_req_add_le_scan_disable(&req);
4499 hci_req_add_le_passive_scan(&req);
4500
4501 hci_req_run(&req, NULL);
4502 }
4503
4504 hci_dev_unlock(hdev);
4505
4506 return err;
4507 }
4508
4509 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4510 u16 opcode)
4511 {
4512 struct mgmt_pending_cmd *cmd;
4513
4514 BT_DBG("status 0x%02x", status);
4515
4516 hci_dev_lock(hdev);
4517
4518 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4519 if (!cmd)
4520 goto unlock;
4521
4522 if (status) {
4523 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4524 mgmt_status(status));
4525 } else {
4526 struct mgmt_mode *cp = cmd->param;
4527
4528 if (cp->val)
4529 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
4530 else
4531 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4532
4533 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4534 new_settings(hdev, cmd->sk);
4535 }
4536
4537 mgmt_pending_remove(cmd);
4538
4539 unlock:
4540 hci_dev_unlock(hdev);
4541 }
4542
4543 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4544 void *data, u16 len)
4545 {
4546 struct mgmt_mode *cp = data;
4547 struct mgmt_pending_cmd *cmd;
4548 struct hci_request req;
4549 int err;
4550
4551 BT_DBG("%s", hdev->name);
4552
4553 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
4554 hdev->hci_ver < BLUETOOTH_VER_1_2)
4555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4556 MGMT_STATUS_NOT_SUPPORTED);
4557
4558 if (cp->val != 0x00 && cp->val != 0x01)
4559 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4560 MGMT_STATUS_INVALID_PARAMS);
4561
4562 hci_dev_lock(hdev);
4563
4564 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4565 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4566 MGMT_STATUS_BUSY);
4567 goto unlock;
4568 }
4569
4570 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
4571 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4572 hdev);
4573 goto unlock;
4574 }
4575
4576 if (!hdev_is_powered(hdev)) {
4577 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
4578 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4579 hdev);
4580 new_settings(hdev, sk);
4581 goto unlock;
4582 }
4583
4584 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4585 data, len);
4586 if (!cmd) {
4587 err = -ENOMEM;
4588 goto unlock;
4589 }
4590
4591 hci_req_init(&req, hdev);
4592
4593 __hci_req_write_fast_connectable(&req, cp->val);
4594
4595 err = hci_req_run(&req, fast_connectable_complete);
4596 if (err < 0) {
4597 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4598 MGMT_STATUS_FAILED);
4599 mgmt_pending_remove(cmd);
4600 }
4601
4602 unlock:
4603 hci_dev_unlock(hdev);
4604
4605 return err;
4606 }
4607
4608 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4609 {
4610 struct mgmt_pending_cmd *cmd;
4611
4612 BT_DBG("status 0x%02x", status);
4613
4614 hci_dev_lock(hdev);
4615
4616 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
4617 if (!cmd)
4618 goto unlock;
4619
4620 if (status) {
4621 u8 mgmt_err = mgmt_status(status);
4622
4623
4624
4625
4626 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
4627
4628 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4629 } else {
4630 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4631 new_settings(hdev, cmd->sk);
4632 }
4633
4634 mgmt_pending_remove(cmd);
4635
4636 unlock:
4637 hci_dev_unlock(hdev);
4638 }
4639
4640 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4641 {
4642 struct mgmt_mode *cp = data;
4643 struct mgmt_pending_cmd *cmd;
4644 struct hci_request req;
4645 int err;
4646
4647 BT_DBG("request for %s", hdev->name);
4648
4649 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4650 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4651 MGMT_STATUS_NOT_SUPPORTED);
4652
4653 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4654 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4655 MGMT_STATUS_REJECTED);
4656
4657 if (cp->val != 0x00 && cp->val != 0x01)
4658 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659 MGMT_STATUS_INVALID_PARAMS);
4660
4661 hci_dev_lock(hdev);
4662
4663 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4664 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4665 goto unlock;
4666 }
4667
4668 if (!hdev_is_powered(hdev)) {
4669 if (!cp->val) {
4670 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4671 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4672 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4673 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4674 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
4675 }
4676
4677 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
4678
4679 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4680 if (err < 0)
4681 goto unlock;
4682
4683 err = new_settings(hdev, sk);
4684 goto unlock;
4685 }
4686
4687
4688 if (!cp->val) {
4689 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4690 MGMT_STATUS_REJECTED);
4691 goto unlock;
4692 } else {
4693
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4708 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4709 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
4710 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4711 MGMT_STATUS_REJECTED);
4712 goto unlock;
4713 }
4714 }
4715
4716 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
4717 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4718 MGMT_STATUS_BUSY);
4719 goto unlock;
4720 }
4721
4722 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4723 if (!cmd) {
4724 err = -ENOMEM;
4725 goto unlock;
4726 }
4727
4728
4729
4730
4731 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
4732
4733 hci_req_init(&req, hdev);
4734
4735 __hci_req_write_fast_connectable(&req, false);
4736 __hci_req_update_scan(&req);
4737
4738
4739
4740
4741 __hci_req_update_adv_data(&req, hdev->cur_adv_instance);
4742
4743 err = hci_req_run(&req, set_bredr_complete);
4744 if (err < 0)
4745 mgmt_pending_remove(cmd);
4746
4747 unlock:
4748 hci_dev_unlock(hdev);
4749 return err;
4750 }
4751
4752 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4753 {
4754 struct mgmt_pending_cmd *cmd;
4755 struct mgmt_mode *cp;
4756
4757 BT_DBG("%s status %u", hdev->name, status);
4758
4759 hci_dev_lock(hdev);
4760
4761 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4762 if (!cmd)
4763 goto unlock;
4764
4765 if (status) {
4766 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4767 mgmt_status(status));
4768 goto remove;
4769 }
4770
4771 cp = cmd->param;
4772
4773 switch (cp->val) {
4774 case 0x00:
4775 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4776 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4777 break;
4778 case 0x01:
4779 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4780 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4781 break;
4782 case 0x02:
4783 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4784 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4785 break;
4786 }
4787
4788 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4789 new_settings(hdev, cmd->sk);
4790
4791 remove:
4792 mgmt_pending_remove(cmd);
4793 unlock:
4794 hci_dev_unlock(hdev);
4795 }
4796
4797 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4798 void *data, u16 len)
4799 {
4800 struct mgmt_mode *cp = data;
4801 struct mgmt_pending_cmd *cmd;
4802 struct hci_request req;
4803 u8 val;
4804 int err;
4805
4806 BT_DBG("request for %s", hdev->name);
4807
4808 if (!lmp_sc_capable(hdev) &&
4809 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
4810 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4811 MGMT_STATUS_NOT_SUPPORTED);
4812
4813 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
4814 lmp_sc_capable(hdev) &&
4815 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
4816 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4817 MGMT_STATUS_REJECTED);
4818
4819 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4820 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4821 MGMT_STATUS_INVALID_PARAMS);
4822
4823 hci_dev_lock(hdev);
4824
4825 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
4826 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4827 bool changed;
4828
4829 if (cp->val) {
4830 changed = !hci_dev_test_and_set_flag(hdev,
4831 HCI_SC_ENABLED);
4832 if (cp->val == 0x02)
4833 hci_dev_set_flag(hdev, HCI_SC_ONLY);
4834 else
4835 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4836 } else {
4837 changed = hci_dev_test_and_clear_flag(hdev,
4838 HCI_SC_ENABLED);
4839 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
4840 }
4841
4842 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4843 if (err < 0)
4844 goto failed;
4845
4846 if (changed)
4847 err = new_settings(hdev, sk);
4848
4849 goto failed;
4850 }
4851
4852 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4854 MGMT_STATUS_BUSY);
4855 goto failed;
4856 }
4857
4858 val = !!cp->val;
4859
4860 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4861 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4862 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4863 goto failed;
4864 }
4865
4866 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4867 if (!cmd) {
4868 err = -ENOMEM;
4869 goto failed;
4870 }
4871
4872 hci_req_init(&req, hdev);
4873 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4874 err = hci_req_run(&req, sc_enable_complete);
4875 if (err < 0) {
4876 mgmt_pending_remove(cmd);
4877 goto failed;
4878 }
4879
4880 failed:
4881 hci_dev_unlock(hdev);
4882 return err;
4883 }
4884
4885 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4886 void *data, u16 len)
4887 {
4888 struct mgmt_mode *cp = data;
4889 bool changed, use_changed;
4890 int err;
4891
4892 BT_DBG("request for %s", hdev->name);
4893
4894 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4896 MGMT_STATUS_INVALID_PARAMS);
4897
4898 hci_dev_lock(hdev);
4899
4900 if (cp->val)
4901 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4902 else
4903 changed = hci_dev_test_and_clear_flag(hdev,
4904 HCI_KEEP_DEBUG_KEYS);
4905
4906 if (cp->val == 0x02)
4907 use_changed = !hci_dev_test_and_set_flag(hdev,
4908 HCI_USE_DEBUG_KEYS);
4909 else
4910 use_changed = hci_dev_test_and_clear_flag(hdev,
4911 HCI_USE_DEBUG_KEYS);
4912
4913 if (hdev_is_powered(hdev) && use_changed &&
4914 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
4915 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4916 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4917 sizeof(mode), &mode);
4918 }
4919
4920 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4921 if (err < 0)
4922 goto unlock;
4923
4924 if (changed)
4925 err = new_settings(hdev, sk);
4926
4927 unlock:
4928 hci_dev_unlock(hdev);
4929 return err;
4930 }
4931
4932 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4933 u16 len)
4934 {
4935 struct mgmt_cp_set_privacy *cp = cp_data;
4936 bool changed;
4937 int err;
4938
4939 BT_DBG("request for %s", hdev->name);
4940
4941 if (!lmp_le_capable(hdev))
4942 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4943 MGMT_STATUS_NOT_SUPPORTED);
4944
4945 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02)
4946 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4947 MGMT_STATUS_INVALID_PARAMS);
4948
4949 if (hdev_is_powered(hdev))
4950 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4951 MGMT_STATUS_REJECTED);
4952
4953 hci_dev_lock(hdev);
4954
4955
4956
4957
4958 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
4959
4960 if (cp->privacy) {
4961 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
4962 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4963 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4964 hci_adv_instances_set_rpa_expired(hdev, true);
4965 if (cp->privacy == 0x02)
4966 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY);
4967 else
4968 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4969 } else {
4970 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
4971 memset(hdev->irk, 0, sizeof(hdev->irk));
4972 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
4973 hci_adv_instances_set_rpa_expired(hdev, false);
4974 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY);
4975 }
4976
4977 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4978 if (err < 0)
4979 goto unlock;
4980
4981 if (changed)
4982 err = new_settings(hdev, sk);
4983
4984 unlock:
4985 hci_dev_unlock(hdev);
4986 return err;
4987 }
4988
4989 static bool irk_is_valid(struct mgmt_irk_info *irk)
4990 {
4991 switch (irk->addr.type) {
4992 case BDADDR_LE_PUBLIC:
4993 return true;
4994
4995 case BDADDR_LE_RANDOM:
4996
4997 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4998 return false;
4999 return true;
5000 }
5001
5002 return false;
5003 }
5004
5005 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5006 u16 len)
5007 {
5008 struct mgmt_cp_load_irks *cp = cp_data;
5009 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5010 sizeof(struct mgmt_irk_info));
5011 u16 irk_count, expected_len;
5012 int i, err;
5013
5014 BT_DBG("request for %s", hdev->name);
5015
5016 if (!lmp_le_capable(hdev))
5017 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5018 MGMT_STATUS_NOT_SUPPORTED);
5019
5020 irk_count = __le16_to_cpu(cp->irk_count);
5021 if (irk_count > max_irk_count) {
5022 bt_dev_err(hdev, "load_irks: too big irk_count value %u",
5023 irk_count);
5024 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5025 MGMT_STATUS_INVALID_PARAMS);
5026 }
5027
5028 expected_len = struct_size(cp, irks, irk_count);
5029 if (expected_len != len) {
5030 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes",
5031 expected_len, len);
5032 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5033 MGMT_STATUS_INVALID_PARAMS);
5034 }
5035
5036 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5037
5038 for (i = 0; i < irk_count; i++) {
5039 struct mgmt_irk_info *key = &cp->irks[i];
5040
5041 if (!irk_is_valid(key))
5042 return mgmt_cmd_status(sk, hdev->id,
5043 MGMT_OP_LOAD_IRKS,
5044 MGMT_STATUS_INVALID_PARAMS);
5045 }
5046
5047 hci_dev_lock(hdev);
5048
5049 hci_smp_irks_clear(hdev);
5050
5051 for (i = 0; i < irk_count; i++) {
5052 struct mgmt_irk_info *irk = &cp->irks[i];
5053
5054 hci_add_irk(hdev, &irk->addr.bdaddr,
5055 le_addr_type(irk->addr.type), irk->val,
5056 BDADDR_ANY);
5057 }
5058
5059 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
5060
5061 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5062
5063 hci_dev_unlock(hdev);
5064
5065 return err;
5066 }
5067
5068 static bool ltk_is_valid(struct mgmt_ltk_info *key)
5069 {
5070 if (key->master != 0x00 && key->master != 0x01)
5071 return false;
5072
5073 switch (key->addr.type) {
5074 case BDADDR_LE_PUBLIC:
5075 return true;
5076
5077 case BDADDR_LE_RANDOM:
5078
5079 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5080 return false;
5081 return true;
5082 }
5083
5084 return false;
5085 }
5086
5087 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
5088 void *cp_data, u16 len)
5089 {
5090 struct mgmt_cp_load_long_term_keys *cp = cp_data;
5091 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5092 sizeof(struct mgmt_ltk_info));
5093 u16 key_count, expected_len;
5094 int i, err;
5095
5096 BT_DBG("request for %s", hdev->name);
5097
5098 if (!lmp_le_capable(hdev))
5099 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5100 MGMT_STATUS_NOT_SUPPORTED);
5101
5102 key_count = __le16_to_cpu(cp->key_count);
5103 if (key_count > max_key_count) {
5104 bt_dev_err(hdev, "load_ltks: too big key_count value %u",
5105 key_count);
5106 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5107 MGMT_STATUS_INVALID_PARAMS);
5108 }
5109
5110 expected_len = struct_size(cp, keys, key_count);
5111 if (expected_len != len) {
5112 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes",
5113 expected_len, len);
5114 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5115 MGMT_STATUS_INVALID_PARAMS);
5116 }
5117
5118 BT_DBG("%s key_count %u", hdev->name, key_count);
5119
5120 for (i = 0; i < key_count; i++) {
5121 struct mgmt_ltk_info *key = &cp->keys[i];
5122
5123 if (!ltk_is_valid(key))
5124 return mgmt_cmd_status(sk, hdev->id,
5125 MGMT_OP_LOAD_LONG_TERM_KEYS,
5126 MGMT_STATUS_INVALID_PARAMS);
5127 }
5128
5129 hci_dev_lock(hdev);
5130
5131 hci_smp_ltks_clear(hdev);
5132
5133 for (i = 0; i < key_count; i++) {
5134 struct mgmt_ltk_info *key = &cp->keys[i];
5135 u8 type, authenticated;
5136
5137 switch (key->type) {
5138 case MGMT_LTK_UNAUTHENTICATED:
5139 authenticated = 0x00;
5140 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5141 break;
5142 case MGMT_LTK_AUTHENTICATED:
5143 authenticated = 0x01;
5144 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5145 break;
5146 case MGMT_LTK_P256_UNAUTH:
5147 authenticated = 0x00;
5148 type = SMP_LTK_P256;
5149 break;
5150 case MGMT_LTK_P256_AUTH:
5151 authenticated = 0x01;
5152 type = SMP_LTK_P256;
5153 break;
5154 case MGMT_LTK_P256_DEBUG:
5155 authenticated = 0x00;
5156 type = SMP_LTK_P256_DEBUG;
5157
5158 default:
5159 continue;
5160 }
5161
5162 hci_add_ltk(hdev, &key->addr.bdaddr,
5163 le_addr_type(key->addr.type), type, authenticated,
5164 key->val, key->enc_size, key->ediv, key->rand);
5165 }
5166
5167 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5168 NULL, 0);
5169
5170 hci_dev_unlock(hdev);
5171
5172 return err;
5173 }
5174
5175 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5176 {
5177 struct hci_conn *conn = cmd->user_data;
5178 struct mgmt_rp_get_conn_info rp;
5179 int err;
5180
5181 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5182
5183 if (status == MGMT_STATUS_SUCCESS) {
5184 rp.rssi = conn->rssi;
5185 rp.tx_power = conn->tx_power;
5186 rp.max_tx_power = conn->max_tx_power;
5187 } else {
5188 rp.rssi = HCI_RSSI_INVALID;
5189 rp.tx_power = HCI_TX_POWER_INVALID;
5190 rp.max_tx_power = HCI_TX_POWER_INVALID;
5191 }
5192
5193 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5194 status, &rp, sizeof(rp));
5195
5196 hci_conn_drop(conn);
5197 hci_conn_put(conn);
5198
5199 return err;
5200 }
5201
5202 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5203 u16 opcode)
5204 {
5205 struct hci_cp_read_rssi *cp;
5206 struct mgmt_pending_cmd *cmd;
5207 struct hci_conn *conn;
5208 u16 handle;
5209 u8 status;
5210
5211 BT_DBG("status 0x%02x", hci_status);
5212
5213 hci_dev_lock(hdev);
5214
5215
5216
5217
5218
5219
5220
5221
5222
5223
5224 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5225 if (!cp) {
5226 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5227 status = MGMT_STATUS_SUCCESS;
5228 } else {
5229 status = mgmt_status(hci_status);
5230 }
5231
5232 if (!cp) {
5233 bt_dev_err(hdev, "invalid sent_cmd in conn_info response");
5234 goto unlock;
5235 }
5236
5237 handle = __le16_to_cpu(cp->handle);
5238 conn = hci_conn_hash_lookup_handle(hdev, handle);
5239 if (!conn) {
5240 bt_dev_err(hdev, "unknown handle (%d) in conn_info response",
5241 handle);
5242 goto unlock;
5243 }
5244
5245 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5246 if (!cmd)
5247 goto unlock;
5248
5249 cmd->cmd_complete(cmd, status);
5250 mgmt_pending_remove(cmd);
5251
5252 unlock:
5253 hci_dev_unlock(hdev);
5254 }
5255
5256 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5257 u16 len)
5258 {
5259 struct mgmt_cp_get_conn_info *cp = data;
5260 struct mgmt_rp_get_conn_info rp;
5261 struct hci_conn *conn;
5262 unsigned long conn_info_age;
5263 int err = 0;
5264
5265 BT_DBG("%s", hdev->name);
5266
5267 memset(&rp, 0, sizeof(rp));
5268 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5269 rp.addr.type = cp->addr.type;
5270
5271 if (!bdaddr_type_is_valid(cp->addr.type))
5272 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5273 MGMT_STATUS_INVALID_PARAMS,
5274 &rp, sizeof(rp));
5275
5276 hci_dev_lock(hdev);
5277
5278 if (!hdev_is_powered(hdev)) {
5279 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5280 MGMT_STATUS_NOT_POWERED, &rp,
5281 sizeof(rp));
5282 goto unlock;
5283 }
5284
5285 if (cp->addr.type == BDADDR_BREDR)
5286 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5287 &cp->addr.bdaddr);
5288 else
5289 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5290
5291 if (!conn || conn->state != BT_CONNECTED) {
5292 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5293 MGMT_STATUS_NOT_CONNECTED, &rp,
5294 sizeof(rp));
5295 goto unlock;
5296 }
5297
5298 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5299 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5300 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5301 goto unlock;
5302 }
5303
5304
5305
5306
5307 conn_info_age = hdev->conn_info_min_age +
5308 prandom_u32_max(hdev->conn_info_max_age -
5309 hdev->conn_info_min_age);
5310
5311
5312
5313
5314 if (time_after(jiffies, conn->conn_info_timestamp +
5315 msecs_to_jiffies(conn_info_age)) ||
5316 !conn->conn_info_timestamp) {
5317 struct hci_request req;
5318 struct hci_cp_read_tx_power req_txp_cp;
5319 struct hci_cp_read_rssi req_rssi_cp;
5320 struct mgmt_pending_cmd *cmd;
5321
5322 hci_req_init(&req, hdev);
5323 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5324 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5325 &req_rssi_cp);
5326
5327
5328
5329
5330 if (!bdaddr_type_is_le(cp->addr.type) ||
5331 conn->tx_power == HCI_TX_POWER_INVALID) {
5332 req_txp_cp.handle = cpu_to_le16(conn->handle);
5333 req_txp_cp.type = 0x00;
5334 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5335 sizeof(req_txp_cp), &req_txp_cp);
5336 }
5337
5338
5339 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5340 req_txp_cp.handle = cpu_to_le16(conn->handle);
5341 req_txp_cp.type = 0x01;
5342 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5343 sizeof(req_txp_cp), &req_txp_cp);
5344 }
5345
5346 err = hci_req_run(&req, conn_info_refresh_complete);
5347 if (err < 0)
5348 goto unlock;
5349
5350 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5351 data, len);
5352 if (!cmd) {
5353 err = -ENOMEM;
5354 goto unlock;
5355 }
5356
5357 hci_conn_hold(conn);
5358 cmd->user_data = hci_conn_get(conn);
5359 cmd->cmd_complete = conn_info_cmd_complete;
5360
5361 conn->conn_info_timestamp = jiffies;
5362 } else {
5363
5364 rp.rssi = conn->rssi;
5365 rp.tx_power = conn->tx_power;
5366 rp.max_tx_power = conn->max_tx_power;
5367
5368 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5369 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5370 }
5371
5372 unlock:
5373 hci_dev_unlock(hdev);
5374 return err;
5375 }
5376
5377 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
5378 {
5379 struct hci_conn *conn = cmd->user_data;
5380 struct mgmt_rp_get_clock_info rp;
5381 struct hci_dev *hdev;
5382 int err;
5383
5384 memset(&rp, 0, sizeof(rp));
5385 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
5386
5387 if (status)
5388 goto complete;
5389
5390 hdev = hci_dev_get(cmd->index);
5391 if (hdev) {
5392 rp.local_clock = cpu_to_le32(hdev->clock);
5393 hci_dev_put(hdev);
5394 }
5395
5396 if (conn) {
5397 rp.piconet_clock = cpu_to_le32(conn->clock);
5398 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5399 }
5400
5401 complete:
5402 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5403 sizeof(rp));
5404
5405 if (conn) {
5406 hci_conn_drop(conn);
5407 hci_conn_put(conn);
5408 }
5409
5410 return err;
5411 }
5412
5413 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5414 {
5415 struct hci_cp_read_clock *hci_cp;
5416 struct mgmt_pending_cmd *cmd;
5417 struct hci_conn *conn;
5418
5419 BT_DBG("%s status %u", hdev->name, status);
5420
5421 hci_dev_lock(hdev);
5422
5423 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5424 if (!hci_cp)
5425 goto unlock;
5426
5427 if (hci_cp->which) {
5428 u16 handle = __le16_to_cpu(hci_cp->handle);
5429 conn = hci_conn_hash_lookup_handle(hdev, handle);
5430 } else {
5431 conn = NULL;
5432 }
5433
5434 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5435 if (!cmd)
5436 goto unlock;
5437
5438 cmd->cmd_complete(cmd, mgmt_status(status));
5439 mgmt_pending_remove(cmd);
5440
5441 unlock:
5442 hci_dev_unlock(hdev);
5443 }
5444
5445 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5446 u16 len)
5447 {
5448 struct mgmt_cp_get_clock_info *cp = data;
5449 struct mgmt_rp_get_clock_info rp;
5450 struct hci_cp_read_clock hci_cp;
5451 struct mgmt_pending_cmd *cmd;
5452 struct hci_request req;
5453 struct hci_conn *conn;
5454 int err;
5455
5456 BT_DBG("%s", hdev->name);
5457
5458 memset(&rp, 0, sizeof(rp));
5459 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5460 rp.addr.type = cp->addr.type;
5461
5462 if (cp->addr.type != BDADDR_BREDR)
5463 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5464 MGMT_STATUS_INVALID_PARAMS,
5465 &rp, sizeof(rp));
5466
5467 hci_dev_lock(hdev);
5468
5469 if (!hdev_is_powered(hdev)) {
5470 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5471 MGMT_STATUS_NOT_POWERED, &rp,
5472 sizeof(rp));
5473 goto unlock;
5474 }
5475
5476 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5477 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5478 &cp->addr.bdaddr);
5479 if (!conn || conn->state != BT_CONNECTED) {
5480 err = mgmt_cmd_complete(sk, hdev->id,
5481 MGMT_OP_GET_CLOCK_INFO,
5482 MGMT_STATUS_NOT_CONNECTED,
5483 &rp, sizeof(rp));
5484 goto unlock;
5485 }
5486 } else {
5487 conn = NULL;
5488 }
5489
5490 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5491 if (!cmd) {
5492 err = -ENOMEM;
5493 goto unlock;
5494 }
5495
5496 cmd->cmd_complete = clock_info_cmd_complete;
5497
5498 hci_req_init(&req, hdev);
5499
5500 memset(&hci_cp, 0, sizeof(hci_cp));
5501 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5502
5503 if (conn) {
5504 hci_conn_hold(conn);
5505 cmd->user_data = hci_conn_get(conn);
5506
5507 hci_cp.handle = cpu_to_le16(conn->handle);
5508 hci_cp.which = 0x01;
5509 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5510 }
5511
5512 err = hci_req_run(&req, get_clock_info_complete);
5513 if (err < 0)
5514 mgmt_pending_remove(cmd);
5515
5516 unlock:
5517 hci_dev_unlock(hdev);
5518 return err;
5519 }
5520
5521 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5522 {
5523 struct hci_conn *conn;
5524
5525 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5526 if (!conn)
5527 return false;
5528
5529 if (conn->dst_type != type)
5530 return false;
5531
5532 if (conn->state != BT_CONNECTED)
5533 return false;
5534
5535 return true;
5536 }
5537
5538
5539 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr,
5540 u8 addr_type, u8 auto_connect)
5541 {
5542 struct hci_conn_params *params;
5543
5544 params = hci_conn_params_add(hdev, addr, addr_type);
5545 if (!params)
5546 return -EIO;
5547
5548 if (params->auto_connect == auto_connect)
5549 return 0;
5550
5551 list_del_init(¶ms->action);
5552
5553 switch (auto_connect) {
5554 case HCI_AUTO_CONN_DISABLED:
5555 case HCI_AUTO_CONN_LINK_LOSS:
5556
5557
5558
5559 if (params->explicit_connect)
5560 list_add(¶ms->action, &hdev->pend_le_conns);
5561 break;
5562 case HCI_AUTO_CONN_REPORT:
5563 if (params->explicit_connect)
5564 list_add(¶ms->action, &hdev->pend_le_conns);
5565 else
5566 list_add(¶ms->action, &hdev->pend_le_reports);
5567 break;
5568 case HCI_AUTO_CONN_DIRECT:
5569 case HCI_AUTO_CONN_ALWAYS:
5570 if (!is_connected(hdev, addr, addr_type))
5571 list_add(¶ms->action, &hdev->pend_le_conns);
5572 break;
5573 }
5574
5575 params->auto_connect = auto_connect;
5576
5577 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5578 auto_connect);
5579
5580 return 0;
5581 }
5582
5583 static void device_added(struct sock *sk, struct hci_dev *hdev,
5584 bdaddr_t *bdaddr, u8 type, u8 action)
5585 {
5586 struct mgmt_ev_device_added ev;
5587
5588 bacpy(&ev.addr.bdaddr, bdaddr);
5589 ev.addr.type = type;
5590 ev.action = action;
5591
5592 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5593 }
5594
5595 static int add_device(struct sock *sk, struct hci_dev *hdev,
5596 void *data, u16 len)
5597 {
5598 struct mgmt_cp_add_device *cp = data;
5599 u8 auto_conn, addr_type;
5600 int err;
5601
5602 BT_DBG("%s", hdev->name);
5603
5604 if (!bdaddr_type_is_valid(cp->addr.type) ||
5605 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5606 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5607 MGMT_STATUS_INVALID_PARAMS,
5608 &cp->addr, sizeof(cp->addr));
5609
5610 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5611 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5612 MGMT_STATUS_INVALID_PARAMS,
5613 &cp->addr, sizeof(cp->addr));
5614
5615 hci_dev_lock(hdev);
5616
5617 if (cp->addr.type == BDADDR_BREDR) {
5618
5619 if (cp->action != 0x01) {
5620 err = mgmt_cmd_complete(sk, hdev->id,
5621 MGMT_OP_ADD_DEVICE,
5622 MGMT_STATUS_INVALID_PARAMS,
5623 &cp->addr, sizeof(cp->addr));
5624 goto unlock;
5625 }
5626
5627 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5628 cp->addr.type);
5629 if (err)
5630 goto unlock;
5631
5632 hci_req_update_scan(hdev);
5633
5634 goto added;
5635 }
5636
5637 addr_type = le_addr_type(cp->addr.type);
5638
5639 if (cp->action == 0x02)
5640 auto_conn = HCI_AUTO_CONN_ALWAYS;
5641 else if (cp->action == 0x01)
5642 auto_conn = HCI_AUTO_CONN_DIRECT;
5643 else
5644 auto_conn = HCI_AUTO_CONN_REPORT;
5645
5646
5647
5648
5649
5650
5651 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5652 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5653 MGMT_STATUS_INVALID_PARAMS,
5654 &cp->addr, sizeof(cp->addr));
5655 goto unlock;
5656 }
5657
5658
5659
5660
5661 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5662 auto_conn) < 0) {
5663 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5664 MGMT_STATUS_FAILED, &cp->addr,
5665 sizeof(cp->addr));
5666 goto unlock;
5667 }
5668
5669 hci_update_background_scan(hdev);
5670
5671 added:
5672 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5673
5674 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5675 MGMT_STATUS_SUCCESS, &cp->addr,
5676 sizeof(cp->addr));
5677
5678 unlock:
5679 hci_dev_unlock(hdev);
5680 return err;
5681 }
5682
5683 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5684 bdaddr_t *bdaddr, u8 type)
5685 {
5686 struct mgmt_ev_device_removed ev;
5687
5688 bacpy(&ev.addr.bdaddr, bdaddr);
5689 ev.addr.type = type;
5690
5691 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5692 }
5693
5694 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5695 void *data, u16 len)
5696 {
5697 struct mgmt_cp_remove_device *cp = data;
5698 int err;
5699
5700 BT_DBG("%s", hdev->name);
5701
5702 hci_dev_lock(hdev);
5703
5704 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5705 struct hci_conn_params *params;
5706 u8 addr_type;
5707
5708 if (!bdaddr_type_is_valid(cp->addr.type)) {
5709 err = mgmt_cmd_complete(sk, hdev->id,
5710 MGMT_OP_REMOVE_DEVICE,
5711 MGMT_STATUS_INVALID_PARAMS,
5712 &cp->addr, sizeof(cp->addr));
5713 goto unlock;
5714 }
5715
5716 if (cp->addr.type == BDADDR_BREDR) {
5717 err = hci_bdaddr_list_del(&hdev->whitelist,
5718 &cp->addr.bdaddr,
5719 cp->addr.type);
5720 if (err) {
5721 err = mgmt_cmd_complete(sk, hdev->id,
5722 MGMT_OP_REMOVE_DEVICE,
5723 MGMT_STATUS_INVALID_PARAMS,
5724 &cp->addr,
5725 sizeof(cp->addr));
5726 goto unlock;
5727 }
5728
5729 hci_req_update_scan(hdev);
5730
5731 device_removed(sk, hdev, &cp->addr.bdaddr,
5732 cp->addr.type);
5733 goto complete;
5734 }
5735
5736 addr_type = le_addr_type(cp->addr.type);
5737
5738
5739
5740
5741
5742
5743 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
5744 err = mgmt_cmd_complete(sk, hdev->id,
5745 MGMT_OP_REMOVE_DEVICE,
5746 MGMT_STATUS_INVALID_PARAMS,
5747 &cp->addr, sizeof(cp->addr));
5748 goto unlock;
5749 }
5750
5751 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5752 addr_type);
5753 if (!params) {
5754 err = mgmt_cmd_complete(sk, hdev->id,
5755 MGMT_OP_REMOVE_DEVICE,
5756 MGMT_STATUS_INVALID_PARAMS,
5757 &cp->addr, sizeof(cp->addr));
5758 goto unlock;
5759 }
5760
5761 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
5762 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
5763 err = mgmt_cmd_complete(sk, hdev->id,
5764 MGMT_OP_REMOVE_DEVICE,
5765 MGMT_STATUS_INVALID_PARAMS,
5766 &cp->addr, sizeof(cp->addr));
5767 goto unlock;
5768 }
5769
5770 list_del(¶ms->action);
5771 list_del(¶ms->list);
5772 kfree(params);
5773 hci_update_background_scan(hdev);
5774
5775 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5776 } else {
5777 struct hci_conn_params *p, *tmp;
5778 struct bdaddr_list *b, *btmp;
5779
5780 if (cp->addr.type) {
5781 err = mgmt_cmd_complete(sk, hdev->id,
5782 MGMT_OP_REMOVE_DEVICE,
5783 MGMT_STATUS_INVALID_PARAMS,
5784 &cp->addr, sizeof(cp->addr));
5785 goto unlock;
5786 }
5787
5788 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5789 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5790 list_del(&b->list);
5791 kfree(b);
5792 }
5793
5794 hci_req_update_scan(hdev);
5795
5796 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5797 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5798 continue;
5799 device_removed(sk, hdev, &p->addr, p->addr_type);
5800 if (p->explicit_connect) {
5801 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
5802 continue;
5803 }
5804 list_del(&p->action);
5805 list_del(&p->list);
5806 kfree(p);
5807 }
5808
5809 BT_DBG("All LE connection parameters were removed");
5810
5811 hci_update_background_scan(hdev);
5812 }
5813
5814 complete:
5815 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5816 MGMT_STATUS_SUCCESS, &cp->addr,
5817 sizeof(cp->addr));
5818 unlock:
5819 hci_dev_unlock(hdev);
5820 return err;
5821 }
5822
5823 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5824 u16 len)
5825 {
5826 struct mgmt_cp_load_conn_param *cp = data;
5827 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5828 sizeof(struct mgmt_conn_param));
5829 u16 param_count, expected_len;
5830 int i;
5831
5832 if (!lmp_le_capable(hdev))
5833 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5834 MGMT_STATUS_NOT_SUPPORTED);
5835
5836 param_count = __le16_to_cpu(cp->param_count);
5837 if (param_count > max_param_count) {
5838 bt_dev_err(hdev, "load_conn_param: too big param_count value %u",
5839 param_count);
5840 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5841 MGMT_STATUS_INVALID_PARAMS);
5842 }
5843
5844 expected_len = struct_size(cp, params, param_count);
5845 if (expected_len != len) {
5846 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes",
5847 expected_len, len);
5848 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5849 MGMT_STATUS_INVALID_PARAMS);
5850 }
5851
5852 BT_DBG("%s param_count %u", hdev->name, param_count);
5853
5854 hci_dev_lock(hdev);
5855
5856 hci_conn_params_clear_disabled(hdev);
5857
5858 for (i = 0; i < param_count; i++) {
5859 struct mgmt_conn_param *param = &cp->params[i];
5860 struct hci_conn_params *hci_param;
5861 u16 min, max, latency, timeout;
5862 u8 addr_type;
5863
5864 BT_DBG("Adding %pMR (type %u)", ¶m->addr.bdaddr,
5865 param->addr.type);
5866
5867 if (param->addr.type == BDADDR_LE_PUBLIC) {
5868 addr_type = ADDR_LE_DEV_PUBLIC;
5869 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5870 addr_type = ADDR_LE_DEV_RANDOM;
5871 } else {
5872 bt_dev_err(hdev, "ignoring invalid connection parameters");
5873 continue;
5874 }
5875
5876 min = le16_to_cpu(param->min_interval);
5877 max = le16_to_cpu(param->max_interval);
5878 latency = le16_to_cpu(param->latency);
5879 timeout = le16_to_cpu(param->timeout);
5880
5881 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5882 min, max, latency, timeout);
5883
5884 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5885 bt_dev_err(hdev, "ignoring invalid connection parameters");
5886 continue;
5887 }
5888
5889 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
5890 addr_type);
5891 if (!hci_param) {
5892 bt_dev_err(hdev, "failed to add connection parameters");
5893 continue;
5894 }
5895
5896 hci_param->conn_min_interval = min;
5897 hci_param->conn_max_interval = max;
5898 hci_param->conn_latency = latency;
5899 hci_param->supervision_timeout = timeout;
5900 }
5901
5902 hci_dev_unlock(hdev);
5903
5904 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
5905 NULL, 0);
5906 }
5907
5908 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5909 void *data, u16 len)
5910 {
5911 struct mgmt_cp_set_external_config *cp = data;
5912 bool changed;
5913 int err;
5914
5915 BT_DBG("%s", hdev->name);
5916
5917 if (hdev_is_powered(hdev))
5918 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5919 MGMT_STATUS_REJECTED);
5920
5921 if (cp->config != 0x00 && cp->config != 0x01)
5922 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5923 MGMT_STATUS_INVALID_PARAMS);
5924
5925 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5926 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5927 MGMT_STATUS_NOT_SUPPORTED);
5928
5929 hci_dev_lock(hdev);
5930
5931 if (cp->config)
5932 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
5933 else
5934 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
5935
5936 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5937 if (err < 0)
5938 goto unlock;
5939
5940 if (!changed)
5941 goto unlock;
5942
5943 err = new_options(hdev, sk);
5944
5945 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
5946 mgmt_index_removed(hdev);
5947
5948 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
5949 hci_dev_set_flag(hdev, HCI_CONFIG);
5950 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
5951
5952 queue_work(hdev->req_workqueue, &hdev->power_on);
5953 } else {
5954 set_bit(HCI_RAW, &hdev->flags);
5955 mgmt_index_added(hdev);
5956 }
5957 }
5958
5959 unlock:
5960 hci_dev_unlock(hdev);
5961 return err;
5962 }
5963
5964 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5965 void *data, u16 len)
5966 {
5967 struct mgmt_cp_set_public_address *cp = data;
5968 bool changed;
5969 int err;
5970
5971 BT_DBG("%s", hdev->name);
5972
5973 if (hdev_is_powered(hdev))
5974 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5975 MGMT_STATUS_REJECTED);
5976
5977 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5978 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5979 MGMT_STATUS_INVALID_PARAMS);
5980
5981 if (!hdev->set_bdaddr)
5982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5983 MGMT_STATUS_NOT_SUPPORTED);
5984
5985 hci_dev_lock(hdev);
5986
5987 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5988 bacpy(&hdev->public_addr, &cp->bdaddr);
5989
5990 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5991 if (err < 0)
5992 goto unlock;
5993
5994 if (!changed)
5995 goto unlock;
5996
5997 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5998 err = new_options(hdev, sk);
5999
6000 if (is_configured(hdev)) {
6001 mgmt_index_removed(hdev);
6002
6003 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
6004
6005 hci_dev_set_flag(hdev, HCI_CONFIG);
6006 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
6007
6008 queue_work(hdev->req_workqueue, &hdev->power_on);
6009 }
6010
6011 unlock:
6012 hci_dev_unlock(hdev);
6013 return err;
6014 }
6015
6016 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6017 u16 opcode, struct sk_buff *skb)
6018 {
6019 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6020 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6021 u8 *h192, *r192, *h256, *r256;
6022 struct mgmt_pending_cmd *cmd;
6023 u16 eir_len;
6024 int err;
6025
6026 BT_DBG("%s status %u", hdev->name, status);
6027
6028 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6029 if (!cmd)
6030 return;
6031
6032 mgmt_cp = cmd->param;
6033
6034 if (status) {
6035 status = mgmt_status(status);
6036 eir_len = 0;
6037
6038 h192 = NULL;
6039 r192 = NULL;
6040 h256 = NULL;
6041 r256 = NULL;
6042 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6043 struct hci_rp_read_local_oob_data *rp;
6044
6045 if (skb->len != sizeof(*rp)) {
6046 status = MGMT_STATUS_FAILED;
6047 eir_len = 0;
6048 } else {
6049 status = MGMT_STATUS_SUCCESS;
6050 rp = (void *)skb->data;
6051
6052 eir_len = 5 + 18 + 18;
6053 h192 = rp->hash;
6054 r192 = rp->rand;
6055 h256 = NULL;
6056 r256 = NULL;
6057 }
6058 } else {
6059 struct hci_rp_read_local_oob_ext_data *rp;
6060
6061 if (skb->len != sizeof(*rp)) {
6062 status = MGMT_STATUS_FAILED;
6063 eir_len = 0;
6064 } else {
6065 status = MGMT_STATUS_SUCCESS;
6066 rp = (void *)skb->data;
6067
6068 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6069 eir_len = 5 + 18 + 18;
6070 h192 = NULL;
6071 r192 = NULL;
6072 } else {
6073 eir_len = 5 + 18 + 18 + 18 + 18;
6074 h192 = rp->hash192;
6075 r192 = rp->rand192;
6076 }
6077
6078 h256 = rp->hash256;
6079 r256 = rp->rand256;
6080 }
6081 }
6082
6083 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6084 if (!mgmt_rp)
6085 goto done;
6086
6087 if (status)
6088 goto send_rsp;
6089
6090 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6091 hdev->dev_class, 3);
6092
6093 if (h192 && r192) {
6094 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6095 EIR_SSP_HASH_C192, h192, 16);
6096 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6097 EIR_SSP_RAND_R192, r192, 16);
6098 }
6099
6100 if (h256 && r256) {
6101 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6102 EIR_SSP_HASH_C256, h256, 16);
6103 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6104 EIR_SSP_RAND_R256, r256, 16);
6105 }
6106
6107 send_rsp:
6108 mgmt_rp->type = mgmt_cp->type;
6109 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6110
6111 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6112 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6113 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6114 if (err < 0 || status)
6115 goto done;
6116
6117 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6118
6119 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6120 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6121 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6122 done:
6123 kfree(mgmt_rp);
6124 mgmt_pending_remove(cmd);
6125 }
6126
6127 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6128 struct mgmt_cp_read_local_oob_ext_data *cp)
6129 {
6130 struct mgmt_pending_cmd *cmd;
6131 struct hci_request req;
6132 int err;
6133
6134 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6135 cp, sizeof(*cp));
6136 if (!cmd)
6137 return -ENOMEM;
6138
6139 hci_req_init(&req, hdev);
6140
6141 if (bredr_sc_enabled(hdev))
6142 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6143 else
6144 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6145
6146 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6147 if (err < 0) {
6148 mgmt_pending_remove(cmd);
6149 return err;
6150 }
6151
6152 return 0;
6153 }
6154
6155 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6156 void *data, u16 data_len)
6157 {
6158 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6159 struct mgmt_rp_read_local_oob_ext_data *rp;
6160 size_t rp_len;
6161 u16 eir_len;
6162 u8 status, flags, role, addr[7], hash[16], rand[16];
6163 int err;
6164
6165 BT_DBG("%s", hdev->name);
6166
6167 if (hdev_is_powered(hdev)) {
6168 switch (cp->type) {
6169 case BIT(BDADDR_BREDR):
6170 status = mgmt_bredr_support(hdev);
6171 if (status)
6172 eir_len = 0;
6173 else
6174 eir_len = 5;
6175 break;
6176 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6177 status = mgmt_le_support(hdev);
6178 if (status)
6179 eir_len = 0;
6180 else
6181 eir_len = 9 + 3 + 18 + 18 + 3;
6182 break;
6183 default:
6184 status = MGMT_STATUS_INVALID_PARAMS;
6185 eir_len = 0;
6186 break;
6187 }
6188 } else {
6189 status = MGMT_STATUS_NOT_POWERED;
6190 eir_len = 0;
6191 }
6192
6193 rp_len = sizeof(*rp) + eir_len;
6194 rp = kmalloc(rp_len, GFP_ATOMIC);
6195 if (!rp)
6196 return -ENOMEM;
6197
6198 if (status)
6199 goto complete;
6200
6201 hci_dev_lock(hdev);
6202
6203 eir_len = 0;
6204 switch (cp->type) {
6205 case BIT(BDADDR_BREDR):
6206 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6207 err = read_local_ssp_oob_req(hdev, sk, cp);
6208 hci_dev_unlock(hdev);
6209 if (!err)
6210 goto done;
6211
6212 status = MGMT_STATUS_FAILED;
6213 goto complete;
6214 } else {
6215 eir_len = eir_append_data(rp->eir, eir_len,
6216 EIR_CLASS_OF_DEV,
6217 hdev->dev_class, 3);
6218 }
6219 break;
6220 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6221 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6222 smp_generate_oob(hdev, hash, rand) < 0) {
6223 hci_dev_unlock(hdev);
6224 status = MGMT_STATUS_FAILED;
6225 goto complete;
6226 }
6227
6228
6229
6230
6231
6232
6233
6234
6235
6236
6237
6238 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6239 hci_dev_unlock(hdev);
6240 status = MGMT_STATUS_REJECTED;
6241 goto complete;
6242 }
6243
6244 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6245 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6246 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6247 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6248 memcpy(addr, &hdev->static_addr, 6);
6249 addr[6] = 0x01;
6250 } else {
6251 memcpy(addr, &hdev->bdaddr, 6);
6252 addr[6] = 0x00;
6253 }
6254
6255 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6256 addr, sizeof(addr));
6257
6258 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6259 role = 0x02;
6260 else
6261 role = 0x01;
6262
6263 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6264 &role, sizeof(role));
6265
6266 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6267 eir_len = eir_append_data(rp->eir, eir_len,
6268 EIR_LE_SC_CONFIRM,
6269 hash, sizeof(hash));
6270
6271 eir_len = eir_append_data(rp->eir, eir_len,
6272 EIR_LE_SC_RANDOM,
6273 rand, sizeof(rand));
6274 }
6275
6276 flags = mgmt_get_adv_discov_flags(hdev);
6277
6278 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6279 flags |= LE_AD_NO_BREDR;
6280
6281 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6282 &flags, sizeof(flags));
6283 break;
6284 }
6285
6286 hci_dev_unlock(hdev);
6287
6288 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6289
6290 status = MGMT_STATUS_SUCCESS;
6291
6292 complete:
6293 rp->type = cp->type;
6294 rp->eir_len = cpu_to_le16(eir_len);
6295
6296 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6297 status, rp, sizeof(*rp) + eir_len);
6298 if (err < 0 || status)
6299 goto done;
6300
6301 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6302 rp, sizeof(*rp) + eir_len,
6303 HCI_MGMT_OOB_DATA_EVENTS, sk);
6304
6305 done:
6306 kfree(rp);
6307
6308 return err;
6309 }
6310
6311 static u32 get_supported_adv_flags(struct hci_dev *hdev)
6312 {
6313 u32 flags = 0;
6314
6315 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6316 flags |= MGMT_ADV_FLAG_DISCOV;
6317 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6318 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6319 flags |= MGMT_ADV_FLAG_APPEARANCE;
6320 flags |= MGMT_ADV_FLAG_LOCAL_NAME;
6321
6322
6323
6324
6325 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) ||
6326 ext_adv_capable(hdev))
6327 flags |= MGMT_ADV_FLAG_TX_POWER;
6328
6329 if (ext_adv_capable(hdev)) {
6330 flags |= MGMT_ADV_FLAG_SEC_1M;
6331
6332 if (hdev->le_features[1] & HCI_LE_PHY_2M)
6333 flags |= MGMT_ADV_FLAG_SEC_2M;
6334
6335 if (hdev->le_features[1] & HCI_LE_PHY_CODED)
6336 flags |= MGMT_ADV_FLAG_SEC_CODED;
6337 }
6338
6339 return flags;
6340 }
6341
6342 static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6343 void *data, u16 data_len)
6344 {
6345 struct mgmt_rp_read_adv_features *rp;
6346 size_t rp_len;
6347 int err;
6348 struct adv_info *adv_instance;
6349 u32 supported_flags;
6350 u8 *instance;
6351
6352 BT_DBG("%s", hdev->name);
6353
6354 if (!lmp_le_capable(hdev))
6355 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6356 MGMT_STATUS_REJECTED);
6357
6358 hci_dev_lock(hdev);
6359
6360 rp_len = sizeof(*rp) + hdev->adv_instance_cnt;
6361 rp = kmalloc(rp_len, GFP_ATOMIC);
6362 if (!rp) {
6363 hci_dev_unlock(hdev);
6364 return -ENOMEM;
6365 }
6366
6367 supported_flags = get_supported_adv_flags(hdev);
6368
6369 rp->supported_flags = cpu_to_le32(supported_flags);
6370 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6371 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
6372 rp->max_instances = HCI_MAX_ADV_INSTANCES;
6373 rp->num_instances = hdev->adv_instance_cnt;
6374
6375 instance = rp->instance;
6376 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6377 *instance = adv_instance->instance;
6378 instance++;
6379 }
6380
6381 hci_dev_unlock(hdev);
6382
6383 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6384 MGMT_STATUS_SUCCESS, rp, rp_len);
6385
6386 kfree(rp);
6387
6388 return err;
6389 }
6390
6391 static u8 calculate_name_len(struct hci_dev *hdev)
6392 {
6393 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
6394
6395 return append_local_name(hdev, buf, 0);
6396 }
6397
6398 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags,
6399 bool is_adv_data)
6400 {
6401 u8 max_len = HCI_MAX_AD_LENGTH;
6402
6403 if (is_adv_data) {
6404 if (adv_flags & (MGMT_ADV_FLAG_DISCOV |
6405 MGMT_ADV_FLAG_LIMITED_DISCOV |
6406 MGMT_ADV_FLAG_MANAGED_FLAGS))
6407 max_len -= 3;
6408
6409 if (adv_flags & MGMT_ADV_FLAG_TX_POWER)
6410 max_len -= 3;
6411 } else {
6412 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME)
6413 max_len -= calculate_name_len(hdev);
6414
6415 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE))
6416 max_len -= 4;
6417 }
6418
6419 return max_len;
6420 }
6421
6422 static bool flags_managed(u32 adv_flags)
6423 {
6424 return adv_flags & (MGMT_ADV_FLAG_DISCOV |
6425 MGMT_ADV_FLAG_LIMITED_DISCOV |
6426 MGMT_ADV_FLAG_MANAGED_FLAGS);
6427 }
6428
6429 static bool tx_power_managed(u32 adv_flags)
6430 {
6431 return adv_flags & MGMT_ADV_FLAG_TX_POWER;
6432 }
6433
6434 static bool name_managed(u32 adv_flags)
6435 {
6436 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME;
6437 }
6438
6439 static bool appearance_managed(u32 adv_flags)
6440 {
6441 return adv_flags & MGMT_ADV_FLAG_APPEARANCE;
6442 }
6443
6444 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
6445 u8 len, bool is_adv_data)
6446 {
6447 int i, cur_len;
6448 u8 max_len;
6449
6450 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data);
6451
6452 if (len > max_len)
6453 return false;
6454
6455
6456 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6457 cur_len = data[i];
6458
6459 if (data[i + 1] == EIR_FLAGS &&
6460 (!is_adv_data || flags_managed(adv_flags)))
6461 return false;
6462
6463 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags))
6464 return false;
6465
6466 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags))
6467 return false;
6468
6469 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags))
6470 return false;
6471
6472 if (data[i + 1] == EIR_APPEARANCE &&
6473 appearance_managed(adv_flags))
6474 return false;
6475
6476
6477
6478
6479 if (i + cur_len >= len)
6480 return false;
6481 }
6482
6483 return true;
6484 }
6485
6486 static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6487 u16 opcode)
6488 {
6489 struct mgmt_pending_cmd *cmd;
6490 struct mgmt_cp_add_advertising *cp;
6491 struct mgmt_rp_add_advertising rp;
6492 struct adv_info *adv_instance, *n;
6493 u8 instance;
6494
6495 BT_DBG("status %d", status);
6496
6497 hci_dev_lock(hdev);
6498
6499 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6500
6501 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
6502 if (!adv_instance->pending)
6503 continue;
6504
6505 if (!status) {
6506 adv_instance->pending = false;
6507 continue;
6508 }
6509
6510 instance = adv_instance->instance;
6511
6512 if (hdev->cur_adv_instance == instance)
6513 cancel_adv_timeout(hdev);
6514
6515 hci_remove_adv_instance(hdev, instance);
6516 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
6517 }
6518
6519 if (!cmd)
6520 goto unlock;
6521
6522 cp = cmd->param;
6523 rp.instance = cp->instance;
6524
6525 if (status)
6526 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6527 mgmt_status(status));
6528 else
6529 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6530 mgmt_status(status), &rp, sizeof(rp));
6531
6532 mgmt_pending_remove(cmd);
6533
6534 unlock:
6535 hci_dev_unlock(hdev);
6536 }
6537
6538 static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6539 void *data, u16 data_len)
6540 {
6541 struct mgmt_cp_add_advertising *cp = data;
6542 struct mgmt_rp_add_advertising rp;
6543 u32 flags;
6544 u32 supported_flags, phy_flags;
6545 u8 status;
6546 u16 timeout, duration;
6547 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
6548 u8 schedule_instance = 0;
6549 struct adv_info *next_instance;
6550 int err;
6551 struct mgmt_pending_cmd *cmd;
6552 struct hci_request req;
6553
6554 BT_DBG("%s", hdev->name);
6555
6556 status = mgmt_le_support(hdev);
6557 if (status)
6558 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6559 status);
6560
6561 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6562 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6563 MGMT_STATUS_INVALID_PARAMS);
6564
6565 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len)
6566 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6567 MGMT_STATUS_INVALID_PARAMS);
6568
6569 flags = __le32_to_cpu(cp->flags);
6570 timeout = __le16_to_cpu(cp->timeout);
6571 duration = __le16_to_cpu(cp->duration);
6572
6573
6574
6575
6576 supported_flags = get_supported_adv_flags(hdev);
6577 phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK;
6578 if (flags & ~supported_flags ||
6579 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags)))))
6580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6581 MGMT_STATUS_INVALID_PARAMS);
6582
6583 hci_dev_lock(hdev);
6584
6585 if (timeout && !hdev_is_powered(hdev)) {
6586 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6587 MGMT_STATUS_REJECTED);
6588 goto unlock;
6589 }
6590
6591 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6592 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6593 pending_find(MGMT_OP_SET_LE, hdev)) {
6594 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6595 MGMT_STATUS_BUSY);
6596 goto unlock;
6597 }
6598
6599 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
6600 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
6601 cp->scan_rsp_len, false)) {
6602 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6603 MGMT_STATUS_INVALID_PARAMS);
6604 goto unlock;
6605 }
6606
6607 err = hci_add_adv_instance(hdev, cp->instance, flags,
6608 cp->adv_data_len, cp->data,
6609 cp->scan_rsp_len,
6610 cp->data + cp->adv_data_len,
6611 timeout, duration);
6612 if (err < 0) {
6613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6614 MGMT_STATUS_FAILED);
6615 goto unlock;
6616 }
6617
6618
6619
6620
6621 if (hdev->adv_instance_cnt > prev_instance_cnt)
6622 mgmt_advertising_added(sk, hdev, cp->instance);
6623
6624 if (hdev->cur_adv_instance == cp->instance) {
6625
6626
6627
6628
6629
6630 cancel_adv_timeout(hdev);
6631
6632 next_instance = hci_get_next_instance(hdev, cp->instance);
6633 if (next_instance)
6634 schedule_instance = next_instance->instance;
6635 } else if (!hdev->adv_instance_timeout) {
6636
6637
6638
6639 schedule_instance = cp->instance;
6640 }
6641
6642
6643
6644
6645
6646 if (!hdev_is_powered(hdev) ||
6647 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
6648 !schedule_instance) {
6649 rp.instance = cp->instance;
6650 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6651 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6652 goto unlock;
6653 }
6654
6655
6656
6657
6658 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6659 data_len);
6660 if (!cmd) {
6661 err = -ENOMEM;
6662 goto unlock;
6663 }
6664
6665 hci_req_init(&req, hdev);
6666
6667 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true);
6668
6669 if (!err)
6670 err = hci_req_run(&req, add_advertising_complete);
6671
6672 if (err < 0)
6673 mgmt_pending_remove(cmd);
6674
6675 unlock:
6676 hci_dev_unlock(hdev);
6677
6678 return err;
6679 }
6680
6681 static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6682 u16 opcode)
6683 {
6684 struct mgmt_pending_cmd *cmd;
6685 struct mgmt_cp_remove_advertising *cp;
6686 struct mgmt_rp_remove_advertising rp;
6687
6688 BT_DBG("status %d", status);
6689
6690 hci_dev_lock(hdev);
6691
6692
6693
6694
6695
6696 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6697 if (!cmd)
6698 goto unlock;
6699
6700 cp = cmd->param;
6701 rp.instance = cp->instance;
6702
6703 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6704 &rp, sizeof(rp));
6705 mgmt_pending_remove(cmd);
6706
6707 unlock:
6708 hci_dev_unlock(hdev);
6709 }
6710
6711 static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6712 void *data, u16 data_len)
6713 {
6714 struct mgmt_cp_remove_advertising *cp = data;
6715 struct mgmt_rp_remove_advertising rp;
6716 struct mgmt_pending_cmd *cmd;
6717 struct hci_request req;
6718 int err;
6719
6720 BT_DBG("%s", hdev->name);
6721
6722 hci_dev_lock(hdev);
6723
6724 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
6725 err = mgmt_cmd_status(sk, hdev->id,
6726 MGMT_OP_REMOVE_ADVERTISING,
6727 MGMT_STATUS_INVALID_PARAMS);
6728 goto unlock;
6729 }
6730
6731 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6732 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6733 pending_find(MGMT_OP_SET_LE, hdev)) {
6734 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6735 MGMT_STATUS_BUSY);
6736 goto unlock;
6737 }
6738
6739 if (list_empty(&hdev->adv_instances)) {
6740 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6741 MGMT_STATUS_INVALID_PARAMS);
6742 goto unlock;
6743 }
6744
6745 hci_req_init(&req, hdev);
6746
6747 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true);
6748
6749 if (list_empty(&hdev->adv_instances))
6750 __hci_req_disable_advertising(&req);
6751
6752
6753
6754
6755
6756 if (skb_queue_empty(&req.cmd_q) ||
6757 !hdev_is_powered(hdev) ||
6758 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6759 hci_req_purge(&req);
6760 rp.instance = cp->instance;
6761 err = mgmt_cmd_complete(sk, hdev->id,
6762 MGMT_OP_REMOVE_ADVERTISING,
6763 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6764 goto unlock;
6765 }
6766
6767 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6768 data_len);
6769 if (!cmd) {
6770 err = -ENOMEM;
6771 goto unlock;
6772 }
6773
6774 err = hci_req_run(&req, remove_advertising_complete);
6775 if (err < 0)
6776 mgmt_pending_remove(cmd);
6777
6778 unlock:
6779 hci_dev_unlock(hdev);
6780
6781 return err;
6782 }
6783
6784 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev,
6785 void *data, u16 data_len)
6786 {
6787 struct mgmt_cp_get_adv_size_info *cp = data;
6788 struct mgmt_rp_get_adv_size_info rp;
6789 u32 flags, supported_flags;
6790 int err;
6791
6792 BT_DBG("%s", hdev->name);
6793
6794 if (!lmp_le_capable(hdev))
6795 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6796 MGMT_STATUS_REJECTED);
6797
6798 if (cp->instance < 1 || cp->instance > HCI_MAX_ADV_INSTANCES)
6799 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6800 MGMT_STATUS_INVALID_PARAMS);
6801
6802 flags = __le32_to_cpu(cp->flags);
6803
6804
6805
6806
6807 supported_flags = get_supported_adv_flags(hdev);
6808 if (flags & ~supported_flags)
6809 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6810 MGMT_STATUS_INVALID_PARAMS);
6811
6812 rp.instance = cp->instance;
6813 rp.flags = cp->flags;
6814 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true);
6815 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false);
6816
6817 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO,
6818 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6819
6820 return err;
6821 }
6822
6823 static const struct hci_mgmt_handler mgmt_handlers[] = {
6824 { NULL },
6825 { read_version, MGMT_READ_VERSION_SIZE,
6826 HCI_MGMT_NO_HDEV |
6827 HCI_MGMT_UNTRUSTED },
6828 { read_commands, MGMT_READ_COMMANDS_SIZE,
6829 HCI_MGMT_NO_HDEV |
6830 HCI_MGMT_UNTRUSTED },
6831 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
6832 HCI_MGMT_NO_HDEV |
6833 HCI_MGMT_UNTRUSTED },
6834 { read_controller_info, MGMT_READ_INFO_SIZE,
6835 HCI_MGMT_UNTRUSTED },
6836 { set_powered, MGMT_SETTING_SIZE },
6837 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6838 { set_connectable, MGMT_SETTING_SIZE },
6839 { set_fast_connectable, MGMT_SETTING_SIZE },
6840 { set_bondable, MGMT_SETTING_SIZE },
6841 { set_link_security, MGMT_SETTING_SIZE },
6842 { set_ssp, MGMT_SETTING_SIZE },
6843 { set_hs, MGMT_SETTING_SIZE },
6844 { set_le, MGMT_SETTING_SIZE },
6845 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6846 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6847 { add_uuid, MGMT_ADD_UUID_SIZE },
6848 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
6849 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6850 HCI_MGMT_VAR_LEN },
6851 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6852 HCI_MGMT_VAR_LEN },
6853 { disconnect, MGMT_DISCONNECT_SIZE },
6854 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6855 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6856 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6857 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6858 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6859 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6860 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6861 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6862 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6863 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6864 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6865 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6866 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6867 HCI_MGMT_VAR_LEN },
6868 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6869 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6870 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6871 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6872 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6873 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6874 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6875 { set_advertising, MGMT_SETTING_SIZE },
6876 { set_bredr, MGMT_SETTING_SIZE },
6877 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6878 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6879 { set_secure_conn, MGMT_SETTING_SIZE },
6880 { set_debug_keys, MGMT_SETTING_SIZE },
6881 { set_privacy, MGMT_SET_PRIVACY_SIZE },
6882 { load_irks, MGMT_LOAD_IRKS_SIZE,
6883 HCI_MGMT_VAR_LEN },
6884 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6885 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6886 { add_device, MGMT_ADD_DEVICE_SIZE },
6887 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
6888 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6889 HCI_MGMT_VAR_LEN },
6890 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6891 HCI_MGMT_NO_HDEV |
6892 HCI_MGMT_UNTRUSTED },
6893 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
6894 HCI_MGMT_UNCONFIGURED |
6895 HCI_MGMT_UNTRUSTED },
6896 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6897 HCI_MGMT_UNCONFIGURED },
6898 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6899 HCI_MGMT_UNCONFIGURED },
6900 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6901 HCI_MGMT_VAR_LEN },
6902 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
6903 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
6904 HCI_MGMT_NO_HDEV |
6905 HCI_MGMT_UNTRUSTED },
6906 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
6907 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
6908 HCI_MGMT_VAR_LEN },
6909 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
6910 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE },
6911 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE },
6912 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE,
6913 HCI_MGMT_UNTRUSTED },
6914 { set_appearance, MGMT_SET_APPEARANCE_SIZE },
6915 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE },
6916 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE },
6917 };
6918
6919 void mgmt_index_added(struct hci_dev *hdev)
6920 {
6921 struct mgmt_ev_ext_index ev;
6922
6923 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6924 return;
6925
6926 switch (hdev->dev_type) {
6927 case HCI_PRIMARY:
6928 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6929 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6930 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6931 ev.type = 0x01;
6932 } else {
6933 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6934 HCI_MGMT_INDEX_EVENTS);
6935 ev.type = 0x00;
6936 }
6937 break;
6938 case HCI_AMP:
6939 ev.type = 0x02;
6940 break;
6941 default:
6942 return;
6943 }
6944
6945 ev.bus = hdev->bus;
6946
6947 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6948 HCI_MGMT_EXT_INDEX_EVENTS);
6949 }
6950
6951 void mgmt_index_removed(struct hci_dev *hdev)
6952 {
6953 struct mgmt_ev_ext_index ev;
6954 u8 status = MGMT_STATUS_INVALID_INDEX;
6955
6956 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6957 return;
6958
6959 switch (hdev->dev_type) {
6960 case HCI_PRIMARY:
6961 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6962
6963 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6964 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6965 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
6966 ev.type = 0x01;
6967 } else {
6968 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6969 HCI_MGMT_INDEX_EVENTS);
6970 ev.type = 0x00;
6971 }
6972 break;
6973 case HCI_AMP:
6974 ev.type = 0x02;
6975 break;
6976 default:
6977 return;
6978 }
6979
6980 ev.bus = hdev->bus;
6981
6982 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6983 HCI_MGMT_EXT_INDEX_EVENTS);
6984 }
6985
6986
6987 static void restart_le_actions(struct hci_dev *hdev)
6988 {
6989 struct hci_conn_params *p;
6990
6991 list_for_each_entry(p, &hdev->le_conn_params, list) {
6992
6993
6994
6995 list_del_init(&p->action);
6996
6997 switch (p->auto_connect) {
6998 case HCI_AUTO_CONN_DIRECT:
6999 case HCI_AUTO_CONN_ALWAYS:
7000 list_add(&p->action, &hdev->pend_le_conns);
7001 break;
7002 case HCI_AUTO_CONN_REPORT:
7003 list_add(&p->action, &hdev->pend_le_reports);
7004 break;
7005 default:
7006 break;
7007 }
7008 }
7009 }
7010
7011 void mgmt_power_on(struct hci_dev *hdev, int err)
7012 {
7013 struct cmd_lookup match = { NULL, hdev };
7014
7015 BT_DBG("err %d", err);
7016
7017 hci_dev_lock(hdev);
7018
7019 if (!err) {
7020 restart_le_actions(hdev);
7021 hci_update_background_scan(hdev);
7022 }
7023
7024 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7025
7026 new_settings(hdev, match.sk);
7027
7028 if (match.sk)
7029 sock_put(match.sk);
7030
7031 hci_dev_unlock(hdev);
7032 }
7033
7034 void __mgmt_power_off(struct hci_dev *hdev)
7035 {
7036 struct cmd_lookup match = { NULL, hdev };
7037 u8 status, zero_cod[] = { 0, 0, 0 };
7038
7039 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7040
7041
7042
7043
7044
7045
7046
7047
7048 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
7049 status = MGMT_STATUS_INVALID_INDEX;
7050 else
7051 status = MGMT_STATUS_NOT_POWERED;
7052
7053 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
7054
7055 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) {
7056 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7057 zero_cod, sizeof(zero_cod),
7058 HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7059 ext_info_changed(hdev, NULL);
7060 }
7061
7062 new_settings(hdev, match.sk);
7063
7064 if (match.sk)
7065 sock_put(match.sk);
7066 }
7067
7068 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
7069 {
7070 struct mgmt_pending_cmd *cmd;
7071 u8 status;
7072
7073 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7074 if (!cmd)
7075 return;
7076
7077 if (err == -ERFKILL)
7078 status = MGMT_STATUS_RFKILLED;
7079 else
7080 status = MGMT_STATUS_FAILED;
7081
7082 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
7083
7084 mgmt_pending_remove(cmd);
7085 }
7086
7087 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7088 bool persistent)
7089 {
7090 struct mgmt_ev_new_link_key ev;
7091
7092 memset(&ev, 0, sizeof(ev));
7093
7094 ev.store_hint = persistent;
7095 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7096 ev.key.addr.type = BDADDR_BREDR;
7097 ev.key.type = key->type;
7098 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
7099 ev.key.pin_len = key->pin_len;
7100
7101 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
7102 }
7103
7104 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7105 {
7106 switch (ltk->type) {
7107 case SMP_LTK:
7108 case SMP_LTK_SLAVE:
7109 if (ltk->authenticated)
7110 return MGMT_LTK_AUTHENTICATED;
7111 return MGMT_LTK_UNAUTHENTICATED;
7112 case SMP_LTK_P256:
7113 if (ltk->authenticated)
7114 return MGMT_LTK_P256_AUTH;
7115 return MGMT_LTK_P256_UNAUTH;
7116 case SMP_LTK_P256_DEBUG:
7117 return MGMT_LTK_P256_DEBUG;
7118 }
7119
7120 return MGMT_LTK_UNAUTHENTICATED;
7121 }
7122
7123 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
7124 {
7125 struct mgmt_ev_new_long_term_key ev;
7126
7127 memset(&ev, 0, sizeof(ev));
7128
7129
7130
7131
7132
7133
7134
7135
7136
7137
7138
7139
7140 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7141 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7142 ev.store_hint = 0x00;
7143 else
7144 ev.store_hint = persistent;
7145
7146 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
7147 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
7148 ev.key.type = mgmt_ltk_type(key);
7149 ev.key.enc_size = key->enc_size;
7150 ev.key.ediv = key->ediv;
7151 ev.key.rand = key->rand;
7152
7153 if (key->type == SMP_LTK)
7154 ev.key.master = 1;
7155
7156
7157
7158
7159 memcpy(ev.key.val, key->val, key->enc_size);
7160 memset(ev.key.val + key->enc_size, 0,
7161 sizeof(ev.key.val) - key->enc_size);
7162
7163 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
7164 }
7165
7166 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
7167 {
7168 struct mgmt_ev_new_irk ev;
7169
7170 memset(&ev, 0, sizeof(ev));
7171
7172 ev.store_hint = persistent;
7173
7174 bacpy(&ev.rpa, &irk->rpa);
7175 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7176 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7177 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7178
7179 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7180 }
7181
7182 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7183 bool persistent)
7184 {
7185 struct mgmt_ev_new_csrk ev;
7186
7187 memset(&ev, 0, sizeof(ev));
7188
7189
7190
7191
7192
7193
7194
7195
7196
7197
7198 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7199 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7200 ev.store_hint = 0x00;
7201 else
7202 ev.store_hint = persistent;
7203
7204 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7205 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
7206 ev.key.type = csrk->type;
7207 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7208
7209 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7210 }
7211
7212 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
7213 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7214 u16 max_interval, u16 latency, u16 timeout)
7215 {
7216 struct mgmt_ev_new_conn_param ev;
7217
7218 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7219 return;
7220
7221 memset(&ev, 0, sizeof(ev));
7222 bacpy(&ev.addr.bdaddr, bdaddr);
7223 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
7224 ev.store_hint = store_hint;
7225 ev.min_interval = cpu_to_le16(min_interval);
7226 ev.max_interval = cpu_to_le16(max_interval);
7227 ev.latency = cpu_to_le16(latency);
7228 ev.timeout = cpu_to_le16(timeout);
7229
7230 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7231 }
7232
7233 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7234 u32 flags, u8 *name, u8 name_len)
7235 {
7236 char buf[512];
7237 struct mgmt_ev_device_connected *ev = (void *) buf;
7238 u16 eir_len = 0;
7239
7240 bacpy(&ev->addr.bdaddr, &conn->dst);
7241 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7242
7243 ev->flags = __cpu_to_le32(flags);
7244
7245
7246
7247
7248
7249 if (conn->le_adv_data_len > 0) {
7250 memcpy(&ev->eir[eir_len],
7251 conn->le_adv_data, conn->le_adv_data_len);
7252 eir_len = conn->le_adv_data_len;
7253 } else {
7254 if (name_len > 0)
7255 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7256 name, name_len);
7257
7258 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
7259 eir_len = eir_append_data(ev->eir, eir_len,
7260 EIR_CLASS_OF_DEV,
7261 conn->dev_class, 3);
7262 }
7263
7264 ev->eir_len = cpu_to_le16(eir_len);
7265
7266 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7267 sizeof(*ev) + eir_len, NULL);
7268 }
7269
7270 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
7271 {
7272 struct sock **sk = data;
7273
7274 cmd->cmd_complete(cmd, 0);
7275
7276 *sk = cmd->sk;
7277 sock_hold(*sk);
7278
7279 mgmt_pending_remove(cmd);
7280 }
7281
7282 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
7283 {
7284 struct hci_dev *hdev = data;
7285 struct mgmt_cp_unpair_device *cp = cmd->param;
7286
7287 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7288
7289 cmd->cmd_complete(cmd, 0);
7290 mgmt_pending_remove(cmd);
7291 }
7292
7293 bool mgmt_powering_down(struct hci_dev *hdev)
7294 {
7295 struct mgmt_pending_cmd *cmd;
7296 struct mgmt_mode *cp;
7297
7298 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
7299 if (!cmd)
7300 return false;
7301
7302 cp = cmd->param;
7303 if (!cp->val)
7304 return true;
7305
7306 return false;
7307 }
7308
7309 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
7310 u8 link_type, u8 addr_type, u8 reason,
7311 bool mgmt_connected)
7312 {
7313 struct mgmt_ev_device_disconnected ev;
7314 struct sock *sk = NULL;
7315
7316
7317
7318
7319 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7320 cancel_delayed_work(&hdev->power_off);
7321 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7322 }
7323
7324 if (!mgmt_connected)
7325 return;
7326
7327 if (link_type != ACL_LINK && link_type != LE_LINK)
7328 return;
7329
7330 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
7331
7332 bacpy(&ev.addr.bdaddr, bdaddr);
7333 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7334 ev.reason = reason;
7335
7336 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
7337
7338 if (sk)
7339 sock_put(sk);
7340
7341 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7342 hdev);
7343 }
7344
7345 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7346 u8 link_type, u8 addr_type, u8 status)
7347 {
7348 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7349 struct mgmt_cp_disconnect *cp;
7350 struct mgmt_pending_cmd *cmd;
7351
7352 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7353 hdev);
7354
7355 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
7356 if (!cmd)
7357 return;
7358
7359 cp = cmd->param;
7360
7361 if (bacmp(bdaddr, &cp->addr.bdaddr))
7362 return;
7363
7364 if (cp->addr.type != bdaddr_type)
7365 return;
7366
7367 cmd->cmd_complete(cmd, mgmt_status(status));
7368 mgmt_pending_remove(cmd);
7369 }
7370
7371 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7372 u8 addr_type, u8 status)
7373 {
7374 struct mgmt_ev_connect_failed ev;
7375
7376
7377
7378
7379 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7380 cancel_delayed_work(&hdev->power_off);
7381 queue_work(hdev->req_workqueue, &hdev->power_off.work);
7382 }
7383
7384 bacpy(&ev.addr.bdaddr, bdaddr);
7385 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7386 ev.status = mgmt_status(status);
7387
7388 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
7389 }
7390
7391 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
7392 {
7393 struct mgmt_ev_pin_code_request ev;
7394
7395 bacpy(&ev.addr.bdaddr, bdaddr);
7396 ev.addr.type = BDADDR_BREDR;
7397 ev.secure = secure;
7398
7399 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
7400 }
7401
7402 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7403 u8 status)
7404 {
7405 struct mgmt_pending_cmd *cmd;
7406
7407 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
7408 if (!cmd)
7409 return;
7410
7411 cmd->cmd_complete(cmd, mgmt_status(status));
7412 mgmt_pending_remove(cmd);
7413 }
7414
7415 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7416 u8 status)
7417 {
7418 struct mgmt_pending_cmd *cmd;
7419
7420 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
7421 if (!cmd)
7422 return;
7423
7424 cmd->cmd_complete(cmd, mgmt_status(status));
7425 mgmt_pending_remove(cmd);
7426 }
7427
7428 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7429 u8 link_type, u8 addr_type, u32 value,
7430 u8 confirm_hint)
7431 {
7432 struct mgmt_ev_user_confirm_request ev;
7433
7434 BT_DBG("%s", hdev->name);
7435
7436 bacpy(&ev.addr.bdaddr, bdaddr);
7437 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7438 ev.confirm_hint = confirm_hint;
7439 ev.value = cpu_to_le32(value);
7440
7441 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
7442 NULL);
7443 }
7444
7445 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
7446 u8 link_type, u8 addr_type)
7447 {
7448 struct mgmt_ev_user_passkey_request ev;
7449
7450 BT_DBG("%s", hdev->name);
7451
7452 bacpy(&ev.addr.bdaddr, bdaddr);
7453 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7454
7455 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
7456 NULL);
7457 }
7458
7459 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7460 u8 link_type, u8 addr_type, u8 status,
7461 u8 opcode)
7462 {
7463 struct mgmt_pending_cmd *cmd;
7464
7465 cmd = pending_find(opcode, hdev);
7466 if (!cmd)
7467 return -ENOENT;
7468
7469 cmd->cmd_complete(cmd, mgmt_status(status));
7470 mgmt_pending_remove(cmd);
7471
7472 return 0;
7473 }
7474
7475 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7476 u8 link_type, u8 addr_type, u8 status)
7477 {
7478 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7479 status, MGMT_OP_USER_CONFIRM_REPLY);
7480 }
7481
7482 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7483 u8 link_type, u8 addr_type, u8 status)
7484 {
7485 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7486 status,
7487 MGMT_OP_USER_CONFIRM_NEG_REPLY);
7488 }
7489
7490 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7491 u8 link_type, u8 addr_type, u8 status)
7492 {
7493 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7494 status, MGMT_OP_USER_PASSKEY_REPLY);
7495 }
7496
7497 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7498 u8 link_type, u8 addr_type, u8 status)
7499 {
7500 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
7501 status,
7502 MGMT_OP_USER_PASSKEY_NEG_REPLY);
7503 }
7504
7505 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7506 u8 link_type, u8 addr_type, u32 passkey,
7507 u8 entered)
7508 {
7509 struct mgmt_ev_passkey_notify ev;
7510
7511 BT_DBG("%s", hdev->name);
7512
7513 bacpy(&ev.addr.bdaddr, bdaddr);
7514 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7515 ev.passkey = __cpu_to_le32(passkey);
7516 ev.entered = entered;
7517
7518 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7519 }
7520
7521 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
7522 {
7523 struct mgmt_ev_auth_failed ev;
7524 struct mgmt_pending_cmd *cmd;
7525 u8 status = mgmt_status(hci_status);
7526
7527 bacpy(&ev.addr.bdaddr, &conn->dst);
7528 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7529 ev.status = status;
7530
7531 cmd = find_pairing(conn);
7532
7533 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7534 cmd ? cmd->sk : NULL);
7535
7536 if (cmd) {
7537 cmd->cmd_complete(cmd, status);
7538 mgmt_pending_remove(cmd);
7539 }
7540 }
7541
7542 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
7543 {
7544 struct cmd_lookup match = { NULL, hdev };
7545 bool changed;
7546
7547 if (status) {
7548 u8 mgmt_err = mgmt_status(status);
7549 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
7550 cmd_status_rsp, &mgmt_err);
7551 return;
7552 }
7553
7554 if (test_bit(HCI_AUTH, &hdev->flags))
7555 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
7556 else
7557 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
7558
7559 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
7560 &match);
7561
7562 if (changed)
7563 new_settings(hdev, match.sk);
7564
7565 if (match.sk)
7566 sock_put(match.sk);
7567 }
7568
7569 static void clear_eir(struct hci_request *req)
7570 {
7571 struct hci_dev *hdev = req->hdev;
7572 struct hci_cp_write_eir cp;
7573
7574 if (!lmp_ext_inq_capable(hdev))
7575 return;
7576
7577 memset(hdev->eir, 0, sizeof(hdev->eir));
7578
7579 memset(&cp, 0, sizeof(cp));
7580
7581 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
7582 }
7583
7584 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
7585 {
7586 struct cmd_lookup match = { NULL, hdev };
7587 struct hci_request req;
7588 bool changed = false;
7589
7590 if (status) {
7591 u8 mgmt_err = mgmt_status(status);
7592
7593 if (enable && hci_dev_test_and_clear_flag(hdev,
7594 HCI_SSP_ENABLED)) {
7595 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7596 new_settings(hdev, NULL);
7597 }
7598
7599 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7600 &mgmt_err);
7601 return;
7602 }
7603
7604 if (enable) {
7605 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
7606 } else {
7607 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
7608 if (!changed)
7609 changed = hci_dev_test_and_clear_flag(hdev,
7610 HCI_HS_ENABLED);
7611 else
7612 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
7613 }
7614
7615 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7616
7617 if (changed)
7618 new_settings(hdev, match.sk);
7619
7620 if (match.sk)
7621 sock_put(match.sk);
7622
7623 hci_req_init(&req, hdev);
7624
7625 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7626 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
7627 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7628 sizeof(enable), &enable);
7629 __hci_req_update_eir(&req);
7630 } else {
7631 clear_eir(&req);
7632 }
7633
7634 hci_req_run(&req, NULL);
7635 }
7636
7637 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
7638 {
7639 struct cmd_lookup *match = data;
7640
7641 if (match->sk == NULL) {
7642 match->sk = cmd->sk;
7643 sock_hold(match->sk);
7644 }
7645 }
7646
7647 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7648 u8 status)
7649 {
7650 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7651
7652 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7653 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7654 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
7655
7656 if (!status) {
7657 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
7658 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL);
7659 ext_info_changed(hdev, NULL);
7660 }
7661
7662 if (match.sk)
7663 sock_put(match.sk);
7664 }
7665
7666 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
7667 {
7668 struct mgmt_cp_set_local_name ev;
7669 struct mgmt_pending_cmd *cmd;
7670
7671 if (status)
7672 return;
7673
7674 memset(&ev, 0, sizeof(ev));
7675 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
7676 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
7677
7678 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
7679 if (!cmd) {
7680 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
7681
7682
7683
7684
7685 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7686 return;
7687 }
7688
7689 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7690 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL);
7691 ext_info_changed(hdev, cmd ? cmd->sk : NULL);
7692 }
7693
7694 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7695 {
7696 int i;
7697
7698 for (i = 0; i < uuid_count; i++) {
7699 if (!memcmp(uuid, uuids[i], 16))
7700 return true;
7701 }
7702
7703 return false;
7704 }
7705
7706 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7707 {
7708 u16 parsed = 0;
7709
7710 while (parsed < eir_len) {
7711 u8 field_len = eir[0];
7712 u8 uuid[16];
7713 int i;
7714
7715 if (field_len == 0)
7716 break;
7717
7718 if (eir_len - parsed < field_len + 1)
7719 break;
7720
7721 switch (eir[1]) {
7722 case EIR_UUID16_ALL:
7723 case EIR_UUID16_SOME:
7724 for (i = 0; i + 3 <= field_len; i += 2) {
7725 memcpy(uuid, bluetooth_base_uuid, 16);
7726 uuid[13] = eir[i + 3];
7727 uuid[12] = eir[i + 2];
7728 if (has_uuid(uuid, uuid_count, uuids))
7729 return true;
7730 }
7731 break;
7732 case EIR_UUID32_ALL:
7733 case EIR_UUID32_SOME:
7734 for (i = 0; i + 5 <= field_len; i += 4) {
7735 memcpy(uuid, bluetooth_base_uuid, 16);
7736 uuid[15] = eir[i + 5];
7737 uuid[14] = eir[i + 4];
7738 uuid[13] = eir[i + 3];
7739 uuid[12] = eir[i + 2];
7740 if (has_uuid(uuid, uuid_count, uuids))
7741 return true;
7742 }
7743 break;
7744 case EIR_UUID128_ALL:
7745 case EIR_UUID128_SOME:
7746 for (i = 0; i + 17 <= field_len; i += 16) {
7747 memcpy(uuid, eir + i + 2, 16);
7748 if (has_uuid(uuid, uuid_count, uuids))
7749 return true;
7750 }
7751 break;
7752 }
7753
7754 parsed += field_len + 1;
7755 eir += field_len + 1;
7756 }
7757
7758 return false;
7759 }
7760
7761 static void restart_le_scan(struct hci_dev *hdev)
7762 {
7763
7764 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
7765 return;
7766
7767 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7768 hdev->discovery.scan_start +
7769 hdev->discovery.scan_duration))
7770 return;
7771
7772 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart,
7773 DISCOV_LE_RESTART_DELAY);
7774 }
7775
7776 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7777 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7778 {
7779
7780
7781
7782
7783
7784
7785
7786
7787
7788 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7789 (rssi == HCI_RSSI_INVALID ||
7790 (rssi < hdev->discovery.rssi &&
7791 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
7792 return false;
7793
7794 if (hdev->discovery.uuid_count != 0) {
7795
7796
7797
7798 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7799 hdev->discovery.uuids) &&
7800 !eir_has_uuids(scan_rsp, scan_rsp_len,
7801 hdev->discovery.uuid_count,
7802 hdev->discovery.uuids))
7803 return false;
7804 }
7805
7806
7807
7808
7809 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7810 restart_le_scan(hdev);
7811
7812
7813 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7814 rssi < hdev->discovery.rssi)
7815 return false;
7816 }
7817
7818 return true;
7819 }
7820
7821 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7822 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7823 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7824 {
7825 char buf[512];
7826 struct mgmt_ev_device_found *ev = (void *)buf;
7827 size_t ev_size;
7828
7829
7830
7831
7832
7833 if (!hci_discovery_active(hdev)) {
7834 if (link_type == ACL_LINK)
7835 return;
7836 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7837 return;
7838 }
7839
7840 if (hdev->discovery.result_filtering) {
7841
7842 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7843 scan_rsp_len))
7844 return;
7845 }
7846
7847 if (hdev->discovery.limited) {
7848
7849 if (dev_class) {
7850 if (!(dev_class[1] & 0x20))
7851 return;
7852 } else {
7853 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL);
7854 if (!flags || !(flags[0] & LE_AD_LIMITED))
7855 return;
7856 }
7857 }
7858
7859
7860
7861
7862 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7863 return;
7864
7865 memset(buf, 0, sizeof(buf));
7866
7867
7868
7869
7870
7871
7872
7873
7874
7875 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7876 link_type == ACL_LINK)
7877 rssi = 0;
7878
7879 bacpy(&ev->addr.bdaddr, bdaddr);
7880 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7881 ev->rssi = rssi;
7882 ev->flags = cpu_to_le32(flags);
7883
7884 if (eir_len > 0)
7885
7886 memcpy(ev->eir, eir, eir_len);
7887
7888 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7889 NULL))
7890 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7891 dev_class, 3);
7892
7893 if (scan_rsp_len > 0)
7894
7895 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7896
7897 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7898 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7899
7900 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7901 }
7902
7903 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7904 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7905 {
7906 struct mgmt_ev_device_found *ev;
7907 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7908 u16 eir_len;
7909
7910 ev = (struct mgmt_ev_device_found *) buf;
7911
7912 memset(buf, 0, sizeof(buf));
7913
7914 bacpy(&ev->addr.bdaddr, bdaddr);
7915 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7916 ev->rssi = rssi;
7917
7918 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7919 name_len);
7920
7921 ev->eir_len = cpu_to_le16(eir_len);
7922
7923 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7924 }
7925
7926 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7927 {
7928 struct mgmt_ev_discovering ev;
7929
7930 BT_DBG("%s discovering %u", hdev->name, discovering);
7931
7932 memset(&ev, 0, sizeof(ev));
7933 ev.type = hdev->discovery.type;
7934 ev.discovering = discovering;
7935
7936 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7937 }
7938
7939 static struct hci_mgmt_chan chan = {
7940 .channel = HCI_CHANNEL_CONTROL,
7941 .handler_count = ARRAY_SIZE(mgmt_handlers),
7942 .handlers = mgmt_handlers,
7943 .hdev_init = mgmt_init_hdev,
7944 };
7945
7946 int mgmt_init(void)
7947 {
7948 return hci_mgmt_chan_register(&chan);
7949 }
7950
7951 void mgmt_exit(void)
7952 {
7953 hci_mgmt_chan_unregister(&chan);
7954 }