]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/mgmt.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:


f3fec4264dcff2e2f3e71a894645cbb0cd973b04
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/mgmt.h>
33 #include <net/bluetooth/smp.h>
34
35 bool enable_hs;
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 2
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 };
80
81 static const u16 mgmt_events[] = {
82 MGMT_EV_CONTROLLER_ERROR,
83 MGMT_EV_INDEX_ADDED,
84 MGMT_EV_INDEX_REMOVED,
85 MGMT_EV_NEW_SETTINGS,
86 MGMT_EV_CLASS_OF_DEV_CHANGED,
87 MGMT_EV_LOCAL_NAME_CHANGED,
88 MGMT_EV_NEW_LINK_KEY,
89 MGMT_EV_NEW_LONG_TERM_KEY,
90 MGMT_EV_DEVICE_CONNECTED,
91 MGMT_EV_DEVICE_DISCONNECTED,
92 MGMT_EV_CONNECT_FAILED,
93 MGMT_EV_PIN_CODE_REQUEST,
94 MGMT_EV_USER_CONFIRM_REQUEST,
95 MGMT_EV_USER_PASSKEY_REQUEST,
96 MGMT_EV_AUTH_FAILED,
97 MGMT_EV_DEVICE_FOUND,
98 MGMT_EV_DISCOVERING,
99 MGMT_EV_DEVICE_BLOCKED,
100 MGMT_EV_DEVICE_UNBLOCKED,
101 MGMT_EV_DEVICE_UNPAIRED,
102 MGMT_EV_PASSKEY_NOTIFY,
103 };
104
105 /*
106 * These LE scan and inquiry parameters were chosen according to LE General
107 * Discovery Procedure specification.
108 */
109 #define LE_SCAN_TYPE 0x01
110 #define LE_SCAN_WIN 0x12
111 #define LE_SCAN_INT 0x12
112 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
113 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
114
115 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
116 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
117
118 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
119
120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
121 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
122
123 struct pending_cmd {
124 struct list_head list;
125 u16 opcode;
126 int index;
127 void *param;
128 struct sock *sk;
129 void *user_data;
130 };
131
132 /* HCI to MGMT error code conversion table */
133 static u8 mgmt_status_table[] = {
134 MGMT_STATUS_SUCCESS,
135 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
136 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
137 MGMT_STATUS_FAILED, /* Hardware Failure */
138 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
139 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
140 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
141 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
142 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
143 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
144 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
145 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
146 MGMT_STATUS_BUSY, /* Command Disallowed */
147 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
148 MGMT_STATUS_REJECTED, /* Rejected Security */
149 MGMT_STATUS_REJECTED, /* Rejected Personal */
150 MGMT_STATUS_TIMEOUT, /* Host Timeout */
151 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
152 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
153 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
154 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
155 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
156 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
157 MGMT_STATUS_BUSY, /* Repeated Attempts */
158 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
159 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
160 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
161 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
162 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
163 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
164 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
165 MGMT_STATUS_FAILED, /* Unspecified Error */
166 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
167 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
168 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
169 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
170 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
171 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
172 MGMT_STATUS_FAILED, /* Unit Link Key Used */
173 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
174 MGMT_STATUS_TIMEOUT, /* Instant Passed */
175 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
176 MGMT_STATUS_FAILED, /* Transaction Collision */
177 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
178 MGMT_STATUS_REJECTED, /* QoS Rejected */
179 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
180 MGMT_STATUS_REJECTED, /* Insufficient Security */
181 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
182 MGMT_STATUS_BUSY, /* Role Switch Pending */
183 MGMT_STATUS_FAILED, /* Slot Violation */
184 MGMT_STATUS_FAILED, /* Role Switch Failed */
185 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
186 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
187 MGMT_STATUS_BUSY, /* Host Busy Pairing */
188 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
189 MGMT_STATUS_BUSY, /* Controller Busy */
190 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
191 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
192 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
193 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
194 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
195 };
196
197 bool mgmt_valid_hdev(struct hci_dev *hdev)
198 {
199 return hdev->dev_type == HCI_BREDR;
200 }
201
202 static u8 mgmt_status(u8 hci_status)
203 {
204 if (hci_status < ARRAY_SIZE(mgmt_status_table))
205 return mgmt_status_table[hci_status];
206
207 return MGMT_STATUS_FAILED;
208 }
209
210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
211 {
212 struct sk_buff *skb;
213 struct mgmt_hdr *hdr;
214 struct mgmt_ev_cmd_status *ev;
215 int err;
216
217 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
218
219 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
220 if (!skb)
221 return -ENOMEM;
222
223 hdr = (void *) skb_put(skb, sizeof(*hdr));
224
225 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
226 hdr->index = cpu_to_le16(index);
227 hdr->len = cpu_to_le16(sizeof(*ev));
228
229 ev = (void *) skb_put(skb, sizeof(*ev));
230 ev->status = status;
231 ev->opcode = cpu_to_le16(cmd);
232
233 err = sock_queue_rcv_skb(sk, skb);
234 if (err < 0)
235 kfree_skb(skb);
236
237 return err;
238 }
239
240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
241 void *rp, size_t rp_len)
242 {
243 struct sk_buff *skb;
244 struct mgmt_hdr *hdr;
245 struct mgmt_ev_cmd_complete *ev;
246 int err;
247
248 BT_DBG("sock %p", sk);
249
250 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
251 if (!skb)
252 return -ENOMEM;
253
254 hdr = (void *) skb_put(skb, sizeof(*hdr));
255
256 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
257 hdr->index = cpu_to_le16(index);
258 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
259
260 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
261 ev->opcode = cpu_to_le16(cmd);
262 ev->status = status;
263
264 if (rp)
265 memcpy(ev->data, rp, rp_len);
266
267 err = sock_queue_rcv_skb(sk, skb);
268 if (err < 0)
269 kfree_skb(skb);
270
271 return err;
272 }
273
274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
275 u16 data_len)
276 {
277 struct mgmt_rp_read_version rp;
278
279 BT_DBG("sock %p", sk);
280
281 rp.version = MGMT_VERSION;
282 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
283
284 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
285 sizeof(rp));
286 }
287
288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
289 u16 data_len)
290 {
291 struct mgmt_rp_read_commands *rp;
292 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
293 const u16 num_events = ARRAY_SIZE(mgmt_events);
294 __le16 *opcode;
295 size_t rp_size;
296 int i, err;
297
298 BT_DBG("sock %p", sk);
299
300 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
301
302 rp = kmalloc(rp_size, GFP_KERNEL);
303 if (!rp)
304 return -ENOMEM;
305
306 rp->num_commands = __constant_cpu_to_le16(num_commands);
307 rp->num_events = __constant_cpu_to_le16(num_events);
308
309 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
310 put_unaligned_le16(mgmt_commands[i], opcode);
311
312 for (i = 0; i < num_events; i++, opcode++)
313 put_unaligned_le16(mgmt_events[i], opcode);
314
315 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
316 rp_size);
317 kfree(rp);
318
319 return err;
320 }
321
322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
323 u16 data_len)
324 {
325 struct mgmt_rp_read_index_list *rp;
326 struct hci_dev *d;
327 size_t rp_len;
328 u16 count;
329 int err;
330
331 BT_DBG("sock %p", sk);
332
333 read_lock(&hci_dev_list_lock);
334
335 count = 0;
336 list_for_each_entry(d, &hci_dev_list, list) {
337 if (!mgmt_valid_hdev(d))
338 continue;
339
340 count++;
341 }
342
343 rp_len = sizeof(*rp) + (2 * count);
344 rp = kmalloc(rp_len, GFP_ATOMIC);
345 if (!rp) {
346 read_unlock(&hci_dev_list_lock);
347 return -ENOMEM;
348 }
349
350 count = 0;
351 list_for_each_entry(d, &hci_dev_list, list) {
352 if (test_bit(HCI_SETUP, &d->dev_flags))
353 continue;
354
355 if (!mgmt_valid_hdev(d))
356 continue;
357
358 rp->index[count++] = cpu_to_le16(d->id);
359 BT_DBG("Added hci%u", d->id);
360 }
361
362 rp->num_controllers = cpu_to_le16(count);
363 rp_len = sizeof(*rp) + (2 * count);
364
365 read_unlock(&hci_dev_list_lock);
366
367 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
368 rp_len);
369
370 kfree(rp);
371
372 return err;
373 }
374
375 static u32 get_supported_settings(struct hci_dev *hdev)
376 {
377 u32 settings = 0;
378
379 settings |= MGMT_SETTING_POWERED;
380 settings |= MGMT_SETTING_PAIRABLE;
381
382 if (lmp_ssp_capable(hdev))
383 settings |= MGMT_SETTING_SSP;
384
385 if (lmp_bredr_capable(hdev)) {
386 settings |= MGMT_SETTING_CONNECTABLE;
387 settings |= MGMT_SETTING_FAST_CONNECTABLE;
388 settings |= MGMT_SETTING_DISCOVERABLE;
389 settings |= MGMT_SETTING_BREDR;
390 settings |= MGMT_SETTING_LINK_SECURITY;
391 }
392
393 if (enable_hs)
394 settings |= MGMT_SETTING_HS;
395
396 if (lmp_le_capable(hdev))
397 settings |= MGMT_SETTING_LE;
398
399 return settings;
400 }
401
402 static u32 get_current_settings(struct hci_dev *hdev)
403 {
404 u32 settings = 0;
405
406 if (hdev_is_powered(hdev))
407 settings |= MGMT_SETTING_POWERED;
408
409 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
410 settings |= MGMT_SETTING_CONNECTABLE;
411
412 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
413 settings |= MGMT_SETTING_DISCOVERABLE;
414
415 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
416 settings |= MGMT_SETTING_PAIRABLE;
417
418 if (lmp_bredr_capable(hdev))
419 settings |= MGMT_SETTING_BREDR;
420
421 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
422 settings |= MGMT_SETTING_LE;
423
424 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
425 settings |= MGMT_SETTING_LINK_SECURITY;
426
427 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
428 settings |= MGMT_SETTING_SSP;
429
430 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
431 settings |= MGMT_SETTING_HS;
432
433 return settings;
434 }
435
436 #define PNP_INFO_SVCLASS_ID 0x1200
437
438 static u8 bluetooth_base_uuid[] = {
439 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
440 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
441 };
442
443 static u16 get_uuid16(u8 *uuid128)
444 {
445 u32 val;
446 int i;
447
448 for (i = 0; i < 12; i++) {
449 if (bluetooth_base_uuid[i] != uuid128[i])
450 return 0;
451 }
452
453 val = get_unaligned_le32(&uuid128[12]);
454 if (val > 0xffff)
455 return 0;
456
457 return (u16) val;
458 }
459
460 static void create_eir(struct hci_dev *hdev, u8 *data)
461 {
462 u8 *ptr = data;
463 u16 eir_len = 0;
464 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
465 int i, truncated = 0;
466 struct bt_uuid *uuid;
467 size_t name_len;
468
469 name_len = strlen(hdev->dev_name);
470
471 if (name_len > 0) {
472 /* EIR Data type */
473 if (name_len > 48) {
474 name_len = 48;
475 ptr[1] = EIR_NAME_SHORT;
476 } else
477 ptr[1] = EIR_NAME_COMPLETE;
478
479 /* EIR Data length */
480 ptr[0] = name_len + 1;
481
482 memcpy(ptr + 2, hdev->dev_name, name_len);
483
484 eir_len += (name_len + 2);
485 ptr += (name_len + 2);
486 }
487
488 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
489 ptr[0] = 2;
490 ptr[1] = EIR_TX_POWER;
491 ptr[2] = (u8) hdev->inq_tx_power;
492
493 eir_len += 3;
494 ptr += 3;
495 }
496
497 if (hdev->devid_source > 0) {
498 ptr[0] = 9;
499 ptr[1] = EIR_DEVICE_ID;
500
501 put_unaligned_le16(hdev->devid_source, ptr + 2);
502 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
503 put_unaligned_le16(hdev->devid_product, ptr + 6);
504 put_unaligned_le16(hdev->devid_version, ptr + 8);
505
506 eir_len += 10;
507 ptr += 10;
508 }
509
510 memset(uuid16_list, 0, sizeof(uuid16_list));
511
512 /* Group all UUID16 types */
513 list_for_each_entry(uuid, &hdev->uuids, list) {
514 u16 uuid16;
515
516 uuid16 = get_uuid16(uuid->uuid);
517 if (uuid16 == 0)
518 return;
519
520 if (uuid16 < 0x1100)
521 continue;
522
523 if (uuid16 == PNP_INFO_SVCLASS_ID)
524 continue;
525
526 /* Stop if not enough space to put next UUID */
527 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
528 truncated = 1;
529 break;
530 }
531
532 /* Check for duplicates */
533 for (i = 0; uuid16_list[i] != 0; i++)
534 if (uuid16_list[i] == uuid16)
535 break;
536
537 if (uuid16_list[i] == 0) {
538 uuid16_list[i] = uuid16;
539 eir_len += sizeof(u16);
540 }
541 }
542
543 if (uuid16_list[0] != 0) {
544 u8 *length = ptr;
545
546 /* EIR Data type */
547 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
548
549 ptr += 2;
550 eir_len += 2;
551
552 for (i = 0; uuid16_list[i] != 0; i++) {
553 *ptr++ = (uuid16_list[i] & 0x00ff);
554 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
555 }
556
557 /* EIR Data length */
558 *length = (i * sizeof(u16)) + 1;
559 }
560 }
561
562 static int update_eir(struct hci_dev *hdev)
563 {
564 struct hci_cp_write_eir cp;
565
566 if (!hdev_is_powered(hdev))
567 return 0;
568
569 if (!lmp_ext_inq_capable(hdev))
570 return 0;
571
572 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
573 return 0;
574
575 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
576 return 0;
577
578 memset(&cp, 0, sizeof(cp));
579
580 create_eir(hdev, cp.data);
581
582 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
583 return 0;
584
585 memcpy(hdev->eir, cp.data, sizeof(cp.data));
586
587 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
588 }
589
590 static u8 get_service_classes(struct hci_dev *hdev)
591 {
592 struct bt_uuid *uuid;
593 u8 val = 0;
594
595 list_for_each_entry(uuid, &hdev->uuids, list)
596 val |= uuid->svc_hint;
597
598 return val;
599 }
600
601 static int update_class(struct hci_dev *hdev)
602 {
603 u8 cod[3];
604 int err;
605
606 BT_DBG("%s", hdev->name);
607
608 if (!hdev_is_powered(hdev))
609 return 0;
610
611 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
612 return 0;
613
614 cod[0] = hdev->minor_class;
615 cod[1] = hdev->major_class;
616 cod[2] = get_service_classes(hdev);
617
618 if (memcmp(cod, hdev->dev_class, 3) == 0)
619 return 0;
620
621 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
622 if (err == 0)
623 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
624
625 return err;
626 }
627
628 static void service_cache_off(struct work_struct *work)
629 {
630 struct hci_dev *hdev = container_of(work, struct hci_dev,
631 service_cache.work);
632
633 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
634 return;
635
636 hci_dev_lock(hdev);
637
638 update_eir(hdev);
639 update_class(hdev);
640
641 hci_dev_unlock(hdev);
642 }
643
644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
645 {
646 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
647 return;
648
649 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
650
651 /* Non-mgmt controlled devices get this bit set
652 * implicitly so that pairing works for them, however
653 * for mgmt we require user-space to explicitly enable
654 * it
655 */
656 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
657 }
658
659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
660 void *data, u16 data_len)
661 {
662 struct mgmt_rp_read_info rp;
663
664 BT_DBG("sock %p %s", sk, hdev->name);
665
666 hci_dev_lock(hdev);
667
668 memset(&rp, 0, sizeof(rp));
669
670 bacpy(&rp.bdaddr, &hdev->bdaddr);
671
672 rp.version = hdev->hci_ver;
673 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
674
675 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
676 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
677
678 memcpy(rp.dev_class, hdev->dev_class, 3);
679
680 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
681 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
682
683 hci_dev_unlock(hdev);
684
685 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
686 sizeof(rp));
687 }
688
689 static void mgmt_pending_free(struct pending_cmd *cmd)
690 {
691 sock_put(cmd->sk);
692 kfree(cmd->param);
693 kfree(cmd);
694 }
695
696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
697 struct hci_dev *hdev, void *data,
698 u16 len)
699 {
700 struct pending_cmd *cmd;
701
702 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
703 if (!cmd)
704 return NULL;
705
706 cmd->opcode = opcode;
707 cmd->index = hdev->id;
708
709 cmd->param = kmalloc(len, GFP_KERNEL);
710 if (!cmd->param) {
711 kfree(cmd);
712 return NULL;
713 }
714
715 if (data)
716 memcpy(cmd->param, data, len);
717
718 cmd->sk = sk;
719 sock_hold(sk);
720
721 list_add(&cmd->list, &hdev->mgmt_pending);
722
723 return cmd;
724 }
725
726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
727 void (*cb)(struct pending_cmd *cmd,
728 void *data),
729 void *data)
730 {
731 struct list_head *p, *n;
732
733 list_for_each_safe(p, n, &hdev->mgmt_pending) {
734 struct pending_cmd *cmd;
735
736 cmd = list_entry(p, struct pending_cmd, list);
737
738 if (opcode > 0 && cmd->opcode != opcode)
739 continue;
740
741 cb(cmd, data);
742 }
743 }
744
745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
746 {
747 struct pending_cmd *cmd;
748
749 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
750 if (cmd->opcode == opcode)
751 return cmd;
752 }
753
754 return NULL;
755 }
756
757 static void mgmt_pending_remove(struct pending_cmd *cmd)
758 {
759 list_del(&cmd->list);
760 mgmt_pending_free(cmd);
761 }
762
763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
764 {
765 __le32 settings = cpu_to_le32(get_current_settings(hdev));
766
767 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
768 sizeof(settings));
769 }
770
771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
772 u16 len)
773 {
774 struct mgmt_mode *cp = data;
775 struct pending_cmd *cmd;
776 int err;
777
778 BT_DBG("request for %s", hdev->name);
779
780 hci_dev_lock(hdev);
781
782 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
783 cancel_delayed_work(&hdev->power_off);
784
785 if (cp->val) {
786 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
787 mgmt_powered(hdev, 1);
788 goto failed;
789 }
790 }
791
792 if (!!cp->val == hdev_is_powered(hdev)) {
793 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
794 goto failed;
795 }
796
797 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
798 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
799 MGMT_STATUS_BUSY);
800 goto failed;
801 }
802
803 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
804 if (!cmd) {
805 err = -ENOMEM;
806 goto failed;
807 }
808
809 if (cp->val)
810 schedule_work(&hdev->power_on);
811 else
812 schedule_work(&hdev->power_off.work);
813
814 err = 0;
815
816 failed:
817 hci_dev_unlock(hdev);
818 return err;
819 }
820
821 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
822 struct sock *skip_sk)
823 {
824 struct sk_buff *skb;
825 struct mgmt_hdr *hdr;
826
827 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
828 if (!skb)
829 return -ENOMEM;
830
831 hdr = (void *) skb_put(skb, sizeof(*hdr));
832 hdr->opcode = cpu_to_le16(event);
833 if (hdev)
834 hdr->index = cpu_to_le16(hdev->id);
835 else
836 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
837 hdr->len = cpu_to_le16(data_len);
838
839 if (data)
840 memcpy(skb_put(skb, data_len), data, data_len);
841
842 /* Time stamp */
843 __net_timestamp(skb);
844
845 hci_send_to_control(skb, skip_sk);
846 kfree_skb(skb);
847
848 return 0;
849 }
850
851 static int new_settings(struct hci_dev *hdev, struct sock *skip)
852 {
853 __le32 ev;
854
855 ev = cpu_to_le32(get_current_settings(hdev));
856
857 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
858 }
859
860 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
861 u16 len)
862 {
863 struct mgmt_cp_set_discoverable *cp = data;
864 struct pending_cmd *cmd;
865 u16 timeout;
866 u8 scan;
867 int err;
868
869 BT_DBG("request for %s", hdev->name);
870
871 if (!lmp_bredr_capable(hdev))
872 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
873 MGMT_STATUS_NOT_SUPPORTED);
874
875 timeout = __le16_to_cpu(cp->timeout);
876 if (!cp->val && timeout > 0)
877 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
878 MGMT_STATUS_INVALID_PARAMS);
879
880 hci_dev_lock(hdev);
881
882 if (!hdev_is_powered(hdev) && timeout > 0) {
883 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
884 MGMT_STATUS_NOT_POWERED);
885 goto failed;
886 }
887
888 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
889 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
890 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
891 MGMT_STATUS_BUSY);
892 goto failed;
893 }
894
895 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
896 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
897 MGMT_STATUS_REJECTED);
898 goto failed;
899 }
900
901 if (!hdev_is_powered(hdev)) {
902 bool changed = false;
903
904 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
905 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
906 changed = true;
907 }
908
909 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
910 if (err < 0)
911 goto failed;
912
913 if (changed)
914 err = new_settings(hdev, sk);
915
916 goto failed;
917 }
918
919 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
920 if (hdev->discov_timeout > 0) {
921 cancel_delayed_work(&hdev->discov_off);
922 hdev->discov_timeout = 0;
923 }
924
925 if (cp->val && timeout > 0) {
926 hdev->discov_timeout = timeout;
927 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
928 msecs_to_jiffies(hdev->discov_timeout * 1000));
929 }
930
931 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
932 goto failed;
933 }
934
935 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
936 if (!cmd) {
937 err = -ENOMEM;
938 goto failed;
939 }
940
941 scan = SCAN_PAGE;
942
943 if (cp->val)
944 scan |= SCAN_INQUIRY;
945 else
946 cancel_delayed_work(&hdev->discov_off);
947
948 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
949 if (err < 0)
950 mgmt_pending_remove(cmd);
951
952 if (cp->val)
953 hdev->discov_timeout = timeout;
954
955 failed:
956 hci_dev_unlock(hdev);
957 return err;
958 }
959
960 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
961 u16 len)
962 {
963 struct mgmt_mode *cp = data;
964 struct pending_cmd *cmd;
965 u8 scan;
966 int err;
967
968 BT_DBG("request for %s", hdev->name);
969
970 if (!lmp_bredr_capable(hdev))
971 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
972 MGMT_STATUS_NOT_SUPPORTED);
973
974 hci_dev_lock(hdev);
975
976 if (!hdev_is_powered(hdev)) {
977 bool changed = false;
978
979 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
980 changed = true;
981
982 if (cp->val) {
983 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
984 } else {
985 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
986 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
987 }
988
989 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
990 if (err < 0)
991 goto failed;
992
993 if (changed)
994 err = new_settings(hdev, sk);
995
996 goto failed;
997 }
998
999 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1000 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1001 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1002 MGMT_STATUS_BUSY);
1003 goto failed;
1004 }
1005
1006 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1007 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1008 goto failed;
1009 }
1010
1011 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1012 if (!cmd) {
1013 err = -ENOMEM;
1014 goto failed;
1015 }
1016
1017 if (cp->val) {
1018 scan = SCAN_PAGE;
1019 } else {
1020 scan = 0;
1021
1022 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1023 hdev->discov_timeout > 0)
1024 cancel_delayed_work(&hdev->discov_off);
1025 }
1026
1027 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1028 if (err < 0)
1029 mgmt_pending_remove(cmd);
1030
1031 failed:
1032 hci_dev_unlock(hdev);
1033 return err;
1034 }
1035
1036 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1037 u16 len)
1038 {
1039 struct mgmt_mode *cp = data;
1040 int err;
1041
1042 BT_DBG("request for %s", hdev->name);
1043
1044 hci_dev_lock(hdev);
1045
1046 if (cp->val)
1047 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1048 else
1049 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1050
1051 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1052 if (err < 0)
1053 goto failed;
1054
1055 err = new_settings(hdev, sk);
1056
1057 failed:
1058 hci_dev_unlock(hdev);
1059 return err;
1060 }
1061
1062 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1063 u16 len)
1064 {
1065 struct mgmt_mode *cp = data;
1066 struct pending_cmd *cmd;
1067 u8 val;
1068 int err;
1069
1070 BT_DBG("request for %s", hdev->name);
1071
1072 if (!lmp_bredr_capable(hdev))
1073 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1074 MGMT_STATUS_NOT_SUPPORTED);
1075
1076 hci_dev_lock(hdev);
1077
1078 if (!hdev_is_powered(hdev)) {
1079 bool changed = false;
1080
1081 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1082 &hdev->dev_flags)) {
1083 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1084 changed = true;
1085 }
1086
1087 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1088 if (err < 0)
1089 goto failed;
1090
1091 if (changed)
1092 err = new_settings(hdev, sk);
1093
1094 goto failed;
1095 }
1096
1097 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1098 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1099 MGMT_STATUS_BUSY);
1100 goto failed;
1101 }
1102
1103 val = !!cp->val;
1104
1105 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1106 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1107 goto failed;
1108 }
1109
1110 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1111 if (!cmd) {
1112 err = -ENOMEM;
1113 goto failed;
1114 }
1115
1116 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1117 if (err < 0) {
1118 mgmt_pending_remove(cmd);
1119 goto failed;
1120 }
1121
1122 failed:
1123 hci_dev_unlock(hdev);
1124 return err;
1125 }
1126
1127 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1128 {
1129 struct mgmt_mode *cp = data;
1130 struct pending_cmd *cmd;
1131 u8 val;
1132 int err;
1133
1134 BT_DBG("request for %s", hdev->name);
1135
1136 hci_dev_lock(hdev);
1137
1138 if (!lmp_ssp_capable(hdev)) {
1139 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1140 MGMT_STATUS_NOT_SUPPORTED);
1141 goto failed;
1142 }
1143
1144 val = !!cp->val;
1145
1146 if (!hdev_is_powered(hdev)) {
1147 bool changed = false;
1148
1149 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1150 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1151 changed = true;
1152 }
1153
1154 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1155 if (err < 0)
1156 goto failed;
1157
1158 if (changed)
1159 err = new_settings(hdev, sk);
1160
1161 goto failed;
1162 }
1163
1164 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1165 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1166 MGMT_STATUS_BUSY);
1167 goto failed;
1168 }
1169
1170 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1171 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1172 goto failed;
1173 }
1174
1175 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1176 if (!cmd) {
1177 err = -ENOMEM;
1178 goto failed;
1179 }
1180
1181 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1182 if (err < 0) {
1183 mgmt_pending_remove(cmd);
1184 goto failed;
1185 }
1186
1187 failed:
1188 hci_dev_unlock(hdev);
1189 return err;
1190 }
1191
1192 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1193 {
1194 struct mgmt_mode *cp = data;
1195
1196 BT_DBG("request for %s", hdev->name);
1197
1198 if (!enable_hs)
1199 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1200 MGMT_STATUS_NOT_SUPPORTED);
1201
1202 if (cp->val)
1203 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1204 else
1205 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1206
1207 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1208 }
1209
1210 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1211 {
1212 struct mgmt_mode *cp = data;
1213 struct hci_cp_write_le_host_supported hci_cp;
1214 struct pending_cmd *cmd;
1215 int err;
1216 u8 val, enabled;
1217
1218 BT_DBG("request for %s", hdev->name);
1219
1220 hci_dev_lock(hdev);
1221
1222 if (!lmp_le_capable(hdev)) {
1223 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1224 MGMT_STATUS_NOT_SUPPORTED);
1225 goto unlock;
1226 }
1227
1228 val = !!cp->val;
1229 enabled = lmp_host_le_capable(hdev);
1230
1231 if (!hdev_is_powered(hdev) || val == enabled) {
1232 bool changed = false;
1233
1234 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1235 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1236 changed = true;
1237 }
1238
1239 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1240 if (err < 0)
1241 goto unlock;
1242
1243 if (changed)
1244 err = new_settings(hdev, sk);
1245
1246 goto unlock;
1247 }
1248
1249 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1250 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1251 MGMT_STATUS_BUSY);
1252 goto unlock;
1253 }
1254
1255 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1256 if (!cmd) {
1257 err = -ENOMEM;
1258 goto unlock;
1259 }
1260
1261 memset(&hci_cp, 0, sizeof(hci_cp));
1262
1263 if (val) {
1264 hci_cp.le = val;
1265 hci_cp.simul = lmp_le_br_capable(hdev);
1266 }
1267
1268 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1269 &hci_cp);
1270 if (err < 0)
1271 mgmt_pending_remove(cmd);
1272
1273 unlock:
1274 hci_dev_unlock(hdev);
1275 return err;
1276 }
1277
1278 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1279 {
1280 struct mgmt_cp_add_uuid *cp = data;
1281 struct pending_cmd *cmd;
1282 struct bt_uuid *uuid;
1283 int err;
1284
1285 BT_DBG("request for %s", hdev->name);
1286
1287 hci_dev_lock(hdev);
1288
1289 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1290 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1291 MGMT_STATUS_BUSY);
1292 goto failed;
1293 }
1294
1295 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1296 if (!uuid) {
1297 err = -ENOMEM;
1298 goto failed;
1299 }
1300
1301 memcpy(uuid->uuid, cp->uuid, 16);
1302 uuid->svc_hint = cp->svc_hint;
1303
1304 list_add(&uuid->list, &hdev->uuids);
1305
1306 err = update_class(hdev);
1307 if (err < 0)
1308 goto failed;
1309
1310 err = update_eir(hdev);
1311 if (err < 0)
1312 goto failed;
1313
1314 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1315 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1316 hdev->dev_class, 3);
1317 goto failed;
1318 }
1319
1320 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1321 if (!cmd)
1322 err = -ENOMEM;
1323
1324 failed:
1325 hci_dev_unlock(hdev);
1326 return err;
1327 }
1328
1329 static bool enable_service_cache(struct hci_dev *hdev)
1330 {
1331 if (!hdev_is_powered(hdev))
1332 return false;
1333
1334 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1335 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1336 return true;
1337 }
1338
1339 return false;
1340 }
1341
1342 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1343 u16 len)
1344 {
1345 struct mgmt_cp_remove_uuid *cp = data;
1346 struct pending_cmd *cmd;
1347 struct list_head *p, *n;
1348 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1349 int err, found;
1350
1351 BT_DBG("request for %s", hdev->name);
1352
1353 hci_dev_lock(hdev);
1354
1355 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1356 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1357 MGMT_STATUS_BUSY);
1358 goto unlock;
1359 }
1360
1361 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1362 err = hci_uuids_clear(hdev);
1363
1364 if (enable_service_cache(hdev)) {
1365 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1366 0, hdev->dev_class, 3);
1367 goto unlock;
1368 }
1369
1370 goto update_class;
1371 }
1372
1373 found = 0;
1374
1375 list_for_each_safe(p, n, &hdev->uuids) {
1376 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1377
1378 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1379 continue;
1380
1381 list_del(&match->list);
1382 kfree(match);
1383 found++;
1384 }
1385
1386 if (found == 0) {
1387 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1388 MGMT_STATUS_INVALID_PARAMS);
1389 goto unlock;
1390 }
1391
1392 update_class:
1393 err = update_class(hdev);
1394 if (err < 0)
1395 goto unlock;
1396
1397 err = update_eir(hdev);
1398 if (err < 0)
1399 goto unlock;
1400
1401 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1402 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1403 hdev->dev_class, 3);
1404 goto unlock;
1405 }
1406
1407 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1408 if (!cmd)
1409 err = -ENOMEM;
1410
1411 unlock:
1412 hci_dev_unlock(hdev);
1413 return err;
1414 }
1415
1416 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1417 u16 len)
1418 {
1419 struct mgmt_cp_set_dev_class *cp = data;
1420 struct pending_cmd *cmd;
1421 int err;
1422
1423 BT_DBG("request for %s", hdev->name);
1424
1425 hci_dev_lock(hdev);
1426
1427 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1428 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1429 MGMT_STATUS_BUSY);
1430 goto unlock;
1431 }
1432
1433 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1434 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1435 MGMT_STATUS_INVALID_PARAMS);
1436 goto unlock;
1437 }
1438
1439 hdev->major_class = cp->major;
1440 hdev->minor_class = cp->minor;
1441
1442 if (!hdev_is_powered(hdev)) {
1443 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1444 hdev->dev_class, 3);
1445 goto unlock;
1446 }
1447
1448 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1449 hci_dev_unlock(hdev);
1450 cancel_delayed_work_sync(&hdev->service_cache);
1451 hci_dev_lock(hdev);
1452 update_eir(hdev);
1453 }
1454
1455 err = update_class(hdev);
1456 if (err < 0)
1457 goto unlock;
1458
1459 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1460 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1461 hdev->dev_class, 3);
1462 goto unlock;
1463 }
1464
1465 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1466 if (!cmd)
1467 err = -ENOMEM;
1468
1469 unlock:
1470 hci_dev_unlock(hdev);
1471 return err;
1472 }
1473
1474 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1475 u16 len)
1476 {
1477 struct mgmt_cp_load_link_keys *cp = data;
1478 u16 key_count, expected_len;
1479 int i;
1480
1481 key_count = __le16_to_cpu(cp->key_count);
1482
1483 expected_len = sizeof(*cp) + key_count *
1484 sizeof(struct mgmt_link_key_info);
1485 if (expected_len != len) {
1486 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1487 len, expected_len);
1488 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1489 MGMT_STATUS_INVALID_PARAMS);
1490 }
1491
1492 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1493 key_count);
1494
1495 hci_dev_lock(hdev);
1496
1497 hci_link_keys_clear(hdev);
1498
1499 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1500
1501 if (cp->debug_keys)
1502 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1503 else
1504 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1505
1506 for (i = 0; i < key_count; i++) {
1507 struct mgmt_link_key_info *key = &cp->keys[i];
1508
1509 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1510 key->type, key->pin_len);
1511 }
1512
1513 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1514
1515 hci_dev_unlock(hdev);
1516
1517 return 0;
1518 }
1519
1520 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1521 u8 addr_type, struct sock *skip_sk)
1522 {
1523 struct mgmt_ev_device_unpaired ev;
1524
1525 bacpy(&ev.addr.bdaddr, bdaddr);
1526 ev.addr.type = addr_type;
1527
1528 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1529 skip_sk);
1530 }
1531
1532 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1533 u16 len)
1534 {
1535 struct mgmt_cp_unpair_device *cp = data;
1536 struct mgmt_rp_unpair_device rp;
1537 struct hci_cp_disconnect dc;
1538 struct pending_cmd *cmd;
1539 struct hci_conn *conn;
1540 int err;
1541
1542 hci_dev_lock(hdev);
1543
1544 memset(&rp, 0, sizeof(rp));
1545 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1546 rp.addr.type = cp->addr.type;
1547
1548 if (!hdev_is_powered(hdev)) {
1549 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1550 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1551 goto unlock;
1552 }
1553
1554 if (cp->addr.type == BDADDR_BREDR)
1555 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1556 else
1557 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1558
1559 if (err < 0) {
1560 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1561 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1562 goto unlock;
1563 }
1564
1565 if (cp->disconnect) {
1566 if (cp->addr.type == BDADDR_BREDR)
1567 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1568 &cp->addr.bdaddr);
1569 else
1570 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1571 &cp->addr.bdaddr);
1572 } else {
1573 conn = NULL;
1574 }
1575
1576 if (!conn) {
1577 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1578 &rp, sizeof(rp));
1579 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1580 goto unlock;
1581 }
1582
1583 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1584 sizeof(*cp));
1585 if (!cmd) {
1586 err = -ENOMEM;
1587 goto unlock;
1588 }
1589
1590 dc.handle = cpu_to_le16(conn->handle);
1591 dc.reason = 0x13; /* Remote User Terminated Connection */
1592 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1593 if (err < 0)
1594 mgmt_pending_remove(cmd);
1595
1596 unlock:
1597 hci_dev_unlock(hdev);
1598 return err;
1599 }
1600
1601 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1602 u16 len)
1603 {
1604 struct mgmt_cp_disconnect *cp = data;
1605 struct hci_cp_disconnect dc;
1606 struct pending_cmd *cmd;
1607 struct hci_conn *conn;
1608 int err;
1609
1610 BT_DBG("");
1611
1612 hci_dev_lock(hdev);
1613
1614 if (!test_bit(HCI_UP, &hdev->flags)) {
1615 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1616 MGMT_STATUS_NOT_POWERED);
1617 goto failed;
1618 }
1619
1620 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1621 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1622 MGMT_STATUS_BUSY);
1623 goto failed;
1624 }
1625
1626 if (cp->addr.type == BDADDR_BREDR)
1627 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1628 &cp->addr.bdaddr);
1629 else
1630 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1631
1632 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1633 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1634 MGMT_STATUS_NOT_CONNECTED);
1635 goto failed;
1636 }
1637
1638 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1639 if (!cmd) {
1640 err = -ENOMEM;
1641 goto failed;
1642 }
1643
1644 dc.handle = cpu_to_le16(conn->handle);
1645 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1646
1647 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1648 if (err < 0)
1649 mgmt_pending_remove(cmd);
1650
1651 failed:
1652 hci_dev_unlock(hdev);
1653 return err;
1654 }
1655
1656 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1657 {
1658 switch (link_type) {
1659 case LE_LINK:
1660 switch (addr_type) {
1661 case ADDR_LE_DEV_PUBLIC:
1662 return BDADDR_LE_PUBLIC;
1663
1664 default:
1665 /* Fallback to LE Random address type */
1666 return BDADDR_LE_RANDOM;
1667 }
1668
1669 default:
1670 /* Fallback to BR/EDR type */
1671 return BDADDR_BREDR;
1672 }
1673 }
1674
1675 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1676 u16 data_len)
1677 {
1678 struct mgmt_rp_get_connections *rp;
1679 struct hci_conn *c;
1680 size_t rp_len;
1681 int err;
1682 u16 i;
1683
1684 BT_DBG("");
1685
1686 hci_dev_lock(hdev);
1687
1688 if (!hdev_is_powered(hdev)) {
1689 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1690 MGMT_STATUS_NOT_POWERED);
1691 goto unlock;
1692 }
1693
1694 i = 0;
1695 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1696 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1697 i++;
1698 }
1699
1700 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1701 rp = kmalloc(rp_len, GFP_KERNEL);
1702 if (!rp) {
1703 err = -ENOMEM;
1704 goto unlock;
1705 }
1706
1707 i = 0;
1708 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1709 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1710 continue;
1711 bacpy(&rp->addr[i].bdaddr, &c->dst);
1712 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1713 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1714 continue;
1715 i++;
1716 }
1717
1718 rp->conn_count = cpu_to_le16(i);
1719
1720 /* Recalculate length in case of filtered SCO connections, etc */
1721 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1722
1723 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1724 rp_len);
1725
1726 kfree(rp);
1727
1728 unlock:
1729 hci_dev_unlock(hdev);
1730 return err;
1731 }
1732
1733 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1734 struct mgmt_cp_pin_code_neg_reply *cp)
1735 {
1736 struct pending_cmd *cmd;
1737 int err;
1738
1739 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1740 sizeof(*cp));
1741 if (!cmd)
1742 return -ENOMEM;
1743
1744 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1745 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1746 if (err < 0)
1747 mgmt_pending_remove(cmd);
1748
1749 return err;
1750 }
1751
1752 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1753 u16 len)
1754 {
1755 struct hci_conn *conn;
1756 struct mgmt_cp_pin_code_reply *cp = data;
1757 struct hci_cp_pin_code_reply reply;
1758 struct pending_cmd *cmd;
1759 int err;
1760
1761 BT_DBG("");
1762
1763 hci_dev_lock(hdev);
1764
1765 if (!hdev_is_powered(hdev)) {
1766 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1767 MGMT_STATUS_NOT_POWERED);
1768 goto failed;
1769 }
1770
1771 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1772 if (!conn) {
1773 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1774 MGMT_STATUS_NOT_CONNECTED);
1775 goto failed;
1776 }
1777
1778 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1779 struct mgmt_cp_pin_code_neg_reply ncp;
1780
1781 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1782
1783 BT_ERR("PIN code is not 16 bytes long");
1784
1785 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1786 if (err >= 0)
1787 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1788 MGMT_STATUS_INVALID_PARAMS);
1789
1790 goto failed;
1791 }
1792
1793 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1794 if (!cmd) {
1795 err = -ENOMEM;
1796 goto failed;
1797 }
1798
1799 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1800 reply.pin_len = cp->pin_len;
1801 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1802
1803 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1804 if (err < 0)
1805 mgmt_pending_remove(cmd);
1806
1807 failed:
1808 hci_dev_unlock(hdev);
1809 return err;
1810 }
1811
1812 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1813 u16 len)
1814 {
1815 struct mgmt_cp_set_io_capability *cp = data;
1816
1817 BT_DBG("");
1818
1819 hci_dev_lock(hdev);
1820
1821 hdev->io_capability = cp->io_capability;
1822
1823 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1824 hdev->io_capability);
1825
1826 hci_dev_unlock(hdev);
1827
1828 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1829 0);
1830 }
1831
1832 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1833 {
1834 struct hci_dev *hdev = conn->hdev;
1835 struct pending_cmd *cmd;
1836
1837 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1838 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1839 continue;
1840
1841 if (cmd->user_data != conn)
1842 continue;
1843
1844 return cmd;
1845 }
1846
1847 return NULL;
1848 }
1849
1850 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1851 {
1852 struct mgmt_rp_pair_device rp;
1853 struct hci_conn *conn = cmd->user_data;
1854
1855 bacpy(&rp.addr.bdaddr, &conn->dst);
1856 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1857
1858 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1859 &rp, sizeof(rp));
1860
1861 /* So we don't get further callbacks for this connection */
1862 conn->connect_cfm_cb = NULL;
1863 conn->security_cfm_cb = NULL;
1864 conn->disconn_cfm_cb = NULL;
1865
1866 hci_conn_put(conn);
1867
1868 mgmt_pending_remove(cmd);
1869 }
1870
1871 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1872 {
1873 struct pending_cmd *cmd;
1874
1875 BT_DBG("status %u", status);
1876
1877 cmd = find_pairing(conn);
1878 if (!cmd)
1879 BT_DBG("Unable to find a pending command");
1880 else
1881 pairing_complete(cmd, mgmt_status(status));
1882 }
1883
1884 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1885 {
1886 struct pending_cmd *cmd;
1887
1888 BT_DBG("status %u", status);
1889
1890 if (!status)
1891 return;
1892
1893 cmd = find_pairing(conn);
1894 if (!cmd)
1895 BT_DBG("Unable to find a pending command");
1896 else
1897 pairing_complete(cmd, mgmt_status(status));
1898 }
1899
1900 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1901 u16 len)
1902 {
1903 struct mgmt_cp_pair_device *cp = data;
1904 struct mgmt_rp_pair_device rp;
1905 struct pending_cmd *cmd;
1906 u8 sec_level, auth_type;
1907 struct hci_conn *conn;
1908 int err;
1909
1910 BT_DBG("");
1911
1912 hci_dev_lock(hdev);
1913
1914 if (!hdev_is_powered(hdev)) {
1915 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1916 MGMT_STATUS_NOT_POWERED);
1917 goto unlock;
1918 }
1919
1920 sec_level = BT_SECURITY_MEDIUM;
1921 if (cp->io_cap == 0x03)
1922 auth_type = HCI_AT_DEDICATED_BONDING;
1923 else
1924 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1925
1926 if (cp->addr.type == BDADDR_BREDR)
1927 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1928 cp->addr.type, sec_level, auth_type);
1929 else
1930 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1931 cp->addr.type, sec_level, auth_type);
1932
1933 memset(&rp, 0, sizeof(rp));
1934 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1935 rp.addr.type = cp->addr.type;
1936
1937 if (IS_ERR(conn)) {
1938 int status;
1939
1940 if (PTR_ERR(conn) == -EBUSY)
1941 status = MGMT_STATUS_BUSY;
1942 else
1943 status = MGMT_STATUS_CONNECT_FAILED;
1944
1945 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1946 status, &rp,
1947 sizeof(rp));
1948 goto unlock;
1949 }
1950
1951 if (conn->connect_cfm_cb) {
1952 hci_conn_put(conn);
1953 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1954 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1955 goto unlock;
1956 }
1957
1958 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1959 if (!cmd) {
1960 err = -ENOMEM;
1961 hci_conn_put(conn);
1962 goto unlock;
1963 }
1964
1965 /* For LE, just connecting isn't a proof that the pairing finished */
1966 if (cp->addr.type == BDADDR_BREDR)
1967 conn->connect_cfm_cb = pairing_complete_cb;
1968 else
1969 conn->connect_cfm_cb = le_connect_complete_cb;
1970
1971 conn->security_cfm_cb = pairing_complete_cb;
1972 conn->disconn_cfm_cb = pairing_complete_cb;
1973 conn->io_capability = cp->io_cap;
1974 cmd->user_data = conn;
1975
1976 if (conn->state == BT_CONNECTED &&
1977 hci_conn_security(conn, sec_level, auth_type))
1978 pairing_complete(cmd, 0);
1979
1980 err = 0;
1981
1982 unlock:
1983 hci_dev_unlock(hdev);
1984 return err;
1985 }
1986
1987 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1988 u16 len)
1989 {
1990 struct mgmt_addr_info *addr = data;
1991 struct pending_cmd *cmd;
1992 struct hci_conn *conn;
1993 int err;
1994
1995 BT_DBG("");
1996
1997 hci_dev_lock(hdev);
1998
1999 if (!hdev_is_powered(hdev)) {
2000 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2001 MGMT_STATUS_NOT_POWERED);
2002 goto unlock;
2003 }
2004
2005 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2006 if (!cmd) {
2007 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2008 MGMT_STATUS_INVALID_PARAMS);
2009 goto unlock;
2010 }
2011
2012 conn = cmd->user_data;
2013
2014 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2015 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2016 MGMT_STATUS_INVALID_PARAMS);
2017 goto unlock;
2018 }
2019
2020 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2021
2022 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2023 addr, sizeof(*addr));
2024 unlock:
2025 hci_dev_unlock(hdev);
2026 return err;
2027 }
2028
2029 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2030 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2031 u16 hci_op, __le32 passkey)
2032 {
2033 struct pending_cmd *cmd;
2034 struct hci_conn *conn;
2035 int err;
2036
2037 hci_dev_lock(hdev);
2038
2039 if (!hdev_is_powered(hdev)) {
2040 err = cmd_status(sk, hdev->id, mgmt_op,
2041 MGMT_STATUS_NOT_POWERED);
2042 goto done;
2043 }
2044
2045 if (type == BDADDR_BREDR)
2046 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2047 else
2048 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2049
2050 if (!conn) {
2051 err = cmd_status(sk, hdev->id, mgmt_op,
2052 MGMT_STATUS_NOT_CONNECTED);
2053 goto done;
2054 }
2055
2056 if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2057 /* Continue with pairing via SMP */
2058 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2059
2060 if (!err)
2061 err = cmd_status(sk, hdev->id, mgmt_op,
2062 MGMT_STATUS_SUCCESS);
2063 else
2064 err = cmd_status(sk, hdev->id, mgmt_op,
2065 MGMT_STATUS_FAILED);
2066
2067 goto done;
2068 }
2069
2070 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2071 if (!cmd) {
2072 err = -ENOMEM;
2073 goto done;
2074 }
2075
2076 /* Continue with pairing via HCI */
2077 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2078 struct hci_cp_user_passkey_reply cp;
2079
2080 bacpy(&cp.bdaddr, bdaddr);
2081 cp.passkey = passkey;
2082 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2083 } else
2084 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2085
2086 if (err < 0)
2087 mgmt_pending_remove(cmd);
2088
2089 done:
2090 hci_dev_unlock(hdev);
2091 return err;
2092 }
2093
2094 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2095 void *data, u16 len)
2096 {
2097 struct mgmt_cp_pin_code_neg_reply *cp = data;
2098
2099 BT_DBG("");
2100
2101 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2102 MGMT_OP_PIN_CODE_NEG_REPLY,
2103 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2104 }
2105
2106 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2107 u16 len)
2108 {
2109 struct mgmt_cp_user_confirm_reply *cp = data;
2110
2111 BT_DBG("");
2112
2113 if (len != sizeof(*cp))
2114 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2115 MGMT_STATUS_INVALID_PARAMS);
2116
2117 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2118 MGMT_OP_USER_CONFIRM_REPLY,
2119 HCI_OP_USER_CONFIRM_REPLY, 0);
2120 }
2121
2122 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2123 void *data, u16 len)
2124 {
2125 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2126
2127 BT_DBG("");
2128
2129 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2130 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2131 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2132 }
2133
2134 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2135 u16 len)
2136 {
2137 struct mgmt_cp_user_passkey_reply *cp = data;
2138
2139 BT_DBG("");
2140
2141 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2142 MGMT_OP_USER_PASSKEY_REPLY,
2143 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2144 }
2145
2146 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2147 void *data, u16 len)
2148 {
2149 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2150
2151 BT_DBG("");
2152
2153 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2154 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2155 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2156 }
2157
2158 static int update_name(struct hci_dev *hdev, const char *name)
2159 {
2160 struct hci_cp_write_local_name cp;
2161
2162 memcpy(cp.name, name, sizeof(cp.name));
2163
2164 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2165 }
2166
2167 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2168 u16 len)
2169 {
2170 struct mgmt_cp_set_local_name *cp = data;
2171 struct pending_cmd *cmd;
2172 int err;
2173
2174 BT_DBG("");
2175
2176 hci_dev_lock(hdev);
2177
2178 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2179
2180 if (!hdev_is_powered(hdev)) {
2181 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2182
2183 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2184 data, len);
2185 if (err < 0)
2186 goto failed;
2187
2188 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2189 sk);
2190
2191 goto failed;
2192 }
2193
2194 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2195 if (!cmd) {
2196 err = -ENOMEM;
2197 goto failed;
2198 }
2199
2200 err = update_name(hdev, cp->name);
2201 if (err < 0)
2202 mgmt_pending_remove(cmd);
2203
2204 failed:
2205 hci_dev_unlock(hdev);
2206 return err;
2207 }
2208
2209 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2210 void *data, u16 data_len)
2211 {
2212 struct pending_cmd *cmd;
2213 int err;
2214
2215 BT_DBG("%s", hdev->name);
2216
2217 hci_dev_lock(hdev);
2218
2219 if (!hdev_is_powered(hdev)) {
2220 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2221 MGMT_STATUS_NOT_POWERED);
2222 goto unlock;
2223 }
2224
2225 if (!lmp_ssp_capable(hdev)) {
2226 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2227 MGMT_STATUS_NOT_SUPPORTED);
2228 goto unlock;
2229 }
2230
2231 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2232 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2233 MGMT_STATUS_BUSY);
2234 goto unlock;
2235 }
2236
2237 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2238 if (!cmd) {
2239 err = -ENOMEM;
2240 goto unlock;
2241 }
2242
2243 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2244 if (err < 0)
2245 mgmt_pending_remove(cmd);
2246
2247 unlock:
2248 hci_dev_unlock(hdev);
2249 return err;
2250 }
2251
2252 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2253 void *data, u16 len)
2254 {
2255 struct mgmt_cp_add_remote_oob_data *cp = data;
2256 u8 status;
2257 int err;
2258
2259 BT_DBG("%s ", hdev->name);
2260
2261 hci_dev_lock(hdev);
2262
2263 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2264 cp->randomizer);
2265 if (err < 0)
2266 status = MGMT_STATUS_FAILED;
2267 else
2268 status = MGMT_STATUS_SUCCESS;
2269
2270 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2271 &cp->addr, sizeof(cp->addr));
2272
2273 hci_dev_unlock(hdev);
2274 return err;
2275 }
2276
2277 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2278 void *data, u16 len)
2279 {
2280 struct mgmt_cp_remove_remote_oob_data *cp = data;
2281 u8 status;
2282 int err;
2283
2284 BT_DBG("%s", hdev->name);
2285
2286 hci_dev_lock(hdev);
2287
2288 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2289 if (err < 0)
2290 status = MGMT_STATUS_INVALID_PARAMS;
2291 else
2292 status = MGMT_STATUS_SUCCESS;
2293
2294 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2295 status, &cp->addr, sizeof(cp->addr));
2296
2297 hci_dev_unlock(hdev);
2298 return err;
2299 }
2300
2301 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2302 {
2303 int err;
2304
2305 BT_DBG("%s", hdev->name);
2306
2307 hci_dev_lock(hdev);
2308
2309 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2310 if (err < 0)
2311 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2312
2313 hci_dev_unlock(hdev);
2314
2315 return err;
2316 }
2317
2318 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2319 void *data, u16 len)
2320 {
2321 struct mgmt_cp_start_discovery *cp = data;
2322 struct pending_cmd *cmd;
2323 int err;
2324
2325 BT_DBG("%s", hdev->name);
2326
2327 hci_dev_lock(hdev);
2328
2329 if (!hdev_is_powered(hdev)) {
2330 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2331 MGMT_STATUS_NOT_POWERED);
2332 goto failed;
2333 }
2334
2335 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2336 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2337 MGMT_STATUS_BUSY);
2338 goto failed;
2339 }
2340
2341 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2342 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2343 MGMT_STATUS_BUSY);
2344 goto failed;
2345 }
2346
2347 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2348 if (!cmd) {
2349 err = -ENOMEM;
2350 goto failed;
2351 }
2352
2353 hdev->discovery.type = cp->type;
2354
2355 switch (hdev->discovery.type) {
2356 case DISCOV_TYPE_BREDR:
2357 if (lmp_bredr_capable(hdev))
2358 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2359 else
2360 err = -ENOTSUPP;
2361 break;
2362
2363 case DISCOV_TYPE_LE:
2364 if (lmp_host_le_capable(hdev))
2365 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2366 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2367 else
2368 err = -ENOTSUPP;
2369 break;
2370
2371 case DISCOV_TYPE_INTERLEAVED:
2372 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2373 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2374 LE_SCAN_WIN,
2375 LE_SCAN_TIMEOUT_BREDR_LE);
2376 else
2377 err = -ENOTSUPP;
2378 break;
2379
2380 default:
2381 err = -EINVAL;
2382 }
2383
2384 if (err < 0)
2385 mgmt_pending_remove(cmd);
2386 else
2387 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2388
2389 failed:
2390 hci_dev_unlock(hdev);
2391 return err;
2392 }
2393
2394 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2395 u16 len)
2396 {
2397 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2398 struct pending_cmd *cmd;
2399 struct hci_cp_remote_name_req_cancel cp;
2400 struct inquiry_entry *e;
2401 int err;
2402
2403 BT_DBG("%s", hdev->name);
2404
2405 hci_dev_lock(hdev);
2406
2407 if (!hci_discovery_active(hdev)) {
2408 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2409 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2410 sizeof(mgmt_cp->type));
2411 goto unlock;
2412 }
2413
2414 if (hdev->discovery.type != mgmt_cp->type) {
2415 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2416 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2417 sizeof(mgmt_cp->type));
2418 goto unlock;
2419 }
2420
2421 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2422 if (!cmd) {
2423 err = -ENOMEM;
2424 goto unlock;
2425 }
2426
2427 switch (hdev->discovery.state) {
2428 case DISCOVERY_FINDING:
2429 if (test_bit(HCI_INQUIRY, &hdev->flags))
2430 err = hci_cancel_inquiry(hdev);
2431 else
2432 err = hci_cancel_le_scan(hdev);
2433
2434 break;
2435
2436 case DISCOVERY_RESOLVING:
2437 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2438 NAME_PENDING);
2439 if (!e) {
2440 mgmt_pending_remove(cmd);
2441 err = cmd_complete(sk, hdev->id,
2442 MGMT_OP_STOP_DISCOVERY, 0,
2443 &mgmt_cp->type,
2444 sizeof(mgmt_cp->type));
2445 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2446 goto unlock;
2447 }
2448
2449 bacpy(&cp.bdaddr, &e->data.bdaddr);
2450 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2451 sizeof(cp), &cp);
2452
2453 break;
2454
2455 default:
2456 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2457 err = -EFAULT;
2458 }
2459
2460 if (err < 0)
2461 mgmt_pending_remove(cmd);
2462 else
2463 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2464
2465 unlock:
2466 hci_dev_unlock(hdev);
2467 return err;
2468 }
2469
2470 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2471 u16 len)
2472 {
2473 struct mgmt_cp_confirm_name *cp = data;
2474 struct inquiry_entry *e;
2475 int err;
2476
2477 BT_DBG("%s", hdev->name);
2478
2479 hci_dev_lock(hdev);
2480
2481 if (!hci_discovery_active(hdev)) {
2482 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2483 MGMT_STATUS_FAILED);
2484 goto failed;
2485 }
2486
2487 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2488 if (!e) {
2489 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2490 MGMT_STATUS_INVALID_PARAMS);
2491 goto failed;
2492 }
2493
2494 if (cp->name_known) {
2495 e->name_state = NAME_KNOWN;
2496 list_del(&e->list);
2497 } else {
2498 e->name_state = NAME_NEEDED;
2499 hci_inquiry_cache_update_resolve(hdev, e);
2500 }
2501
2502 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2503 sizeof(cp->addr));
2504
2505 failed:
2506 hci_dev_unlock(hdev);
2507 return err;
2508 }
2509
2510 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2511 u16 len)
2512 {
2513 struct mgmt_cp_block_device *cp = data;
2514 u8 status;
2515 int err;
2516
2517 BT_DBG("%s", hdev->name);
2518
2519 hci_dev_lock(hdev);
2520
2521 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2522 if (err < 0)
2523 status = MGMT_STATUS_FAILED;
2524 else
2525 status = MGMT_STATUS_SUCCESS;
2526
2527 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2528 &cp->addr, sizeof(cp->addr));
2529
2530 hci_dev_unlock(hdev);
2531
2532 return err;
2533 }
2534
2535 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2536 u16 len)
2537 {
2538 struct mgmt_cp_unblock_device *cp = data;
2539 u8 status;
2540 int err;
2541
2542 BT_DBG("%s", hdev->name);
2543
2544 hci_dev_lock(hdev);
2545
2546 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2547 if (err < 0)
2548 status = MGMT_STATUS_INVALID_PARAMS;
2549 else
2550 status = MGMT_STATUS_SUCCESS;
2551
2552 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2553 &cp->addr, sizeof(cp->addr));
2554
2555 hci_dev_unlock(hdev);
2556
2557 return err;
2558 }
2559
2560 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2561 u16 len)
2562 {
2563 struct mgmt_cp_set_device_id *cp = data;
2564 int err;
2565 __u16 source;
2566
2567 BT_DBG("%s", hdev->name);
2568
2569 source = __le16_to_cpu(cp->source);
2570
2571 if (source > 0x0002)
2572 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2573 MGMT_STATUS_INVALID_PARAMS);
2574
2575 hci_dev_lock(hdev);
2576
2577 hdev->devid_source = source;
2578 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2579 hdev->devid_product = __le16_to_cpu(cp->product);
2580 hdev->devid_version = __le16_to_cpu(cp->version);
2581
2582 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2583
2584 update_eir(hdev);
2585
2586 hci_dev_unlock(hdev);
2587
2588 return err;
2589 }
2590
2591 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2592 void *data, u16 len)
2593 {
2594 struct mgmt_mode *cp = data;
2595 struct hci_cp_write_page_scan_activity acp;
2596 u8 type;
2597 int err;
2598
2599 BT_DBG("%s", hdev->name);
2600
2601 if (!lmp_bredr_capable(hdev))
2602 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2603 MGMT_STATUS_NOT_SUPPORTED);
2604
2605 if (!hdev_is_powered(hdev))
2606 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2607 MGMT_STATUS_NOT_POWERED);
2608
2609 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2610 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2611 MGMT_STATUS_REJECTED);
2612
2613 hci_dev_lock(hdev);
2614
2615 if (cp->val) {
2616 type = PAGE_SCAN_TYPE_INTERLACED;
2617
2618 /* 160 msec page scan interval */
2619 acp.interval = __constant_cpu_to_le16(0x0100);
2620 } else {
2621 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2622
2623 /* default 1.28 sec page scan */
2624 acp.interval = __constant_cpu_to_le16(0x0800);
2625 }
2626
2627 /* default 11.25 msec page scan window */
2628 acp.window = __constant_cpu_to_le16(0x0012);
2629
2630 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2631 &acp);
2632 if (err < 0) {
2633 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2634 MGMT_STATUS_FAILED);
2635 goto done;
2636 }
2637
2638 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2639 if (err < 0) {
2640 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2641 MGMT_STATUS_FAILED);
2642 goto done;
2643 }
2644
2645 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2646 NULL, 0);
2647 done:
2648 hci_dev_unlock(hdev);
2649 return err;
2650 }
2651
2652 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2653 void *cp_data, u16 len)
2654 {
2655 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2656 u16 key_count, expected_len;
2657 int i, err;
2658
2659 key_count = __le16_to_cpu(cp->key_count);
2660
2661 expected_len = sizeof(*cp) + key_count *
2662 sizeof(struct mgmt_ltk_info);
2663 if (expected_len != len) {
2664 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2665 len, expected_len);
2666 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2667 EINVAL);
2668 }
2669
2670 BT_DBG("%s key_count %u", hdev->name, key_count);
2671
2672 hci_dev_lock(hdev);
2673
2674 hci_smp_ltks_clear(hdev);
2675
2676 for (i = 0; i < key_count; i++) {
2677 struct mgmt_ltk_info *key = &cp->keys[i];
2678 u8 type;
2679
2680 if (key->master)
2681 type = HCI_SMP_LTK;
2682 else
2683 type = HCI_SMP_LTK_SLAVE;
2684
2685 hci_add_ltk(hdev, &key->addr.bdaddr,
2686 bdaddr_to_le(key->addr.type),
2687 type, 0, key->authenticated, key->val,
2688 key->enc_size, key->ediv, key->rand);
2689 }
2690
2691 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
2692 NULL, 0);
2693
2694 hci_dev_unlock(hdev);
2695
2696 return err;
2697 }
2698
2699 static const struct mgmt_handler {
2700 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2701 u16 data_len);
2702 bool var_len;
2703 size_t data_len;
2704 } mgmt_handlers[] = {
2705 { NULL }, /* 0x0000 (no command) */
2706 { read_version, false, MGMT_READ_VERSION_SIZE },
2707 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2708 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2709 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2710 { set_powered, false, MGMT_SETTING_SIZE },
2711 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2712 { set_connectable, false, MGMT_SETTING_SIZE },
2713 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2714 { set_pairable, false, MGMT_SETTING_SIZE },
2715 { set_link_security, false, MGMT_SETTING_SIZE },
2716 { set_ssp, false, MGMT_SETTING_SIZE },
2717 { set_hs, false, MGMT_SETTING_SIZE },
2718 { set_le, false, MGMT_SETTING_SIZE },
2719 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2720 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2721 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2722 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2723 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2724 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2725 { disconnect, false, MGMT_DISCONNECT_SIZE },
2726 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2727 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2728 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2729 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2730 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2731 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2732 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2733 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2734 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2735 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2736 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2737 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2738 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2739 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2740 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2741 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2742 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2743 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2744 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2745 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
2746 };
2747
2748
2749 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2750 {
2751 void *buf;
2752 u8 *cp;
2753 struct mgmt_hdr *hdr;
2754 u16 opcode, index, len;
2755 struct hci_dev *hdev = NULL;
2756 const struct mgmt_handler *handler;
2757 int err;
2758
2759 BT_DBG("got %zu bytes", msglen);
2760
2761 if (msglen < sizeof(*hdr))
2762 return -EINVAL;
2763
2764 buf = kmalloc(msglen, GFP_KERNEL);
2765 if (!buf)
2766 return -ENOMEM;
2767
2768 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2769 err = -EFAULT;
2770 goto done;
2771 }
2772
2773 hdr = buf;
2774 opcode = __le16_to_cpu(hdr->opcode);
2775 index = __le16_to_cpu(hdr->index);
2776 len = __le16_to_cpu(hdr->len);
2777
2778 if (len != msglen - sizeof(*hdr)) {
2779 err = -EINVAL;
2780 goto done;
2781 }
2782
2783 if (index != MGMT_INDEX_NONE) {
2784 hdev = hci_dev_get(index);
2785 if (!hdev) {
2786 err = cmd_status(sk, index, opcode,
2787 MGMT_STATUS_INVALID_INDEX);
2788 goto done;
2789 }
2790 }
2791
2792 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2793 mgmt_handlers[opcode].func == NULL) {
2794 BT_DBG("Unknown op %u", opcode);
2795 err = cmd_status(sk, index, opcode,
2796 MGMT_STATUS_UNKNOWN_COMMAND);
2797 goto done;
2798 }
2799
2800 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2801 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2802 err = cmd_status(sk, index, opcode,
2803 MGMT_STATUS_INVALID_INDEX);
2804 goto done;
2805 }
2806
2807 handler = &mgmt_handlers[opcode];
2808
2809 if ((handler->var_len && len < handler->data_len) ||
2810 (!handler->var_len && len != handler->data_len)) {
2811 err = cmd_status(sk, index, opcode,
2812 MGMT_STATUS_INVALID_PARAMS);
2813 goto done;
2814 }
2815
2816 if (hdev)
2817 mgmt_init_hdev(sk, hdev);
2818
2819 cp = buf + sizeof(*hdr);
2820
2821 err = handler->func(sk, hdev, cp, len);
2822 if (err < 0)
2823 goto done;
2824
2825 err = msglen;
2826
2827 done:
2828 if (hdev)
2829 hci_dev_put(hdev);
2830
2831 kfree(buf);
2832 return err;
2833 }
2834
2835 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2836 {
2837 u8 *status = data;
2838
2839 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2840 mgmt_pending_remove(cmd);
2841 }
2842
2843 int mgmt_index_added(struct hci_dev *hdev)
2844 {
2845 if (!mgmt_valid_hdev(hdev))
2846 return -ENOTSUPP;
2847
2848 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2849 }
2850
2851 int mgmt_index_removed(struct hci_dev *hdev)
2852 {
2853 u8 status = MGMT_STATUS_INVALID_INDEX;
2854
2855 if (!mgmt_valid_hdev(hdev))
2856 return -ENOTSUPP;
2857
2858 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2859
2860 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2861 }
2862
2863 struct cmd_lookup {
2864 struct sock *sk;
2865 struct hci_dev *hdev;
2866 u8 mgmt_status;
2867 };
2868
2869 static void settings_rsp(struct pending_cmd *cmd, void *data)
2870 {
2871 struct cmd_lookup *match = data;
2872
2873 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2874
2875 list_del(&cmd->list);
2876
2877 if (match->sk == NULL) {
2878 match->sk = cmd->sk;
2879 sock_hold(match->sk);
2880 }
2881
2882 mgmt_pending_free(cmd);
2883 }
2884
2885 static int set_bredr_scan(struct hci_dev *hdev)
2886 {
2887 u8 scan = 0;
2888
2889 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2890 scan |= SCAN_PAGE;
2891 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2892 scan |= SCAN_INQUIRY;
2893
2894 if (!scan)
2895 return 0;
2896
2897 return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2898 }
2899
2900 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2901 {
2902 struct cmd_lookup match = { NULL, hdev };
2903 int err;
2904
2905 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2906 return 0;
2907
2908 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2909
2910 if (powered) {
2911 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
2912 !lmp_host_ssp_capable(hdev)) {
2913 u8 ssp = 1;
2914
2915 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2916 }
2917
2918 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2919 struct hci_cp_write_le_host_supported cp;
2920
2921 cp.le = 1;
2922 cp.simul = lmp_le_br_capable(hdev);
2923
2924 /* Check first if we already have the right
2925 * host state (host features set)
2926 */
2927 if (cp.le != lmp_host_le_capable(hdev) ||
2928 cp.simul != lmp_host_le_br_capable(hdev))
2929 hci_send_cmd(hdev,
2930 HCI_OP_WRITE_LE_HOST_SUPPORTED,
2931 sizeof(cp), &cp);
2932 }
2933
2934 if (lmp_bredr_capable(hdev)) {
2935 set_bredr_scan(hdev);
2936 update_class(hdev);
2937 update_name(hdev, hdev->dev_name);
2938 update_eir(hdev);
2939 }
2940 } else {
2941 u8 status = MGMT_STATUS_NOT_POWERED;
2942 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2943 }
2944
2945 err = new_settings(hdev, match.sk);
2946
2947 if (match.sk)
2948 sock_put(match.sk);
2949
2950 return err;
2951 }
2952
2953 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2954 {
2955 struct cmd_lookup match = { NULL, hdev };
2956 bool changed = false;
2957 int err = 0;
2958
2959 if (discoverable) {
2960 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2961 changed = true;
2962 } else {
2963 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2964 changed = true;
2965 }
2966
2967 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2968 &match);
2969
2970 if (changed)
2971 err = new_settings(hdev, match.sk);
2972
2973 if (match.sk)
2974 sock_put(match.sk);
2975
2976 return err;
2977 }
2978
2979 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2980 {
2981 struct cmd_lookup match = { NULL, hdev };
2982 bool changed = false;
2983 int err = 0;
2984
2985 if (connectable) {
2986 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2987 changed = true;
2988 } else {
2989 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2990 changed = true;
2991 }
2992
2993 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2994 &match);
2995
2996 if (changed)
2997 err = new_settings(hdev, match.sk);
2998
2999 if (match.sk)
3000 sock_put(match.sk);
3001
3002 return err;
3003 }
3004
3005 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3006 {
3007 u8 mgmt_err = mgmt_status(status);
3008
3009 if (scan & SCAN_PAGE)
3010 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3011 cmd_status_rsp, &mgmt_err);
3012
3013 if (scan & SCAN_INQUIRY)
3014 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3015 cmd_status_rsp, &mgmt_err);
3016
3017 return 0;
3018 }
3019
3020 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3021 bool persistent)
3022 {
3023 struct mgmt_ev_new_link_key ev;
3024
3025 memset(&ev, 0, sizeof(ev));
3026
3027 ev.store_hint = persistent;
3028 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3029 ev.key.addr.type = BDADDR_BREDR;
3030 ev.key.type = key->type;
3031 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3032 ev.key.pin_len = key->pin_len;
3033
3034 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3035 }
3036
3037 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3038 {
3039 struct mgmt_ev_new_long_term_key ev;
3040
3041 memset(&ev, 0, sizeof(ev));
3042
3043 ev.store_hint = persistent;
3044 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3045 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3046 ev.key.authenticated = key->authenticated;
3047 ev.key.enc_size = key->enc_size;
3048 ev.key.ediv = key->ediv;
3049
3050 if (key->type == HCI_SMP_LTK)
3051 ev.key.master = 1;
3052
3053 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3054 memcpy(ev.key.val, key->val, sizeof(key->val));
3055
3056 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3057 NULL);
3058 }
3059
3060 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3061 u8 addr_type, u32 flags, u8 *name, u8 name_len,
3062 u8 *dev_class)
3063 {
3064 char buf[512];
3065 struct mgmt_ev_device_connected *ev = (void *) buf;
3066 u16 eir_len = 0;
3067
3068 bacpy(&ev->addr.bdaddr, bdaddr);
3069 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3070
3071 ev->flags = __cpu_to_le32(flags);
3072
3073 if (name_len > 0)
3074 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3075 name, name_len);
3076
3077 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3078 eir_len = eir_append_data(ev->eir, eir_len,
3079 EIR_CLASS_OF_DEV, dev_class, 3);
3080
3081 ev->eir_len = cpu_to_le16(eir_len);
3082
3083 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3084 sizeof(*ev) + eir_len, NULL);
3085 }
3086
3087 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3088 {
3089 struct mgmt_cp_disconnect *cp = cmd->param;
3090 struct sock **sk = data;
3091 struct mgmt_rp_disconnect rp;
3092
3093 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3094 rp.addr.type = cp->addr.type;
3095
3096 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3097 sizeof(rp));
3098
3099 *sk = cmd->sk;
3100 sock_hold(*sk);
3101
3102 mgmt_pending_remove(cmd);
3103 }
3104
3105 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3106 {
3107 struct hci_dev *hdev = data;
3108 struct mgmt_cp_unpair_device *cp = cmd->param;
3109 struct mgmt_rp_unpair_device rp;
3110
3111 memset(&rp, 0, sizeof(rp));
3112 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3113 rp.addr.type = cp->addr.type;
3114
3115 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3116
3117 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3118
3119 mgmt_pending_remove(cmd);
3120 }
3121
3122 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3123 u8 link_type, u8 addr_type, u8 reason)
3124 {
3125 struct mgmt_ev_device_disconnected ev;
3126 struct sock *sk = NULL;
3127 int err;
3128
3129 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3130
3131 bacpy(&ev.addr.bdaddr, bdaddr);
3132 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3133 ev.reason = reason;
3134
3135 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3136 sk);
3137
3138 if (sk)
3139 sock_put(sk);
3140
3141 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3142 hdev);
3143
3144 return err;
3145 }
3146
3147 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3148 u8 link_type, u8 addr_type, u8 status)
3149 {
3150 struct mgmt_rp_disconnect rp;
3151 struct pending_cmd *cmd;
3152 int err;
3153
3154 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3155 hdev);
3156
3157 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3158 if (!cmd)
3159 return -ENOENT;
3160
3161 bacpy(&rp.addr.bdaddr, bdaddr);
3162 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3163
3164 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3165 mgmt_status(status), &rp, sizeof(rp));
3166
3167 mgmt_pending_remove(cmd);
3168
3169 return err;
3170 }
3171
3172 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3173 u8 addr_type, u8 status)
3174 {
3175 struct mgmt_ev_connect_failed ev;
3176
3177 bacpy(&ev.addr.bdaddr, bdaddr);
3178 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3179 ev.status = mgmt_status(status);
3180
3181 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3182 }
3183
3184 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3185 {
3186 struct mgmt_ev_pin_code_request ev;
3187
3188 bacpy(&ev.addr.bdaddr, bdaddr);
3189 ev.addr.type = BDADDR_BREDR;
3190 ev.secure = secure;
3191
3192 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3193 NULL);
3194 }
3195
3196 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3197 u8 status)
3198 {
3199 struct pending_cmd *cmd;
3200 struct mgmt_rp_pin_code_reply rp;
3201 int err;
3202
3203 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3204 if (!cmd)
3205 return -ENOENT;
3206
3207 bacpy(&rp.addr.bdaddr, bdaddr);
3208 rp.addr.type = BDADDR_BREDR;
3209
3210 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3211 mgmt_status(status), &rp, sizeof(rp));
3212
3213 mgmt_pending_remove(cmd);
3214
3215 return err;
3216 }
3217
3218 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3219 u8 status)
3220 {
3221 struct pending_cmd *cmd;
3222 struct mgmt_rp_pin_code_reply rp;
3223 int err;
3224
3225 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3226 if (!cmd)
3227 return -ENOENT;
3228
3229 bacpy(&rp.addr.bdaddr, bdaddr);
3230 rp.addr.type = BDADDR_BREDR;
3231
3232 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3233 mgmt_status(status), &rp, sizeof(rp));
3234
3235 mgmt_pending_remove(cmd);
3236
3237 return err;
3238 }
3239
3240 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3241 u8 link_type, u8 addr_type, __le32 value,
3242 u8 confirm_hint)
3243 {
3244 struct mgmt_ev_user_confirm_request ev;
3245
3246 BT_DBG("%s", hdev->name);
3247
3248 bacpy(&ev.addr.bdaddr, bdaddr);
3249 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3250 ev.confirm_hint = confirm_hint;
3251 ev.value = value;
3252
3253 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3254 NULL);
3255 }
3256
3257 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3258 u8 link_type, u8 addr_type)
3259 {
3260 struct mgmt_ev_user_passkey_request ev;
3261
3262 BT_DBG("%s", hdev->name);
3263
3264 bacpy(&ev.addr.bdaddr, bdaddr);
3265 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3266
3267 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3268 NULL);
3269 }
3270
3271 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3272 u8 link_type, u8 addr_type, u8 status,
3273 u8 opcode)
3274 {
3275 struct pending_cmd *cmd;
3276 struct mgmt_rp_user_confirm_reply rp;
3277 int err;
3278
3279 cmd = mgmt_pending_find(opcode, hdev);
3280 if (!cmd)
3281 return -ENOENT;
3282
3283 bacpy(&rp.addr.bdaddr, bdaddr);
3284 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3285 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3286 &rp, sizeof(rp));
3287
3288 mgmt_pending_remove(cmd);
3289
3290 return err;
3291 }
3292
3293 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3294 u8 link_type, u8 addr_type, u8 status)
3295 {
3296 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3297 status, MGMT_OP_USER_CONFIRM_REPLY);
3298 }
3299
3300 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3301 u8 link_type, u8 addr_type, u8 status)
3302 {
3303 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3304 status,
3305 MGMT_OP_USER_CONFIRM_NEG_REPLY);
3306 }
3307
3308 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3309 u8 link_type, u8 addr_type, u8 status)
3310 {
3311 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3312 status, MGMT_OP_USER_PASSKEY_REPLY);
3313 }
3314
3315 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3316 u8 link_type, u8 addr_type, u8 status)
3317 {
3318 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3319 status,
3320 MGMT_OP_USER_PASSKEY_NEG_REPLY);
3321 }
3322
3323 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3324 u8 link_type, u8 addr_type, u32 passkey,
3325 u8 entered)
3326 {
3327 struct mgmt_ev_passkey_notify ev;
3328
3329 BT_DBG("%s", hdev->name);
3330
3331 bacpy(&ev.addr.bdaddr, bdaddr);
3332 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3333 ev.passkey = __cpu_to_le32(passkey);
3334 ev.entered = entered;
3335
3336 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3337 }
3338
3339 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3340 u8 addr_type, u8 status)
3341 {
3342 struct mgmt_ev_auth_failed ev;
3343
3344 bacpy(&ev.addr.bdaddr, bdaddr);
3345 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3346 ev.status = mgmt_status(status);
3347
3348 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3349 }
3350
3351 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3352 {
3353 struct cmd_lookup match = { NULL, hdev };
3354 bool changed = false;
3355 int err = 0;
3356
3357 if (status) {
3358 u8 mgmt_err = mgmt_status(status);
3359 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3360 cmd_status_rsp, &mgmt_err);
3361 return 0;
3362 }
3363
3364 if (test_bit(HCI_AUTH, &hdev->flags)) {
3365 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3366 changed = true;
3367 } else {
3368 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3369 changed = true;
3370 }
3371
3372 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3373 &match);
3374
3375 if (changed)
3376 err = new_settings(hdev, match.sk);
3377
3378 if (match.sk)
3379 sock_put(match.sk);
3380
3381 return err;
3382 }
3383
3384 static int clear_eir(struct hci_dev *hdev)
3385 {
3386 struct hci_cp_write_eir cp;
3387
3388 if (!lmp_ext_inq_capable(hdev))
3389 return 0;
3390
3391 memset(hdev->eir, 0, sizeof(hdev->eir));
3392
3393 memset(&cp, 0, sizeof(cp));
3394
3395 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3396 }
3397
3398 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3399 {
3400 struct cmd_lookup match = { NULL, hdev };
3401 bool changed = false;
3402 int err = 0;
3403
3404 if (status) {
3405 u8 mgmt_err = mgmt_status(status);
3406
3407 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3408 &hdev->dev_flags))
3409 err = new_settings(hdev, NULL);
3410
3411 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3412 &mgmt_err);
3413
3414 return err;
3415 }
3416
3417 if (enable) {
3418 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3419 changed = true;
3420 } else {
3421 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3422 changed = true;
3423 }
3424
3425 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3426
3427 if (changed)
3428 err = new_settings(hdev, match.sk);
3429
3430 if (match.sk)
3431 sock_put(match.sk);
3432
3433 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3434 update_eir(hdev);
3435 else
3436 clear_eir(hdev);
3437
3438 return err;
3439 }
3440
3441 static void class_rsp(struct pending_cmd *cmd, void *data)
3442 {
3443 struct cmd_lookup *match = data;
3444
3445 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3446 match->hdev->dev_class, 3);
3447
3448 list_del(&cmd->list);
3449
3450 if (match->sk == NULL) {
3451 match->sk = cmd->sk;
3452 sock_hold(match->sk);
3453 }
3454
3455 mgmt_pending_free(cmd);
3456 }
3457
3458 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3459 u8 status)
3460 {
3461 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3462 int err = 0;
3463
3464 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3465
3466 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3467 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3468 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3469
3470 if (!status)
3471 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3472 3, NULL);
3473
3474 if (match.sk)
3475 sock_put(match.sk);
3476
3477 return err;
3478 }
3479
3480 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3481 {
3482 struct pending_cmd *cmd;
3483 struct mgmt_cp_set_local_name ev;
3484 bool changed = false;
3485 int err = 0;
3486
3487 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3488 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3489 changed = true;
3490 }
3491
3492 memset(&ev, 0, sizeof(ev));
3493 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3494 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3495
3496 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3497 if (!cmd)
3498 goto send_event;
3499
3500 /* Always assume that either the short or the complete name has
3501 * changed if there was a pending mgmt command */
3502 changed = true;
3503
3504 if (status) {
3505 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3506 mgmt_status(status));
3507 goto failed;
3508 }
3509
3510 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3511 sizeof(ev));
3512 if (err < 0)
3513 goto failed;
3514
3515 send_event:
3516 if (changed)
3517 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3518 sizeof(ev), cmd ? cmd->sk : NULL);
3519
3520 /* EIR is taken care of separately when powering on the
3521 * adapter so only update them here if this is a name change
3522 * unrelated to power on.
3523 */
3524 if (!test_bit(HCI_INIT, &hdev->flags))
3525 update_eir(hdev);
3526
3527 failed:
3528 if (cmd)
3529 mgmt_pending_remove(cmd);
3530 return err;
3531 }
3532
3533 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3534 u8 *randomizer, u8 status)
3535 {
3536 struct pending_cmd *cmd;
3537 int err;
3538
3539 BT_DBG("%s status %u", hdev->name, status);
3540
3541 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3542 if (!cmd)
3543 return -ENOENT;
3544
3545 if (status) {
3546 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3547 mgmt_status(status));
3548 } else {
3549 struct mgmt_rp_read_local_oob_data rp;
3550
3551 memcpy(rp.hash, hash, sizeof(rp.hash));
3552 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3553
3554 err = cmd_complete(cmd->sk, hdev->id,
3555 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3556 sizeof(rp));
3557 }
3558
3559 mgmt_pending_remove(cmd);
3560
3561 return err;
3562 }
3563
3564 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3565 {
3566 struct cmd_lookup match = { NULL, hdev };
3567 bool changed = false;
3568 int err = 0;
3569
3570 if (status) {
3571 u8 mgmt_err = mgmt_status(status);
3572
3573 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3574 &hdev->dev_flags))
3575 err = new_settings(hdev, NULL);
3576
3577 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3578 &mgmt_err);
3579
3580 return err;
3581 }
3582
3583 if (enable) {
3584 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3585 changed = true;
3586 } else {
3587 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3588 changed = true;
3589 }
3590
3591 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3592
3593 if (changed)
3594 err = new_settings(hdev, match.sk);
3595
3596 if (match.sk)
3597 sock_put(match.sk);
3598
3599 return err;
3600 }
3601
3602 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3603 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3604 ssp, u8 *eir, u16 eir_len)
3605 {
3606 char buf[512];
3607 struct mgmt_ev_device_found *ev = (void *) buf;
3608 size_t ev_size;
3609
3610 /* Leave 5 bytes for a potential CoD field */
3611 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3612 return -EINVAL;
3613
3614 memset(buf, 0, sizeof(buf));
3615
3616 bacpy(&ev->addr.bdaddr, bdaddr);
3617 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3618 ev->rssi = rssi;
3619 if (cfm_name)
3620 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3621 if (!ssp)
3622 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3623
3624 if (eir_len > 0)
3625 memcpy(ev->eir, eir, eir_len);
3626
3627 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3628 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3629 dev_class, 3);
3630
3631 ev->eir_len = cpu_to_le16(eir_len);
3632 ev_size = sizeof(*ev) + eir_len;
3633
3634 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3635 }
3636
3637 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3638 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3639 {
3640 struct mgmt_ev_device_found *ev;
3641 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3642 u16 eir_len;
3643
3644 ev = (struct mgmt_ev_device_found *) buf;
3645
3646 memset(buf, 0, sizeof(buf));
3647
3648 bacpy(&ev->addr.bdaddr, bdaddr);
3649 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3650 ev->rssi = rssi;
3651
3652 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3653 name_len);
3654
3655 ev->eir_len = cpu_to_le16(eir_len);
3656
3657 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3658 sizeof(*ev) + eir_len, NULL);
3659 }
3660
3661 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3662 {
3663 struct pending_cmd *cmd;
3664 u8 type;
3665 int err;
3666
3667 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3668
3669 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3670 if (!cmd)
3671 return -ENOENT;
3672
3673 type = hdev->discovery.type;
3674
3675 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3676 &type, sizeof(type));
3677 mgmt_pending_remove(cmd);
3678
3679 return err;
3680 }
3681
3682 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3683 {
3684 struct pending_cmd *cmd;
3685 int err;
3686
3687 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3688 if (!cmd)
3689 return -ENOENT;
3690
3691 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3692 &hdev->discovery.type, sizeof(hdev->discovery.type));
3693 mgmt_pending_remove(cmd);
3694
3695 return err;
3696 }
3697
3698 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3699 {
3700 struct mgmt_ev_discovering ev;
3701 struct pending_cmd *cmd;
3702
3703 BT_DBG("%s discovering %u", hdev->name, discovering);
3704
3705 if (discovering)
3706 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3707 else
3708 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3709
3710 if (cmd != NULL) {
3711 u8 type = hdev->discovery.type;
3712
3713 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3714 sizeof(type));
3715 mgmt_pending_remove(cmd);
3716 }
3717
3718 memset(&ev, 0, sizeof(ev));
3719 ev.type = hdev->discovery.type;
3720 ev.discovering = discovering;
3721
3722 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3723 }
3724
3725 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3726 {
3727 struct pending_cmd *cmd;
3728 struct mgmt_ev_device_blocked ev;
3729
3730 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3731
3732 bacpy(&ev.addr.bdaddr, bdaddr);
3733 ev.addr.type = type;
3734
3735 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3736 cmd ? cmd->sk : NULL);
3737 }
3738
3739 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3740 {
3741 struct pending_cmd *cmd;
3742 struct mgmt_ev_device_unblocked ev;
3743
3744 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3745
3746 bacpy(&ev.addr.bdaddr, bdaddr);
3747 ev.addr.type = type;
3748
3749 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3750 cmd ? cmd->sk : NULL);
3751 }
3752
3753 module_param(enable_hs, bool, 0644);
3754 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
ubuntu-bionic-kernel mirror