]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - net/bluetooth/mgmt.c
projects / mirror_ubuntu-zesty-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[mirror_ubuntu-zesty-kernel.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/kernel.h>
28 #include <linux/uaccess.h>
29 #include <linux/module.h>
30 #include <asm/unaligned.h>
31
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/mgmt.h>
35 #include <net/bluetooth/smp.h>
36
37 bool enable_hs;
38 bool enable_le;
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 0
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_PAIRABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 };
82
83 static const u16 mgmt_events[] = {
84 MGMT_EV_CONTROLLER_ERROR,
85 MGMT_EV_INDEX_ADDED,
86 MGMT_EV_INDEX_REMOVED,
87 MGMT_EV_NEW_SETTINGS,
88 MGMT_EV_CLASS_OF_DEV_CHANGED,
89 MGMT_EV_LOCAL_NAME_CHANGED,
90 MGMT_EV_NEW_LINK_KEY,
91 MGMT_EV_NEW_LONG_TERM_KEY,
92 MGMT_EV_DEVICE_CONNECTED,
93 MGMT_EV_DEVICE_DISCONNECTED,
94 MGMT_EV_CONNECT_FAILED,
95 MGMT_EV_PIN_CODE_REQUEST,
96 MGMT_EV_USER_CONFIRM_REQUEST,
97 MGMT_EV_USER_PASSKEY_REQUEST,
98 MGMT_EV_AUTH_FAILED,
99 MGMT_EV_DEVICE_FOUND,
100 MGMT_EV_DISCOVERING,
101 MGMT_EV_DEVICE_BLOCKED,
102 MGMT_EV_DEVICE_UNBLOCKED,
103 MGMT_EV_DEVICE_UNPAIRED,
104 };
105
106 /*
107 * These LE scan and inquiry parameters were chosen according to LE General
108 * Discovery Procedure specification.
109 */
110 #define LE_SCAN_TYPE 0x01
111 #define LE_SCAN_WIN 0x12
112 #define LE_SCAN_INT 0x12
113 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
114 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
115
116 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
117 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
118
119 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
120
121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
122 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
123
124 struct pending_cmd {
125 struct list_head list;
126 u16 opcode;
127 int index;
128 void *param;
129 struct sock *sk;
130 void *user_data;
131 };
132
133 /* HCI to MGMT error code conversion table */
134 static u8 mgmt_status_table[] = {
135 MGMT_STATUS_SUCCESS,
136 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
137 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
138 MGMT_STATUS_FAILED, /* Hardware Failure */
139 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
140 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
141 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
142 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
143 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
144 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
145 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
146 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
147 MGMT_STATUS_BUSY, /* Command Disallowed */
148 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
149 MGMT_STATUS_REJECTED, /* Rejected Security */
150 MGMT_STATUS_REJECTED, /* Rejected Personal */
151 MGMT_STATUS_TIMEOUT, /* Host Timeout */
152 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
153 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
154 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
155 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
156 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
157 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
158 MGMT_STATUS_BUSY, /* Repeated Attempts */
159 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
160 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
161 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
162 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
163 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
164 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
165 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
166 MGMT_STATUS_FAILED, /* Unspecified Error */
167 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
168 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
169 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
170 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
171 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
172 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
173 MGMT_STATUS_FAILED, /* Unit Link Key Used */
174 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
175 MGMT_STATUS_TIMEOUT, /* Instant Passed */
176 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
177 MGMT_STATUS_FAILED, /* Transaction Collision */
178 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
179 MGMT_STATUS_REJECTED, /* QoS Rejected */
180 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
181 MGMT_STATUS_REJECTED, /* Insufficient Security */
182 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
183 MGMT_STATUS_BUSY, /* Role Switch Pending */
184 MGMT_STATUS_FAILED, /* Slot Violation */
185 MGMT_STATUS_FAILED, /* Role Switch Failed */
186 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
187 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
188 MGMT_STATUS_BUSY, /* Host Busy Pairing */
189 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
190 MGMT_STATUS_BUSY, /* Controller Busy */
191 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
192 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
193 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
194 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
195 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
196 };
197
198 static u8 mgmt_status(u8 hci_status)
199 {
200 if (hci_status < ARRAY_SIZE(mgmt_status_table))
201 return mgmt_status_table[hci_status];
202
203 return MGMT_STATUS_FAILED;
204 }
205
206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
207 {
208 struct sk_buff *skb;
209 struct mgmt_hdr *hdr;
210 struct mgmt_ev_cmd_status *ev;
211 int err;
212
213 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
214
215 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
216 if (!skb)
217 return -ENOMEM;
218
219 hdr = (void *) skb_put(skb, sizeof(*hdr));
220
221 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
222 hdr->index = cpu_to_le16(index);
223 hdr->len = cpu_to_le16(sizeof(*ev));
224
225 ev = (void *) skb_put(skb, sizeof(*ev));
226 ev->status = status;
227 put_unaligned_le16(cmd, &ev->opcode);
228
229 err = sock_queue_rcv_skb(sk, skb);
230 if (err < 0)
231 kfree_skb(skb);
232
233 return err;
234 }
235
236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
237 void *rp, size_t rp_len)
238 {
239 struct sk_buff *skb;
240 struct mgmt_hdr *hdr;
241 struct mgmt_ev_cmd_complete *ev;
242 int err;
243
244 BT_DBG("sock %p", sk);
245
246 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
247 if (!skb)
248 return -ENOMEM;
249
250 hdr = (void *) skb_put(skb, sizeof(*hdr));
251
252 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
253 hdr->index = cpu_to_le16(index);
254 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
255
256 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
257 put_unaligned_le16(cmd, &ev->opcode);
258 ev->status = status;
259
260 if (rp)
261 memcpy(ev->data, rp, rp_len);
262
263 err = sock_queue_rcv_skb(sk, skb);
264 if (err < 0)
265 kfree_skb(skb);
266
267 return err;
268 }
269
270 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
271 u16 data_len)
272 {
273 struct mgmt_rp_read_version rp;
274
275 BT_DBG("sock %p", sk);
276
277 rp.version = MGMT_VERSION;
278 put_unaligned_le16(MGMT_REVISION, &rp.revision);
279
280 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
281 sizeof(rp));
282 }
283
284 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
285 u16 data_len)
286 {
287 struct mgmt_rp_read_commands *rp;
288 u16 num_commands = ARRAY_SIZE(mgmt_commands);
289 u16 num_events = ARRAY_SIZE(mgmt_events);
290 u16 *opcode;
291 size_t rp_size;
292 int i, err;
293
294 BT_DBG("sock %p", sk);
295
296 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
297
298 rp = kmalloc(rp_size, GFP_KERNEL);
299 if (!rp)
300 return -ENOMEM;
301
302 put_unaligned_le16(num_commands, &rp->num_commands);
303 put_unaligned_le16(num_events, &rp->num_events);
304
305 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
306 put_unaligned_le16(mgmt_commands[i], opcode);
307
308 for (i = 0; i < num_events; i++, opcode++)
309 put_unaligned_le16(mgmt_events[i], opcode);
310
311 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
312 rp_size);
313 kfree(rp);
314
315 return err;
316 }
317
318 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
319 u16 data_len)
320 {
321 struct mgmt_rp_read_index_list *rp;
322 struct list_head *p;
323 struct hci_dev *d;
324 size_t rp_len;
325 u16 count;
326 int i, err;
327
328 BT_DBG("sock %p", sk);
329
330 read_lock(&hci_dev_list_lock);
331
332 count = 0;
333 list_for_each(p, &hci_dev_list) {
334 count++;
335 }
336
337 rp_len = sizeof(*rp) + (2 * count);
338 rp = kmalloc(rp_len, GFP_ATOMIC);
339 if (!rp) {
340 read_unlock(&hci_dev_list_lock);
341 return -ENOMEM;
342 }
343
344 put_unaligned_le16(count, &rp->num_controllers);
345
346 i = 0;
347 list_for_each_entry(d, &hci_dev_list, list) {
348 if (test_bit(HCI_SETUP, &d->dev_flags))
349 continue;
350
351 put_unaligned_le16(d->id, &rp->index[i++]);
352 BT_DBG("Added hci%u", d->id);
353 }
354
355 read_unlock(&hci_dev_list_lock);
356
357 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
358 rp_len);
359
360 kfree(rp);
361
362 return err;
363 }
364
365 static u32 get_supported_settings(struct hci_dev *hdev)
366 {
367 u32 settings = 0;
368
369 settings |= MGMT_SETTING_POWERED;
370 settings |= MGMT_SETTING_CONNECTABLE;
371 settings |= MGMT_SETTING_FAST_CONNECTABLE;
372 settings |= MGMT_SETTING_DISCOVERABLE;
373 settings |= MGMT_SETTING_PAIRABLE;
374
375 if (hdev->features[6] & LMP_SIMPLE_PAIR)
376 settings |= MGMT_SETTING_SSP;
377
378 if (!(hdev->features[4] & LMP_NO_BREDR)) {
379 settings |= MGMT_SETTING_BREDR;
380 settings |= MGMT_SETTING_LINK_SECURITY;
381 }
382
383 if (enable_hs)
384 settings |= MGMT_SETTING_HS;
385
386 if (enable_le) {
387 if (hdev->features[4] & LMP_LE)
388 settings |= MGMT_SETTING_LE;
389 }
390
391 return settings;
392 }
393
394 static u32 get_current_settings(struct hci_dev *hdev)
395 {
396 u32 settings = 0;
397
398 if (hdev_is_powered(hdev))
399 settings |= MGMT_SETTING_POWERED;
400
401 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
402 settings |= MGMT_SETTING_CONNECTABLE;
403
404 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
405 settings |= MGMT_SETTING_DISCOVERABLE;
406
407 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
408 settings |= MGMT_SETTING_PAIRABLE;
409
410 if (!(hdev->features[4] & LMP_NO_BREDR))
411 settings |= MGMT_SETTING_BREDR;
412
413 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
414 settings |= MGMT_SETTING_LE;
415
416 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
417 settings |= MGMT_SETTING_LINK_SECURITY;
418
419 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
420 settings |= MGMT_SETTING_SSP;
421
422 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
423 settings |= MGMT_SETTING_HS;
424
425 return settings;
426 }
427
428 #define PNP_INFO_SVCLASS_ID 0x1200
429
430 static u8 bluetooth_base_uuid[] = {
431 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
432 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
433 };
434
435 static u16 get_uuid16(u8 *uuid128)
436 {
437 u32 val;
438 int i;
439
440 for (i = 0; i < 12; i++) {
441 if (bluetooth_base_uuid[i] != uuid128[i])
442 return 0;
443 }
444
445 memcpy(&val, &uuid128[12], 4);
446
447 val = le32_to_cpu(val);
448 if (val > 0xffff)
449 return 0;
450
451 return (u16) val;
452 }
453
454 static void create_eir(struct hci_dev *hdev, u8 *data)
455 {
456 u8 *ptr = data;
457 u16 eir_len = 0;
458 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
459 int i, truncated = 0;
460 struct bt_uuid *uuid;
461 size_t name_len;
462
463 name_len = strlen(hdev->dev_name);
464
465 if (name_len > 0) {
466 /* EIR Data type */
467 if (name_len > 48) {
468 name_len = 48;
469 ptr[1] = EIR_NAME_SHORT;
470 } else
471 ptr[1] = EIR_NAME_COMPLETE;
472
473 /* EIR Data length */
474 ptr[0] = name_len + 1;
475
476 memcpy(ptr + 2, hdev->dev_name, name_len);
477
478 eir_len += (name_len + 2);
479 ptr += (name_len + 2);
480 }
481
482 memset(uuid16_list, 0, sizeof(uuid16_list));
483
484 /* Group all UUID16 types */
485 list_for_each_entry(uuid, &hdev->uuids, list) {
486 u16 uuid16;
487
488 uuid16 = get_uuid16(uuid->uuid);
489 if (uuid16 == 0)
490 return;
491
492 if (uuid16 < 0x1100)
493 continue;
494
495 if (uuid16 == PNP_INFO_SVCLASS_ID)
496 continue;
497
498 /* Stop if not enough space to put next UUID */
499 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
500 truncated = 1;
501 break;
502 }
503
504 /* Check for duplicates */
505 for (i = 0; uuid16_list[i] != 0; i++)
506 if (uuid16_list[i] == uuid16)
507 break;
508
509 if (uuid16_list[i] == 0) {
510 uuid16_list[i] = uuid16;
511 eir_len += sizeof(u16);
512 }
513 }
514
515 if (uuid16_list[0] != 0) {
516 u8 *length = ptr;
517
518 /* EIR Data type */
519 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
520
521 ptr += 2;
522 eir_len += 2;
523
524 for (i = 0; uuid16_list[i] != 0; i++) {
525 *ptr++ = (uuid16_list[i] & 0x00ff);
526 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
527 }
528
529 /* EIR Data length */
530 *length = (i * sizeof(u16)) + 1;
531 }
532 }
533
534 static int update_eir(struct hci_dev *hdev)
535 {
536 struct hci_cp_write_eir cp;
537
538 if (!hdev_is_powered(hdev))
539 return 0;
540
541 if (!(hdev->features[6] & LMP_EXT_INQ))
542 return 0;
543
544 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
545 return 0;
546
547 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
548 return 0;
549
550 memset(&cp, 0, sizeof(cp));
551
552 create_eir(hdev, cp.data);
553
554 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
555 return 0;
556
557 memcpy(hdev->eir, cp.data, sizeof(cp.data));
558
559 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
560 }
561
562 static u8 get_service_classes(struct hci_dev *hdev)
563 {
564 struct bt_uuid *uuid;
565 u8 val = 0;
566
567 list_for_each_entry(uuid, &hdev->uuids, list)
568 val |= uuid->svc_hint;
569
570 return val;
571 }
572
573 static int update_class(struct hci_dev *hdev)
574 {
575 u8 cod[3];
576 int err;
577
578 BT_DBG("%s", hdev->name);
579
580 if (!hdev_is_powered(hdev))
581 return 0;
582
583 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
584 return 0;
585
586 cod[0] = hdev->minor_class;
587 cod[1] = hdev->major_class;
588 cod[2] = get_service_classes(hdev);
589
590 if (memcmp(cod, hdev->dev_class, 3) == 0)
591 return 0;
592
593 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
594 if (err == 0)
595 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
596
597 return err;
598 }
599
600 static void service_cache_off(struct work_struct *work)
601 {
602 struct hci_dev *hdev = container_of(work, struct hci_dev,
603 service_cache.work);
604
605 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
606 return;
607
608 hci_dev_lock(hdev);
609
610 update_eir(hdev);
611 update_class(hdev);
612
613 hci_dev_unlock(hdev);
614 }
615
616 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
617 {
618 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
619 return;
620
621 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
622
623 /* Non-mgmt controlled devices get this bit set
624 * implicitly so that pairing works for them, however
625 * for mgmt we require user-space to explicitly enable
626 * it
627 */
628 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
629 }
630
631 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
632 void *data, u16 data_len)
633 {
634 struct mgmt_rp_read_info rp;
635
636 BT_DBG("sock %p %s", sk, hdev->name);
637
638 hci_dev_lock(hdev);
639
640 memset(&rp, 0, sizeof(rp));
641
642 bacpy(&rp.bdaddr, &hdev->bdaddr);
643
644 rp.version = hdev->hci_ver;
645
646 put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
647
648 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
649 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
650
651 memcpy(rp.dev_class, hdev->dev_class, 3);
652
653 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
654 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
655
656 hci_dev_unlock(hdev);
657
658 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
659 sizeof(rp));
660 }
661
662 static void mgmt_pending_free(struct pending_cmd *cmd)
663 {
664 sock_put(cmd->sk);
665 kfree(cmd->param);
666 kfree(cmd);
667 }
668
669 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
670 struct hci_dev *hdev, void *data,
671 u16 len)
672 {
673 struct pending_cmd *cmd;
674
675 cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
676 if (!cmd)
677 return NULL;
678
679 cmd->opcode = opcode;
680 cmd->index = hdev->id;
681
682 cmd->param = kmalloc(len, GFP_ATOMIC);
683 if (!cmd->param) {
684 kfree(cmd);
685 return NULL;
686 }
687
688 if (data)
689 memcpy(cmd->param, data, len);
690
691 cmd->sk = sk;
692 sock_hold(sk);
693
694 list_add(&cmd->list, &hdev->mgmt_pending);
695
696 return cmd;
697 }
698
699 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
700 void (*cb)(struct pending_cmd *cmd, void *data),
701 void *data)
702 {
703 struct list_head *p, *n;
704
705 list_for_each_safe(p, n, &hdev->mgmt_pending) {
706 struct pending_cmd *cmd;
707
708 cmd = list_entry(p, struct pending_cmd, list);
709
710 if (opcode > 0 && cmd->opcode != opcode)
711 continue;
712
713 cb(cmd, data);
714 }
715 }
716
717 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
718 {
719 struct pending_cmd *cmd;
720
721 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
722 if (cmd->opcode == opcode)
723 return cmd;
724 }
725
726 return NULL;
727 }
728
729 static void mgmt_pending_remove(struct pending_cmd *cmd)
730 {
731 list_del(&cmd->list);
732 mgmt_pending_free(cmd);
733 }
734
735 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
736 {
737 __le32 settings = cpu_to_le32(get_current_settings(hdev));
738
739 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
740 sizeof(settings));
741 }
742
743 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
744 u16 len)
745 {
746 struct mgmt_mode *cp = data;
747 struct pending_cmd *cmd;
748 int err;
749
750 BT_DBG("request for %s", hdev->name);
751
752 hci_dev_lock(hdev);
753
754 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
755 cancel_delayed_work(&hdev->power_off);
756
757 if (cp->val) {
758 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
759 mgmt_powered(hdev, 1);
760 goto failed;
761 }
762 }
763
764 if (!!cp->val == hdev_is_powered(hdev)) {
765 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
766 goto failed;
767 }
768
769 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
770 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
771 MGMT_STATUS_BUSY);
772 goto failed;
773 }
774
775 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
776 if (!cmd) {
777 err = -ENOMEM;
778 goto failed;
779 }
780
781 if (cp->val)
782 schedule_work(&hdev->power_on);
783 else
784 schedule_work(&hdev->power_off.work);
785
786 err = 0;
787
788 failed:
789 hci_dev_unlock(hdev);
790 return err;
791 }
792
793 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
794 struct sock *skip_sk)
795 {
796 struct sk_buff *skb;
797 struct mgmt_hdr *hdr;
798
799 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
800 if (!skb)
801 return -ENOMEM;
802
803 hdr = (void *) skb_put(skb, sizeof(*hdr));
804 hdr->opcode = cpu_to_le16(event);
805 if (hdev)
806 hdr->index = cpu_to_le16(hdev->id);
807 else
808 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
809 hdr->len = cpu_to_le16(data_len);
810
811 if (data)
812 memcpy(skb_put(skb, data_len), data, data_len);
813
814 /* Time stamp */
815 __net_timestamp(skb);
816
817 hci_send_to_control(skb, skip_sk);
818 kfree_skb(skb);
819
820 return 0;
821 }
822
823 static int new_settings(struct hci_dev *hdev, struct sock *skip)
824 {
825 __le32 ev;
826
827 ev = cpu_to_le32(get_current_settings(hdev));
828
829 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
830 }
831
832 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
833 u16 len)
834 {
835 struct mgmt_cp_set_discoverable *cp = data;
836 struct pending_cmd *cmd;
837 u16 timeout;
838 u8 scan;
839 int err;
840
841 BT_DBG("request for %s", hdev->name);
842
843 timeout = get_unaligned_le16(&cp->timeout);
844 if (!cp->val && timeout > 0)
845 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
846 MGMT_STATUS_INVALID_PARAMS);
847
848 hci_dev_lock(hdev);
849
850 if (!hdev_is_powered(hdev) && timeout > 0) {
851 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
852 MGMT_STATUS_NOT_POWERED);
853 goto failed;
854 }
855
856 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
857 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
858 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
859 MGMT_STATUS_BUSY);
860 goto failed;
861 }
862
863 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
864 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
865 MGMT_STATUS_REJECTED);
866 goto failed;
867 }
868
869 if (!hdev_is_powered(hdev)) {
870 bool changed = false;
871
872 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
873 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
874 changed = true;
875 }
876
877 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
878 if (err < 0)
879 goto failed;
880
881 if (changed)
882 err = new_settings(hdev, sk);
883
884 goto failed;
885 }
886
887 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
888 if (hdev->discov_timeout > 0) {
889 cancel_delayed_work(&hdev->discov_off);
890 hdev->discov_timeout = 0;
891 }
892
893 if (cp->val && timeout > 0) {
894 hdev->discov_timeout = timeout;
895 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
896 msecs_to_jiffies(hdev->discov_timeout * 1000));
897 }
898
899 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
900 goto failed;
901 }
902
903 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
904 if (!cmd) {
905 err = -ENOMEM;
906 goto failed;
907 }
908
909 scan = SCAN_PAGE;
910
911 if (cp->val)
912 scan |= SCAN_INQUIRY;
913 else
914 cancel_delayed_work(&hdev->discov_off);
915
916 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
917 if (err < 0)
918 mgmt_pending_remove(cmd);
919
920 if (cp->val)
921 hdev->discov_timeout = timeout;
922
923 failed:
924 hci_dev_unlock(hdev);
925 return err;
926 }
927
928 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
929 u16 len)
930 {
931 struct mgmt_mode *cp = data;
932 struct pending_cmd *cmd;
933 u8 scan;
934 int err;
935
936 BT_DBG("request for %s", hdev->name);
937
938 hci_dev_lock(hdev);
939
940 if (!hdev_is_powered(hdev)) {
941 bool changed = false;
942
943 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
944 changed = true;
945
946 if (cp->val) {
947 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
948 } else {
949 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
950 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
951 }
952
953 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
954 if (err < 0)
955 goto failed;
956
957 if (changed)
958 err = new_settings(hdev, sk);
959
960 goto failed;
961 }
962
963 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
964 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
965 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
966 MGMT_STATUS_BUSY);
967 goto failed;
968 }
969
970 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
971 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
972 goto failed;
973 }
974
975 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
976 if (!cmd) {
977 err = -ENOMEM;
978 goto failed;
979 }
980
981 if (cp->val) {
982 scan = SCAN_PAGE;
983 } else {
984 scan = 0;
985
986 if (test_bit(HCI_ISCAN, &hdev->flags) &&
987 hdev->discov_timeout > 0)
988 cancel_delayed_work(&hdev->discov_off);
989 }
990
991 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
992 if (err < 0)
993 mgmt_pending_remove(cmd);
994
995 failed:
996 hci_dev_unlock(hdev);
997 return err;
998 }
999
1000 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1001 u16 len)
1002 {
1003 struct mgmt_mode *cp = data;
1004 int err;
1005
1006 BT_DBG("request for %s", hdev->name);
1007
1008 hci_dev_lock(hdev);
1009
1010 if (cp->val)
1011 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1012 else
1013 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1014
1015 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1016 if (err < 0)
1017 goto failed;
1018
1019 err = new_settings(hdev, sk);
1020
1021 failed:
1022 hci_dev_unlock(hdev);
1023 return err;
1024 }
1025
1026 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1027 u16 len)
1028 {
1029 struct mgmt_mode *cp = data;
1030 struct pending_cmd *cmd;
1031 u8 val;
1032 int err;
1033
1034 BT_DBG("request for %s", hdev->name);
1035
1036 hci_dev_lock(hdev);
1037
1038 if (!hdev_is_powered(hdev)) {
1039 bool changed = false;
1040
1041 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1042 &hdev->dev_flags)) {
1043 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1044 changed = true;
1045 }
1046
1047 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1048 if (err < 0)
1049 goto failed;
1050
1051 if (changed)
1052 err = new_settings(hdev, sk);
1053
1054 goto failed;
1055 }
1056
1057 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1058 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1059 MGMT_STATUS_BUSY);
1060 goto failed;
1061 }
1062
1063 val = !!cp->val;
1064
1065 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1066 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1067 goto failed;
1068 }
1069
1070 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1071 if (!cmd) {
1072 err = -ENOMEM;
1073 goto failed;
1074 }
1075
1076 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1077 if (err < 0) {
1078 mgmt_pending_remove(cmd);
1079 goto failed;
1080 }
1081
1082 failed:
1083 hci_dev_unlock(hdev);
1084 return err;
1085 }
1086
1087 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1088 {
1089 struct mgmt_mode *cp = data;
1090 struct pending_cmd *cmd;
1091 u8 val;
1092 int err;
1093
1094 BT_DBG("request for %s", hdev->name);
1095
1096 hci_dev_lock(hdev);
1097
1098 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1099 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1100 MGMT_STATUS_NOT_SUPPORTED);
1101 goto failed;
1102 }
1103
1104 val = !!cp->val;
1105
1106 if (!hdev_is_powered(hdev)) {
1107 bool changed = false;
1108
1109 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1110 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1111 changed = true;
1112 }
1113
1114 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1115 if (err < 0)
1116 goto failed;
1117
1118 if (changed)
1119 err = new_settings(hdev, sk);
1120
1121 goto failed;
1122 }
1123
1124 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1125 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1126 MGMT_STATUS_BUSY);
1127 goto failed;
1128 }
1129
1130 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1131 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1132 goto failed;
1133 }
1134
1135 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1136 if (!cmd) {
1137 err = -ENOMEM;
1138 goto failed;
1139 }
1140
1141 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1142 if (err < 0) {
1143 mgmt_pending_remove(cmd);
1144 goto failed;
1145 }
1146
1147 failed:
1148 hci_dev_unlock(hdev);
1149 return err;
1150 }
1151
1152 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1153 {
1154 struct mgmt_mode *cp = data;
1155
1156 BT_DBG("request for %s", hdev->name);
1157
1158 if (!enable_hs)
1159 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1160 MGMT_STATUS_NOT_SUPPORTED);
1161
1162 if (cp->val)
1163 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1164 else
1165 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1166
1167 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1168 }
1169
1170 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1171 {
1172 struct mgmt_mode *cp = data;
1173 struct hci_cp_write_le_host_supported hci_cp;
1174 struct pending_cmd *cmd;
1175 int err;
1176 u8 val, enabled;
1177
1178 BT_DBG("request for %s", hdev->name);
1179
1180 hci_dev_lock(hdev);
1181
1182 if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1183 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1184 MGMT_STATUS_NOT_SUPPORTED);
1185 goto unlock;
1186 }
1187
1188 val = !!cp->val;
1189 enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1190
1191 if (!hdev_is_powered(hdev) || val == enabled) {
1192 bool changed = false;
1193
1194 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1195 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1196 changed = true;
1197 }
1198
1199 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1200 if (err < 0)
1201 goto unlock;
1202
1203 if (changed)
1204 err = new_settings(hdev, sk);
1205
1206 goto unlock;
1207 }
1208
1209 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1210 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1211 MGMT_STATUS_BUSY);
1212 goto unlock;
1213 }
1214
1215 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1216 if (!cmd) {
1217 err = -ENOMEM;
1218 goto unlock;
1219 }
1220
1221 memset(&hci_cp, 0, sizeof(hci_cp));
1222
1223 if (val) {
1224 hci_cp.le = val;
1225 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1226 }
1227
1228 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1229 &hci_cp);
1230 if (err < 0) {
1231 mgmt_pending_remove(cmd);
1232 goto unlock;
1233 }
1234
1235 unlock:
1236 hci_dev_unlock(hdev);
1237 return err;
1238 }
1239
1240 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1241 {
1242 struct mgmt_cp_add_uuid *cp = data;
1243 struct pending_cmd *cmd;
1244 struct bt_uuid *uuid;
1245 int err;
1246
1247 BT_DBG("request for %s", hdev->name);
1248
1249 hci_dev_lock(hdev);
1250
1251 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1252 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1253 MGMT_STATUS_BUSY);
1254 goto failed;
1255 }
1256
1257 uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1258 if (!uuid) {
1259 err = -ENOMEM;
1260 goto failed;
1261 }
1262
1263 memcpy(uuid->uuid, cp->uuid, 16);
1264 uuid->svc_hint = cp->svc_hint;
1265
1266 list_add(&uuid->list, &hdev->uuids);
1267
1268 err = update_class(hdev);
1269 if (err < 0)
1270 goto failed;
1271
1272 err = update_eir(hdev);
1273 if (err < 0)
1274 goto failed;
1275
1276 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1277 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1278 hdev->dev_class, 3);
1279 goto failed;
1280 }
1281
1282 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1283 if (!cmd) {
1284 err = -ENOMEM;
1285 goto failed;
1286 }
1287
1288 failed:
1289 hci_dev_unlock(hdev);
1290 return err;
1291 }
1292
1293 static bool enable_service_cache(struct hci_dev *hdev)
1294 {
1295 if (!hdev_is_powered(hdev))
1296 return false;
1297
1298 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1299 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1300 return true;
1301 }
1302
1303 return false;
1304 }
1305
1306 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1307 u16 len)
1308 {
1309 struct mgmt_cp_remove_uuid *cp = data;
1310 struct pending_cmd *cmd;
1311 struct list_head *p, *n;
1312 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1313 int err, found;
1314
1315 BT_DBG("request for %s", hdev->name);
1316
1317 hci_dev_lock(hdev);
1318
1319 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1320 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1321 MGMT_STATUS_BUSY);
1322 goto unlock;
1323 }
1324
1325 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1326 err = hci_uuids_clear(hdev);
1327
1328 if (enable_service_cache(hdev)) {
1329 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1330 0, hdev->dev_class, 3);
1331 goto unlock;
1332 }
1333
1334 goto update_class;
1335 }
1336
1337 found = 0;
1338
1339 list_for_each_safe(p, n, &hdev->uuids) {
1340 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1341
1342 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1343 continue;
1344
1345 list_del(&match->list);
1346 found++;
1347 }
1348
1349 if (found == 0) {
1350 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1351 MGMT_STATUS_INVALID_PARAMS);
1352 goto unlock;
1353 }
1354
1355 update_class:
1356 err = update_class(hdev);
1357 if (err < 0)
1358 goto unlock;
1359
1360 err = update_eir(hdev);
1361 if (err < 0)
1362 goto unlock;
1363
1364 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1365 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1366 hdev->dev_class, 3);
1367 goto unlock;
1368 }
1369
1370 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1371 if (!cmd) {
1372 err = -ENOMEM;
1373 goto unlock;
1374 }
1375
1376 unlock:
1377 hci_dev_unlock(hdev);
1378 return err;
1379 }
1380
1381 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1382 u16 len)
1383 {
1384 struct mgmt_cp_set_dev_class *cp = data;
1385 struct pending_cmd *cmd;
1386 int err;
1387
1388 BT_DBG("request for %s", hdev->name);
1389
1390 hci_dev_lock(hdev);
1391
1392 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1393 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1394 MGMT_STATUS_BUSY);
1395 goto unlock;
1396 }
1397
1398 hdev->major_class = cp->major;
1399 hdev->minor_class = cp->minor;
1400
1401 if (!hdev_is_powered(hdev)) {
1402 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1403 hdev->dev_class, 3);
1404 goto unlock;
1405 }
1406
1407 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1408 hci_dev_unlock(hdev);
1409 cancel_delayed_work_sync(&hdev->service_cache);
1410 hci_dev_lock(hdev);
1411 update_eir(hdev);
1412 }
1413
1414 err = update_class(hdev);
1415 if (err < 0)
1416 goto unlock;
1417
1418 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1419 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1420 hdev->dev_class, 3);
1421 goto unlock;
1422 }
1423
1424 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1425 if (!cmd) {
1426 err = -ENOMEM;
1427 goto unlock;
1428 }
1429
1430 unlock:
1431 hci_dev_unlock(hdev);
1432 return err;
1433 }
1434
1435 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1436 u16 len)
1437 {
1438 struct mgmt_cp_load_link_keys *cp = data;
1439 u16 key_count, expected_len;
1440 int i;
1441
1442 key_count = get_unaligned_le16(&cp->key_count);
1443
1444 expected_len = sizeof(*cp) + key_count *
1445 sizeof(struct mgmt_link_key_info);
1446 if (expected_len != len) {
1447 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1448 len, expected_len);
1449 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1450 MGMT_STATUS_INVALID_PARAMS);
1451 }
1452
1453 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1454 key_count);
1455
1456 hci_dev_lock(hdev);
1457
1458 hci_link_keys_clear(hdev);
1459
1460 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1461
1462 if (cp->debug_keys)
1463 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1464 else
1465 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1466
1467 for (i = 0; i < key_count; i++) {
1468 struct mgmt_link_key_info *key = &cp->keys[i];
1469
1470 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1471 key->type, key->pin_len);
1472 }
1473
1474 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1475
1476 hci_dev_unlock(hdev);
1477
1478 return 0;
1479 }
1480
1481 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1482 u8 addr_type, struct sock *skip_sk)
1483 {
1484 struct mgmt_ev_device_unpaired ev;
1485
1486 bacpy(&ev.addr.bdaddr, bdaddr);
1487 ev.addr.type = addr_type;
1488
1489 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1490 skip_sk);
1491 }
1492
1493 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1494 u16 len)
1495 {
1496 struct mgmt_cp_unpair_device *cp = data;
1497 struct mgmt_rp_unpair_device rp;
1498 struct hci_cp_disconnect dc;
1499 struct pending_cmd *cmd;
1500 struct hci_conn *conn;
1501 int err;
1502
1503 hci_dev_lock(hdev);
1504
1505 memset(&rp, 0, sizeof(rp));
1506 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1507 rp.addr.type = cp->addr.type;
1508
1509 if (!hdev_is_powered(hdev)) {
1510 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1511 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1512 goto unlock;
1513 }
1514
1515 if (cp->addr.type == MGMT_ADDR_BREDR)
1516 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1517 else
1518 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1519
1520 if (err < 0) {
1521 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1522 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1523 goto unlock;
1524 }
1525
1526 if (cp->disconnect) {
1527 if (cp->addr.type == MGMT_ADDR_BREDR)
1528 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1529 &cp->addr.bdaddr);
1530 else
1531 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1532 &cp->addr.bdaddr);
1533 } else {
1534 conn = NULL;
1535 }
1536
1537 if (!conn) {
1538 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1539 &rp, sizeof(rp));
1540 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1541 goto unlock;
1542 }
1543
1544 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1545 sizeof(*cp));
1546 if (!cmd) {
1547 err = -ENOMEM;
1548 goto unlock;
1549 }
1550
1551 put_unaligned_le16(conn->handle, &dc.handle);
1552 dc.reason = 0x13; /* Remote User Terminated Connection */
1553 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1554 if (err < 0)
1555 mgmt_pending_remove(cmd);
1556
1557 unlock:
1558 hci_dev_unlock(hdev);
1559 return err;
1560 }
1561
1562 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1563 u16 len)
1564 {
1565 struct mgmt_cp_disconnect *cp = data;
1566 struct hci_cp_disconnect dc;
1567 struct pending_cmd *cmd;
1568 struct hci_conn *conn;
1569 int err;
1570
1571 BT_DBG("");
1572
1573 hci_dev_lock(hdev);
1574
1575 if (!test_bit(HCI_UP, &hdev->flags)) {
1576 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1577 MGMT_STATUS_NOT_POWERED);
1578 goto failed;
1579 }
1580
1581 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1582 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1583 MGMT_STATUS_BUSY);
1584 goto failed;
1585 }
1586
1587 if (cp->addr.type == MGMT_ADDR_BREDR)
1588 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1589 else
1590 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1591
1592 if (!conn) {
1593 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1594 MGMT_STATUS_NOT_CONNECTED);
1595 goto failed;
1596 }
1597
1598 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1599 if (!cmd) {
1600 err = -ENOMEM;
1601 goto failed;
1602 }
1603
1604 put_unaligned_le16(conn->handle, &dc.handle);
1605 dc.reason = 0x13; /* Remote User Terminated Connection */
1606
1607 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1608 if (err < 0)
1609 mgmt_pending_remove(cmd);
1610
1611 failed:
1612 hci_dev_unlock(hdev);
1613 return err;
1614 }
1615
1616 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1617 {
1618 switch (link_type) {
1619 case LE_LINK:
1620 switch (addr_type) {
1621 case ADDR_LE_DEV_PUBLIC:
1622 return MGMT_ADDR_LE_PUBLIC;
1623 case ADDR_LE_DEV_RANDOM:
1624 return MGMT_ADDR_LE_RANDOM;
1625 default:
1626 return MGMT_ADDR_INVALID;
1627 }
1628 case ACL_LINK:
1629 return MGMT_ADDR_BREDR;
1630 default:
1631 return MGMT_ADDR_INVALID;
1632 }
1633 }
1634
1635 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1636 u16 data_len)
1637 {
1638 struct mgmt_rp_get_connections *rp;
1639 struct hci_conn *c;
1640 size_t rp_len;
1641 int err;
1642 u16 i;
1643
1644 BT_DBG("");
1645
1646 hci_dev_lock(hdev);
1647
1648 if (!hdev_is_powered(hdev)) {
1649 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1650 MGMT_STATUS_NOT_POWERED);
1651 goto unlock;
1652 }
1653
1654 i = 0;
1655 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1656 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1657 i++;
1658 }
1659
1660 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1661 rp = kmalloc(rp_len, GFP_ATOMIC);
1662 if (!rp) {
1663 err = -ENOMEM;
1664 goto unlock;
1665 }
1666
1667 i = 0;
1668 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1669 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1670 continue;
1671 bacpy(&rp->addr[i].bdaddr, &c->dst);
1672 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1673 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1674 continue;
1675 i++;
1676 }
1677
1678 put_unaligned_le16(i, &rp->conn_count);
1679
1680 /* Recalculate length in case of filtered SCO connections, etc */
1681 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1682
1683 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1684 rp_len);
1685
1686 kfree(rp);
1687
1688 unlock:
1689 hci_dev_unlock(hdev);
1690 return err;
1691 }
1692
1693 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1694 struct mgmt_cp_pin_code_neg_reply *cp)
1695 {
1696 struct pending_cmd *cmd;
1697 int err;
1698
1699 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1700 sizeof(*cp));
1701 if (!cmd)
1702 return -ENOMEM;
1703
1704 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1705 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1706 if (err < 0)
1707 mgmt_pending_remove(cmd);
1708
1709 return err;
1710 }
1711
1712 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1713 u16 len)
1714 {
1715 struct hci_conn *conn;
1716 struct mgmt_cp_pin_code_reply *cp = data;
1717 struct hci_cp_pin_code_reply reply;
1718 struct pending_cmd *cmd;
1719 int err;
1720
1721 BT_DBG("");
1722
1723 hci_dev_lock(hdev);
1724
1725 if (!hdev_is_powered(hdev)) {
1726 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1727 MGMT_STATUS_NOT_POWERED);
1728 goto failed;
1729 }
1730
1731 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1732 if (!conn) {
1733 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1734 MGMT_STATUS_NOT_CONNECTED);
1735 goto failed;
1736 }
1737
1738 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1739 struct mgmt_cp_pin_code_neg_reply ncp;
1740
1741 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1742
1743 BT_ERR("PIN code is not 16 bytes long");
1744
1745 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1746 if (err >= 0)
1747 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1748 MGMT_STATUS_INVALID_PARAMS);
1749
1750 goto failed;
1751 }
1752
1753 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1754 if (!cmd) {
1755 err = -ENOMEM;
1756 goto failed;
1757 }
1758
1759 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1760 reply.pin_len = cp->pin_len;
1761 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1762
1763 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1764 if (err < 0)
1765 mgmt_pending_remove(cmd);
1766
1767 failed:
1768 hci_dev_unlock(hdev);
1769 return err;
1770 }
1771
1772 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1773 void *data, u16 len)
1774 {
1775 struct mgmt_cp_pin_code_neg_reply *cp = data;
1776 int err;
1777
1778 BT_DBG("");
1779
1780 hci_dev_lock(hdev);
1781
1782 if (!hdev_is_powered(hdev)) {
1783 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1784 MGMT_STATUS_NOT_POWERED);
1785 goto failed;
1786 }
1787
1788 err = send_pin_code_neg_reply(sk, hdev, cp);
1789
1790 failed:
1791 hci_dev_unlock(hdev);
1792 return err;
1793 }
1794
1795 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1796 u16 len)
1797 {
1798 struct mgmt_cp_set_io_capability *cp = data;
1799
1800 BT_DBG("");
1801
1802 hci_dev_lock(hdev);
1803
1804 hdev->io_capability = cp->io_capability;
1805
1806 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1807 hdev->io_capability);
1808
1809 hci_dev_unlock(hdev);
1810
1811 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1812 0);
1813 }
1814
1815 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1816 {
1817 struct hci_dev *hdev = conn->hdev;
1818 struct pending_cmd *cmd;
1819
1820 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1821 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1822 continue;
1823
1824 if (cmd->user_data != conn)
1825 continue;
1826
1827 return cmd;
1828 }
1829
1830 return NULL;
1831 }
1832
1833 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1834 {
1835 struct mgmt_rp_pair_device rp;
1836 struct hci_conn *conn = cmd->user_data;
1837
1838 bacpy(&rp.addr.bdaddr, &conn->dst);
1839 rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1840
1841 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1842 &rp, sizeof(rp));
1843
1844 /* So we don't get further callbacks for this connection */
1845 conn->connect_cfm_cb = NULL;
1846 conn->security_cfm_cb = NULL;
1847 conn->disconn_cfm_cb = NULL;
1848
1849 hci_conn_put(conn);
1850
1851 mgmt_pending_remove(cmd);
1852 }
1853
1854 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1855 {
1856 struct pending_cmd *cmd;
1857
1858 BT_DBG("status %u", status);
1859
1860 cmd = find_pairing(conn);
1861 if (!cmd)
1862 BT_DBG("Unable to find a pending command");
1863 else
1864 pairing_complete(cmd, mgmt_status(status));
1865 }
1866
1867 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1868 u16 len)
1869 {
1870 struct mgmt_cp_pair_device *cp = data;
1871 struct mgmt_rp_pair_device rp;
1872 struct pending_cmd *cmd;
1873 u8 sec_level, auth_type;
1874 struct hci_conn *conn;
1875 int err;
1876
1877 BT_DBG("");
1878
1879 hci_dev_lock(hdev);
1880
1881 if (!hdev_is_powered(hdev)) {
1882 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1883 MGMT_STATUS_NOT_POWERED);
1884 goto unlock;
1885 }
1886
1887 sec_level = BT_SECURITY_MEDIUM;
1888 if (cp->io_cap == 0x03)
1889 auth_type = HCI_AT_DEDICATED_BONDING;
1890 else
1891 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1892
1893 if (cp->addr.type == MGMT_ADDR_BREDR)
1894 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1895 auth_type);
1896 else
1897 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1898 auth_type);
1899
1900 memset(&rp, 0, sizeof(rp));
1901 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1902 rp.addr.type = cp->addr.type;
1903
1904 if (IS_ERR(conn)) {
1905 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1906 MGMT_STATUS_CONNECT_FAILED, &rp,
1907 sizeof(rp));
1908 goto unlock;
1909 }
1910
1911 if (conn->connect_cfm_cb) {
1912 hci_conn_put(conn);
1913 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1914 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1915 goto unlock;
1916 }
1917
1918 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1919 if (!cmd) {
1920 err = -ENOMEM;
1921 hci_conn_put(conn);
1922 goto unlock;
1923 }
1924
1925 /* For LE, just connecting isn't a proof that the pairing finished */
1926 if (cp->addr.type == MGMT_ADDR_BREDR)
1927 conn->connect_cfm_cb = pairing_complete_cb;
1928
1929 conn->security_cfm_cb = pairing_complete_cb;
1930 conn->disconn_cfm_cb = pairing_complete_cb;
1931 conn->io_capability = cp->io_cap;
1932 cmd->user_data = conn;
1933
1934 if (conn->state == BT_CONNECTED &&
1935 hci_conn_security(conn, sec_level, auth_type))
1936 pairing_complete(cmd, 0);
1937
1938 err = 0;
1939
1940 unlock:
1941 hci_dev_unlock(hdev);
1942 return err;
1943 }
1944
1945 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1946 u16 len)
1947 {
1948 struct mgmt_addr_info *addr = data;
1949 struct pending_cmd *cmd;
1950 struct hci_conn *conn;
1951 int err;
1952
1953 BT_DBG("");
1954
1955 hci_dev_lock(hdev);
1956
1957 if (!hdev_is_powered(hdev)) {
1958 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1959 MGMT_STATUS_NOT_POWERED);
1960 goto unlock;
1961 }
1962
1963 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1964 if (!cmd) {
1965 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1966 MGMT_STATUS_INVALID_PARAMS);
1967 goto unlock;
1968 }
1969
1970 conn = cmd->user_data;
1971
1972 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1973 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1974 MGMT_STATUS_INVALID_PARAMS);
1975 goto unlock;
1976 }
1977
1978 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1979
1980 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1981 addr, sizeof(*addr));
1982 unlock:
1983 hci_dev_unlock(hdev);
1984 return err;
1985 }
1986
1987 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1988 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
1989 u16 hci_op, __le32 passkey)
1990 {
1991 struct pending_cmd *cmd;
1992 struct hci_conn *conn;
1993 int err;
1994
1995 hci_dev_lock(hdev);
1996
1997 if (!hdev_is_powered(hdev)) {
1998 err = cmd_status(sk, hdev->id, mgmt_op,
1999 MGMT_STATUS_NOT_POWERED);
2000 goto done;
2001 }
2002
2003 if (type == MGMT_ADDR_BREDR)
2004 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2005 else
2006 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2007
2008 if (!conn) {
2009 err = cmd_status(sk, hdev->id, mgmt_op,
2010 MGMT_STATUS_NOT_CONNECTED);
2011 goto done;
2012 }
2013
2014 if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2015 /* Continue with pairing via SMP */
2016 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2017
2018 if (!err)
2019 err = cmd_status(sk, hdev->id, mgmt_op,
2020 MGMT_STATUS_SUCCESS);
2021 else
2022 err = cmd_status(sk, hdev->id, mgmt_op,
2023 MGMT_STATUS_FAILED);
2024
2025 goto done;
2026 }
2027
2028 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2029 if (!cmd) {
2030 err = -ENOMEM;
2031 goto done;
2032 }
2033
2034 /* Continue with pairing via HCI */
2035 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2036 struct hci_cp_user_passkey_reply cp;
2037
2038 bacpy(&cp.bdaddr, bdaddr);
2039 cp.passkey = passkey;
2040 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2041 } else
2042 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2043
2044 if (err < 0)
2045 mgmt_pending_remove(cmd);
2046
2047 done:
2048 hci_dev_unlock(hdev);
2049 return err;
2050 }
2051
2052 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2053 u16 len)
2054 {
2055 struct mgmt_cp_user_confirm_reply *cp = data;
2056
2057 BT_DBG("");
2058
2059 if (len != sizeof(*cp))
2060 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2061 MGMT_STATUS_INVALID_PARAMS);
2062
2063 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2064 MGMT_OP_USER_CONFIRM_REPLY,
2065 HCI_OP_USER_CONFIRM_REPLY, 0);
2066 }
2067
2068 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2069 void *data, u16 len)
2070 {
2071 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2072
2073 BT_DBG("");
2074
2075 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2076 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2077 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2078 }
2079
2080 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2081 u16 len)
2082 {
2083 struct mgmt_cp_user_passkey_reply *cp = data;
2084
2085 BT_DBG("");
2086
2087 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2088 MGMT_OP_USER_PASSKEY_REPLY,
2089 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2090 }
2091
2092 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2093 void *data, u16 len)
2094 {
2095 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2096
2097 BT_DBG("");
2098
2099 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2100 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2101 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2102 }
2103
2104 static int update_name(struct hci_dev *hdev, const char *name)
2105 {
2106 struct hci_cp_write_local_name cp;
2107
2108 memcpy(cp.name, name, sizeof(cp.name));
2109
2110 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2111 }
2112
2113 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2114 u16 len)
2115 {
2116 struct mgmt_cp_set_local_name *cp = data;
2117 struct pending_cmd *cmd;
2118 int err;
2119
2120 BT_DBG("");
2121
2122 hci_dev_lock(hdev);
2123
2124 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2125
2126 if (!hdev_is_powered(hdev)) {
2127 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2128
2129 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2130 data, len);
2131 if (err < 0)
2132 goto failed;
2133
2134 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2135 sk);
2136
2137 goto failed;
2138 }
2139
2140 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2141 if (!cmd) {
2142 err = -ENOMEM;
2143 goto failed;
2144 }
2145
2146 err = update_name(hdev, cp->name);
2147 if (err < 0)
2148 mgmt_pending_remove(cmd);
2149
2150 failed:
2151 hci_dev_unlock(hdev);
2152 return err;
2153 }
2154
2155 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2156 void *data, u16 data_len)
2157 {
2158 struct pending_cmd *cmd;
2159 int err;
2160
2161 BT_DBG("%s", hdev->name);
2162
2163 hci_dev_lock(hdev);
2164
2165 if (!hdev_is_powered(hdev)) {
2166 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2167 MGMT_STATUS_NOT_POWERED);
2168 goto unlock;
2169 }
2170
2171 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2172 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2173 MGMT_STATUS_NOT_SUPPORTED);
2174 goto unlock;
2175 }
2176
2177 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2178 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2179 MGMT_STATUS_BUSY);
2180 goto unlock;
2181 }
2182
2183 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2184 if (!cmd) {
2185 err = -ENOMEM;
2186 goto unlock;
2187 }
2188
2189 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2190 if (err < 0)
2191 mgmt_pending_remove(cmd);
2192
2193 unlock:
2194 hci_dev_unlock(hdev);
2195 return err;
2196 }
2197
2198 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2199 void *data, u16 len)
2200 {
2201 struct mgmt_cp_add_remote_oob_data *cp = data;
2202 u8 status;
2203 int err;
2204
2205 BT_DBG("%s ", hdev->name);
2206
2207 hci_dev_lock(hdev);
2208
2209 if (!hdev_is_powered(hdev)) {
2210 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2211 MGMT_STATUS_NOT_POWERED, &cp->addr,
2212 sizeof(cp->addr));
2213 goto unlock;
2214 }
2215
2216 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2217 cp->randomizer);
2218 if (err < 0)
2219 status = MGMT_STATUS_FAILED;
2220 else
2221 status = 0;
2222
2223 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2224 &cp->addr, sizeof(cp->addr));
2225
2226 unlock:
2227 hci_dev_unlock(hdev);
2228 return err;
2229 }
2230
2231 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2232 void *data, u16 len)
2233 {
2234 struct mgmt_cp_remove_remote_oob_data *cp = data;
2235 u8 status;
2236 int err;
2237
2238 BT_DBG("%s", hdev->name);
2239
2240 hci_dev_lock(hdev);
2241
2242 if (!hdev_is_powered(hdev)) {
2243 err = cmd_complete(sk, hdev->id,
2244 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2245 MGMT_STATUS_NOT_POWERED, &cp->addr,
2246 sizeof(cp->addr));
2247 goto unlock;
2248 }
2249
2250 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2251 if (err < 0)
2252 status = MGMT_STATUS_INVALID_PARAMS;
2253 else
2254 status = 0;
2255
2256 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2257 status, &cp->addr, sizeof(cp->addr));
2258
2259 unlock:
2260 hci_dev_unlock(hdev);
2261 return err;
2262 }
2263
2264 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2265 {
2266 int err;
2267
2268 BT_DBG("%s", hdev->name);
2269
2270 hci_dev_lock(hdev);
2271
2272 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2273 if (err < 0)
2274 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2275
2276 hci_dev_unlock(hdev);
2277
2278 return err;
2279 }
2280
2281 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2282 void *data, u16 len)
2283 {
2284 struct mgmt_cp_start_discovery *cp = data;
2285 struct pending_cmd *cmd;
2286 int err;
2287
2288 BT_DBG("%s", hdev->name);
2289
2290 hci_dev_lock(hdev);
2291
2292 if (!hdev_is_powered(hdev)) {
2293 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2294 MGMT_STATUS_NOT_POWERED);
2295 goto failed;
2296 }
2297
2298 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2299 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2300 MGMT_STATUS_BUSY);
2301 goto failed;
2302 }
2303
2304 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2305 if (!cmd) {
2306 err = -ENOMEM;
2307 goto failed;
2308 }
2309
2310 hdev->discovery.type = cp->type;
2311
2312 switch (hdev->discovery.type) {
2313 case DISCOV_TYPE_BREDR:
2314 if (lmp_bredr_capable(hdev))
2315 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2316 else
2317 err = -ENOTSUPP;
2318 break;
2319
2320 case DISCOV_TYPE_LE:
2321 if (lmp_host_le_capable(hdev))
2322 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2323 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2324 else
2325 err = -ENOTSUPP;
2326 break;
2327
2328 case DISCOV_TYPE_INTERLEAVED:
2329 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2330 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2331 LE_SCAN_WIN,
2332 LE_SCAN_TIMEOUT_BREDR_LE);
2333 else
2334 err = -ENOTSUPP;
2335 break;
2336
2337 default:
2338 err = -EINVAL;
2339 }
2340
2341 if (err < 0)
2342 mgmt_pending_remove(cmd);
2343 else
2344 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2345
2346 failed:
2347 hci_dev_unlock(hdev);
2348 return err;
2349 }
2350
2351 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2352 u16 len)
2353 {
2354 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2355 struct pending_cmd *cmd;
2356 struct hci_cp_remote_name_req_cancel cp;
2357 struct inquiry_entry *e;
2358 int err;
2359
2360 BT_DBG("%s", hdev->name);
2361
2362 hci_dev_lock(hdev);
2363
2364 if (!hci_discovery_active(hdev)) {
2365 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2366 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2367 sizeof(mgmt_cp->type));
2368 goto unlock;
2369 }
2370
2371 if (hdev->discovery.type != mgmt_cp->type) {
2372 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2373 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2374 sizeof(mgmt_cp->type));
2375 goto unlock;
2376 }
2377
2378 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2379 if (!cmd) {
2380 err = -ENOMEM;
2381 goto unlock;
2382 }
2383
2384 if (hdev->discovery.state == DISCOVERY_FINDING) {
2385 err = hci_cancel_inquiry(hdev);
2386 if (err < 0)
2387 mgmt_pending_remove(cmd);
2388 else
2389 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2390 goto unlock;
2391 }
2392
2393 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2394 if (!e) {
2395 mgmt_pending_remove(cmd);
2396 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
2397 &mgmt_cp->type, sizeof(mgmt_cp->type));
2398 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2399 goto unlock;
2400 }
2401
2402 bacpy(&cp.bdaddr, &e->data.bdaddr);
2403 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2404 &cp);
2405 if (err < 0)
2406 mgmt_pending_remove(cmd);
2407 else
2408 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2409
2410 unlock:
2411 hci_dev_unlock(hdev);
2412 return err;
2413 }
2414
2415 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2416 u16 len)
2417 {
2418 struct mgmt_cp_confirm_name *cp = data;
2419 struct inquiry_entry *e;
2420 int err;
2421
2422 BT_DBG("%s", hdev->name);
2423
2424 hci_dev_lock(hdev);
2425
2426 if (!hci_discovery_active(hdev)) {
2427 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2428 MGMT_STATUS_FAILED);
2429 goto failed;
2430 }
2431
2432 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2433 if (!e) {
2434 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2435 MGMT_STATUS_INVALID_PARAMS);
2436 goto failed;
2437 }
2438
2439 if (cp->name_known) {
2440 e->name_state = NAME_KNOWN;
2441 list_del(&e->list);
2442 } else {
2443 e->name_state = NAME_NEEDED;
2444 hci_inquiry_cache_update_resolve(hdev, e);
2445 }
2446
2447 err = 0;
2448
2449 failed:
2450 hci_dev_unlock(hdev);
2451 return err;
2452 }
2453
2454 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2455 u16 len)
2456 {
2457 struct mgmt_cp_block_device *cp = data;
2458 u8 status;
2459 int err;
2460
2461 BT_DBG("%s", hdev->name);
2462
2463 hci_dev_lock(hdev);
2464
2465 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2466 if (err < 0)
2467 status = MGMT_STATUS_FAILED;
2468 else
2469 status = 0;
2470
2471 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2472 &cp->addr, sizeof(cp->addr));
2473
2474 hci_dev_unlock(hdev);
2475
2476 return err;
2477 }
2478
2479 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2480 u16 len)
2481 {
2482 struct mgmt_cp_unblock_device *cp = data;
2483 u8 status;
2484 int err;
2485
2486 BT_DBG("%s", hdev->name);
2487
2488 hci_dev_lock(hdev);
2489
2490 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2491 if (err < 0)
2492 status = MGMT_STATUS_INVALID_PARAMS;
2493 else
2494 status = 0;
2495
2496 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2497 &cp->addr, sizeof(cp->addr));
2498
2499 hci_dev_unlock(hdev);
2500
2501 return err;
2502 }
2503
2504 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2505 void *data, u16 len)
2506 {
2507 struct mgmt_mode *cp = data;
2508 struct hci_cp_write_page_scan_activity acp;
2509 u8 type;
2510 int err;
2511
2512 BT_DBG("%s", hdev->name);
2513
2514 if (!hdev_is_powered(hdev))
2515 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2516 MGMT_STATUS_NOT_POWERED);
2517
2518 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2519 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2520 MGMT_STATUS_REJECTED);
2521
2522 hci_dev_lock(hdev);
2523
2524 if (cp->val) {
2525 type = PAGE_SCAN_TYPE_INTERLACED;
2526
2527 /* 22.5 msec page scan interval */
2528 acp.interval = __constant_cpu_to_le16(0x0024);
2529 } else {
2530 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2531
2532 /* default 1.28 sec page scan */
2533 acp.interval = __constant_cpu_to_le16(0x0800);
2534 }
2535
2536 /* default 11.25 msec page scan window */
2537 acp.window = __constant_cpu_to_le16(0x0012);
2538
2539 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2540 &acp);
2541 if (err < 0) {
2542 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2543 MGMT_STATUS_FAILED);
2544 goto done;
2545 }
2546
2547 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2548 if (err < 0) {
2549 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2550 MGMT_STATUS_FAILED);
2551 goto done;
2552 }
2553
2554 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2555 NULL, 0);
2556 done:
2557 hci_dev_unlock(hdev);
2558 return err;
2559 }
2560
2561 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2562 void *cp_data, u16 len)
2563 {
2564 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2565 u16 key_count, expected_len;
2566 int i;
2567
2568 key_count = get_unaligned_le16(&cp->key_count);
2569
2570 expected_len = sizeof(*cp) + key_count *
2571 sizeof(struct mgmt_ltk_info);
2572 if (expected_len != len) {
2573 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2574 len, expected_len);
2575 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2576 EINVAL);
2577 }
2578
2579 BT_DBG("%s key_count %u", hdev->name, key_count);
2580
2581 hci_dev_lock(hdev);
2582
2583 hci_smp_ltks_clear(hdev);
2584
2585 for (i = 0; i < key_count; i++) {
2586 struct mgmt_ltk_info *key = &cp->keys[i];
2587 u8 type;
2588
2589 if (key->master)
2590 type = HCI_SMP_LTK;
2591 else
2592 type = HCI_SMP_LTK_SLAVE;
2593
2594 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2595 type, 0, key->authenticated, key->val,
2596 key->enc_size, key->ediv, key->rand);
2597 }
2598
2599 hci_dev_unlock(hdev);
2600
2601 return 0;
2602 }
2603
2604 struct mgmt_handler {
2605 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2606 u16 data_len);
2607 bool var_len;
2608 size_t data_len;
2609 } mgmt_handlers[] = {
2610 { NULL }, /* 0x0000 (no command) */
2611 { read_version, false, MGMT_READ_VERSION_SIZE },
2612 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2613 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2614 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2615 { set_powered, false, MGMT_SETTING_SIZE },
2616 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2617 { set_connectable, false, MGMT_SETTING_SIZE },
2618 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2619 { set_pairable, false, MGMT_SETTING_SIZE },
2620 { set_link_security, false, MGMT_SETTING_SIZE },
2621 { set_ssp, false, MGMT_SETTING_SIZE },
2622 { set_hs, false, MGMT_SETTING_SIZE },
2623 { set_le, false, MGMT_SETTING_SIZE },
2624 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2625 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2626 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2627 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2628 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2629 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2630 { disconnect, false, MGMT_DISCONNECT_SIZE },
2631 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2632 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2633 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2634 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2635 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2636 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2637 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2638 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2639 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2640 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2641 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2642 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2643 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2644 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2645 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2646 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2647 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2648 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2649 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2650 };
2651
2652
2653 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2654 {
2655 void *buf;
2656 u8 *cp;
2657 struct mgmt_hdr *hdr;
2658 u16 opcode, index, len;
2659 struct hci_dev *hdev = NULL;
2660 struct mgmt_handler *handler;
2661 int err;
2662
2663 BT_DBG("got %zu bytes", msglen);
2664
2665 if (msglen < sizeof(*hdr))
2666 return -EINVAL;
2667
2668 buf = kmalloc(msglen, GFP_KERNEL);
2669 if (!buf)
2670 return -ENOMEM;
2671
2672 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2673 err = -EFAULT;
2674 goto done;
2675 }
2676
2677 hdr = buf;
2678 opcode = get_unaligned_le16(&hdr->opcode);
2679 index = get_unaligned_le16(&hdr->index);
2680 len = get_unaligned_le16(&hdr->len);
2681
2682 if (len != msglen - sizeof(*hdr)) {
2683 err = -EINVAL;
2684 goto done;
2685 }
2686
2687 if (index != MGMT_INDEX_NONE) {
2688 hdev = hci_dev_get(index);
2689 if (!hdev) {
2690 err = cmd_status(sk, index, opcode,
2691 MGMT_STATUS_INVALID_INDEX);
2692 goto done;
2693 }
2694 }
2695
2696 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2697 mgmt_handlers[opcode].func == NULL) {
2698 BT_DBG("Unknown op %u", opcode);
2699 err = cmd_status(sk, index, opcode,
2700 MGMT_STATUS_UNKNOWN_COMMAND);
2701 goto done;
2702 }
2703
2704 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2705 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2706 err = cmd_status(sk, index, opcode,
2707 MGMT_STATUS_INVALID_INDEX);
2708 goto done;
2709 }
2710
2711 handler = &mgmt_handlers[opcode];
2712
2713 if ((handler->var_len && len < handler->data_len) ||
2714 (!handler->var_len && len != handler->data_len)) {
2715 err = cmd_status(sk, index, opcode,
2716 MGMT_STATUS_INVALID_PARAMS);
2717 goto done;
2718 }
2719
2720 if (hdev)
2721 mgmt_init_hdev(sk, hdev);
2722
2723 cp = buf + sizeof(*hdr);
2724
2725 err = handler->func(sk, hdev, cp, len);
2726 if (err < 0)
2727 goto done;
2728
2729 err = msglen;
2730
2731 done:
2732 if (hdev)
2733 hci_dev_put(hdev);
2734
2735 kfree(buf);
2736 return err;
2737 }
2738
2739 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2740 {
2741 u8 *status = data;
2742
2743 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2744 mgmt_pending_remove(cmd);
2745 }
2746
2747 int mgmt_index_added(struct hci_dev *hdev)
2748 {
2749 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2750 }
2751
2752 int mgmt_index_removed(struct hci_dev *hdev)
2753 {
2754 u8 status = MGMT_STATUS_INVALID_INDEX;
2755
2756 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2757
2758 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2759 }
2760
2761 struct cmd_lookup {
2762 struct sock *sk;
2763 struct hci_dev *hdev;
2764 u8 mgmt_status;
2765 };
2766
2767 static void settings_rsp(struct pending_cmd *cmd, void *data)
2768 {
2769 struct cmd_lookup *match = data;
2770
2771 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2772
2773 list_del(&cmd->list);
2774
2775 if (match->sk == NULL) {
2776 match->sk = cmd->sk;
2777 sock_hold(match->sk);
2778 }
2779
2780 mgmt_pending_free(cmd);
2781 }
2782
2783 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2784 {
2785 struct cmd_lookup match = { NULL, hdev };
2786 int err;
2787
2788 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2789 return 0;
2790
2791 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2792
2793 if (powered) {
2794 u8 scan = 0;
2795
2796 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2797 scan |= SCAN_PAGE;
2798 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2799 scan |= SCAN_INQUIRY;
2800
2801 if (scan)
2802 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2803
2804 update_class(hdev);
2805 update_name(hdev, hdev->dev_name);
2806 update_eir(hdev);
2807 } else {
2808 u8 status = MGMT_STATUS_NOT_POWERED;
2809 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2810 }
2811
2812 err = new_settings(hdev, match.sk);
2813
2814 if (match.sk)
2815 sock_put(match.sk);
2816
2817 return err;
2818 }
2819
2820 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2821 {
2822 struct cmd_lookup match = { NULL, hdev };
2823 bool changed = false;
2824 int err = 0;
2825
2826 if (discoverable) {
2827 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2828 changed = true;
2829 } else {
2830 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2831 changed = true;
2832 }
2833
2834 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2835 &match);
2836
2837 if (changed)
2838 err = new_settings(hdev, match.sk);
2839
2840 if (match.sk)
2841 sock_put(match.sk);
2842
2843 return err;
2844 }
2845
2846 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2847 {
2848 struct cmd_lookup match = { NULL, hdev };
2849 bool changed = false;
2850 int err = 0;
2851
2852 if (connectable) {
2853 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2854 changed = true;
2855 } else {
2856 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2857 changed = true;
2858 }
2859
2860 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2861 &match);
2862
2863 if (changed)
2864 err = new_settings(hdev, match.sk);
2865
2866 if (match.sk)
2867 sock_put(match.sk);
2868
2869 return err;
2870 }
2871
2872 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2873 {
2874 u8 mgmt_err = mgmt_status(status);
2875
2876 if (scan & SCAN_PAGE)
2877 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2878 cmd_status_rsp, &mgmt_err);
2879
2880 if (scan & SCAN_INQUIRY)
2881 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2882 cmd_status_rsp, &mgmt_err);
2883
2884 return 0;
2885 }
2886
2887 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent)
2888 {
2889 struct mgmt_ev_new_link_key ev;
2890
2891 memset(&ev, 0, sizeof(ev));
2892
2893 ev.store_hint = persistent;
2894 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2895 ev.key.addr.type = MGMT_ADDR_BREDR;
2896 ev.key.type = key->type;
2897 memcpy(ev.key.val, key->val, 16);
2898 ev.key.pin_len = key->pin_len;
2899
2900 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2901 }
2902
2903 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2904 {
2905 struct mgmt_ev_new_long_term_key ev;
2906
2907 memset(&ev, 0, sizeof(ev));
2908
2909 ev.store_hint = persistent;
2910 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2911 ev.key.addr.type = key->bdaddr_type;
2912 ev.key.authenticated = key->authenticated;
2913 ev.key.enc_size = key->enc_size;
2914 ev.key.ediv = key->ediv;
2915
2916 if (key->type == HCI_SMP_LTK)
2917 ev.key.master = 1;
2918
2919 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2920 memcpy(ev.key.val, key->val, sizeof(key->val));
2921
2922 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2923 NULL);
2924 }
2925
2926 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2927 u8 addr_type, u32 flags, u8 *name, u8 name_len,
2928 u8 *dev_class)
2929 {
2930 char buf[512];
2931 struct mgmt_ev_device_connected *ev = (void *) buf;
2932 u16 eir_len = 0;
2933
2934 bacpy(&ev->addr.bdaddr, bdaddr);
2935 ev->addr.type = link_to_mgmt(link_type, addr_type);
2936
2937 ev->flags = __cpu_to_le32(flags);
2938
2939 if (name_len > 0)
2940 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
2941 name, name_len);
2942
2943 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2944 eir_len = eir_append_data(ev->eir, eir_len,
2945 EIR_CLASS_OF_DEV, dev_class, 3);
2946
2947 put_unaligned_le16(eir_len, &ev->eir_len);
2948
2949 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
2950 sizeof(*ev) + eir_len, NULL);
2951 }
2952
2953 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2954 {
2955 struct mgmt_cp_disconnect *cp = cmd->param;
2956 struct sock **sk = data;
2957 struct mgmt_rp_disconnect rp;
2958
2959 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2960 rp.addr.type = cp->addr.type;
2961
2962 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
2963 sizeof(rp));
2964
2965 *sk = cmd->sk;
2966 sock_hold(*sk);
2967
2968 mgmt_pending_remove(cmd);
2969 }
2970
2971 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
2972 {
2973 struct hci_dev *hdev = data;
2974 struct mgmt_cp_unpair_device *cp = cmd->param;
2975 struct mgmt_rp_unpair_device rp;
2976
2977 memset(&rp, 0, sizeof(rp));
2978 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2979 rp.addr.type = cp->addr.type;
2980
2981 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2982
2983 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
2984
2985 mgmt_pending_remove(cmd);
2986 }
2987
2988 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
2989 u8 link_type, u8 addr_type)
2990 {
2991 struct mgmt_addr_info ev;
2992 struct sock *sk = NULL;
2993 int err;
2994
2995 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
2996
2997 bacpy(&ev.bdaddr, bdaddr);
2998 ev.type = link_to_mgmt(link_type, addr_type);
2999
3000 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3001 sk);
3002
3003 if (sk)
3004 sock_put(sk);
3005
3006 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3007 hdev);
3008
3009 return err;
3010 }
3011
3012 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3013 u8 link_type, u8 addr_type, u8 status)
3014 {
3015 struct mgmt_rp_disconnect rp;
3016 struct pending_cmd *cmd;
3017 int err;
3018
3019 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3020 if (!cmd)
3021 return -ENOENT;
3022
3023 bacpy(&rp.addr.bdaddr, bdaddr);
3024 rp.addr.type = link_to_mgmt(link_type, addr_type);
3025
3026 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3027 mgmt_status(status), &rp, sizeof(rp));
3028
3029 mgmt_pending_remove(cmd);
3030
3031 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3032 hdev);
3033 return err;
3034 }
3035
3036 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3037 u8 addr_type, u8 status)
3038 {
3039 struct mgmt_ev_connect_failed ev;
3040
3041 bacpy(&ev.addr.bdaddr, bdaddr);
3042 ev.addr.type = link_to_mgmt(link_type, addr_type);
3043 ev.status = mgmt_status(status);
3044
3045 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3046 }
3047
3048 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3049 {
3050 struct mgmt_ev_pin_code_request ev;
3051
3052 bacpy(&ev.addr.bdaddr, bdaddr);
3053 ev.addr.type = MGMT_ADDR_BREDR;
3054 ev.secure = secure;
3055
3056 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3057 NULL);
3058 }
3059
3060 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3061 u8 status)
3062 {
3063 struct pending_cmd *cmd;
3064 struct mgmt_rp_pin_code_reply rp;
3065 int err;
3066
3067 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3068 if (!cmd)
3069 return -ENOENT;
3070
3071 bacpy(&rp.addr.bdaddr, bdaddr);
3072 rp.addr.type = MGMT_ADDR_BREDR;
3073
3074 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3075 mgmt_status(status), &rp, sizeof(rp));
3076
3077 mgmt_pending_remove(cmd);
3078
3079 return err;
3080 }
3081
3082 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3083 u8 status)
3084 {
3085 struct pending_cmd *cmd;
3086 struct mgmt_rp_pin_code_reply rp;
3087 int err;
3088
3089 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3090 if (!cmd)
3091 return -ENOENT;
3092
3093 bacpy(&rp.addr.bdaddr, bdaddr);
3094 rp.addr.type = MGMT_ADDR_BREDR;
3095
3096 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3097 mgmt_status(status), &rp, sizeof(rp));
3098
3099 mgmt_pending_remove(cmd);
3100
3101 return err;
3102 }
3103
3104 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3105 u8 link_type, u8 addr_type, __le32 value,
3106 u8 confirm_hint)
3107 {
3108 struct mgmt_ev_user_confirm_request ev;
3109
3110 BT_DBG("%s", hdev->name);
3111
3112 bacpy(&ev.addr.bdaddr, bdaddr);
3113 ev.addr.type = link_to_mgmt(link_type, addr_type);
3114 ev.confirm_hint = confirm_hint;
3115 put_unaligned_le32(value, &ev.value);
3116
3117 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3118 NULL);
3119 }
3120
3121 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3122 u8 link_type, u8 addr_type)
3123 {
3124 struct mgmt_ev_user_passkey_request ev;
3125
3126 BT_DBG("%s", hdev->name);
3127
3128 bacpy(&ev.addr.bdaddr, bdaddr);
3129 ev.addr.type = link_to_mgmt(link_type, addr_type);
3130
3131 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3132 NULL);
3133 }
3134
3135 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3136 u8 link_type, u8 addr_type, u8 status,
3137 u8 opcode)
3138 {
3139 struct pending_cmd *cmd;
3140 struct mgmt_rp_user_confirm_reply rp;
3141 int err;
3142
3143 cmd = mgmt_pending_find(opcode, hdev);
3144 if (!cmd)
3145 return -ENOENT;
3146
3147 bacpy(&rp.addr.bdaddr, bdaddr);
3148 rp.addr.type = link_to_mgmt(link_type, addr_type);
3149 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3150 &rp, sizeof(rp));
3151
3152 mgmt_pending_remove(cmd);
3153
3154 return err;
3155 }
3156
3157 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3158 u8 link_type, u8 addr_type, u8 status)
3159 {
3160 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3161 status, MGMT_OP_USER_CONFIRM_REPLY);
3162 }
3163
3164 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3165 u8 link_type, u8 addr_type, u8 status)
3166 {
3167 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3168 status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3169 }
3170
3171 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3172 u8 link_type, u8 addr_type, u8 status)
3173 {
3174 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3175 status, MGMT_OP_USER_PASSKEY_REPLY);
3176 }
3177
3178 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3179 u8 link_type, u8 addr_type, u8 status)
3180 {
3181 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3182 status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3183 }
3184
3185 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3186 u8 addr_type, u8 status)
3187 {
3188 struct mgmt_ev_auth_failed ev;
3189
3190 bacpy(&ev.addr.bdaddr, bdaddr);
3191 ev.addr.type = link_to_mgmt(link_type, addr_type);
3192 ev.status = mgmt_status(status);
3193
3194 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3195 }
3196
3197 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3198 {
3199 struct cmd_lookup match = { NULL, hdev };
3200 bool changed = false;
3201 int err = 0;
3202
3203 if (status) {
3204 u8 mgmt_err = mgmt_status(status);
3205 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3206 cmd_status_rsp, &mgmt_err);
3207 return 0;
3208 }
3209
3210 if (test_bit(HCI_AUTH, &hdev->flags)) {
3211 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3212 changed = true;
3213 } else {
3214 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3215 changed = true;
3216 }
3217
3218 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3219 &match);
3220
3221 if (changed)
3222 err = new_settings(hdev, match.sk);
3223
3224 if (match.sk)
3225 sock_put(match.sk);
3226
3227 return err;
3228 }
3229
3230 static int clear_eir(struct hci_dev *hdev)
3231 {
3232 struct hci_cp_write_eir cp;
3233
3234 if (!(hdev->features[6] & LMP_EXT_INQ))
3235 return 0;
3236
3237 memset(hdev->eir, 0, sizeof(hdev->eir));
3238
3239 memset(&cp, 0, sizeof(cp));
3240
3241 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3242 }
3243
3244 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3245 {
3246 struct cmd_lookup match = { NULL, hdev };
3247 bool changed = false;
3248 int err = 0;
3249
3250 if (status) {
3251 u8 mgmt_err = mgmt_status(status);
3252
3253 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3254 &hdev->dev_flags))
3255 err = new_settings(hdev, NULL);
3256
3257 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3258 &mgmt_err);
3259
3260 return err;
3261 }
3262
3263 if (enable) {
3264 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3265 changed = true;
3266 } else {
3267 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3268 changed = true;
3269 }
3270
3271 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3272
3273 if (changed)
3274 err = new_settings(hdev, match.sk);
3275
3276 if (match.sk)
3277 sock_put(match.sk);
3278
3279 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3280 update_eir(hdev);
3281 else
3282 clear_eir(hdev);
3283
3284 return err;
3285 }
3286
3287 static void class_rsp(struct pending_cmd *cmd, void *data)
3288 {
3289 struct cmd_lookup *match = data;
3290
3291 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3292 match->hdev->dev_class, 3);
3293
3294 list_del(&cmd->list);
3295
3296 if (match->sk == NULL) {
3297 match->sk = cmd->sk;
3298 sock_hold(match->sk);
3299 }
3300
3301 mgmt_pending_free(cmd);
3302 }
3303
3304 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3305 u8 status)
3306 {
3307 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3308 int err = 0;
3309
3310 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3311
3312 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3313 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3314 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3315
3316 if (!status)
3317 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3318 3, NULL);
3319
3320 if (match.sk)
3321 sock_put(match.sk);
3322
3323 return err;
3324 }
3325
3326 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3327 {
3328 struct pending_cmd *cmd;
3329 struct mgmt_cp_set_local_name ev;
3330 bool changed = false;
3331 int err = 0;
3332
3333 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3334 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3335 changed = true;
3336 }
3337
3338 memset(&ev, 0, sizeof(ev));
3339 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3340 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3341
3342 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3343 if (!cmd)
3344 goto send_event;
3345
3346 /* Always assume that either the short or the complete name has
3347 * changed if there was a pending mgmt command */
3348 changed = true;
3349
3350 if (status) {
3351 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3352 mgmt_status(status));
3353 goto failed;
3354 }
3355
3356 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3357 sizeof(ev));
3358 if (err < 0)
3359 goto failed;
3360
3361 send_event:
3362 if (changed)
3363 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3364 sizeof(ev), cmd ? cmd->sk : NULL);
3365
3366 update_eir(hdev);
3367
3368 failed:
3369 if (cmd)
3370 mgmt_pending_remove(cmd);
3371 return err;
3372 }
3373
3374 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3375 u8 *randomizer, u8 status)
3376 {
3377 struct pending_cmd *cmd;
3378 int err;
3379
3380 BT_DBG("%s status %u", hdev->name, status);
3381
3382 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3383 if (!cmd)
3384 return -ENOENT;
3385
3386 if (status) {
3387 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3388 mgmt_status(status));
3389 } else {
3390 struct mgmt_rp_read_local_oob_data rp;
3391
3392 memcpy(rp.hash, hash, sizeof(rp.hash));
3393 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3394
3395 err = cmd_complete(cmd->sk, hdev->id,
3396 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3397 sizeof(rp));
3398 }
3399
3400 mgmt_pending_remove(cmd);
3401
3402 return err;
3403 }
3404
3405 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3406 {
3407 struct cmd_lookup match = { NULL, hdev };
3408 bool changed = false;
3409 int err = 0;
3410
3411 if (status) {
3412 u8 mgmt_err = mgmt_status(status);
3413
3414 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3415 &hdev->dev_flags))
3416 err = new_settings(hdev, NULL);
3417
3418 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev,
3419 cmd_status_rsp, &mgmt_err);
3420
3421 return err;
3422 }
3423
3424 if (enable) {
3425 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3426 changed = true;
3427 } else {
3428 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3429 changed = true;
3430 }
3431
3432 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3433
3434 if (changed)
3435 err = new_settings(hdev, match.sk);
3436
3437 if (match.sk)
3438 sock_put(match.sk);
3439
3440 return err;
3441 }
3442
3443 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3444 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3445 ssp, u8 *eir, u16 eir_len)
3446 {
3447 char buf[512];
3448 struct mgmt_ev_device_found *ev = (void *) buf;
3449 size_t ev_size;
3450
3451 /* Leave 5 bytes for a potential CoD field */
3452 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3453 return -EINVAL;
3454
3455 memset(buf, 0, sizeof(buf));
3456
3457 bacpy(&ev->addr.bdaddr, bdaddr);
3458 ev->addr.type = link_to_mgmt(link_type, addr_type);
3459 ev->rssi = rssi;
3460 if (cfm_name)
3461 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3462 if (!ssp)
3463 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3464
3465 if (eir_len > 0)
3466 memcpy(ev->eir, eir, eir_len);
3467
3468 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3469 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3470 dev_class, 3);
3471
3472 put_unaligned_le16(eir_len, &ev->eir_len);
3473
3474 ev_size = sizeof(*ev) + eir_len;
3475
3476 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3477 }
3478
3479 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3480 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3481 {
3482 struct mgmt_ev_device_found *ev;
3483 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3484 u16 eir_len;
3485
3486 ev = (struct mgmt_ev_device_found *) buf;
3487
3488 memset(buf, 0, sizeof(buf));
3489
3490 bacpy(&ev->addr.bdaddr, bdaddr);
3491 ev->addr.type = link_to_mgmt(link_type, addr_type);
3492 ev->rssi = rssi;
3493
3494 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3495 name_len);
3496
3497 put_unaligned_le16(eir_len, &ev->eir_len);
3498
3499 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3500 sizeof(*ev) + eir_len, NULL);
3501 }
3502
3503 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3504 {
3505 struct pending_cmd *cmd;
3506 u8 type;
3507 int err;
3508
3509 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3510
3511 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3512 if (!cmd)
3513 return -ENOENT;
3514
3515 type = hdev->discovery.type;
3516
3517 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3518 &type, sizeof(type));
3519 mgmt_pending_remove(cmd);
3520
3521 return err;
3522 }
3523
3524 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3525 {
3526 struct pending_cmd *cmd;
3527 int err;
3528
3529 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3530 if (!cmd)
3531 return -ENOENT;
3532
3533 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3534 &hdev->discovery.type, sizeof(hdev->discovery.type));
3535 mgmt_pending_remove(cmd);
3536
3537 return err;
3538 }
3539
3540 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3541 {
3542 struct mgmt_ev_discovering ev;
3543 struct pending_cmd *cmd;
3544
3545 BT_DBG("%s discovering %u", hdev->name, discovering);
3546
3547 if (discovering)
3548 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3549 else
3550 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3551
3552 if (cmd != NULL) {
3553 u8 type = hdev->discovery.type;
3554
3555 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3556 sizeof(type));
3557 mgmt_pending_remove(cmd);
3558 }
3559
3560 memset(&ev, 0, sizeof(ev));
3561 ev.type = hdev->discovery.type;
3562 ev.discovering = discovering;
3563
3564 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3565 }
3566
3567 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3568 {
3569 struct pending_cmd *cmd;
3570 struct mgmt_ev_device_blocked ev;
3571
3572 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3573
3574 bacpy(&ev.addr.bdaddr, bdaddr);
3575 ev.addr.type = type;
3576
3577 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3578 cmd ? cmd->sk : NULL);
3579 }
3580
3581 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3582 {
3583 struct pending_cmd *cmd;
3584 struct mgmt_ev_device_unblocked ev;
3585
3586 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3587
3588 bacpy(&ev.addr.bdaddr, bdaddr);
3589 ev.addr.type = type;
3590
3591 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3592 cmd ? cmd->sk : NULL);
3593 }
3594
3595 module_param(enable_hs, bool, 0644);
3596 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3597
3598 module_param(enable_le, bool, 0644);
3599 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");
ubuntu-zesty-kernel mirror