]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/mgmt.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Bluetooth: Update start_discovery to use HCI request
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/mgmt.h>
33 #include <net/bluetooth/smp.h>
34
35 bool enable_hs;
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 3
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 };
80
81 static const u16 mgmt_events[] = {
82 MGMT_EV_CONTROLLER_ERROR,
83 MGMT_EV_INDEX_ADDED,
84 MGMT_EV_INDEX_REMOVED,
85 MGMT_EV_NEW_SETTINGS,
86 MGMT_EV_CLASS_OF_DEV_CHANGED,
87 MGMT_EV_LOCAL_NAME_CHANGED,
88 MGMT_EV_NEW_LINK_KEY,
89 MGMT_EV_NEW_LONG_TERM_KEY,
90 MGMT_EV_DEVICE_CONNECTED,
91 MGMT_EV_DEVICE_DISCONNECTED,
92 MGMT_EV_CONNECT_FAILED,
93 MGMT_EV_PIN_CODE_REQUEST,
94 MGMT_EV_USER_CONFIRM_REQUEST,
95 MGMT_EV_USER_PASSKEY_REQUEST,
96 MGMT_EV_AUTH_FAILED,
97 MGMT_EV_DEVICE_FOUND,
98 MGMT_EV_DISCOVERING,
99 MGMT_EV_DEVICE_BLOCKED,
100 MGMT_EV_DEVICE_UNBLOCKED,
101 MGMT_EV_DEVICE_UNPAIRED,
102 MGMT_EV_PASSKEY_NOTIFY,
103 };
104
105 /*
106 * These LE scan and inquiry parameters were chosen according to LE General
107 * Discovery Procedure specification.
108 */
109 #define LE_SCAN_WIN 0x12
110 #define LE_SCAN_INT 0x12
111 #define LE_SCAN_TIMEOUT_LE_ONLY msecs_to_jiffies(10240)
112 #define LE_SCAN_TIMEOUT_BREDR_LE msecs_to_jiffies(5120)
113
114 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
115 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
116
117 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
118
119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
120 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
121
122 struct pending_cmd {
123 struct list_head list;
124 u16 opcode;
125 int index;
126 void *param;
127 struct sock *sk;
128 void *user_data;
129 };
130
131 /* HCI to MGMT error code conversion table */
132 static u8 mgmt_status_table[] = {
133 MGMT_STATUS_SUCCESS,
134 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
135 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
136 MGMT_STATUS_FAILED, /* Hardware Failure */
137 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
138 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
139 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
140 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
141 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
142 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
143 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
144 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
145 MGMT_STATUS_BUSY, /* Command Disallowed */
146 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
147 MGMT_STATUS_REJECTED, /* Rejected Security */
148 MGMT_STATUS_REJECTED, /* Rejected Personal */
149 MGMT_STATUS_TIMEOUT, /* Host Timeout */
150 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
151 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
152 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
153 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
154 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
155 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
156 MGMT_STATUS_BUSY, /* Repeated Attempts */
157 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
158 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
159 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
160 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
161 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
162 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
163 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
164 MGMT_STATUS_FAILED, /* Unspecified Error */
165 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
166 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
167 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
168 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
169 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
170 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
171 MGMT_STATUS_FAILED, /* Unit Link Key Used */
172 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
173 MGMT_STATUS_TIMEOUT, /* Instant Passed */
174 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
175 MGMT_STATUS_FAILED, /* Transaction Collision */
176 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
177 MGMT_STATUS_REJECTED, /* QoS Rejected */
178 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
179 MGMT_STATUS_REJECTED, /* Insufficient Security */
180 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
181 MGMT_STATUS_BUSY, /* Role Switch Pending */
182 MGMT_STATUS_FAILED, /* Slot Violation */
183 MGMT_STATUS_FAILED, /* Role Switch Failed */
184 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
185 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
186 MGMT_STATUS_BUSY, /* Host Busy Pairing */
187 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
188 MGMT_STATUS_BUSY, /* Controller Busy */
189 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
190 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
191 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
192 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
193 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
194 };
195
196 bool mgmt_valid_hdev(struct hci_dev *hdev)
197 {
198 return hdev->dev_type == HCI_BREDR;
199 }
200
201 static u8 mgmt_status(u8 hci_status)
202 {
203 if (hci_status < ARRAY_SIZE(mgmt_status_table))
204 return mgmt_status_table[hci_status];
205
206 return MGMT_STATUS_FAILED;
207 }
208
209 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
210 {
211 struct sk_buff *skb;
212 struct mgmt_hdr *hdr;
213 struct mgmt_ev_cmd_status *ev;
214 int err;
215
216 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
217
218 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
219 if (!skb)
220 return -ENOMEM;
221
222 hdr = (void *) skb_put(skb, sizeof(*hdr));
223
224 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
225 hdr->index = cpu_to_le16(index);
226 hdr->len = cpu_to_le16(sizeof(*ev));
227
228 ev = (void *) skb_put(skb, sizeof(*ev));
229 ev->status = status;
230 ev->opcode = cpu_to_le16(cmd);
231
232 err = sock_queue_rcv_skb(sk, skb);
233 if (err < 0)
234 kfree_skb(skb);
235
236 return err;
237 }
238
239 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
240 void *rp, size_t rp_len)
241 {
242 struct sk_buff *skb;
243 struct mgmt_hdr *hdr;
244 struct mgmt_ev_cmd_complete *ev;
245 int err;
246
247 BT_DBG("sock %p", sk);
248
249 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
250 if (!skb)
251 return -ENOMEM;
252
253 hdr = (void *) skb_put(skb, sizeof(*hdr));
254
255 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
256 hdr->index = cpu_to_le16(index);
257 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
258
259 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
260 ev->opcode = cpu_to_le16(cmd);
261 ev->status = status;
262
263 if (rp)
264 memcpy(ev->data, rp, rp_len);
265
266 err = sock_queue_rcv_skb(sk, skb);
267 if (err < 0)
268 kfree_skb(skb);
269
270 return err;
271 }
272
273 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
274 u16 data_len)
275 {
276 struct mgmt_rp_read_version rp;
277
278 BT_DBG("sock %p", sk);
279
280 rp.version = MGMT_VERSION;
281 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
282
283 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
284 sizeof(rp));
285 }
286
287 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
288 u16 data_len)
289 {
290 struct mgmt_rp_read_commands *rp;
291 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
292 const u16 num_events = ARRAY_SIZE(mgmt_events);
293 __le16 *opcode;
294 size_t rp_size;
295 int i, err;
296
297 BT_DBG("sock %p", sk);
298
299 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
300
301 rp = kmalloc(rp_size, GFP_KERNEL);
302 if (!rp)
303 return -ENOMEM;
304
305 rp->num_commands = __constant_cpu_to_le16(num_commands);
306 rp->num_events = __constant_cpu_to_le16(num_events);
307
308 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
309 put_unaligned_le16(mgmt_commands[i], opcode);
310
311 for (i = 0; i < num_events; i++, opcode++)
312 put_unaligned_le16(mgmt_events[i], opcode);
313
314 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
315 rp_size);
316 kfree(rp);
317
318 return err;
319 }
320
321 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
322 u16 data_len)
323 {
324 struct mgmt_rp_read_index_list *rp;
325 struct hci_dev *d;
326 size_t rp_len;
327 u16 count;
328 int err;
329
330 BT_DBG("sock %p", sk);
331
332 read_lock(&hci_dev_list_lock);
333
334 count = 0;
335 list_for_each_entry(d, &hci_dev_list, list) {
336 if (!mgmt_valid_hdev(d))
337 continue;
338
339 count++;
340 }
341
342 rp_len = sizeof(*rp) + (2 * count);
343 rp = kmalloc(rp_len, GFP_ATOMIC);
344 if (!rp) {
345 read_unlock(&hci_dev_list_lock);
346 return -ENOMEM;
347 }
348
349 count = 0;
350 list_for_each_entry(d, &hci_dev_list, list) {
351 if (test_bit(HCI_SETUP, &d->dev_flags))
352 continue;
353
354 if (!mgmt_valid_hdev(d))
355 continue;
356
357 rp->index[count++] = cpu_to_le16(d->id);
358 BT_DBG("Added hci%u", d->id);
359 }
360
361 rp->num_controllers = cpu_to_le16(count);
362 rp_len = sizeof(*rp) + (2 * count);
363
364 read_unlock(&hci_dev_list_lock);
365
366 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
367 rp_len);
368
369 kfree(rp);
370
371 return err;
372 }
373
374 static u32 get_supported_settings(struct hci_dev *hdev)
375 {
376 u32 settings = 0;
377
378 settings |= MGMT_SETTING_POWERED;
379 settings |= MGMT_SETTING_PAIRABLE;
380
381 if (lmp_ssp_capable(hdev))
382 settings |= MGMT_SETTING_SSP;
383
384 if (lmp_bredr_capable(hdev)) {
385 settings |= MGMT_SETTING_CONNECTABLE;
386 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
387 settings |= MGMT_SETTING_FAST_CONNECTABLE;
388 settings |= MGMT_SETTING_DISCOVERABLE;
389 settings |= MGMT_SETTING_BREDR;
390 settings |= MGMT_SETTING_LINK_SECURITY;
391 }
392
393 if (enable_hs)
394 settings |= MGMT_SETTING_HS;
395
396 if (lmp_le_capable(hdev))
397 settings |= MGMT_SETTING_LE;
398
399 return settings;
400 }
401
402 static u32 get_current_settings(struct hci_dev *hdev)
403 {
404 u32 settings = 0;
405
406 if (hdev_is_powered(hdev))
407 settings |= MGMT_SETTING_POWERED;
408
409 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
410 settings |= MGMT_SETTING_CONNECTABLE;
411
412 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
413 settings |= MGMT_SETTING_FAST_CONNECTABLE;
414
415 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
416 settings |= MGMT_SETTING_DISCOVERABLE;
417
418 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
419 settings |= MGMT_SETTING_PAIRABLE;
420
421 if (lmp_bredr_capable(hdev))
422 settings |= MGMT_SETTING_BREDR;
423
424 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
425 settings |= MGMT_SETTING_LE;
426
427 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
428 settings |= MGMT_SETTING_LINK_SECURITY;
429
430 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
431 settings |= MGMT_SETTING_SSP;
432
433 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
434 settings |= MGMT_SETTING_HS;
435
436 return settings;
437 }
438
439 #define PNP_INFO_SVCLASS_ID 0x1200
440
441 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
442 {
443 u8 *ptr = data, *uuids_start = NULL;
444 struct bt_uuid *uuid;
445
446 if (len < 4)
447 return ptr;
448
449 list_for_each_entry(uuid, &hdev->uuids, list) {
450 u16 uuid16;
451
452 if (uuid->size != 16)
453 continue;
454
455 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
456 if (uuid16 < 0x1100)
457 continue;
458
459 if (uuid16 == PNP_INFO_SVCLASS_ID)
460 continue;
461
462 if (!uuids_start) {
463 uuids_start = ptr;
464 uuids_start[0] = 1;
465 uuids_start[1] = EIR_UUID16_ALL;
466 ptr += 2;
467 }
468
469 /* Stop if not enough space to put next UUID */
470 if ((ptr - data) + sizeof(u16) > len) {
471 uuids_start[1] = EIR_UUID16_SOME;
472 break;
473 }
474
475 *ptr++ = (uuid16 & 0x00ff);
476 *ptr++ = (uuid16 & 0xff00) >> 8;
477 uuids_start[0] += sizeof(uuid16);
478 }
479
480 return ptr;
481 }
482
483 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
484 {
485 u8 *ptr = data, *uuids_start = NULL;
486 struct bt_uuid *uuid;
487
488 if (len < 6)
489 return ptr;
490
491 list_for_each_entry(uuid, &hdev->uuids, list) {
492 if (uuid->size != 32)
493 continue;
494
495 if (!uuids_start) {
496 uuids_start = ptr;
497 uuids_start[0] = 1;
498 uuids_start[1] = EIR_UUID32_ALL;
499 ptr += 2;
500 }
501
502 /* Stop if not enough space to put next UUID */
503 if ((ptr - data) + sizeof(u32) > len) {
504 uuids_start[1] = EIR_UUID32_SOME;
505 break;
506 }
507
508 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
509 ptr += sizeof(u32);
510 uuids_start[0] += sizeof(u32);
511 }
512
513 return ptr;
514 }
515
516 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
517 {
518 u8 *ptr = data, *uuids_start = NULL;
519 struct bt_uuid *uuid;
520
521 if (len < 18)
522 return ptr;
523
524 list_for_each_entry(uuid, &hdev->uuids, list) {
525 if (uuid->size != 128)
526 continue;
527
528 if (!uuids_start) {
529 uuids_start = ptr;
530 uuids_start[0] = 1;
531 uuids_start[1] = EIR_UUID128_ALL;
532 ptr += 2;
533 }
534
535 /* Stop if not enough space to put next UUID */
536 if ((ptr - data) + 16 > len) {
537 uuids_start[1] = EIR_UUID128_SOME;
538 break;
539 }
540
541 memcpy(ptr, uuid->uuid, 16);
542 ptr += 16;
543 uuids_start[0] += 16;
544 }
545
546 return ptr;
547 }
548
549 static void create_eir(struct hci_dev *hdev, u8 *data)
550 {
551 u8 *ptr = data;
552 size_t name_len;
553
554 name_len = strlen(hdev->dev_name);
555
556 if (name_len > 0) {
557 /* EIR Data type */
558 if (name_len > 48) {
559 name_len = 48;
560 ptr[1] = EIR_NAME_SHORT;
561 } else
562 ptr[1] = EIR_NAME_COMPLETE;
563
564 /* EIR Data length */
565 ptr[0] = name_len + 1;
566
567 memcpy(ptr + 2, hdev->dev_name, name_len);
568
569 ptr += (name_len + 2);
570 }
571
572 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
573 ptr[0] = 2;
574 ptr[1] = EIR_TX_POWER;
575 ptr[2] = (u8) hdev->inq_tx_power;
576
577 ptr += 3;
578 }
579
580 if (hdev->devid_source > 0) {
581 ptr[0] = 9;
582 ptr[1] = EIR_DEVICE_ID;
583
584 put_unaligned_le16(hdev->devid_source, ptr + 2);
585 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
586 put_unaligned_le16(hdev->devid_product, ptr + 6);
587 put_unaligned_le16(hdev->devid_version, ptr + 8);
588
589 ptr += 10;
590 }
591
592 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
593 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
594 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
595 }
596
597 static void update_eir(struct hci_request *req)
598 {
599 struct hci_dev *hdev = req->hdev;
600 struct hci_cp_write_eir cp;
601
602 if (!hdev_is_powered(hdev))
603 return;
604
605 if (!lmp_ext_inq_capable(hdev))
606 return;
607
608 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
609 return;
610
611 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
612 return;
613
614 memset(&cp, 0, sizeof(cp));
615
616 create_eir(hdev, cp.data);
617
618 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
619 return;
620
621 memcpy(hdev->eir, cp.data, sizeof(cp.data));
622
623 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
624 }
625
626 static u8 get_service_classes(struct hci_dev *hdev)
627 {
628 struct bt_uuid *uuid;
629 u8 val = 0;
630
631 list_for_each_entry(uuid, &hdev->uuids, list)
632 val |= uuid->svc_hint;
633
634 return val;
635 }
636
637 static void update_class(struct hci_request *req)
638 {
639 struct hci_dev *hdev = req->hdev;
640 u8 cod[3];
641
642 BT_DBG("%s", hdev->name);
643
644 if (!hdev_is_powered(hdev))
645 return;
646
647 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
648 return;
649
650 cod[0] = hdev->minor_class;
651 cod[1] = hdev->major_class;
652 cod[2] = get_service_classes(hdev);
653
654 if (memcmp(cod, hdev->dev_class, 3) == 0)
655 return;
656
657 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
658 }
659
660 static void service_cache_off(struct work_struct *work)
661 {
662 struct hci_dev *hdev = container_of(work, struct hci_dev,
663 service_cache.work);
664 struct hci_request req;
665
666 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
667 return;
668
669 hci_req_init(&req, hdev);
670
671 hci_dev_lock(hdev);
672
673 update_eir(&req);
674 update_class(&req);
675
676 hci_dev_unlock(hdev);
677
678 hci_req_run(&req, NULL);
679 }
680
681 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
682 {
683 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
684 return;
685
686 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
687
688 /* Non-mgmt controlled devices get this bit set
689 * implicitly so that pairing works for them, however
690 * for mgmt we require user-space to explicitly enable
691 * it
692 */
693 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
694 }
695
696 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
697 void *data, u16 data_len)
698 {
699 struct mgmt_rp_read_info rp;
700
701 BT_DBG("sock %p %s", sk, hdev->name);
702
703 hci_dev_lock(hdev);
704
705 memset(&rp, 0, sizeof(rp));
706
707 bacpy(&rp.bdaddr, &hdev->bdaddr);
708
709 rp.version = hdev->hci_ver;
710 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
711
712 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
713 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
714
715 memcpy(rp.dev_class, hdev->dev_class, 3);
716
717 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
718 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
719
720 hci_dev_unlock(hdev);
721
722 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
723 sizeof(rp));
724 }
725
726 static void mgmt_pending_free(struct pending_cmd *cmd)
727 {
728 sock_put(cmd->sk);
729 kfree(cmd->param);
730 kfree(cmd);
731 }
732
733 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
734 struct hci_dev *hdev, void *data,
735 u16 len)
736 {
737 struct pending_cmd *cmd;
738
739 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
740 if (!cmd)
741 return NULL;
742
743 cmd->opcode = opcode;
744 cmd->index = hdev->id;
745
746 cmd->param = kmalloc(len, GFP_KERNEL);
747 if (!cmd->param) {
748 kfree(cmd);
749 return NULL;
750 }
751
752 if (data)
753 memcpy(cmd->param, data, len);
754
755 cmd->sk = sk;
756 sock_hold(sk);
757
758 list_add(&cmd->list, &hdev->mgmt_pending);
759
760 return cmd;
761 }
762
763 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
764 void (*cb)(struct pending_cmd *cmd,
765 void *data),
766 void *data)
767 {
768 struct pending_cmd *cmd, *tmp;
769
770 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
771 if (opcode > 0 && cmd->opcode != opcode)
772 continue;
773
774 cb(cmd, data);
775 }
776 }
777
778 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
779 {
780 struct pending_cmd *cmd;
781
782 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
783 if (cmd->opcode == opcode)
784 return cmd;
785 }
786
787 return NULL;
788 }
789
790 static void mgmt_pending_remove(struct pending_cmd *cmd)
791 {
792 list_del(&cmd->list);
793 mgmt_pending_free(cmd);
794 }
795
796 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
797 {
798 __le32 settings = cpu_to_le32(get_current_settings(hdev));
799
800 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
801 sizeof(settings));
802 }
803
804 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
805 u16 len)
806 {
807 struct mgmt_mode *cp = data;
808 struct pending_cmd *cmd;
809 int err;
810
811 BT_DBG("request for %s", hdev->name);
812
813 if (cp->val != 0x00 && cp->val != 0x01)
814 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
815 MGMT_STATUS_INVALID_PARAMS);
816
817 hci_dev_lock(hdev);
818
819 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
820 cancel_delayed_work(&hdev->power_off);
821
822 if (cp->val) {
823 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
824 data, len);
825 err = mgmt_powered(hdev, 1);
826 goto failed;
827 }
828 }
829
830 if (!!cp->val == hdev_is_powered(hdev)) {
831 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
832 goto failed;
833 }
834
835 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
836 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
837 MGMT_STATUS_BUSY);
838 goto failed;
839 }
840
841 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
842 if (!cmd) {
843 err = -ENOMEM;
844 goto failed;
845 }
846
847 if (cp->val)
848 queue_work(hdev->req_workqueue, &hdev->power_on);
849 else
850 queue_work(hdev->req_workqueue, &hdev->power_off.work);
851
852 err = 0;
853
854 failed:
855 hci_dev_unlock(hdev);
856 return err;
857 }
858
859 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
860 struct sock *skip_sk)
861 {
862 struct sk_buff *skb;
863 struct mgmt_hdr *hdr;
864
865 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
866 if (!skb)
867 return -ENOMEM;
868
869 hdr = (void *) skb_put(skb, sizeof(*hdr));
870 hdr->opcode = cpu_to_le16(event);
871 if (hdev)
872 hdr->index = cpu_to_le16(hdev->id);
873 else
874 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
875 hdr->len = cpu_to_le16(data_len);
876
877 if (data)
878 memcpy(skb_put(skb, data_len), data, data_len);
879
880 /* Time stamp */
881 __net_timestamp(skb);
882
883 hci_send_to_control(skb, skip_sk);
884 kfree_skb(skb);
885
886 return 0;
887 }
888
889 static int new_settings(struct hci_dev *hdev, struct sock *skip)
890 {
891 __le32 ev;
892
893 ev = cpu_to_le32(get_current_settings(hdev));
894
895 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
896 }
897
898 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
899 u16 len)
900 {
901 struct mgmt_cp_set_discoverable *cp = data;
902 struct pending_cmd *cmd;
903 u16 timeout;
904 u8 scan;
905 int err;
906
907 BT_DBG("request for %s", hdev->name);
908
909 if (!lmp_bredr_capable(hdev))
910 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
911 MGMT_STATUS_NOT_SUPPORTED);
912
913 if (cp->val != 0x00 && cp->val != 0x01)
914 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
915 MGMT_STATUS_INVALID_PARAMS);
916
917 timeout = __le16_to_cpu(cp->timeout);
918 if (!cp->val && timeout > 0)
919 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
920 MGMT_STATUS_INVALID_PARAMS);
921
922 hci_dev_lock(hdev);
923
924 if (!hdev_is_powered(hdev) && timeout > 0) {
925 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
926 MGMT_STATUS_NOT_POWERED);
927 goto failed;
928 }
929
930 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
931 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
932 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
933 MGMT_STATUS_BUSY);
934 goto failed;
935 }
936
937 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
938 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
939 MGMT_STATUS_REJECTED);
940 goto failed;
941 }
942
943 if (!hdev_is_powered(hdev)) {
944 bool changed = false;
945
946 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
947 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
948 changed = true;
949 }
950
951 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
952 if (err < 0)
953 goto failed;
954
955 if (changed)
956 err = new_settings(hdev, sk);
957
958 goto failed;
959 }
960
961 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
962 if (hdev->discov_timeout > 0) {
963 cancel_delayed_work(&hdev->discov_off);
964 hdev->discov_timeout = 0;
965 }
966
967 if (cp->val && timeout > 0) {
968 hdev->discov_timeout = timeout;
969 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
970 msecs_to_jiffies(hdev->discov_timeout * 1000));
971 }
972
973 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
974 goto failed;
975 }
976
977 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
978 if (!cmd) {
979 err = -ENOMEM;
980 goto failed;
981 }
982
983 scan = SCAN_PAGE;
984
985 if (cp->val)
986 scan |= SCAN_INQUIRY;
987 else
988 cancel_delayed_work(&hdev->discov_off);
989
990 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
991 if (err < 0)
992 mgmt_pending_remove(cmd);
993
994 if (cp->val)
995 hdev->discov_timeout = timeout;
996
997 failed:
998 hci_dev_unlock(hdev);
999 return err;
1000 }
1001
1002 static void write_fast_connectable(struct hci_request *req, bool enable)
1003 {
1004 struct hci_dev *hdev = req->hdev;
1005 struct hci_cp_write_page_scan_activity acp;
1006 u8 type;
1007
1008 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1009 return;
1010
1011 if (enable) {
1012 type = PAGE_SCAN_TYPE_INTERLACED;
1013
1014 /* 160 msec page scan interval */
1015 acp.interval = __constant_cpu_to_le16(0x0100);
1016 } else {
1017 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1018
1019 /* default 1.28 sec page scan */
1020 acp.interval = __constant_cpu_to_le16(0x0800);
1021 }
1022
1023 acp.window = __constant_cpu_to_le16(0x0012);
1024
1025 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1026 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1027 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1028 sizeof(acp), &acp);
1029
1030 if (hdev->page_scan_type != type)
1031 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1032 }
1033
1034 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1035 {
1036 struct pending_cmd *cmd;
1037
1038 BT_DBG("status 0x%02x", status);
1039
1040 hci_dev_lock(hdev);
1041
1042 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1043 if (!cmd)
1044 goto unlock;
1045
1046 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1047
1048 mgmt_pending_remove(cmd);
1049
1050 unlock:
1051 hci_dev_unlock(hdev);
1052 }
1053
1054 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1055 u16 len)
1056 {
1057 struct mgmt_mode *cp = data;
1058 struct pending_cmd *cmd;
1059 struct hci_request req;
1060 u8 scan;
1061 int err;
1062
1063 BT_DBG("request for %s", hdev->name);
1064
1065 if (!lmp_bredr_capable(hdev))
1066 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1067 MGMT_STATUS_NOT_SUPPORTED);
1068
1069 if (cp->val != 0x00 && cp->val != 0x01)
1070 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1071 MGMT_STATUS_INVALID_PARAMS);
1072
1073 hci_dev_lock(hdev);
1074
1075 if (!hdev_is_powered(hdev)) {
1076 bool changed = false;
1077
1078 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1079 changed = true;
1080
1081 if (cp->val) {
1082 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1083 } else {
1084 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1085 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1086 }
1087
1088 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1089 if (err < 0)
1090 goto failed;
1091
1092 if (changed)
1093 err = new_settings(hdev, sk);
1094
1095 goto failed;
1096 }
1097
1098 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1099 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1100 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1101 MGMT_STATUS_BUSY);
1102 goto failed;
1103 }
1104
1105 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1106 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1107 goto failed;
1108 }
1109
1110 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1111 if (!cmd) {
1112 err = -ENOMEM;
1113 goto failed;
1114 }
1115
1116 if (cp->val) {
1117 scan = SCAN_PAGE;
1118 } else {
1119 scan = 0;
1120
1121 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1122 hdev->discov_timeout > 0)
1123 cancel_delayed_work(&hdev->discov_off);
1124 }
1125
1126 hci_req_init(&req, hdev);
1127
1128 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1129
1130 /* If we're going from non-connectable to connectable or
1131 * vice-versa when fast connectable is enabled ensure that fast
1132 * connectable gets disabled. write_fast_connectable won't do
1133 * anything if the page scan parameters are already what they
1134 * should be.
1135 */
1136 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1137 write_fast_connectable(&req, false);
1138
1139 err = hci_req_run(&req, set_connectable_complete);
1140 if (err < 0)
1141 mgmt_pending_remove(cmd);
1142
1143 failed:
1144 hci_dev_unlock(hdev);
1145 return err;
1146 }
1147
1148 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1149 u16 len)
1150 {
1151 struct mgmt_mode *cp = data;
1152 int err;
1153
1154 BT_DBG("request for %s", hdev->name);
1155
1156 if (cp->val != 0x00 && cp->val != 0x01)
1157 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1158 MGMT_STATUS_INVALID_PARAMS);
1159
1160 hci_dev_lock(hdev);
1161
1162 if (cp->val)
1163 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1164 else
1165 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1166
1167 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1168 if (err < 0)
1169 goto failed;
1170
1171 err = new_settings(hdev, sk);
1172
1173 failed:
1174 hci_dev_unlock(hdev);
1175 return err;
1176 }
1177
1178 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1179 u16 len)
1180 {
1181 struct mgmt_mode *cp = data;
1182 struct pending_cmd *cmd;
1183 u8 val;
1184 int err;
1185
1186 BT_DBG("request for %s", hdev->name);
1187
1188 if (!lmp_bredr_capable(hdev))
1189 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1190 MGMT_STATUS_NOT_SUPPORTED);
1191
1192 if (cp->val != 0x00 && cp->val != 0x01)
1193 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1194 MGMT_STATUS_INVALID_PARAMS);
1195
1196 hci_dev_lock(hdev);
1197
1198 if (!hdev_is_powered(hdev)) {
1199 bool changed = false;
1200
1201 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1202 &hdev->dev_flags)) {
1203 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1204 changed = true;
1205 }
1206
1207 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1208 if (err < 0)
1209 goto failed;
1210
1211 if (changed)
1212 err = new_settings(hdev, sk);
1213
1214 goto failed;
1215 }
1216
1217 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1218 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1219 MGMT_STATUS_BUSY);
1220 goto failed;
1221 }
1222
1223 val = !!cp->val;
1224
1225 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1226 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1227 goto failed;
1228 }
1229
1230 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1231 if (!cmd) {
1232 err = -ENOMEM;
1233 goto failed;
1234 }
1235
1236 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1237 if (err < 0) {
1238 mgmt_pending_remove(cmd);
1239 goto failed;
1240 }
1241
1242 failed:
1243 hci_dev_unlock(hdev);
1244 return err;
1245 }
1246
1247 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1248 {
1249 struct mgmt_mode *cp = data;
1250 struct pending_cmd *cmd;
1251 u8 val;
1252 int err;
1253
1254 BT_DBG("request for %s", hdev->name);
1255
1256 if (!lmp_ssp_capable(hdev))
1257 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1258 MGMT_STATUS_NOT_SUPPORTED);
1259
1260 if (cp->val != 0x00 && cp->val != 0x01)
1261 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1262 MGMT_STATUS_INVALID_PARAMS);
1263
1264 hci_dev_lock(hdev);
1265
1266 val = !!cp->val;
1267
1268 if (!hdev_is_powered(hdev)) {
1269 bool changed = false;
1270
1271 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1272 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1273 changed = true;
1274 }
1275
1276 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1277 if (err < 0)
1278 goto failed;
1279
1280 if (changed)
1281 err = new_settings(hdev, sk);
1282
1283 goto failed;
1284 }
1285
1286 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1287 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1288 MGMT_STATUS_BUSY);
1289 goto failed;
1290 }
1291
1292 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1293 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1294 goto failed;
1295 }
1296
1297 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1298 if (!cmd) {
1299 err = -ENOMEM;
1300 goto failed;
1301 }
1302
1303 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1304 if (err < 0) {
1305 mgmt_pending_remove(cmd);
1306 goto failed;
1307 }
1308
1309 failed:
1310 hci_dev_unlock(hdev);
1311 return err;
1312 }
1313
1314 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1315 {
1316 struct mgmt_mode *cp = data;
1317
1318 BT_DBG("request for %s", hdev->name);
1319
1320 if (!enable_hs)
1321 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1322 MGMT_STATUS_NOT_SUPPORTED);
1323
1324 if (cp->val != 0x00 && cp->val != 0x01)
1325 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1326 MGMT_STATUS_INVALID_PARAMS);
1327
1328 if (cp->val)
1329 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1330 else
1331 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1332
1333 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1334 }
1335
1336 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1337 {
1338 struct mgmt_mode *cp = data;
1339 struct hci_cp_write_le_host_supported hci_cp;
1340 struct pending_cmd *cmd;
1341 int err;
1342 u8 val, enabled;
1343
1344 BT_DBG("request for %s", hdev->name);
1345
1346 if (!lmp_le_capable(hdev))
1347 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1348 MGMT_STATUS_NOT_SUPPORTED);
1349
1350 if (cp->val != 0x00 && cp->val != 0x01)
1351 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1352 MGMT_STATUS_INVALID_PARAMS);
1353
1354 /* LE-only devices do not allow toggling LE on/off */
1355 if (!lmp_bredr_capable(hdev))
1356 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1357 MGMT_STATUS_REJECTED);
1358
1359 hci_dev_lock(hdev);
1360
1361 val = !!cp->val;
1362 enabled = lmp_host_le_capable(hdev);
1363
1364 if (!hdev_is_powered(hdev) || val == enabled) {
1365 bool changed = false;
1366
1367 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1368 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1369 changed = true;
1370 }
1371
1372 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1373 if (err < 0)
1374 goto unlock;
1375
1376 if (changed)
1377 err = new_settings(hdev, sk);
1378
1379 goto unlock;
1380 }
1381
1382 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1383 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1384 MGMT_STATUS_BUSY);
1385 goto unlock;
1386 }
1387
1388 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1389 if (!cmd) {
1390 err = -ENOMEM;
1391 goto unlock;
1392 }
1393
1394 memset(&hci_cp, 0, sizeof(hci_cp));
1395
1396 if (val) {
1397 hci_cp.le = val;
1398 hci_cp.simul = lmp_le_br_capable(hdev);
1399 }
1400
1401 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1402 &hci_cp);
1403 if (err < 0)
1404 mgmt_pending_remove(cmd);
1405
1406 unlock:
1407 hci_dev_unlock(hdev);
1408 return err;
1409 }
1410
1411 /* This is a helper function to test for pending mgmt commands that can
1412 * cause CoD or EIR HCI commands. We can only allow one such pending
1413 * mgmt command at a time since otherwise we cannot easily track what
1414 * the current values are, will be, and based on that calculate if a new
1415 * HCI command needs to be sent and if yes with what value.
1416 */
1417 static bool pending_eir_or_class(struct hci_dev *hdev)
1418 {
1419 struct pending_cmd *cmd;
1420
1421 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1422 switch (cmd->opcode) {
1423 case MGMT_OP_ADD_UUID:
1424 case MGMT_OP_REMOVE_UUID:
1425 case MGMT_OP_SET_DEV_CLASS:
1426 case MGMT_OP_SET_POWERED:
1427 return true;
1428 }
1429 }
1430
1431 return false;
1432 }
1433
1434 static const u8 bluetooth_base_uuid[] = {
1435 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1436 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1437 };
1438
1439 static u8 get_uuid_size(const u8 *uuid)
1440 {
1441 u32 val;
1442
1443 if (memcmp(uuid, bluetooth_base_uuid, 12))
1444 return 128;
1445
1446 val = get_unaligned_le32(&uuid[12]);
1447 if (val > 0xffff)
1448 return 32;
1449
1450 return 16;
1451 }
1452
1453 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1454 {
1455 struct pending_cmd *cmd;
1456
1457 hci_dev_lock(hdev);
1458
1459 cmd = mgmt_pending_find(mgmt_op, hdev);
1460 if (!cmd)
1461 goto unlock;
1462
1463 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1464 hdev->dev_class, 3);
1465
1466 mgmt_pending_remove(cmd);
1467
1468 unlock:
1469 hci_dev_unlock(hdev);
1470 }
1471
1472 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1473 {
1474 BT_DBG("status 0x%02x", status);
1475
1476 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1477 }
1478
1479 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1480 {
1481 struct mgmt_cp_add_uuid *cp = data;
1482 struct pending_cmd *cmd;
1483 struct hci_request req;
1484 struct bt_uuid *uuid;
1485 int err;
1486
1487 BT_DBG("request for %s", hdev->name);
1488
1489 hci_dev_lock(hdev);
1490
1491 if (pending_eir_or_class(hdev)) {
1492 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1493 MGMT_STATUS_BUSY);
1494 goto failed;
1495 }
1496
1497 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1498 if (!uuid) {
1499 err = -ENOMEM;
1500 goto failed;
1501 }
1502
1503 memcpy(uuid->uuid, cp->uuid, 16);
1504 uuid->svc_hint = cp->svc_hint;
1505 uuid->size = get_uuid_size(cp->uuid);
1506
1507 list_add_tail(&uuid->list, &hdev->uuids);
1508
1509 hci_req_init(&req, hdev);
1510
1511 update_class(&req);
1512 update_eir(&req);
1513
1514 err = hci_req_run(&req, add_uuid_complete);
1515 if (err < 0) {
1516 if (err != -ENODATA)
1517 goto failed;
1518
1519 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1520 hdev->dev_class, 3);
1521 goto failed;
1522 }
1523
1524 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1525 if (!cmd) {
1526 err = -ENOMEM;
1527 goto failed;
1528 }
1529
1530 err = 0;
1531
1532 failed:
1533 hci_dev_unlock(hdev);
1534 return err;
1535 }
1536
1537 static bool enable_service_cache(struct hci_dev *hdev)
1538 {
1539 if (!hdev_is_powered(hdev))
1540 return false;
1541
1542 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1543 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1544 CACHE_TIMEOUT);
1545 return true;
1546 }
1547
1548 return false;
1549 }
1550
1551 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1552 {
1553 BT_DBG("status 0x%02x", status);
1554
1555 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1556 }
1557
1558 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1559 u16 len)
1560 {
1561 struct mgmt_cp_remove_uuid *cp = data;
1562 struct pending_cmd *cmd;
1563 struct bt_uuid *match, *tmp;
1564 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1565 struct hci_request req;
1566 int err, found;
1567
1568 BT_DBG("request for %s", hdev->name);
1569
1570 hci_dev_lock(hdev);
1571
1572 if (pending_eir_or_class(hdev)) {
1573 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1574 MGMT_STATUS_BUSY);
1575 goto unlock;
1576 }
1577
1578 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1579 err = hci_uuids_clear(hdev);
1580
1581 if (enable_service_cache(hdev)) {
1582 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1583 0, hdev->dev_class, 3);
1584 goto unlock;
1585 }
1586
1587 goto update_class;
1588 }
1589
1590 found = 0;
1591
1592 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1593 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1594 continue;
1595
1596 list_del(&match->list);
1597 kfree(match);
1598 found++;
1599 }
1600
1601 if (found == 0) {
1602 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1603 MGMT_STATUS_INVALID_PARAMS);
1604 goto unlock;
1605 }
1606
1607 update_class:
1608 hci_req_init(&req, hdev);
1609
1610 update_class(&req);
1611 update_eir(&req);
1612
1613 err = hci_req_run(&req, remove_uuid_complete);
1614 if (err < 0) {
1615 if (err != -ENODATA)
1616 goto unlock;
1617
1618 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1619 hdev->dev_class, 3);
1620 goto unlock;
1621 }
1622
1623 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1624 if (!cmd) {
1625 err = -ENOMEM;
1626 goto unlock;
1627 }
1628
1629 err = 0;
1630
1631 unlock:
1632 hci_dev_unlock(hdev);
1633 return err;
1634 }
1635
1636 static void set_class_complete(struct hci_dev *hdev, u8 status)
1637 {
1638 BT_DBG("status 0x%02x", status);
1639
1640 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1641 }
1642
1643 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1644 u16 len)
1645 {
1646 struct mgmt_cp_set_dev_class *cp = data;
1647 struct pending_cmd *cmd;
1648 struct hci_request req;
1649 int err;
1650
1651 BT_DBG("request for %s", hdev->name);
1652
1653 if (!lmp_bredr_capable(hdev))
1654 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1655 MGMT_STATUS_NOT_SUPPORTED);
1656
1657 hci_dev_lock(hdev);
1658
1659 if (pending_eir_or_class(hdev)) {
1660 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1661 MGMT_STATUS_BUSY);
1662 goto unlock;
1663 }
1664
1665 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1666 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1667 MGMT_STATUS_INVALID_PARAMS);
1668 goto unlock;
1669 }
1670
1671 hdev->major_class = cp->major;
1672 hdev->minor_class = cp->minor;
1673
1674 if (!hdev_is_powered(hdev)) {
1675 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1676 hdev->dev_class, 3);
1677 goto unlock;
1678 }
1679
1680 hci_req_init(&req, hdev);
1681
1682 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1683 hci_dev_unlock(hdev);
1684 cancel_delayed_work_sync(&hdev->service_cache);
1685 hci_dev_lock(hdev);
1686 update_eir(&req);
1687 }
1688
1689 update_class(&req);
1690
1691 err = hci_req_run(&req, set_class_complete);
1692 if (err < 0) {
1693 if (err != -ENODATA)
1694 goto unlock;
1695
1696 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1697 hdev->dev_class, 3);
1698 goto unlock;
1699 }
1700
1701 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1702 if (!cmd) {
1703 err = -ENOMEM;
1704 goto unlock;
1705 }
1706
1707 err = 0;
1708
1709 unlock:
1710 hci_dev_unlock(hdev);
1711 return err;
1712 }
1713
1714 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1715 u16 len)
1716 {
1717 struct mgmt_cp_load_link_keys *cp = data;
1718 u16 key_count, expected_len;
1719 int i;
1720
1721 key_count = __le16_to_cpu(cp->key_count);
1722
1723 expected_len = sizeof(*cp) + key_count *
1724 sizeof(struct mgmt_link_key_info);
1725 if (expected_len != len) {
1726 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1727 len, expected_len);
1728 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1729 MGMT_STATUS_INVALID_PARAMS);
1730 }
1731
1732 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1733 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1734 MGMT_STATUS_INVALID_PARAMS);
1735
1736 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1737 key_count);
1738
1739 for (i = 0; i < key_count; i++) {
1740 struct mgmt_link_key_info *key = &cp->keys[i];
1741
1742 if (key->addr.type != BDADDR_BREDR)
1743 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1744 MGMT_STATUS_INVALID_PARAMS);
1745 }
1746
1747 hci_dev_lock(hdev);
1748
1749 hci_link_keys_clear(hdev);
1750
1751 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1752
1753 if (cp->debug_keys)
1754 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1755 else
1756 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1757
1758 for (i = 0; i < key_count; i++) {
1759 struct mgmt_link_key_info *key = &cp->keys[i];
1760
1761 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1762 key->type, key->pin_len);
1763 }
1764
1765 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1766
1767 hci_dev_unlock(hdev);
1768
1769 return 0;
1770 }
1771
1772 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1773 u8 addr_type, struct sock *skip_sk)
1774 {
1775 struct mgmt_ev_device_unpaired ev;
1776
1777 bacpy(&ev.addr.bdaddr, bdaddr);
1778 ev.addr.type = addr_type;
1779
1780 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1781 skip_sk);
1782 }
1783
1784 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1785 u16 len)
1786 {
1787 struct mgmt_cp_unpair_device *cp = data;
1788 struct mgmt_rp_unpair_device rp;
1789 struct hci_cp_disconnect dc;
1790 struct pending_cmd *cmd;
1791 struct hci_conn *conn;
1792 int err;
1793
1794 memset(&rp, 0, sizeof(rp));
1795 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1796 rp.addr.type = cp->addr.type;
1797
1798 if (!bdaddr_type_is_valid(cp->addr.type))
1799 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1800 MGMT_STATUS_INVALID_PARAMS,
1801 &rp, sizeof(rp));
1802
1803 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1804 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1805 MGMT_STATUS_INVALID_PARAMS,
1806 &rp, sizeof(rp));
1807
1808 hci_dev_lock(hdev);
1809
1810 if (!hdev_is_powered(hdev)) {
1811 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1812 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1813 goto unlock;
1814 }
1815
1816 if (cp->addr.type == BDADDR_BREDR)
1817 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1818 else
1819 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1820
1821 if (err < 0) {
1822 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1823 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1824 goto unlock;
1825 }
1826
1827 if (cp->disconnect) {
1828 if (cp->addr.type == BDADDR_BREDR)
1829 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1830 &cp->addr.bdaddr);
1831 else
1832 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1833 &cp->addr.bdaddr);
1834 } else {
1835 conn = NULL;
1836 }
1837
1838 if (!conn) {
1839 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1840 &rp, sizeof(rp));
1841 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1842 goto unlock;
1843 }
1844
1845 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1846 sizeof(*cp));
1847 if (!cmd) {
1848 err = -ENOMEM;
1849 goto unlock;
1850 }
1851
1852 dc.handle = cpu_to_le16(conn->handle);
1853 dc.reason = 0x13; /* Remote User Terminated Connection */
1854 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1855 if (err < 0)
1856 mgmt_pending_remove(cmd);
1857
1858 unlock:
1859 hci_dev_unlock(hdev);
1860 return err;
1861 }
1862
1863 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1864 u16 len)
1865 {
1866 struct mgmt_cp_disconnect *cp = data;
1867 struct mgmt_rp_disconnect rp;
1868 struct hci_cp_disconnect dc;
1869 struct pending_cmd *cmd;
1870 struct hci_conn *conn;
1871 int err;
1872
1873 BT_DBG("");
1874
1875 memset(&rp, 0, sizeof(rp));
1876 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1877 rp.addr.type = cp->addr.type;
1878
1879 if (!bdaddr_type_is_valid(cp->addr.type))
1880 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1881 MGMT_STATUS_INVALID_PARAMS,
1882 &rp, sizeof(rp));
1883
1884 hci_dev_lock(hdev);
1885
1886 if (!test_bit(HCI_UP, &hdev->flags)) {
1887 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1888 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1889 goto failed;
1890 }
1891
1892 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1893 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1894 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1895 goto failed;
1896 }
1897
1898 if (cp->addr.type == BDADDR_BREDR)
1899 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1900 &cp->addr.bdaddr);
1901 else
1902 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1903
1904 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1905 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1906 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1907 goto failed;
1908 }
1909
1910 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1911 if (!cmd) {
1912 err = -ENOMEM;
1913 goto failed;
1914 }
1915
1916 dc.handle = cpu_to_le16(conn->handle);
1917 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1918
1919 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1920 if (err < 0)
1921 mgmt_pending_remove(cmd);
1922
1923 failed:
1924 hci_dev_unlock(hdev);
1925 return err;
1926 }
1927
1928 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1929 {
1930 switch (link_type) {
1931 case LE_LINK:
1932 switch (addr_type) {
1933 case ADDR_LE_DEV_PUBLIC:
1934 return BDADDR_LE_PUBLIC;
1935
1936 default:
1937 /* Fallback to LE Random address type */
1938 return BDADDR_LE_RANDOM;
1939 }
1940
1941 default:
1942 /* Fallback to BR/EDR type */
1943 return BDADDR_BREDR;
1944 }
1945 }
1946
1947 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1948 u16 data_len)
1949 {
1950 struct mgmt_rp_get_connections *rp;
1951 struct hci_conn *c;
1952 size_t rp_len;
1953 int err;
1954 u16 i;
1955
1956 BT_DBG("");
1957
1958 hci_dev_lock(hdev);
1959
1960 if (!hdev_is_powered(hdev)) {
1961 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1962 MGMT_STATUS_NOT_POWERED);
1963 goto unlock;
1964 }
1965
1966 i = 0;
1967 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1968 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1969 i++;
1970 }
1971
1972 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1973 rp = kmalloc(rp_len, GFP_KERNEL);
1974 if (!rp) {
1975 err = -ENOMEM;
1976 goto unlock;
1977 }
1978
1979 i = 0;
1980 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1981 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1982 continue;
1983 bacpy(&rp->addr[i].bdaddr, &c->dst);
1984 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1985 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1986 continue;
1987 i++;
1988 }
1989
1990 rp->conn_count = cpu_to_le16(i);
1991
1992 /* Recalculate length in case of filtered SCO connections, etc */
1993 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1994
1995 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1996 rp_len);
1997
1998 kfree(rp);
1999
2000 unlock:
2001 hci_dev_unlock(hdev);
2002 return err;
2003 }
2004
2005 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2006 struct mgmt_cp_pin_code_neg_reply *cp)
2007 {
2008 struct pending_cmd *cmd;
2009 int err;
2010
2011 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2012 sizeof(*cp));
2013 if (!cmd)
2014 return -ENOMEM;
2015
2016 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2017 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2018 if (err < 0)
2019 mgmt_pending_remove(cmd);
2020
2021 return err;
2022 }
2023
2024 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2025 u16 len)
2026 {
2027 struct hci_conn *conn;
2028 struct mgmt_cp_pin_code_reply *cp = data;
2029 struct hci_cp_pin_code_reply reply;
2030 struct pending_cmd *cmd;
2031 int err;
2032
2033 BT_DBG("");
2034
2035 hci_dev_lock(hdev);
2036
2037 if (!hdev_is_powered(hdev)) {
2038 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2039 MGMT_STATUS_NOT_POWERED);
2040 goto failed;
2041 }
2042
2043 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2044 if (!conn) {
2045 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2046 MGMT_STATUS_NOT_CONNECTED);
2047 goto failed;
2048 }
2049
2050 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2051 struct mgmt_cp_pin_code_neg_reply ncp;
2052
2053 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2054
2055 BT_ERR("PIN code is not 16 bytes long");
2056
2057 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2058 if (err >= 0)
2059 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2060 MGMT_STATUS_INVALID_PARAMS);
2061
2062 goto failed;
2063 }
2064
2065 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2066 if (!cmd) {
2067 err = -ENOMEM;
2068 goto failed;
2069 }
2070
2071 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2072 reply.pin_len = cp->pin_len;
2073 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2074
2075 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2076 if (err < 0)
2077 mgmt_pending_remove(cmd);
2078
2079 failed:
2080 hci_dev_unlock(hdev);
2081 return err;
2082 }
2083
2084 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2085 u16 len)
2086 {
2087 struct mgmt_cp_set_io_capability *cp = data;
2088
2089 BT_DBG("");
2090
2091 hci_dev_lock(hdev);
2092
2093 hdev->io_capability = cp->io_capability;
2094
2095 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2096 hdev->io_capability);
2097
2098 hci_dev_unlock(hdev);
2099
2100 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2101 0);
2102 }
2103
2104 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2105 {
2106 struct hci_dev *hdev = conn->hdev;
2107 struct pending_cmd *cmd;
2108
2109 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2110 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2111 continue;
2112
2113 if (cmd->user_data != conn)
2114 continue;
2115
2116 return cmd;
2117 }
2118
2119 return NULL;
2120 }
2121
2122 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2123 {
2124 struct mgmt_rp_pair_device rp;
2125 struct hci_conn *conn = cmd->user_data;
2126
2127 bacpy(&rp.addr.bdaddr, &conn->dst);
2128 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2129
2130 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2131 &rp, sizeof(rp));
2132
2133 /* So we don't get further callbacks for this connection */
2134 conn->connect_cfm_cb = NULL;
2135 conn->security_cfm_cb = NULL;
2136 conn->disconn_cfm_cb = NULL;
2137
2138 hci_conn_drop(conn);
2139
2140 mgmt_pending_remove(cmd);
2141 }
2142
2143 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2144 {
2145 struct pending_cmd *cmd;
2146
2147 BT_DBG("status %u", status);
2148
2149 cmd = find_pairing(conn);
2150 if (!cmd)
2151 BT_DBG("Unable to find a pending command");
2152 else
2153 pairing_complete(cmd, mgmt_status(status));
2154 }
2155
2156 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2157 {
2158 struct pending_cmd *cmd;
2159
2160 BT_DBG("status %u", status);
2161
2162 if (!status)
2163 return;
2164
2165 cmd = find_pairing(conn);
2166 if (!cmd)
2167 BT_DBG("Unable to find a pending command");
2168 else
2169 pairing_complete(cmd, mgmt_status(status));
2170 }
2171
2172 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2173 u16 len)
2174 {
2175 struct mgmt_cp_pair_device *cp = data;
2176 struct mgmt_rp_pair_device rp;
2177 struct pending_cmd *cmd;
2178 u8 sec_level, auth_type;
2179 struct hci_conn *conn;
2180 int err;
2181
2182 BT_DBG("");
2183
2184 memset(&rp, 0, sizeof(rp));
2185 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2186 rp.addr.type = cp->addr.type;
2187
2188 if (!bdaddr_type_is_valid(cp->addr.type))
2189 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2190 MGMT_STATUS_INVALID_PARAMS,
2191 &rp, sizeof(rp));
2192
2193 hci_dev_lock(hdev);
2194
2195 if (!hdev_is_powered(hdev)) {
2196 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2197 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2198 goto unlock;
2199 }
2200
2201 sec_level = BT_SECURITY_MEDIUM;
2202 if (cp->io_cap == 0x03)
2203 auth_type = HCI_AT_DEDICATED_BONDING;
2204 else
2205 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2206
2207 if (cp->addr.type == BDADDR_BREDR)
2208 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2209 cp->addr.type, sec_level, auth_type);
2210 else
2211 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2212 cp->addr.type, sec_level, auth_type);
2213
2214 if (IS_ERR(conn)) {
2215 int status;
2216
2217 if (PTR_ERR(conn) == -EBUSY)
2218 status = MGMT_STATUS_BUSY;
2219 else
2220 status = MGMT_STATUS_CONNECT_FAILED;
2221
2222 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2223 status, &rp,
2224 sizeof(rp));
2225 goto unlock;
2226 }
2227
2228 if (conn->connect_cfm_cb) {
2229 hci_conn_drop(conn);
2230 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2231 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2232 goto unlock;
2233 }
2234
2235 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2236 if (!cmd) {
2237 err = -ENOMEM;
2238 hci_conn_drop(conn);
2239 goto unlock;
2240 }
2241
2242 /* For LE, just connecting isn't a proof that the pairing finished */
2243 if (cp->addr.type == BDADDR_BREDR)
2244 conn->connect_cfm_cb = pairing_complete_cb;
2245 else
2246 conn->connect_cfm_cb = le_connect_complete_cb;
2247
2248 conn->security_cfm_cb = pairing_complete_cb;
2249 conn->disconn_cfm_cb = pairing_complete_cb;
2250 conn->io_capability = cp->io_cap;
2251 cmd->user_data = conn;
2252
2253 if (conn->state == BT_CONNECTED &&
2254 hci_conn_security(conn, sec_level, auth_type))
2255 pairing_complete(cmd, 0);
2256
2257 err = 0;
2258
2259 unlock:
2260 hci_dev_unlock(hdev);
2261 return err;
2262 }
2263
2264 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2265 u16 len)
2266 {
2267 struct mgmt_addr_info *addr = data;
2268 struct pending_cmd *cmd;
2269 struct hci_conn *conn;
2270 int err;
2271
2272 BT_DBG("");
2273
2274 hci_dev_lock(hdev);
2275
2276 if (!hdev_is_powered(hdev)) {
2277 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2278 MGMT_STATUS_NOT_POWERED);
2279 goto unlock;
2280 }
2281
2282 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2283 if (!cmd) {
2284 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2285 MGMT_STATUS_INVALID_PARAMS);
2286 goto unlock;
2287 }
2288
2289 conn = cmd->user_data;
2290
2291 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2292 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2293 MGMT_STATUS_INVALID_PARAMS);
2294 goto unlock;
2295 }
2296
2297 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2298
2299 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2300 addr, sizeof(*addr));
2301 unlock:
2302 hci_dev_unlock(hdev);
2303 return err;
2304 }
2305
2306 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2307 struct mgmt_addr_info *addr, u16 mgmt_op,
2308 u16 hci_op, __le32 passkey)
2309 {
2310 struct pending_cmd *cmd;
2311 struct hci_conn *conn;
2312 int err;
2313
2314 hci_dev_lock(hdev);
2315
2316 if (!hdev_is_powered(hdev)) {
2317 err = cmd_complete(sk, hdev->id, mgmt_op,
2318 MGMT_STATUS_NOT_POWERED, addr,
2319 sizeof(*addr));
2320 goto done;
2321 }
2322
2323 if (addr->type == BDADDR_BREDR)
2324 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2325 else
2326 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2327
2328 if (!conn) {
2329 err = cmd_complete(sk, hdev->id, mgmt_op,
2330 MGMT_STATUS_NOT_CONNECTED, addr,
2331 sizeof(*addr));
2332 goto done;
2333 }
2334
2335 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2336 /* Continue with pairing via SMP */
2337 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2338
2339 if (!err)
2340 err = cmd_complete(sk, hdev->id, mgmt_op,
2341 MGMT_STATUS_SUCCESS, addr,
2342 sizeof(*addr));
2343 else
2344 err = cmd_complete(sk, hdev->id, mgmt_op,
2345 MGMT_STATUS_FAILED, addr,
2346 sizeof(*addr));
2347
2348 goto done;
2349 }
2350
2351 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2352 if (!cmd) {
2353 err = -ENOMEM;
2354 goto done;
2355 }
2356
2357 /* Continue with pairing via HCI */
2358 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2359 struct hci_cp_user_passkey_reply cp;
2360
2361 bacpy(&cp.bdaddr, &addr->bdaddr);
2362 cp.passkey = passkey;
2363 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2364 } else
2365 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2366 &addr->bdaddr);
2367
2368 if (err < 0)
2369 mgmt_pending_remove(cmd);
2370
2371 done:
2372 hci_dev_unlock(hdev);
2373 return err;
2374 }
2375
2376 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2377 void *data, u16 len)
2378 {
2379 struct mgmt_cp_pin_code_neg_reply *cp = data;
2380
2381 BT_DBG("");
2382
2383 return user_pairing_resp(sk, hdev, &cp->addr,
2384 MGMT_OP_PIN_CODE_NEG_REPLY,
2385 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2386 }
2387
2388 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2389 u16 len)
2390 {
2391 struct mgmt_cp_user_confirm_reply *cp = data;
2392
2393 BT_DBG("");
2394
2395 if (len != sizeof(*cp))
2396 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2397 MGMT_STATUS_INVALID_PARAMS);
2398
2399 return user_pairing_resp(sk, hdev, &cp->addr,
2400 MGMT_OP_USER_CONFIRM_REPLY,
2401 HCI_OP_USER_CONFIRM_REPLY, 0);
2402 }
2403
2404 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2405 void *data, u16 len)
2406 {
2407 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2408
2409 BT_DBG("");
2410
2411 return user_pairing_resp(sk, hdev, &cp->addr,
2412 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2413 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2414 }
2415
2416 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2417 u16 len)
2418 {
2419 struct mgmt_cp_user_passkey_reply *cp = data;
2420
2421 BT_DBG("");
2422
2423 return user_pairing_resp(sk, hdev, &cp->addr,
2424 MGMT_OP_USER_PASSKEY_REPLY,
2425 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2426 }
2427
2428 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2429 void *data, u16 len)
2430 {
2431 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2432
2433 BT_DBG("");
2434
2435 return user_pairing_resp(sk, hdev, &cp->addr,
2436 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2437 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2438 }
2439
2440 static void update_name(struct hci_request *req)
2441 {
2442 struct hci_dev *hdev = req->hdev;
2443 struct hci_cp_write_local_name cp;
2444
2445 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2446
2447 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2448 }
2449
2450 static void set_name_complete(struct hci_dev *hdev, u8 status)
2451 {
2452 struct mgmt_cp_set_local_name *cp;
2453 struct pending_cmd *cmd;
2454
2455 BT_DBG("status 0x%02x", status);
2456
2457 hci_dev_lock(hdev);
2458
2459 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2460 if (!cmd)
2461 goto unlock;
2462
2463 cp = cmd->param;
2464
2465 if (status)
2466 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2467 mgmt_status(status));
2468 else
2469 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2470 cp, sizeof(*cp));
2471
2472 mgmt_pending_remove(cmd);
2473
2474 unlock:
2475 hci_dev_unlock(hdev);
2476 }
2477
2478 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2479 u16 len)
2480 {
2481 struct mgmt_cp_set_local_name *cp = data;
2482 struct pending_cmd *cmd;
2483 struct hci_request req;
2484 int err;
2485
2486 BT_DBG("");
2487
2488 hci_dev_lock(hdev);
2489
2490 /* If the old values are the same as the new ones just return a
2491 * direct command complete event.
2492 */
2493 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2494 !memcmp(hdev->short_name, cp->short_name,
2495 sizeof(hdev->short_name))) {
2496 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2497 data, len);
2498 goto failed;
2499 }
2500
2501 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2502
2503 if (!hdev_is_powered(hdev)) {
2504 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2505
2506 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2507 data, len);
2508 if (err < 0)
2509 goto failed;
2510
2511 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2512 sk);
2513
2514 goto failed;
2515 }
2516
2517 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2518 if (!cmd) {
2519 err = -ENOMEM;
2520 goto failed;
2521 }
2522
2523 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2524
2525 hci_req_init(&req, hdev);
2526
2527 if (lmp_bredr_capable(hdev)) {
2528 update_name(&req);
2529 update_eir(&req);
2530 }
2531
2532 if (lmp_le_capable(hdev))
2533 hci_update_ad(&req);
2534
2535 err = hci_req_run(&req, set_name_complete);
2536 if (err < 0)
2537 mgmt_pending_remove(cmd);
2538
2539 failed:
2540 hci_dev_unlock(hdev);
2541 return err;
2542 }
2543
2544 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2545 void *data, u16 data_len)
2546 {
2547 struct pending_cmd *cmd;
2548 int err;
2549
2550 BT_DBG("%s", hdev->name);
2551
2552 hci_dev_lock(hdev);
2553
2554 if (!hdev_is_powered(hdev)) {
2555 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2556 MGMT_STATUS_NOT_POWERED);
2557 goto unlock;
2558 }
2559
2560 if (!lmp_ssp_capable(hdev)) {
2561 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2562 MGMT_STATUS_NOT_SUPPORTED);
2563 goto unlock;
2564 }
2565
2566 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2567 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2568 MGMT_STATUS_BUSY);
2569 goto unlock;
2570 }
2571
2572 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2573 if (!cmd) {
2574 err = -ENOMEM;
2575 goto unlock;
2576 }
2577
2578 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2579 if (err < 0)
2580 mgmt_pending_remove(cmd);
2581
2582 unlock:
2583 hci_dev_unlock(hdev);
2584 return err;
2585 }
2586
2587 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2588 void *data, u16 len)
2589 {
2590 struct mgmt_cp_add_remote_oob_data *cp = data;
2591 u8 status;
2592 int err;
2593
2594 BT_DBG("%s ", hdev->name);
2595
2596 hci_dev_lock(hdev);
2597
2598 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2599 cp->randomizer);
2600 if (err < 0)
2601 status = MGMT_STATUS_FAILED;
2602 else
2603 status = MGMT_STATUS_SUCCESS;
2604
2605 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2606 &cp->addr, sizeof(cp->addr));
2607
2608 hci_dev_unlock(hdev);
2609 return err;
2610 }
2611
2612 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2613 void *data, u16 len)
2614 {
2615 struct mgmt_cp_remove_remote_oob_data *cp = data;
2616 u8 status;
2617 int err;
2618
2619 BT_DBG("%s", hdev->name);
2620
2621 hci_dev_lock(hdev);
2622
2623 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2624 if (err < 0)
2625 status = MGMT_STATUS_INVALID_PARAMS;
2626 else
2627 status = MGMT_STATUS_SUCCESS;
2628
2629 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2630 status, &cp->addr, sizeof(cp->addr));
2631
2632 hci_dev_unlock(hdev);
2633 return err;
2634 }
2635
2636 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2637 {
2638 int err;
2639
2640 BT_DBG("%s", hdev->name);
2641
2642 hci_dev_lock(hdev);
2643
2644 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2645 if (err < 0)
2646 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2647
2648 hci_dev_unlock(hdev);
2649
2650 return err;
2651 }
2652
2653 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2654 {
2655 BT_DBG("status %d", status);
2656
2657 if (status) {
2658 hci_dev_lock(hdev);
2659 mgmt_start_discovery_failed(hdev, status);
2660 hci_dev_unlock(hdev);
2661 return;
2662 }
2663
2664 hci_dev_lock(hdev);
2665 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2666 hci_dev_unlock(hdev);
2667
2668 switch (hdev->discovery.type) {
2669 case DISCOV_TYPE_LE:
2670 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2671 LE_SCAN_TIMEOUT_LE_ONLY);
2672 break;
2673
2674 case DISCOV_TYPE_INTERLEAVED:
2675 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2676 LE_SCAN_TIMEOUT_BREDR_LE);
2677 break;
2678
2679 case DISCOV_TYPE_BREDR:
2680 break;
2681
2682 default:
2683 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2684 }
2685 }
2686
2687 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2688 void *data, u16 len)
2689 {
2690 struct mgmt_cp_start_discovery *cp = data;
2691 struct pending_cmd *cmd;
2692 struct hci_cp_le_set_scan_param param_cp;
2693 struct hci_cp_le_set_scan_enable enable_cp;
2694 struct hci_cp_inquiry inq_cp;
2695 struct hci_request req;
2696 /* General inquiry access code (GIAC) */
2697 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2698 int err;
2699
2700 BT_DBG("%s", hdev->name);
2701
2702 hci_dev_lock(hdev);
2703
2704 if (!hdev_is_powered(hdev)) {
2705 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2706 MGMT_STATUS_NOT_POWERED);
2707 goto failed;
2708 }
2709
2710 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2711 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2712 MGMT_STATUS_BUSY);
2713 goto failed;
2714 }
2715
2716 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2717 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2718 MGMT_STATUS_BUSY);
2719 goto failed;
2720 }
2721
2722 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2723 if (!cmd) {
2724 err = -ENOMEM;
2725 goto failed;
2726 }
2727
2728 hdev->discovery.type = cp->type;
2729
2730 hci_req_init(&req, hdev);
2731
2732 switch (hdev->discovery.type) {
2733 case DISCOV_TYPE_BREDR:
2734 if (!lmp_bredr_capable(hdev)) {
2735 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2736 MGMT_STATUS_NOT_SUPPORTED);
2737 mgmt_pending_remove(cmd);
2738 goto failed;
2739 }
2740
2741 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2742 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2743 MGMT_STATUS_BUSY);
2744 mgmt_pending_remove(cmd);
2745 goto failed;
2746 }
2747
2748 hci_inquiry_cache_flush(hdev);
2749
2750 memset(&inq_cp, 0, sizeof(inq_cp));
2751 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2752 inq_cp.length = INQUIRY_LEN_BREDR;
2753 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2754 break;
2755
2756 case DISCOV_TYPE_LE:
2757 case DISCOV_TYPE_INTERLEAVED:
2758 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2759 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2760 MGMT_STATUS_NOT_SUPPORTED);
2761 mgmt_pending_remove(cmd);
2762 goto failed;
2763 }
2764
2765 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2766 !lmp_bredr_capable(hdev)) {
2767 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2768 MGMT_STATUS_NOT_SUPPORTED);
2769 mgmt_pending_remove(cmd);
2770 goto failed;
2771 }
2772
2773 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2774 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2775 MGMT_STATUS_REJECTED);
2776 mgmt_pending_remove(cmd);
2777 goto failed;
2778 }
2779
2780 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2781 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2782 MGMT_STATUS_BUSY);
2783 mgmt_pending_remove(cmd);
2784 goto failed;
2785 }
2786
2787 memset(&param_cp, 0, sizeof(param_cp));
2788 param_cp.type = LE_SCAN_ACTIVE;
2789 param_cp.interval = cpu_to_le16(LE_SCAN_INT);
2790 param_cp.window = cpu_to_le16(LE_SCAN_WIN);
2791 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2792 &param_cp);
2793
2794 memset(&enable_cp, 0, sizeof(enable_cp));
2795 enable_cp.enable = LE_SCAN_ENABLE;
2796 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2797 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2798 &enable_cp);
2799 break;
2800
2801 default:
2802 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2803 MGMT_STATUS_INVALID_PARAMS);
2804 mgmt_pending_remove(cmd);
2805 goto failed;
2806 }
2807
2808 err = hci_req_run(&req, start_discovery_complete);
2809 if (err < 0)
2810 mgmt_pending_remove(cmd);
2811 else
2812 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2813
2814 failed:
2815 hci_dev_unlock(hdev);
2816 return err;
2817 }
2818
2819 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2820 u16 len)
2821 {
2822 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2823 struct pending_cmd *cmd;
2824 struct hci_cp_remote_name_req_cancel cp;
2825 struct inquiry_entry *e;
2826 int err;
2827
2828 BT_DBG("%s", hdev->name);
2829
2830 hci_dev_lock(hdev);
2831
2832 if (!hci_discovery_active(hdev)) {
2833 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2834 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2835 sizeof(mgmt_cp->type));
2836 goto unlock;
2837 }
2838
2839 if (hdev->discovery.type != mgmt_cp->type) {
2840 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2841 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2842 sizeof(mgmt_cp->type));
2843 goto unlock;
2844 }
2845
2846 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2847 if (!cmd) {
2848 err = -ENOMEM;
2849 goto unlock;
2850 }
2851
2852 switch (hdev->discovery.state) {
2853 case DISCOVERY_FINDING:
2854 if (test_bit(HCI_INQUIRY, &hdev->flags))
2855 err = hci_cancel_inquiry(hdev);
2856 else
2857 err = hci_cancel_le_scan(hdev);
2858
2859 break;
2860
2861 case DISCOVERY_RESOLVING:
2862 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2863 NAME_PENDING);
2864 if (!e) {
2865 mgmt_pending_remove(cmd);
2866 err = cmd_complete(sk, hdev->id,
2867 MGMT_OP_STOP_DISCOVERY, 0,
2868 &mgmt_cp->type,
2869 sizeof(mgmt_cp->type));
2870 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2871 goto unlock;
2872 }
2873
2874 bacpy(&cp.bdaddr, &e->data.bdaddr);
2875 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2876 sizeof(cp), &cp);
2877
2878 break;
2879
2880 default:
2881 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2882 err = -EFAULT;
2883 }
2884
2885 if (err < 0)
2886 mgmt_pending_remove(cmd);
2887 else
2888 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2889
2890 unlock:
2891 hci_dev_unlock(hdev);
2892 return err;
2893 }
2894
2895 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2896 u16 len)
2897 {
2898 struct mgmt_cp_confirm_name *cp = data;
2899 struct inquiry_entry *e;
2900 int err;
2901
2902 BT_DBG("%s", hdev->name);
2903
2904 hci_dev_lock(hdev);
2905
2906 if (!hci_discovery_active(hdev)) {
2907 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2908 MGMT_STATUS_FAILED);
2909 goto failed;
2910 }
2911
2912 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2913 if (!e) {
2914 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2915 MGMT_STATUS_INVALID_PARAMS);
2916 goto failed;
2917 }
2918
2919 if (cp->name_known) {
2920 e->name_state = NAME_KNOWN;
2921 list_del(&e->list);
2922 } else {
2923 e->name_state = NAME_NEEDED;
2924 hci_inquiry_cache_update_resolve(hdev, e);
2925 }
2926
2927 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2928 sizeof(cp->addr));
2929
2930 failed:
2931 hci_dev_unlock(hdev);
2932 return err;
2933 }
2934
2935 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2936 u16 len)
2937 {
2938 struct mgmt_cp_block_device *cp = data;
2939 u8 status;
2940 int err;
2941
2942 BT_DBG("%s", hdev->name);
2943
2944 if (!bdaddr_type_is_valid(cp->addr.type))
2945 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2946 MGMT_STATUS_INVALID_PARAMS,
2947 &cp->addr, sizeof(cp->addr));
2948
2949 hci_dev_lock(hdev);
2950
2951 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2952 if (err < 0)
2953 status = MGMT_STATUS_FAILED;
2954 else
2955 status = MGMT_STATUS_SUCCESS;
2956
2957 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2958 &cp->addr, sizeof(cp->addr));
2959
2960 hci_dev_unlock(hdev);
2961
2962 return err;
2963 }
2964
2965 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2966 u16 len)
2967 {
2968 struct mgmt_cp_unblock_device *cp = data;
2969 u8 status;
2970 int err;
2971
2972 BT_DBG("%s", hdev->name);
2973
2974 if (!bdaddr_type_is_valid(cp->addr.type))
2975 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
2976 MGMT_STATUS_INVALID_PARAMS,
2977 &cp->addr, sizeof(cp->addr));
2978
2979 hci_dev_lock(hdev);
2980
2981 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2982 if (err < 0)
2983 status = MGMT_STATUS_INVALID_PARAMS;
2984 else
2985 status = MGMT_STATUS_SUCCESS;
2986
2987 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2988 &cp->addr, sizeof(cp->addr));
2989
2990 hci_dev_unlock(hdev);
2991
2992 return err;
2993 }
2994
2995 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2996 u16 len)
2997 {
2998 struct mgmt_cp_set_device_id *cp = data;
2999 struct hci_request req;
3000 int err;
3001 __u16 source;
3002
3003 BT_DBG("%s", hdev->name);
3004
3005 source = __le16_to_cpu(cp->source);
3006
3007 if (source > 0x0002)
3008 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3009 MGMT_STATUS_INVALID_PARAMS);
3010
3011 hci_dev_lock(hdev);
3012
3013 hdev->devid_source = source;
3014 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3015 hdev->devid_product = __le16_to_cpu(cp->product);
3016 hdev->devid_version = __le16_to_cpu(cp->version);
3017
3018 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3019
3020 hci_req_init(&req, hdev);
3021 update_eir(&req);
3022 hci_req_run(&req, NULL);
3023
3024 hci_dev_unlock(hdev);
3025
3026 return err;
3027 }
3028
3029 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3030 {
3031 struct pending_cmd *cmd;
3032
3033 BT_DBG("status 0x%02x", status);
3034
3035 hci_dev_lock(hdev);
3036
3037 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3038 if (!cmd)
3039 goto unlock;
3040
3041 if (status) {
3042 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3043 mgmt_status(status));
3044 } else {
3045 struct mgmt_mode *cp = cmd->param;
3046
3047 if (cp->val)
3048 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3049 else
3050 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3051
3052 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3053 new_settings(hdev, cmd->sk);
3054 }
3055
3056 mgmt_pending_remove(cmd);
3057
3058 unlock:
3059 hci_dev_unlock(hdev);
3060 }
3061
3062 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3063 void *data, u16 len)
3064 {
3065 struct mgmt_mode *cp = data;
3066 struct pending_cmd *cmd;
3067 struct hci_request req;
3068 int err;
3069
3070 BT_DBG("%s", hdev->name);
3071
3072 if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3073 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3074 MGMT_STATUS_NOT_SUPPORTED);
3075
3076 if (cp->val != 0x00 && cp->val != 0x01)
3077 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3078 MGMT_STATUS_INVALID_PARAMS);
3079
3080 if (!hdev_is_powered(hdev))
3081 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3082 MGMT_STATUS_NOT_POWERED);
3083
3084 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3085 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3086 MGMT_STATUS_REJECTED);
3087
3088 hci_dev_lock(hdev);
3089
3090 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3091 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3092 MGMT_STATUS_BUSY);
3093 goto unlock;
3094 }
3095
3096 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3097 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3098 hdev);
3099 goto unlock;
3100 }
3101
3102 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3103 data, len);
3104 if (!cmd) {
3105 err = -ENOMEM;
3106 goto unlock;
3107 }
3108
3109 hci_req_init(&req, hdev);
3110
3111 write_fast_connectable(&req, cp->val);
3112
3113 err = hci_req_run(&req, fast_connectable_complete);
3114 if (err < 0) {
3115 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3116 MGMT_STATUS_FAILED);
3117 mgmt_pending_remove(cmd);
3118 }
3119
3120 unlock:
3121 hci_dev_unlock(hdev);
3122
3123 return err;
3124 }
3125
3126 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3127 {
3128 if (key->authenticated != 0x00 && key->authenticated != 0x01)
3129 return false;
3130 if (key->master != 0x00 && key->master != 0x01)
3131 return false;
3132 if (!bdaddr_type_is_le(key->addr.type))
3133 return false;
3134 return true;
3135 }
3136
3137 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3138 void *cp_data, u16 len)
3139 {
3140 struct mgmt_cp_load_long_term_keys *cp = cp_data;
3141 u16 key_count, expected_len;
3142 int i, err;
3143
3144 key_count = __le16_to_cpu(cp->key_count);
3145
3146 expected_len = sizeof(*cp) + key_count *
3147 sizeof(struct mgmt_ltk_info);
3148 if (expected_len != len) {
3149 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3150 len, expected_len);
3151 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3152 MGMT_STATUS_INVALID_PARAMS);
3153 }
3154
3155 BT_DBG("%s key_count %u", hdev->name, key_count);
3156
3157 for (i = 0; i < key_count; i++) {
3158 struct mgmt_ltk_info *key = &cp->keys[i];
3159
3160 if (!ltk_is_valid(key))
3161 return cmd_status(sk, hdev->id,
3162 MGMT_OP_LOAD_LONG_TERM_KEYS,
3163 MGMT_STATUS_INVALID_PARAMS);
3164 }
3165
3166 hci_dev_lock(hdev);
3167
3168 hci_smp_ltks_clear(hdev);
3169
3170 for (i = 0; i < key_count; i++) {
3171 struct mgmt_ltk_info *key = &cp->keys[i];
3172 u8 type;
3173
3174 if (key->master)
3175 type = HCI_SMP_LTK;
3176 else
3177 type = HCI_SMP_LTK_SLAVE;
3178
3179 hci_add_ltk(hdev, &key->addr.bdaddr,
3180 bdaddr_to_le(key->addr.type),
3181 type, 0, key->authenticated, key->val,
3182 key->enc_size, key->ediv, key->rand);
3183 }
3184
3185 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3186 NULL, 0);
3187
3188 hci_dev_unlock(hdev);
3189
3190 return err;
3191 }
3192
3193 static const struct mgmt_handler {
3194 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3195 u16 data_len);
3196 bool var_len;
3197 size_t data_len;
3198 } mgmt_handlers[] = {
3199 { NULL }, /* 0x0000 (no command) */
3200 { read_version, false, MGMT_READ_VERSION_SIZE },
3201 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
3202 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
3203 { read_controller_info, false, MGMT_READ_INFO_SIZE },
3204 { set_powered, false, MGMT_SETTING_SIZE },
3205 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
3206 { set_connectable, false, MGMT_SETTING_SIZE },
3207 { set_fast_connectable, false, MGMT_SETTING_SIZE },
3208 { set_pairable, false, MGMT_SETTING_SIZE },
3209 { set_link_security, false, MGMT_SETTING_SIZE },
3210 { set_ssp, false, MGMT_SETTING_SIZE },
3211 { set_hs, false, MGMT_SETTING_SIZE },
3212 { set_le, false, MGMT_SETTING_SIZE },
3213 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
3214 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
3215 { add_uuid, false, MGMT_ADD_UUID_SIZE },
3216 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
3217 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
3218 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3219 { disconnect, false, MGMT_DISCONNECT_SIZE },
3220 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
3221 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
3222 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3223 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
3224 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
3225 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3226 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
3227 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
3228 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3229 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
3230 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3231 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3232 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3233 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3234 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
3235 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
3236 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
3237 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
3238 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
3239 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
3240 };
3241
3242
3243 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3244 {
3245 void *buf;
3246 u8 *cp;
3247 struct mgmt_hdr *hdr;
3248 u16 opcode, index, len;
3249 struct hci_dev *hdev = NULL;
3250 const struct mgmt_handler *handler;
3251 int err;
3252
3253 BT_DBG("got %zu bytes", msglen);
3254
3255 if (msglen < sizeof(*hdr))
3256 return -EINVAL;
3257
3258 buf = kmalloc(msglen, GFP_KERNEL);
3259 if (!buf)
3260 return -ENOMEM;
3261
3262 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3263 err = -EFAULT;
3264 goto done;
3265 }
3266
3267 hdr = buf;
3268 opcode = __le16_to_cpu(hdr->opcode);
3269 index = __le16_to_cpu(hdr->index);
3270 len = __le16_to_cpu(hdr->len);
3271
3272 if (len != msglen - sizeof(*hdr)) {
3273 err = -EINVAL;
3274 goto done;
3275 }
3276
3277 if (index != MGMT_INDEX_NONE) {
3278 hdev = hci_dev_get(index);
3279 if (!hdev) {
3280 err = cmd_status(sk, index, opcode,
3281 MGMT_STATUS_INVALID_INDEX);
3282 goto done;
3283 }
3284 }
3285
3286 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3287 mgmt_handlers[opcode].func == NULL) {
3288 BT_DBG("Unknown op %u", opcode);
3289 err = cmd_status(sk, index, opcode,
3290 MGMT_STATUS_UNKNOWN_COMMAND);
3291 goto done;
3292 }
3293
3294 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3295 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3296 err = cmd_status(sk, index, opcode,
3297 MGMT_STATUS_INVALID_INDEX);
3298 goto done;
3299 }
3300
3301 handler = &mgmt_handlers[opcode];
3302
3303 if ((handler->var_len && len < handler->data_len) ||
3304 (!handler->var_len && len != handler->data_len)) {
3305 err = cmd_status(sk, index, opcode,
3306 MGMT_STATUS_INVALID_PARAMS);
3307 goto done;
3308 }
3309
3310 if (hdev)
3311 mgmt_init_hdev(sk, hdev);
3312
3313 cp = buf + sizeof(*hdr);
3314
3315 err = handler->func(sk, hdev, cp, len);
3316 if (err < 0)
3317 goto done;
3318
3319 err = msglen;
3320
3321 done:
3322 if (hdev)
3323 hci_dev_put(hdev);
3324
3325 kfree(buf);
3326 return err;
3327 }
3328
3329 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3330 {
3331 u8 *status = data;
3332
3333 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3334 mgmt_pending_remove(cmd);
3335 }
3336
3337 int mgmt_index_added(struct hci_dev *hdev)
3338 {
3339 if (!mgmt_valid_hdev(hdev))
3340 return -ENOTSUPP;
3341
3342 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3343 }
3344
3345 int mgmt_index_removed(struct hci_dev *hdev)
3346 {
3347 u8 status = MGMT_STATUS_INVALID_INDEX;
3348
3349 if (!mgmt_valid_hdev(hdev))
3350 return -ENOTSUPP;
3351
3352 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3353
3354 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3355 }
3356
3357 struct cmd_lookup {
3358 struct sock *sk;
3359 struct hci_dev *hdev;
3360 u8 mgmt_status;
3361 };
3362
3363 static void settings_rsp(struct pending_cmd *cmd, void *data)
3364 {
3365 struct cmd_lookup *match = data;
3366
3367 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3368
3369 list_del(&cmd->list);
3370
3371 if (match->sk == NULL) {
3372 match->sk = cmd->sk;
3373 sock_hold(match->sk);
3374 }
3375
3376 mgmt_pending_free(cmd);
3377 }
3378
3379 static void set_bredr_scan(struct hci_request *req)
3380 {
3381 struct hci_dev *hdev = req->hdev;
3382 u8 scan = 0;
3383
3384 /* Ensure that fast connectable is disabled. This function will
3385 * not do anything if the page scan parameters are already what
3386 * they should be.
3387 */
3388 write_fast_connectable(req, false);
3389
3390 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3391 scan |= SCAN_PAGE;
3392 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3393 scan |= SCAN_INQUIRY;
3394
3395 if (scan)
3396 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3397 }
3398
3399 static void powered_complete(struct hci_dev *hdev, u8 status)
3400 {
3401 struct cmd_lookup match = { NULL, hdev };
3402
3403 BT_DBG("status 0x%02x", status);
3404
3405 hci_dev_lock(hdev);
3406
3407 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3408
3409 new_settings(hdev, match.sk);
3410
3411 hci_dev_unlock(hdev);
3412
3413 if (match.sk)
3414 sock_put(match.sk);
3415 }
3416
3417 static int powered_update_hci(struct hci_dev *hdev)
3418 {
3419 struct hci_request req;
3420 u8 link_sec;
3421
3422 hci_req_init(&req, hdev);
3423
3424 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3425 !lmp_host_ssp_capable(hdev)) {
3426 u8 ssp = 1;
3427
3428 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3429 }
3430
3431 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3432 lmp_bredr_capable(hdev)) {
3433 struct hci_cp_write_le_host_supported cp;
3434
3435 cp.le = 1;
3436 cp.simul = lmp_le_br_capable(hdev);
3437
3438 /* Check first if we already have the right
3439 * host state (host features set)
3440 */
3441 if (cp.le != lmp_host_le_capable(hdev) ||
3442 cp.simul != lmp_host_le_br_capable(hdev))
3443 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3444 sizeof(cp), &cp);
3445 }
3446
3447 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3448 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3449 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3450 sizeof(link_sec), &link_sec);
3451
3452 if (lmp_bredr_capable(hdev)) {
3453 set_bredr_scan(&req);
3454 update_class(&req);
3455 update_name(&req);
3456 update_eir(&req);
3457 }
3458
3459 return hci_req_run(&req, powered_complete);
3460 }
3461
3462 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3463 {
3464 struct cmd_lookup match = { NULL, hdev };
3465 u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3466 u8 zero_cod[] = { 0, 0, 0 };
3467 int err;
3468
3469 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3470 return 0;
3471
3472 if (powered) {
3473 if (powered_update_hci(hdev) == 0)
3474 return 0;
3475
3476 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3477 &match);
3478 goto new_settings;
3479 }
3480
3481 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3482 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3483
3484 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3485 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3486 zero_cod, sizeof(zero_cod), NULL);
3487
3488 new_settings:
3489 err = new_settings(hdev, match.sk);
3490
3491 if (match.sk)
3492 sock_put(match.sk);
3493
3494 return err;
3495 }
3496
3497 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3498 {
3499 struct pending_cmd *cmd;
3500 u8 status;
3501
3502 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3503 if (!cmd)
3504 return -ENOENT;
3505
3506 if (err == -ERFKILL)
3507 status = MGMT_STATUS_RFKILLED;
3508 else
3509 status = MGMT_STATUS_FAILED;
3510
3511 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3512
3513 mgmt_pending_remove(cmd);
3514
3515 return err;
3516 }
3517
3518 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3519 {
3520 struct cmd_lookup match = { NULL, hdev };
3521 bool changed = false;
3522 int err = 0;
3523
3524 if (discoverable) {
3525 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3526 changed = true;
3527 } else {
3528 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3529 changed = true;
3530 }
3531
3532 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3533 &match);
3534
3535 if (changed)
3536 err = new_settings(hdev, match.sk);
3537
3538 if (match.sk)
3539 sock_put(match.sk);
3540
3541 return err;
3542 }
3543
3544 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3545 {
3546 struct pending_cmd *cmd;
3547 bool changed = false;
3548 int err = 0;
3549
3550 if (connectable) {
3551 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3552 changed = true;
3553 } else {
3554 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3555 changed = true;
3556 }
3557
3558 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3559
3560 if (changed)
3561 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3562
3563 return err;
3564 }
3565
3566 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3567 {
3568 u8 mgmt_err = mgmt_status(status);
3569
3570 if (scan & SCAN_PAGE)
3571 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3572 cmd_status_rsp, &mgmt_err);
3573
3574 if (scan & SCAN_INQUIRY)
3575 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3576 cmd_status_rsp, &mgmt_err);
3577
3578 return 0;
3579 }
3580
3581 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3582 bool persistent)
3583 {
3584 struct mgmt_ev_new_link_key ev;
3585
3586 memset(&ev, 0, sizeof(ev));
3587
3588 ev.store_hint = persistent;
3589 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3590 ev.key.addr.type = BDADDR_BREDR;
3591 ev.key.type = key->type;
3592 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3593 ev.key.pin_len = key->pin_len;
3594
3595 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3596 }
3597
3598 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3599 {
3600 struct mgmt_ev_new_long_term_key ev;
3601
3602 memset(&ev, 0, sizeof(ev));
3603
3604 ev.store_hint = persistent;
3605 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3606 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3607 ev.key.authenticated = key->authenticated;
3608 ev.key.enc_size = key->enc_size;
3609 ev.key.ediv = key->ediv;
3610
3611 if (key->type == HCI_SMP_LTK)
3612 ev.key.master = 1;
3613
3614 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3615 memcpy(ev.key.val, key->val, sizeof(key->val));
3616
3617 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3618 NULL);
3619 }
3620
3621 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3622 u8 addr_type, u32 flags, u8 *name, u8 name_len,
3623 u8 *dev_class)
3624 {
3625 char buf[512];
3626 struct mgmt_ev_device_connected *ev = (void *) buf;
3627 u16 eir_len = 0;
3628
3629 bacpy(&ev->addr.bdaddr, bdaddr);
3630 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3631
3632 ev->flags = __cpu_to_le32(flags);
3633
3634 if (name_len > 0)
3635 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3636 name, name_len);
3637
3638 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3639 eir_len = eir_append_data(ev->eir, eir_len,
3640 EIR_CLASS_OF_DEV, dev_class, 3);
3641
3642 ev->eir_len = cpu_to_le16(eir_len);
3643
3644 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3645 sizeof(*ev) + eir_len, NULL);
3646 }
3647
3648 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3649 {
3650 struct mgmt_cp_disconnect *cp = cmd->param;
3651 struct sock **sk = data;
3652 struct mgmt_rp_disconnect rp;
3653
3654 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3655 rp.addr.type = cp->addr.type;
3656
3657 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3658 sizeof(rp));
3659
3660 *sk = cmd->sk;
3661 sock_hold(*sk);
3662
3663 mgmt_pending_remove(cmd);
3664 }
3665
3666 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3667 {
3668 struct hci_dev *hdev = data;
3669 struct mgmt_cp_unpair_device *cp = cmd->param;
3670 struct mgmt_rp_unpair_device rp;
3671
3672 memset(&rp, 0, sizeof(rp));
3673 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3674 rp.addr.type = cp->addr.type;
3675
3676 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3677
3678 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3679
3680 mgmt_pending_remove(cmd);
3681 }
3682
3683 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3684 u8 link_type, u8 addr_type, u8 reason)
3685 {
3686 struct mgmt_ev_device_disconnected ev;
3687 struct sock *sk = NULL;
3688 int err;
3689
3690 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3691
3692 bacpy(&ev.addr.bdaddr, bdaddr);
3693 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3694 ev.reason = reason;
3695
3696 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3697 sk);
3698
3699 if (sk)
3700 sock_put(sk);
3701
3702 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3703 hdev);
3704
3705 return err;
3706 }
3707
3708 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3709 u8 link_type, u8 addr_type, u8 status)
3710 {
3711 struct mgmt_rp_disconnect rp;
3712 struct pending_cmd *cmd;
3713 int err;
3714
3715 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3716 hdev);
3717
3718 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3719 if (!cmd)
3720 return -ENOENT;
3721
3722 bacpy(&rp.addr.bdaddr, bdaddr);
3723 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3724
3725 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3726 mgmt_status(status), &rp, sizeof(rp));
3727
3728 mgmt_pending_remove(cmd);
3729
3730 return err;
3731 }
3732
3733 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3734 u8 addr_type, u8 status)
3735 {
3736 struct mgmt_ev_connect_failed ev;
3737
3738 bacpy(&ev.addr.bdaddr, bdaddr);
3739 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3740 ev.status = mgmt_status(status);
3741
3742 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3743 }
3744
3745 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3746 {
3747 struct mgmt_ev_pin_code_request ev;
3748
3749 bacpy(&ev.addr.bdaddr, bdaddr);
3750 ev.addr.type = BDADDR_BREDR;
3751 ev.secure = secure;
3752
3753 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3754 NULL);
3755 }
3756
3757 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3758 u8 status)
3759 {
3760 struct pending_cmd *cmd;
3761 struct mgmt_rp_pin_code_reply rp;
3762 int err;
3763
3764 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3765 if (!cmd)
3766 return -ENOENT;
3767
3768 bacpy(&rp.addr.bdaddr, bdaddr);
3769 rp.addr.type = BDADDR_BREDR;
3770
3771 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3772 mgmt_status(status), &rp, sizeof(rp));
3773
3774 mgmt_pending_remove(cmd);
3775
3776 return err;
3777 }
3778
3779 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3780 u8 status)
3781 {
3782 struct pending_cmd *cmd;
3783 struct mgmt_rp_pin_code_reply rp;
3784 int err;
3785
3786 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3787 if (!cmd)
3788 return -ENOENT;
3789
3790 bacpy(&rp.addr.bdaddr, bdaddr);
3791 rp.addr.type = BDADDR_BREDR;
3792
3793 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3794 mgmt_status(status), &rp, sizeof(rp));
3795
3796 mgmt_pending_remove(cmd);
3797
3798 return err;
3799 }
3800
3801 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3802 u8 link_type, u8 addr_type, __le32 value,
3803 u8 confirm_hint)
3804 {
3805 struct mgmt_ev_user_confirm_request ev;
3806
3807 BT_DBG("%s", hdev->name);
3808
3809 bacpy(&ev.addr.bdaddr, bdaddr);
3810 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3811 ev.confirm_hint = confirm_hint;
3812 ev.value = value;
3813
3814 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3815 NULL);
3816 }
3817
3818 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3819 u8 link_type, u8 addr_type)
3820 {
3821 struct mgmt_ev_user_passkey_request ev;
3822
3823 BT_DBG("%s", hdev->name);
3824
3825 bacpy(&ev.addr.bdaddr, bdaddr);
3826 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3827
3828 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3829 NULL);
3830 }
3831
3832 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3833 u8 link_type, u8 addr_type, u8 status,
3834 u8 opcode)
3835 {
3836 struct pending_cmd *cmd;
3837 struct mgmt_rp_user_confirm_reply rp;
3838 int err;
3839
3840 cmd = mgmt_pending_find(opcode, hdev);
3841 if (!cmd)
3842 return -ENOENT;
3843
3844 bacpy(&rp.addr.bdaddr, bdaddr);
3845 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3846 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3847 &rp, sizeof(rp));
3848
3849 mgmt_pending_remove(cmd);
3850
3851 return err;
3852 }
3853
3854 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3855 u8 link_type, u8 addr_type, u8 status)
3856 {
3857 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3858 status, MGMT_OP_USER_CONFIRM_REPLY);
3859 }
3860
3861 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3862 u8 link_type, u8 addr_type, u8 status)
3863 {
3864 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3865 status,
3866 MGMT_OP_USER_CONFIRM_NEG_REPLY);
3867 }
3868
3869 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3870 u8 link_type, u8 addr_type, u8 status)
3871 {
3872 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3873 status, MGMT_OP_USER_PASSKEY_REPLY);
3874 }
3875
3876 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3877 u8 link_type, u8 addr_type, u8 status)
3878 {
3879 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3880 status,
3881 MGMT_OP_USER_PASSKEY_NEG_REPLY);
3882 }
3883
3884 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3885 u8 link_type, u8 addr_type, u32 passkey,
3886 u8 entered)
3887 {
3888 struct mgmt_ev_passkey_notify ev;
3889
3890 BT_DBG("%s", hdev->name);
3891
3892 bacpy(&ev.addr.bdaddr, bdaddr);
3893 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3894 ev.passkey = __cpu_to_le32(passkey);
3895 ev.entered = entered;
3896
3897 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3898 }
3899
3900 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3901 u8 addr_type, u8 status)
3902 {
3903 struct mgmt_ev_auth_failed ev;
3904
3905 bacpy(&ev.addr.bdaddr, bdaddr);
3906 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3907 ev.status = mgmt_status(status);
3908
3909 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3910 }
3911
3912 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3913 {
3914 struct cmd_lookup match = { NULL, hdev };
3915 bool changed = false;
3916 int err = 0;
3917
3918 if (status) {
3919 u8 mgmt_err = mgmt_status(status);
3920 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3921 cmd_status_rsp, &mgmt_err);
3922 return 0;
3923 }
3924
3925 if (test_bit(HCI_AUTH, &hdev->flags)) {
3926 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3927 changed = true;
3928 } else {
3929 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3930 changed = true;
3931 }
3932
3933 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3934 &match);
3935
3936 if (changed)
3937 err = new_settings(hdev, match.sk);
3938
3939 if (match.sk)
3940 sock_put(match.sk);
3941
3942 return err;
3943 }
3944
3945 static void clear_eir(struct hci_request *req)
3946 {
3947 struct hci_dev *hdev = req->hdev;
3948 struct hci_cp_write_eir cp;
3949
3950 if (!lmp_ext_inq_capable(hdev))
3951 return;
3952
3953 memset(hdev->eir, 0, sizeof(hdev->eir));
3954
3955 memset(&cp, 0, sizeof(cp));
3956
3957 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3958 }
3959
3960 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3961 {
3962 struct cmd_lookup match = { NULL, hdev };
3963 struct hci_request req;
3964 bool changed = false;
3965 int err = 0;
3966
3967 if (status) {
3968 u8 mgmt_err = mgmt_status(status);
3969
3970 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3971 &hdev->dev_flags))
3972 err = new_settings(hdev, NULL);
3973
3974 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3975 &mgmt_err);
3976
3977 return err;
3978 }
3979
3980 if (enable) {
3981 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3982 changed = true;
3983 } else {
3984 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3985 changed = true;
3986 }
3987
3988 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3989
3990 if (changed)
3991 err = new_settings(hdev, match.sk);
3992
3993 if (match.sk)
3994 sock_put(match.sk);
3995
3996 hci_req_init(&req, hdev);
3997
3998 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3999 update_eir(&req);
4000 else
4001 clear_eir(&req);
4002
4003 hci_req_run(&req, NULL);
4004
4005 return err;
4006 }
4007
4008 static void sk_lookup(struct pending_cmd *cmd, void *data)
4009 {
4010 struct cmd_lookup *match = data;
4011
4012 if (match->sk == NULL) {
4013 match->sk = cmd->sk;
4014 sock_hold(match->sk);
4015 }
4016 }
4017
4018 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4019 u8 status)
4020 {
4021 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4022 int err = 0;
4023
4024 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4025 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4026 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4027
4028 if (!status)
4029 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4030 3, NULL);
4031
4032 if (match.sk)
4033 sock_put(match.sk);
4034
4035 return err;
4036 }
4037
4038 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4039 {
4040 struct mgmt_cp_set_local_name ev;
4041 struct pending_cmd *cmd;
4042
4043 if (status)
4044 return 0;
4045
4046 memset(&ev, 0, sizeof(ev));
4047 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4048 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4049
4050 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4051 if (!cmd) {
4052 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4053
4054 /* If this is a HCI command related to powering on the
4055 * HCI dev don't send any mgmt signals.
4056 */
4057 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4058 return 0;
4059 }
4060
4061 return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4062 cmd ? cmd->sk : NULL);
4063 }
4064
4065 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4066 u8 *randomizer, u8 status)
4067 {
4068 struct pending_cmd *cmd;
4069 int err;
4070
4071 BT_DBG("%s status %u", hdev->name, status);
4072
4073 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4074 if (!cmd)
4075 return -ENOENT;
4076
4077 if (status) {
4078 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4079 mgmt_status(status));
4080 } else {
4081 struct mgmt_rp_read_local_oob_data rp;
4082
4083 memcpy(rp.hash, hash, sizeof(rp.hash));
4084 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4085
4086 err = cmd_complete(cmd->sk, hdev->id,
4087 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4088 sizeof(rp));
4089 }
4090
4091 mgmt_pending_remove(cmd);
4092
4093 return err;
4094 }
4095
4096 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4097 {
4098 struct cmd_lookup match = { NULL, hdev };
4099 bool changed = false;
4100 int err = 0;
4101
4102 if (status) {
4103 u8 mgmt_err = mgmt_status(status);
4104
4105 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
4106 &hdev->dev_flags))
4107 err = new_settings(hdev, NULL);
4108
4109 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
4110 &mgmt_err);
4111
4112 return err;
4113 }
4114
4115 if (enable) {
4116 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4117 changed = true;
4118 } else {
4119 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4120 changed = true;
4121 }
4122
4123 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4124
4125 if (changed)
4126 err = new_settings(hdev, match.sk);
4127
4128 if (match.sk)
4129 sock_put(match.sk);
4130
4131 return err;
4132 }
4133
4134 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4135 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4136 ssp, u8 *eir, u16 eir_len)
4137 {
4138 char buf[512];
4139 struct mgmt_ev_device_found *ev = (void *) buf;
4140 size_t ev_size;
4141
4142 /* Leave 5 bytes for a potential CoD field */
4143 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4144 return -EINVAL;
4145
4146 memset(buf, 0, sizeof(buf));
4147
4148 bacpy(&ev->addr.bdaddr, bdaddr);
4149 ev->addr.type = link_to_bdaddr(link_type, addr_type);
4150 ev->rssi = rssi;
4151 if (cfm_name)
4152 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4153 if (!ssp)
4154 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4155
4156 if (eir_len > 0)
4157 memcpy(ev->eir, eir, eir_len);
4158
4159 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4160 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4161 dev_class, 3);
4162
4163 ev->eir_len = cpu_to_le16(eir_len);
4164 ev_size = sizeof(*ev) + eir_len;
4165
4166 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4167 }
4168
4169 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4170 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4171 {
4172 struct mgmt_ev_device_found *ev;
4173 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4174 u16 eir_len;
4175
4176 ev = (struct mgmt_ev_device_found *) buf;
4177
4178 memset(buf, 0, sizeof(buf));
4179
4180 bacpy(&ev->addr.bdaddr, bdaddr);
4181 ev->addr.type = link_to_bdaddr(link_type, addr_type);
4182 ev->rssi = rssi;
4183
4184 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4185 name_len);
4186
4187 ev->eir_len = cpu_to_le16(eir_len);
4188
4189 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4190 sizeof(*ev) + eir_len, NULL);
4191 }
4192
4193 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
4194 {
4195 struct pending_cmd *cmd;
4196 u8 type;
4197 int err;
4198
4199 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4200
4201 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4202 if (!cmd)
4203 return -ENOENT;
4204
4205 type = hdev->discovery.type;
4206
4207 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4208 &type, sizeof(type));
4209 mgmt_pending_remove(cmd);
4210
4211 return err;
4212 }
4213
4214 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
4215 {
4216 struct pending_cmd *cmd;
4217 int err;
4218
4219 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4220 if (!cmd)
4221 return -ENOENT;
4222
4223 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
4224 &hdev->discovery.type, sizeof(hdev->discovery.type));
4225 mgmt_pending_remove(cmd);
4226
4227 return err;
4228 }
4229
4230 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4231 {
4232 struct mgmt_ev_discovering ev;
4233 struct pending_cmd *cmd;
4234
4235 BT_DBG("%s discovering %u", hdev->name, discovering);
4236
4237 if (discovering)
4238 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4239 else
4240 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4241
4242 if (cmd != NULL) {
4243 u8 type = hdev->discovery.type;
4244
4245 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4246 sizeof(type));
4247 mgmt_pending_remove(cmd);
4248 }
4249
4250 memset(&ev, 0, sizeof(ev));
4251 ev.type = hdev->discovery.type;
4252 ev.discovering = discovering;
4253
4254 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4255 }
4256
4257 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4258 {
4259 struct pending_cmd *cmd;
4260 struct mgmt_ev_device_blocked ev;
4261
4262 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4263
4264 bacpy(&ev.addr.bdaddr, bdaddr);
4265 ev.addr.type = type;
4266
4267 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4268 cmd ? cmd->sk : NULL);
4269 }
4270
4271 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4272 {
4273 struct pending_cmd *cmd;
4274 struct mgmt_ev_device_unblocked ev;
4275
4276 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4277
4278 bacpy(&ev.addr.bdaddr, bdaddr);
4279 ev.addr.type = type;
4280
4281 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4282 cmd ? cmd->sk : NULL);
4283 }
4284
4285 module_param(enable_hs, bool, 0644);
4286 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
ubuntu-bionic-kernel mirror