?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Linux 3.12.28
[linux/fpc-iii.git] / net / bluetooth / mgmt.c
blob211fffb5dca8623f31a4216cc6a8a9e61ad52e2b
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/mgmt.h>
33 #include <net/bluetooth/smp.h>
34
35 bool enable_hs;
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 3
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 };
80
81 static const u16 mgmt_events[] = {
82 MGMT_EV_CONTROLLER_ERROR,
83 MGMT_EV_INDEX_ADDED,
84 MGMT_EV_INDEX_REMOVED,
85 MGMT_EV_NEW_SETTINGS,
86 MGMT_EV_CLASS_OF_DEV_CHANGED,
87 MGMT_EV_LOCAL_NAME_CHANGED,
88 MGMT_EV_NEW_LINK_KEY,
89 MGMT_EV_NEW_LONG_TERM_KEY,
90 MGMT_EV_DEVICE_CONNECTED,
91 MGMT_EV_DEVICE_DISCONNECTED,
92 MGMT_EV_CONNECT_FAILED,
93 MGMT_EV_PIN_CODE_REQUEST,
94 MGMT_EV_USER_CONFIRM_REQUEST,
95 MGMT_EV_USER_PASSKEY_REQUEST,
96 MGMT_EV_AUTH_FAILED,
97 MGMT_EV_DEVICE_FOUND,
98 MGMT_EV_DISCOVERING,
99 MGMT_EV_DEVICE_BLOCKED,
100 MGMT_EV_DEVICE_UNBLOCKED,
101 MGMT_EV_DEVICE_UNPAIRED,
102 MGMT_EV_PASSKEY_NOTIFY,
103 };
104
105 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
106
107 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
108 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
109
110 struct pending_cmd {
111 struct list_head list;
112 u16 opcode;
113 int index;
114 void *param;
115 struct sock *sk;
116 void *user_data;
117 };
118
119 /* HCI to MGMT error code conversion table */
120 static u8 mgmt_status_table[] = {
121 MGMT_STATUS_SUCCESS,
122 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
123 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
124 MGMT_STATUS_FAILED, /* Hardware Failure */
125 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
126 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
127 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
128 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
129 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
130 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
131 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
132 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
133 MGMT_STATUS_BUSY, /* Command Disallowed */
134 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
135 MGMT_STATUS_REJECTED, /* Rejected Security */
136 MGMT_STATUS_REJECTED, /* Rejected Personal */
137 MGMT_STATUS_TIMEOUT, /* Host Timeout */
138 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
139 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
140 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
141 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
142 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
143 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
144 MGMT_STATUS_BUSY, /* Repeated Attempts */
145 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
146 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
147 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
148 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
149 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
150 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
151 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
152 MGMT_STATUS_FAILED, /* Unspecified Error */
153 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
154 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
155 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
156 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
157 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
158 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
159 MGMT_STATUS_FAILED, /* Unit Link Key Used */
160 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
161 MGMT_STATUS_TIMEOUT, /* Instant Passed */
162 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
163 MGMT_STATUS_FAILED, /* Transaction Collision */
164 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
165 MGMT_STATUS_REJECTED, /* QoS Rejected */
166 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
167 MGMT_STATUS_REJECTED, /* Insufficient Security */
168 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
169 MGMT_STATUS_BUSY, /* Role Switch Pending */
170 MGMT_STATUS_FAILED, /* Slot Violation */
171 MGMT_STATUS_FAILED, /* Role Switch Failed */
172 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
173 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
174 MGMT_STATUS_BUSY, /* Host Busy Pairing */
175 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
176 MGMT_STATUS_BUSY, /* Controller Busy */
177 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
178 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
179 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
180 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
181 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
182 };
183
184 bool mgmt_valid_hdev(struct hci_dev *hdev)
185 {
186 return hdev->dev_type == HCI_BREDR;
187 }
188
189 static u8 mgmt_status(u8 hci_status)
190 {
191 if (hci_status < ARRAY_SIZE(mgmt_status_table))
192 return mgmt_status_table[hci_status];
193
194 return MGMT_STATUS_FAILED;
195 }
196
197 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
198 {
199 struct sk_buff *skb;
200 struct mgmt_hdr *hdr;
201 struct mgmt_ev_cmd_status *ev;
202 int err;
203
204 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
205
206 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
207 if (!skb)
208 return -ENOMEM;
209
210 hdr = (void *) skb_put(skb, sizeof(*hdr));
211
212 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
213 hdr->index = cpu_to_le16(index);
214 hdr->len = cpu_to_le16(sizeof(*ev));
215
216 ev = (void *) skb_put(skb, sizeof(*ev));
217 ev->status = status;
218 ev->opcode = cpu_to_le16(cmd);
219
220 err = sock_queue_rcv_skb(sk, skb);
221 if (err < 0)
222 kfree_skb(skb);
223
224 return err;
225 }
226
227 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
228 void *rp, size_t rp_len)
229 {
230 struct sk_buff *skb;
231 struct mgmt_hdr *hdr;
232 struct mgmt_ev_cmd_complete *ev;
233 int err;
234
235 BT_DBG("sock %p", sk);
236
237 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
238 if (!skb)
239 return -ENOMEM;
240
241 hdr = (void *) skb_put(skb, sizeof(*hdr));
242
243 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
244 hdr->index = cpu_to_le16(index);
245 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
246
247 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
248 ev->opcode = cpu_to_le16(cmd);
249 ev->status = status;
250
251 if (rp)
252 memcpy(ev->data, rp, rp_len);
253
254 err = sock_queue_rcv_skb(sk, skb);
255 if (err < 0)
256 kfree_skb(skb);
257
258 return err;
259 }
260
261 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
262 u16 data_len)
263 {
264 struct mgmt_rp_read_version rp;
265
266 BT_DBG("sock %p", sk);
267
268 rp.version = MGMT_VERSION;
269 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
270
271 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
272 sizeof(rp));
273 }
274
275 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
276 u16 data_len)
277 {
278 struct mgmt_rp_read_commands *rp;
279 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
280 const u16 num_events = ARRAY_SIZE(mgmt_events);
281 __le16 *opcode;
282 size_t rp_size;
283 int i, err;
284
285 BT_DBG("sock %p", sk);
286
287 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
288
289 rp = kmalloc(rp_size, GFP_KERNEL);
290 if (!rp)
291 return -ENOMEM;
292
293 rp->num_commands = __constant_cpu_to_le16(num_commands);
294 rp->num_events = __constant_cpu_to_le16(num_events);
295
296 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
297 put_unaligned_le16(mgmt_commands[i], opcode);
298
299 for (i = 0; i < num_events; i++, opcode++)
300 put_unaligned_le16(mgmt_events[i], opcode);
301
302 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
303 rp_size);
304 kfree(rp);
305
306 return err;
307 }
308
309 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
310 u16 data_len)
311 {
312 struct mgmt_rp_read_index_list *rp;
313 struct hci_dev *d;
314 size_t rp_len;
315 u16 count;
316 int err;
317
318 BT_DBG("sock %p", sk);
319
320 read_lock(&hci_dev_list_lock);
321
322 count = 0;
323 list_for_each_entry(d, &hci_dev_list, list) {
324 if (!mgmt_valid_hdev(d))
325 continue;
326
327 count++;
328 }
329
330 rp_len = sizeof(*rp) + (2 * count);
331 rp = kmalloc(rp_len, GFP_ATOMIC);
332 if (!rp) {
333 read_unlock(&hci_dev_list_lock);
334 return -ENOMEM;
335 }
336
337 count = 0;
338 list_for_each_entry(d, &hci_dev_list, list) {
339 if (test_bit(HCI_SETUP, &d->dev_flags))
340 continue;
341
342 if (!mgmt_valid_hdev(d))
343 continue;
344
345 rp->index[count++] = cpu_to_le16(d->id);
346 BT_DBG("Added hci%u", d->id);
347 }
348
349 rp->num_controllers = cpu_to_le16(count);
350 rp_len = sizeof(*rp) + (2 * count);
351
352 read_unlock(&hci_dev_list_lock);
353
354 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
355 rp_len);
356
357 kfree(rp);
358
359 return err;
360 }
361
362 static u32 get_supported_settings(struct hci_dev *hdev)
363 {
364 u32 settings = 0;
365
366 settings |= MGMT_SETTING_POWERED;
367 settings |= MGMT_SETTING_PAIRABLE;
368
369 if (lmp_ssp_capable(hdev))
370 settings |= MGMT_SETTING_SSP;
371
372 if (lmp_bredr_capable(hdev)) {
373 settings |= MGMT_SETTING_CONNECTABLE;
374 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
375 settings |= MGMT_SETTING_FAST_CONNECTABLE;
376 settings |= MGMT_SETTING_DISCOVERABLE;
377 settings |= MGMT_SETTING_BREDR;
378 settings |= MGMT_SETTING_LINK_SECURITY;
379 }
380
381 if (enable_hs)
382 settings |= MGMT_SETTING_HS;
383
384 if (lmp_le_capable(hdev))
385 settings |= MGMT_SETTING_LE;
386
387 return settings;
388 }
389
390 static u32 get_current_settings(struct hci_dev *hdev)
391 {
392 u32 settings = 0;
393
394 if (hdev_is_powered(hdev))
395 settings |= MGMT_SETTING_POWERED;
396
397 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
398 settings |= MGMT_SETTING_CONNECTABLE;
399
400 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
401 settings |= MGMT_SETTING_FAST_CONNECTABLE;
402
403 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
404 settings |= MGMT_SETTING_DISCOVERABLE;
405
406 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
407 settings |= MGMT_SETTING_PAIRABLE;
408
409 if (lmp_bredr_capable(hdev))
410 settings |= MGMT_SETTING_BREDR;
411
412 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
413 settings |= MGMT_SETTING_LE;
414
415 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
416 settings |= MGMT_SETTING_LINK_SECURITY;
417
418 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
419 settings |= MGMT_SETTING_SSP;
420
421 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
422 settings |= MGMT_SETTING_HS;
423
424 return settings;
425 }
426
427 #define PNP_INFO_SVCLASS_ID 0x1200
428
429 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
430 {
431 u8 *ptr = data, *uuids_start = NULL;
432 struct bt_uuid *uuid;
433
434 if (len < 4)
435 return ptr;
436
437 list_for_each_entry(uuid, &hdev->uuids, list) {
438 u16 uuid16;
439
440 if (uuid->size != 16)
441 continue;
442
443 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
444 if (uuid16 < 0x1100)
445 continue;
446
447 if (uuid16 == PNP_INFO_SVCLASS_ID)
448 continue;
449
450 if (!uuids_start) {
451 uuids_start = ptr;
452 uuids_start[0] = 1;
453 uuids_start[1] = EIR_UUID16_ALL;
454 ptr += 2;
455 }
456
457 /* Stop if not enough space to put next UUID */
458 if ((ptr - data) + sizeof(u16) > len) {
459 uuids_start[1] = EIR_UUID16_SOME;
460 break;
461 }
462
463 *ptr++ = (uuid16 & 0x00ff);
464 *ptr++ = (uuid16 & 0xff00) >> 8;
465 uuids_start[0] += sizeof(uuid16);
466 }
467
468 return ptr;
469 }
470
471 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
472 {
473 u8 *ptr = data, *uuids_start = NULL;
474 struct bt_uuid *uuid;
475
476 if (len < 6)
477 return ptr;
478
479 list_for_each_entry(uuid, &hdev->uuids, list) {
480 if (uuid->size != 32)
481 continue;
482
483 if (!uuids_start) {
484 uuids_start = ptr;
485 uuids_start[0] = 1;
486 uuids_start[1] = EIR_UUID32_ALL;
487 ptr += 2;
488 }
489
490 /* Stop if not enough space to put next UUID */
491 if ((ptr - data) + sizeof(u32) > len) {
492 uuids_start[1] = EIR_UUID32_SOME;
493 break;
494 }
495
496 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
497 ptr += sizeof(u32);
498 uuids_start[0] += sizeof(u32);
499 }
500
501 return ptr;
502 }
503
504 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
505 {
506 u8 *ptr = data, *uuids_start = NULL;
507 struct bt_uuid *uuid;
508
509 if (len < 18)
510 return ptr;
511
512 list_for_each_entry(uuid, &hdev->uuids, list) {
513 if (uuid->size != 128)
514 continue;
515
516 if (!uuids_start) {
517 uuids_start = ptr;
518 uuids_start[0] = 1;
519 uuids_start[1] = EIR_UUID128_ALL;
520 ptr += 2;
521 }
522
523 /* Stop if not enough space to put next UUID */
524 if ((ptr - data) + 16 > len) {
525 uuids_start[1] = EIR_UUID128_SOME;
526 break;
527 }
528
529 memcpy(ptr, uuid->uuid, 16);
530 ptr += 16;
531 uuids_start[0] += 16;
532 }
533
534 return ptr;
535 }
536
537 static void create_eir(struct hci_dev *hdev, u8 *data)
538 {
539 u8 *ptr = data;
540 size_t name_len;
541
542 name_len = strlen(hdev->dev_name);
543
544 if (name_len > 0) {
545 /* EIR Data type */
546 if (name_len > 48) {
547 name_len = 48;
548 ptr[1] = EIR_NAME_SHORT;
549 } else
550 ptr[1] = EIR_NAME_COMPLETE;
551
552 /* EIR Data length */
553 ptr[0] = name_len + 1;
554
555 memcpy(ptr + 2, hdev->dev_name, name_len);
556
557 ptr += (name_len + 2);
558 }
559
560 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
561 ptr[0] = 2;
562 ptr[1] = EIR_TX_POWER;
563 ptr[2] = (u8) hdev->inq_tx_power;
564
565 ptr += 3;
566 }
567
568 if (hdev->devid_source > 0) {
569 ptr[0] = 9;
570 ptr[1] = EIR_DEVICE_ID;
571
572 put_unaligned_le16(hdev->devid_source, ptr + 2);
573 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
574 put_unaligned_le16(hdev->devid_product, ptr + 6);
575 put_unaligned_le16(hdev->devid_version, ptr + 8);
576
577 ptr += 10;
578 }
579
580 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
581 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
582 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
583 }
584
585 static void update_eir(struct hci_request *req)
586 {
587 struct hci_dev *hdev = req->hdev;
588 struct hci_cp_write_eir cp;
589
590 if (!hdev_is_powered(hdev))
591 return;
592
593 if (!lmp_ext_inq_capable(hdev))
594 return;
595
596 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
597 return;
598
599 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
600 return;
601
602 memset(&cp, 0, sizeof(cp));
603
604 create_eir(hdev, cp.data);
605
606 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
607 return;
608
609 memcpy(hdev->eir, cp.data, sizeof(cp.data));
610
611 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
612 }
613
614 static u8 get_service_classes(struct hci_dev *hdev)
615 {
616 struct bt_uuid *uuid;
617 u8 val = 0;
618
619 list_for_each_entry(uuid, &hdev->uuids, list)
620 val |= uuid->svc_hint;
621
622 return val;
623 }
624
625 static void update_class(struct hci_request *req)
626 {
627 struct hci_dev *hdev = req->hdev;
628 u8 cod[3];
629
630 BT_DBG("%s", hdev->name);
631
632 if (!hdev_is_powered(hdev))
633 return;
634
635 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
636 return;
637
638 cod[0] = hdev->minor_class;
639 cod[1] = hdev->major_class;
640 cod[2] = get_service_classes(hdev);
641
642 if (memcmp(cod, hdev->dev_class, 3) == 0)
643 return;
644
645 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
646 }
647
648 static void service_cache_off(struct work_struct *work)
649 {
650 struct hci_dev *hdev = container_of(work, struct hci_dev,
651 service_cache.work);
652 struct hci_request req;
653
654 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
655 return;
656
657 hci_req_init(&req, hdev);
658
659 hci_dev_lock(hdev);
660
661 update_eir(&req);
662 update_class(&req);
663
664 hci_dev_unlock(hdev);
665
666 hci_req_run(&req, NULL);
667 }
668
669 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
670 {
671 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
672 return;
673
674 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
675
676 /* Non-mgmt controlled devices get this bit set
677 * implicitly so that pairing works for them, however
678 * for mgmt we require user-space to explicitly enable
679 * it
680 */
681 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
682 }
683
684 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
685 void *data, u16 data_len)
686 {
687 struct mgmt_rp_read_info rp;
688
689 BT_DBG("sock %p %s", sk, hdev->name);
690
691 hci_dev_lock(hdev);
692
693 memset(&rp, 0, sizeof(rp));
694
695 bacpy(&rp.bdaddr, &hdev->bdaddr);
696
697 rp.version = hdev->hci_ver;
698 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
699
700 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
701 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
702
703 memcpy(rp.dev_class, hdev->dev_class, 3);
704
705 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
706 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
707
708 hci_dev_unlock(hdev);
709
710 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
711 sizeof(rp));
712 }
713
714 static void mgmt_pending_free(struct pending_cmd *cmd)
715 {
716 sock_put(cmd->sk);
717 kfree(cmd->param);
718 kfree(cmd);
719 }
720
721 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
722 struct hci_dev *hdev, void *data,
723 u16 len)
724 {
725 struct pending_cmd *cmd;
726
727 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
728 if (!cmd)
729 return NULL;
730
731 cmd->opcode = opcode;
732 cmd->index = hdev->id;
733
734 cmd->param = kmalloc(len, GFP_KERNEL);
735 if (!cmd->param) {
736 kfree(cmd);
737 return NULL;
738 }
739
740 if (data)
741 memcpy(cmd->param, data, len);
742
743 cmd->sk = sk;
744 sock_hold(sk);
745
746 list_add(&cmd->list, &hdev->mgmt_pending);
747
748 return cmd;
749 }
750
751 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
752 void (*cb)(struct pending_cmd *cmd,
753 void *data),
754 void *data)
755 {
756 struct pending_cmd *cmd, *tmp;
757
758 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
759 if (opcode > 0 && cmd->opcode != opcode)
760 continue;
761
762 cb(cmd, data);
763 }
764 }
765
766 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
767 {
768 struct pending_cmd *cmd;
769
770 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
771 if (cmd->opcode == opcode)
772 return cmd;
773 }
774
775 return NULL;
776 }
777
778 static void mgmt_pending_remove(struct pending_cmd *cmd)
779 {
780 list_del(&cmd->list);
781 mgmt_pending_free(cmd);
782 }
783
784 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
785 {
786 __le32 settings = cpu_to_le32(get_current_settings(hdev));
787
788 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
789 sizeof(settings));
790 }
791
792 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
793 u16 len)
794 {
795 struct mgmt_mode *cp = data;
796 struct pending_cmd *cmd;
797 int err;
798
799 BT_DBG("request for %s", hdev->name);
800
801 if (cp->val != 0x00 && cp->val != 0x01)
802 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
803 MGMT_STATUS_INVALID_PARAMS);
804
805 hci_dev_lock(hdev);
806
807 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
808 cancel_delayed_work(&hdev->power_off);
809
810 if (cp->val) {
811 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
812 data, len);
813 err = mgmt_powered(hdev, 1);
814 goto failed;
815 }
816 }
817
818 if (!!cp->val == hdev_is_powered(hdev)) {
819 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
820 goto failed;
821 }
822
823 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
824 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
825 MGMT_STATUS_BUSY);
826 goto failed;
827 }
828
829 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
830 if (!cmd) {
831 err = -ENOMEM;
832 goto failed;
833 }
834
835 if (cp->val)
836 queue_work(hdev->req_workqueue, &hdev->power_on);
837 else
838 queue_work(hdev->req_workqueue, &hdev->power_off.work);
839
840 err = 0;
841
842 failed:
843 hci_dev_unlock(hdev);
844 return err;
845 }
846
847 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
848 struct sock *skip_sk)
849 {
850 struct sk_buff *skb;
851 struct mgmt_hdr *hdr;
852
853 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
854 if (!skb)
855 return -ENOMEM;
856
857 hdr = (void *) skb_put(skb, sizeof(*hdr));
858 hdr->opcode = cpu_to_le16(event);
859 if (hdev)
860 hdr->index = cpu_to_le16(hdev->id);
861 else
862 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
863 hdr->len = cpu_to_le16(data_len);
864
865 if (data)
866 memcpy(skb_put(skb, data_len), data, data_len);
867
868 /* Time stamp */
869 __net_timestamp(skb);
870
871 hci_send_to_control(skb, skip_sk);
872 kfree_skb(skb);
873
874 return 0;
875 }
876
877 static int new_settings(struct hci_dev *hdev, struct sock *skip)
878 {
879 __le32 ev;
880
881 ev = cpu_to_le32(get_current_settings(hdev));
882
883 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
884 }
885
886 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
887 u16 len)
888 {
889 struct mgmt_cp_set_discoverable *cp = data;
890 struct pending_cmd *cmd;
891 u16 timeout;
892 u8 scan;
893 int err;
894
895 BT_DBG("request for %s", hdev->name);
896
897 if (!lmp_bredr_capable(hdev))
898 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
899 MGMT_STATUS_NOT_SUPPORTED);
900
901 if (cp->val != 0x00 && cp->val != 0x01)
902 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
903 MGMT_STATUS_INVALID_PARAMS);
904
905 timeout = __le16_to_cpu(cp->timeout);
906 if (!cp->val && timeout > 0)
907 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
908 MGMT_STATUS_INVALID_PARAMS);
909
910 hci_dev_lock(hdev);
911
912 if (!hdev_is_powered(hdev) && timeout > 0) {
913 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
914 MGMT_STATUS_NOT_POWERED);
915 goto failed;
916 }
917
918 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
919 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
920 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
921 MGMT_STATUS_BUSY);
922 goto failed;
923 }
924
925 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
926 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
927 MGMT_STATUS_REJECTED);
928 goto failed;
929 }
930
931 if (!hdev_is_powered(hdev)) {
932 bool changed = false;
933
934 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
935 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
936 changed = true;
937 }
938
939 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
940 if (err < 0)
941 goto failed;
942
943 if (changed)
944 err = new_settings(hdev, sk);
945
946 goto failed;
947 }
948
949 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
950 if (hdev->discov_timeout > 0) {
951 cancel_delayed_work(&hdev->discov_off);
952 hdev->discov_timeout = 0;
953 }
954
955 if (cp->val && timeout > 0) {
956 hdev->discov_timeout = timeout;
957 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
958 msecs_to_jiffies(hdev->discov_timeout * 1000));
959 }
960
961 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
962 goto failed;
963 }
964
965 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
966 if (!cmd) {
967 err = -ENOMEM;
968 goto failed;
969 }
970
971 scan = SCAN_PAGE;
972
973 if (cp->val)
974 scan |= SCAN_INQUIRY;
975 else
976 cancel_delayed_work(&hdev->discov_off);
977
978 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
979 if (err < 0)
980 mgmt_pending_remove(cmd);
981
982 if (cp->val)
983 hdev->discov_timeout = timeout;
984
985 failed:
986 hci_dev_unlock(hdev);
987 return err;
988 }
989
990 static void write_fast_connectable(struct hci_request *req, bool enable)
991 {
992 struct hci_dev *hdev = req->hdev;
993 struct hci_cp_write_page_scan_activity acp;
994 u8 type;
995
996 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
997 return;
998
999 if (enable) {
1000 type = PAGE_SCAN_TYPE_INTERLACED;
1001
1002 /* 160 msec page scan interval */
1003 acp.interval = __constant_cpu_to_le16(0x0100);
1004 } else {
1005 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1006
1007 /* default 1.28 sec page scan */
1008 acp.interval = __constant_cpu_to_le16(0x0800);
1009 }
1010
1011 acp.window = __constant_cpu_to_le16(0x0012);
1012
1013 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1014 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1015 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1016 sizeof(acp), &acp);
1017
1018 if (hdev->page_scan_type != type)
1019 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1020 }
1021
1022 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1023 {
1024 struct pending_cmd *cmd;
1025
1026 BT_DBG("status 0x%02x", status);
1027
1028 hci_dev_lock(hdev);
1029
1030 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1031 if (!cmd)
1032 goto unlock;
1033
1034 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1035
1036 mgmt_pending_remove(cmd);
1037
1038 unlock:
1039 hci_dev_unlock(hdev);
1040 }
1041
1042 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1043 u16 len)
1044 {
1045 struct mgmt_mode *cp = data;
1046 struct pending_cmd *cmd;
1047 struct hci_request req;
1048 u8 scan;
1049 int err;
1050
1051 BT_DBG("request for %s", hdev->name);
1052
1053 if (!lmp_bredr_capable(hdev))
1054 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1055 MGMT_STATUS_NOT_SUPPORTED);
1056
1057 if (cp->val != 0x00 && cp->val != 0x01)
1058 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1059 MGMT_STATUS_INVALID_PARAMS);
1060
1061 hci_dev_lock(hdev);
1062
1063 if (!hdev_is_powered(hdev)) {
1064 bool changed = false;
1065
1066 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1067 changed = true;
1068
1069 if (cp->val) {
1070 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1071 } else {
1072 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1073 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1074 }
1075
1076 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1077 if (err < 0)
1078 goto failed;
1079
1080 if (changed)
1081 err = new_settings(hdev, sk);
1082
1083 goto failed;
1084 }
1085
1086 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1087 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1088 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1089 MGMT_STATUS_BUSY);
1090 goto failed;
1091 }
1092
1093 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1094 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1095 goto failed;
1096 }
1097
1098 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1099 if (!cmd) {
1100 err = -ENOMEM;
1101 goto failed;
1102 }
1103
1104 if (cp->val) {
1105 scan = SCAN_PAGE;
1106 } else {
1107 scan = 0;
1108
1109 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1110 hdev->discov_timeout > 0)
1111 cancel_delayed_work(&hdev->discov_off);
1112 }
1113
1114 hci_req_init(&req, hdev);
1115
1116 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1117
1118 /* If we're going from non-connectable to connectable or
1119 * vice-versa when fast connectable is enabled ensure that fast
1120 * connectable gets disabled. write_fast_connectable won't do
1121 * anything if the page scan parameters are already what they
1122 * should be.
1123 */
1124 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1125 write_fast_connectable(&req, false);
1126
1127 err = hci_req_run(&req, set_connectable_complete);
1128 if (err < 0)
1129 mgmt_pending_remove(cmd);
1130
1131 failed:
1132 hci_dev_unlock(hdev);
1133 return err;
1134 }
1135
1136 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1137 u16 len)
1138 {
1139 struct mgmt_mode *cp = data;
1140 int err;
1141
1142 BT_DBG("request for %s", hdev->name);
1143
1144 if (cp->val != 0x00 && cp->val != 0x01)
1145 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE,
1146 MGMT_STATUS_INVALID_PARAMS);
1147
1148 hci_dev_lock(hdev);
1149
1150 if (cp->val)
1151 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1152 else
1153 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1154
1155 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1156 if (err < 0)
1157 goto failed;
1158
1159 err = new_settings(hdev, sk);
1160
1161 failed:
1162 hci_dev_unlock(hdev);
1163 return err;
1164 }
1165
1166 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1167 u16 len)
1168 {
1169 struct mgmt_mode *cp = data;
1170 struct pending_cmd *cmd;
1171 u8 val;
1172 int err;
1173
1174 BT_DBG("request for %s", hdev->name);
1175
1176 if (!lmp_bredr_capable(hdev))
1177 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1178 MGMT_STATUS_NOT_SUPPORTED);
1179
1180 if (cp->val != 0x00 && cp->val != 0x01)
1181 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1182 MGMT_STATUS_INVALID_PARAMS);
1183
1184 hci_dev_lock(hdev);
1185
1186 if (!hdev_is_powered(hdev)) {
1187 bool changed = false;
1188
1189 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1190 &hdev->dev_flags)) {
1191 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1192 changed = true;
1193 }
1194
1195 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1196 if (err < 0)
1197 goto failed;
1198
1199 if (changed)
1200 err = new_settings(hdev, sk);
1201
1202 goto failed;
1203 }
1204
1205 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1206 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1207 MGMT_STATUS_BUSY);
1208 goto failed;
1209 }
1210
1211 val = !!cp->val;
1212
1213 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1214 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1215 goto failed;
1216 }
1217
1218 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1219 if (!cmd) {
1220 err = -ENOMEM;
1221 goto failed;
1222 }
1223
1224 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1225 if (err < 0) {
1226 mgmt_pending_remove(cmd);
1227 goto failed;
1228 }
1229
1230 failed:
1231 hci_dev_unlock(hdev);
1232 return err;
1233 }
1234
1235 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1236 {
1237 struct mgmt_mode *cp = data;
1238 struct pending_cmd *cmd;
1239 u8 val;
1240 int err;
1241
1242 BT_DBG("request for %s", hdev->name);
1243
1244 if (!lmp_ssp_capable(hdev))
1245 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1246 MGMT_STATUS_NOT_SUPPORTED);
1247
1248 if (cp->val != 0x00 && cp->val != 0x01)
1249 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1250 MGMT_STATUS_INVALID_PARAMS);
1251
1252 hci_dev_lock(hdev);
1253
1254 val = !!cp->val;
1255
1256 if (!hdev_is_powered(hdev)) {
1257 bool changed = false;
1258
1259 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1260 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1261 changed = true;
1262 }
1263
1264 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1265 if (err < 0)
1266 goto failed;
1267
1268 if (changed)
1269 err = new_settings(hdev, sk);
1270
1271 goto failed;
1272 }
1273
1274 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1275 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1276 MGMT_STATUS_BUSY);
1277 goto failed;
1278 }
1279
1280 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1281 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1282 goto failed;
1283 }
1284
1285 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1286 if (!cmd) {
1287 err = -ENOMEM;
1288 goto failed;
1289 }
1290
1291 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1292 if (err < 0) {
1293 mgmt_pending_remove(cmd);
1294 goto failed;
1295 }
1296
1297 failed:
1298 hci_dev_unlock(hdev);
1299 return err;
1300 }
1301
1302 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1303 {
1304 struct mgmt_mode *cp = data;
1305
1306 BT_DBG("request for %s", hdev->name);
1307
1308 if (!enable_hs)
1309 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1310 MGMT_STATUS_NOT_SUPPORTED);
1311
1312 if (cp->val != 0x00 && cp->val != 0x01)
1313 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1314 MGMT_STATUS_INVALID_PARAMS);
1315
1316 if (cp->val)
1317 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1318 else
1319 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1320
1321 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1322 }
1323
1324 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1325 {
1326 struct mgmt_mode *cp = data;
1327 struct hci_cp_write_le_host_supported hci_cp;
1328 struct pending_cmd *cmd;
1329 int err;
1330 u8 val, enabled;
1331
1332 BT_DBG("request for %s", hdev->name);
1333
1334 if (!lmp_le_capable(hdev))
1335 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1336 MGMT_STATUS_NOT_SUPPORTED);
1337
1338 if (cp->val != 0x00 && cp->val != 0x01)
1339 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1340 MGMT_STATUS_INVALID_PARAMS);
1341
1342 /* LE-only devices do not allow toggling LE on/off */
1343 if (!lmp_bredr_capable(hdev))
1344 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1345 MGMT_STATUS_REJECTED);
1346
1347 hci_dev_lock(hdev);
1348
1349 val = !!cp->val;
1350 enabled = lmp_host_le_capable(hdev);
1351
1352 if (!hdev_is_powered(hdev) || val == enabled) {
1353 bool changed = false;
1354
1355 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1356 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1357 changed = true;
1358 }
1359
1360 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1361 if (err < 0)
1362 goto unlock;
1363
1364 if (changed)
1365 err = new_settings(hdev, sk);
1366
1367 goto unlock;
1368 }
1369
1370 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1371 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1372 MGMT_STATUS_BUSY);
1373 goto unlock;
1374 }
1375
1376 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1377 if (!cmd) {
1378 err = -ENOMEM;
1379 goto unlock;
1380 }
1381
1382 memset(&hci_cp, 0, sizeof(hci_cp));
1383
1384 if (val) {
1385 hci_cp.le = val;
1386 hci_cp.simul = lmp_le_br_capable(hdev);
1387 }
1388
1389 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1390 &hci_cp);
1391 if (err < 0)
1392 mgmt_pending_remove(cmd);
1393
1394 unlock:
1395 hci_dev_unlock(hdev);
1396 return err;
1397 }
1398
1399 /* This is a helper function to test for pending mgmt commands that can
1400 * cause CoD or EIR HCI commands. We can only allow one such pending
1401 * mgmt command at a time since otherwise we cannot easily track what
1402 * the current values are, will be, and based on that calculate if a new
1403 * HCI command needs to be sent and if yes with what value.
1404 */
1405 static bool pending_eir_or_class(struct hci_dev *hdev)
1406 {
1407 struct pending_cmd *cmd;
1408
1409 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1410 switch (cmd->opcode) {
1411 case MGMT_OP_ADD_UUID:
1412 case MGMT_OP_REMOVE_UUID:
1413 case MGMT_OP_SET_DEV_CLASS:
1414 case MGMT_OP_SET_POWERED:
1415 return true;
1416 }
1417 }
1418
1419 return false;
1420 }
1421
1422 static const u8 bluetooth_base_uuid[] = {
1423 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1424 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1425 };
1426
1427 static u8 get_uuid_size(const u8 *uuid)
1428 {
1429 u32 val;
1430
1431 if (memcmp(uuid, bluetooth_base_uuid, 12))
1432 return 128;
1433
1434 val = get_unaligned_le32(&uuid[12]);
1435 if (val > 0xffff)
1436 return 32;
1437
1438 return 16;
1439 }
1440
1441 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
1442 {
1443 struct pending_cmd *cmd;
1444
1445 hci_dev_lock(hdev);
1446
1447 cmd = mgmt_pending_find(mgmt_op, hdev);
1448 if (!cmd)
1449 goto unlock;
1450
1451 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
1452 hdev->dev_class, 3);
1453
1454 mgmt_pending_remove(cmd);
1455
1456 unlock:
1457 hci_dev_unlock(hdev);
1458 }
1459
1460 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
1461 {
1462 BT_DBG("status 0x%02x", status);
1463
1464 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
1465 }
1466
1467 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1468 {
1469 struct mgmt_cp_add_uuid *cp = data;
1470 struct pending_cmd *cmd;
1471 struct hci_request req;
1472 struct bt_uuid *uuid;
1473 int err;
1474
1475 BT_DBG("request for %s", hdev->name);
1476
1477 hci_dev_lock(hdev);
1478
1479 if (pending_eir_or_class(hdev)) {
1480 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1481 MGMT_STATUS_BUSY);
1482 goto failed;
1483 }
1484
1485 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1486 if (!uuid) {
1487 err = -ENOMEM;
1488 goto failed;
1489 }
1490
1491 memcpy(uuid->uuid, cp->uuid, 16);
1492 uuid->svc_hint = cp->svc_hint;
1493 uuid->size = get_uuid_size(cp->uuid);
1494
1495 list_add_tail(&uuid->list, &hdev->uuids);
1496
1497 hci_req_init(&req, hdev);
1498
1499 update_class(&req);
1500 update_eir(&req);
1501
1502 err = hci_req_run(&req, add_uuid_complete);
1503 if (err < 0) {
1504 if (err != -ENODATA)
1505 goto failed;
1506
1507 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1508 hdev->dev_class, 3);
1509 goto failed;
1510 }
1511
1512 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1513 if (!cmd) {
1514 err = -ENOMEM;
1515 goto failed;
1516 }
1517
1518 err = 0;
1519
1520 failed:
1521 hci_dev_unlock(hdev);
1522 return err;
1523 }
1524
1525 static bool enable_service_cache(struct hci_dev *hdev)
1526 {
1527 if (!hdev_is_powered(hdev))
1528 return false;
1529
1530 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1531 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
1532 CACHE_TIMEOUT);
1533 return true;
1534 }
1535
1536 return false;
1537 }
1538
1539 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
1540 {
1541 BT_DBG("status 0x%02x", status);
1542
1543 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
1544 }
1545
1546 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1547 u16 len)
1548 {
1549 struct mgmt_cp_remove_uuid *cp = data;
1550 struct pending_cmd *cmd;
1551 struct bt_uuid *match, *tmp;
1552 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1553 struct hci_request req;
1554 int err, found;
1555
1556 BT_DBG("request for %s", hdev->name);
1557
1558 hci_dev_lock(hdev);
1559
1560 if (pending_eir_or_class(hdev)) {
1561 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1562 MGMT_STATUS_BUSY);
1563 goto unlock;
1564 }
1565
1566 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1567 err = hci_uuids_clear(hdev);
1568
1569 if (enable_service_cache(hdev)) {
1570 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1571 0, hdev->dev_class, 3);
1572 goto unlock;
1573 }
1574
1575 goto update_class;
1576 }
1577
1578 found = 0;
1579
1580 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
1581 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1582 continue;
1583
1584 list_del(&match->list);
1585 kfree(match);
1586 found++;
1587 }
1588
1589 if (found == 0) {
1590 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1591 MGMT_STATUS_INVALID_PARAMS);
1592 goto unlock;
1593 }
1594
1595 update_class:
1596 hci_req_init(&req, hdev);
1597
1598 update_class(&req);
1599 update_eir(&req);
1600
1601 err = hci_req_run(&req, remove_uuid_complete);
1602 if (err < 0) {
1603 if (err != -ENODATA)
1604 goto unlock;
1605
1606 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1607 hdev->dev_class, 3);
1608 goto unlock;
1609 }
1610
1611 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1612 if (!cmd) {
1613 err = -ENOMEM;
1614 goto unlock;
1615 }
1616
1617 err = 0;
1618
1619 unlock:
1620 hci_dev_unlock(hdev);
1621 return err;
1622 }
1623
1624 static void set_class_complete(struct hci_dev *hdev, u8 status)
1625 {
1626 BT_DBG("status 0x%02x", status);
1627
1628 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
1629 }
1630
1631 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1632 u16 len)
1633 {
1634 struct mgmt_cp_set_dev_class *cp = data;
1635 struct pending_cmd *cmd;
1636 struct hci_request req;
1637 int err;
1638
1639 BT_DBG("request for %s", hdev->name);
1640
1641 if (!lmp_bredr_capable(hdev))
1642 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1643 MGMT_STATUS_NOT_SUPPORTED);
1644
1645 hci_dev_lock(hdev);
1646
1647 if (pending_eir_or_class(hdev)) {
1648 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1649 MGMT_STATUS_BUSY);
1650 goto unlock;
1651 }
1652
1653 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
1654 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1655 MGMT_STATUS_INVALID_PARAMS);
1656 goto unlock;
1657 }
1658
1659 hdev->major_class = cp->major;
1660 hdev->minor_class = cp->minor;
1661
1662 if (!hdev_is_powered(hdev)) {
1663 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1664 hdev->dev_class, 3);
1665 goto unlock;
1666 }
1667
1668 hci_req_init(&req, hdev);
1669
1670 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1671 hci_dev_unlock(hdev);
1672 cancel_delayed_work_sync(&hdev->service_cache);
1673 hci_dev_lock(hdev);
1674 update_eir(&req);
1675 }
1676
1677 update_class(&req);
1678
1679 err = hci_req_run(&req, set_class_complete);
1680 if (err < 0) {
1681 if (err != -ENODATA)
1682 goto unlock;
1683
1684 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1685 hdev->dev_class, 3);
1686 goto unlock;
1687 }
1688
1689 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1690 if (!cmd) {
1691 err = -ENOMEM;
1692 goto unlock;
1693 }
1694
1695 err = 0;
1696
1697 unlock:
1698 hci_dev_unlock(hdev);
1699 return err;
1700 }
1701
1702 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1703 u16 len)
1704 {
1705 struct mgmt_cp_load_link_keys *cp = data;
1706 u16 key_count, expected_len;
1707 int i;
1708
1709 key_count = __le16_to_cpu(cp->key_count);
1710
1711 expected_len = sizeof(*cp) + key_count *
1712 sizeof(struct mgmt_link_key_info);
1713 if (expected_len != len) {
1714 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1715 len, expected_len);
1716 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1717 MGMT_STATUS_INVALID_PARAMS);
1718 }
1719
1720 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
1721 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1722 MGMT_STATUS_INVALID_PARAMS);
1723
1724 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1725 key_count);
1726
1727 for (i = 0; i < key_count; i++) {
1728 struct mgmt_link_key_info *key = &cp->keys[i];
1729
1730 if (key->addr.type != BDADDR_BREDR)
1731 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1732 MGMT_STATUS_INVALID_PARAMS);
1733 }
1734
1735 hci_dev_lock(hdev);
1736
1737 hci_link_keys_clear(hdev);
1738
1739 if (cp->debug_keys)
1740 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1741 else
1742 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1743
1744 for (i = 0; i < key_count; i++) {
1745 struct mgmt_link_key_info *key = &cp->keys[i];
1746
1747 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1748 key->type, key->pin_len);
1749 }
1750
1751 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1752
1753 hci_dev_unlock(hdev);
1754
1755 return 0;
1756 }
1757
1758 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1759 u8 addr_type, struct sock *skip_sk)
1760 {
1761 struct mgmt_ev_device_unpaired ev;
1762
1763 bacpy(&ev.addr.bdaddr, bdaddr);
1764 ev.addr.type = addr_type;
1765
1766 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1767 skip_sk);
1768 }
1769
1770 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1771 u16 len)
1772 {
1773 struct mgmt_cp_unpair_device *cp = data;
1774 struct mgmt_rp_unpair_device rp;
1775 struct hci_cp_disconnect dc;
1776 struct pending_cmd *cmd;
1777 struct hci_conn *conn;
1778 int err;
1779
1780 memset(&rp, 0, sizeof(rp));
1781 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1782 rp.addr.type = cp->addr.type;
1783
1784 if (!bdaddr_type_is_valid(cp->addr.type))
1785 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1786 MGMT_STATUS_INVALID_PARAMS,
1787 &rp, sizeof(rp));
1788
1789 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
1790 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1791 MGMT_STATUS_INVALID_PARAMS,
1792 &rp, sizeof(rp));
1793
1794 hci_dev_lock(hdev);
1795
1796 if (!hdev_is_powered(hdev)) {
1797 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1798 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1799 goto unlock;
1800 }
1801
1802 if (cp->addr.type == BDADDR_BREDR)
1803 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1804 else
1805 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1806
1807 if (err < 0) {
1808 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1809 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1810 goto unlock;
1811 }
1812
1813 if (cp->disconnect) {
1814 if (cp->addr.type == BDADDR_BREDR)
1815 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1816 &cp->addr.bdaddr);
1817 else
1818 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1819 &cp->addr.bdaddr);
1820 } else {
1821 conn = NULL;
1822 }
1823
1824 if (!conn) {
1825 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1826 &rp, sizeof(rp));
1827 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1828 goto unlock;
1829 }
1830
1831 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1832 sizeof(*cp));
1833 if (!cmd) {
1834 err = -ENOMEM;
1835 goto unlock;
1836 }
1837
1838 dc.handle = cpu_to_le16(conn->handle);
1839 dc.reason = 0x13; /* Remote User Terminated Connection */
1840 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1841 if (err < 0)
1842 mgmt_pending_remove(cmd);
1843
1844 unlock:
1845 hci_dev_unlock(hdev);
1846 return err;
1847 }
1848
1849 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1850 u16 len)
1851 {
1852 struct mgmt_cp_disconnect *cp = data;
1853 struct mgmt_rp_disconnect rp;
1854 struct hci_cp_disconnect dc;
1855 struct pending_cmd *cmd;
1856 struct hci_conn *conn;
1857 int err;
1858
1859 BT_DBG("");
1860
1861 memset(&rp, 0, sizeof(rp));
1862 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1863 rp.addr.type = cp->addr.type;
1864
1865 if (!bdaddr_type_is_valid(cp->addr.type))
1866 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1867 MGMT_STATUS_INVALID_PARAMS,
1868 &rp, sizeof(rp));
1869
1870 hci_dev_lock(hdev);
1871
1872 if (!test_bit(HCI_UP, &hdev->flags)) {
1873 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1874 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1875 goto failed;
1876 }
1877
1878 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1879 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1880 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1881 goto failed;
1882 }
1883
1884 if (cp->addr.type == BDADDR_BREDR)
1885 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1886 &cp->addr.bdaddr);
1887 else
1888 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1889
1890 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1891 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
1892 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
1893 goto failed;
1894 }
1895
1896 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1897 if (!cmd) {
1898 err = -ENOMEM;
1899 goto failed;
1900 }
1901
1902 dc.handle = cpu_to_le16(conn->handle);
1903 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1904
1905 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1906 if (err < 0)
1907 mgmt_pending_remove(cmd);
1908
1909 failed:
1910 hci_dev_unlock(hdev);
1911 return err;
1912 }
1913
1914 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1915 {
1916 switch (link_type) {
1917 case LE_LINK:
1918 switch (addr_type) {
1919 case ADDR_LE_DEV_PUBLIC:
1920 return BDADDR_LE_PUBLIC;
1921
1922 default:
1923 /* Fallback to LE Random address type */
1924 return BDADDR_LE_RANDOM;
1925 }
1926
1927 default:
1928 /* Fallback to BR/EDR type */
1929 return BDADDR_BREDR;
1930 }
1931 }
1932
1933 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1934 u16 data_len)
1935 {
1936 struct mgmt_rp_get_connections *rp;
1937 struct hci_conn *c;
1938 size_t rp_len;
1939 int err;
1940 u16 i;
1941
1942 BT_DBG("");
1943
1944 hci_dev_lock(hdev);
1945
1946 if (!hdev_is_powered(hdev)) {
1947 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1948 MGMT_STATUS_NOT_POWERED);
1949 goto unlock;
1950 }
1951
1952 i = 0;
1953 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1954 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1955 i++;
1956 }
1957
1958 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1959 rp = kmalloc(rp_len, GFP_KERNEL);
1960 if (!rp) {
1961 err = -ENOMEM;
1962 goto unlock;
1963 }
1964
1965 i = 0;
1966 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1967 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1968 continue;
1969 bacpy(&rp->addr[i].bdaddr, &c->dst);
1970 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1971 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1972 continue;
1973 i++;
1974 }
1975
1976 rp->conn_count = cpu_to_le16(i);
1977
1978 /* Recalculate length in case of filtered SCO connections, etc */
1979 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1980
1981 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1982 rp_len);
1983
1984 kfree(rp);
1985
1986 unlock:
1987 hci_dev_unlock(hdev);
1988 return err;
1989 }
1990
1991 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1992 struct mgmt_cp_pin_code_neg_reply *cp)
1993 {
1994 struct pending_cmd *cmd;
1995 int err;
1996
1997 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1998 sizeof(*cp));
1999 if (!cmd)
2000 return -ENOMEM;
2001
2002 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2003 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2004 if (err < 0)
2005 mgmt_pending_remove(cmd);
2006
2007 return err;
2008 }
2009
2010 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2011 u16 len)
2012 {
2013 struct hci_conn *conn;
2014 struct mgmt_cp_pin_code_reply *cp = data;
2015 struct hci_cp_pin_code_reply reply;
2016 struct pending_cmd *cmd;
2017 int err;
2018
2019 BT_DBG("");
2020
2021 hci_dev_lock(hdev);
2022
2023 if (!hdev_is_powered(hdev)) {
2024 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2025 MGMT_STATUS_NOT_POWERED);
2026 goto failed;
2027 }
2028
2029 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
2030 if (!conn) {
2031 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2032 MGMT_STATUS_NOT_CONNECTED);
2033 goto failed;
2034 }
2035
2036 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
2037 struct mgmt_cp_pin_code_neg_reply ncp;
2038
2039 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
2040
2041 BT_ERR("PIN code is not 16 bytes long");
2042
2043 err = send_pin_code_neg_reply(sk, hdev, &ncp);
2044 if (err >= 0)
2045 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2046 MGMT_STATUS_INVALID_PARAMS);
2047
2048 goto failed;
2049 }
2050
2051 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
2052 if (!cmd) {
2053 err = -ENOMEM;
2054 goto failed;
2055 }
2056
2057 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
2058 reply.pin_len = cp->pin_len;
2059 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
2060
2061 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
2062 if (err < 0)
2063 mgmt_pending_remove(cmd);
2064
2065 failed:
2066 hci_dev_unlock(hdev);
2067 return err;
2068 }
2069
2070 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
2071 u16 len)
2072 {
2073 struct mgmt_cp_set_io_capability *cp = data;
2074
2075 BT_DBG("");
2076
2077 hci_dev_lock(hdev);
2078
2079 hdev->io_capability = cp->io_capability;
2080
2081 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
2082 hdev->io_capability);
2083
2084 hci_dev_unlock(hdev);
2085
2086 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
2087 0);
2088 }
2089
2090 static struct pending_cmd *find_pairing(struct hci_conn *conn)
2091 {
2092 struct hci_dev *hdev = conn->hdev;
2093 struct pending_cmd *cmd;
2094
2095 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2096 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
2097 continue;
2098
2099 if (cmd->user_data != conn)
2100 continue;
2101
2102 return cmd;
2103 }
2104
2105 return NULL;
2106 }
2107
2108 static void pairing_complete(struct pending_cmd *cmd, u8 status)
2109 {
2110 struct mgmt_rp_pair_device rp;
2111 struct hci_conn *conn = cmd->user_data;
2112
2113 bacpy(&rp.addr.bdaddr, &conn->dst);
2114 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
2115
2116 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
2117 &rp, sizeof(rp));
2118
2119 /* So we don't get further callbacks for this connection */
2120 conn->connect_cfm_cb = NULL;
2121 conn->security_cfm_cb = NULL;
2122 conn->disconn_cfm_cb = NULL;
2123
2124 hci_conn_drop(conn);
2125
2126 mgmt_pending_remove(cmd);
2127 }
2128
2129 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
2130 {
2131 struct pending_cmd *cmd;
2132
2133 BT_DBG("status %u", status);
2134
2135 cmd = find_pairing(conn);
2136 if (!cmd)
2137 BT_DBG("Unable to find a pending command");
2138 else
2139 pairing_complete(cmd, mgmt_status(status));
2140 }
2141
2142 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
2143 {
2144 struct pending_cmd *cmd;
2145
2146 BT_DBG("status %u", status);
2147
2148 if (!status)
2149 return;
2150
2151 cmd = find_pairing(conn);
2152 if (!cmd)
2153 BT_DBG("Unable to find a pending command");
2154 else
2155 pairing_complete(cmd, mgmt_status(status));
2156 }
2157
2158 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2159 u16 len)
2160 {
2161 struct mgmt_cp_pair_device *cp = data;
2162 struct mgmt_rp_pair_device rp;
2163 struct pending_cmd *cmd;
2164 u8 sec_level, auth_type;
2165 struct hci_conn *conn;
2166 int err;
2167
2168 BT_DBG("");
2169
2170 memset(&rp, 0, sizeof(rp));
2171 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2172 rp.addr.type = cp->addr.type;
2173
2174 if (!bdaddr_type_is_valid(cp->addr.type))
2175 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2176 MGMT_STATUS_INVALID_PARAMS,
2177 &rp, sizeof(rp));
2178
2179 hci_dev_lock(hdev);
2180
2181 if (!hdev_is_powered(hdev)) {
2182 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2183 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2184 goto unlock;
2185 }
2186
2187 sec_level = BT_SECURITY_MEDIUM;
2188 if (cp->io_cap == 0x03)
2189 auth_type = HCI_AT_DEDICATED_BONDING;
2190 else
2191 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2192
2193 if (cp->addr.type == BDADDR_BREDR)
2194 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
2195 cp->addr.type, sec_level, auth_type);
2196 else
2197 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
2198 cp->addr.type, sec_level, auth_type);
2199
2200 if (IS_ERR(conn)) {
2201 int status;
2202
2203 if (PTR_ERR(conn) == -EBUSY)
2204 status = MGMT_STATUS_BUSY;
2205 else
2206 status = MGMT_STATUS_CONNECT_FAILED;
2207
2208 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2209 status, &rp,
2210 sizeof(rp));
2211 goto unlock;
2212 }
2213
2214 if (conn->connect_cfm_cb) {
2215 hci_conn_drop(conn);
2216 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
2217 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2218 goto unlock;
2219 }
2220
2221 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
2222 if (!cmd) {
2223 err = -ENOMEM;
2224 hci_conn_drop(conn);
2225 goto unlock;
2226 }
2227
2228 /* For LE, just connecting isn't a proof that the pairing finished */
2229 if (cp->addr.type == BDADDR_BREDR)
2230 conn->connect_cfm_cb = pairing_complete_cb;
2231 else
2232 conn->connect_cfm_cb = le_connect_complete_cb;
2233
2234 conn->security_cfm_cb = pairing_complete_cb;
2235 conn->disconn_cfm_cb = pairing_complete_cb;
2236 conn->io_capability = cp->io_cap;
2237 cmd->user_data = conn;
2238
2239 if (conn->state == BT_CONNECTED &&
2240 hci_conn_security(conn, sec_level, auth_type))
2241 pairing_complete(cmd, 0);
2242
2243 err = 0;
2244
2245 unlock:
2246 hci_dev_unlock(hdev);
2247 return err;
2248 }
2249
2250 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2251 u16 len)
2252 {
2253 struct mgmt_addr_info *addr = data;
2254 struct pending_cmd *cmd;
2255 struct hci_conn *conn;
2256 int err;
2257
2258 BT_DBG("");
2259
2260 hci_dev_lock(hdev);
2261
2262 if (!hdev_is_powered(hdev)) {
2263 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2264 MGMT_STATUS_NOT_POWERED);
2265 goto unlock;
2266 }
2267
2268 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2269 if (!cmd) {
2270 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2271 MGMT_STATUS_INVALID_PARAMS);
2272 goto unlock;
2273 }
2274
2275 conn = cmd->user_data;
2276
2277 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2278 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2279 MGMT_STATUS_INVALID_PARAMS);
2280 goto unlock;
2281 }
2282
2283 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2284
2285 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2286 addr, sizeof(*addr));
2287 unlock:
2288 hci_dev_unlock(hdev);
2289 return err;
2290 }
2291
2292 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2293 struct mgmt_addr_info *addr, u16 mgmt_op,
2294 u16 hci_op, __le32 passkey)
2295 {
2296 struct pending_cmd *cmd;
2297 struct hci_conn *conn;
2298 int err;
2299
2300 hci_dev_lock(hdev);
2301
2302 if (!hdev_is_powered(hdev)) {
2303 err = cmd_complete(sk, hdev->id, mgmt_op,
2304 MGMT_STATUS_NOT_POWERED, addr,
2305 sizeof(*addr));
2306 goto done;
2307 }
2308
2309 if (addr->type == BDADDR_BREDR)
2310 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
2311 else
2312 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
2313
2314 if (!conn) {
2315 err = cmd_complete(sk, hdev->id, mgmt_op,
2316 MGMT_STATUS_NOT_CONNECTED, addr,
2317 sizeof(*addr));
2318 goto done;
2319 }
2320
2321 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
2322 /* Continue with pairing via SMP. The hdev lock must be
2323 * released as SMP may try to recquire it for crypto
2324 * purposes.
2325 */
2326 hci_dev_unlock(hdev);
2327 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2328 hci_dev_lock(hdev);
2329
2330 if (!err)
2331 err = cmd_complete(sk, hdev->id, mgmt_op,
2332 MGMT_STATUS_SUCCESS, addr,
2333 sizeof(*addr));
2334 else
2335 err = cmd_complete(sk, hdev->id, mgmt_op,
2336 MGMT_STATUS_FAILED, addr,
2337 sizeof(*addr));
2338
2339 goto done;
2340 }
2341
2342 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
2343 if (!cmd) {
2344 err = -ENOMEM;
2345 goto done;
2346 }
2347
2348 /* Continue with pairing via HCI */
2349 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2350 struct hci_cp_user_passkey_reply cp;
2351
2352 bacpy(&cp.bdaddr, &addr->bdaddr);
2353 cp.passkey = passkey;
2354 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2355 } else
2356 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
2357 &addr->bdaddr);
2358
2359 if (err < 0)
2360 mgmt_pending_remove(cmd);
2361
2362 done:
2363 hci_dev_unlock(hdev);
2364 return err;
2365 }
2366
2367 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2368 void *data, u16 len)
2369 {
2370 struct mgmt_cp_pin_code_neg_reply *cp = data;
2371
2372 BT_DBG("");
2373
2374 return user_pairing_resp(sk, hdev, &cp->addr,
2375 MGMT_OP_PIN_CODE_NEG_REPLY,
2376 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2377 }
2378
2379 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2380 u16 len)
2381 {
2382 struct mgmt_cp_user_confirm_reply *cp = data;
2383
2384 BT_DBG("");
2385
2386 if (len != sizeof(*cp))
2387 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2388 MGMT_STATUS_INVALID_PARAMS);
2389
2390 return user_pairing_resp(sk, hdev, &cp->addr,
2391 MGMT_OP_USER_CONFIRM_REPLY,
2392 HCI_OP_USER_CONFIRM_REPLY, 0);
2393 }
2394
2395 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2396 void *data, u16 len)
2397 {
2398 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2399
2400 BT_DBG("");
2401
2402 return user_pairing_resp(sk, hdev, &cp->addr,
2403 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2404 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2405 }
2406
2407 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2408 u16 len)
2409 {
2410 struct mgmt_cp_user_passkey_reply *cp = data;
2411
2412 BT_DBG("");
2413
2414 return user_pairing_resp(sk, hdev, &cp->addr,
2415 MGMT_OP_USER_PASSKEY_REPLY,
2416 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2417 }
2418
2419 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2420 void *data, u16 len)
2421 {
2422 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2423
2424 BT_DBG("");
2425
2426 return user_pairing_resp(sk, hdev, &cp->addr,
2427 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2428 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2429 }
2430
2431 static void update_name(struct hci_request *req)
2432 {
2433 struct hci_dev *hdev = req->hdev;
2434 struct hci_cp_write_local_name cp;
2435
2436 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2437
2438 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2439 }
2440
2441 static void set_name_complete(struct hci_dev *hdev, u8 status)
2442 {
2443 struct mgmt_cp_set_local_name *cp;
2444 struct pending_cmd *cmd;
2445
2446 BT_DBG("status 0x%02x", status);
2447
2448 hci_dev_lock(hdev);
2449
2450 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
2451 if (!cmd)
2452 goto unlock;
2453
2454 cp = cmd->param;
2455
2456 if (status)
2457 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
2458 mgmt_status(status));
2459 else
2460 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2461 cp, sizeof(*cp));
2462
2463 mgmt_pending_remove(cmd);
2464
2465 unlock:
2466 hci_dev_unlock(hdev);
2467 }
2468
2469 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2470 u16 len)
2471 {
2472 struct mgmt_cp_set_local_name *cp = data;
2473 struct pending_cmd *cmd;
2474 struct hci_request req;
2475 int err;
2476
2477 BT_DBG("");
2478
2479 hci_dev_lock(hdev);
2480
2481 /* If the old values are the same as the new ones just return a
2482 * direct command complete event.
2483 */
2484 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
2485 !memcmp(hdev->short_name, cp->short_name,
2486 sizeof(hdev->short_name))) {
2487 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2488 data, len);
2489 goto failed;
2490 }
2491
2492 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2493
2494 if (!hdev_is_powered(hdev)) {
2495 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2496
2497 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2498 data, len);
2499 if (err < 0)
2500 goto failed;
2501
2502 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2503 sk);
2504
2505 goto failed;
2506 }
2507
2508 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2509 if (!cmd) {
2510 err = -ENOMEM;
2511 goto failed;
2512 }
2513
2514 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2515
2516 hci_req_init(&req, hdev);
2517
2518 if (lmp_bredr_capable(hdev)) {
2519 update_name(&req);
2520 update_eir(&req);
2521 }
2522
2523 if (lmp_le_capable(hdev))
2524 hci_update_ad(&req);
2525
2526 err = hci_req_run(&req, set_name_complete);
2527 if (err < 0)
2528 mgmt_pending_remove(cmd);
2529
2530 failed:
2531 hci_dev_unlock(hdev);
2532 return err;
2533 }
2534
2535 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2536 void *data, u16 data_len)
2537 {
2538 struct pending_cmd *cmd;
2539 int err;
2540
2541 BT_DBG("%s", hdev->name);
2542
2543 hci_dev_lock(hdev);
2544
2545 if (!hdev_is_powered(hdev)) {
2546 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2547 MGMT_STATUS_NOT_POWERED);
2548 goto unlock;
2549 }
2550
2551 if (!lmp_ssp_capable(hdev)) {
2552 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2553 MGMT_STATUS_NOT_SUPPORTED);
2554 goto unlock;
2555 }
2556
2557 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2558 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2559 MGMT_STATUS_BUSY);
2560 goto unlock;
2561 }
2562
2563 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2564 if (!cmd) {
2565 err = -ENOMEM;
2566 goto unlock;
2567 }
2568
2569 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2570 if (err < 0)
2571 mgmt_pending_remove(cmd);
2572
2573 unlock:
2574 hci_dev_unlock(hdev);
2575 return err;
2576 }
2577
2578 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2579 void *data, u16 len)
2580 {
2581 struct mgmt_cp_add_remote_oob_data *cp = data;
2582 u8 status;
2583 int err;
2584
2585 BT_DBG("%s ", hdev->name);
2586
2587 hci_dev_lock(hdev);
2588
2589 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2590 cp->randomizer);
2591 if (err < 0)
2592 status = MGMT_STATUS_FAILED;
2593 else
2594 status = MGMT_STATUS_SUCCESS;
2595
2596 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2597 &cp->addr, sizeof(cp->addr));
2598
2599 hci_dev_unlock(hdev);
2600 return err;
2601 }
2602
2603 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2604 void *data, u16 len)
2605 {
2606 struct mgmt_cp_remove_remote_oob_data *cp = data;
2607 u8 status;
2608 int err;
2609
2610 BT_DBG("%s", hdev->name);
2611
2612 hci_dev_lock(hdev);
2613
2614 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2615 if (err < 0)
2616 status = MGMT_STATUS_INVALID_PARAMS;
2617 else
2618 status = MGMT_STATUS_SUCCESS;
2619
2620 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2621 status, &cp->addr, sizeof(cp->addr));
2622
2623 hci_dev_unlock(hdev);
2624 return err;
2625 }
2626
2627 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
2628 {
2629 struct pending_cmd *cmd;
2630 u8 type;
2631 int err;
2632
2633 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2634
2635 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
2636 if (!cmd)
2637 return -ENOENT;
2638
2639 type = hdev->discovery.type;
2640
2641 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2642 &type, sizeof(type));
2643 mgmt_pending_remove(cmd);
2644
2645 return err;
2646 }
2647
2648 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
2649 {
2650 BT_DBG("status %d", status);
2651
2652 if (status) {
2653 hci_dev_lock(hdev);
2654 mgmt_start_discovery_failed(hdev, status);
2655 hci_dev_unlock(hdev);
2656 return;
2657 }
2658
2659 hci_dev_lock(hdev);
2660 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2661 hci_dev_unlock(hdev);
2662
2663 switch (hdev->discovery.type) {
2664 case DISCOV_TYPE_LE:
2665 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2666 DISCOV_LE_TIMEOUT);
2667 break;
2668
2669 case DISCOV_TYPE_INTERLEAVED:
2670 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2671 DISCOV_INTERLEAVED_TIMEOUT);
2672 break;
2673
2674 case DISCOV_TYPE_BREDR:
2675 break;
2676
2677 default:
2678 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
2679 }
2680 }
2681
2682 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2683 void *data, u16 len)
2684 {
2685 struct mgmt_cp_start_discovery *cp = data;
2686 struct pending_cmd *cmd;
2687 struct hci_cp_le_set_scan_param param_cp;
2688 struct hci_cp_le_set_scan_enable enable_cp;
2689 struct hci_cp_inquiry inq_cp;
2690 struct hci_request req;
2691 /* General inquiry access code (GIAC) */
2692 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2693 int err;
2694
2695 BT_DBG("%s", hdev->name);
2696
2697 hci_dev_lock(hdev);
2698
2699 if (!hdev_is_powered(hdev)) {
2700 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2701 MGMT_STATUS_NOT_POWERED);
2702 goto failed;
2703 }
2704
2705 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2706 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2707 MGMT_STATUS_BUSY);
2708 goto failed;
2709 }
2710
2711 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2712 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2713 MGMT_STATUS_BUSY);
2714 goto failed;
2715 }
2716
2717 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2718 if (!cmd) {
2719 err = -ENOMEM;
2720 goto failed;
2721 }
2722
2723 hdev->discovery.type = cp->type;
2724
2725 hci_req_init(&req, hdev);
2726
2727 switch (hdev->discovery.type) {
2728 case DISCOV_TYPE_BREDR:
2729 if (!lmp_bredr_capable(hdev)) {
2730 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2731 MGMT_STATUS_NOT_SUPPORTED);
2732 mgmt_pending_remove(cmd);
2733 goto failed;
2734 }
2735
2736 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2737 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2738 MGMT_STATUS_BUSY);
2739 mgmt_pending_remove(cmd);
2740 goto failed;
2741 }
2742
2743 hci_inquiry_cache_flush(hdev);
2744
2745 memset(&inq_cp, 0, sizeof(inq_cp));
2746 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
2747 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
2748 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
2749 break;
2750
2751 case DISCOV_TYPE_LE:
2752 case DISCOV_TYPE_INTERLEAVED:
2753 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2754 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2755 MGMT_STATUS_NOT_SUPPORTED);
2756 mgmt_pending_remove(cmd);
2757 goto failed;
2758 }
2759
2760 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
2761 !lmp_bredr_capable(hdev)) {
2762 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2763 MGMT_STATUS_NOT_SUPPORTED);
2764 mgmt_pending_remove(cmd);
2765 goto failed;
2766 }
2767
2768 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags)) {
2769 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2770 MGMT_STATUS_REJECTED);
2771 mgmt_pending_remove(cmd);
2772 goto failed;
2773 }
2774
2775 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
2776 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2777 MGMT_STATUS_BUSY);
2778 mgmt_pending_remove(cmd);
2779 goto failed;
2780 }
2781
2782 memset(&param_cp, 0, sizeof(param_cp));
2783 param_cp.type = LE_SCAN_ACTIVE;
2784 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
2785 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2786 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2787 &param_cp);
2788
2789 memset(&enable_cp, 0, sizeof(enable_cp));
2790 enable_cp.enable = LE_SCAN_ENABLE;
2791 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2792 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2793 &enable_cp);
2794 break;
2795
2796 default:
2797 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2798 MGMT_STATUS_INVALID_PARAMS);
2799 mgmt_pending_remove(cmd);
2800 goto failed;
2801 }
2802
2803 err = hci_req_run(&req, start_discovery_complete);
2804 if (err < 0)
2805 mgmt_pending_remove(cmd);
2806 else
2807 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2808
2809 failed:
2810 hci_dev_unlock(hdev);
2811 return err;
2812 }
2813
2814 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
2815 {
2816 struct pending_cmd *cmd;
2817 int err;
2818
2819 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
2820 if (!cmd)
2821 return -ENOENT;
2822
2823 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
2824 &hdev->discovery.type, sizeof(hdev->discovery.type));
2825 mgmt_pending_remove(cmd);
2826
2827 return err;
2828 }
2829
2830 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
2831 {
2832 BT_DBG("status %d", status);
2833
2834 hci_dev_lock(hdev);
2835
2836 if (status) {
2837 mgmt_stop_discovery_failed(hdev, status);
2838 goto unlock;
2839 }
2840
2841 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2842
2843 unlock:
2844 hci_dev_unlock(hdev);
2845 }
2846
2847 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2848 u16 len)
2849 {
2850 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2851 struct pending_cmd *cmd;
2852 struct hci_cp_remote_name_req_cancel cp;
2853 struct inquiry_entry *e;
2854 struct hci_request req;
2855 struct hci_cp_le_set_scan_enable enable_cp;
2856 int err;
2857
2858 BT_DBG("%s", hdev->name);
2859
2860 hci_dev_lock(hdev);
2861
2862 if (!hci_discovery_active(hdev)) {
2863 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2864 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2865 sizeof(mgmt_cp->type));
2866 goto unlock;
2867 }
2868
2869 if (hdev->discovery.type != mgmt_cp->type) {
2870 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2871 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2872 sizeof(mgmt_cp->type));
2873 goto unlock;
2874 }
2875
2876 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2877 if (!cmd) {
2878 err = -ENOMEM;
2879 goto unlock;
2880 }
2881
2882 hci_req_init(&req, hdev);
2883
2884 switch (hdev->discovery.state) {
2885 case DISCOVERY_FINDING:
2886 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
2887 hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2888 } else {
2889 cancel_delayed_work(&hdev->le_scan_disable);
2890
2891 memset(&enable_cp, 0, sizeof(enable_cp));
2892 enable_cp.enable = LE_SCAN_DISABLE;
2893 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE,
2894 sizeof(enable_cp), &enable_cp);
2895 }
2896
2897 break;
2898
2899 case DISCOVERY_RESOLVING:
2900 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2901 NAME_PENDING);
2902 if (!e) {
2903 mgmt_pending_remove(cmd);
2904 err = cmd_complete(sk, hdev->id,
2905 MGMT_OP_STOP_DISCOVERY, 0,
2906 &mgmt_cp->type,
2907 sizeof(mgmt_cp->type));
2908 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2909 goto unlock;
2910 }
2911
2912 bacpy(&cp.bdaddr, &e->data.bdaddr);
2913 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2914 &cp);
2915
2916 break;
2917
2918 default:
2919 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2920
2921 mgmt_pending_remove(cmd);
2922 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2923 MGMT_STATUS_FAILED, &mgmt_cp->type,
2924 sizeof(mgmt_cp->type));
2925 goto unlock;
2926 }
2927
2928 err = hci_req_run(&req, stop_discovery_complete);
2929 if (err < 0)
2930 mgmt_pending_remove(cmd);
2931 else
2932 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2933
2934 unlock:
2935 hci_dev_unlock(hdev);
2936 return err;
2937 }
2938
2939 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2940 u16 len)
2941 {
2942 struct mgmt_cp_confirm_name *cp = data;
2943 struct inquiry_entry *e;
2944 int err;
2945
2946 BT_DBG("%s", hdev->name);
2947
2948 hci_dev_lock(hdev);
2949
2950 if (!hci_discovery_active(hdev)) {
2951 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2952 MGMT_STATUS_FAILED);
2953 goto failed;
2954 }
2955
2956 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2957 if (!e) {
2958 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2959 MGMT_STATUS_INVALID_PARAMS);
2960 goto failed;
2961 }
2962
2963 if (cp->name_known) {
2964 e->name_state = NAME_KNOWN;
2965 list_del(&e->list);
2966 } else {
2967 e->name_state = NAME_NEEDED;
2968 hci_inquiry_cache_update_resolve(hdev, e);
2969 }
2970
2971 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
2972 sizeof(cp->addr));
2973
2974 failed:
2975 hci_dev_unlock(hdev);
2976 return err;
2977 }
2978
2979 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2980 u16 len)
2981 {
2982 struct mgmt_cp_block_device *cp = data;
2983 u8 status;
2984 int err;
2985
2986 BT_DBG("%s", hdev->name);
2987
2988 if (!bdaddr_type_is_valid(cp->addr.type))
2989 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
2990 MGMT_STATUS_INVALID_PARAMS,
2991 &cp->addr, sizeof(cp->addr));
2992
2993 hci_dev_lock(hdev);
2994
2995 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2996 if (err < 0)
2997 status = MGMT_STATUS_FAILED;
2998 else
2999 status = MGMT_STATUS_SUCCESS;
3000
3001 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
3002 &cp->addr, sizeof(cp->addr));
3003
3004 hci_dev_unlock(hdev);
3005
3006 return err;
3007 }
3008
3009 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
3010 u16 len)
3011 {
3012 struct mgmt_cp_unblock_device *cp = data;
3013 u8 status;
3014 int err;
3015
3016 BT_DBG("%s", hdev->name);
3017
3018 if (!bdaddr_type_is_valid(cp->addr.type))
3019 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
3020 MGMT_STATUS_INVALID_PARAMS,
3021 &cp->addr, sizeof(cp->addr));
3022
3023 hci_dev_lock(hdev);
3024
3025 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
3026 if (err < 0)
3027 status = MGMT_STATUS_INVALID_PARAMS;
3028 else
3029 status = MGMT_STATUS_SUCCESS;
3030
3031 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
3032 &cp->addr, sizeof(cp->addr));
3033
3034 hci_dev_unlock(hdev);
3035
3036 return err;
3037 }
3038
3039 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
3040 u16 len)
3041 {
3042 struct mgmt_cp_set_device_id *cp = data;
3043 struct hci_request req;
3044 int err;
3045 __u16 source;
3046
3047 BT_DBG("%s", hdev->name);
3048
3049 source = __le16_to_cpu(cp->source);
3050
3051 if (source > 0x0002)
3052 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
3053 MGMT_STATUS_INVALID_PARAMS);
3054
3055 hci_dev_lock(hdev);
3056
3057 hdev->devid_source = source;
3058 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
3059 hdev->devid_product = __le16_to_cpu(cp->product);
3060 hdev->devid_version = __le16_to_cpu(cp->version);
3061
3062 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
3063
3064 hci_req_init(&req, hdev);
3065 update_eir(&req);
3066 hci_req_run(&req, NULL);
3067
3068 hci_dev_unlock(hdev);
3069
3070 return err;
3071 }
3072
3073 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
3074 {
3075 struct pending_cmd *cmd;
3076
3077 BT_DBG("status 0x%02x", status);
3078
3079 hci_dev_lock(hdev);
3080
3081 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3082 if (!cmd)
3083 goto unlock;
3084
3085 if (status) {
3086 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3087 mgmt_status(status));
3088 } else {
3089 struct mgmt_mode *cp = cmd->param;
3090
3091 if (cp->val)
3092 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3093 else
3094 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
3095
3096 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
3097 new_settings(hdev, cmd->sk);
3098 }
3099
3100 mgmt_pending_remove(cmd);
3101
3102 unlock:
3103 hci_dev_unlock(hdev);
3104 }
3105
3106 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
3107 void *data, u16 len)
3108 {
3109 struct mgmt_mode *cp = data;
3110 struct pending_cmd *cmd;
3111 struct hci_request req;
3112 int err;
3113
3114 BT_DBG("%s", hdev->name);
3115
3116 if (!lmp_bredr_capable(hdev) || hdev->hci_ver < BLUETOOTH_VER_1_2)
3117 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3118 MGMT_STATUS_NOT_SUPPORTED);
3119
3120 if (cp->val != 0x00 && cp->val != 0x01)
3121 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3122 MGMT_STATUS_INVALID_PARAMS);
3123
3124 if (!hdev_is_powered(hdev))
3125 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3126 MGMT_STATUS_NOT_POWERED);
3127
3128 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3129 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3130 MGMT_STATUS_REJECTED);
3131
3132 hci_dev_lock(hdev);
3133
3134 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
3135 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3136 MGMT_STATUS_BUSY);
3137 goto unlock;
3138 }
3139
3140 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
3141 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
3142 hdev);
3143 goto unlock;
3144 }
3145
3146 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
3147 data, len);
3148 if (!cmd) {
3149 err = -ENOMEM;
3150 goto unlock;
3151 }
3152
3153 hci_req_init(&req, hdev);
3154
3155 write_fast_connectable(&req, cp->val);
3156
3157 err = hci_req_run(&req, fast_connectable_complete);
3158 if (err < 0) {
3159 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
3160 MGMT_STATUS_FAILED);
3161 mgmt_pending_remove(cmd);
3162 }
3163
3164 unlock:
3165 hci_dev_unlock(hdev);
3166
3167 return err;
3168 }
3169
3170 static bool ltk_is_valid(struct mgmt_ltk_info *key)
3171 {
3172 if (key->authenticated != 0x00 && key->authenticated != 0x01)
3173 return false;
3174 if (key->master != 0x00 && key->master != 0x01)
3175 return false;
3176 if (!bdaddr_type_is_le(key->addr.type))
3177 return false;
3178 return true;
3179 }
3180
3181 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
3182 void *cp_data, u16 len)
3183 {
3184 struct mgmt_cp_load_long_term_keys *cp = cp_data;
3185 u16 key_count, expected_len;
3186 int i, err;
3187
3188 key_count = __le16_to_cpu(cp->key_count);
3189
3190 expected_len = sizeof(*cp) + key_count *
3191 sizeof(struct mgmt_ltk_info);
3192 if (expected_len != len) {
3193 BT_ERR("load_keys: expected %u bytes, got %u bytes",
3194 len, expected_len);
3195 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
3196 MGMT_STATUS_INVALID_PARAMS);
3197 }
3198
3199 BT_DBG("%s key_count %u", hdev->name, key_count);
3200
3201 for (i = 0; i < key_count; i++) {
3202 struct mgmt_ltk_info *key = &cp->keys[i];
3203
3204 if (!ltk_is_valid(key))
3205 return cmd_status(sk, hdev->id,
3206 MGMT_OP_LOAD_LONG_TERM_KEYS,
3207 MGMT_STATUS_INVALID_PARAMS);
3208 }
3209
3210 hci_dev_lock(hdev);
3211
3212 hci_smp_ltks_clear(hdev);
3213
3214 for (i = 0; i < key_count; i++) {
3215 struct mgmt_ltk_info *key = &cp->keys[i];
3216 u8 type;
3217
3218 if (key->master)
3219 type = HCI_SMP_LTK;
3220 else
3221 type = HCI_SMP_LTK_SLAVE;
3222
3223 hci_add_ltk(hdev, &key->addr.bdaddr,
3224 bdaddr_to_le(key->addr.type),
3225 type, 0, key->authenticated, key->val,
3226 key->enc_size, key->ediv, key->rand);
3227 }
3228
3229 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
3230 NULL, 0);
3231
3232 hci_dev_unlock(hdev);
3233
3234 return err;
3235 }
3236
3237 static const struct mgmt_handler {
3238 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
3239 u16 data_len);
3240 bool var_len;
3241 size_t data_len;
3242 } mgmt_handlers[] = {
3243 { NULL }, /* 0x0000 (no command) */
3244 { read_version, false, MGMT_READ_VERSION_SIZE },
3245 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
3246 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
3247 { read_controller_info, false, MGMT_READ_INFO_SIZE },
3248 { set_powered, false, MGMT_SETTING_SIZE },
3249 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
3250 { set_connectable, false, MGMT_SETTING_SIZE },
3251 { set_fast_connectable, false, MGMT_SETTING_SIZE },
3252 { set_pairable, false, MGMT_SETTING_SIZE },
3253 { set_link_security, false, MGMT_SETTING_SIZE },
3254 { set_ssp, false, MGMT_SETTING_SIZE },
3255 { set_hs, false, MGMT_SETTING_SIZE },
3256 { set_le, false, MGMT_SETTING_SIZE },
3257 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
3258 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
3259 { add_uuid, false, MGMT_ADD_UUID_SIZE },
3260 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
3261 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
3262 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
3263 { disconnect, false, MGMT_DISCONNECT_SIZE },
3264 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
3265 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
3266 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
3267 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
3268 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
3269 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
3270 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
3271 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
3272 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
3273 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
3274 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
3275 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
3276 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
3277 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
3278 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
3279 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
3280 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
3281 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
3282 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
3283 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
3284 };
3285
3286
3287 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
3288 {
3289 void *buf;
3290 u8 *cp;
3291 struct mgmt_hdr *hdr;
3292 u16 opcode, index, len;
3293 struct hci_dev *hdev = NULL;
3294 const struct mgmt_handler *handler;
3295 int err;
3296
3297 BT_DBG("got %zu bytes", msglen);
3298
3299 if (msglen < sizeof(*hdr))
3300 return -EINVAL;
3301
3302 buf = kmalloc(msglen, GFP_KERNEL);
3303 if (!buf)
3304 return -ENOMEM;
3305
3306 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
3307 err = -EFAULT;
3308 goto done;
3309 }
3310
3311 hdr = buf;
3312 opcode = __le16_to_cpu(hdr->opcode);
3313 index = __le16_to_cpu(hdr->index);
3314 len = __le16_to_cpu(hdr->len);
3315
3316 if (len != msglen - sizeof(*hdr)) {
3317 err = -EINVAL;
3318 goto done;
3319 }
3320
3321 if (index != MGMT_INDEX_NONE) {
3322 hdev = hci_dev_get(index);
3323 if (!hdev) {
3324 err = cmd_status(sk, index, opcode,
3325 MGMT_STATUS_INVALID_INDEX);
3326 goto done;
3327 }
3328 }
3329
3330 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
3331 mgmt_handlers[opcode].func == NULL) {
3332 BT_DBG("Unknown op %u", opcode);
3333 err = cmd_status(sk, index, opcode,
3334 MGMT_STATUS_UNKNOWN_COMMAND);
3335 goto done;
3336 }
3337
3338 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
3339 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
3340 err = cmd_status(sk, index, opcode,
3341 MGMT_STATUS_INVALID_INDEX);
3342 goto done;
3343 }
3344
3345 handler = &mgmt_handlers[opcode];
3346
3347 if ((handler->var_len && len < handler->data_len) ||
3348 (!handler->var_len && len != handler->data_len)) {
3349 err = cmd_status(sk, index, opcode,
3350 MGMT_STATUS_INVALID_PARAMS);
3351 goto done;
3352 }
3353
3354 if (hdev)
3355 mgmt_init_hdev(sk, hdev);
3356
3357 cp = buf + sizeof(*hdr);
3358
3359 err = handler->func(sk, hdev, cp, len);
3360 if (err < 0)
3361 goto done;
3362
3363 err = msglen;
3364
3365 done:
3366 if (hdev)
3367 hci_dev_put(hdev);
3368
3369 kfree(buf);
3370 return err;
3371 }
3372
3373 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
3374 {
3375 u8 *status = data;
3376
3377 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
3378 mgmt_pending_remove(cmd);
3379 }
3380
3381 int mgmt_index_added(struct hci_dev *hdev)
3382 {
3383 if (!mgmt_valid_hdev(hdev))
3384 return -ENOTSUPP;
3385
3386 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
3387 }
3388
3389 int mgmt_index_removed(struct hci_dev *hdev)
3390 {
3391 u8 status = MGMT_STATUS_INVALID_INDEX;
3392
3393 if (!mgmt_valid_hdev(hdev))
3394 return -ENOTSUPP;
3395
3396 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
3397
3398 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
3399 }
3400
3401 struct cmd_lookup {
3402 struct sock *sk;
3403 struct hci_dev *hdev;
3404 u8 mgmt_status;
3405 };
3406
3407 static void settings_rsp(struct pending_cmd *cmd, void *data)
3408 {
3409 struct cmd_lookup *match = data;
3410
3411 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
3412
3413 list_del(&cmd->list);
3414
3415 if (match->sk == NULL) {
3416 match->sk = cmd->sk;
3417 sock_hold(match->sk);
3418 }
3419
3420 mgmt_pending_free(cmd);
3421 }
3422
3423 static void set_bredr_scan(struct hci_request *req)
3424 {
3425 struct hci_dev *hdev = req->hdev;
3426 u8 scan = 0;
3427
3428 /* Ensure that fast connectable is disabled. This function will
3429 * not do anything if the page scan parameters are already what
3430 * they should be.
3431 */
3432 write_fast_connectable(req, false);
3433
3434 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3435 scan |= SCAN_PAGE;
3436 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3437 scan |= SCAN_INQUIRY;
3438
3439 if (scan)
3440 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
3441 }
3442
3443 static void powered_complete(struct hci_dev *hdev, u8 status)
3444 {
3445 struct cmd_lookup match = { NULL, hdev };
3446
3447 BT_DBG("status 0x%02x", status);
3448
3449 hci_dev_lock(hdev);
3450
3451 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3452
3453 new_settings(hdev, match.sk);
3454
3455 hci_dev_unlock(hdev);
3456
3457 if (match.sk)
3458 sock_put(match.sk);
3459 }
3460
3461 static int powered_update_hci(struct hci_dev *hdev)
3462 {
3463 struct hci_request req;
3464 u8 link_sec;
3465
3466 hci_req_init(&req, hdev);
3467
3468 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
3469 !lmp_host_ssp_capable(hdev)) {
3470 u8 ssp = 1;
3471
3472 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
3473 }
3474
3475 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
3476 lmp_bredr_capable(hdev)) {
3477 struct hci_cp_write_le_host_supported cp;
3478
3479 cp.le = 1;
3480 cp.simul = lmp_le_br_capable(hdev);
3481
3482 /* Check first if we already have the right
3483 * host state (host features set)
3484 */
3485 if (cp.le != lmp_host_le_capable(hdev) ||
3486 cp.simul != lmp_host_le_br_capable(hdev))
3487 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3488 sizeof(cp), &cp);
3489 }
3490
3491 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
3492 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3493 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
3494 sizeof(link_sec), &link_sec);
3495
3496 if (lmp_bredr_capable(hdev)) {
3497 set_bredr_scan(&req);
3498 update_class(&req);
3499 update_name(&req);
3500 update_eir(&req);
3501 }
3502
3503 return hci_req_run(&req, powered_complete);
3504 }
3505
3506 int mgmt_powered(struct hci_dev *hdev, u8 powered)
3507 {
3508 struct cmd_lookup match = { NULL, hdev };
3509 u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
3510 u8 zero_cod[] = { 0, 0, 0 };
3511 int err;
3512
3513 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3514 return 0;
3515
3516 if (powered) {
3517 if (powered_update_hci(hdev) == 0)
3518 return 0;
3519
3520 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
3521 &match);
3522 goto new_settings;
3523 }
3524
3525 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
3526 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered);
3527
3528 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
3529 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
3530 zero_cod, sizeof(zero_cod), NULL);
3531
3532 new_settings:
3533 err = new_settings(hdev, match.sk);
3534
3535 if (match.sk)
3536 sock_put(match.sk);
3537
3538 return err;
3539 }
3540
3541 int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
3542 {
3543 struct pending_cmd *cmd;
3544 u8 status;
3545
3546 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
3547 if (!cmd)
3548 return -ENOENT;
3549
3550 if (err == -ERFKILL)
3551 status = MGMT_STATUS_RFKILLED;
3552 else
3553 status = MGMT_STATUS_FAILED;
3554
3555 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
3556
3557 mgmt_pending_remove(cmd);
3558
3559 return err;
3560 }
3561
3562 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
3563 {
3564 struct cmd_lookup match = { NULL, hdev };
3565 bool changed = false;
3566 int err = 0;
3567
3568 if (discoverable) {
3569 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3570 changed = true;
3571 } else {
3572 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
3573 changed = true;
3574 }
3575
3576 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
3577 &match);
3578
3579 if (changed)
3580 err = new_settings(hdev, match.sk);
3581
3582 if (match.sk)
3583 sock_put(match.sk);
3584
3585 return err;
3586 }
3587
3588 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
3589 {
3590 struct pending_cmd *cmd;
3591 bool changed = false;
3592 int err = 0;
3593
3594 if (connectable) {
3595 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3596 changed = true;
3597 } else {
3598 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
3599 changed = true;
3600 }
3601
3602 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
3603
3604 if (changed)
3605 err = new_settings(hdev, cmd ? cmd->sk : NULL);
3606
3607 return err;
3608 }
3609
3610 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3611 {
3612 u8 mgmt_err = mgmt_status(status);
3613
3614 if (scan & SCAN_PAGE)
3615 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3616 cmd_status_rsp, &mgmt_err);
3617
3618 if (scan & SCAN_INQUIRY)
3619 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3620 cmd_status_rsp, &mgmt_err);
3621
3622 return 0;
3623 }
3624
3625 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3626 bool persistent)
3627 {
3628 struct mgmt_ev_new_link_key ev;
3629
3630 memset(&ev, 0, sizeof(ev));
3631
3632 ev.store_hint = persistent;
3633 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3634 ev.key.addr.type = BDADDR_BREDR;
3635 ev.key.type = key->type;
3636 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3637 ev.key.pin_len = key->pin_len;
3638
3639 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3640 }
3641
3642 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3643 {
3644 struct mgmt_ev_new_long_term_key ev;
3645
3646 memset(&ev, 0, sizeof(ev));
3647
3648 ev.store_hint = persistent;
3649 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3650 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3651 ev.key.authenticated = key->authenticated;
3652 ev.key.enc_size = key->enc_size;
3653 ev.key.ediv = key->ediv;
3654
3655 if (key->type == HCI_SMP_LTK)
3656 ev.key.master = 1;
3657
3658 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3659 memcpy(ev.key.val, key->val, sizeof(key->val));
3660
3661 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3662 NULL);
3663 }
3664
3665 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3666 u8 addr_type, u32 flags, u8 *name, u8 name_len,
3667 u8 *dev_class)
3668 {
3669 char buf[512];
3670 struct mgmt_ev_device_connected *ev = (void *) buf;
3671 u16 eir_len = 0;
3672
3673 bacpy(&ev->addr.bdaddr, bdaddr);
3674 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3675
3676 ev->flags = __cpu_to_le32(flags);
3677
3678 if (name_len > 0)
3679 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3680 name, name_len);
3681
3682 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3683 eir_len = eir_append_data(ev->eir, eir_len,
3684 EIR_CLASS_OF_DEV, dev_class, 3);
3685
3686 ev->eir_len = cpu_to_le16(eir_len);
3687
3688 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3689 sizeof(*ev) + eir_len, NULL);
3690 }
3691
3692 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3693 {
3694 struct mgmt_cp_disconnect *cp = cmd->param;
3695 struct sock **sk = data;
3696 struct mgmt_rp_disconnect rp;
3697
3698 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3699 rp.addr.type = cp->addr.type;
3700
3701 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3702 sizeof(rp));
3703
3704 *sk = cmd->sk;
3705 sock_hold(*sk);
3706
3707 mgmt_pending_remove(cmd);
3708 }
3709
3710 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3711 {
3712 struct hci_dev *hdev = data;
3713 struct mgmt_cp_unpair_device *cp = cmd->param;
3714 struct mgmt_rp_unpair_device rp;
3715
3716 memset(&rp, 0, sizeof(rp));
3717 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3718 rp.addr.type = cp->addr.type;
3719
3720 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3721
3722 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3723
3724 mgmt_pending_remove(cmd);
3725 }
3726
3727 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3728 u8 link_type, u8 addr_type, u8 reason)
3729 {
3730 struct mgmt_ev_device_disconnected ev;
3731 struct sock *sk = NULL;
3732 int err;
3733
3734 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3735
3736 bacpy(&ev.addr.bdaddr, bdaddr);
3737 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3738 ev.reason = reason;
3739
3740 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3741 sk);
3742
3743 if (sk)
3744 sock_put(sk);
3745
3746 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3747 hdev);
3748
3749 return err;
3750 }
3751
3752 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3753 u8 link_type, u8 addr_type, u8 status)
3754 {
3755 struct mgmt_rp_disconnect rp;
3756 struct pending_cmd *cmd;
3757 int err;
3758
3759 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3760 hdev);
3761
3762 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3763 if (!cmd)
3764 return -ENOENT;
3765
3766 bacpy(&rp.addr.bdaddr, bdaddr);
3767 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3768
3769 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3770 mgmt_status(status), &rp, sizeof(rp));
3771
3772 mgmt_pending_remove(cmd);
3773
3774 return err;
3775 }
3776
3777 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3778 u8 addr_type, u8 status)
3779 {
3780 struct mgmt_ev_connect_failed ev;
3781
3782 bacpy(&ev.addr.bdaddr, bdaddr);
3783 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3784 ev.status = mgmt_status(status);
3785
3786 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3787 }
3788
3789 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3790 {
3791 struct mgmt_ev_pin_code_request ev;
3792
3793 bacpy(&ev.addr.bdaddr, bdaddr);
3794 ev.addr.type = BDADDR_BREDR;
3795 ev.secure = secure;
3796
3797 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3798 NULL);
3799 }
3800
3801 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3802 u8 status)
3803 {
3804 struct pending_cmd *cmd;
3805 struct mgmt_rp_pin_code_reply rp;
3806 int err;
3807
3808 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3809 if (!cmd)
3810 return -ENOENT;
3811
3812 bacpy(&rp.addr.bdaddr, bdaddr);
3813 rp.addr.type = BDADDR_BREDR;
3814
3815 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3816 mgmt_status(status), &rp, sizeof(rp));
3817
3818 mgmt_pending_remove(cmd);
3819
3820 return err;
3821 }
3822
3823 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3824 u8 status)
3825 {
3826 struct pending_cmd *cmd;
3827 struct mgmt_rp_pin_code_reply rp;
3828 int err;
3829
3830 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3831 if (!cmd)
3832 return -ENOENT;
3833
3834 bacpy(&rp.addr.bdaddr, bdaddr);
3835 rp.addr.type = BDADDR_BREDR;
3836
3837 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3838 mgmt_status(status), &rp, sizeof(rp));
3839
3840 mgmt_pending_remove(cmd);
3841
3842 return err;
3843 }
3844
3845 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3846 u8 link_type, u8 addr_type, __le32 value,
3847 u8 confirm_hint)
3848 {
3849 struct mgmt_ev_user_confirm_request ev;
3850
3851 BT_DBG("%s", hdev->name);
3852
3853 bacpy(&ev.addr.bdaddr, bdaddr);
3854 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3855 ev.confirm_hint = confirm_hint;
3856 ev.value = value;
3857
3858 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3859 NULL);
3860 }
3861
3862 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3863 u8 link_type, u8 addr_type)
3864 {
3865 struct mgmt_ev_user_passkey_request ev;
3866
3867 BT_DBG("%s", hdev->name);
3868
3869 bacpy(&ev.addr.bdaddr, bdaddr);
3870 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3871
3872 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3873 NULL);
3874 }
3875
3876 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3877 u8 link_type, u8 addr_type, u8 status,
3878 u8 opcode)
3879 {
3880 struct pending_cmd *cmd;
3881 struct mgmt_rp_user_confirm_reply rp;
3882 int err;
3883
3884 cmd = mgmt_pending_find(opcode, hdev);
3885 if (!cmd)
3886 return -ENOENT;
3887
3888 bacpy(&rp.addr.bdaddr, bdaddr);
3889 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3890 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3891 &rp, sizeof(rp));
3892
3893 mgmt_pending_remove(cmd);
3894
3895 return err;
3896 }
3897
3898 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3899 u8 link_type, u8 addr_type, u8 status)
3900 {
3901 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3902 status, MGMT_OP_USER_CONFIRM_REPLY);
3903 }
3904
3905 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3906 u8 link_type, u8 addr_type, u8 status)
3907 {
3908 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3909 status,
3910 MGMT_OP_USER_CONFIRM_NEG_REPLY);
3911 }
3912
3913 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3914 u8 link_type, u8 addr_type, u8 status)
3915 {
3916 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3917 status, MGMT_OP_USER_PASSKEY_REPLY);
3918 }
3919
3920 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3921 u8 link_type, u8 addr_type, u8 status)
3922 {
3923 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3924 status,
3925 MGMT_OP_USER_PASSKEY_NEG_REPLY);
3926 }
3927
3928 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3929 u8 link_type, u8 addr_type, u32 passkey,
3930 u8 entered)
3931 {
3932 struct mgmt_ev_passkey_notify ev;
3933
3934 BT_DBG("%s", hdev->name);
3935
3936 bacpy(&ev.addr.bdaddr, bdaddr);
3937 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3938 ev.passkey = __cpu_to_le32(passkey);
3939 ev.entered = entered;
3940
3941 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3942 }
3943
3944 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3945 u8 addr_type, u8 status)
3946 {
3947 struct mgmt_ev_auth_failed ev;
3948
3949 bacpy(&ev.addr.bdaddr, bdaddr);
3950 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3951 ev.status = mgmt_status(status);
3952
3953 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3954 }
3955
3956 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3957 {
3958 struct cmd_lookup match = { NULL, hdev };
3959 bool changed = false;
3960 int err = 0;
3961
3962 if (status) {
3963 u8 mgmt_err = mgmt_status(status);
3964 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3965 cmd_status_rsp, &mgmt_err);
3966 return 0;
3967 }
3968
3969 if (test_bit(HCI_AUTH, &hdev->flags)) {
3970 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3971 changed = true;
3972 } else {
3973 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3974 changed = true;
3975 }
3976
3977 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3978 &match);
3979
3980 if (changed)
3981 err = new_settings(hdev, match.sk);
3982
3983 if (match.sk)
3984 sock_put(match.sk);
3985
3986 return err;
3987 }
3988
3989 static void clear_eir(struct hci_request *req)
3990 {
3991 struct hci_dev *hdev = req->hdev;
3992 struct hci_cp_write_eir cp;
3993
3994 if (!lmp_ext_inq_capable(hdev))
3995 return;
3996
3997 memset(hdev->eir, 0, sizeof(hdev->eir));
3998
3999 memset(&cp, 0, sizeof(cp));
4000
4001 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
4002 }
4003
4004 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4005 {
4006 struct cmd_lookup match = { NULL, hdev };
4007 struct hci_request req;
4008 bool changed = false;
4009 int err = 0;
4010
4011 if (status) {
4012 u8 mgmt_err = mgmt_status(status);
4013
4014 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
4015 &hdev->dev_flags))
4016 err = new_settings(hdev, NULL);
4017
4018 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
4019 &mgmt_err);
4020
4021 return err;
4022 }
4023
4024 if (enable) {
4025 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4026 changed = true;
4027 } else {
4028 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4029 changed = true;
4030 }
4031
4032 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
4033
4034 if (changed)
4035 err = new_settings(hdev, match.sk);
4036
4037 if (match.sk)
4038 sock_put(match.sk);
4039
4040 hci_req_init(&req, hdev);
4041
4042 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4043 update_eir(&req);
4044 else
4045 clear_eir(&req);
4046
4047 hci_req_run(&req, NULL);
4048
4049 return err;
4050 }
4051
4052 static void sk_lookup(struct pending_cmd *cmd, void *data)
4053 {
4054 struct cmd_lookup *match = data;
4055
4056 if (match->sk == NULL) {
4057 match->sk = cmd->sk;
4058 sock_hold(match->sk);
4059 }
4060 }
4061
4062 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
4063 u8 status)
4064 {
4065 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
4066 int err = 0;
4067
4068 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
4069 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
4070 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
4071
4072 if (!status)
4073 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
4074 3, NULL);
4075
4076 if (match.sk)
4077 sock_put(match.sk);
4078
4079 return err;
4080 }
4081
4082 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
4083 {
4084 struct mgmt_cp_set_local_name ev;
4085 struct pending_cmd *cmd;
4086
4087 if (status)
4088 return 0;
4089
4090 memset(&ev, 0, sizeof(ev));
4091 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
4092 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
4093
4094 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
4095 if (!cmd) {
4096 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
4097
4098 /* If this is a HCI command related to powering on the
4099 * HCI dev don't send any mgmt signals.
4100 */
4101 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
4102 return 0;
4103 }
4104
4105 return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
4106 cmd ? cmd->sk : NULL);
4107 }
4108
4109 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
4110 u8 *randomizer, u8 status)
4111 {
4112 struct pending_cmd *cmd;
4113 int err;
4114
4115 BT_DBG("%s status %u", hdev->name, status);
4116
4117 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
4118 if (!cmd)
4119 return -ENOENT;
4120
4121 if (status) {
4122 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4123 mgmt_status(status));
4124 } else {
4125 struct mgmt_rp_read_local_oob_data rp;
4126
4127 memcpy(rp.hash, hash, sizeof(rp.hash));
4128 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
4129
4130 err = cmd_complete(cmd->sk, hdev->id,
4131 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
4132 sizeof(rp));
4133 }
4134
4135 mgmt_pending_remove(cmd);
4136
4137 return err;
4138 }
4139
4140 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
4141 {
4142 struct cmd_lookup match = { NULL, hdev };
4143 bool changed = false;
4144 int err = 0;
4145
4146 if (status) {
4147 u8 mgmt_err = mgmt_status(status);
4148
4149 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
4150 &hdev->dev_flags))
4151 err = new_settings(hdev, NULL);
4152
4153 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
4154 &mgmt_err);
4155
4156 return err;
4157 }
4158
4159 if (enable) {
4160 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4161 changed = true;
4162 } else {
4163 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4164 changed = true;
4165 }
4166
4167 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
4168
4169 if (changed)
4170 err = new_settings(hdev, match.sk);
4171
4172 if (match.sk)
4173 sock_put(match.sk);
4174
4175 return err;
4176 }
4177
4178 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4179 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
4180 ssp, u8 *eir, u16 eir_len)
4181 {
4182 char buf[512];
4183 struct mgmt_ev_device_found *ev = (void *) buf;
4184 size_t ev_size;
4185
4186 if (!hci_discovery_active(hdev))
4187 return -EPERM;
4188
4189 /* Leave 5 bytes for a potential CoD field */
4190 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
4191 return -EINVAL;
4192
4193 memset(buf, 0, sizeof(buf));
4194
4195 bacpy(&ev->addr.bdaddr, bdaddr);
4196 ev->addr.type = link_to_bdaddr(link_type, addr_type);
4197 ev->rssi = rssi;
4198 if (cfm_name)
4199 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
4200 if (!ssp)
4201 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
4202
4203 if (eir_len > 0)
4204 memcpy(ev->eir, eir, eir_len);
4205
4206 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
4207 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
4208 dev_class, 3);
4209
4210 ev->eir_len = cpu_to_le16(eir_len);
4211 ev_size = sizeof(*ev) + eir_len;
4212
4213 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
4214 }
4215
4216 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
4217 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
4218 {
4219 struct mgmt_ev_device_found *ev;
4220 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
4221 u16 eir_len;
4222
4223 ev = (struct mgmt_ev_device_found *) buf;
4224
4225 memset(buf, 0, sizeof(buf));
4226
4227 bacpy(&ev->addr.bdaddr, bdaddr);
4228 ev->addr.type = link_to_bdaddr(link_type, addr_type);
4229 ev->rssi = rssi;
4230
4231 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
4232 name_len);
4233
4234 ev->eir_len = cpu_to_le16(eir_len);
4235
4236 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
4237 sizeof(*ev) + eir_len, NULL);
4238 }
4239
4240 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
4241 {
4242 struct mgmt_ev_discovering ev;
4243 struct pending_cmd *cmd;
4244
4245 BT_DBG("%s discovering %u", hdev->name, discovering);
4246
4247 if (discovering)
4248 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
4249 else
4250 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4251
4252 if (cmd != NULL) {
4253 u8 type = hdev->discovery.type;
4254
4255 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
4256 sizeof(type));
4257 mgmt_pending_remove(cmd);
4258 }
4259
4260 memset(&ev, 0, sizeof(ev));
4261 ev.type = hdev->discovery.type;
4262 ev.discovering = discovering;
4263
4264 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
4265 }
4266
4267 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4268 {
4269 struct pending_cmd *cmd;
4270 struct mgmt_ev_device_blocked ev;
4271
4272 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
4273
4274 bacpy(&ev.addr.bdaddr, bdaddr);
4275 ev.addr.type = type;
4276
4277 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
4278 cmd ? cmd->sk : NULL);
4279 }
4280
4281 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4282 {
4283 struct pending_cmd *cmd;
4284 struct mgmt_ev_device_unblocked ev;
4285
4286 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
4287
4288 bacpy(&ev.addr.bdaddr, bdaddr);
4289 ev.addr.type = type;
4290
4291 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
4292 cmd ? cmd->sk : NULL);
4293 }
4294
4295 module_param(enable_hs, bool, 0644);
4296 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
Linux with added FPC-III support