projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
[deliverable/linux.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/mgmt.h>
33 #include <net/bluetooth/smp.h>
34
35 bool enable_hs;
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 1
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 };
80
81 static const u16 mgmt_events[] = {
82 MGMT_EV_CONTROLLER_ERROR,
83 MGMT_EV_INDEX_ADDED,
84 MGMT_EV_INDEX_REMOVED,
85 MGMT_EV_NEW_SETTINGS,
86 MGMT_EV_CLASS_OF_DEV_CHANGED,
87 MGMT_EV_LOCAL_NAME_CHANGED,
88 MGMT_EV_NEW_LINK_KEY,
89 MGMT_EV_NEW_LONG_TERM_KEY,
90 MGMT_EV_DEVICE_CONNECTED,
91 MGMT_EV_DEVICE_DISCONNECTED,
92 MGMT_EV_CONNECT_FAILED,
93 MGMT_EV_PIN_CODE_REQUEST,
94 MGMT_EV_USER_CONFIRM_REQUEST,
95 MGMT_EV_USER_PASSKEY_REQUEST,
96 MGMT_EV_AUTH_FAILED,
97 MGMT_EV_DEVICE_FOUND,
98 MGMT_EV_DISCOVERING,
99 MGMT_EV_DEVICE_BLOCKED,
100 MGMT_EV_DEVICE_UNBLOCKED,
101 MGMT_EV_DEVICE_UNPAIRED,
102 };
103
104 /*
105 * These LE scan and inquiry parameters were chosen according to LE General
106 * Discovery Procedure specification.
107 */
108 #define LE_SCAN_TYPE 0x01
109 #define LE_SCAN_WIN 0x12
110 #define LE_SCAN_INT 0x12
111 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
112 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
113
114 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
115 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
116
117 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
118
119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
120 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
121
122 struct pending_cmd {
123 struct list_head list;
124 u16 opcode;
125 int index;
126 void *param;
127 struct sock *sk;
128 void *user_data;
129 };
130
131 /* HCI to MGMT error code conversion table */
132 static u8 mgmt_status_table[] = {
133 MGMT_STATUS_SUCCESS,
134 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
135 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
136 MGMT_STATUS_FAILED, /* Hardware Failure */
137 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
138 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
139 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
140 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
141 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
142 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
143 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
144 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
145 MGMT_STATUS_BUSY, /* Command Disallowed */
146 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
147 MGMT_STATUS_REJECTED, /* Rejected Security */
148 MGMT_STATUS_REJECTED, /* Rejected Personal */
149 MGMT_STATUS_TIMEOUT, /* Host Timeout */
150 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
151 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
152 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
153 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
154 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
155 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
156 MGMT_STATUS_BUSY, /* Repeated Attempts */
157 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
158 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
159 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
160 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
161 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
162 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
163 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
164 MGMT_STATUS_FAILED, /* Unspecified Error */
165 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
166 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
167 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
168 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
169 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
170 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
171 MGMT_STATUS_FAILED, /* Unit Link Key Used */
172 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
173 MGMT_STATUS_TIMEOUT, /* Instant Passed */
174 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
175 MGMT_STATUS_FAILED, /* Transaction Collision */
176 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
177 MGMT_STATUS_REJECTED, /* QoS Rejected */
178 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
179 MGMT_STATUS_REJECTED, /* Insufficient Security */
180 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
181 MGMT_STATUS_BUSY, /* Role Switch Pending */
182 MGMT_STATUS_FAILED, /* Slot Violation */
183 MGMT_STATUS_FAILED, /* Role Switch Failed */
184 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
185 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
186 MGMT_STATUS_BUSY, /* Host Busy Pairing */
187 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
188 MGMT_STATUS_BUSY, /* Controller Busy */
189 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
190 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
191 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
192 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
193 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
194 };
195
196 static u8 mgmt_status(u8 hci_status)
197 {
198 if (hci_status < ARRAY_SIZE(mgmt_status_table))
199 return mgmt_status_table[hci_status];
200
201 return MGMT_STATUS_FAILED;
202 }
203
204 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
205 {
206 struct sk_buff *skb;
207 struct mgmt_hdr *hdr;
208 struct mgmt_ev_cmd_status *ev;
209 int err;
210
211 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
212
213 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
214 if (!skb)
215 return -ENOMEM;
216
217 hdr = (void *) skb_put(skb, sizeof(*hdr));
218
219 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
220 hdr->index = cpu_to_le16(index);
221 hdr->len = cpu_to_le16(sizeof(*ev));
222
223 ev = (void *) skb_put(skb, sizeof(*ev));
224 ev->status = status;
225 ev->opcode = cpu_to_le16(cmd);
226
227 err = sock_queue_rcv_skb(sk, skb);
228 if (err < 0)
229 kfree_skb(skb);
230
231 return err;
232 }
233
234 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
235 void *rp, size_t rp_len)
236 {
237 struct sk_buff *skb;
238 struct mgmt_hdr *hdr;
239 struct mgmt_ev_cmd_complete *ev;
240 int err;
241
242 BT_DBG("sock %p", sk);
243
244 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
245 if (!skb)
246 return -ENOMEM;
247
248 hdr = (void *) skb_put(skb, sizeof(*hdr));
249
250 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
251 hdr->index = cpu_to_le16(index);
252 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
253
254 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
255 ev->opcode = cpu_to_le16(cmd);
256 ev->status = status;
257
258 if (rp)
259 memcpy(ev->data, rp, rp_len);
260
261 err = sock_queue_rcv_skb(sk, skb);
262 if (err < 0)
263 kfree_skb(skb);
264
265 return err;
266 }
267
268 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
269 u16 data_len)
270 {
271 struct mgmt_rp_read_version rp;
272
273 BT_DBG("sock %p", sk);
274
275 rp.version = MGMT_VERSION;
276 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
277
278 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
279 sizeof(rp));
280 }
281
282 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
283 u16 data_len)
284 {
285 struct mgmt_rp_read_commands *rp;
286 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
287 const u16 num_events = ARRAY_SIZE(mgmt_events);
288 __le16 *opcode;
289 size_t rp_size;
290 int i, err;
291
292 BT_DBG("sock %p", sk);
293
294 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
295
296 rp = kmalloc(rp_size, GFP_KERNEL);
297 if (!rp)
298 return -ENOMEM;
299
300 rp->num_commands = __constant_cpu_to_le16(num_commands);
301 rp->num_events = __constant_cpu_to_le16(num_events);
302
303 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
304 put_unaligned_le16(mgmt_commands[i], opcode);
305
306 for (i = 0; i < num_events; i++, opcode++)
307 put_unaligned_le16(mgmt_events[i], opcode);
308
309 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
310 rp_size);
311 kfree(rp);
312
313 return err;
314 }
315
316 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
317 u16 data_len)
318 {
319 struct mgmt_rp_read_index_list *rp;
320 struct list_head *p;
321 struct hci_dev *d;
322 size_t rp_len;
323 u16 count;
324 int i, err;
325
326 BT_DBG("sock %p", sk);
327
328 read_lock(&hci_dev_list_lock);
329
330 count = 0;
331 list_for_each(p, &hci_dev_list) {
332 count++;
333 }
334
335 rp_len = sizeof(*rp) + (2 * count);
336 rp = kmalloc(rp_len, GFP_ATOMIC);
337 if (!rp) {
338 read_unlock(&hci_dev_list_lock);
339 return -ENOMEM;
340 }
341
342 rp->num_controllers = cpu_to_le16(count);
343
344 i = 0;
345 list_for_each_entry(d, &hci_dev_list, list) {
346 if (test_bit(HCI_SETUP, &d->dev_flags))
347 continue;
348
349 rp->index[i++] = cpu_to_le16(d->id);
350 BT_DBG("Added hci%u", d->id);
351 }
352
353 read_unlock(&hci_dev_list_lock);
354
355 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
356 rp_len);
357
358 kfree(rp);
359
360 return err;
361 }
362
363 static u32 get_supported_settings(struct hci_dev *hdev)
364 {
365 u32 settings = 0;
366
367 settings |= MGMT_SETTING_POWERED;
368 settings |= MGMT_SETTING_CONNECTABLE;
369 settings |= MGMT_SETTING_FAST_CONNECTABLE;
370 settings |= MGMT_SETTING_DISCOVERABLE;
371 settings |= MGMT_SETTING_PAIRABLE;
372
373 if (hdev->features[6] & LMP_SIMPLE_PAIR)
374 settings |= MGMT_SETTING_SSP;
375
376 if (!(hdev->features[4] & LMP_NO_BREDR)) {
377 settings |= MGMT_SETTING_BREDR;
378 settings |= MGMT_SETTING_LINK_SECURITY;
379 }
380
381 if (enable_hs)
382 settings |= MGMT_SETTING_HS;
383
384 if (hdev->features[4] & LMP_LE)
385 settings |= MGMT_SETTING_LE;
386
387 return settings;
388 }
389
390 static u32 get_current_settings(struct hci_dev *hdev)
391 {
392 u32 settings = 0;
393
394 if (hdev_is_powered(hdev))
395 settings |= MGMT_SETTING_POWERED;
396
397 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
398 settings |= MGMT_SETTING_CONNECTABLE;
399
400 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
401 settings |= MGMT_SETTING_DISCOVERABLE;
402
403 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
404 settings |= MGMT_SETTING_PAIRABLE;
405
406 if (!(hdev->features[4] & LMP_NO_BREDR))
407 settings |= MGMT_SETTING_BREDR;
408
409 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
410 settings |= MGMT_SETTING_LE;
411
412 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
413 settings |= MGMT_SETTING_LINK_SECURITY;
414
415 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
416 settings |= MGMT_SETTING_SSP;
417
418 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
419 settings |= MGMT_SETTING_HS;
420
421 return settings;
422 }
423
424 #define PNP_INFO_SVCLASS_ID 0x1200
425
426 static u8 bluetooth_base_uuid[] = {
427 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
428 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
429 };
430
431 static u16 get_uuid16(u8 *uuid128)
432 {
433 u32 val;
434 int i;
435
436 for (i = 0; i < 12; i++) {
437 if (bluetooth_base_uuid[i] != uuid128[i])
438 return 0;
439 }
440
441 val = get_unaligned_le32(&uuid128[12]);
442 if (val > 0xffff)
443 return 0;
444
445 return (u16) val;
446 }
447
448 static void create_eir(struct hci_dev *hdev, u8 *data)
449 {
450 u8 *ptr = data;
451 u16 eir_len = 0;
452 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
453 int i, truncated = 0;
454 struct bt_uuid *uuid;
455 size_t name_len;
456
457 name_len = strlen(hdev->dev_name);
458
459 if (name_len > 0) {
460 /* EIR Data type */
461 if (name_len > 48) {
462 name_len = 48;
463 ptr[1] = EIR_NAME_SHORT;
464 } else
465 ptr[1] = EIR_NAME_COMPLETE;
466
467 /* EIR Data length */
468 ptr[0] = name_len + 1;
469
470 memcpy(ptr + 2, hdev->dev_name, name_len);
471
472 eir_len += (name_len + 2);
473 ptr += (name_len + 2);
474 }
475
476 if (hdev->inq_tx_power) {
477 ptr[0] = 2;
478 ptr[1] = EIR_TX_POWER;
479 ptr[2] = (u8) hdev->inq_tx_power;
480
481 eir_len += 3;
482 ptr += 3;
483 }
484
485 if (hdev->devid_source > 0) {
486 ptr[0] = 9;
487 ptr[1] = EIR_DEVICE_ID;
488
489 put_unaligned_le16(hdev->devid_source, ptr + 2);
490 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
491 put_unaligned_le16(hdev->devid_product, ptr + 6);
492 put_unaligned_le16(hdev->devid_version, ptr + 8);
493
494 eir_len += 10;
495 ptr += 10;
496 }
497
498 memset(uuid16_list, 0, sizeof(uuid16_list));
499
500 /* Group all UUID16 types */
501 list_for_each_entry(uuid, &hdev->uuids, list) {
502 u16 uuid16;
503
504 uuid16 = get_uuid16(uuid->uuid);
505 if (uuid16 == 0)
506 return;
507
508 if (uuid16 < 0x1100)
509 continue;
510
511 if (uuid16 == PNP_INFO_SVCLASS_ID)
512 continue;
513
514 /* Stop if not enough space to put next UUID */
515 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
516 truncated = 1;
517 break;
518 }
519
520 /* Check for duplicates */
521 for (i = 0; uuid16_list[i] != 0; i++)
522 if (uuid16_list[i] == uuid16)
523 break;
524
525 if (uuid16_list[i] == 0) {
526 uuid16_list[i] = uuid16;
527 eir_len += sizeof(u16);
528 }
529 }
530
531 if (uuid16_list[0] != 0) {
532 u8 *length = ptr;
533
534 /* EIR Data type */
535 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
536
537 ptr += 2;
538 eir_len += 2;
539
540 for (i = 0; uuid16_list[i] != 0; i++) {
541 *ptr++ = (uuid16_list[i] & 0x00ff);
542 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
543 }
544
545 /* EIR Data length */
546 *length = (i * sizeof(u16)) + 1;
547 }
548 }
549
550 static int update_eir(struct hci_dev *hdev)
551 {
552 struct hci_cp_write_eir cp;
553
554 if (!hdev_is_powered(hdev))
555 return 0;
556
557 if (!(hdev->features[6] & LMP_EXT_INQ))
558 return 0;
559
560 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
561 return 0;
562
563 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
564 return 0;
565
566 memset(&cp, 0, sizeof(cp));
567
568 create_eir(hdev, cp.data);
569
570 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
571 return 0;
572
573 memcpy(hdev->eir, cp.data, sizeof(cp.data));
574
575 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
576 }
577
578 static u8 get_service_classes(struct hci_dev *hdev)
579 {
580 struct bt_uuid *uuid;
581 u8 val = 0;
582
583 list_for_each_entry(uuid, &hdev->uuids, list)
584 val |= uuid->svc_hint;
585
586 return val;
587 }
588
589 static int update_class(struct hci_dev *hdev)
590 {
591 u8 cod[3];
592 int err;
593
594 BT_DBG("%s", hdev->name);
595
596 if (!hdev_is_powered(hdev))
597 return 0;
598
599 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
600 return 0;
601
602 cod[0] = hdev->minor_class;
603 cod[1] = hdev->major_class;
604 cod[2] = get_service_classes(hdev);
605
606 if (memcmp(cod, hdev->dev_class, 3) == 0)
607 return 0;
608
609 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
610 if (err == 0)
611 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
612
613 return err;
614 }
615
616 static void service_cache_off(struct work_struct *work)
617 {
618 struct hci_dev *hdev = container_of(work, struct hci_dev,
619 service_cache.work);
620
621 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
622 return;
623
624 hci_dev_lock(hdev);
625
626 update_eir(hdev);
627 update_class(hdev);
628
629 hci_dev_unlock(hdev);
630 }
631
632 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
633 {
634 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
635 return;
636
637 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
638
639 /* Non-mgmt controlled devices get this bit set
640 * implicitly so that pairing works for them, however
641 * for mgmt we require user-space to explicitly enable
642 * it
643 */
644 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
645 }
646
647 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
648 void *data, u16 data_len)
649 {
650 struct mgmt_rp_read_info rp;
651
652 BT_DBG("sock %p %s", sk, hdev->name);
653
654 hci_dev_lock(hdev);
655
656 memset(&rp, 0, sizeof(rp));
657
658 bacpy(&rp.bdaddr, &hdev->bdaddr);
659
660 rp.version = hdev->hci_ver;
661 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
662
663 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
664 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
665
666 memcpy(rp.dev_class, hdev->dev_class, 3);
667
668 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
669 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
670
671 hci_dev_unlock(hdev);
672
673 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
674 sizeof(rp));
675 }
676
677 static void mgmt_pending_free(struct pending_cmd *cmd)
678 {
679 sock_put(cmd->sk);
680 kfree(cmd->param);
681 kfree(cmd);
682 }
683
684 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
685 struct hci_dev *hdev, void *data,
686 u16 len)
687 {
688 struct pending_cmd *cmd;
689
690 cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
691 if (!cmd)
692 return NULL;
693
694 cmd->opcode = opcode;
695 cmd->index = hdev->id;
696
697 cmd->param = kmalloc(len, GFP_ATOMIC);
698 if (!cmd->param) {
699 kfree(cmd);
700 return NULL;
701 }
702
703 if (data)
704 memcpy(cmd->param, data, len);
705
706 cmd->sk = sk;
707 sock_hold(sk);
708
709 list_add(&cmd->list, &hdev->mgmt_pending);
710
711 return cmd;
712 }
713
714 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
715 void (*cb)(struct pending_cmd *cmd,
716 void *data),
717 void *data)
718 {
719 struct list_head *p, *n;
720
721 list_for_each_safe(p, n, &hdev->mgmt_pending) {
722 struct pending_cmd *cmd;
723
724 cmd = list_entry(p, struct pending_cmd, list);
725
726 if (opcode > 0 && cmd->opcode != opcode)
727 continue;
728
729 cb(cmd, data);
730 }
731 }
732
733 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
734 {
735 struct pending_cmd *cmd;
736
737 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
738 if (cmd->opcode == opcode)
739 return cmd;
740 }
741
742 return NULL;
743 }
744
745 static void mgmt_pending_remove(struct pending_cmd *cmd)
746 {
747 list_del(&cmd->list);
748 mgmt_pending_free(cmd);
749 }
750
751 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
752 {
753 __le32 settings = cpu_to_le32(get_current_settings(hdev));
754
755 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
756 sizeof(settings));
757 }
758
759 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
760 u16 len)
761 {
762 struct mgmt_mode *cp = data;
763 struct pending_cmd *cmd;
764 int err;
765
766 BT_DBG("request for %s", hdev->name);
767
768 hci_dev_lock(hdev);
769
770 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
771 cancel_delayed_work(&hdev->power_off);
772
773 if (cp->val) {
774 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
775 mgmt_powered(hdev, 1);
776 goto failed;
777 }
778 }
779
780 if (!!cp->val == hdev_is_powered(hdev)) {
781 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
782 goto failed;
783 }
784
785 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
786 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
787 MGMT_STATUS_BUSY);
788 goto failed;
789 }
790
791 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
792 if (!cmd) {
793 err = -ENOMEM;
794 goto failed;
795 }
796
797 if (cp->val)
798 schedule_work(&hdev->power_on);
799 else
800 schedule_work(&hdev->power_off.work);
801
802 err = 0;
803
804 failed:
805 hci_dev_unlock(hdev);
806 return err;
807 }
808
809 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
810 struct sock *skip_sk)
811 {
812 struct sk_buff *skb;
813 struct mgmt_hdr *hdr;
814
815 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
816 if (!skb)
817 return -ENOMEM;
818
819 hdr = (void *) skb_put(skb, sizeof(*hdr));
820 hdr->opcode = cpu_to_le16(event);
821 if (hdev)
822 hdr->index = cpu_to_le16(hdev->id);
823 else
824 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
825 hdr->len = cpu_to_le16(data_len);
826
827 if (data)
828 memcpy(skb_put(skb, data_len), data, data_len);
829
830 /* Time stamp */
831 __net_timestamp(skb);
832
833 hci_send_to_control(skb, skip_sk);
834 kfree_skb(skb);
835
836 return 0;
837 }
838
839 static int new_settings(struct hci_dev *hdev, struct sock *skip)
840 {
841 __le32 ev;
842
843 ev = cpu_to_le32(get_current_settings(hdev));
844
845 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
846 }
847
848 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
849 u16 len)
850 {
851 struct mgmt_cp_set_discoverable *cp = data;
852 struct pending_cmd *cmd;
853 u16 timeout;
854 u8 scan;
855 int err;
856
857 BT_DBG("request for %s", hdev->name);
858
859 timeout = __le16_to_cpu(cp->timeout);
860 if (!cp->val && timeout > 0)
861 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
862 MGMT_STATUS_INVALID_PARAMS);
863
864 hci_dev_lock(hdev);
865
866 if (!hdev_is_powered(hdev) && timeout > 0) {
867 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
868 MGMT_STATUS_NOT_POWERED);
869 goto failed;
870 }
871
872 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
873 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
874 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
875 MGMT_STATUS_BUSY);
876 goto failed;
877 }
878
879 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
880 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
881 MGMT_STATUS_REJECTED);
882 goto failed;
883 }
884
885 if (!hdev_is_powered(hdev)) {
886 bool changed = false;
887
888 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
889 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
890 changed = true;
891 }
892
893 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
894 if (err < 0)
895 goto failed;
896
897 if (changed)
898 err = new_settings(hdev, sk);
899
900 goto failed;
901 }
902
903 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
904 if (hdev->discov_timeout > 0) {
905 cancel_delayed_work(&hdev->discov_off);
906 hdev->discov_timeout = 0;
907 }
908
909 if (cp->val && timeout > 0) {
910 hdev->discov_timeout = timeout;
911 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
912 msecs_to_jiffies(hdev->discov_timeout * 1000));
913 }
914
915 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
916 goto failed;
917 }
918
919 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
920 if (!cmd) {
921 err = -ENOMEM;
922 goto failed;
923 }
924
925 scan = SCAN_PAGE;
926
927 if (cp->val)
928 scan |= SCAN_INQUIRY;
929 else
930 cancel_delayed_work(&hdev->discov_off);
931
932 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
933 if (err < 0)
934 mgmt_pending_remove(cmd);
935
936 if (cp->val)
937 hdev->discov_timeout = timeout;
938
939 failed:
940 hci_dev_unlock(hdev);
941 return err;
942 }
943
944 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
945 u16 len)
946 {
947 struct mgmt_mode *cp = data;
948 struct pending_cmd *cmd;
949 u8 scan;
950 int err;
951
952 BT_DBG("request for %s", hdev->name);
953
954 hci_dev_lock(hdev);
955
956 if (!hdev_is_powered(hdev)) {
957 bool changed = false;
958
959 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
960 changed = true;
961
962 if (cp->val) {
963 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
964 } else {
965 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
966 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
967 }
968
969 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
970 if (err < 0)
971 goto failed;
972
973 if (changed)
974 err = new_settings(hdev, sk);
975
976 goto failed;
977 }
978
979 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
980 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
981 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
982 MGMT_STATUS_BUSY);
983 goto failed;
984 }
985
986 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
987 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
988 goto failed;
989 }
990
991 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
992 if (!cmd) {
993 err = -ENOMEM;
994 goto failed;
995 }
996
997 if (cp->val) {
998 scan = SCAN_PAGE;
999 } else {
1000 scan = 0;
1001
1002 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1003 hdev->discov_timeout > 0)
1004 cancel_delayed_work(&hdev->discov_off);
1005 }
1006
1007 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1008 if (err < 0)
1009 mgmt_pending_remove(cmd);
1010
1011 failed:
1012 hci_dev_unlock(hdev);
1013 return err;
1014 }
1015
1016 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1017 u16 len)
1018 {
1019 struct mgmt_mode *cp = data;
1020 int err;
1021
1022 BT_DBG("request for %s", hdev->name);
1023
1024 hci_dev_lock(hdev);
1025
1026 if (cp->val)
1027 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1028 else
1029 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1030
1031 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1032 if (err < 0)
1033 goto failed;
1034
1035 err = new_settings(hdev, sk);
1036
1037 failed:
1038 hci_dev_unlock(hdev);
1039 return err;
1040 }
1041
1042 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1043 u16 len)
1044 {
1045 struct mgmt_mode *cp = data;
1046 struct pending_cmd *cmd;
1047 u8 val;
1048 int err;
1049
1050 BT_DBG("request for %s", hdev->name);
1051
1052 hci_dev_lock(hdev);
1053
1054 if (!hdev_is_powered(hdev)) {
1055 bool changed = false;
1056
1057 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1058 &hdev->dev_flags)) {
1059 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1060 changed = true;
1061 }
1062
1063 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1064 if (err < 0)
1065 goto failed;
1066
1067 if (changed)
1068 err = new_settings(hdev, sk);
1069
1070 goto failed;
1071 }
1072
1073 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1074 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1075 MGMT_STATUS_BUSY);
1076 goto failed;
1077 }
1078
1079 val = !!cp->val;
1080
1081 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1082 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1083 goto failed;
1084 }
1085
1086 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1087 if (!cmd) {
1088 err = -ENOMEM;
1089 goto failed;
1090 }
1091
1092 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1093 if (err < 0) {
1094 mgmt_pending_remove(cmd);
1095 goto failed;
1096 }
1097
1098 failed:
1099 hci_dev_unlock(hdev);
1100 return err;
1101 }
1102
1103 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1104 {
1105 struct mgmt_mode *cp = data;
1106 struct pending_cmd *cmd;
1107 u8 val;
1108 int err;
1109
1110 BT_DBG("request for %s", hdev->name);
1111
1112 hci_dev_lock(hdev);
1113
1114 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1115 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1116 MGMT_STATUS_NOT_SUPPORTED);
1117 goto failed;
1118 }
1119
1120 val = !!cp->val;
1121
1122 if (!hdev_is_powered(hdev)) {
1123 bool changed = false;
1124
1125 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1126 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1127 changed = true;
1128 }
1129
1130 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1131 if (err < 0)
1132 goto failed;
1133
1134 if (changed)
1135 err = new_settings(hdev, sk);
1136
1137 goto failed;
1138 }
1139
1140 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1141 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1142 MGMT_STATUS_BUSY);
1143 goto failed;
1144 }
1145
1146 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1147 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1148 goto failed;
1149 }
1150
1151 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1152 if (!cmd) {
1153 err = -ENOMEM;
1154 goto failed;
1155 }
1156
1157 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1158 if (err < 0) {
1159 mgmt_pending_remove(cmd);
1160 goto failed;
1161 }
1162
1163 failed:
1164 hci_dev_unlock(hdev);
1165 return err;
1166 }
1167
1168 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1169 {
1170 struct mgmt_mode *cp = data;
1171
1172 BT_DBG("request for %s", hdev->name);
1173
1174 if (!enable_hs)
1175 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1176 MGMT_STATUS_NOT_SUPPORTED);
1177
1178 if (cp->val)
1179 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1180 else
1181 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1182
1183 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1184 }
1185
1186 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1187 {
1188 struct mgmt_mode *cp = data;
1189 struct hci_cp_write_le_host_supported hci_cp;
1190 struct pending_cmd *cmd;
1191 int err;
1192 u8 val, enabled;
1193
1194 BT_DBG("request for %s", hdev->name);
1195
1196 hci_dev_lock(hdev);
1197
1198 if (!(hdev->features[4] & LMP_LE)) {
1199 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1200 MGMT_STATUS_NOT_SUPPORTED);
1201 goto unlock;
1202 }
1203
1204 val = !!cp->val;
1205 enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1206
1207 if (!hdev_is_powered(hdev) || val == enabled) {
1208 bool changed = false;
1209
1210 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1211 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1212 changed = true;
1213 }
1214
1215 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1216 if (err < 0)
1217 goto unlock;
1218
1219 if (changed)
1220 err = new_settings(hdev, sk);
1221
1222 goto unlock;
1223 }
1224
1225 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1226 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1227 MGMT_STATUS_BUSY);
1228 goto unlock;
1229 }
1230
1231 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1232 if (!cmd) {
1233 err = -ENOMEM;
1234 goto unlock;
1235 }
1236
1237 memset(&hci_cp, 0, sizeof(hci_cp));
1238
1239 if (val) {
1240 hci_cp.le = val;
1241 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1242 }
1243
1244 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1245 &hci_cp);
1246 if (err < 0)
1247 mgmt_pending_remove(cmd);
1248
1249 unlock:
1250 hci_dev_unlock(hdev);
1251 return err;
1252 }
1253
1254 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1255 {
1256 struct mgmt_cp_add_uuid *cp = data;
1257 struct pending_cmd *cmd;
1258 struct bt_uuid *uuid;
1259 int err;
1260
1261 BT_DBG("request for %s", hdev->name);
1262
1263 hci_dev_lock(hdev);
1264
1265 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1266 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1267 MGMT_STATUS_BUSY);
1268 goto failed;
1269 }
1270
1271 uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1272 if (!uuid) {
1273 err = -ENOMEM;
1274 goto failed;
1275 }
1276
1277 memcpy(uuid->uuid, cp->uuid, 16);
1278 uuid->svc_hint = cp->svc_hint;
1279
1280 list_add(&uuid->list, &hdev->uuids);
1281
1282 err = update_class(hdev);
1283 if (err < 0)
1284 goto failed;
1285
1286 err = update_eir(hdev);
1287 if (err < 0)
1288 goto failed;
1289
1290 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1291 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1292 hdev->dev_class, 3);
1293 goto failed;
1294 }
1295
1296 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1297 if (!cmd)
1298 err = -ENOMEM;
1299
1300 failed:
1301 hci_dev_unlock(hdev);
1302 return err;
1303 }
1304
1305 static bool enable_service_cache(struct hci_dev *hdev)
1306 {
1307 if (!hdev_is_powered(hdev))
1308 return false;
1309
1310 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1311 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1312 return true;
1313 }
1314
1315 return false;
1316 }
1317
1318 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1319 u16 len)
1320 {
1321 struct mgmt_cp_remove_uuid *cp = data;
1322 struct pending_cmd *cmd;
1323 struct list_head *p, *n;
1324 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1325 int err, found;
1326
1327 BT_DBG("request for %s", hdev->name);
1328
1329 hci_dev_lock(hdev);
1330
1331 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1332 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1333 MGMT_STATUS_BUSY);
1334 goto unlock;
1335 }
1336
1337 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1338 err = hci_uuids_clear(hdev);
1339
1340 if (enable_service_cache(hdev)) {
1341 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1342 0, hdev->dev_class, 3);
1343 goto unlock;
1344 }
1345
1346 goto update_class;
1347 }
1348
1349 found = 0;
1350
1351 list_for_each_safe(p, n, &hdev->uuids) {
1352 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1353
1354 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1355 continue;
1356
1357 list_del(&match->list);
1358 found++;
1359 }
1360
1361 if (found == 0) {
1362 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1363 MGMT_STATUS_INVALID_PARAMS);
1364 goto unlock;
1365 }
1366
1367 update_class:
1368 err = update_class(hdev);
1369 if (err < 0)
1370 goto unlock;
1371
1372 err = update_eir(hdev);
1373 if (err < 0)
1374 goto unlock;
1375
1376 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1377 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1378 hdev->dev_class, 3);
1379 goto unlock;
1380 }
1381
1382 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1383 if (!cmd)
1384 err = -ENOMEM;
1385
1386 unlock:
1387 hci_dev_unlock(hdev);
1388 return err;
1389 }
1390
1391 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1392 u16 len)
1393 {
1394 struct mgmt_cp_set_dev_class *cp = data;
1395 struct pending_cmd *cmd;
1396 int err;
1397
1398 BT_DBG("request for %s", hdev->name);
1399
1400 hci_dev_lock(hdev);
1401
1402 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1403 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1404 MGMT_STATUS_BUSY);
1405 goto unlock;
1406 }
1407
1408 hdev->major_class = cp->major;
1409 hdev->minor_class = cp->minor;
1410
1411 if (!hdev_is_powered(hdev)) {
1412 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1413 hdev->dev_class, 3);
1414 goto unlock;
1415 }
1416
1417 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1418 hci_dev_unlock(hdev);
1419 cancel_delayed_work_sync(&hdev->service_cache);
1420 hci_dev_lock(hdev);
1421 update_eir(hdev);
1422 }
1423
1424 err = update_class(hdev);
1425 if (err < 0)
1426 goto unlock;
1427
1428 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1429 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1430 hdev->dev_class, 3);
1431 goto unlock;
1432 }
1433
1434 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1435 if (!cmd)
1436 err = -ENOMEM;
1437
1438 unlock:
1439 hci_dev_unlock(hdev);
1440 return err;
1441 }
1442
1443 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1444 u16 len)
1445 {
1446 struct mgmt_cp_load_link_keys *cp = data;
1447 u16 key_count, expected_len;
1448 int i;
1449
1450 key_count = __le16_to_cpu(cp->key_count);
1451
1452 expected_len = sizeof(*cp) + key_count *
1453 sizeof(struct mgmt_link_key_info);
1454 if (expected_len != len) {
1455 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1456 len, expected_len);
1457 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1458 MGMT_STATUS_INVALID_PARAMS);
1459 }
1460
1461 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1462 key_count);
1463
1464 hci_dev_lock(hdev);
1465
1466 hci_link_keys_clear(hdev);
1467
1468 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1469
1470 if (cp->debug_keys)
1471 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1472 else
1473 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1474
1475 for (i = 0; i < key_count; i++) {
1476 struct mgmt_link_key_info *key = &cp->keys[i];
1477
1478 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1479 key->type, key->pin_len);
1480 }
1481
1482 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1483
1484 hci_dev_unlock(hdev);
1485
1486 return 0;
1487 }
1488
1489 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1490 u8 addr_type, struct sock *skip_sk)
1491 {
1492 struct mgmt_ev_device_unpaired ev;
1493
1494 bacpy(&ev.addr.bdaddr, bdaddr);
1495 ev.addr.type = addr_type;
1496
1497 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1498 skip_sk);
1499 }
1500
1501 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1502 u16 len)
1503 {
1504 struct mgmt_cp_unpair_device *cp = data;
1505 struct mgmt_rp_unpair_device rp;
1506 struct hci_cp_disconnect dc;
1507 struct pending_cmd *cmd;
1508 struct hci_conn *conn;
1509 int err;
1510
1511 hci_dev_lock(hdev);
1512
1513 memset(&rp, 0, sizeof(rp));
1514 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1515 rp.addr.type = cp->addr.type;
1516
1517 if (!hdev_is_powered(hdev)) {
1518 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1519 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1520 goto unlock;
1521 }
1522
1523 if (cp->addr.type == BDADDR_BREDR)
1524 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1525 else
1526 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1527
1528 if (err < 0) {
1529 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1530 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1531 goto unlock;
1532 }
1533
1534 if (cp->disconnect) {
1535 if (cp->addr.type == BDADDR_BREDR)
1536 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1537 &cp->addr.bdaddr);
1538 else
1539 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1540 &cp->addr.bdaddr);
1541 } else {
1542 conn = NULL;
1543 }
1544
1545 if (!conn) {
1546 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1547 &rp, sizeof(rp));
1548 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1549 goto unlock;
1550 }
1551
1552 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1553 sizeof(*cp));
1554 if (!cmd) {
1555 err = -ENOMEM;
1556 goto unlock;
1557 }
1558
1559 dc.handle = cpu_to_le16(conn->handle);
1560 dc.reason = 0x13; /* Remote User Terminated Connection */
1561 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1562 if (err < 0)
1563 mgmt_pending_remove(cmd);
1564
1565 unlock:
1566 hci_dev_unlock(hdev);
1567 return err;
1568 }
1569
1570 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1571 u16 len)
1572 {
1573 struct mgmt_cp_disconnect *cp = data;
1574 struct hci_cp_disconnect dc;
1575 struct pending_cmd *cmd;
1576 struct hci_conn *conn;
1577 int err;
1578
1579 BT_DBG("");
1580
1581 hci_dev_lock(hdev);
1582
1583 if (!test_bit(HCI_UP, &hdev->flags)) {
1584 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1585 MGMT_STATUS_NOT_POWERED);
1586 goto failed;
1587 }
1588
1589 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1590 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1591 MGMT_STATUS_BUSY);
1592 goto failed;
1593 }
1594
1595 if (cp->addr.type == BDADDR_BREDR)
1596 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1597 &cp->addr.bdaddr);
1598 else
1599 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1600
1601 if (!conn) {
1602 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603 MGMT_STATUS_NOT_CONNECTED);
1604 goto failed;
1605 }
1606
1607 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1608 if (!cmd) {
1609 err = -ENOMEM;
1610 goto failed;
1611 }
1612
1613 dc.handle = cpu_to_le16(conn->handle);
1614 dc.reason = 0x13; /* Remote User Terminated Connection */
1615
1616 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1617 if (err < 0)
1618 mgmt_pending_remove(cmd);
1619
1620 failed:
1621 hci_dev_unlock(hdev);
1622 return err;
1623 }
1624
1625 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1626 {
1627 switch (link_type) {
1628 case LE_LINK:
1629 switch (addr_type) {
1630 case ADDR_LE_DEV_PUBLIC:
1631 return BDADDR_LE_PUBLIC;
1632
1633 default:
1634 /* Fallback to LE Random address type */
1635 return BDADDR_LE_RANDOM;
1636 }
1637
1638 default:
1639 /* Fallback to BR/EDR type */
1640 return BDADDR_BREDR;
1641 }
1642 }
1643
1644 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1645 u16 data_len)
1646 {
1647 struct mgmt_rp_get_connections *rp;
1648 struct hci_conn *c;
1649 size_t rp_len;
1650 int err;
1651 u16 i;
1652
1653 BT_DBG("");
1654
1655 hci_dev_lock(hdev);
1656
1657 if (!hdev_is_powered(hdev)) {
1658 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1659 MGMT_STATUS_NOT_POWERED);
1660 goto unlock;
1661 }
1662
1663 i = 0;
1664 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1665 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1666 i++;
1667 }
1668
1669 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1670 rp = kmalloc(rp_len, GFP_ATOMIC);
1671 if (!rp) {
1672 err = -ENOMEM;
1673 goto unlock;
1674 }
1675
1676 i = 0;
1677 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1678 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1679 continue;
1680 bacpy(&rp->addr[i].bdaddr, &c->dst);
1681 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1682 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1683 continue;
1684 i++;
1685 }
1686
1687 rp->conn_count = cpu_to_le16(i);
1688
1689 /* Recalculate length in case of filtered SCO connections, etc */
1690 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1691
1692 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1693 rp_len);
1694
1695 kfree(rp);
1696
1697 unlock:
1698 hci_dev_unlock(hdev);
1699 return err;
1700 }
1701
1702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1703 struct mgmt_cp_pin_code_neg_reply *cp)
1704 {
1705 struct pending_cmd *cmd;
1706 int err;
1707
1708 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1709 sizeof(*cp));
1710 if (!cmd)
1711 return -ENOMEM;
1712
1713 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1714 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1715 if (err < 0)
1716 mgmt_pending_remove(cmd);
1717
1718 return err;
1719 }
1720
1721 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1722 u16 len)
1723 {
1724 struct hci_conn *conn;
1725 struct mgmt_cp_pin_code_reply *cp = data;
1726 struct hci_cp_pin_code_reply reply;
1727 struct pending_cmd *cmd;
1728 int err;
1729
1730 BT_DBG("");
1731
1732 hci_dev_lock(hdev);
1733
1734 if (!hdev_is_powered(hdev)) {
1735 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1736 MGMT_STATUS_NOT_POWERED);
1737 goto failed;
1738 }
1739
1740 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1741 if (!conn) {
1742 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1743 MGMT_STATUS_NOT_CONNECTED);
1744 goto failed;
1745 }
1746
1747 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1748 struct mgmt_cp_pin_code_neg_reply ncp;
1749
1750 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1751
1752 BT_ERR("PIN code is not 16 bytes long");
1753
1754 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1755 if (err >= 0)
1756 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1757 MGMT_STATUS_INVALID_PARAMS);
1758
1759 goto failed;
1760 }
1761
1762 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1763 if (!cmd) {
1764 err = -ENOMEM;
1765 goto failed;
1766 }
1767
1768 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1769 reply.pin_len = cp->pin_len;
1770 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1771
1772 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1773 if (err < 0)
1774 mgmt_pending_remove(cmd);
1775
1776 failed:
1777 hci_dev_unlock(hdev);
1778 return err;
1779 }
1780
1781 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1782 void *data, u16 len)
1783 {
1784 struct mgmt_cp_pin_code_neg_reply *cp = data;
1785 int err;
1786
1787 BT_DBG("");
1788
1789 hci_dev_lock(hdev);
1790
1791 if (!hdev_is_powered(hdev)) {
1792 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1793 MGMT_STATUS_NOT_POWERED);
1794 goto failed;
1795 }
1796
1797 err = send_pin_code_neg_reply(sk, hdev, cp);
1798
1799 failed:
1800 hci_dev_unlock(hdev);
1801 return err;
1802 }
1803
1804 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1805 u16 len)
1806 {
1807 struct mgmt_cp_set_io_capability *cp = data;
1808
1809 BT_DBG("");
1810
1811 hci_dev_lock(hdev);
1812
1813 hdev->io_capability = cp->io_capability;
1814
1815 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1816 hdev->io_capability);
1817
1818 hci_dev_unlock(hdev);
1819
1820 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1821 0);
1822 }
1823
1824 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1825 {
1826 struct hci_dev *hdev = conn->hdev;
1827 struct pending_cmd *cmd;
1828
1829 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1830 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1831 continue;
1832
1833 if (cmd->user_data != conn)
1834 continue;
1835
1836 return cmd;
1837 }
1838
1839 return NULL;
1840 }
1841
1842 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1843 {
1844 struct mgmt_rp_pair_device rp;
1845 struct hci_conn *conn = cmd->user_data;
1846
1847 bacpy(&rp.addr.bdaddr, &conn->dst);
1848 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1849
1850 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1851 &rp, sizeof(rp));
1852
1853 /* So we don't get further callbacks for this connection */
1854 conn->connect_cfm_cb = NULL;
1855 conn->security_cfm_cb = NULL;
1856 conn->disconn_cfm_cb = NULL;
1857
1858 hci_conn_put(conn);
1859
1860 mgmt_pending_remove(cmd);
1861 }
1862
1863 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1864 {
1865 struct pending_cmd *cmd;
1866
1867 BT_DBG("status %u", status);
1868
1869 cmd = find_pairing(conn);
1870 if (!cmd)
1871 BT_DBG("Unable to find a pending command");
1872 else
1873 pairing_complete(cmd, mgmt_status(status));
1874 }
1875
1876 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1877 {
1878 struct pending_cmd *cmd;
1879
1880 BT_DBG("status %u", status);
1881
1882 if (!status)
1883 return;
1884
1885 cmd = find_pairing(conn);
1886 if (!cmd)
1887 BT_DBG("Unable to find a pending command");
1888 else
1889 pairing_complete(cmd, mgmt_status(status));
1890 }
1891
1892 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1893 u16 len)
1894 {
1895 struct mgmt_cp_pair_device *cp = data;
1896 struct mgmt_rp_pair_device rp;
1897 struct pending_cmd *cmd;
1898 u8 sec_level, auth_type;
1899 struct hci_conn *conn;
1900 int err;
1901
1902 BT_DBG("");
1903
1904 hci_dev_lock(hdev);
1905
1906 if (!hdev_is_powered(hdev)) {
1907 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1908 MGMT_STATUS_NOT_POWERED);
1909 goto unlock;
1910 }
1911
1912 sec_level = BT_SECURITY_MEDIUM;
1913 if (cp->io_cap == 0x03)
1914 auth_type = HCI_AT_DEDICATED_BONDING;
1915 else
1916 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1917
1918 if (cp->addr.type == BDADDR_BREDR)
1919 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1920 cp->addr.type, sec_level, auth_type);
1921 else
1922 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1923 cp->addr.type, sec_level, auth_type);
1924
1925 memset(&rp, 0, sizeof(rp));
1926 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1927 rp.addr.type = cp->addr.type;
1928
1929 if (IS_ERR(conn)) {
1930 int status;
1931
1932 if (PTR_ERR(conn) == -EBUSY)
1933 status = MGMT_STATUS_BUSY;
1934 else
1935 status = MGMT_STATUS_CONNECT_FAILED;
1936
1937 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1938 status, &rp,
1939 sizeof(rp));
1940 goto unlock;
1941 }
1942
1943 if (conn->connect_cfm_cb) {
1944 hci_conn_put(conn);
1945 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1946 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1947 goto unlock;
1948 }
1949
1950 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1951 if (!cmd) {
1952 err = -ENOMEM;
1953 hci_conn_put(conn);
1954 goto unlock;
1955 }
1956
1957 /* For LE, just connecting isn't a proof that the pairing finished */
1958 if (cp->addr.type == BDADDR_BREDR)
1959 conn->connect_cfm_cb = pairing_complete_cb;
1960 else
1961 conn->connect_cfm_cb = le_connect_complete_cb;
1962
1963 conn->security_cfm_cb = pairing_complete_cb;
1964 conn->disconn_cfm_cb = pairing_complete_cb;
1965 conn->io_capability = cp->io_cap;
1966 cmd->user_data = conn;
1967
1968 if (conn->state == BT_CONNECTED &&
1969 hci_conn_security(conn, sec_level, auth_type))
1970 pairing_complete(cmd, 0);
1971
1972 err = 0;
1973
1974 unlock:
1975 hci_dev_unlock(hdev);
1976 return err;
1977 }
1978
1979 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1980 u16 len)
1981 {
1982 struct mgmt_addr_info *addr = data;
1983 struct pending_cmd *cmd;
1984 struct hci_conn *conn;
1985 int err;
1986
1987 BT_DBG("");
1988
1989 hci_dev_lock(hdev);
1990
1991 if (!hdev_is_powered(hdev)) {
1992 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1993 MGMT_STATUS_NOT_POWERED);
1994 goto unlock;
1995 }
1996
1997 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1998 if (!cmd) {
1999 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2000 MGMT_STATUS_INVALID_PARAMS);
2001 goto unlock;
2002 }
2003
2004 conn = cmd->user_data;
2005
2006 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2007 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2008 MGMT_STATUS_INVALID_PARAMS);
2009 goto unlock;
2010 }
2011
2012 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2013
2014 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2015 addr, sizeof(*addr));
2016 unlock:
2017 hci_dev_unlock(hdev);
2018 return err;
2019 }
2020
2021 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2022 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2023 u16 hci_op, __le32 passkey)
2024 {
2025 struct pending_cmd *cmd;
2026 struct hci_conn *conn;
2027 int err;
2028
2029 hci_dev_lock(hdev);
2030
2031 if (!hdev_is_powered(hdev)) {
2032 err = cmd_status(sk, hdev->id, mgmt_op,
2033 MGMT_STATUS_NOT_POWERED);
2034 goto done;
2035 }
2036
2037 if (type == BDADDR_BREDR)
2038 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2039 else
2040 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2041
2042 if (!conn) {
2043 err = cmd_status(sk, hdev->id, mgmt_op,
2044 MGMT_STATUS_NOT_CONNECTED);
2045 goto done;
2046 }
2047
2048 if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2049 /* Continue with pairing via SMP */
2050 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2051
2052 if (!err)
2053 err = cmd_status(sk, hdev->id, mgmt_op,
2054 MGMT_STATUS_SUCCESS);
2055 else
2056 err = cmd_status(sk, hdev->id, mgmt_op,
2057 MGMT_STATUS_FAILED);
2058
2059 goto done;
2060 }
2061
2062 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2063 if (!cmd) {
2064 err = -ENOMEM;
2065 goto done;
2066 }
2067
2068 /* Continue with pairing via HCI */
2069 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2070 struct hci_cp_user_passkey_reply cp;
2071
2072 bacpy(&cp.bdaddr, bdaddr);
2073 cp.passkey = passkey;
2074 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2075 } else
2076 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2077
2078 if (err < 0)
2079 mgmt_pending_remove(cmd);
2080
2081 done:
2082 hci_dev_unlock(hdev);
2083 return err;
2084 }
2085
2086 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2087 u16 len)
2088 {
2089 struct mgmt_cp_user_confirm_reply *cp = data;
2090
2091 BT_DBG("");
2092
2093 if (len != sizeof(*cp))
2094 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2095 MGMT_STATUS_INVALID_PARAMS);
2096
2097 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2098 MGMT_OP_USER_CONFIRM_REPLY,
2099 HCI_OP_USER_CONFIRM_REPLY, 0);
2100 }
2101
2102 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2103 void *data, u16 len)
2104 {
2105 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2106
2107 BT_DBG("");
2108
2109 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2110 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2111 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2112 }
2113
2114 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2115 u16 len)
2116 {
2117 struct mgmt_cp_user_passkey_reply *cp = data;
2118
2119 BT_DBG("");
2120
2121 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2122 MGMT_OP_USER_PASSKEY_REPLY,
2123 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2124 }
2125
2126 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2127 void *data, u16 len)
2128 {
2129 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2130
2131 BT_DBG("");
2132
2133 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2134 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2135 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2136 }
2137
2138 static int update_name(struct hci_dev *hdev, const char *name)
2139 {
2140 struct hci_cp_write_local_name cp;
2141
2142 memcpy(cp.name, name, sizeof(cp.name));
2143
2144 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2145 }
2146
2147 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2148 u16 len)
2149 {
2150 struct mgmt_cp_set_local_name *cp = data;
2151 struct pending_cmd *cmd;
2152 int err;
2153
2154 BT_DBG("");
2155
2156 hci_dev_lock(hdev);
2157
2158 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2159
2160 if (!hdev_is_powered(hdev)) {
2161 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2162
2163 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2164 data, len);
2165 if (err < 0)
2166 goto failed;
2167
2168 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2169 sk);
2170
2171 goto failed;
2172 }
2173
2174 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2175 if (!cmd) {
2176 err = -ENOMEM;
2177 goto failed;
2178 }
2179
2180 err = update_name(hdev, cp->name);
2181 if (err < 0)
2182 mgmt_pending_remove(cmd);
2183
2184 failed:
2185 hci_dev_unlock(hdev);
2186 return err;
2187 }
2188
2189 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2190 void *data, u16 data_len)
2191 {
2192 struct pending_cmd *cmd;
2193 int err;
2194
2195 BT_DBG("%s", hdev->name);
2196
2197 hci_dev_lock(hdev);
2198
2199 if (!hdev_is_powered(hdev)) {
2200 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2201 MGMT_STATUS_NOT_POWERED);
2202 goto unlock;
2203 }
2204
2205 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2206 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2207 MGMT_STATUS_NOT_SUPPORTED);
2208 goto unlock;
2209 }
2210
2211 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2212 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2213 MGMT_STATUS_BUSY);
2214 goto unlock;
2215 }
2216
2217 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2218 if (!cmd) {
2219 err = -ENOMEM;
2220 goto unlock;
2221 }
2222
2223 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2224 if (err < 0)
2225 mgmt_pending_remove(cmd);
2226
2227 unlock:
2228 hci_dev_unlock(hdev);
2229 return err;
2230 }
2231
2232 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2233 void *data, u16 len)
2234 {
2235 struct mgmt_cp_add_remote_oob_data *cp = data;
2236 u8 status;
2237 int err;
2238
2239 BT_DBG("%s ", hdev->name);
2240
2241 hci_dev_lock(hdev);
2242
2243 if (!hdev_is_powered(hdev)) {
2244 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2245 MGMT_STATUS_NOT_POWERED, &cp->addr,
2246 sizeof(cp->addr));
2247 goto unlock;
2248 }
2249
2250 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2251 cp->randomizer);
2252 if (err < 0)
2253 status = MGMT_STATUS_FAILED;
2254 else
2255 status = 0;
2256
2257 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2258 &cp->addr, sizeof(cp->addr));
2259
2260 unlock:
2261 hci_dev_unlock(hdev);
2262 return err;
2263 }
2264
2265 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2266 void *data, u16 len)
2267 {
2268 struct mgmt_cp_remove_remote_oob_data *cp = data;
2269 u8 status;
2270 int err;
2271
2272 BT_DBG("%s", hdev->name);
2273
2274 hci_dev_lock(hdev);
2275
2276 if (!hdev_is_powered(hdev)) {
2277 err = cmd_complete(sk, hdev->id,
2278 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2279 MGMT_STATUS_NOT_POWERED, &cp->addr,
2280 sizeof(cp->addr));
2281 goto unlock;
2282 }
2283
2284 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2285 if (err < 0)
2286 status = MGMT_STATUS_INVALID_PARAMS;
2287 else
2288 status = 0;
2289
2290 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2291 status, &cp->addr, sizeof(cp->addr));
2292
2293 unlock:
2294 hci_dev_unlock(hdev);
2295 return err;
2296 }
2297
2298 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2299 {
2300 int err;
2301
2302 BT_DBG("%s", hdev->name);
2303
2304 hci_dev_lock(hdev);
2305
2306 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2307 if (err < 0)
2308 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2309
2310 hci_dev_unlock(hdev);
2311
2312 return err;
2313 }
2314
2315 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2316 void *data, u16 len)
2317 {
2318 struct mgmt_cp_start_discovery *cp = data;
2319 struct pending_cmd *cmd;
2320 int err;
2321
2322 BT_DBG("%s", hdev->name);
2323
2324 hci_dev_lock(hdev);
2325
2326 if (!hdev_is_powered(hdev)) {
2327 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2328 MGMT_STATUS_NOT_POWERED);
2329 goto failed;
2330 }
2331
2332 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2333 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2334 MGMT_STATUS_BUSY);
2335 goto failed;
2336 }
2337
2338 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2339 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2340 MGMT_STATUS_BUSY);
2341 goto failed;
2342 }
2343
2344 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2345 if (!cmd) {
2346 err = -ENOMEM;
2347 goto failed;
2348 }
2349
2350 hdev->discovery.type = cp->type;
2351
2352 switch (hdev->discovery.type) {
2353 case DISCOV_TYPE_BREDR:
2354 if (lmp_bredr_capable(hdev))
2355 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2356 else
2357 err = -ENOTSUPP;
2358 break;
2359
2360 case DISCOV_TYPE_LE:
2361 if (lmp_host_le_capable(hdev))
2362 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2363 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2364 else
2365 err = -ENOTSUPP;
2366 break;
2367
2368 case DISCOV_TYPE_INTERLEAVED:
2369 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2370 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2371 LE_SCAN_WIN,
2372 LE_SCAN_TIMEOUT_BREDR_LE);
2373 else
2374 err = -ENOTSUPP;
2375 break;
2376
2377 default:
2378 err = -EINVAL;
2379 }
2380
2381 if (err < 0)
2382 mgmt_pending_remove(cmd);
2383 else
2384 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2385
2386 failed:
2387 hci_dev_unlock(hdev);
2388 return err;
2389 }
2390
2391 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2392 u16 len)
2393 {
2394 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2395 struct pending_cmd *cmd;
2396 struct hci_cp_remote_name_req_cancel cp;
2397 struct inquiry_entry *e;
2398 int err;
2399
2400 BT_DBG("%s", hdev->name);
2401
2402 hci_dev_lock(hdev);
2403
2404 if (!hci_discovery_active(hdev)) {
2405 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2406 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2407 sizeof(mgmt_cp->type));
2408 goto unlock;
2409 }
2410
2411 if (hdev->discovery.type != mgmt_cp->type) {
2412 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2413 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2414 sizeof(mgmt_cp->type));
2415 goto unlock;
2416 }
2417
2418 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2419 if (!cmd) {
2420 err = -ENOMEM;
2421 goto unlock;
2422 }
2423
2424 switch (hdev->discovery.state) {
2425 case DISCOVERY_FINDING:
2426 if (test_bit(HCI_INQUIRY, &hdev->flags))
2427 err = hci_cancel_inquiry(hdev);
2428 else
2429 err = hci_cancel_le_scan(hdev);
2430
2431 break;
2432
2433 case DISCOVERY_RESOLVING:
2434 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2435 NAME_PENDING);
2436 if (!e) {
2437 mgmt_pending_remove(cmd);
2438 err = cmd_complete(sk, hdev->id,
2439 MGMT_OP_STOP_DISCOVERY, 0,
2440 &mgmt_cp->type,
2441 sizeof(mgmt_cp->type));
2442 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2443 goto unlock;
2444 }
2445
2446 bacpy(&cp.bdaddr, &e->data.bdaddr);
2447 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2448 sizeof(cp), &cp);
2449
2450 break;
2451
2452 default:
2453 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2454 err = -EFAULT;
2455 }
2456
2457 if (err < 0)
2458 mgmt_pending_remove(cmd);
2459 else
2460 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2461
2462 unlock:
2463 hci_dev_unlock(hdev);
2464 return err;
2465 }
2466
2467 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2468 u16 len)
2469 {
2470 struct mgmt_cp_confirm_name *cp = data;
2471 struct inquiry_entry *e;
2472 int err;
2473
2474 BT_DBG("%s", hdev->name);
2475
2476 hci_dev_lock(hdev);
2477
2478 if (!hci_discovery_active(hdev)) {
2479 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2480 MGMT_STATUS_FAILED);
2481 goto failed;
2482 }
2483
2484 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2485 if (!e) {
2486 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2487 MGMT_STATUS_INVALID_PARAMS);
2488 goto failed;
2489 }
2490
2491 if (cp->name_known) {
2492 e->name_state = NAME_KNOWN;
2493 list_del(&e->list);
2494 } else {
2495 e->name_state = NAME_NEEDED;
2496 hci_inquiry_cache_update_resolve(hdev, e);
2497 }
2498
2499 err = 0;
2500
2501 failed:
2502 hci_dev_unlock(hdev);
2503 return err;
2504 }
2505
2506 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2507 u16 len)
2508 {
2509 struct mgmt_cp_block_device *cp = data;
2510 u8 status;
2511 int err;
2512
2513 BT_DBG("%s", hdev->name);
2514
2515 hci_dev_lock(hdev);
2516
2517 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2518 if (err < 0)
2519 status = MGMT_STATUS_FAILED;
2520 else
2521 status = 0;
2522
2523 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2524 &cp->addr, sizeof(cp->addr));
2525
2526 hci_dev_unlock(hdev);
2527
2528 return err;
2529 }
2530
2531 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2532 u16 len)
2533 {
2534 struct mgmt_cp_unblock_device *cp = data;
2535 u8 status;
2536 int err;
2537
2538 BT_DBG("%s", hdev->name);
2539
2540 hci_dev_lock(hdev);
2541
2542 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2543 if (err < 0)
2544 status = MGMT_STATUS_INVALID_PARAMS;
2545 else
2546 status = 0;
2547
2548 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2549 &cp->addr, sizeof(cp->addr));
2550
2551 hci_dev_unlock(hdev);
2552
2553 return err;
2554 }
2555
2556 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2557 u16 len)
2558 {
2559 struct mgmt_cp_set_device_id *cp = data;
2560 int err;
2561 __u16 source;
2562
2563 BT_DBG("%s", hdev->name);
2564
2565 source = __le16_to_cpu(cp->source);
2566
2567 if (source > 0x0002)
2568 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2569 MGMT_STATUS_INVALID_PARAMS);
2570
2571 hci_dev_lock(hdev);
2572
2573 hdev->devid_source = source;
2574 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2575 hdev->devid_product = __le16_to_cpu(cp->product);
2576 hdev->devid_version = __le16_to_cpu(cp->version);
2577
2578 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2579
2580 update_eir(hdev);
2581
2582 hci_dev_unlock(hdev);
2583
2584 return err;
2585 }
2586
2587 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2588 void *data, u16 len)
2589 {
2590 struct mgmt_mode *cp = data;
2591 struct hci_cp_write_page_scan_activity acp;
2592 u8 type;
2593 int err;
2594
2595 BT_DBG("%s", hdev->name);
2596
2597 if (!hdev_is_powered(hdev))
2598 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2599 MGMT_STATUS_NOT_POWERED);
2600
2601 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2602 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2603 MGMT_STATUS_REJECTED);
2604
2605 hci_dev_lock(hdev);
2606
2607 if (cp->val) {
2608 type = PAGE_SCAN_TYPE_INTERLACED;
2609
2610 /* 22.5 msec page scan interval */
2611 acp.interval = __constant_cpu_to_le16(0x0024);
2612 } else {
2613 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2614
2615 /* default 1.28 sec page scan */
2616 acp.interval = __constant_cpu_to_le16(0x0800);
2617 }
2618
2619 /* default 11.25 msec page scan window */
2620 acp.window = __constant_cpu_to_le16(0x0012);
2621
2622 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2623 &acp);
2624 if (err < 0) {
2625 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2626 MGMT_STATUS_FAILED);
2627 goto done;
2628 }
2629
2630 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2631 if (err < 0) {
2632 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2633 MGMT_STATUS_FAILED);
2634 goto done;
2635 }
2636
2637 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2638 NULL, 0);
2639 done:
2640 hci_dev_unlock(hdev);
2641 return err;
2642 }
2643
2644 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2645 void *cp_data, u16 len)
2646 {
2647 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2648 u16 key_count, expected_len;
2649 int i;
2650
2651 key_count = __le16_to_cpu(cp->key_count);
2652
2653 expected_len = sizeof(*cp) + key_count *
2654 sizeof(struct mgmt_ltk_info);
2655 if (expected_len != len) {
2656 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2657 len, expected_len);
2658 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2659 EINVAL);
2660 }
2661
2662 BT_DBG("%s key_count %u", hdev->name, key_count);
2663
2664 hci_dev_lock(hdev);
2665
2666 hci_smp_ltks_clear(hdev);
2667
2668 for (i = 0; i < key_count; i++) {
2669 struct mgmt_ltk_info *key = &cp->keys[i];
2670 u8 type;
2671
2672 if (key->master)
2673 type = HCI_SMP_LTK;
2674 else
2675 type = HCI_SMP_LTK_SLAVE;
2676
2677 hci_add_ltk(hdev, &key->addr.bdaddr,
2678 bdaddr_to_le(key->addr.type),
2679 type, 0, key->authenticated, key->val,
2680 key->enc_size, key->ediv, key->rand);
2681 }
2682
2683 hci_dev_unlock(hdev);
2684
2685 return 0;
2686 }
2687
2688 static const struct mgmt_handler {
2689 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2690 u16 data_len);
2691 bool var_len;
2692 size_t data_len;
2693 } mgmt_handlers[] = {
2694 { NULL }, /* 0x0000 (no command) */
2695 { read_version, false, MGMT_READ_VERSION_SIZE },
2696 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2697 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2698 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2699 { set_powered, false, MGMT_SETTING_SIZE },
2700 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2701 { set_connectable, false, MGMT_SETTING_SIZE },
2702 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2703 { set_pairable, false, MGMT_SETTING_SIZE },
2704 { set_link_security, false, MGMT_SETTING_SIZE },
2705 { set_ssp, false, MGMT_SETTING_SIZE },
2706 { set_hs, false, MGMT_SETTING_SIZE },
2707 { set_le, false, MGMT_SETTING_SIZE },
2708 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2709 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2710 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2711 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2712 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2713 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2714 { disconnect, false, MGMT_DISCONNECT_SIZE },
2715 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2716 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2717 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2718 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2719 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2720 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2721 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2722 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2723 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2724 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2725 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2726 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2727 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2728 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2729 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2730 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2731 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2732 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2733 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2734 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
2735 };
2736
2737
2738 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2739 {
2740 void *buf;
2741 u8 *cp;
2742 struct mgmt_hdr *hdr;
2743 u16 opcode, index, len;
2744 struct hci_dev *hdev = NULL;
2745 const struct mgmt_handler *handler;
2746 int err;
2747
2748 BT_DBG("got %zu bytes", msglen);
2749
2750 if (msglen < sizeof(*hdr))
2751 return -EINVAL;
2752
2753 buf = kmalloc(msglen, GFP_KERNEL);
2754 if (!buf)
2755 return -ENOMEM;
2756
2757 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2758 err = -EFAULT;
2759 goto done;
2760 }
2761
2762 hdr = buf;
2763 opcode = __le16_to_cpu(hdr->opcode);
2764 index = __le16_to_cpu(hdr->index);
2765 len = __le16_to_cpu(hdr->len);
2766
2767 if (len != msglen - sizeof(*hdr)) {
2768 err = -EINVAL;
2769 goto done;
2770 }
2771
2772 if (index != MGMT_INDEX_NONE) {
2773 hdev = hci_dev_get(index);
2774 if (!hdev) {
2775 err = cmd_status(sk, index, opcode,
2776 MGMT_STATUS_INVALID_INDEX);
2777 goto done;
2778 }
2779 }
2780
2781 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2782 mgmt_handlers[opcode].func == NULL) {
2783 BT_DBG("Unknown op %u", opcode);
2784 err = cmd_status(sk, index, opcode,
2785 MGMT_STATUS_UNKNOWN_COMMAND);
2786 goto done;
2787 }
2788
2789 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2790 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2791 err = cmd_status(sk, index, opcode,
2792 MGMT_STATUS_INVALID_INDEX);
2793 goto done;
2794 }
2795
2796 handler = &mgmt_handlers[opcode];
2797
2798 if ((handler->var_len && len < handler->data_len) ||
2799 (!handler->var_len && len != handler->data_len)) {
2800 err = cmd_status(sk, index, opcode,
2801 MGMT_STATUS_INVALID_PARAMS);
2802 goto done;
2803 }
2804
2805 if (hdev)
2806 mgmt_init_hdev(sk, hdev);
2807
2808 cp = buf + sizeof(*hdr);
2809
2810 err = handler->func(sk, hdev, cp, len);
2811 if (err < 0)
2812 goto done;
2813
2814 err = msglen;
2815
2816 done:
2817 if (hdev)
2818 hci_dev_put(hdev);
2819
2820 kfree(buf);
2821 return err;
2822 }
2823
2824 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2825 {
2826 u8 *status = data;
2827
2828 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2829 mgmt_pending_remove(cmd);
2830 }
2831
2832 int mgmt_index_added(struct hci_dev *hdev)
2833 {
2834 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2835 }
2836
2837 int mgmt_index_removed(struct hci_dev *hdev)
2838 {
2839 u8 status = MGMT_STATUS_INVALID_INDEX;
2840
2841 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2842
2843 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2844 }
2845
2846 struct cmd_lookup {
2847 struct sock *sk;
2848 struct hci_dev *hdev;
2849 u8 mgmt_status;
2850 };
2851
2852 static void settings_rsp(struct pending_cmd *cmd, void *data)
2853 {
2854 struct cmd_lookup *match = data;
2855
2856 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2857
2858 list_del(&cmd->list);
2859
2860 if (match->sk == NULL) {
2861 match->sk = cmd->sk;
2862 sock_hold(match->sk);
2863 }
2864
2865 mgmt_pending_free(cmd);
2866 }
2867
2868 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2869 {
2870 struct cmd_lookup match = { NULL, hdev };
2871 int err;
2872
2873 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2874 return 0;
2875
2876 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2877
2878 if (powered) {
2879 u8 scan = 0;
2880
2881 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2882 scan |= SCAN_PAGE;
2883 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2884 scan |= SCAN_INQUIRY;
2885
2886 if (scan)
2887 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2888
2889 update_class(hdev);
2890 update_name(hdev, hdev->dev_name);
2891 update_eir(hdev);
2892 } else {
2893 u8 status = MGMT_STATUS_NOT_POWERED;
2894 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2895 }
2896
2897 err = new_settings(hdev, match.sk);
2898
2899 if (match.sk)
2900 sock_put(match.sk);
2901
2902 return err;
2903 }
2904
2905 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2906 {
2907 struct cmd_lookup match = { NULL, hdev };
2908 bool changed = false;
2909 int err = 0;
2910
2911 if (discoverable) {
2912 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2913 changed = true;
2914 } else {
2915 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2916 changed = true;
2917 }
2918
2919 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2920 &match);
2921
2922 if (changed)
2923 err = new_settings(hdev, match.sk);
2924
2925 if (match.sk)
2926 sock_put(match.sk);
2927
2928 return err;
2929 }
2930
2931 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2932 {
2933 struct cmd_lookup match = { NULL, hdev };
2934 bool changed = false;
2935 int err = 0;
2936
2937 if (connectable) {
2938 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2939 changed = true;
2940 } else {
2941 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2942 changed = true;
2943 }
2944
2945 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2946 &match);
2947
2948 if (changed)
2949 err = new_settings(hdev, match.sk);
2950
2951 if (match.sk)
2952 sock_put(match.sk);
2953
2954 return err;
2955 }
2956
2957 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2958 {
2959 u8 mgmt_err = mgmt_status(status);
2960
2961 if (scan & SCAN_PAGE)
2962 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2963 cmd_status_rsp, &mgmt_err);
2964
2965 if (scan & SCAN_INQUIRY)
2966 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2967 cmd_status_rsp, &mgmt_err);
2968
2969 return 0;
2970 }
2971
2972 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2973 bool persistent)
2974 {
2975 struct mgmt_ev_new_link_key ev;
2976
2977 memset(&ev, 0, sizeof(ev));
2978
2979 ev.store_hint = persistent;
2980 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2981 ev.key.addr.type = BDADDR_BREDR;
2982 ev.key.type = key->type;
2983 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
2984 ev.key.pin_len = key->pin_len;
2985
2986 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2987 }
2988
2989 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2990 {
2991 struct mgmt_ev_new_long_term_key ev;
2992
2993 memset(&ev, 0, sizeof(ev));
2994
2995 ev.store_hint = persistent;
2996 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2997 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
2998 ev.key.authenticated = key->authenticated;
2999 ev.key.enc_size = key->enc_size;
3000 ev.key.ediv = key->ediv;
3001
3002 if (key->type == HCI_SMP_LTK)
3003 ev.key.master = 1;
3004
3005 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3006 memcpy(ev.key.val, key->val, sizeof(key->val));
3007
3008 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3009 NULL);
3010 }
3011
3012 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3013 u8 addr_type, u32 flags, u8 *name, u8 name_len,
3014 u8 *dev_class)
3015 {
3016 char buf[512];
3017 struct mgmt_ev_device_connected *ev = (void *) buf;
3018 u16 eir_len = 0;
3019
3020 bacpy(&ev->addr.bdaddr, bdaddr);
3021 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3022
3023 ev->flags = __cpu_to_le32(flags);
3024
3025 if (name_len > 0)
3026 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3027 name, name_len);
3028
3029 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3030 eir_len = eir_append_data(ev->eir, eir_len,
3031 EIR_CLASS_OF_DEV, dev_class, 3);
3032
3033 ev->eir_len = cpu_to_le16(eir_len);
3034
3035 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3036 sizeof(*ev) + eir_len, NULL);
3037 }
3038
3039 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3040 {
3041 struct mgmt_cp_disconnect *cp = cmd->param;
3042 struct sock **sk = data;
3043 struct mgmt_rp_disconnect rp;
3044
3045 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3046 rp.addr.type = cp->addr.type;
3047
3048 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3049 sizeof(rp));
3050
3051 *sk = cmd->sk;
3052 sock_hold(*sk);
3053
3054 mgmt_pending_remove(cmd);
3055 }
3056
3057 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3058 {
3059 struct hci_dev *hdev = data;
3060 struct mgmt_cp_unpair_device *cp = cmd->param;
3061 struct mgmt_rp_unpair_device rp;
3062
3063 memset(&rp, 0, sizeof(rp));
3064 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3065 rp.addr.type = cp->addr.type;
3066
3067 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3068
3069 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3070
3071 mgmt_pending_remove(cmd);
3072 }
3073
3074 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3075 u8 link_type, u8 addr_type)
3076 {
3077 struct mgmt_addr_info ev;
3078 struct sock *sk = NULL;
3079 int err;
3080
3081 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3082
3083 bacpy(&ev.bdaddr, bdaddr);
3084 ev.type = link_to_bdaddr(link_type, addr_type);
3085
3086 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3087 sk);
3088
3089 if (sk)
3090 sock_put(sk);
3091
3092 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3093 hdev);
3094
3095 return err;
3096 }
3097
3098 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3099 u8 link_type, u8 addr_type, u8 status)
3100 {
3101 struct mgmt_rp_disconnect rp;
3102 struct pending_cmd *cmd;
3103 int err;
3104
3105 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3106 if (!cmd)
3107 return -ENOENT;
3108
3109 bacpy(&rp.addr.bdaddr, bdaddr);
3110 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3111
3112 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3113 mgmt_status(status), &rp, sizeof(rp));
3114
3115 mgmt_pending_remove(cmd);
3116
3117 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3118 hdev);
3119 return err;
3120 }
3121
3122 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3123 u8 addr_type, u8 status)
3124 {
3125 struct mgmt_ev_connect_failed ev;
3126
3127 bacpy(&ev.addr.bdaddr, bdaddr);
3128 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3129 ev.status = mgmt_status(status);
3130
3131 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3132 }
3133
3134 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3135 {
3136 struct mgmt_ev_pin_code_request ev;
3137
3138 bacpy(&ev.addr.bdaddr, bdaddr);
3139 ev.addr.type = BDADDR_BREDR;
3140 ev.secure = secure;
3141
3142 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3143 NULL);
3144 }
3145
3146 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3147 u8 status)
3148 {
3149 struct pending_cmd *cmd;
3150 struct mgmt_rp_pin_code_reply rp;
3151 int err;
3152
3153 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3154 if (!cmd)
3155 return -ENOENT;
3156
3157 bacpy(&rp.addr.bdaddr, bdaddr);
3158 rp.addr.type = BDADDR_BREDR;
3159
3160 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3161 mgmt_status(status), &rp, sizeof(rp));
3162
3163 mgmt_pending_remove(cmd);
3164
3165 return err;
3166 }
3167
3168 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3169 u8 status)
3170 {
3171 struct pending_cmd *cmd;
3172 struct mgmt_rp_pin_code_reply rp;
3173 int err;
3174
3175 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3176 if (!cmd)
3177 return -ENOENT;
3178
3179 bacpy(&rp.addr.bdaddr, bdaddr);
3180 rp.addr.type = BDADDR_BREDR;
3181
3182 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3183 mgmt_status(status), &rp, sizeof(rp));
3184
3185 mgmt_pending_remove(cmd);
3186
3187 return err;
3188 }
3189
3190 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3191 u8 link_type, u8 addr_type, __le32 value,
3192 u8 confirm_hint)
3193 {
3194 struct mgmt_ev_user_confirm_request ev;
3195
3196 BT_DBG("%s", hdev->name);
3197
3198 bacpy(&ev.addr.bdaddr, bdaddr);
3199 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3200 ev.confirm_hint = confirm_hint;
3201 ev.value = value;
3202
3203 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3204 NULL);
3205 }
3206
3207 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3208 u8 link_type, u8 addr_type)
3209 {
3210 struct mgmt_ev_user_passkey_request ev;
3211
3212 BT_DBG("%s", hdev->name);
3213
3214 bacpy(&ev.addr.bdaddr, bdaddr);
3215 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3216
3217 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3218 NULL);
3219 }
3220
3221 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3222 u8 link_type, u8 addr_type, u8 status,
3223 u8 opcode)
3224 {
3225 struct pending_cmd *cmd;
3226 struct mgmt_rp_user_confirm_reply rp;
3227 int err;
3228
3229 cmd = mgmt_pending_find(opcode, hdev);
3230 if (!cmd)
3231 return -ENOENT;
3232
3233 bacpy(&rp.addr.bdaddr, bdaddr);
3234 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3235 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3236 &rp, sizeof(rp));
3237
3238 mgmt_pending_remove(cmd);
3239
3240 return err;
3241 }
3242
3243 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3244 u8 link_type, u8 addr_type, u8 status)
3245 {
3246 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3247 status, MGMT_OP_USER_CONFIRM_REPLY);
3248 }
3249
3250 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3251 u8 link_type, u8 addr_type, u8 status)
3252 {
3253 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3254 status,
3255 MGMT_OP_USER_CONFIRM_NEG_REPLY);
3256 }
3257
3258 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3259 u8 link_type, u8 addr_type, u8 status)
3260 {
3261 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3262 status, MGMT_OP_USER_PASSKEY_REPLY);
3263 }
3264
3265 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3266 u8 link_type, u8 addr_type, u8 status)
3267 {
3268 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3269 status,
3270 MGMT_OP_USER_PASSKEY_NEG_REPLY);
3271 }
3272
3273 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3274 u8 addr_type, u8 status)
3275 {
3276 struct mgmt_ev_auth_failed ev;
3277
3278 bacpy(&ev.addr.bdaddr, bdaddr);
3279 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3280 ev.status = mgmt_status(status);
3281
3282 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3283 }
3284
3285 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3286 {
3287 struct cmd_lookup match = { NULL, hdev };
3288 bool changed = false;
3289 int err = 0;
3290
3291 if (status) {
3292 u8 mgmt_err = mgmt_status(status);
3293 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3294 cmd_status_rsp, &mgmt_err);
3295 return 0;
3296 }
3297
3298 if (test_bit(HCI_AUTH, &hdev->flags)) {
3299 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3300 changed = true;
3301 } else {
3302 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3303 changed = true;
3304 }
3305
3306 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3307 &match);
3308
3309 if (changed)
3310 err = new_settings(hdev, match.sk);
3311
3312 if (match.sk)
3313 sock_put(match.sk);
3314
3315 return err;
3316 }
3317
3318 static int clear_eir(struct hci_dev *hdev)
3319 {
3320 struct hci_cp_write_eir cp;
3321
3322 if (!(hdev->features[6] & LMP_EXT_INQ))
3323 return 0;
3324
3325 memset(hdev->eir, 0, sizeof(hdev->eir));
3326
3327 memset(&cp, 0, sizeof(cp));
3328
3329 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3330 }
3331
3332 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3333 {
3334 struct cmd_lookup match = { NULL, hdev };
3335 bool changed = false;
3336 int err = 0;
3337
3338 if (status) {
3339 u8 mgmt_err = mgmt_status(status);
3340
3341 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3342 &hdev->dev_flags))
3343 err = new_settings(hdev, NULL);
3344
3345 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3346 &mgmt_err);
3347
3348 return err;
3349 }
3350
3351 if (enable) {
3352 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3353 changed = true;
3354 } else {
3355 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3356 changed = true;
3357 }
3358
3359 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3360
3361 if (changed)
3362 err = new_settings(hdev, match.sk);
3363
3364 if (match.sk)
3365 sock_put(match.sk);
3366
3367 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3368 update_eir(hdev);
3369 else
3370 clear_eir(hdev);
3371
3372 return err;
3373 }
3374
3375 static void class_rsp(struct pending_cmd *cmd, void *data)
3376 {
3377 struct cmd_lookup *match = data;
3378
3379 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3380 match->hdev->dev_class, 3);
3381
3382 list_del(&cmd->list);
3383
3384 if (match->sk == NULL) {
3385 match->sk = cmd->sk;
3386 sock_hold(match->sk);
3387 }
3388
3389 mgmt_pending_free(cmd);
3390 }
3391
3392 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3393 u8 status)
3394 {
3395 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3396 int err = 0;
3397
3398 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3399
3400 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3401 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3402 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3403
3404 if (!status)
3405 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3406 3, NULL);
3407
3408 if (match.sk)
3409 sock_put(match.sk);
3410
3411 return err;
3412 }
3413
3414 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3415 {
3416 struct pending_cmd *cmd;
3417 struct mgmt_cp_set_local_name ev;
3418 bool changed = false;
3419 int err = 0;
3420
3421 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3422 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3423 changed = true;
3424 }
3425
3426 memset(&ev, 0, sizeof(ev));
3427 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3428 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3429
3430 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3431 if (!cmd)
3432 goto send_event;
3433
3434 /* Always assume that either the short or the complete name has
3435 * changed if there was a pending mgmt command */
3436 changed = true;
3437
3438 if (status) {
3439 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3440 mgmt_status(status));
3441 goto failed;
3442 }
3443
3444 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3445 sizeof(ev));
3446 if (err < 0)
3447 goto failed;
3448
3449 send_event:
3450 if (changed)
3451 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3452 sizeof(ev), cmd ? cmd->sk : NULL);
3453
3454 update_eir(hdev);
3455
3456 failed:
3457 if (cmd)
3458 mgmt_pending_remove(cmd);
3459 return err;
3460 }
3461
3462 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3463 u8 *randomizer, u8 status)
3464 {
3465 struct pending_cmd *cmd;
3466 int err;
3467
3468 BT_DBG("%s status %u", hdev->name, status);
3469
3470 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3471 if (!cmd)
3472 return -ENOENT;
3473
3474 if (status) {
3475 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3476 mgmt_status(status));
3477 } else {
3478 struct mgmt_rp_read_local_oob_data rp;
3479
3480 memcpy(rp.hash, hash, sizeof(rp.hash));
3481 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3482
3483 err = cmd_complete(cmd->sk, hdev->id,
3484 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3485 sizeof(rp));
3486 }
3487
3488 mgmt_pending_remove(cmd);
3489
3490 return err;
3491 }
3492
3493 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3494 {
3495 struct cmd_lookup match = { NULL, hdev };
3496 bool changed = false;
3497 int err = 0;
3498
3499 if (status) {
3500 u8 mgmt_err = mgmt_status(status);
3501
3502 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3503 &hdev->dev_flags))
3504 err = new_settings(hdev, NULL);
3505
3506 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3507 &mgmt_err);
3508
3509 return err;
3510 }
3511
3512 if (enable) {
3513 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3514 changed = true;
3515 } else {
3516 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3517 changed = true;
3518 }
3519
3520 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3521
3522 if (changed)
3523 err = new_settings(hdev, match.sk);
3524
3525 if (match.sk)
3526 sock_put(match.sk);
3527
3528 return err;
3529 }
3530
3531 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3532 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3533 ssp, u8 *eir, u16 eir_len)
3534 {
3535 char buf[512];
3536 struct mgmt_ev_device_found *ev = (void *) buf;
3537 size_t ev_size;
3538
3539 /* Leave 5 bytes for a potential CoD field */
3540 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3541 return -EINVAL;
3542
3543 memset(buf, 0, sizeof(buf));
3544
3545 bacpy(&ev->addr.bdaddr, bdaddr);
3546 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3547 ev->rssi = rssi;
3548 if (cfm_name)
3549 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3550 if (!ssp)
3551 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3552
3553 if (eir_len > 0)
3554 memcpy(ev->eir, eir, eir_len);
3555
3556 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3557 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3558 dev_class, 3);
3559
3560 ev->eir_len = cpu_to_le16(eir_len);
3561
3562 ev_size = sizeof(*ev) + eir_len;
3563
3564 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3565 }
3566
3567 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3568 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3569 {
3570 struct mgmt_ev_device_found *ev;
3571 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3572 u16 eir_len;
3573
3574 ev = (struct mgmt_ev_device_found *) buf;
3575
3576 memset(buf, 0, sizeof(buf));
3577
3578 bacpy(&ev->addr.bdaddr, bdaddr);
3579 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3580 ev->rssi = rssi;
3581
3582 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3583 name_len);
3584
3585 ev->eir_len = cpu_to_le16(eir_len);
3586
3587 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3588 sizeof(*ev) + eir_len, NULL);
3589 }
3590
3591 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3592 {
3593 struct pending_cmd *cmd;
3594 u8 type;
3595 int err;
3596
3597 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3598
3599 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3600 if (!cmd)
3601 return -ENOENT;
3602
3603 type = hdev->discovery.type;
3604
3605 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3606 &type, sizeof(type));
3607 mgmt_pending_remove(cmd);
3608
3609 return err;
3610 }
3611
3612 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3613 {
3614 struct pending_cmd *cmd;
3615 int err;
3616
3617 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3618 if (!cmd)
3619 return -ENOENT;
3620
3621 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3622 &hdev->discovery.type, sizeof(hdev->discovery.type));
3623 mgmt_pending_remove(cmd);
3624
3625 return err;
3626 }
3627
3628 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3629 {
3630 struct mgmt_ev_discovering ev;
3631 struct pending_cmd *cmd;
3632
3633 BT_DBG("%s discovering %u", hdev->name, discovering);
3634
3635 if (discovering)
3636 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3637 else
3638 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3639
3640 if (cmd != NULL) {
3641 u8 type = hdev->discovery.type;
3642
3643 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3644 sizeof(type));
3645 mgmt_pending_remove(cmd);
3646 }
3647
3648 memset(&ev, 0, sizeof(ev));
3649 ev.type = hdev->discovery.type;
3650 ev.discovering = discovering;
3651
3652 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3653 }
3654
3655 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3656 {
3657 struct pending_cmd *cmd;
3658 struct mgmt_ev_device_blocked ev;
3659
3660 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3661
3662 bacpy(&ev.addr.bdaddr, bdaddr);
3663 ev.addr.type = type;
3664
3665 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3666 cmd ? cmd->sk : NULL);
3667 }
3668
3669 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3670 {
3671 struct pending_cmd *cmd;
3672 struct mgmt_ev_device_unblocked ev;
3673
3674 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3675
3676 bacpy(&ev.addr.bdaddr, bdaddr);
3677 ev.addr.type = type;
3678
3679 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3680 cmd ? cmd->sk : NULL);
3681 }
3682
3683 module_param(enable_hs, bool, 0644);
3684 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
Linux kernel - Deliverables
This page took 0.248949 seconds and 5 git commands to generate.