projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
[deliverable/linux.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/mgmt.h>
33 #include <net/bluetooth/smp.h>
34
35 bool enable_hs;
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 1
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 };
80
81 static const u16 mgmt_events[] = {
82 MGMT_EV_CONTROLLER_ERROR,
83 MGMT_EV_INDEX_ADDED,
84 MGMT_EV_INDEX_REMOVED,
85 MGMT_EV_NEW_SETTINGS,
86 MGMT_EV_CLASS_OF_DEV_CHANGED,
87 MGMT_EV_LOCAL_NAME_CHANGED,
88 MGMT_EV_NEW_LINK_KEY,
89 MGMT_EV_NEW_LONG_TERM_KEY,
90 MGMT_EV_DEVICE_CONNECTED,
91 MGMT_EV_DEVICE_DISCONNECTED,
92 MGMT_EV_CONNECT_FAILED,
93 MGMT_EV_PIN_CODE_REQUEST,
94 MGMT_EV_USER_CONFIRM_REQUEST,
95 MGMT_EV_USER_PASSKEY_REQUEST,
96 MGMT_EV_AUTH_FAILED,
97 MGMT_EV_DEVICE_FOUND,
98 MGMT_EV_DISCOVERING,
99 MGMT_EV_DEVICE_BLOCKED,
100 MGMT_EV_DEVICE_UNBLOCKED,
101 MGMT_EV_DEVICE_UNPAIRED,
102 };
103
104 /*
105 * These LE scan and inquiry parameters were chosen according to LE General
106 * Discovery Procedure specification.
107 */
108 #define LE_SCAN_TYPE 0x01
109 #define LE_SCAN_WIN 0x12
110 #define LE_SCAN_INT 0x12
111 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
112 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
113
114 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
115 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
116
117 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
118
119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
120 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
121
122 struct pending_cmd {
123 struct list_head list;
124 u16 opcode;
125 int index;
126 void *param;
127 struct sock *sk;
128 void *user_data;
129 };
130
131 /* HCI to MGMT error code conversion table */
132 static u8 mgmt_status_table[] = {
133 MGMT_STATUS_SUCCESS,
134 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
135 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
136 MGMT_STATUS_FAILED, /* Hardware Failure */
137 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
138 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
139 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
140 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
141 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
142 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
143 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
144 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
145 MGMT_STATUS_BUSY, /* Command Disallowed */
146 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
147 MGMT_STATUS_REJECTED, /* Rejected Security */
148 MGMT_STATUS_REJECTED, /* Rejected Personal */
149 MGMT_STATUS_TIMEOUT, /* Host Timeout */
150 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
151 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
152 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
153 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
154 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
155 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
156 MGMT_STATUS_BUSY, /* Repeated Attempts */
157 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
158 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
159 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
160 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
161 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
162 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
163 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
164 MGMT_STATUS_FAILED, /* Unspecified Error */
165 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
166 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
167 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
168 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
169 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
170 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
171 MGMT_STATUS_FAILED, /* Unit Link Key Used */
172 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
173 MGMT_STATUS_TIMEOUT, /* Instant Passed */
174 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
175 MGMT_STATUS_FAILED, /* Transaction Collision */
176 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
177 MGMT_STATUS_REJECTED, /* QoS Rejected */
178 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
179 MGMT_STATUS_REJECTED, /* Insufficient Security */
180 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
181 MGMT_STATUS_BUSY, /* Role Switch Pending */
182 MGMT_STATUS_FAILED, /* Slot Violation */
183 MGMT_STATUS_FAILED, /* Role Switch Failed */
184 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
185 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
186 MGMT_STATUS_BUSY, /* Host Busy Pairing */
187 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
188 MGMT_STATUS_BUSY, /* Controller Busy */
189 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
190 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
191 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
192 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
193 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
194 };
195
196 bool mgmt_valid_hdev(struct hci_dev *hdev)
197 {
198 return hdev->dev_type == HCI_BREDR;
199 }
200
201 static u8 mgmt_status(u8 hci_status)
202 {
203 if (hci_status < ARRAY_SIZE(mgmt_status_table))
204 return mgmt_status_table[hci_status];
205
206 return MGMT_STATUS_FAILED;
207 }
208
209 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
210 {
211 struct sk_buff *skb;
212 struct mgmt_hdr *hdr;
213 struct mgmt_ev_cmd_status *ev;
214 int err;
215
216 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
217
218 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
219 if (!skb)
220 return -ENOMEM;
221
222 hdr = (void *) skb_put(skb, sizeof(*hdr));
223
224 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
225 hdr->index = cpu_to_le16(index);
226 hdr->len = cpu_to_le16(sizeof(*ev));
227
228 ev = (void *) skb_put(skb, sizeof(*ev));
229 ev->status = status;
230 ev->opcode = cpu_to_le16(cmd);
231
232 err = sock_queue_rcv_skb(sk, skb);
233 if (err < 0)
234 kfree_skb(skb);
235
236 return err;
237 }
238
239 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
240 void *rp, size_t rp_len)
241 {
242 struct sk_buff *skb;
243 struct mgmt_hdr *hdr;
244 struct mgmt_ev_cmd_complete *ev;
245 int err;
246
247 BT_DBG("sock %p", sk);
248
249 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
250 if (!skb)
251 return -ENOMEM;
252
253 hdr = (void *) skb_put(skb, sizeof(*hdr));
254
255 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
256 hdr->index = cpu_to_le16(index);
257 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
258
259 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
260 ev->opcode = cpu_to_le16(cmd);
261 ev->status = status;
262
263 if (rp)
264 memcpy(ev->data, rp, rp_len);
265
266 err = sock_queue_rcv_skb(sk, skb);
267 if (err < 0)
268 kfree_skb(skb);
269
270 return err;
271 }
272
273 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
274 u16 data_len)
275 {
276 struct mgmt_rp_read_version rp;
277
278 BT_DBG("sock %p", sk);
279
280 rp.version = MGMT_VERSION;
281 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
282
283 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
284 sizeof(rp));
285 }
286
287 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
288 u16 data_len)
289 {
290 struct mgmt_rp_read_commands *rp;
291 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
292 const u16 num_events = ARRAY_SIZE(mgmt_events);
293 __le16 *opcode;
294 size_t rp_size;
295 int i, err;
296
297 BT_DBG("sock %p", sk);
298
299 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
300
301 rp = kmalloc(rp_size, GFP_KERNEL);
302 if (!rp)
303 return -ENOMEM;
304
305 rp->num_commands = __constant_cpu_to_le16(num_commands);
306 rp->num_events = __constant_cpu_to_le16(num_events);
307
308 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
309 put_unaligned_le16(mgmt_commands[i], opcode);
310
311 for (i = 0; i < num_events; i++, opcode++)
312 put_unaligned_le16(mgmt_events[i], opcode);
313
314 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
315 rp_size);
316 kfree(rp);
317
318 return err;
319 }
320
321 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
322 u16 data_len)
323 {
324 struct mgmt_rp_read_index_list *rp;
325 struct hci_dev *d;
326 size_t rp_len;
327 u16 count;
328 int i, err;
329
330 BT_DBG("sock %p", sk);
331
332 read_lock(&hci_dev_list_lock);
333
334 count = 0;
335 list_for_each_entry(d, &hci_dev_list, list) {
336 if (!mgmt_valid_hdev(d))
337 continue;
338
339 count++;
340 }
341
342 rp_len = sizeof(*rp) + (2 * count);
343 rp = kmalloc(rp_len, GFP_ATOMIC);
344 if (!rp) {
345 read_unlock(&hci_dev_list_lock);
346 return -ENOMEM;
347 }
348
349 rp->num_controllers = cpu_to_le16(count);
350
351 i = 0;
352 list_for_each_entry(d, &hci_dev_list, list) {
353 if (test_bit(HCI_SETUP, &d->dev_flags))
354 continue;
355
356 if (!mgmt_valid_hdev(d))
357 continue;
358
359 rp->index[i++] = cpu_to_le16(d->id);
360 BT_DBG("Added hci%u", d->id);
361 }
362
363 read_unlock(&hci_dev_list_lock);
364
365 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
366 rp_len);
367
368 kfree(rp);
369
370 return err;
371 }
372
373 static u32 get_supported_settings(struct hci_dev *hdev)
374 {
375 u32 settings = 0;
376
377 settings |= MGMT_SETTING_POWERED;
378 settings |= MGMT_SETTING_CONNECTABLE;
379 settings |= MGMT_SETTING_FAST_CONNECTABLE;
380 settings |= MGMT_SETTING_DISCOVERABLE;
381 settings |= MGMT_SETTING_PAIRABLE;
382
383 if (lmp_ssp_capable(hdev))
384 settings |= MGMT_SETTING_SSP;
385
386 if (lmp_bredr_capable(hdev)) {
387 settings |= MGMT_SETTING_BREDR;
388 settings |= MGMT_SETTING_LINK_SECURITY;
389 }
390
391 if (enable_hs)
392 settings |= MGMT_SETTING_HS;
393
394 if (lmp_le_capable(hdev))
395 settings |= MGMT_SETTING_LE;
396
397 return settings;
398 }
399
400 static u32 get_current_settings(struct hci_dev *hdev)
401 {
402 u32 settings = 0;
403
404 if (hdev_is_powered(hdev))
405 settings |= MGMT_SETTING_POWERED;
406
407 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
408 settings |= MGMT_SETTING_CONNECTABLE;
409
410 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
411 settings |= MGMT_SETTING_DISCOVERABLE;
412
413 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
414 settings |= MGMT_SETTING_PAIRABLE;
415
416 if (lmp_bredr_capable(hdev))
417 settings |= MGMT_SETTING_BREDR;
418
419 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
420 settings |= MGMT_SETTING_LE;
421
422 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
423 settings |= MGMT_SETTING_LINK_SECURITY;
424
425 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
426 settings |= MGMT_SETTING_SSP;
427
428 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
429 settings |= MGMT_SETTING_HS;
430
431 return settings;
432 }
433
434 #define PNP_INFO_SVCLASS_ID 0x1200
435
436 static u8 bluetooth_base_uuid[] = {
437 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
438 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
439 };
440
441 static u16 get_uuid16(u8 *uuid128)
442 {
443 u32 val;
444 int i;
445
446 for (i = 0; i < 12; i++) {
447 if (bluetooth_base_uuid[i] != uuid128[i])
448 return 0;
449 }
450
451 val = get_unaligned_le32(&uuid128[12]);
452 if (val > 0xffff)
453 return 0;
454
455 return (u16) val;
456 }
457
458 static void create_eir(struct hci_dev *hdev, u8 *data)
459 {
460 u8 *ptr = data;
461 u16 eir_len = 0;
462 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
463 int i, truncated = 0;
464 struct bt_uuid *uuid;
465 size_t name_len;
466
467 name_len = strlen(hdev->dev_name);
468
469 if (name_len > 0) {
470 /* EIR Data type */
471 if (name_len > 48) {
472 name_len = 48;
473 ptr[1] = EIR_NAME_SHORT;
474 } else
475 ptr[1] = EIR_NAME_COMPLETE;
476
477 /* EIR Data length */
478 ptr[0] = name_len + 1;
479
480 memcpy(ptr + 2, hdev->dev_name, name_len);
481
482 eir_len += (name_len + 2);
483 ptr += (name_len + 2);
484 }
485
486 if (hdev->inq_tx_power) {
487 ptr[0] = 2;
488 ptr[1] = EIR_TX_POWER;
489 ptr[2] = (u8) hdev->inq_tx_power;
490
491 eir_len += 3;
492 ptr += 3;
493 }
494
495 if (hdev->devid_source > 0) {
496 ptr[0] = 9;
497 ptr[1] = EIR_DEVICE_ID;
498
499 put_unaligned_le16(hdev->devid_source, ptr + 2);
500 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
501 put_unaligned_le16(hdev->devid_product, ptr + 6);
502 put_unaligned_le16(hdev->devid_version, ptr + 8);
503
504 eir_len += 10;
505 ptr += 10;
506 }
507
508 memset(uuid16_list, 0, sizeof(uuid16_list));
509
510 /* Group all UUID16 types */
511 list_for_each_entry(uuid, &hdev->uuids, list) {
512 u16 uuid16;
513
514 uuid16 = get_uuid16(uuid->uuid);
515 if (uuid16 == 0)
516 return;
517
518 if (uuid16 < 0x1100)
519 continue;
520
521 if (uuid16 == PNP_INFO_SVCLASS_ID)
522 continue;
523
524 /* Stop if not enough space to put next UUID */
525 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
526 truncated = 1;
527 break;
528 }
529
530 /* Check for duplicates */
531 for (i = 0; uuid16_list[i] != 0; i++)
532 if (uuid16_list[i] == uuid16)
533 break;
534
535 if (uuid16_list[i] == 0) {
536 uuid16_list[i] = uuid16;
537 eir_len += sizeof(u16);
538 }
539 }
540
541 if (uuid16_list[0] != 0) {
542 u8 *length = ptr;
543
544 /* EIR Data type */
545 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
546
547 ptr += 2;
548 eir_len += 2;
549
550 for (i = 0; uuid16_list[i] != 0; i++) {
551 *ptr++ = (uuid16_list[i] & 0x00ff);
552 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
553 }
554
555 /* EIR Data length */
556 *length = (i * sizeof(u16)) + 1;
557 }
558 }
559
560 static int update_eir(struct hci_dev *hdev)
561 {
562 struct hci_cp_write_eir cp;
563
564 if (!hdev_is_powered(hdev))
565 return 0;
566
567 if (!(hdev->features[6] & LMP_EXT_INQ))
568 return 0;
569
570 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
571 return 0;
572
573 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
574 return 0;
575
576 memset(&cp, 0, sizeof(cp));
577
578 create_eir(hdev, cp.data);
579
580 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
581 return 0;
582
583 memcpy(hdev->eir, cp.data, sizeof(cp.data));
584
585 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
586 }
587
588 static u8 get_service_classes(struct hci_dev *hdev)
589 {
590 struct bt_uuid *uuid;
591 u8 val = 0;
592
593 list_for_each_entry(uuid, &hdev->uuids, list)
594 val |= uuid->svc_hint;
595
596 return val;
597 }
598
599 static int update_class(struct hci_dev *hdev)
600 {
601 u8 cod[3];
602 int err;
603
604 BT_DBG("%s", hdev->name);
605
606 if (!hdev_is_powered(hdev))
607 return 0;
608
609 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
610 return 0;
611
612 cod[0] = hdev->minor_class;
613 cod[1] = hdev->major_class;
614 cod[2] = get_service_classes(hdev);
615
616 if (memcmp(cod, hdev->dev_class, 3) == 0)
617 return 0;
618
619 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
620 if (err == 0)
621 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
622
623 return err;
624 }
625
626 static void service_cache_off(struct work_struct *work)
627 {
628 struct hci_dev *hdev = container_of(work, struct hci_dev,
629 service_cache.work);
630
631 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
632 return;
633
634 hci_dev_lock(hdev);
635
636 update_eir(hdev);
637 update_class(hdev);
638
639 hci_dev_unlock(hdev);
640 }
641
642 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
643 {
644 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
645 return;
646
647 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
648
649 /* Non-mgmt controlled devices get this bit set
650 * implicitly so that pairing works for them, however
651 * for mgmt we require user-space to explicitly enable
652 * it
653 */
654 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
655 }
656
657 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
658 void *data, u16 data_len)
659 {
660 struct mgmt_rp_read_info rp;
661
662 BT_DBG("sock %p %s", sk, hdev->name);
663
664 hci_dev_lock(hdev);
665
666 memset(&rp, 0, sizeof(rp));
667
668 bacpy(&rp.bdaddr, &hdev->bdaddr);
669
670 rp.version = hdev->hci_ver;
671 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
672
673 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
674 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
675
676 memcpy(rp.dev_class, hdev->dev_class, 3);
677
678 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
679 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
680
681 hci_dev_unlock(hdev);
682
683 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
684 sizeof(rp));
685 }
686
687 static void mgmt_pending_free(struct pending_cmd *cmd)
688 {
689 sock_put(cmd->sk);
690 kfree(cmd->param);
691 kfree(cmd);
692 }
693
694 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
695 struct hci_dev *hdev, void *data,
696 u16 len)
697 {
698 struct pending_cmd *cmd;
699
700 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
701 if (!cmd)
702 return NULL;
703
704 cmd->opcode = opcode;
705 cmd->index = hdev->id;
706
707 cmd->param = kmalloc(len, GFP_KERNEL);
708 if (!cmd->param) {
709 kfree(cmd);
710 return NULL;
711 }
712
713 if (data)
714 memcpy(cmd->param, data, len);
715
716 cmd->sk = sk;
717 sock_hold(sk);
718
719 list_add(&cmd->list, &hdev->mgmt_pending);
720
721 return cmd;
722 }
723
724 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
725 void (*cb)(struct pending_cmd *cmd,
726 void *data),
727 void *data)
728 {
729 struct list_head *p, *n;
730
731 list_for_each_safe(p, n, &hdev->mgmt_pending) {
732 struct pending_cmd *cmd;
733
734 cmd = list_entry(p, struct pending_cmd, list);
735
736 if (opcode > 0 && cmd->opcode != opcode)
737 continue;
738
739 cb(cmd, data);
740 }
741 }
742
743 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
744 {
745 struct pending_cmd *cmd;
746
747 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
748 if (cmd->opcode == opcode)
749 return cmd;
750 }
751
752 return NULL;
753 }
754
755 static void mgmt_pending_remove(struct pending_cmd *cmd)
756 {
757 list_del(&cmd->list);
758 mgmt_pending_free(cmd);
759 }
760
761 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
762 {
763 __le32 settings = cpu_to_le32(get_current_settings(hdev));
764
765 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
766 sizeof(settings));
767 }
768
769 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
770 u16 len)
771 {
772 struct mgmt_mode *cp = data;
773 struct pending_cmd *cmd;
774 int err;
775
776 BT_DBG("request for %s", hdev->name);
777
778 hci_dev_lock(hdev);
779
780 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
781 cancel_delayed_work(&hdev->power_off);
782
783 if (cp->val) {
784 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
785 mgmt_powered(hdev, 1);
786 goto failed;
787 }
788 }
789
790 if (!!cp->val == hdev_is_powered(hdev)) {
791 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
792 goto failed;
793 }
794
795 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
796 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
797 MGMT_STATUS_BUSY);
798 goto failed;
799 }
800
801 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
802 if (!cmd) {
803 err = -ENOMEM;
804 goto failed;
805 }
806
807 if (cp->val)
808 schedule_work(&hdev->power_on);
809 else
810 schedule_work(&hdev->power_off.work);
811
812 err = 0;
813
814 failed:
815 hci_dev_unlock(hdev);
816 return err;
817 }
818
819 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
820 struct sock *skip_sk)
821 {
822 struct sk_buff *skb;
823 struct mgmt_hdr *hdr;
824
825 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
826 if (!skb)
827 return -ENOMEM;
828
829 hdr = (void *) skb_put(skb, sizeof(*hdr));
830 hdr->opcode = cpu_to_le16(event);
831 if (hdev)
832 hdr->index = cpu_to_le16(hdev->id);
833 else
834 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
835 hdr->len = cpu_to_le16(data_len);
836
837 if (data)
838 memcpy(skb_put(skb, data_len), data, data_len);
839
840 /* Time stamp */
841 __net_timestamp(skb);
842
843 hci_send_to_control(skb, skip_sk);
844 kfree_skb(skb);
845
846 return 0;
847 }
848
849 static int new_settings(struct hci_dev *hdev, struct sock *skip)
850 {
851 __le32 ev;
852
853 ev = cpu_to_le32(get_current_settings(hdev));
854
855 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
856 }
857
858 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
859 u16 len)
860 {
861 struct mgmt_cp_set_discoverable *cp = data;
862 struct pending_cmd *cmd;
863 u16 timeout;
864 u8 scan;
865 int err;
866
867 BT_DBG("request for %s", hdev->name);
868
869 timeout = __le16_to_cpu(cp->timeout);
870 if (!cp->val && timeout > 0)
871 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
872 MGMT_STATUS_INVALID_PARAMS);
873
874 hci_dev_lock(hdev);
875
876 if (!hdev_is_powered(hdev) && timeout > 0) {
877 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
878 MGMT_STATUS_NOT_POWERED);
879 goto failed;
880 }
881
882 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
883 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
884 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
885 MGMT_STATUS_BUSY);
886 goto failed;
887 }
888
889 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
890 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
891 MGMT_STATUS_REJECTED);
892 goto failed;
893 }
894
895 if (!hdev_is_powered(hdev)) {
896 bool changed = false;
897
898 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
899 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
900 changed = true;
901 }
902
903 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
904 if (err < 0)
905 goto failed;
906
907 if (changed)
908 err = new_settings(hdev, sk);
909
910 goto failed;
911 }
912
913 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
914 if (hdev->discov_timeout > 0) {
915 cancel_delayed_work(&hdev->discov_off);
916 hdev->discov_timeout = 0;
917 }
918
919 if (cp->val && timeout > 0) {
920 hdev->discov_timeout = timeout;
921 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
922 msecs_to_jiffies(hdev->discov_timeout * 1000));
923 }
924
925 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
926 goto failed;
927 }
928
929 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
930 if (!cmd) {
931 err = -ENOMEM;
932 goto failed;
933 }
934
935 scan = SCAN_PAGE;
936
937 if (cp->val)
938 scan |= SCAN_INQUIRY;
939 else
940 cancel_delayed_work(&hdev->discov_off);
941
942 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
943 if (err < 0)
944 mgmt_pending_remove(cmd);
945
946 if (cp->val)
947 hdev->discov_timeout = timeout;
948
949 failed:
950 hci_dev_unlock(hdev);
951 return err;
952 }
953
954 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
955 u16 len)
956 {
957 struct mgmt_mode *cp = data;
958 struct pending_cmd *cmd;
959 u8 scan;
960 int err;
961
962 BT_DBG("request for %s", hdev->name);
963
964 hci_dev_lock(hdev);
965
966 if (!hdev_is_powered(hdev)) {
967 bool changed = false;
968
969 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
970 changed = true;
971
972 if (cp->val) {
973 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
974 } else {
975 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
976 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
977 }
978
979 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
980 if (err < 0)
981 goto failed;
982
983 if (changed)
984 err = new_settings(hdev, sk);
985
986 goto failed;
987 }
988
989 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
990 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
991 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
992 MGMT_STATUS_BUSY);
993 goto failed;
994 }
995
996 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
997 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
998 goto failed;
999 }
1000
1001 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1002 if (!cmd) {
1003 err = -ENOMEM;
1004 goto failed;
1005 }
1006
1007 if (cp->val) {
1008 scan = SCAN_PAGE;
1009 } else {
1010 scan = 0;
1011
1012 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1013 hdev->discov_timeout > 0)
1014 cancel_delayed_work(&hdev->discov_off);
1015 }
1016
1017 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1018 if (err < 0)
1019 mgmt_pending_remove(cmd);
1020
1021 failed:
1022 hci_dev_unlock(hdev);
1023 return err;
1024 }
1025
1026 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1027 u16 len)
1028 {
1029 struct mgmt_mode *cp = data;
1030 int err;
1031
1032 BT_DBG("request for %s", hdev->name);
1033
1034 hci_dev_lock(hdev);
1035
1036 if (cp->val)
1037 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1038 else
1039 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1040
1041 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1042 if (err < 0)
1043 goto failed;
1044
1045 err = new_settings(hdev, sk);
1046
1047 failed:
1048 hci_dev_unlock(hdev);
1049 return err;
1050 }
1051
1052 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1053 u16 len)
1054 {
1055 struct mgmt_mode *cp = data;
1056 struct pending_cmd *cmd;
1057 u8 val;
1058 int err;
1059
1060 BT_DBG("request for %s", hdev->name);
1061
1062 hci_dev_lock(hdev);
1063
1064 if (!hdev_is_powered(hdev)) {
1065 bool changed = false;
1066
1067 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1068 &hdev->dev_flags)) {
1069 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1070 changed = true;
1071 }
1072
1073 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1074 if (err < 0)
1075 goto failed;
1076
1077 if (changed)
1078 err = new_settings(hdev, sk);
1079
1080 goto failed;
1081 }
1082
1083 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1084 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1085 MGMT_STATUS_BUSY);
1086 goto failed;
1087 }
1088
1089 val = !!cp->val;
1090
1091 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1092 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1093 goto failed;
1094 }
1095
1096 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1097 if (!cmd) {
1098 err = -ENOMEM;
1099 goto failed;
1100 }
1101
1102 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1103 if (err < 0) {
1104 mgmt_pending_remove(cmd);
1105 goto failed;
1106 }
1107
1108 failed:
1109 hci_dev_unlock(hdev);
1110 return err;
1111 }
1112
1113 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1114 {
1115 struct mgmt_mode *cp = data;
1116 struct pending_cmd *cmd;
1117 u8 val;
1118 int err;
1119
1120 BT_DBG("request for %s", hdev->name);
1121
1122 hci_dev_lock(hdev);
1123
1124 if (!lmp_ssp_capable(hdev)) {
1125 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1126 MGMT_STATUS_NOT_SUPPORTED);
1127 goto failed;
1128 }
1129
1130 val = !!cp->val;
1131
1132 if (!hdev_is_powered(hdev)) {
1133 bool changed = false;
1134
1135 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1136 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1137 changed = true;
1138 }
1139
1140 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1141 if (err < 0)
1142 goto failed;
1143
1144 if (changed)
1145 err = new_settings(hdev, sk);
1146
1147 goto failed;
1148 }
1149
1150 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1151 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1152 MGMT_STATUS_BUSY);
1153 goto failed;
1154 }
1155
1156 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1157 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1158 goto failed;
1159 }
1160
1161 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1162 if (!cmd) {
1163 err = -ENOMEM;
1164 goto failed;
1165 }
1166
1167 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1168 if (err < 0) {
1169 mgmt_pending_remove(cmd);
1170 goto failed;
1171 }
1172
1173 failed:
1174 hci_dev_unlock(hdev);
1175 return err;
1176 }
1177
1178 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1179 {
1180 struct mgmt_mode *cp = data;
1181
1182 BT_DBG("request for %s", hdev->name);
1183
1184 if (!enable_hs)
1185 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1186 MGMT_STATUS_NOT_SUPPORTED);
1187
1188 if (cp->val)
1189 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1190 else
1191 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1192
1193 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1194 }
1195
1196 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1197 {
1198 struct mgmt_mode *cp = data;
1199 struct hci_cp_write_le_host_supported hci_cp;
1200 struct pending_cmd *cmd;
1201 int err;
1202 u8 val, enabled;
1203
1204 BT_DBG("request for %s", hdev->name);
1205
1206 hci_dev_lock(hdev);
1207
1208 if (!lmp_le_capable(hdev)) {
1209 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1210 MGMT_STATUS_NOT_SUPPORTED);
1211 goto unlock;
1212 }
1213
1214 val = !!cp->val;
1215 enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1216
1217 if (!hdev_is_powered(hdev) || val == enabled) {
1218 bool changed = false;
1219
1220 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1221 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1222 changed = true;
1223 }
1224
1225 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1226 if (err < 0)
1227 goto unlock;
1228
1229 if (changed)
1230 err = new_settings(hdev, sk);
1231
1232 goto unlock;
1233 }
1234
1235 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1236 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1237 MGMT_STATUS_BUSY);
1238 goto unlock;
1239 }
1240
1241 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1242 if (!cmd) {
1243 err = -ENOMEM;
1244 goto unlock;
1245 }
1246
1247 memset(&hci_cp, 0, sizeof(hci_cp));
1248
1249 if (val) {
1250 hci_cp.le = val;
1251 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1252 }
1253
1254 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1255 &hci_cp);
1256 if (err < 0)
1257 mgmt_pending_remove(cmd);
1258
1259 unlock:
1260 hci_dev_unlock(hdev);
1261 return err;
1262 }
1263
1264 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1265 {
1266 struct mgmt_cp_add_uuid *cp = data;
1267 struct pending_cmd *cmd;
1268 struct bt_uuid *uuid;
1269 int err;
1270
1271 BT_DBG("request for %s", hdev->name);
1272
1273 hci_dev_lock(hdev);
1274
1275 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1276 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1277 MGMT_STATUS_BUSY);
1278 goto failed;
1279 }
1280
1281 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1282 if (!uuid) {
1283 err = -ENOMEM;
1284 goto failed;
1285 }
1286
1287 memcpy(uuid->uuid, cp->uuid, 16);
1288 uuid->svc_hint = cp->svc_hint;
1289
1290 list_add(&uuid->list, &hdev->uuids);
1291
1292 err = update_class(hdev);
1293 if (err < 0)
1294 goto failed;
1295
1296 err = update_eir(hdev);
1297 if (err < 0)
1298 goto failed;
1299
1300 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1301 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1302 hdev->dev_class, 3);
1303 goto failed;
1304 }
1305
1306 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1307 if (!cmd)
1308 err = -ENOMEM;
1309
1310 failed:
1311 hci_dev_unlock(hdev);
1312 return err;
1313 }
1314
1315 static bool enable_service_cache(struct hci_dev *hdev)
1316 {
1317 if (!hdev_is_powered(hdev))
1318 return false;
1319
1320 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1321 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1322 return true;
1323 }
1324
1325 return false;
1326 }
1327
1328 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1329 u16 len)
1330 {
1331 struct mgmt_cp_remove_uuid *cp = data;
1332 struct pending_cmd *cmd;
1333 struct list_head *p, *n;
1334 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1335 int err, found;
1336
1337 BT_DBG("request for %s", hdev->name);
1338
1339 hci_dev_lock(hdev);
1340
1341 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1342 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1343 MGMT_STATUS_BUSY);
1344 goto unlock;
1345 }
1346
1347 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1348 err = hci_uuids_clear(hdev);
1349
1350 if (enable_service_cache(hdev)) {
1351 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1352 0, hdev->dev_class, 3);
1353 goto unlock;
1354 }
1355
1356 goto update_class;
1357 }
1358
1359 found = 0;
1360
1361 list_for_each_safe(p, n, &hdev->uuids) {
1362 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1363
1364 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1365 continue;
1366
1367 list_del(&match->list);
1368 found++;
1369 }
1370
1371 if (found == 0) {
1372 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1373 MGMT_STATUS_INVALID_PARAMS);
1374 goto unlock;
1375 }
1376
1377 update_class:
1378 err = update_class(hdev);
1379 if (err < 0)
1380 goto unlock;
1381
1382 err = update_eir(hdev);
1383 if (err < 0)
1384 goto unlock;
1385
1386 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1387 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1388 hdev->dev_class, 3);
1389 goto unlock;
1390 }
1391
1392 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1393 if (!cmd)
1394 err = -ENOMEM;
1395
1396 unlock:
1397 hci_dev_unlock(hdev);
1398 return err;
1399 }
1400
1401 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1402 u16 len)
1403 {
1404 struct mgmt_cp_set_dev_class *cp = data;
1405 struct pending_cmd *cmd;
1406 int err;
1407
1408 BT_DBG("request for %s", hdev->name);
1409
1410 hci_dev_lock(hdev);
1411
1412 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1413 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1414 MGMT_STATUS_BUSY);
1415 goto unlock;
1416 }
1417
1418 hdev->major_class = cp->major;
1419 hdev->minor_class = cp->minor;
1420
1421 if (!hdev_is_powered(hdev)) {
1422 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1423 hdev->dev_class, 3);
1424 goto unlock;
1425 }
1426
1427 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1428 hci_dev_unlock(hdev);
1429 cancel_delayed_work_sync(&hdev->service_cache);
1430 hci_dev_lock(hdev);
1431 update_eir(hdev);
1432 }
1433
1434 err = update_class(hdev);
1435 if (err < 0)
1436 goto unlock;
1437
1438 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1439 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1440 hdev->dev_class, 3);
1441 goto unlock;
1442 }
1443
1444 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1445 if (!cmd)
1446 err = -ENOMEM;
1447
1448 unlock:
1449 hci_dev_unlock(hdev);
1450 return err;
1451 }
1452
1453 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1454 u16 len)
1455 {
1456 struct mgmt_cp_load_link_keys *cp = data;
1457 u16 key_count, expected_len;
1458 int i;
1459
1460 key_count = __le16_to_cpu(cp->key_count);
1461
1462 expected_len = sizeof(*cp) + key_count *
1463 sizeof(struct mgmt_link_key_info);
1464 if (expected_len != len) {
1465 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1466 len, expected_len);
1467 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1468 MGMT_STATUS_INVALID_PARAMS);
1469 }
1470
1471 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1472 key_count);
1473
1474 hci_dev_lock(hdev);
1475
1476 hci_link_keys_clear(hdev);
1477
1478 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1479
1480 if (cp->debug_keys)
1481 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1482 else
1483 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1484
1485 for (i = 0; i < key_count; i++) {
1486 struct mgmt_link_key_info *key = &cp->keys[i];
1487
1488 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1489 key->type, key->pin_len);
1490 }
1491
1492 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1493
1494 hci_dev_unlock(hdev);
1495
1496 return 0;
1497 }
1498
1499 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1500 u8 addr_type, struct sock *skip_sk)
1501 {
1502 struct mgmt_ev_device_unpaired ev;
1503
1504 bacpy(&ev.addr.bdaddr, bdaddr);
1505 ev.addr.type = addr_type;
1506
1507 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1508 skip_sk);
1509 }
1510
1511 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1512 u16 len)
1513 {
1514 struct mgmt_cp_unpair_device *cp = data;
1515 struct mgmt_rp_unpair_device rp;
1516 struct hci_cp_disconnect dc;
1517 struct pending_cmd *cmd;
1518 struct hci_conn *conn;
1519 int err;
1520
1521 hci_dev_lock(hdev);
1522
1523 memset(&rp, 0, sizeof(rp));
1524 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1525 rp.addr.type = cp->addr.type;
1526
1527 if (!hdev_is_powered(hdev)) {
1528 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1529 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1530 goto unlock;
1531 }
1532
1533 if (cp->addr.type == BDADDR_BREDR)
1534 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1535 else
1536 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1537
1538 if (err < 0) {
1539 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1540 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1541 goto unlock;
1542 }
1543
1544 if (cp->disconnect) {
1545 if (cp->addr.type == BDADDR_BREDR)
1546 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1547 &cp->addr.bdaddr);
1548 else
1549 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1550 &cp->addr.bdaddr);
1551 } else {
1552 conn = NULL;
1553 }
1554
1555 if (!conn) {
1556 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1557 &rp, sizeof(rp));
1558 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1559 goto unlock;
1560 }
1561
1562 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1563 sizeof(*cp));
1564 if (!cmd) {
1565 err = -ENOMEM;
1566 goto unlock;
1567 }
1568
1569 dc.handle = cpu_to_le16(conn->handle);
1570 dc.reason = 0x13; /* Remote User Terminated Connection */
1571 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1572 if (err < 0)
1573 mgmt_pending_remove(cmd);
1574
1575 unlock:
1576 hci_dev_unlock(hdev);
1577 return err;
1578 }
1579
1580 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1581 u16 len)
1582 {
1583 struct mgmt_cp_disconnect *cp = data;
1584 struct hci_cp_disconnect dc;
1585 struct pending_cmd *cmd;
1586 struct hci_conn *conn;
1587 int err;
1588
1589 BT_DBG("");
1590
1591 hci_dev_lock(hdev);
1592
1593 if (!test_bit(HCI_UP, &hdev->flags)) {
1594 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1595 MGMT_STATUS_NOT_POWERED);
1596 goto failed;
1597 }
1598
1599 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1600 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1601 MGMT_STATUS_BUSY);
1602 goto failed;
1603 }
1604
1605 if (cp->addr.type == BDADDR_BREDR)
1606 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1607 &cp->addr.bdaddr);
1608 else
1609 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1610
1611 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1612 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1613 MGMT_STATUS_NOT_CONNECTED);
1614 goto failed;
1615 }
1616
1617 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1618 if (!cmd) {
1619 err = -ENOMEM;
1620 goto failed;
1621 }
1622
1623 dc.handle = cpu_to_le16(conn->handle);
1624 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1625
1626 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1627 if (err < 0)
1628 mgmt_pending_remove(cmd);
1629
1630 failed:
1631 hci_dev_unlock(hdev);
1632 return err;
1633 }
1634
1635 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1636 {
1637 switch (link_type) {
1638 case LE_LINK:
1639 switch (addr_type) {
1640 case ADDR_LE_DEV_PUBLIC:
1641 return BDADDR_LE_PUBLIC;
1642
1643 default:
1644 /* Fallback to LE Random address type */
1645 return BDADDR_LE_RANDOM;
1646 }
1647
1648 default:
1649 /* Fallback to BR/EDR type */
1650 return BDADDR_BREDR;
1651 }
1652 }
1653
1654 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1655 u16 data_len)
1656 {
1657 struct mgmt_rp_get_connections *rp;
1658 struct hci_conn *c;
1659 size_t rp_len;
1660 int err;
1661 u16 i;
1662
1663 BT_DBG("");
1664
1665 hci_dev_lock(hdev);
1666
1667 if (!hdev_is_powered(hdev)) {
1668 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1669 MGMT_STATUS_NOT_POWERED);
1670 goto unlock;
1671 }
1672
1673 i = 0;
1674 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1675 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1676 i++;
1677 }
1678
1679 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1680 rp = kmalloc(rp_len, GFP_KERNEL);
1681 if (!rp) {
1682 err = -ENOMEM;
1683 goto unlock;
1684 }
1685
1686 i = 0;
1687 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1688 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1689 continue;
1690 bacpy(&rp->addr[i].bdaddr, &c->dst);
1691 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1692 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1693 continue;
1694 i++;
1695 }
1696
1697 rp->conn_count = cpu_to_le16(i);
1698
1699 /* Recalculate length in case of filtered SCO connections, etc */
1700 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1701
1702 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1703 rp_len);
1704
1705 kfree(rp);
1706
1707 unlock:
1708 hci_dev_unlock(hdev);
1709 return err;
1710 }
1711
1712 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1713 struct mgmt_cp_pin_code_neg_reply *cp)
1714 {
1715 struct pending_cmd *cmd;
1716 int err;
1717
1718 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1719 sizeof(*cp));
1720 if (!cmd)
1721 return -ENOMEM;
1722
1723 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1724 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1725 if (err < 0)
1726 mgmt_pending_remove(cmd);
1727
1728 return err;
1729 }
1730
1731 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1732 u16 len)
1733 {
1734 struct hci_conn *conn;
1735 struct mgmt_cp_pin_code_reply *cp = data;
1736 struct hci_cp_pin_code_reply reply;
1737 struct pending_cmd *cmd;
1738 int err;
1739
1740 BT_DBG("");
1741
1742 hci_dev_lock(hdev);
1743
1744 if (!hdev_is_powered(hdev)) {
1745 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1746 MGMT_STATUS_NOT_POWERED);
1747 goto failed;
1748 }
1749
1750 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1751 if (!conn) {
1752 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1753 MGMT_STATUS_NOT_CONNECTED);
1754 goto failed;
1755 }
1756
1757 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1758 struct mgmt_cp_pin_code_neg_reply ncp;
1759
1760 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1761
1762 BT_ERR("PIN code is not 16 bytes long");
1763
1764 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1765 if (err >= 0)
1766 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1767 MGMT_STATUS_INVALID_PARAMS);
1768
1769 goto failed;
1770 }
1771
1772 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1773 if (!cmd) {
1774 err = -ENOMEM;
1775 goto failed;
1776 }
1777
1778 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1779 reply.pin_len = cp->pin_len;
1780 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1781
1782 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1783 if (err < 0)
1784 mgmt_pending_remove(cmd);
1785
1786 failed:
1787 hci_dev_unlock(hdev);
1788 return err;
1789 }
1790
1791 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1792 u16 len)
1793 {
1794 struct mgmt_cp_set_io_capability *cp = data;
1795
1796 BT_DBG("");
1797
1798 hci_dev_lock(hdev);
1799
1800 hdev->io_capability = cp->io_capability;
1801
1802 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1803 hdev->io_capability);
1804
1805 hci_dev_unlock(hdev);
1806
1807 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1808 0);
1809 }
1810
1811 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1812 {
1813 struct hci_dev *hdev = conn->hdev;
1814 struct pending_cmd *cmd;
1815
1816 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1817 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1818 continue;
1819
1820 if (cmd->user_data != conn)
1821 continue;
1822
1823 return cmd;
1824 }
1825
1826 return NULL;
1827 }
1828
1829 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1830 {
1831 struct mgmt_rp_pair_device rp;
1832 struct hci_conn *conn = cmd->user_data;
1833
1834 bacpy(&rp.addr.bdaddr, &conn->dst);
1835 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1836
1837 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1838 &rp, sizeof(rp));
1839
1840 /* So we don't get further callbacks for this connection */
1841 conn->connect_cfm_cb = NULL;
1842 conn->security_cfm_cb = NULL;
1843 conn->disconn_cfm_cb = NULL;
1844
1845 hci_conn_put(conn);
1846
1847 mgmt_pending_remove(cmd);
1848 }
1849
1850 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1851 {
1852 struct pending_cmd *cmd;
1853
1854 BT_DBG("status %u", status);
1855
1856 cmd = find_pairing(conn);
1857 if (!cmd)
1858 BT_DBG("Unable to find a pending command");
1859 else
1860 pairing_complete(cmd, mgmt_status(status));
1861 }
1862
1863 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1864 {
1865 struct pending_cmd *cmd;
1866
1867 BT_DBG("status %u", status);
1868
1869 if (!status)
1870 return;
1871
1872 cmd = find_pairing(conn);
1873 if (!cmd)
1874 BT_DBG("Unable to find a pending command");
1875 else
1876 pairing_complete(cmd, mgmt_status(status));
1877 }
1878
1879 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1880 u16 len)
1881 {
1882 struct mgmt_cp_pair_device *cp = data;
1883 struct mgmt_rp_pair_device rp;
1884 struct pending_cmd *cmd;
1885 u8 sec_level, auth_type;
1886 struct hci_conn *conn;
1887 int err;
1888
1889 BT_DBG("");
1890
1891 hci_dev_lock(hdev);
1892
1893 if (!hdev_is_powered(hdev)) {
1894 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1895 MGMT_STATUS_NOT_POWERED);
1896 goto unlock;
1897 }
1898
1899 sec_level = BT_SECURITY_MEDIUM;
1900 if (cp->io_cap == 0x03)
1901 auth_type = HCI_AT_DEDICATED_BONDING;
1902 else
1903 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1904
1905 if (cp->addr.type == BDADDR_BREDR)
1906 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1907 cp->addr.type, sec_level, auth_type);
1908 else
1909 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1910 cp->addr.type, sec_level, auth_type);
1911
1912 memset(&rp, 0, sizeof(rp));
1913 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1914 rp.addr.type = cp->addr.type;
1915
1916 if (IS_ERR(conn)) {
1917 int status;
1918
1919 if (PTR_ERR(conn) == -EBUSY)
1920 status = MGMT_STATUS_BUSY;
1921 else
1922 status = MGMT_STATUS_CONNECT_FAILED;
1923
1924 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1925 status, &rp,
1926 sizeof(rp));
1927 goto unlock;
1928 }
1929
1930 if (conn->connect_cfm_cb) {
1931 hci_conn_put(conn);
1932 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1933 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1934 goto unlock;
1935 }
1936
1937 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1938 if (!cmd) {
1939 err = -ENOMEM;
1940 hci_conn_put(conn);
1941 goto unlock;
1942 }
1943
1944 /* For LE, just connecting isn't a proof that the pairing finished */
1945 if (cp->addr.type == BDADDR_BREDR)
1946 conn->connect_cfm_cb = pairing_complete_cb;
1947 else
1948 conn->connect_cfm_cb = le_connect_complete_cb;
1949
1950 conn->security_cfm_cb = pairing_complete_cb;
1951 conn->disconn_cfm_cb = pairing_complete_cb;
1952 conn->io_capability = cp->io_cap;
1953 cmd->user_data = conn;
1954
1955 if (conn->state == BT_CONNECTED &&
1956 hci_conn_security(conn, sec_level, auth_type))
1957 pairing_complete(cmd, 0);
1958
1959 err = 0;
1960
1961 unlock:
1962 hci_dev_unlock(hdev);
1963 return err;
1964 }
1965
1966 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1967 u16 len)
1968 {
1969 struct mgmt_addr_info *addr = data;
1970 struct pending_cmd *cmd;
1971 struct hci_conn *conn;
1972 int err;
1973
1974 BT_DBG("");
1975
1976 hci_dev_lock(hdev);
1977
1978 if (!hdev_is_powered(hdev)) {
1979 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1980 MGMT_STATUS_NOT_POWERED);
1981 goto unlock;
1982 }
1983
1984 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1985 if (!cmd) {
1986 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1987 MGMT_STATUS_INVALID_PARAMS);
1988 goto unlock;
1989 }
1990
1991 conn = cmd->user_data;
1992
1993 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1994 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1995 MGMT_STATUS_INVALID_PARAMS);
1996 goto unlock;
1997 }
1998
1999 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2000
2001 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2002 addr, sizeof(*addr));
2003 unlock:
2004 hci_dev_unlock(hdev);
2005 return err;
2006 }
2007
2008 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2009 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2010 u16 hci_op, __le32 passkey)
2011 {
2012 struct pending_cmd *cmd;
2013 struct hci_conn *conn;
2014 int err;
2015
2016 hci_dev_lock(hdev);
2017
2018 if (!hdev_is_powered(hdev)) {
2019 err = cmd_status(sk, hdev->id, mgmt_op,
2020 MGMT_STATUS_NOT_POWERED);
2021 goto done;
2022 }
2023
2024 if (type == BDADDR_BREDR)
2025 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2026 else
2027 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2028
2029 if (!conn) {
2030 err = cmd_status(sk, hdev->id, mgmt_op,
2031 MGMT_STATUS_NOT_CONNECTED);
2032 goto done;
2033 }
2034
2035 if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2036 /* Continue with pairing via SMP */
2037 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2038
2039 if (!err)
2040 err = cmd_status(sk, hdev->id, mgmt_op,
2041 MGMT_STATUS_SUCCESS);
2042 else
2043 err = cmd_status(sk, hdev->id, mgmt_op,
2044 MGMT_STATUS_FAILED);
2045
2046 goto done;
2047 }
2048
2049 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2050 if (!cmd) {
2051 err = -ENOMEM;
2052 goto done;
2053 }
2054
2055 /* Continue with pairing via HCI */
2056 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2057 struct hci_cp_user_passkey_reply cp;
2058
2059 bacpy(&cp.bdaddr, bdaddr);
2060 cp.passkey = passkey;
2061 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2062 } else
2063 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2064
2065 if (err < 0)
2066 mgmt_pending_remove(cmd);
2067
2068 done:
2069 hci_dev_unlock(hdev);
2070 return err;
2071 }
2072
2073 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2074 void *data, u16 len)
2075 {
2076 struct mgmt_cp_pin_code_neg_reply *cp = data;
2077
2078 BT_DBG("");
2079
2080 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2081 MGMT_OP_PIN_CODE_NEG_REPLY,
2082 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2083 }
2084
2085 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2086 u16 len)
2087 {
2088 struct mgmt_cp_user_confirm_reply *cp = data;
2089
2090 BT_DBG("");
2091
2092 if (len != sizeof(*cp))
2093 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2094 MGMT_STATUS_INVALID_PARAMS);
2095
2096 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2097 MGMT_OP_USER_CONFIRM_REPLY,
2098 HCI_OP_USER_CONFIRM_REPLY, 0);
2099 }
2100
2101 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2102 void *data, u16 len)
2103 {
2104 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2105
2106 BT_DBG("");
2107
2108 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2109 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2110 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2111 }
2112
2113 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2114 u16 len)
2115 {
2116 struct mgmt_cp_user_passkey_reply *cp = data;
2117
2118 BT_DBG("");
2119
2120 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2121 MGMT_OP_USER_PASSKEY_REPLY,
2122 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2123 }
2124
2125 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2126 void *data, u16 len)
2127 {
2128 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2129
2130 BT_DBG("");
2131
2132 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2133 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2134 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2135 }
2136
2137 static int update_name(struct hci_dev *hdev, const char *name)
2138 {
2139 struct hci_cp_write_local_name cp;
2140
2141 memcpy(cp.name, name, sizeof(cp.name));
2142
2143 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2144 }
2145
2146 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2147 u16 len)
2148 {
2149 struct mgmt_cp_set_local_name *cp = data;
2150 struct pending_cmd *cmd;
2151 int err;
2152
2153 BT_DBG("");
2154
2155 hci_dev_lock(hdev);
2156
2157 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2158
2159 if (!hdev_is_powered(hdev)) {
2160 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2161
2162 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2163 data, len);
2164 if (err < 0)
2165 goto failed;
2166
2167 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2168 sk);
2169
2170 goto failed;
2171 }
2172
2173 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2174 if (!cmd) {
2175 err = -ENOMEM;
2176 goto failed;
2177 }
2178
2179 err = update_name(hdev, cp->name);
2180 if (err < 0)
2181 mgmt_pending_remove(cmd);
2182
2183 failed:
2184 hci_dev_unlock(hdev);
2185 return err;
2186 }
2187
2188 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2189 void *data, u16 data_len)
2190 {
2191 struct pending_cmd *cmd;
2192 int err;
2193
2194 BT_DBG("%s", hdev->name);
2195
2196 hci_dev_lock(hdev);
2197
2198 if (!hdev_is_powered(hdev)) {
2199 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2200 MGMT_STATUS_NOT_POWERED);
2201 goto unlock;
2202 }
2203
2204 if (!lmp_ssp_capable(hdev)) {
2205 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2206 MGMT_STATUS_NOT_SUPPORTED);
2207 goto unlock;
2208 }
2209
2210 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2211 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2212 MGMT_STATUS_BUSY);
2213 goto unlock;
2214 }
2215
2216 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2217 if (!cmd) {
2218 err = -ENOMEM;
2219 goto unlock;
2220 }
2221
2222 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2223 if (err < 0)
2224 mgmt_pending_remove(cmd);
2225
2226 unlock:
2227 hci_dev_unlock(hdev);
2228 return err;
2229 }
2230
2231 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2232 void *data, u16 len)
2233 {
2234 struct mgmt_cp_add_remote_oob_data *cp = data;
2235 u8 status;
2236 int err;
2237
2238 BT_DBG("%s ", hdev->name);
2239
2240 hci_dev_lock(hdev);
2241
2242 if (!hdev_is_powered(hdev)) {
2243 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2244 MGMT_STATUS_NOT_POWERED, &cp->addr,
2245 sizeof(cp->addr));
2246 goto unlock;
2247 }
2248
2249 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2250 cp->randomizer);
2251 if (err < 0)
2252 status = MGMT_STATUS_FAILED;
2253 else
2254 status = 0;
2255
2256 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2257 &cp->addr, sizeof(cp->addr));
2258
2259 unlock:
2260 hci_dev_unlock(hdev);
2261 return err;
2262 }
2263
2264 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2265 void *data, u16 len)
2266 {
2267 struct mgmt_cp_remove_remote_oob_data *cp = data;
2268 u8 status;
2269 int err;
2270
2271 BT_DBG("%s", hdev->name);
2272
2273 hci_dev_lock(hdev);
2274
2275 if (!hdev_is_powered(hdev)) {
2276 err = cmd_complete(sk, hdev->id,
2277 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2278 MGMT_STATUS_NOT_POWERED, &cp->addr,
2279 sizeof(cp->addr));
2280 goto unlock;
2281 }
2282
2283 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2284 if (err < 0)
2285 status = MGMT_STATUS_INVALID_PARAMS;
2286 else
2287 status = 0;
2288
2289 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2290 status, &cp->addr, sizeof(cp->addr));
2291
2292 unlock:
2293 hci_dev_unlock(hdev);
2294 return err;
2295 }
2296
2297 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2298 {
2299 int err;
2300
2301 BT_DBG("%s", hdev->name);
2302
2303 hci_dev_lock(hdev);
2304
2305 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2306 if (err < 0)
2307 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2308
2309 hci_dev_unlock(hdev);
2310
2311 return err;
2312 }
2313
2314 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2315 void *data, u16 len)
2316 {
2317 struct mgmt_cp_start_discovery *cp = data;
2318 struct pending_cmd *cmd;
2319 int err;
2320
2321 BT_DBG("%s", hdev->name);
2322
2323 hci_dev_lock(hdev);
2324
2325 if (!hdev_is_powered(hdev)) {
2326 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2327 MGMT_STATUS_NOT_POWERED);
2328 goto failed;
2329 }
2330
2331 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2332 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2333 MGMT_STATUS_BUSY);
2334 goto failed;
2335 }
2336
2337 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2338 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2339 MGMT_STATUS_BUSY);
2340 goto failed;
2341 }
2342
2343 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2344 if (!cmd) {
2345 err = -ENOMEM;
2346 goto failed;
2347 }
2348
2349 hdev->discovery.type = cp->type;
2350
2351 switch (hdev->discovery.type) {
2352 case DISCOV_TYPE_BREDR:
2353 if (lmp_bredr_capable(hdev))
2354 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2355 else
2356 err = -ENOTSUPP;
2357 break;
2358
2359 case DISCOV_TYPE_LE:
2360 if (lmp_host_le_capable(hdev))
2361 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2362 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2363 else
2364 err = -ENOTSUPP;
2365 break;
2366
2367 case DISCOV_TYPE_INTERLEAVED:
2368 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2369 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2370 LE_SCAN_WIN,
2371 LE_SCAN_TIMEOUT_BREDR_LE);
2372 else
2373 err = -ENOTSUPP;
2374 break;
2375
2376 default:
2377 err = -EINVAL;
2378 }
2379
2380 if (err < 0)
2381 mgmt_pending_remove(cmd);
2382 else
2383 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2384
2385 failed:
2386 hci_dev_unlock(hdev);
2387 return err;
2388 }
2389
2390 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2391 u16 len)
2392 {
2393 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2394 struct pending_cmd *cmd;
2395 struct hci_cp_remote_name_req_cancel cp;
2396 struct inquiry_entry *e;
2397 int err;
2398
2399 BT_DBG("%s", hdev->name);
2400
2401 hci_dev_lock(hdev);
2402
2403 if (!hci_discovery_active(hdev)) {
2404 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2405 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2406 sizeof(mgmt_cp->type));
2407 goto unlock;
2408 }
2409
2410 if (hdev->discovery.type != mgmt_cp->type) {
2411 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2412 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2413 sizeof(mgmt_cp->type));
2414 goto unlock;
2415 }
2416
2417 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2418 if (!cmd) {
2419 err = -ENOMEM;
2420 goto unlock;
2421 }
2422
2423 switch (hdev->discovery.state) {
2424 case DISCOVERY_FINDING:
2425 if (test_bit(HCI_INQUIRY, &hdev->flags))
2426 err = hci_cancel_inquiry(hdev);
2427 else
2428 err = hci_cancel_le_scan(hdev);
2429
2430 break;
2431
2432 case DISCOVERY_RESOLVING:
2433 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2434 NAME_PENDING);
2435 if (!e) {
2436 mgmt_pending_remove(cmd);
2437 err = cmd_complete(sk, hdev->id,
2438 MGMT_OP_STOP_DISCOVERY, 0,
2439 &mgmt_cp->type,
2440 sizeof(mgmt_cp->type));
2441 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2442 goto unlock;
2443 }
2444
2445 bacpy(&cp.bdaddr, &e->data.bdaddr);
2446 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2447 sizeof(cp), &cp);
2448
2449 break;
2450
2451 default:
2452 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2453 err = -EFAULT;
2454 }
2455
2456 if (err < 0)
2457 mgmt_pending_remove(cmd);
2458 else
2459 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2460
2461 unlock:
2462 hci_dev_unlock(hdev);
2463 return err;
2464 }
2465
2466 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2467 u16 len)
2468 {
2469 struct mgmt_cp_confirm_name *cp = data;
2470 struct inquiry_entry *e;
2471 int err;
2472
2473 BT_DBG("%s", hdev->name);
2474
2475 hci_dev_lock(hdev);
2476
2477 if (!hci_discovery_active(hdev)) {
2478 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2479 MGMT_STATUS_FAILED);
2480 goto failed;
2481 }
2482
2483 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2484 if (!e) {
2485 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2486 MGMT_STATUS_INVALID_PARAMS);
2487 goto failed;
2488 }
2489
2490 if (cp->name_known) {
2491 e->name_state = NAME_KNOWN;
2492 list_del(&e->list);
2493 } else {
2494 e->name_state = NAME_NEEDED;
2495 hci_inquiry_cache_update_resolve(hdev, e);
2496 }
2497
2498 err = 0;
2499
2500 failed:
2501 hci_dev_unlock(hdev);
2502 return err;
2503 }
2504
2505 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2506 u16 len)
2507 {
2508 struct mgmt_cp_block_device *cp = data;
2509 u8 status;
2510 int err;
2511
2512 BT_DBG("%s", hdev->name);
2513
2514 hci_dev_lock(hdev);
2515
2516 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2517 if (err < 0)
2518 status = MGMT_STATUS_FAILED;
2519 else
2520 status = 0;
2521
2522 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2523 &cp->addr, sizeof(cp->addr));
2524
2525 hci_dev_unlock(hdev);
2526
2527 return err;
2528 }
2529
2530 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2531 u16 len)
2532 {
2533 struct mgmt_cp_unblock_device *cp = data;
2534 u8 status;
2535 int err;
2536
2537 BT_DBG("%s", hdev->name);
2538
2539 hci_dev_lock(hdev);
2540
2541 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2542 if (err < 0)
2543 status = MGMT_STATUS_INVALID_PARAMS;
2544 else
2545 status = 0;
2546
2547 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2548 &cp->addr, sizeof(cp->addr));
2549
2550 hci_dev_unlock(hdev);
2551
2552 return err;
2553 }
2554
2555 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2556 u16 len)
2557 {
2558 struct mgmt_cp_set_device_id *cp = data;
2559 int err;
2560 __u16 source;
2561
2562 BT_DBG("%s", hdev->name);
2563
2564 source = __le16_to_cpu(cp->source);
2565
2566 if (source > 0x0002)
2567 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2568 MGMT_STATUS_INVALID_PARAMS);
2569
2570 hci_dev_lock(hdev);
2571
2572 hdev->devid_source = source;
2573 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2574 hdev->devid_product = __le16_to_cpu(cp->product);
2575 hdev->devid_version = __le16_to_cpu(cp->version);
2576
2577 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2578
2579 update_eir(hdev);
2580
2581 hci_dev_unlock(hdev);
2582
2583 return err;
2584 }
2585
2586 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2587 void *data, u16 len)
2588 {
2589 struct mgmt_mode *cp = data;
2590 struct hci_cp_write_page_scan_activity acp;
2591 u8 type;
2592 int err;
2593
2594 BT_DBG("%s", hdev->name);
2595
2596 if (!hdev_is_powered(hdev))
2597 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2598 MGMT_STATUS_NOT_POWERED);
2599
2600 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2601 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2602 MGMT_STATUS_REJECTED);
2603
2604 hci_dev_lock(hdev);
2605
2606 if (cp->val) {
2607 type = PAGE_SCAN_TYPE_INTERLACED;
2608
2609 /* 160 msec page scan interval */
2610 acp.interval = __constant_cpu_to_le16(0x0100);
2611 } else {
2612 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2613
2614 /* default 1.28 sec page scan */
2615 acp.interval = __constant_cpu_to_le16(0x0800);
2616 }
2617
2618 /* default 11.25 msec page scan window */
2619 acp.window = __constant_cpu_to_le16(0x0012);
2620
2621 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2622 &acp);
2623 if (err < 0) {
2624 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2625 MGMT_STATUS_FAILED);
2626 goto done;
2627 }
2628
2629 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2630 if (err < 0) {
2631 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2632 MGMT_STATUS_FAILED);
2633 goto done;
2634 }
2635
2636 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2637 NULL, 0);
2638 done:
2639 hci_dev_unlock(hdev);
2640 return err;
2641 }
2642
2643 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2644 void *cp_data, u16 len)
2645 {
2646 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2647 u16 key_count, expected_len;
2648 int i;
2649
2650 key_count = __le16_to_cpu(cp->key_count);
2651
2652 expected_len = sizeof(*cp) + key_count *
2653 sizeof(struct mgmt_ltk_info);
2654 if (expected_len != len) {
2655 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2656 len, expected_len);
2657 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2658 EINVAL);
2659 }
2660
2661 BT_DBG("%s key_count %u", hdev->name, key_count);
2662
2663 hci_dev_lock(hdev);
2664
2665 hci_smp_ltks_clear(hdev);
2666
2667 for (i = 0; i < key_count; i++) {
2668 struct mgmt_ltk_info *key = &cp->keys[i];
2669 u8 type;
2670
2671 if (key->master)
2672 type = HCI_SMP_LTK;
2673 else
2674 type = HCI_SMP_LTK_SLAVE;
2675
2676 hci_add_ltk(hdev, &key->addr.bdaddr,
2677 bdaddr_to_le(key->addr.type),
2678 type, 0, key->authenticated, key->val,
2679 key->enc_size, key->ediv, key->rand);
2680 }
2681
2682 hci_dev_unlock(hdev);
2683
2684 return 0;
2685 }
2686
2687 static const struct mgmt_handler {
2688 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2689 u16 data_len);
2690 bool var_len;
2691 size_t data_len;
2692 } mgmt_handlers[] = {
2693 { NULL }, /* 0x0000 (no command) */
2694 { read_version, false, MGMT_READ_VERSION_SIZE },
2695 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2696 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2697 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2698 { set_powered, false, MGMT_SETTING_SIZE },
2699 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2700 { set_connectable, false, MGMT_SETTING_SIZE },
2701 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2702 { set_pairable, false, MGMT_SETTING_SIZE },
2703 { set_link_security, false, MGMT_SETTING_SIZE },
2704 { set_ssp, false, MGMT_SETTING_SIZE },
2705 { set_hs, false, MGMT_SETTING_SIZE },
2706 { set_le, false, MGMT_SETTING_SIZE },
2707 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2708 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2709 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2710 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2711 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2712 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2713 { disconnect, false, MGMT_DISCONNECT_SIZE },
2714 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2715 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2716 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2717 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2718 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2719 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2720 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2721 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2722 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2723 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2724 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2725 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2726 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2727 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2728 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2729 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2730 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2731 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2732 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2733 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
2734 };
2735
2736
2737 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2738 {
2739 void *buf;
2740 u8 *cp;
2741 struct mgmt_hdr *hdr;
2742 u16 opcode, index, len;
2743 struct hci_dev *hdev = NULL;
2744 const struct mgmt_handler *handler;
2745 int err;
2746
2747 BT_DBG("got %zu bytes", msglen);
2748
2749 if (msglen < sizeof(*hdr))
2750 return -EINVAL;
2751
2752 buf = kmalloc(msglen, GFP_KERNEL);
2753 if (!buf)
2754 return -ENOMEM;
2755
2756 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2757 err = -EFAULT;
2758 goto done;
2759 }
2760
2761 hdr = buf;
2762 opcode = __le16_to_cpu(hdr->opcode);
2763 index = __le16_to_cpu(hdr->index);
2764 len = __le16_to_cpu(hdr->len);
2765
2766 if (len != msglen - sizeof(*hdr)) {
2767 err = -EINVAL;
2768 goto done;
2769 }
2770
2771 if (index != MGMT_INDEX_NONE) {
2772 hdev = hci_dev_get(index);
2773 if (!hdev) {
2774 err = cmd_status(sk, index, opcode,
2775 MGMT_STATUS_INVALID_INDEX);
2776 goto done;
2777 }
2778 }
2779
2780 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2781 mgmt_handlers[opcode].func == NULL) {
2782 BT_DBG("Unknown op %u", opcode);
2783 err = cmd_status(sk, index, opcode,
2784 MGMT_STATUS_UNKNOWN_COMMAND);
2785 goto done;
2786 }
2787
2788 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2789 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2790 err = cmd_status(sk, index, opcode,
2791 MGMT_STATUS_INVALID_INDEX);
2792 goto done;
2793 }
2794
2795 handler = &mgmt_handlers[opcode];
2796
2797 if ((handler->var_len && len < handler->data_len) ||
2798 (!handler->var_len && len != handler->data_len)) {
2799 err = cmd_status(sk, index, opcode,
2800 MGMT_STATUS_INVALID_PARAMS);
2801 goto done;
2802 }
2803
2804 if (hdev)
2805 mgmt_init_hdev(sk, hdev);
2806
2807 cp = buf + sizeof(*hdr);
2808
2809 err = handler->func(sk, hdev, cp, len);
2810 if (err < 0)
2811 goto done;
2812
2813 err = msglen;
2814
2815 done:
2816 if (hdev)
2817 hci_dev_put(hdev);
2818
2819 kfree(buf);
2820 return err;
2821 }
2822
2823 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2824 {
2825 u8 *status = data;
2826
2827 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2828 mgmt_pending_remove(cmd);
2829 }
2830
2831 int mgmt_index_added(struct hci_dev *hdev)
2832 {
2833 if (!mgmt_valid_hdev(hdev))
2834 return -ENOTSUPP;
2835
2836 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2837 }
2838
2839 int mgmt_index_removed(struct hci_dev *hdev)
2840 {
2841 u8 status = MGMT_STATUS_INVALID_INDEX;
2842
2843 if (!mgmt_valid_hdev(hdev))
2844 return -ENOTSUPP;
2845
2846 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2847
2848 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2849 }
2850
2851 struct cmd_lookup {
2852 struct sock *sk;
2853 struct hci_dev *hdev;
2854 u8 mgmt_status;
2855 };
2856
2857 static void settings_rsp(struct pending_cmd *cmd, void *data)
2858 {
2859 struct cmd_lookup *match = data;
2860
2861 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2862
2863 list_del(&cmd->list);
2864
2865 if (match->sk == NULL) {
2866 match->sk = cmd->sk;
2867 sock_hold(match->sk);
2868 }
2869
2870 mgmt_pending_free(cmd);
2871 }
2872
2873 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2874 {
2875 struct cmd_lookup match = { NULL, hdev };
2876 int err;
2877
2878 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2879 return 0;
2880
2881 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2882
2883 if (powered) {
2884 u8 scan = 0;
2885
2886 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2887 scan |= SCAN_PAGE;
2888 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2889 scan |= SCAN_INQUIRY;
2890
2891 if (scan)
2892 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2893
2894 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2895 u8 ssp = 1;
2896
2897 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2898 }
2899
2900 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2901 struct hci_cp_write_le_host_supported cp;
2902
2903 cp.le = 1;
2904 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
2905
2906 hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2907 sizeof(cp), &cp);
2908 }
2909
2910 update_class(hdev);
2911 update_name(hdev, hdev->dev_name);
2912 update_eir(hdev);
2913 } else {
2914 u8 status = MGMT_STATUS_NOT_POWERED;
2915 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2916 }
2917
2918 err = new_settings(hdev, match.sk);
2919
2920 if (match.sk)
2921 sock_put(match.sk);
2922
2923 return err;
2924 }
2925
2926 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2927 {
2928 struct cmd_lookup match = { NULL, hdev };
2929 bool changed = false;
2930 int err = 0;
2931
2932 if (discoverable) {
2933 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2934 changed = true;
2935 } else {
2936 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2937 changed = true;
2938 }
2939
2940 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2941 &match);
2942
2943 if (changed)
2944 err = new_settings(hdev, match.sk);
2945
2946 if (match.sk)
2947 sock_put(match.sk);
2948
2949 return err;
2950 }
2951
2952 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2953 {
2954 struct cmd_lookup match = { NULL, hdev };
2955 bool changed = false;
2956 int err = 0;
2957
2958 if (connectable) {
2959 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2960 changed = true;
2961 } else {
2962 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2963 changed = true;
2964 }
2965
2966 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2967 &match);
2968
2969 if (changed)
2970 err = new_settings(hdev, match.sk);
2971
2972 if (match.sk)
2973 sock_put(match.sk);
2974
2975 return err;
2976 }
2977
2978 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2979 {
2980 u8 mgmt_err = mgmt_status(status);
2981
2982 if (scan & SCAN_PAGE)
2983 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2984 cmd_status_rsp, &mgmt_err);
2985
2986 if (scan & SCAN_INQUIRY)
2987 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2988 cmd_status_rsp, &mgmt_err);
2989
2990 return 0;
2991 }
2992
2993 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
2994 bool persistent)
2995 {
2996 struct mgmt_ev_new_link_key ev;
2997
2998 memset(&ev, 0, sizeof(ev));
2999
3000 ev.store_hint = persistent;
3001 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3002 ev.key.addr.type = BDADDR_BREDR;
3003 ev.key.type = key->type;
3004 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3005 ev.key.pin_len = key->pin_len;
3006
3007 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3008 }
3009
3010 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3011 {
3012 struct mgmt_ev_new_long_term_key ev;
3013
3014 memset(&ev, 0, sizeof(ev));
3015
3016 ev.store_hint = persistent;
3017 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3018 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3019 ev.key.authenticated = key->authenticated;
3020 ev.key.enc_size = key->enc_size;
3021 ev.key.ediv = key->ediv;
3022
3023 if (key->type == HCI_SMP_LTK)
3024 ev.key.master = 1;
3025
3026 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3027 memcpy(ev.key.val, key->val, sizeof(key->val));
3028
3029 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3030 NULL);
3031 }
3032
3033 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3034 u8 addr_type, u32 flags, u8 *name, u8 name_len,
3035 u8 *dev_class)
3036 {
3037 char buf[512];
3038 struct mgmt_ev_device_connected *ev = (void *) buf;
3039 u16 eir_len = 0;
3040
3041 bacpy(&ev->addr.bdaddr, bdaddr);
3042 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3043
3044 ev->flags = __cpu_to_le32(flags);
3045
3046 if (name_len > 0)
3047 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3048 name, name_len);
3049
3050 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3051 eir_len = eir_append_data(ev->eir, eir_len,
3052 EIR_CLASS_OF_DEV, dev_class, 3);
3053
3054 ev->eir_len = cpu_to_le16(eir_len);
3055
3056 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3057 sizeof(*ev) + eir_len, NULL);
3058 }
3059
3060 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3061 {
3062 struct mgmt_cp_disconnect *cp = cmd->param;
3063 struct sock **sk = data;
3064 struct mgmt_rp_disconnect rp;
3065
3066 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3067 rp.addr.type = cp->addr.type;
3068
3069 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3070 sizeof(rp));
3071
3072 *sk = cmd->sk;
3073 sock_hold(*sk);
3074
3075 mgmt_pending_remove(cmd);
3076 }
3077
3078 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3079 {
3080 struct hci_dev *hdev = data;
3081 struct mgmt_cp_unpair_device *cp = cmd->param;
3082 struct mgmt_rp_unpair_device rp;
3083
3084 memset(&rp, 0, sizeof(rp));
3085 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3086 rp.addr.type = cp->addr.type;
3087
3088 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3089
3090 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3091
3092 mgmt_pending_remove(cmd);
3093 }
3094
3095 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3096 u8 link_type, u8 addr_type)
3097 {
3098 struct mgmt_addr_info ev;
3099 struct sock *sk = NULL;
3100 int err;
3101
3102 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3103
3104 bacpy(&ev.bdaddr, bdaddr);
3105 ev.type = link_to_bdaddr(link_type, addr_type);
3106
3107 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3108 sk);
3109
3110 if (sk)
3111 sock_put(sk);
3112
3113 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3114 hdev);
3115
3116 return err;
3117 }
3118
3119 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3120 u8 link_type, u8 addr_type, u8 status)
3121 {
3122 struct mgmt_rp_disconnect rp;
3123 struct pending_cmd *cmd;
3124 int err;
3125
3126 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3127 if (!cmd)
3128 return -ENOENT;
3129
3130 bacpy(&rp.addr.bdaddr, bdaddr);
3131 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3132
3133 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3134 mgmt_status(status), &rp, sizeof(rp));
3135
3136 mgmt_pending_remove(cmd);
3137
3138 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3139 hdev);
3140 return err;
3141 }
3142
3143 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3144 u8 addr_type, u8 status)
3145 {
3146 struct mgmt_ev_connect_failed ev;
3147
3148 bacpy(&ev.addr.bdaddr, bdaddr);
3149 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3150 ev.status = mgmt_status(status);
3151
3152 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3153 }
3154
3155 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3156 {
3157 struct mgmt_ev_pin_code_request ev;
3158
3159 bacpy(&ev.addr.bdaddr, bdaddr);
3160 ev.addr.type = BDADDR_BREDR;
3161 ev.secure = secure;
3162
3163 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3164 NULL);
3165 }
3166
3167 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3168 u8 status)
3169 {
3170 struct pending_cmd *cmd;
3171 struct mgmt_rp_pin_code_reply rp;
3172 int err;
3173
3174 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3175 if (!cmd)
3176 return -ENOENT;
3177
3178 bacpy(&rp.addr.bdaddr, bdaddr);
3179 rp.addr.type = BDADDR_BREDR;
3180
3181 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3182 mgmt_status(status), &rp, sizeof(rp));
3183
3184 mgmt_pending_remove(cmd);
3185
3186 return err;
3187 }
3188
3189 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3190 u8 status)
3191 {
3192 struct pending_cmd *cmd;
3193 struct mgmt_rp_pin_code_reply rp;
3194 int err;
3195
3196 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3197 if (!cmd)
3198 return -ENOENT;
3199
3200 bacpy(&rp.addr.bdaddr, bdaddr);
3201 rp.addr.type = BDADDR_BREDR;
3202
3203 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3204 mgmt_status(status), &rp, sizeof(rp));
3205
3206 mgmt_pending_remove(cmd);
3207
3208 return err;
3209 }
3210
3211 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3212 u8 link_type, u8 addr_type, __le32 value,
3213 u8 confirm_hint)
3214 {
3215 struct mgmt_ev_user_confirm_request ev;
3216
3217 BT_DBG("%s", hdev->name);
3218
3219 bacpy(&ev.addr.bdaddr, bdaddr);
3220 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3221 ev.confirm_hint = confirm_hint;
3222 ev.value = value;
3223
3224 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3225 NULL);
3226 }
3227
3228 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3229 u8 link_type, u8 addr_type)
3230 {
3231 struct mgmt_ev_user_passkey_request ev;
3232
3233 BT_DBG("%s", hdev->name);
3234
3235 bacpy(&ev.addr.bdaddr, bdaddr);
3236 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3237
3238 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3239 NULL);
3240 }
3241
3242 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3243 u8 link_type, u8 addr_type, u8 status,
3244 u8 opcode)
3245 {
3246 struct pending_cmd *cmd;
3247 struct mgmt_rp_user_confirm_reply rp;
3248 int err;
3249
3250 cmd = mgmt_pending_find(opcode, hdev);
3251 if (!cmd)
3252 return -ENOENT;
3253
3254 bacpy(&rp.addr.bdaddr, bdaddr);
3255 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3256 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3257 &rp, sizeof(rp));
3258
3259 mgmt_pending_remove(cmd);
3260
3261 return err;
3262 }
3263
3264 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3265 u8 link_type, u8 addr_type, u8 status)
3266 {
3267 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3268 status, MGMT_OP_USER_CONFIRM_REPLY);
3269 }
3270
3271 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3272 u8 link_type, u8 addr_type, u8 status)
3273 {
3274 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3275 status,
3276 MGMT_OP_USER_CONFIRM_NEG_REPLY);
3277 }
3278
3279 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3280 u8 link_type, u8 addr_type, u8 status)
3281 {
3282 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3283 status, MGMT_OP_USER_PASSKEY_REPLY);
3284 }
3285
3286 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3287 u8 link_type, u8 addr_type, u8 status)
3288 {
3289 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3290 status,
3291 MGMT_OP_USER_PASSKEY_NEG_REPLY);
3292 }
3293
3294 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3295 u8 addr_type, u8 status)
3296 {
3297 struct mgmt_ev_auth_failed ev;
3298
3299 bacpy(&ev.addr.bdaddr, bdaddr);
3300 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3301 ev.status = mgmt_status(status);
3302
3303 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3304 }
3305
3306 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3307 {
3308 struct cmd_lookup match = { NULL, hdev };
3309 bool changed = false;
3310 int err = 0;
3311
3312 if (status) {
3313 u8 mgmt_err = mgmt_status(status);
3314 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3315 cmd_status_rsp, &mgmt_err);
3316 return 0;
3317 }
3318
3319 if (test_bit(HCI_AUTH, &hdev->flags)) {
3320 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3321 changed = true;
3322 } else {
3323 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3324 changed = true;
3325 }
3326
3327 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3328 &match);
3329
3330 if (changed)
3331 err = new_settings(hdev, match.sk);
3332
3333 if (match.sk)
3334 sock_put(match.sk);
3335
3336 return err;
3337 }
3338
3339 static int clear_eir(struct hci_dev *hdev)
3340 {
3341 struct hci_cp_write_eir cp;
3342
3343 if (!(hdev->features[6] & LMP_EXT_INQ))
3344 return 0;
3345
3346 memset(hdev->eir, 0, sizeof(hdev->eir));
3347
3348 memset(&cp, 0, sizeof(cp));
3349
3350 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3351 }
3352
3353 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3354 {
3355 struct cmd_lookup match = { NULL, hdev };
3356 bool changed = false;
3357 int err = 0;
3358
3359 if (status) {
3360 u8 mgmt_err = mgmt_status(status);
3361
3362 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3363 &hdev->dev_flags))
3364 err = new_settings(hdev, NULL);
3365
3366 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3367 &mgmt_err);
3368
3369 return err;
3370 }
3371
3372 if (enable) {
3373 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3374 changed = true;
3375 } else {
3376 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3377 changed = true;
3378 }
3379
3380 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3381
3382 if (changed)
3383 err = new_settings(hdev, match.sk);
3384
3385 if (match.sk)
3386 sock_put(match.sk);
3387
3388 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3389 update_eir(hdev);
3390 else
3391 clear_eir(hdev);
3392
3393 return err;
3394 }
3395
3396 static void class_rsp(struct pending_cmd *cmd, void *data)
3397 {
3398 struct cmd_lookup *match = data;
3399
3400 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3401 match->hdev->dev_class, 3);
3402
3403 list_del(&cmd->list);
3404
3405 if (match->sk == NULL) {
3406 match->sk = cmd->sk;
3407 sock_hold(match->sk);
3408 }
3409
3410 mgmt_pending_free(cmd);
3411 }
3412
3413 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3414 u8 status)
3415 {
3416 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3417 int err = 0;
3418
3419 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3420
3421 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3422 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3423 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3424
3425 if (!status)
3426 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3427 3, NULL);
3428
3429 if (match.sk)
3430 sock_put(match.sk);
3431
3432 return err;
3433 }
3434
3435 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3436 {
3437 struct pending_cmd *cmd;
3438 struct mgmt_cp_set_local_name ev;
3439 bool changed = false;
3440 int err = 0;
3441
3442 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3443 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3444 changed = true;
3445 }
3446
3447 memset(&ev, 0, sizeof(ev));
3448 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3449 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3450
3451 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3452 if (!cmd)
3453 goto send_event;
3454
3455 /* Always assume that either the short or the complete name has
3456 * changed if there was a pending mgmt command */
3457 changed = true;
3458
3459 if (status) {
3460 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3461 mgmt_status(status));
3462 goto failed;
3463 }
3464
3465 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3466 sizeof(ev));
3467 if (err < 0)
3468 goto failed;
3469
3470 send_event:
3471 if (changed)
3472 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3473 sizeof(ev), cmd ? cmd->sk : NULL);
3474
3475 update_eir(hdev);
3476
3477 failed:
3478 if (cmd)
3479 mgmt_pending_remove(cmd);
3480 return err;
3481 }
3482
3483 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3484 u8 *randomizer, u8 status)
3485 {
3486 struct pending_cmd *cmd;
3487 int err;
3488
3489 BT_DBG("%s status %u", hdev->name, status);
3490
3491 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3492 if (!cmd)
3493 return -ENOENT;
3494
3495 if (status) {
3496 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3497 mgmt_status(status));
3498 } else {
3499 struct mgmt_rp_read_local_oob_data rp;
3500
3501 memcpy(rp.hash, hash, sizeof(rp.hash));
3502 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3503
3504 err = cmd_complete(cmd->sk, hdev->id,
3505 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3506 sizeof(rp));
3507 }
3508
3509 mgmt_pending_remove(cmd);
3510
3511 return err;
3512 }
3513
3514 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3515 {
3516 struct cmd_lookup match = { NULL, hdev };
3517 bool changed = false;
3518 int err = 0;
3519
3520 if (status) {
3521 u8 mgmt_err = mgmt_status(status);
3522
3523 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3524 &hdev->dev_flags))
3525 err = new_settings(hdev, NULL);
3526
3527 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3528 &mgmt_err);
3529
3530 return err;
3531 }
3532
3533 if (enable) {
3534 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3535 changed = true;
3536 } else {
3537 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3538 changed = true;
3539 }
3540
3541 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3542
3543 if (changed)
3544 err = new_settings(hdev, match.sk);
3545
3546 if (match.sk)
3547 sock_put(match.sk);
3548
3549 return err;
3550 }
3551
3552 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3553 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3554 ssp, u8 *eir, u16 eir_len)
3555 {
3556 char buf[512];
3557 struct mgmt_ev_device_found *ev = (void *) buf;
3558 size_t ev_size;
3559
3560 /* Leave 5 bytes for a potential CoD field */
3561 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3562 return -EINVAL;
3563
3564 memset(buf, 0, sizeof(buf));
3565
3566 bacpy(&ev->addr.bdaddr, bdaddr);
3567 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3568 ev->rssi = rssi;
3569 if (cfm_name)
3570 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3571 if (!ssp)
3572 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3573
3574 if (eir_len > 0)
3575 memcpy(ev->eir, eir, eir_len);
3576
3577 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3578 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3579 dev_class, 3);
3580
3581 ev->eir_len = cpu_to_le16(eir_len);
3582 ev_size = sizeof(*ev) + eir_len;
3583
3584 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3585 }
3586
3587 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3588 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3589 {
3590 struct mgmt_ev_device_found *ev;
3591 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3592 u16 eir_len;
3593
3594 ev = (struct mgmt_ev_device_found *) buf;
3595
3596 memset(buf, 0, sizeof(buf));
3597
3598 bacpy(&ev->addr.bdaddr, bdaddr);
3599 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3600 ev->rssi = rssi;
3601
3602 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3603 name_len);
3604
3605 ev->eir_len = cpu_to_le16(eir_len);
3606
3607 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3608 sizeof(*ev) + eir_len, NULL);
3609 }
3610
3611 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3612 {
3613 struct pending_cmd *cmd;
3614 u8 type;
3615 int err;
3616
3617 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3618
3619 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3620 if (!cmd)
3621 return -ENOENT;
3622
3623 type = hdev->discovery.type;
3624
3625 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3626 &type, sizeof(type));
3627 mgmt_pending_remove(cmd);
3628
3629 return err;
3630 }
3631
3632 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3633 {
3634 struct pending_cmd *cmd;
3635 int err;
3636
3637 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3638 if (!cmd)
3639 return -ENOENT;
3640
3641 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3642 &hdev->discovery.type, sizeof(hdev->discovery.type));
3643 mgmt_pending_remove(cmd);
3644
3645 return err;
3646 }
3647
3648 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3649 {
3650 struct mgmt_ev_discovering ev;
3651 struct pending_cmd *cmd;
3652
3653 BT_DBG("%s discovering %u", hdev->name, discovering);
3654
3655 if (discovering)
3656 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3657 else
3658 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3659
3660 if (cmd != NULL) {
3661 u8 type = hdev->discovery.type;
3662
3663 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3664 sizeof(type));
3665 mgmt_pending_remove(cmd);
3666 }
3667
3668 memset(&ev, 0, sizeof(ev));
3669 ev.type = hdev->discovery.type;
3670 ev.discovering = discovering;
3671
3672 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3673 }
3674
3675 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3676 {
3677 struct pending_cmd *cmd;
3678 struct mgmt_ev_device_blocked ev;
3679
3680 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3681
3682 bacpy(&ev.addr.bdaddr, bdaddr);
3683 ev.addr.type = type;
3684
3685 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3686 cmd ? cmd->sk : NULL);
3687 }
3688
3689 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3690 {
3691 struct pending_cmd *cmd;
3692 struct mgmt_ev_device_unblocked ev;
3693
3694 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3695
3696 bacpy(&ev.addr.bdaddr, bdaddr);
3697 ev.addr.type = type;
3698
3699 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3700 cmd ? cmd->sk : NULL);
3701 }
3702
3703 module_param(enable_hs, bool, 0644);
3704 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
Linux kernel - Deliverables
This page took 0.170659 seconds and 5 git commands to generate.