1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/mgmt.h> 33 #include <net/bluetooth/smp.h> 34 35 bool enable_hs; 36 37 #define MGMT_VERSION 1 38 #define MGMT_REVISION 1 39 40 static const u16 mgmt_commands[] = { 41 MGMT_OP_READ_INDEX_LIST, 42 MGMT_OP_READ_INFO, 43 MGMT_OP_SET_POWERED, 44 MGMT_OP_SET_DISCOVERABLE, 45 MGMT_OP_SET_CONNECTABLE, 46 MGMT_OP_SET_FAST_CONNECTABLE, 47 MGMT_OP_SET_PAIRABLE, 48 MGMT_OP_SET_LINK_SECURITY, 49 MGMT_OP_SET_SSP, 50 MGMT_OP_SET_HS, 51 MGMT_OP_SET_LE, 52 MGMT_OP_SET_DEV_CLASS, 53 MGMT_OP_SET_LOCAL_NAME, 54 MGMT_OP_ADD_UUID, 55 MGMT_OP_REMOVE_UUID, 56 MGMT_OP_LOAD_LINK_KEYS, 57 MGMT_OP_LOAD_LONG_TERM_KEYS, 58 MGMT_OP_DISCONNECT, 59 MGMT_OP_GET_CONNECTIONS, 60 MGMT_OP_PIN_CODE_REPLY, 61 MGMT_OP_PIN_CODE_NEG_REPLY, 62 MGMT_OP_SET_IO_CAPABILITY, 63 MGMT_OP_PAIR_DEVICE, 64 MGMT_OP_CANCEL_PAIR_DEVICE, 65 MGMT_OP_UNPAIR_DEVICE, 66 MGMT_OP_USER_CONFIRM_REPLY, 67 MGMT_OP_USER_CONFIRM_NEG_REPLY, 68 MGMT_OP_USER_PASSKEY_REPLY, 69 MGMT_OP_USER_PASSKEY_NEG_REPLY, 70 MGMT_OP_READ_LOCAL_OOB_DATA, 71 MGMT_OP_ADD_REMOTE_OOB_DATA, 72 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 73 MGMT_OP_START_DISCOVERY, 74 MGMT_OP_STOP_DISCOVERY, 75 MGMT_OP_CONFIRM_NAME, 76 MGMT_OP_BLOCK_DEVICE, 77 MGMT_OP_UNBLOCK_DEVICE, 78 MGMT_OP_SET_DEVICE_ID, 79 }; 80 81 static const u16 mgmt_events[] = { 82 MGMT_EV_CONTROLLER_ERROR, 83 MGMT_EV_INDEX_ADDED, 84 MGMT_EV_INDEX_REMOVED, 85 MGMT_EV_NEW_SETTINGS, 86 MGMT_EV_CLASS_OF_DEV_CHANGED, 87 MGMT_EV_LOCAL_NAME_CHANGED, 88 MGMT_EV_NEW_LINK_KEY, 89 MGMT_EV_NEW_LONG_TERM_KEY, 90 MGMT_EV_DEVICE_CONNECTED, 91 MGMT_EV_DEVICE_DISCONNECTED, 92 MGMT_EV_CONNECT_FAILED, 93 MGMT_EV_PIN_CODE_REQUEST, 94 MGMT_EV_USER_CONFIRM_REQUEST, 95 MGMT_EV_USER_PASSKEY_REQUEST, 96 MGMT_EV_AUTH_FAILED, 97 MGMT_EV_DEVICE_FOUND, 98 MGMT_EV_DISCOVERING, 99 MGMT_EV_DEVICE_BLOCKED, 100 MGMT_EV_DEVICE_UNBLOCKED, 101 MGMT_EV_DEVICE_UNPAIRED, 102 }; 103 104 /* 105 * These LE scan and inquiry parameters were chosen according to LE General 106 * Discovery Procedure specification. 107 */ 108 #define LE_SCAN_TYPE 0x01 109 #define LE_SCAN_WIN 0x12 110 #define LE_SCAN_INT 0x12 111 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */ 112 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */ 113 114 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */ 115 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */ 116 117 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 118 119 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \ 120 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) 121 122 struct pending_cmd { 123 struct list_head list; 124 u16 opcode; 125 int index; 126 void *param; 127 struct sock *sk; 128 void *user_data; 129 }; 130 131 /* HCI to MGMT error code conversion table */ 132 static u8 mgmt_status_table[] = { 133 MGMT_STATUS_SUCCESS, 134 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 135 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 136 MGMT_STATUS_FAILED, /* Hardware Failure */ 137 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 138 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 139 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */ 140 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 141 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 142 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 143 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 144 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 145 MGMT_STATUS_BUSY, /* Command Disallowed */ 146 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 147 MGMT_STATUS_REJECTED, /* Rejected Security */ 148 MGMT_STATUS_REJECTED, /* Rejected Personal */ 149 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 150 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 151 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 152 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 153 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 154 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 155 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 156 MGMT_STATUS_BUSY, /* Repeated Attempts */ 157 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 158 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 159 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 160 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 161 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 162 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 163 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 164 MGMT_STATUS_FAILED, /* Unspecified Error */ 165 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 166 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 167 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 168 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 169 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 170 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 171 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 172 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 173 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 174 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 175 MGMT_STATUS_FAILED, /* Transaction Collision */ 176 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 177 MGMT_STATUS_REJECTED, /* QoS Rejected */ 178 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 179 MGMT_STATUS_REJECTED, /* Insufficient Security */ 180 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 181 MGMT_STATUS_BUSY, /* Role Switch Pending */ 182 MGMT_STATUS_FAILED, /* Slot Violation */ 183 MGMT_STATUS_FAILED, /* Role Switch Failed */ 184 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 185 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 186 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 187 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 188 MGMT_STATUS_BUSY, /* Controller Busy */ 189 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 190 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 191 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 192 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 193 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 194 }; 195 196 static u8 mgmt_status(u8 hci_status) 197 { 198 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 199 return mgmt_status_table[hci_status]; 200 201 return MGMT_STATUS_FAILED; 202 } 203 204 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status) 205 { 206 struct sk_buff *skb; 207 struct mgmt_hdr *hdr; 208 struct mgmt_ev_cmd_status *ev; 209 int err; 210 211 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status); 212 213 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL); 214 if (!skb) 215 return -ENOMEM; 216 217 hdr = (void *) skb_put(skb, sizeof(*hdr)); 218 219 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS); 220 hdr->index = cpu_to_le16(index); 221 hdr->len = cpu_to_le16(sizeof(*ev)); 222 223 ev = (void *) skb_put(skb, sizeof(*ev)); 224 ev->status = status; 225 ev->opcode = cpu_to_le16(cmd); 226 227 err = sock_queue_rcv_skb(sk, skb); 228 if (err < 0) 229 kfree_skb(skb); 230 231 return err; 232 } 233 234 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status, 235 void *rp, size_t rp_len) 236 { 237 struct sk_buff *skb; 238 struct mgmt_hdr *hdr; 239 struct mgmt_ev_cmd_complete *ev; 240 int err; 241 242 BT_DBG("sock %p", sk); 243 244 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL); 245 if (!skb) 246 return -ENOMEM; 247 248 hdr = (void *) skb_put(skb, sizeof(*hdr)); 249 250 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE); 251 hdr->index = cpu_to_le16(index); 252 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len); 253 254 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len); 255 ev->opcode = cpu_to_le16(cmd); 256 ev->status = status; 257 258 if (rp) 259 memcpy(ev->data, rp, rp_len); 260 261 err = sock_queue_rcv_skb(sk, skb); 262 if (err < 0) 263 kfree_skb(skb); 264 265 return err; 266 } 267 268 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 269 u16 data_len) 270 { 271 struct mgmt_rp_read_version rp; 272 273 BT_DBG("sock %p", sk); 274 275 rp.version = MGMT_VERSION; 276 rp.revision = __constant_cpu_to_le16(MGMT_REVISION); 277 278 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp, 279 sizeof(rp)); 280 } 281 282 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 283 u16 data_len) 284 { 285 struct mgmt_rp_read_commands *rp; 286 const u16 num_commands = ARRAY_SIZE(mgmt_commands); 287 const u16 num_events = ARRAY_SIZE(mgmt_events); 288 __le16 *opcode; 289 size_t rp_size; 290 int i, err; 291 292 BT_DBG("sock %p", sk); 293 294 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 295 296 rp = kmalloc(rp_size, GFP_KERNEL); 297 if (!rp) 298 return -ENOMEM; 299 300 rp->num_commands = __constant_cpu_to_le16(num_commands); 301 rp->num_events = __constant_cpu_to_le16(num_events); 302 303 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++) 304 put_unaligned_le16(mgmt_commands[i], opcode); 305 306 for (i = 0; i < num_events; i++, opcode++) 307 put_unaligned_le16(mgmt_events[i], opcode); 308 309 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp, 310 rp_size); 311 kfree(rp); 312 313 return err; 314 } 315 316 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 317 u16 data_len) 318 { 319 struct mgmt_rp_read_index_list *rp; 320 struct list_head *p; 321 struct hci_dev *d; 322 size_t rp_len; 323 u16 count; 324 int i, err; 325 326 BT_DBG("sock %p", sk); 327 328 read_lock(&hci_dev_list_lock); 329 330 count = 0; 331 list_for_each(p, &hci_dev_list) { 332 count++; 333 } 334 335 rp_len = sizeof(*rp) + (2 * count); 336 rp = kmalloc(rp_len, GFP_ATOMIC); 337 if (!rp) { 338 read_unlock(&hci_dev_list_lock); 339 return -ENOMEM; 340 } 341 342 rp->num_controllers = cpu_to_le16(count); 343 344 i = 0; 345 list_for_each_entry(d, &hci_dev_list, list) { 346 if (test_bit(HCI_SETUP, &d->dev_flags)) 347 continue; 348 349 rp->index[i++] = cpu_to_le16(d->id); 350 BT_DBG("Added hci%u", d->id); 351 } 352 353 read_unlock(&hci_dev_list_lock); 354 355 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp, 356 rp_len); 357 358 kfree(rp); 359 360 return err; 361 } 362 363 static u32 get_supported_settings(struct hci_dev *hdev) 364 { 365 u32 settings = 0; 366 367 settings |= MGMT_SETTING_POWERED; 368 settings |= MGMT_SETTING_CONNECTABLE; 369 settings |= MGMT_SETTING_FAST_CONNECTABLE; 370 settings |= MGMT_SETTING_DISCOVERABLE; 371 settings |= MGMT_SETTING_PAIRABLE; 372 373 if (hdev->features[6] & LMP_SIMPLE_PAIR) 374 settings |= MGMT_SETTING_SSP; 375 376 if (!(hdev->features[4] & LMP_NO_BREDR)) { 377 settings |= MGMT_SETTING_BREDR; 378 settings |= MGMT_SETTING_LINK_SECURITY; 379 } 380 381 if (enable_hs) 382 settings |= MGMT_SETTING_HS; 383 384 if (hdev->features[4] & LMP_LE) 385 settings |= MGMT_SETTING_LE; 386 387 return settings; 388 } 389 390 static u32 get_current_settings(struct hci_dev *hdev) 391 { 392 u32 settings = 0; 393 394 if (hdev_is_powered(hdev)) 395 settings |= MGMT_SETTING_POWERED; 396 397 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 398 settings |= MGMT_SETTING_CONNECTABLE; 399 400 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 401 settings |= MGMT_SETTING_DISCOVERABLE; 402 403 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags)) 404 settings |= MGMT_SETTING_PAIRABLE; 405 406 if (!(hdev->features[4] & LMP_NO_BREDR)) 407 settings |= MGMT_SETTING_BREDR; 408 409 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 410 settings |= MGMT_SETTING_LE; 411 412 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 413 settings |= MGMT_SETTING_LINK_SECURITY; 414 415 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 416 settings |= MGMT_SETTING_SSP; 417 418 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags)) 419 settings |= MGMT_SETTING_HS; 420 421 return settings; 422 } 423 424 #define PNP_INFO_SVCLASS_ID 0x1200 425 426 static u8 bluetooth_base_uuid[] = { 427 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80, 428 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 429 }; 430 431 static u16 get_uuid16(u8 *uuid128) 432 { 433 u32 val; 434 int i; 435 436 for (i = 0; i < 12; i++) { 437 if (bluetooth_base_uuid[i] != uuid128[i]) 438 return 0; 439 } 440 441 val = get_unaligned_le32(&uuid128[12]); 442 if (val > 0xffff) 443 return 0; 444 445 return (u16) val; 446 } 447 448 static void create_eir(struct hci_dev *hdev, u8 *data) 449 { 450 u8 *ptr = data; 451 u16 eir_len = 0; 452 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)]; 453 int i, truncated = 0; 454 struct bt_uuid *uuid; 455 size_t name_len; 456 457 name_len = strlen(hdev->dev_name); 458 459 if (name_len > 0) { 460 /* EIR Data type */ 461 if (name_len > 48) { 462 name_len = 48; 463 ptr[1] = EIR_NAME_SHORT; 464 } else 465 ptr[1] = EIR_NAME_COMPLETE; 466 467 /* EIR Data length */ 468 ptr[0] = name_len + 1; 469 470 memcpy(ptr + 2, hdev->dev_name, name_len); 471 472 eir_len += (name_len + 2); 473 ptr += (name_len + 2); 474 } 475 476 if (hdev->inq_tx_power) { 477 ptr[0] = 2; 478 ptr[1] = EIR_TX_POWER; 479 ptr[2] = (u8) hdev->inq_tx_power; 480 481 eir_len += 3; 482 ptr += 3; 483 } 484 485 if (hdev->devid_source > 0) { 486 ptr[0] = 9; 487 ptr[1] = EIR_DEVICE_ID; 488 489 put_unaligned_le16(hdev->devid_source, ptr + 2); 490 put_unaligned_le16(hdev->devid_vendor, ptr + 4); 491 put_unaligned_le16(hdev->devid_product, ptr + 6); 492 put_unaligned_le16(hdev->devid_version, ptr + 8); 493 494 eir_len += 10; 495 ptr += 10; 496 } 497 498 memset(uuid16_list, 0, sizeof(uuid16_list)); 499 500 /* Group all UUID16 types */ 501 list_for_each_entry(uuid, &hdev->uuids, list) { 502 u16 uuid16; 503 504 uuid16 = get_uuid16(uuid->uuid); 505 if (uuid16 == 0) 506 return; 507 508 if (uuid16 < 0x1100) 509 continue; 510 511 if (uuid16 == PNP_INFO_SVCLASS_ID) 512 continue; 513 514 /* Stop if not enough space to put next UUID */ 515 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) { 516 truncated = 1; 517 break; 518 } 519 520 /* Check for duplicates */ 521 for (i = 0; uuid16_list[i] != 0; i++) 522 if (uuid16_list[i] == uuid16) 523 break; 524 525 if (uuid16_list[i] == 0) { 526 uuid16_list[i] = uuid16; 527 eir_len += sizeof(u16); 528 } 529 } 530 531 if (uuid16_list[0] != 0) { 532 u8 *length = ptr; 533 534 /* EIR Data type */ 535 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL; 536 537 ptr += 2; 538 eir_len += 2; 539 540 for (i = 0; uuid16_list[i] != 0; i++) { 541 *ptr++ = (uuid16_list[i] & 0x00ff); 542 *ptr++ = (uuid16_list[i] & 0xff00) >> 8; 543 } 544 545 /* EIR Data length */ 546 *length = (i * sizeof(u16)) + 1; 547 } 548 } 549 550 static int update_eir(struct hci_dev *hdev) 551 { 552 struct hci_cp_write_eir cp; 553 554 if (!hdev_is_powered(hdev)) 555 return 0; 556 557 if (!(hdev->features[6] & LMP_EXT_INQ)) 558 return 0; 559 560 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 561 return 0; 562 563 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 564 return 0; 565 566 memset(&cp, 0, sizeof(cp)); 567 568 create_eir(hdev, cp.data); 569 570 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 571 return 0; 572 573 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 574 575 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 576 } 577 578 static u8 get_service_classes(struct hci_dev *hdev) 579 { 580 struct bt_uuid *uuid; 581 u8 val = 0; 582 583 list_for_each_entry(uuid, &hdev->uuids, list) 584 val |= uuid->svc_hint; 585 586 return val; 587 } 588 589 static int update_class(struct hci_dev *hdev) 590 { 591 u8 cod[3]; 592 int err; 593 594 BT_DBG("%s", hdev->name); 595 596 if (!hdev_is_powered(hdev)) 597 return 0; 598 599 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 600 return 0; 601 602 cod[0] = hdev->minor_class; 603 cod[1] = hdev->major_class; 604 cod[2] = get_service_classes(hdev); 605 606 if (memcmp(cod, hdev->dev_class, 3) == 0) 607 return 0; 608 609 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod); 610 if (err == 0) 611 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags); 612 613 return err; 614 } 615 616 static void service_cache_off(struct work_struct *work) 617 { 618 struct hci_dev *hdev = container_of(work, struct hci_dev, 619 service_cache.work); 620 621 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 622 return; 623 624 hci_dev_lock(hdev); 625 626 update_eir(hdev); 627 update_class(hdev); 628 629 hci_dev_unlock(hdev); 630 } 631 632 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 633 { 634 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) 635 return; 636 637 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 638 639 /* Non-mgmt controlled devices get this bit set 640 * implicitly so that pairing works for them, however 641 * for mgmt we require user-space to explicitly enable 642 * it 643 */ 644 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 645 } 646 647 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 648 void *data, u16 data_len) 649 { 650 struct mgmt_rp_read_info rp; 651 652 BT_DBG("sock %p %s", sk, hdev->name); 653 654 hci_dev_lock(hdev); 655 656 memset(&rp, 0, sizeof(rp)); 657 658 bacpy(&rp.bdaddr, &hdev->bdaddr); 659 660 rp.version = hdev->hci_ver; 661 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 662 663 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 664 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 665 666 memcpy(rp.dev_class, hdev->dev_class, 3); 667 668 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 669 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 670 671 hci_dev_unlock(hdev); 672 673 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 674 sizeof(rp)); 675 } 676 677 static void mgmt_pending_free(struct pending_cmd *cmd) 678 { 679 sock_put(cmd->sk); 680 kfree(cmd->param); 681 kfree(cmd); 682 } 683 684 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode, 685 struct hci_dev *hdev, void *data, 686 u16 len) 687 { 688 struct pending_cmd *cmd; 689 690 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); 691 if (!cmd) 692 return NULL; 693 694 cmd->opcode = opcode; 695 cmd->index = hdev->id; 696 697 cmd->param = kmalloc(len, GFP_KERNEL); 698 if (!cmd->param) { 699 kfree(cmd); 700 return NULL; 701 } 702 703 if (data) 704 memcpy(cmd->param, data, len); 705 706 cmd->sk = sk; 707 sock_hold(sk); 708 709 list_add(&cmd->list, &hdev->mgmt_pending); 710 711 return cmd; 712 } 713 714 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, 715 void (*cb)(struct pending_cmd *cmd, 716 void *data), 717 void *data) 718 { 719 struct list_head *p, *n; 720 721 list_for_each_safe(p, n, &hdev->mgmt_pending) { 722 struct pending_cmd *cmd; 723 724 cmd = list_entry(p, struct pending_cmd, list); 725 726 if (opcode > 0 && cmd->opcode != opcode) 727 continue; 728 729 cb(cmd, data); 730 } 731 } 732 733 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev) 734 { 735 struct pending_cmd *cmd; 736 737 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 738 if (cmd->opcode == opcode) 739 return cmd; 740 } 741 742 return NULL; 743 } 744 745 static void mgmt_pending_remove(struct pending_cmd *cmd) 746 { 747 list_del(&cmd->list); 748 mgmt_pending_free(cmd); 749 } 750 751 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 752 { 753 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 754 755 return cmd_complete(sk, hdev->id, opcode, 0, &settings, 756 sizeof(settings)); 757 } 758 759 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 760 u16 len) 761 { 762 struct mgmt_mode *cp = data; 763 struct pending_cmd *cmd; 764 int err; 765 766 BT_DBG("request for %s", hdev->name); 767 768 hci_dev_lock(hdev); 769 770 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) { 771 cancel_delayed_work(&hdev->power_off); 772 773 if (cp->val) { 774 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 775 mgmt_powered(hdev, 1); 776 goto failed; 777 } 778 } 779 780 if (!!cp->val == hdev_is_powered(hdev)) { 781 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 782 goto failed; 783 } 784 785 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) { 786 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 787 MGMT_STATUS_BUSY); 788 goto failed; 789 } 790 791 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 792 if (!cmd) { 793 err = -ENOMEM; 794 goto failed; 795 } 796 797 if (cp->val) 798 schedule_work(&hdev->power_on); 799 else 800 schedule_work(&hdev->power_off.work); 801 802 err = 0; 803 804 failed: 805 hci_dev_unlock(hdev); 806 return err; 807 } 808 809 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len, 810 struct sock *skip_sk) 811 { 812 struct sk_buff *skb; 813 struct mgmt_hdr *hdr; 814 815 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL); 816 if (!skb) 817 return -ENOMEM; 818 819 hdr = (void *) skb_put(skb, sizeof(*hdr)); 820 hdr->opcode = cpu_to_le16(event); 821 if (hdev) 822 hdr->index = cpu_to_le16(hdev->id); 823 else 824 hdr->index = cpu_to_le16(MGMT_INDEX_NONE); 825 hdr->len = cpu_to_le16(data_len); 826 827 if (data) 828 memcpy(skb_put(skb, data_len), data, data_len); 829 830 /* Time stamp */ 831 __net_timestamp(skb); 832 833 hci_send_to_control(skb, skip_sk); 834 kfree_skb(skb); 835 836 return 0; 837 } 838 839 static int new_settings(struct hci_dev *hdev, struct sock *skip) 840 { 841 __le32 ev; 842 843 ev = cpu_to_le32(get_current_settings(hdev)); 844 845 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip); 846 } 847 848 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 849 u16 len) 850 { 851 struct mgmt_cp_set_discoverable *cp = data; 852 struct pending_cmd *cmd; 853 u16 timeout; 854 u8 scan; 855 int err; 856 857 BT_DBG("request for %s", hdev->name); 858 859 timeout = __le16_to_cpu(cp->timeout); 860 if (!cp->val && timeout > 0) 861 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 862 MGMT_STATUS_INVALID_PARAMS); 863 864 hci_dev_lock(hdev); 865 866 if (!hdev_is_powered(hdev) && timeout > 0) { 867 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 868 MGMT_STATUS_NOT_POWERED); 869 goto failed; 870 } 871 872 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 873 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 874 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 875 MGMT_STATUS_BUSY); 876 goto failed; 877 } 878 879 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) { 880 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 881 MGMT_STATUS_REJECTED); 882 goto failed; 883 } 884 885 if (!hdev_is_powered(hdev)) { 886 bool changed = false; 887 888 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 889 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 890 changed = true; 891 } 892 893 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 894 if (err < 0) 895 goto failed; 896 897 if (changed) 898 err = new_settings(hdev, sk); 899 900 goto failed; 901 } 902 903 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 904 if (hdev->discov_timeout > 0) { 905 cancel_delayed_work(&hdev->discov_off); 906 hdev->discov_timeout = 0; 907 } 908 909 if (cp->val && timeout > 0) { 910 hdev->discov_timeout = timeout; 911 queue_delayed_work(hdev->workqueue, &hdev->discov_off, 912 msecs_to_jiffies(hdev->discov_timeout * 1000)); 913 } 914 915 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 916 goto failed; 917 } 918 919 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 920 if (!cmd) { 921 err = -ENOMEM; 922 goto failed; 923 } 924 925 scan = SCAN_PAGE; 926 927 if (cp->val) 928 scan |= SCAN_INQUIRY; 929 else 930 cancel_delayed_work(&hdev->discov_off); 931 932 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 933 if (err < 0) 934 mgmt_pending_remove(cmd); 935 936 if (cp->val) 937 hdev->discov_timeout = timeout; 938 939 failed: 940 hci_dev_unlock(hdev); 941 return err; 942 } 943 944 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 945 u16 len) 946 { 947 struct mgmt_mode *cp = data; 948 struct pending_cmd *cmd; 949 u8 scan; 950 int err; 951 952 BT_DBG("request for %s", hdev->name); 953 954 hci_dev_lock(hdev); 955 956 if (!hdev_is_powered(hdev)) { 957 bool changed = false; 958 959 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 960 changed = true; 961 962 if (cp->val) { 963 set_bit(HCI_CONNECTABLE, &hdev->dev_flags); 964 } else { 965 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags); 966 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 967 } 968 969 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 970 if (err < 0) 971 goto failed; 972 973 if (changed) 974 err = new_settings(hdev, sk); 975 976 goto failed; 977 } 978 979 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 980 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 981 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 982 MGMT_STATUS_BUSY); 983 goto failed; 984 } 985 986 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) { 987 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 988 goto failed; 989 } 990 991 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 992 if (!cmd) { 993 err = -ENOMEM; 994 goto failed; 995 } 996 997 if (cp->val) { 998 scan = SCAN_PAGE; 999 } else { 1000 scan = 0; 1001 1002 if (test_bit(HCI_ISCAN, &hdev->flags) && 1003 hdev->discov_timeout > 0) 1004 cancel_delayed_work(&hdev->discov_off); 1005 } 1006 1007 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1008 if (err < 0) 1009 mgmt_pending_remove(cmd); 1010 1011 failed: 1012 hci_dev_unlock(hdev); 1013 return err; 1014 } 1015 1016 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data, 1017 u16 len) 1018 { 1019 struct mgmt_mode *cp = data; 1020 int err; 1021 1022 BT_DBG("request for %s", hdev->name); 1023 1024 hci_dev_lock(hdev); 1025 1026 if (cp->val) 1027 set_bit(HCI_PAIRABLE, &hdev->dev_flags); 1028 else 1029 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 1030 1031 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev); 1032 if (err < 0) 1033 goto failed; 1034 1035 err = new_settings(hdev, sk); 1036 1037 failed: 1038 hci_dev_unlock(hdev); 1039 return err; 1040 } 1041 1042 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1043 u16 len) 1044 { 1045 struct mgmt_mode *cp = data; 1046 struct pending_cmd *cmd; 1047 u8 val; 1048 int err; 1049 1050 BT_DBG("request for %s", hdev->name); 1051 1052 hci_dev_lock(hdev); 1053 1054 if (!hdev_is_powered(hdev)) { 1055 bool changed = false; 1056 1057 if (!!cp->val != test_bit(HCI_LINK_SECURITY, 1058 &hdev->dev_flags)) { 1059 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 1060 changed = true; 1061 } 1062 1063 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1064 if (err < 0) 1065 goto failed; 1066 1067 if (changed) 1068 err = new_settings(hdev, sk); 1069 1070 goto failed; 1071 } 1072 1073 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1074 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1075 MGMT_STATUS_BUSY); 1076 goto failed; 1077 } 1078 1079 val = !!cp->val; 1080 1081 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1082 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1083 goto failed; 1084 } 1085 1086 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1087 if (!cmd) { 1088 err = -ENOMEM; 1089 goto failed; 1090 } 1091 1092 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1093 if (err < 0) { 1094 mgmt_pending_remove(cmd); 1095 goto failed; 1096 } 1097 1098 failed: 1099 hci_dev_unlock(hdev); 1100 return err; 1101 } 1102 1103 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1104 { 1105 struct mgmt_mode *cp = data; 1106 struct pending_cmd *cmd; 1107 u8 val; 1108 int err; 1109 1110 BT_DBG("request for %s", hdev->name); 1111 1112 hci_dev_lock(hdev); 1113 1114 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) { 1115 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1116 MGMT_STATUS_NOT_SUPPORTED); 1117 goto failed; 1118 } 1119 1120 val = !!cp->val; 1121 1122 if (!hdev_is_powered(hdev)) { 1123 bool changed = false; 1124 1125 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) { 1126 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 1127 changed = true; 1128 } 1129 1130 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1131 if (err < 0) 1132 goto failed; 1133 1134 if (changed) 1135 err = new_settings(hdev, sk); 1136 1137 goto failed; 1138 } 1139 1140 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) { 1141 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1142 MGMT_STATUS_BUSY); 1143 goto failed; 1144 } 1145 1146 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) { 1147 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1148 goto failed; 1149 } 1150 1151 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1152 if (!cmd) { 1153 err = -ENOMEM; 1154 goto failed; 1155 } 1156 1157 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val); 1158 if (err < 0) { 1159 mgmt_pending_remove(cmd); 1160 goto failed; 1161 } 1162 1163 failed: 1164 hci_dev_unlock(hdev); 1165 return err; 1166 } 1167 1168 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1169 { 1170 struct mgmt_mode *cp = data; 1171 1172 BT_DBG("request for %s", hdev->name); 1173 1174 if (!enable_hs) 1175 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1176 MGMT_STATUS_NOT_SUPPORTED); 1177 1178 if (cp->val) 1179 set_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1180 else 1181 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1182 1183 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1184 } 1185 1186 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1187 { 1188 struct mgmt_mode *cp = data; 1189 struct hci_cp_write_le_host_supported hci_cp; 1190 struct pending_cmd *cmd; 1191 int err; 1192 u8 val, enabled; 1193 1194 BT_DBG("request for %s", hdev->name); 1195 1196 hci_dev_lock(hdev); 1197 1198 if (!(hdev->features[4] & LMP_LE)) { 1199 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1200 MGMT_STATUS_NOT_SUPPORTED); 1201 goto unlock; 1202 } 1203 1204 val = !!cp->val; 1205 enabled = !!(hdev->host_features[0] & LMP_HOST_LE); 1206 1207 if (!hdev_is_powered(hdev) || val == enabled) { 1208 bool changed = false; 1209 1210 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { 1211 change_bit(HCI_LE_ENABLED, &hdev->dev_flags); 1212 changed = true; 1213 } 1214 1215 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1216 if (err < 0) 1217 goto unlock; 1218 1219 if (changed) 1220 err = new_settings(hdev, sk); 1221 1222 goto unlock; 1223 } 1224 1225 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) { 1226 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1227 MGMT_STATUS_BUSY); 1228 goto unlock; 1229 } 1230 1231 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1232 if (!cmd) { 1233 err = -ENOMEM; 1234 goto unlock; 1235 } 1236 1237 memset(&hci_cp, 0, sizeof(hci_cp)); 1238 1239 if (val) { 1240 hci_cp.le = val; 1241 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR); 1242 } 1243 1244 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 1245 &hci_cp); 1246 if (err < 0) 1247 mgmt_pending_remove(cmd); 1248 1249 unlock: 1250 hci_dev_unlock(hdev); 1251 return err; 1252 } 1253 1254 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1255 { 1256 struct mgmt_cp_add_uuid *cp = data; 1257 struct pending_cmd *cmd; 1258 struct bt_uuid *uuid; 1259 int err; 1260 1261 BT_DBG("request for %s", hdev->name); 1262 1263 hci_dev_lock(hdev); 1264 1265 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1266 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 1267 MGMT_STATUS_BUSY); 1268 goto failed; 1269 } 1270 1271 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 1272 if (!uuid) { 1273 err = -ENOMEM; 1274 goto failed; 1275 } 1276 1277 memcpy(uuid->uuid, cp->uuid, 16); 1278 uuid->svc_hint = cp->svc_hint; 1279 1280 list_add(&uuid->list, &hdev->uuids); 1281 1282 err = update_class(hdev); 1283 if (err < 0) 1284 goto failed; 1285 1286 err = update_eir(hdev); 1287 if (err < 0) 1288 goto failed; 1289 1290 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1291 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 1292 hdev->dev_class, 3); 1293 goto failed; 1294 } 1295 1296 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 1297 if (!cmd) 1298 err = -ENOMEM; 1299 1300 failed: 1301 hci_dev_unlock(hdev); 1302 return err; 1303 } 1304 1305 static bool enable_service_cache(struct hci_dev *hdev) 1306 { 1307 if (!hdev_is_powered(hdev)) 1308 return false; 1309 1310 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1311 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT); 1312 return true; 1313 } 1314 1315 return false; 1316 } 1317 1318 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 1319 u16 len) 1320 { 1321 struct mgmt_cp_remove_uuid *cp = data; 1322 struct pending_cmd *cmd; 1323 struct list_head *p, *n; 1324 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 1325 int err, found; 1326 1327 BT_DBG("request for %s", hdev->name); 1328 1329 hci_dev_lock(hdev); 1330 1331 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1332 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1333 MGMT_STATUS_BUSY); 1334 goto unlock; 1335 } 1336 1337 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 1338 err = hci_uuids_clear(hdev); 1339 1340 if (enable_service_cache(hdev)) { 1341 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1342 0, hdev->dev_class, 3); 1343 goto unlock; 1344 } 1345 1346 goto update_class; 1347 } 1348 1349 found = 0; 1350 1351 list_for_each_safe(p, n, &hdev->uuids) { 1352 struct bt_uuid *match = list_entry(p, struct bt_uuid, list); 1353 1354 if (memcmp(match->uuid, cp->uuid, 16) != 0) 1355 continue; 1356 1357 list_del(&match->list); 1358 found++; 1359 } 1360 1361 if (found == 0) { 1362 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1363 MGMT_STATUS_INVALID_PARAMS); 1364 goto unlock; 1365 } 1366 1367 update_class: 1368 err = update_class(hdev); 1369 if (err < 0) 1370 goto unlock; 1371 1372 err = update_eir(hdev); 1373 if (err < 0) 1374 goto unlock; 1375 1376 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1377 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 1378 hdev->dev_class, 3); 1379 goto unlock; 1380 } 1381 1382 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 1383 if (!cmd) 1384 err = -ENOMEM; 1385 1386 unlock: 1387 hci_dev_unlock(hdev); 1388 return err; 1389 } 1390 1391 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 1392 u16 len) 1393 { 1394 struct mgmt_cp_set_dev_class *cp = data; 1395 struct pending_cmd *cmd; 1396 int err; 1397 1398 BT_DBG("request for %s", hdev->name); 1399 1400 hci_dev_lock(hdev); 1401 1402 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1403 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 1404 MGMT_STATUS_BUSY); 1405 goto unlock; 1406 } 1407 1408 hdev->major_class = cp->major; 1409 hdev->minor_class = cp->minor; 1410 1411 if (!hdev_is_powered(hdev)) { 1412 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 1413 hdev->dev_class, 3); 1414 goto unlock; 1415 } 1416 1417 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1418 hci_dev_unlock(hdev); 1419 cancel_delayed_work_sync(&hdev->service_cache); 1420 hci_dev_lock(hdev); 1421 update_eir(hdev); 1422 } 1423 1424 err = update_class(hdev); 1425 if (err < 0) 1426 goto unlock; 1427 1428 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1429 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 1430 hdev->dev_class, 3); 1431 goto unlock; 1432 } 1433 1434 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 1435 if (!cmd) 1436 err = -ENOMEM; 1437 1438 unlock: 1439 hci_dev_unlock(hdev); 1440 return err; 1441 } 1442 1443 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 1444 u16 len) 1445 { 1446 struct mgmt_cp_load_link_keys *cp = data; 1447 u16 key_count, expected_len; 1448 int i; 1449 1450 key_count = __le16_to_cpu(cp->key_count); 1451 1452 expected_len = sizeof(*cp) + key_count * 1453 sizeof(struct mgmt_link_key_info); 1454 if (expected_len != len) { 1455 BT_ERR("load_link_keys: expected %u bytes, got %u bytes", 1456 len, expected_len); 1457 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 1458 MGMT_STATUS_INVALID_PARAMS); 1459 } 1460 1461 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys, 1462 key_count); 1463 1464 hci_dev_lock(hdev); 1465 1466 hci_link_keys_clear(hdev); 1467 1468 set_bit(HCI_LINK_KEYS, &hdev->dev_flags); 1469 1470 if (cp->debug_keys) 1471 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 1472 else 1473 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 1474 1475 for (i = 0; i < key_count; i++) { 1476 struct mgmt_link_key_info *key = &cp->keys[i]; 1477 1478 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val, 1479 key->type, key->pin_len); 1480 } 1481 1482 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 1483 1484 hci_dev_unlock(hdev); 1485 1486 return 0; 1487 } 1488 1489 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 1490 u8 addr_type, struct sock *skip_sk) 1491 { 1492 struct mgmt_ev_device_unpaired ev; 1493 1494 bacpy(&ev.addr.bdaddr, bdaddr); 1495 ev.addr.type = addr_type; 1496 1497 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 1498 skip_sk); 1499 } 1500 1501 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1502 u16 len) 1503 { 1504 struct mgmt_cp_unpair_device *cp = data; 1505 struct mgmt_rp_unpair_device rp; 1506 struct hci_cp_disconnect dc; 1507 struct pending_cmd *cmd; 1508 struct hci_conn *conn; 1509 int err; 1510 1511 hci_dev_lock(hdev); 1512 1513 memset(&rp, 0, sizeof(rp)); 1514 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 1515 rp.addr.type = cp->addr.type; 1516 1517 if (!hdev_is_powered(hdev)) { 1518 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1519 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 1520 goto unlock; 1521 } 1522 1523 if (cp->addr.type == BDADDR_BREDR) 1524 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 1525 else 1526 err = hci_remove_ltk(hdev, &cp->addr.bdaddr); 1527 1528 if (err < 0) { 1529 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1530 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp)); 1531 goto unlock; 1532 } 1533 1534 if (cp->disconnect) { 1535 if (cp->addr.type == BDADDR_BREDR) 1536 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 1537 &cp->addr.bdaddr); 1538 else 1539 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, 1540 &cp->addr.bdaddr); 1541 } else { 1542 conn = NULL; 1543 } 1544 1545 if (!conn) { 1546 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 1547 &rp, sizeof(rp)); 1548 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 1549 goto unlock; 1550 } 1551 1552 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 1553 sizeof(*cp)); 1554 if (!cmd) { 1555 err = -ENOMEM; 1556 goto unlock; 1557 } 1558 1559 dc.handle = cpu_to_le16(conn->handle); 1560 dc.reason = 0x13; /* Remote User Terminated Connection */ 1561 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 1562 if (err < 0) 1563 mgmt_pending_remove(cmd); 1564 1565 unlock: 1566 hci_dev_unlock(hdev); 1567 return err; 1568 } 1569 1570 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 1571 u16 len) 1572 { 1573 struct mgmt_cp_disconnect *cp = data; 1574 struct hci_cp_disconnect dc; 1575 struct pending_cmd *cmd; 1576 struct hci_conn *conn; 1577 int err; 1578 1579 BT_DBG(""); 1580 1581 hci_dev_lock(hdev); 1582 1583 if (!test_bit(HCI_UP, &hdev->flags)) { 1584 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1585 MGMT_STATUS_NOT_POWERED); 1586 goto failed; 1587 } 1588 1589 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) { 1590 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1591 MGMT_STATUS_BUSY); 1592 goto failed; 1593 } 1594 1595 if (cp->addr.type == BDADDR_BREDR) 1596 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 1597 &cp->addr.bdaddr); 1598 else 1599 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 1600 1601 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 1602 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1603 MGMT_STATUS_NOT_CONNECTED); 1604 goto failed; 1605 } 1606 1607 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 1608 if (!cmd) { 1609 err = -ENOMEM; 1610 goto failed; 1611 } 1612 1613 dc.handle = cpu_to_le16(conn->handle); 1614 dc.reason = HCI_ERROR_REMOTE_USER_TERM; 1615 1616 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 1617 if (err < 0) 1618 mgmt_pending_remove(cmd); 1619 1620 failed: 1621 hci_dev_unlock(hdev); 1622 return err; 1623 } 1624 1625 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 1626 { 1627 switch (link_type) { 1628 case LE_LINK: 1629 switch (addr_type) { 1630 case ADDR_LE_DEV_PUBLIC: 1631 return BDADDR_LE_PUBLIC; 1632 1633 default: 1634 /* Fallback to LE Random address type */ 1635 return BDADDR_LE_RANDOM; 1636 } 1637 1638 default: 1639 /* Fallback to BR/EDR type */ 1640 return BDADDR_BREDR; 1641 } 1642 } 1643 1644 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 1645 u16 data_len) 1646 { 1647 struct mgmt_rp_get_connections *rp; 1648 struct hci_conn *c; 1649 size_t rp_len; 1650 int err; 1651 u16 i; 1652 1653 BT_DBG(""); 1654 1655 hci_dev_lock(hdev); 1656 1657 if (!hdev_is_powered(hdev)) { 1658 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 1659 MGMT_STATUS_NOT_POWERED); 1660 goto unlock; 1661 } 1662 1663 i = 0; 1664 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1665 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 1666 i++; 1667 } 1668 1669 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 1670 rp = kmalloc(rp_len, GFP_KERNEL); 1671 if (!rp) { 1672 err = -ENOMEM; 1673 goto unlock; 1674 } 1675 1676 i = 0; 1677 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1678 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 1679 continue; 1680 bacpy(&rp->addr[i].bdaddr, &c->dst); 1681 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 1682 if (c->type == SCO_LINK || c->type == ESCO_LINK) 1683 continue; 1684 i++; 1685 } 1686 1687 rp->conn_count = cpu_to_le16(i); 1688 1689 /* Recalculate length in case of filtered SCO connections, etc */ 1690 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 1691 1692 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 1693 rp_len); 1694 1695 kfree(rp); 1696 1697 unlock: 1698 hci_dev_unlock(hdev); 1699 return err; 1700 } 1701 1702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 1703 struct mgmt_cp_pin_code_neg_reply *cp) 1704 { 1705 struct pending_cmd *cmd; 1706 int err; 1707 1708 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 1709 sizeof(*cp)); 1710 if (!cmd) 1711 return -ENOMEM; 1712 1713 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 1714 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 1715 if (err < 0) 1716 mgmt_pending_remove(cmd); 1717 1718 return err; 1719 } 1720 1721 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 1722 u16 len) 1723 { 1724 struct hci_conn *conn; 1725 struct mgmt_cp_pin_code_reply *cp = data; 1726 struct hci_cp_pin_code_reply reply; 1727 struct pending_cmd *cmd; 1728 int err; 1729 1730 BT_DBG(""); 1731 1732 hci_dev_lock(hdev); 1733 1734 if (!hdev_is_powered(hdev)) { 1735 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 1736 MGMT_STATUS_NOT_POWERED); 1737 goto failed; 1738 } 1739 1740 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 1741 if (!conn) { 1742 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 1743 MGMT_STATUS_NOT_CONNECTED); 1744 goto failed; 1745 } 1746 1747 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 1748 struct mgmt_cp_pin_code_neg_reply ncp; 1749 1750 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 1751 1752 BT_ERR("PIN code is not 16 bytes long"); 1753 1754 err = send_pin_code_neg_reply(sk, hdev, &ncp); 1755 if (err >= 0) 1756 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 1757 MGMT_STATUS_INVALID_PARAMS); 1758 1759 goto failed; 1760 } 1761 1762 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 1763 if (!cmd) { 1764 err = -ENOMEM; 1765 goto failed; 1766 } 1767 1768 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 1769 reply.pin_len = cp->pin_len; 1770 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 1771 1772 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 1773 if (err < 0) 1774 mgmt_pending_remove(cmd); 1775 1776 failed: 1777 hci_dev_unlock(hdev); 1778 return err; 1779 } 1780 1781 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 1782 u16 len) 1783 { 1784 struct mgmt_cp_set_io_capability *cp = data; 1785 1786 BT_DBG(""); 1787 1788 hci_dev_lock(hdev); 1789 1790 hdev->io_capability = cp->io_capability; 1791 1792 BT_DBG("%s IO capability set to 0x%02x", hdev->name, 1793 hdev->io_capability); 1794 1795 hci_dev_unlock(hdev); 1796 1797 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 1798 0); 1799 } 1800 1801 static struct pending_cmd *find_pairing(struct hci_conn *conn) 1802 { 1803 struct hci_dev *hdev = conn->hdev; 1804 struct pending_cmd *cmd; 1805 1806 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 1807 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 1808 continue; 1809 1810 if (cmd->user_data != conn) 1811 continue; 1812 1813 return cmd; 1814 } 1815 1816 return NULL; 1817 } 1818 1819 static void pairing_complete(struct pending_cmd *cmd, u8 status) 1820 { 1821 struct mgmt_rp_pair_device rp; 1822 struct hci_conn *conn = cmd->user_data; 1823 1824 bacpy(&rp.addr.bdaddr, &conn->dst); 1825 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 1826 1827 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status, 1828 &rp, sizeof(rp)); 1829 1830 /* So we don't get further callbacks for this connection */ 1831 conn->connect_cfm_cb = NULL; 1832 conn->security_cfm_cb = NULL; 1833 conn->disconn_cfm_cb = NULL; 1834 1835 hci_conn_put(conn); 1836 1837 mgmt_pending_remove(cmd); 1838 } 1839 1840 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 1841 { 1842 struct pending_cmd *cmd; 1843 1844 BT_DBG("status %u", status); 1845 1846 cmd = find_pairing(conn); 1847 if (!cmd) 1848 BT_DBG("Unable to find a pending command"); 1849 else 1850 pairing_complete(cmd, mgmt_status(status)); 1851 } 1852 1853 static void le_connect_complete_cb(struct hci_conn *conn, u8 status) 1854 { 1855 struct pending_cmd *cmd; 1856 1857 BT_DBG("status %u", status); 1858 1859 if (!status) 1860 return; 1861 1862 cmd = find_pairing(conn); 1863 if (!cmd) 1864 BT_DBG("Unable to find a pending command"); 1865 else 1866 pairing_complete(cmd, mgmt_status(status)); 1867 } 1868 1869 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1870 u16 len) 1871 { 1872 struct mgmt_cp_pair_device *cp = data; 1873 struct mgmt_rp_pair_device rp; 1874 struct pending_cmd *cmd; 1875 u8 sec_level, auth_type; 1876 struct hci_conn *conn; 1877 int err; 1878 1879 BT_DBG(""); 1880 1881 hci_dev_lock(hdev); 1882 1883 if (!hdev_is_powered(hdev)) { 1884 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 1885 MGMT_STATUS_NOT_POWERED); 1886 goto unlock; 1887 } 1888 1889 sec_level = BT_SECURITY_MEDIUM; 1890 if (cp->io_cap == 0x03) 1891 auth_type = HCI_AT_DEDICATED_BONDING; 1892 else 1893 auth_type = HCI_AT_DEDICATED_BONDING_MITM; 1894 1895 if (cp->addr.type == BDADDR_BREDR) 1896 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, 1897 cp->addr.type, sec_level, auth_type); 1898 else 1899 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, 1900 cp->addr.type, sec_level, auth_type); 1901 1902 memset(&rp, 0, sizeof(rp)); 1903 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 1904 rp.addr.type = cp->addr.type; 1905 1906 if (IS_ERR(conn)) { 1907 int status; 1908 1909 if (PTR_ERR(conn) == -EBUSY) 1910 status = MGMT_STATUS_BUSY; 1911 else 1912 status = MGMT_STATUS_CONNECT_FAILED; 1913 1914 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 1915 status, &rp, 1916 sizeof(rp)); 1917 goto unlock; 1918 } 1919 1920 if (conn->connect_cfm_cb) { 1921 hci_conn_put(conn); 1922 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 1923 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 1924 goto unlock; 1925 } 1926 1927 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 1928 if (!cmd) { 1929 err = -ENOMEM; 1930 hci_conn_put(conn); 1931 goto unlock; 1932 } 1933 1934 /* For LE, just connecting isn't a proof that the pairing finished */ 1935 if (cp->addr.type == BDADDR_BREDR) 1936 conn->connect_cfm_cb = pairing_complete_cb; 1937 else 1938 conn->connect_cfm_cb = le_connect_complete_cb; 1939 1940 conn->security_cfm_cb = pairing_complete_cb; 1941 conn->disconn_cfm_cb = pairing_complete_cb; 1942 conn->io_capability = cp->io_cap; 1943 cmd->user_data = conn; 1944 1945 if (conn->state == BT_CONNECTED && 1946 hci_conn_security(conn, sec_level, auth_type)) 1947 pairing_complete(cmd, 0); 1948 1949 err = 0; 1950 1951 unlock: 1952 hci_dev_unlock(hdev); 1953 return err; 1954 } 1955 1956 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1957 u16 len) 1958 { 1959 struct mgmt_addr_info *addr = data; 1960 struct pending_cmd *cmd; 1961 struct hci_conn *conn; 1962 int err; 1963 1964 BT_DBG(""); 1965 1966 hci_dev_lock(hdev); 1967 1968 if (!hdev_is_powered(hdev)) { 1969 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 1970 MGMT_STATUS_NOT_POWERED); 1971 goto unlock; 1972 } 1973 1974 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev); 1975 if (!cmd) { 1976 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 1977 MGMT_STATUS_INVALID_PARAMS); 1978 goto unlock; 1979 } 1980 1981 conn = cmd->user_data; 1982 1983 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 1984 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 1985 MGMT_STATUS_INVALID_PARAMS); 1986 goto unlock; 1987 } 1988 1989 pairing_complete(cmd, MGMT_STATUS_CANCELLED); 1990 1991 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 1992 addr, sizeof(*addr)); 1993 unlock: 1994 hci_dev_unlock(hdev); 1995 return err; 1996 } 1997 1998 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 1999 bdaddr_t *bdaddr, u8 type, u16 mgmt_op, 2000 u16 hci_op, __le32 passkey) 2001 { 2002 struct pending_cmd *cmd; 2003 struct hci_conn *conn; 2004 int err; 2005 2006 hci_dev_lock(hdev); 2007 2008 if (!hdev_is_powered(hdev)) { 2009 err = cmd_status(sk, hdev->id, mgmt_op, 2010 MGMT_STATUS_NOT_POWERED); 2011 goto done; 2012 } 2013 2014 if (type == BDADDR_BREDR) 2015 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr); 2016 else 2017 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr); 2018 2019 if (!conn) { 2020 err = cmd_status(sk, hdev->id, mgmt_op, 2021 MGMT_STATUS_NOT_CONNECTED); 2022 goto done; 2023 } 2024 2025 if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) { 2026 /* Continue with pairing via SMP */ 2027 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 2028 2029 if (!err) 2030 err = cmd_status(sk, hdev->id, mgmt_op, 2031 MGMT_STATUS_SUCCESS); 2032 else 2033 err = cmd_status(sk, hdev->id, mgmt_op, 2034 MGMT_STATUS_FAILED); 2035 2036 goto done; 2037 } 2038 2039 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr)); 2040 if (!cmd) { 2041 err = -ENOMEM; 2042 goto done; 2043 } 2044 2045 /* Continue with pairing via HCI */ 2046 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 2047 struct hci_cp_user_passkey_reply cp; 2048 2049 bacpy(&cp.bdaddr, bdaddr); 2050 cp.passkey = passkey; 2051 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 2052 } else 2053 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr); 2054 2055 if (err < 0) 2056 mgmt_pending_remove(cmd); 2057 2058 done: 2059 hci_dev_unlock(hdev); 2060 return err; 2061 } 2062 2063 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2064 void *data, u16 len) 2065 { 2066 struct mgmt_cp_pin_code_neg_reply *cp = data; 2067 2068 BT_DBG(""); 2069 2070 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2071 MGMT_OP_PIN_CODE_NEG_REPLY, 2072 HCI_OP_PIN_CODE_NEG_REPLY, 0); 2073 } 2074 2075 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2076 u16 len) 2077 { 2078 struct mgmt_cp_user_confirm_reply *cp = data; 2079 2080 BT_DBG(""); 2081 2082 if (len != sizeof(*cp)) 2083 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 2084 MGMT_STATUS_INVALID_PARAMS); 2085 2086 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2087 MGMT_OP_USER_CONFIRM_REPLY, 2088 HCI_OP_USER_CONFIRM_REPLY, 0); 2089 } 2090 2091 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 2092 void *data, u16 len) 2093 { 2094 struct mgmt_cp_user_confirm_neg_reply *cp = data; 2095 2096 BT_DBG(""); 2097 2098 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2099 MGMT_OP_USER_CONFIRM_NEG_REPLY, 2100 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 2101 } 2102 2103 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2104 u16 len) 2105 { 2106 struct mgmt_cp_user_passkey_reply *cp = data; 2107 2108 BT_DBG(""); 2109 2110 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2111 MGMT_OP_USER_PASSKEY_REPLY, 2112 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 2113 } 2114 2115 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 2116 void *data, u16 len) 2117 { 2118 struct mgmt_cp_user_passkey_neg_reply *cp = data; 2119 2120 BT_DBG(""); 2121 2122 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2123 MGMT_OP_USER_PASSKEY_NEG_REPLY, 2124 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 2125 } 2126 2127 static int update_name(struct hci_dev *hdev, const char *name) 2128 { 2129 struct hci_cp_write_local_name cp; 2130 2131 memcpy(cp.name, name, sizeof(cp.name)); 2132 2133 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp); 2134 } 2135 2136 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 2137 u16 len) 2138 { 2139 struct mgmt_cp_set_local_name *cp = data; 2140 struct pending_cmd *cmd; 2141 int err; 2142 2143 BT_DBG(""); 2144 2145 hci_dev_lock(hdev); 2146 2147 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 2148 2149 if (!hdev_is_powered(hdev)) { 2150 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 2151 2152 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2153 data, len); 2154 if (err < 0) 2155 goto failed; 2156 2157 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len, 2158 sk); 2159 2160 goto failed; 2161 } 2162 2163 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 2164 if (!cmd) { 2165 err = -ENOMEM; 2166 goto failed; 2167 } 2168 2169 err = update_name(hdev, cp->name); 2170 if (err < 0) 2171 mgmt_pending_remove(cmd); 2172 2173 failed: 2174 hci_dev_unlock(hdev); 2175 return err; 2176 } 2177 2178 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 2179 void *data, u16 data_len) 2180 { 2181 struct pending_cmd *cmd; 2182 int err; 2183 2184 BT_DBG("%s", hdev->name); 2185 2186 hci_dev_lock(hdev); 2187 2188 if (!hdev_is_powered(hdev)) { 2189 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2190 MGMT_STATUS_NOT_POWERED); 2191 goto unlock; 2192 } 2193 2194 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) { 2195 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2196 MGMT_STATUS_NOT_SUPPORTED); 2197 goto unlock; 2198 } 2199 2200 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 2201 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2202 MGMT_STATUS_BUSY); 2203 goto unlock; 2204 } 2205 2206 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 2207 if (!cmd) { 2208 err = -ENOMEM; 2209 goto unlock; 2210 } 2211 2212 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 2213 if (err < 0) 2214 mgmt_pending_remove(cmd); 2215 2216 unlock: 2217 hci_dev_unlock(hdev); 2218 return err; 2219 } 2220 2221 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2222 void *data, u16 len) 2223 { 2224 struct mgmt_cp_add_remote_oob_data *cp = data; 2225 u8 status; 2226 int err; 2227 2228 BT_DBG("%s ", hdev->name); 2229 2230 hci_dev_lock(hdev); 2231 2232 if (!hdev_is_powered(hdev)) { 2233 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 2234 MGMT_STATUS_NOT_POWERED, &cp->addr, 2235 sizeof(cp->addr)); 2236 goto unlock; 2237 } 2238 2239 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash, 2240 cp->randomizer); 2241 if (err < 0) 2242 status = MGMT_STATUS_FAILED; 2243 else 2244 status = 0; 2245 2246 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status, 2247 &cp->addr, sizeof(cp->addr)); 2248 2249 unlock: 2250 hci_dev_unlock(hdev); 2251 return err; 2252 } 2253 2254 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2255 void *data, u16 len) 2256 { 2257 struct mgmt_cp_remove_remote_oob_data *cp = data; 2258 u8 status; 2259 int err; 2260 2261 BT_DBG("%s", hdev->name); 2262 2263 hci_dev_lock(hdev); 2264 2265 if (!hdev_is_powered(hdev)) { 2266 err = cmd_complete(sk, hdev->id, 2267 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 2268 MGMT_STATUS_NOT_POWERED, &cp->addr, 2269 sizeof(cp->addr)); 2270 goto unlock; 2271 } 2272 2273 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr); 2274 if (err < 0) 2275 status = MGMT_STATUS_INVALID_PARAMS; 2276 else 2277 status = 0; 2278 2279 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 2280 status, &cp->addr, sizeof(cp->addr)); 2281 2282 unlock: 2283 hci_dev_unlock(hdev); 2284 return err; 2285 } 2286 2287 int mgmt_interleaved_discovery(struct hci_dev *hdev) 2288 { 2289 int err; 2290 2291 BT_DBG("%s", hdev->name); 2292 2293 hci_dev_lock(hdev); 2294 2295 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE); 2296 if (err < 0) 2297 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2298 2299 hci_dev_unlock(hdev); 2300 2301 return err; 2302 } 2303 2304 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 2305 void *data, u16 len) 2306 { 2307 struct mgmt_cp_start_discovery *cp = data; 2308 struct pending_cmd *cmd; 2309 int err; 2310 2311 BT_DBG("%s", hdev->name); 2312 2313 hci_dev_lock(hdev); 2314 2315 if (!hdev_is_powered(hdev)) { 2316 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2317 MGMT_STATUS_NOT_POWERED); 2318 goto failed; 2319 } 2320 2321 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) { 2322 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2323 MGMT_STATUS_BUSY); 2324 goto failed; 2325 } 2326 2327 if (hdev->discovery.state != DISCOVERY_STOPPED) { 2328 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2329 MGMT_STATUS_BUSY); 2330 goto failed; 2331 } 2332 2333 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0); 2334 if (!cmd) { 2335 err = -ENOMEM; 2336 goto failed; 2337 } 2338 2339 hdev->discovery.type = cp->type; 2340 2341 switch (hdev->discovery.type) { 2342 case DISCOV_TYPE_BREDR: 2343 if (lmp_bredr_capable(hdev)) 2344 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR); 2345 else 2346 err = -ENOTSUPP; 2347 break; 2348 2349 case DISCOV_TYPE_LE: 2350 if (lmp_host_le_capable(hdev)) 2351 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, 2352 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY); 2353 else 2354 err = -ENOTSUPP; 2355 break; 2356 2357 case DISCOV_TYPE_INTERLEAVED: 2358 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev)) 2359 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, 2360 LE_SCAN_WIN, 2361 LE_SCAN_TIMEOUT_BREDR_LE); 2362 else 2363 err = -ENOTSUPP; 2364 break; 2365 2366 default: 2367 err = -EINVAL; 2368 } 2369 2370 if (err < 0) 2371 mgmt_pending_remove(cmd); 2372 else 2373 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 2374 2375 failed: 2376 hci_dev_unlock(hdev); 2377 return err; 2378 } 2379 2380 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 2381 u16 len) 2382 { 2383 struct mgmt_cp_stop_discovery *mgmt_cp = data; 2384 struct pending_cmd *cmd; 2385 struct hci_cp_remote_name_req_cancel cp; 2386 struct inquiry_entry *e; 2387 int err; 2388 2389 BT_DBG("%s", hdev->name); 2390 2391 hci_dev_lock(hdev); 2392 2393 if (!hci_discovery_active(hdev)) { 2394 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 2395 MGMT_STATUS_REJECTED, &mgmt_cp->type, 2396 sizeof(mgmt_cp->type)); 2397 goto unlock; 2398 } 2399 2400 if (hdev->discovery.type != mgmt_cp->type) { 2401 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 2402 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type, 2403 sizeof(mgmt_cp->type)); 2404 goto unlock; 2405 } 2406 2407 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0); 2408 if (!cmd) { 2409 err = -ENOMEM; 2410 goto unlock; 2411 } 2412 2413 switch (hdev->discovery.state) { 2414 case DISCOVERY_FINDING: 2415 if (test_bit(HCI_INQUIRY, &hdev->flags)) 2416 err = hci_cancel_inquiry(hdev); 2417 else 2418 err = hci_cancel_le_scan(hdev); 2419 2420 break; 2421 2422 case DISCOVERY_RESOLVING: 2423 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 2424 NAME_PENDING); 2425 if (!e) { 2426 mgmt_pending_remove(cmd); 2427 err = cmd_complete(sk, hdev->id, 2428 MGMT_OP_STOP_DISCOVERY, 0, 2429 &mgmt_cp->type, 2430 sizeof(mgmt_cp->type)); 2431 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2432 goto unlock; 2433 } 2434 2435 bacpy(&cp.bdaddr, &e->data.bdaddr); 2436 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, 2437 sizeof(cp), &cp); 2438 2439 break; 2440 2441 default: 2442 BT_DBG("unknown discovery state %u", hdev->discovery.state); 2443 err = -EFAULT; 2444 } 2445 2446 if (err < 0) 2447 mgmt_pending_remove(cmd); 2448 else 2449 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 2450 2451 unlock: 2452 hci_dev_unlock(hdev); 2453 return err; 2454 } 2455 2456 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 2457 u16 len) 2458 { 2459 struct mgmt_cp_confirm_name *cp = data; 2460 struct inquiry_entry *e; 2461 int err; 2462 2463 BT_DBG("%s", hdev->name); 2464 2465 hci_dev_lock(hdev); 2466 2467 if (!hci_discovery_active(hdev)) { 2468 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 2469 MGMT_STATUS_FAILED); 2470 goto failed; 2471 } 2472 2473 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 2474 if (!e) { 2475 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 2476 MGMT_STATUS_INVALID_PARAMS); 2477 goto failed; 2478 } 2479 2480 if (cp->name_known) { 2481 e->name_state = NAME_KNOWN; 2482 list_del(&e->list); 2483 } else { 2484 e->name_state = NAME_NEEDED; 2485 hci_inquiry_cache_update_resolve(hdev, e); 2486 } 2487 2488 err = 0; 2489 2490 failed: 2491 hci_dev_unlock(hdev); 2492 return err; 2493 } 2494 2495 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 2496 u16 len) 2497 { 2498 struct mgmt_cp_block_device *cp = data; 2499 u8 status; 2500 int err; 2501 2502 BT_DBG("%s", hdev->name); 2503 2504 hci_dev_lock(hdev); 2505 2506 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type); 2507 if (err < 0) 2508 status = MGMT_STATUS_FAILED; 2509 else 2510 status = 0; 2511 2512 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 2513 &cp->addr, sizeof(cp->addr)); 2514 2515 hci_dev_unlock(hdev); 2516 2517 return err; 2518 } 2519 2520 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 2521 u16 len) 2522 { 2523 struct mgmt_cp_unblock_device *cp = data; 2524 u8 status; 2525 int err; 2526 2527 BT_DBG("%s", hdev->name); 2528 2529 hci_dev_lock(hdev); 2530 2531 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type); 2532 if (err < 0) 2533 status = MGMT_STATUS_INVALID_PARAMS; 2534 else 2535 status = 0; 2536 2537 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 2538 &cp->addr, sizeof(cp->addr)); 2539 2540 hci_dev_unlock(hdev); 2541 2542 return err; 2543 } 2544 2545 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 2546 u16 len) 2547 { 2548 struct mgmt_cp_set_device_id *cp = data; 2549 int err; 2550 __u16 source; 2551 2552 BT_DBG("%s", hdev->name); 2553 2554 source = __le16_to_cpu(cp->source); 2555 2556 if (source > 0x0002) 2557 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 2558 MGMT_STATUS_INVALID_PARAMS); 2559 2560 hci_dev_lock(hdev); 2561 2562 hdev->devid_source = source; 2563 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 2564 hdev->devid_product = __le16_to_cpu(cp->product); 2565 hdev->devid_version = __le16_to_cpu(cp->version); 2566 2567 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0); 2568 2569 update_eir(hdev); 2570 2571 hci_dev_unlock(hdev); 2572 2573 return err; 2574 } 2575 2576 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 2577 void *data, u16 len) 2578 { 2579 struct mgmt_mode *cp = data; 2580 struct hci_cp_write_page_scan_activity acp; 2581 u8 type; 2582 int err; 2583 2584 BT_DBG("%s", hdev->name); 2585 2586 if (!hdev_is_powered(hdev)) 2587 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2588 MGMT_STATUS_NOT_POWERED); 2589 2590 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2591 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2592 MGMT_STATUS_REJECTED); 2593 2594 hci_dev_lock(hdev); 2595 2596 if (cp->val) { 2597 type = PAGE_SCAN_TYPE_INTERLACED; 2598 2599 /* 160 msec page scan interval */ 2600 acp.interval = __constant_cpu_to_le16(0x0100); 2601 } else { 2602 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 2603 2604 /* default 1.28 sec page scan */ 2605 acp.interval = __constant_cpu_to_le16(0x0800); 2606 } 2607 2608 /* default 11.25 msec page scan window */ 2609 acp.window = __constant_cpu_to_le16(0x0012); 2610 2611 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp), 2612 &acp); 2613 if (err < 0) { 2614 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2615 MGMT_STATUS_FAILED); 2616 goto done; 2617 } 2618 2619 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type); 2620 if (err < 0) { 2621 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2622 MGMT_STATUS_FAILED); 2623 goto done; 2624 } 2625 2626 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0, 2627 NULL, 0); 2628 done: 2629 hci_dev_unlock(hdev); 2630 return err; 2631 } 2632 2633 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 2634 void *cp_data, u16 len) 2635 { 2636 struct mgmt_cp_load_long_term_keys *cp = cp_data; 2637 u16 key_count, expected_len; 2638 int i; 2639 2640 key_count = __le16_to_cpu(cp->key_count); 2641 2642 expected_len = sizeof(*cp) + key_count * 2643 sizeof(struct mgmt_ltk_info); 2644 if (expected_len != len) { 2645 BT_ERR("load_keys: expected %u bytes, got %u bytes", 2646 len, expected_len); 2647 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 2648 EINVAL); 2649 } 2650 2651 BT_DBG("%s key_count %u", hdev->name, key_count); 2652 2653 hci_dev_lock(hdev); 2654 2655 hci_smp_ltks_clear(hdev); 2656 2657 for (i = 0; i < key_count; i++) { 2658 struct mgmt_ltk_info *key = &cp->keys[i]; 2659 u8 type; 2660 2661 if (key->master) 2662 type = HCI_SMP_LTK; 2663 else 2664 type = HCI_SMP_LTK_SLAVE; 2665 2666 hci_add_ltk(hdev, &key->addr.bdaddr, 2667 bdaddr_to_le(key->addr.type), 2668 type, 0, key->authenticated, key->val, 2669 key->enc_size, key->ediv, key->rand); 2670 } 2671 2672 hci_dev_unlock(hdev); 2673 2674 return 0; 2675 } 2676 2677 static const struct mgmt_handler { 2678 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data, 2679 u16 data_len); 2680 bool var_len; 2681 size_t data_len; 2682 } mgmt_handlers[] = { 2683 { NULL }, /* 0x0000 (no command) */ 2684 { read_version, false, MGMT_READ_VERSION_SIZE }, 2685 { read_commands, false, MGMT_READ_COMMANDS_SIZE }, 2686 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE }, 2687 { read_controller_info, false, MGMT_READ_INFO_SIZE }, 2688 { set_powered, false, MGMT_SETTING_SIZE }, 2689 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE }, 2690 { set_connectable, false, MGMT_SETTING_SIZE }, 2691 { set_fast_connectable, false, MGMT_SETTING_SIZE }, 2692 { set_pairable, false, MGMT_SETTING_SIZE }, 2693 { set_link_security, false, MGMT_SETTING_SIZE }, 2694 { set_ssp, false, MGMT_SETTING_SIZE }, 2695 { set_hs, false, MGMT_SETTING_SIZE }, 2696 { set_le, false, MGMT_SETTING_SIZE }, 2697 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE }, 2698 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE }, 2699 { add_uuid, false, MGMT_ADD_UUID_SIZE }, 2700 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE }, 2701 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE }, 2702 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE }, 2703 { disconnect, false, MGMT_DISCONNECT_SIZE }, 2704 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE }, 2705 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE }, 2706 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 2707 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE }, 2708 { pair_device, false, MGMT_PAIR_DEVICE_SIZE }, 2709 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 2710 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE }, 2711 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE }, 2712 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 2713 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE }, 2714 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 2715 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 2716 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE }, 2717 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 2718 { start_discovery, false, MGMT_START_DISCOVERY_SIZE }, 2719 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE }, 2720 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE }, 2721 { block_device, false, MGMT_BLOCK_DEVICE_SIZE }, 2722 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE }, 2723 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE }, 2724 }; 2725 2726 2727 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen) 2728 { 2729 void *buf; 2730 u8 *cp; 2731 struct mgmt_hdr *hdr; 2732 u16 opcode, index, len; 2733 struct hci_dev *hdev = NULL; 2734 const struct mgmt_handler *handler; 2735 int err; 2736 2737 BT_DBG("got %zu bytes", msglen); 2738 2739 if (msglen < sizeof(*hdr)) 2740 return -EINVAL; 2741 2742 buf = kmalloc(msglen, GFP_KERNEL); 2743 if (!buf) 2744 return -ENOMEM; 2745 2746 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) { 2747 err = -EFAULT; 2748 goto done; 2749 } 2750 2751 hdr = buf; 2752 opcode = __le16_to_cpu(hdr->opcode); 2753 index = __le16_to_cpu(hdr->index); 2754 len = __le16_to_cpu(hdr->len); 2755 2756 if (len != msglen - sizeof(*hdr)) { 2757 err = -EINVAL; 2758 goto done; 2759 } 2760 2761 if (index != MGMT_INDEX_NONE) { 2762 hdev = hci_dev_get(index); 2763 if (!hdev) { 2764 err = cmd_status(sk, index, opcode, 2765 MGMT_STATUS_INVALID_INDEX); 2766 goto done; 2767 } 2768 } 2769 2770 if (opcode >= ARRAY_SIZE(mgmt_handlers) || 2771 mgmt_handlers[opcode].func == NULL) { 2772 BT_DBG("Unknown op %u", opcode); 2773 err = cmd_status(sk, index, opcode, 2774 MGMT_STATUS_UNKNOWN_COMMAND); 2775 goto done; 2776 } 2777 2778 if ((hdev && opcode < MGMT_OP_READ_INFO) || 2779 (!hdev && opcode >= MGMT_OP_READ_INFO)) { 2780 err = cmd_status(sk, index, opcode, 2781 MGMT_STATUS_INVALID_INDEX); 2782 goto done; 2783 } 2784 2785 handler = &mgmt_handlers[opcode]; 2786 2787 if ((handler->var_len && len < handler->data_len) || 2788 (!handler->var_len && len != handler->data_len)) { 2789 err = cmd_status(sk, index, opcode, 2790 MGMT_STATUS_INVALID_PARAMS); 2791 goto done; 2792 } 2793 2794 if (hdev) 2795 mgmt_init_hdev(sk, hdev); 2796 2797 cp = buf + sizeof(*hdr); 2798 2799 err = handler->func(sk, hdev, cp, len); 2800 if (err < 0) 2801 goto done; 2802 2803 err = msglen; 2804 2805 done: 2806 if (hdev) 2807 hci_dev_put(hdev); 2808 2809 kfree(buf); 2810 return err; 2811 } 2812 2813 static void cmd_status_rsp(struct pending_cmd *cmd, void *data) 2814 { 2815 u8 *status = data; 2816 2817 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 2818 mgmt_pending_remove(cmd); 2819 } 2820 2821 int mgmt_index_added(struct hci_dev *hdev) 2822 { 2823 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL); 2824 } 2825 2826 int mgmt_index_removed(struct hci_dev *hdev) 2827 { 2828 u8 status = MGMT_STATUS_INVALID_INDEX; 2829 2830 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status); 2831 2832 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL); 2833 } 2834 2835 struct cmd_lookup { 2836 struct sock *sk; 2837 struct hci_dev *hdev; 2838 u8 mgmt_status; 2839 }; 2840 2841 static void settings_rsp(struct pending_cmd *cmd, void *data) 2842 { 2843 struct cmd_lookup *match = data; 2844 2845 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 2846 2847 list_del(&cmd->list); 2848 2849 if (match->sk == NULL) { 2850 match->sk = cmd->sk; 2851 sock_hold(match->sk); 2852 } 2853 2854 mgmt_pending_free(cmd); 2855 } 2856 2857 int mgmt_powered(struct hci_dev *hdev, u8 powered) 2858 { 2859 struct cmd_lookup match = { NULL, hdev }; 2860 int err; 2861 2862 if (!test_bit(HCI_MGMT, &hdev->dev_flags)) 2863 return 0; 2864 2865 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 2866 2867 if (powered) { 2868 u8 scan = 0; 2869 2870 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2871 scan |= SCAN_PAGE; 2872 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 2873 scan |= SCAN_INQUIRY; 2874 2875 if (scan) 2876 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 2877 2878 update_class(hdev); 2879 update_name(hdev, hdev->dev_name); 2880 update_eir(hdev); 2881 } else { 2882 u8 status = MGMT_STATUS_NOT_POWERED; 2883 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status); 2884 } 2885 2886 err = new_settings(hdev, match.sk); 2887 2888 if (match.sk) 2889 sock_put(match.sk); 2890 2891 return err; 2892 } 2893 2894 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable) 2895 { 2896 struct cmd_lookup match = { NULL, hdev }; 2897 bool changed = false; 2898 int err = 0; 2899 2900 if (discoverable) { 2901 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 2902 changed = true; 2903 } else { 2904 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 2905 changed = true; 2906 } 2907 2908 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, 2909 &match); 2910 2911 if (changed) 2912 err = new_settings(hdev, match.sk); 2913 2914 if (match.sk) 2915 sock_put(match.sk); 2916 2917 return err; 2918 } 2919 2920 int mgmt_connectable(struct hci_dev *hdev, u8 connectable) 2921 { 2922 struct cmd_lookup match = { NULL, hdev }; 2923 bool changed = false; 2924 int err = 0; 2925 2926 if (connectable) { 2927 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2928 changed = true; 2929 } else { 2930 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2931 changed = true; 2932 } 2933 2934 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp, 2935 &match); 2936 2937 if (changed) 2938 err = new_settings(hdev, match.sk); 2939 2940 if (match.sk) 2941 sock_put(match.sk); 2942 2943 return err; 2944 } 2945 2946 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status) 2947 { 2948 u8 mgmt_err = mgmt_status(status); 2949 2950 if (scan & SCAN_PAGE) 2951 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, 2952 cmd_status_rsp, &mgmt_err); 2953 2954 if (scan & SCAN_INQUIRY) 2955 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, 2956 cmd_status_rsp, &mgmt_err); 2957 2958 return 0; 2959 } 2960 2961 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 2962 bool persistent) 2963 { 2964 struct mgmt_ev_new_link_key ev; 2965 2966 memset(&ev, 0, sizeof(ev)); 2967 2968 ev.store_hint = persistent; 2969 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 2970 ev.key.addr.type = BDADDR_BREDR; 2971 ev.key.type = key->type; 2972 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 2973 ev.key.pin_len = key->pin_len; 2974 2975 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 2976 } 2977 2978 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent) 2979 { 2980 struct mgmt_ev_new_long_term_key ev; 2981 2982 memset(&ev, 0, sizeof(ev)); 2983 2984 ev.store_hint = persistent; 2985 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 2986 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 2987 ev.key.authenticated = key->authenticated; 2988 ev.key.enc_size = key->enc_size; 2989 ev.key.ediv = key->ediv; 2990 2991 if (key->type == HCI_SMP_LTK) 2992 ev.key.master = 1; 2993 2994 memcpy(ev.key.rand, key->rand, sizeof(key->rand)); 2995 memcpy(ev.key.val, key->val, sizeof(key->val)); 2996 2997 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), 2998 NULL); 2999 } 3000 3001 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3002 u8 addr_type, u32 flags, u8 *name, u8 name_len, 3003 u8 *dev_class) 3004 { 3005 char buf[512]; 3006 struct mgmt_ev_device_connected *ev = (void *) buf; 3007 u16 eir_len = 0; 3008 3009 bacpy(&ev->addr.bdaddr, bdaddr); 3010 ev->addr.type = link_to_bdaddr(link_type, addr_type); 3011 3012 ev->flags = __cpu_to_le32(flags); 3013 3014 if (name_len > 0) 3015 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 3016 name, name_len); 3017 3018 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0) 3019 eir_len = eir_append_data(ev->eir, eir_len, 3020 EIR_CLASS_OF_DEV, dev_class, 3); 3021 3022 ev->eir_len = cpu_to_le16(eir_len); 3023 3024 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 3025 sizeof(*ev) + eir_len, NULL); 3026 } 3027 3028 static void disconnect_rsp(struct pending_cmd *cmd, void *data) 3029 { 3030 struct mgmt_cp_disconnect *cp = cmd->param; 3031 struct sock **sk = data; 3032 struct mgmt_rp_disconnect rp; 3033 3034 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3035 rp.addr.type = cp->addr.type; 3036 3037 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp, 3038 sizeof(rp)); 3039 3040 *sk = cmd->sk; 3041 sock_hold(*sk); 3042 3043 mgmt_pending_remove(cmd); 3044 } 3045 3046 static void unpair_device_rsp(struct pending_cmd *cmd, void *data) 3047 { 3048 struct hci_dev *hdev = data; 3049 struct mgmt_cp_unpair_device *cp = cmd->param; 3050 struct mgmt_rp_unpair_device rp; 3051 3052 memset(&rp, 0, sizeof(rp)); 3053 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3054 rp.addr.type = cp->addr.type; 3055 3056 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3057 3058 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp)); 3059 3060 mgmt_pending_remove(cmd); 3061 } 3062 3063 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 3064 u8 link_type, u8 addr_type) 3065 { 3066 struct mgmt_addr_info ev; 3067 struct sock *sk = NULL; 3068 int err; 3069 3070 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 3071 3072 bacpy(&ev.bdaddr, bdaddr); 3073 ev.type = link_to_bdaddr(link_type, addr_type); 3074 3075 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), 3076 sk); 3077 3078 if (sk) 3079 sock_put(sk); 3080 3081 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 3082 hdev); 3083 3084 return err; 3085 } 3086 3087 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 3088 u8 link_type, u8 addr_type, u8 status) 3089 { 3090 struct mgmt_rp_disconnect rp; 3091 struct pending_cmd *cmd; 3092 int err; 3093 3094 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev); 3095 if (!cmd) 3096 return -ENOENT; 3097 3098 bacpy(&rp.addr.bdaddr, bdaddr); 3099 rp.addr.type = link_to_bdaddr(link_type, addr_type); 3100 3101 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 3102 mgmt_status(status), &rp, sizeof(rp)); 3103 3104 mgmt_pending_remove(cmd); 3105 3106 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 3107 hdev); 3108 return err; 3109 } 3110 3111 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3112 u8 addr_type, u8 status) 3113 { 3114 struct mgmt_ev_connect_failed ev; 3115 3116 bacpy(&ev.addr.bdaddr, bdaddr); 3117 ev.addr.type = link_to_bdaddr(link_type, addr_type); 3118 ev.status = mgmt_status(status); 3119 3120 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 3121 } 3122 3123 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 3124 { 3125 struct mgmt_ev_pin_code_request ev; 3126 3127 bacpy(&ev.addr.bdaddr, bdaddr); 3128 ev.addr.type = BDADDR_BREDR; 3129 ev.secure = secure; 3130 3131 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), 3132 NULL); 3133 } 3134 3135 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3136 u8 status) 3137 { 3138 struct pending_cmd *cmd; 3139 struct mgmt_rp_pin_code_reply rp; 3140 int err; 3141 3142 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 3143 if (!cmd) 3144 return -ENOENT; 3145 3146 bacpy(&rp.addr.bdaddr, bdaddr); 3147 rp.addr.type = BDADDR_BREDR; 3148 3149 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3150 mgmt_status(status), &rp, sizeof(rp)); 3151 3152 mgmt_pending_remove(cmd); 3153 3154 return err; 3155 } 3156 3157 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3158 u8 status) 3159 { 3160 struct pending_cmd *cmd; 3161 struct mgmt_rp_pin_code_reply rp; 3162 int err; 3163 3164 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 3165 if (!cmd) 3166 return -ENOENT; 3167 3168 bacpy(&rp.addr.bdaddr, bdaddr); 3169 rp.addr.type = BDADDR_BREDR; 3170 3171 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, 3172 mgmt_status(status), &rp, sizeof(rp)); 3173 3174 mgmt_pending_remove(cmd); 3175 3176 return err; 3177 } 3178 3179 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 3180 u8 link_type, u8 addr_type, __le32 value, 3181 u8 confirm_hint) 3182 { 3183 struct mgmt_ev_user_confirm_request ev; 3184 3185 BT_DBG("%s", hdev->name); 3186 3187 bacpy(&ev.addr.bdaddr, bdaddr); 3188 ev.addr.type = link_to_bdaddr(link_type, addr_type); 3189 ev.confirm_hint = confirm_hint; 3190 ev.value = value; 3191 3192 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 3193 NULL); 3194 } 3195 3196 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 3197 u8 link_type, u8 addr_type) 3198 { 3199 struct mgmt_ev_user_passkey_request ev; 3200 3201 BT_DBG("%s", hdev->name); 3202 3203 bacpy(&ev.addr.bdaddr, bdaddr); 3204 ev.addr.type = link_to_bdaddr(link_type, addr_type); 3205 3206 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 3207 NULL); 3208 } 3209 3210 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3211 u8 link_type, u8 addr_type, u8 status, 3212 u8 opcode) 3213 { 3214 struct pending_cmd *cmd; 3215 struct mgmt_rp_user_confirm_reply rp; 3216 int err; 3217 3218 cmd = mgmt_pending_find(opcode, hdev); 3219 if (!cmd) 3220 return -ENOENT; 3221 3222 bacpy(&rp.addr.bdaddr, bdaddr); 3223 rp.addr.type = link_to_bdaddr(link_type, addr_type); 3224 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status), 3225 &rp, sizeof(rp)); 3226 3227 mgmt_pending_remove(cmd); 3228 3229 return err; 3230 } 3231 3232 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3233 u8 link_type, u8 addr_type, u8 status) 3234 { 3235 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3236 status, MGMT_OP_USER_CONFIRM_REPLY); 3237 } 3238 3239 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3240 u8 link_type, u8 addr_type, u8 status) 3241 { 3242 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3243 status, 3244 MGMT_OP_USER_CONFIRM_NEG_REPLY); 3245 } 3246 3247 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3248 u8 link_type, u8 addr_type, u8 status) 3249 { 3250 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3251 status, MGMT_OP_USER_PASSKEY_REPLY); 3252 } 3253 3254 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3255 u8 link_type, u8 addr_type, u8 status) 3256 { 3257 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3258 status, 3259 MGMT_OP_USER_PASSKEY_NEG_REPLY); 3260 } 3261 3262 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3263 u8 addr_type, u8 status) 3264 { 3265 struct mgmt_ev_auth_failed ev; 3266 3267 bacpy(&ev.addr.bdaddr, bdaddr); 3268 ev.addr.type = link_to_bdaddr(link_type, addr_type); 3269 ev.status = mgmt_status(status); 3270 3271 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL); 3272 } 3273 3274 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 3275 { 3276 struct cmd_lookup match = { NULL, hdev }; 3277 bool changed = false; 3278 int err = 0; 3279 3280 if (status) { 3281 u8 mgmt_err = mgmt_status(status); 3282 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 3283 cmd_status_rsp, &mgmt_err); 3284 return 0; 3285 } 3286 3287 if (test_bit(HCI_AUTH, &hdev->flags)) { 3288 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 3289 changed = true; 3290 } else { 3291 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 3292 changed = true; 3293 } 3294 3295 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 3296 &match); 3297 3298 if (changed) 3299 err = new_settings(hdev, match.sk); 3300 3301 if (match.sk) 3302 sock_put(match.sk); 3303 3304 return err; 3305 } 3306 3307 static int clear_eir(struct hci_dev *hdev) 3308 { 3309 struct hci_cp_write_eir cp; 3310 3311 if (!(hdev->features[6] & LMP_EXT_INQ)) 3312 return 0; 3313 3314 memset(hdev->eir, 0, sizeof(hdev->eir)); 3315 3316 memset(&cp, 0, sizeof(cp)); 3317 3318 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 3319 } 3320 3321 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 3322 { 3323 struct cmd_lookup match = { NULL, hdev }; 3324 bool changed = false; 3325 int err = 0; 3326 3327 if (status) { 3328 u8 mgmt_err = mgmt_status(status); 3329 3330 if (enable && test_and_clear_bit(HCI_SSP_ENABLED, 3331 &hdev->dev_flags)) 3332 err = new_settings(hdev, NULL); 3333 3334 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 3335 &mgmt_err); 3336 3337 return err; 3338 } 3339 3340 if (enable) { 3341 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 3342 changed = true; 3343 } else { 3344 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 3345 changed = true; 3346 } 3347 3348 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 3349 3350 if (changed) 3351 err = new_settings(hdev, match.sk); 3352 3353 if (match.sk) 3354 sock_put(match.sk); 3355 3356 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 3357 update_eir(hdev); 3358 else 3359 clear_eir(hdev); 3360 3361 return err; 3362 } 3363 3364 static void class_rsp(struct pending_cmd *cmd, void *data) 3365 { 3366 struct cmd_lookup *match = data; 3367 3368 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status, 3369 match->hdev->dev_class, 3); 3370 3371 list_del(&cmd->list); 3372 3373 if (match->sk == NULL) { 3374 match->sk = cmd->sk; 3375 sock_hold(match->sk); 3376 } 3377 3378 mgmt_pending_free(cmd); 3379 } 3380 3381 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 3382 u8 status) 3383 { 3384 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 3385 int err = 0; 3386 3387 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags); 3388 3389 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match); 3390 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match); 3391 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match); 3392 3393 if (!status) 3394 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3395 3, NULL); 3396 3397 if (match.sk) 3398 sock_put(match.sk); 3399 3400 return err; 3401 } 3402 3403 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 3404 { 3405 struct pending_cmd *cmd; 3406 struct mgmt_cp_set_local_name ev; 3407 bool changed = false; 3408 int err = 0; 3409 3410 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) { 3411 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 3412 changed = true; 3413 } 3414 3415 memset(&ev, 0, sizeof(ev)); 3416 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 3417 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 3418 3419 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3420 if (!cmd) 3421 goto send_event; 3422 3423 /* Always assume that either the short or the complete name has 3424 * changed if there was a pending mgmt command */ 3425 changed = true; 3426 3427 if (status) { 3428 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3429 mgmt_status(status)); 3430 goto failed; 3431 } 3432 3433 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev, 3434 sizeof(ev)); 3435 if (err < 0) 3436 goto failed; 3437 3438 send_event: 3439 if (changed) 3440 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, 3441 sizeof(ev), cmd ? cmd->sk : NULL); 3442 3443 update_eir(hdev); 3444 3445 failed: 3446 if (cmd) 3447 mgmt_pending_remove(cmd); 3448 return err; 3449 } 3450 3451 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash, 3452 u8 *randomizer, u8 status) 3453 { 3454 struct pending_cmd *cmd; 3455 int err; 3456 3457 BT_DBG("%s status %u", hdev->name, status); 3458 3459 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 3460 if (!cmd) 3461 return -ENOENT; 3462 3463 if (status) { 3464 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3465 mgmt_status(status)); 3466 } else { 3467 struct mgmt_rp_read_local_oob_data rp; 3468 3469 memcpy(rp.hash, hash, sizeof(rp.hash)); 3470 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer)); 3471 3472 err = cmd_complete(cmd->sk, hdev->id, 3473 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp, 3474 sizeof(rp)); 3475 } 3476 3477 mgmt_pending_remove(cmd); 3478 3479 return err; 3480 } 3481 3482 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 3483 { 3484 struct cmd_lookup match = { NULL, hdev }; 3485 bool changed = false; 3486 int err = 0; 3487 3488 if (status) { 3489 u8 mgmt_err = mgmt_status(status); 3490 3491 if (enable && test_and_clear_bit(HCI_LE_ENABLED, 3492 &hdev->dev_flags)) 3493 err = new_settings(hdev, NULL); 3494 3495 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 3496 &mgmt_err); 3497 3498 return err; 3499 } 3500 3501 if (enable) { 3502 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 3503 changed = true; 3504 } else { 3505 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 3506 changed = true; 3507 } 3508 3509 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 3510 3511 if (changed) 3512 err = new_settings(hdev, match.sk); 3513 3514 if (match.sk) 3515 sock_put(match.sk); 3516 3517 return err; 3518 } 3519 3520 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3521 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8 3522 ssp, u8 *eir, u16 eir_len) 3523 { 3524 char buf[512]; 3525 struct mgmt_ev_device_found *ev = (void *) buf; 3526 size_t ev_size; 3527 3528 /* Leave 5 bytes for a potential CoD field */ 3529 if (sizeof(*ev) + eir_len + 5 > sizeof(buf)) 3530 return -EINVAL; 3531 3532 memset(buf, 0, sizeof(buf)); 3533 3534 bacpy(&ev->addr.bdaddr, bdaddr); 3535 ev->addr.type = link_to_bdaddr(link_type, addr_type); 3536 ev->rssi = rssi; 3537 if (cfm_name) 3538 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME); 3539 if (!ssp) 3540 ev->flags |= cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING); 3541 3542 if (eir_len > 0) 3543 memcpy(ev->eir, eir, eir_len); 3544 3545 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV)) 3546 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 3547 dev_class, 3); 3548 3549 ev->eir_len = cpu_to_le16(eir_len); 3550 ev_size = sizeof(*ev) + eir_len; 3551 3552 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 3553 } 3554 3555 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3556 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 3557 { 3558 struct mgmt_ev_device_found *ev; 3559 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 3560 u16 eir_len; 3561 3562 ev = (struct mgmt_ev_device_found *) buf; 3563 3564 memset(buf, 0, sizeof(buf)); 3565 3566 bacpy(&ev->addr.bdaddr, bdaddr); 3567 ev->addr.type = link_to_bdaddr(link_type, addr_type); 3568 ev->rssi = rssi; 3569 3570 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 3571 name_len); 3572 3573 ev->eir_len = cpu_to_le16(eir_len); 3574 3575 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, 3576 sizeof(*ev) + eir_len, NULL); 3577 } 3578 3579 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status) 3580 { 3581 struct pending_cmd *cmd; 3582 u8 type; 3583 int err; 3584 3585 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3586 3587 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 3588 if (!cmd) 3589 return -ENOENT; 3590 3591 type = hdev->discovery.type; 3592 3593 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 3594 &type, sizeof(type)); 3595 mgmt_pending_remove(cmd); 3596 3597 return err; 3598 } 3599 3600 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status) 3601 { 3602 struct pending_cmd *cmd; 3603 int err; 3604 3605 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 3606 if (!cmd) 3607 return -ENOENT; 3608 3609 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 3610 &hdev->discovery.type, sizeof(hdev->discovery.type)); 3611 mgmt_pending_remove(cmd); 3612 3613 return err; 3614 } 3615 3616 int mgmt_discovering(struct hci_dev *hdev, u8 discovering) 3617 { 3618 struct mgmt_ev_discovering ev; 3619 struct pending_cmd *cmd; 3620 3621 BT_DBG("%s discovering %u", hdev->name, discovering); 3622 3623 if (discovering) 3624 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 3625 else 3626 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 3627 3628 if (cmd != NULL) { 3629 u8 type = hdev->discovery.type; 3630 3631 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type, 3632 sizeof(type)); 3633 mgmt_pending_remove(cmd); 3634 } 3635 3636 memset(&ev, 0, sizeof(ev)); 3637 ev.type = hdev->discovery.type; 3638 ev.discovering = discovering; 3639 3640 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 3641 } 3642 3643 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 3644 { 3645 struct pending_cmd *cmd; 3646 struct mgmt_ev_device_blocked ev; 3647 3648 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev); 3649 3650 bacpy(&ev.addr.bdaddr, bdaddr); 3651 ev.addr.type = type; 3652 3653 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev), 3654 cmd ? cmd->sk : NULL); 3655 } 3656 3657 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 3658 { 3659 struct pending_cmd *cmd; 3660 struct mgmt_ev_device_unblocked ev; 3661 3662 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev); 3663 3664 bacpy(&ev.addr.bdaddr, bdaddr); 3665 ev.addr.type = type; 3666 3667 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev), 3668 cmd ? cmd->sk : NULL); 3669 } 3670 3671 module_param(enable_hs, bool, 0644); 3672 MODULE_PARM_DESC(enable_hs, "Enable High Speed support"); 3673