1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/mgmt.h> 33 34 #include "smp.h" 35 36 #define MGMT_VERSION 1 37 #define MGMT_REVISION 4 38 39 static const u16 mgmt_commands[] = { 40 MGMT_OP_READ_INDEX_LIST, 41 MGMT_OP_READ_INFO, 42 MGMT_OP_SET_POWERED, 43 MGMT_OP_SET_DISCOVERABLE, 44 MGMT_OP_SET_CONNECTABLE, 45 MGMT_OP_SET_FAST_CONNECTABLE, 46 MGMT_OP_SET_PAIRABLE, 47 MGMT_OP_SET_LINK_SECURITY, 48 MGMT_OP_SET_SSP, 49 MGMT_OP_SET_HS, 50 MGMT_OP_SET_LE, 51 MGMT_OP_SET_DEV_CLASS, 52 MGMT_OP_SET_LOCAL_NAME, 53 MGMT_OP_ADD_UUID, 54 MGMT_OP_REMOVE_UUID, 55 MGMT_OP_LOAD_LINK_KEYS, 56 MGMT_OP_LOAD_LONG_TERM_KEYS, 57 MGMT_OP_DISCONNECT, 58 MGMT_OP_GET_CONNECTIONS, 59 MGMT_OP_PIN_CODE_REPLY, 60 MGMT_OP_PIN_CODE_NEG_REPLY, 61 MGMT_OP_SET_IO_CAPABILITY, 62 MGMT_OP_PAIR_DEVICE, 63 MGMT_OP_CANCEL_PAIR_DEVICE, 64 MGMT_OP_UNPAIR_DEVICE, 65 MGMT_OP_USER_CONFIRM_REPLY, 66 MGMT_OP_USER_CONFIRM_NEG_REPLY, 67 MGMT_OP_USER_PASSKEY_REPLY, 68 MGMT_OP_USER_PASSKEY_NEG_REPLY, 69 MGMT_OP_READ_LOCAL_OOB_DATA, 70 MGMT_OP_ADD_REMOTE_OOB_DATA, 71 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 72 MGMT_OP_START_DISCOVERY, 73 MGMT_OP_STOP_DISCOVERY, 74 MGMT_OP_CONFIRM_NAME, 75 MGMT_OP_BLOCK_DEVICE, 76 MGMT_OP_UNBLOCK_DEVICE, 77 MGMT_OP_SET_DEVICE_ID, 78 MGMT_OP_SET_ADVERTISING, 79 MGMT_OP_SET_BREDR, 80 MGMT_OP_SET_STATIC_ADDRESS, 81 MGMT_OP_SET_SCAN_PARAMS, 82 }; 83 84 static const u16 mgmt_events[] = { 85 MGMT_EV_CONTROLLER_ERROR, 86 MGMT_EV_INDEX_ADDED, 87 MGMT_EV_INDEX_REMOVED, 88 MGMT_EV_NEW_SETTINGS, 89 MGMT_EV_CLASS_OF_DEV_CHANGED, 90 MGMT_EV_LOCAL_NAME_CHANGED, 91 MGMT_EV_NEW_LINK_KEY, 92 MGMT_EV_NEW_LONG_TERM_KEY, 93 MGMT_EV_DEVICE_CONNECTED, 94 MGMT_EV_DEVICE_DISCONNECTED, 95 MGMT_EV_CONNECT_FAILED, 96 MGMT_EV_PIN_CODE_REQUEST, 97 MGMT_EV_USER_CONFIRM_REQUEST, 98 MGMT_EV_USER_PASSKEY_REQUEST, 99 MGMT_EV_AUTH_FAILED, 100 MGMT_EV_DEVICE_FOUND, 101 MGMT_EV_DISCOVERING, 102 MGMT_EV_DEVICE_BLOCKED, 103 MGMT_EV_DEVICE_UNBLOCKED, 104 MGMT_EV_DEVICE_UNPAIRED, 105 MGMT_EV_PASSKEY_NOTIFY, 106 }; 107 108 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 109 110 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \ 111 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) 112 113 struct pending_cmd { 114 struct list_head list; 115 u16 opcode; 116 int index; 117 void *param; 118 struct sock *sk; 119 void *user_data; 120 }; 121 122 /* HCI to MGMT error code conversion table */ 123 static u8 mgmt_status_table[] = { 124 MGMT_STATUS_SUCCESS, 125 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 126 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 127 MGMT_STATUS_FAILED, /* Hardware Failure */ 128 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 129 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 130 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */ 131 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 132 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 133 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 134 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 135 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 136 MGMT_STATUS_BUSY, /* Command Disallowed */ 137 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 138 MGMT_STATUS_REJECTED, /* Rejected Security */ 139 MGMT_STATUS_REJECTED, /* Rejected Personal */ 140 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 141 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 142 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 143 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 144 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 145 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 146 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 147 MGMT_STATUS_BUSY, /* Repeated Attempts */ 148 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 149 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 150 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 151 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 152 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 153 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 154 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 155 MGMT_STATUS_FAILED, /* Unspecified Error */ 156 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 157 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 158 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 159 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 160 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 161 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 162 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 163 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 164 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 165 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 166 MGMT_STATUS_FAILED, /* Transaction Collision */ 167 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 168 MGMT_STATUS_REJECTED, /* QoS Rejected */ 169 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 170 MGMT_STATUS_REJECTED, /* Insufficient Security */ 171 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 172 MGMT_STATUS_BUSY, /* Role Switch Pending */ 173 MGMT_STATUS_FAILED, /* Slot Violation */ 174 MGMT_STATUS_FAILED, /* Role Switch Failed */ 175 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 176 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 177 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 178 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 179 MGMT_STATUS_BUSY, /* Controller Busy */ 180 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 181 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 182 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 183 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 184 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 185 }; 186 187 static u8 mgmt_status(u8 hci_status) 188 { 189 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 190 return mgmt_status_table[hci_status]; 191 192 return MGMT_STATUS_FAILED; 193 } 194 195 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status) 196 { 197 struct sk_buff *skb; 198 struct mgmt_hdr *hdr; 199 struct mgmt_ev_cmd_status *ev; 200 int err; 201 202 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status); 203 204 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL); 205 if (!skb) 206 return -ENOMEM; 207 208 hdr = (void *) skb_put(skb, sizeof(*hdr)); 209 210 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS); 211 hdr->index = cpu_to_le16(index); 212 hdr->len = cpu_to_le16(sizeof(*ev)); 213 214 ev = (void *) skb_put(skb, sizeof(*ev)); 215 ev->status = status; 216 ev->opcode = cpu_to_le16(cmd); 217 218 err = sock_queue_rcv_skb(sk, skb); 219 if (err < 0) 220 kfree_skb(skb); 221 222 return err; 223 } 224 225 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status, 226 void *rp, size_t rp_len) 227 { 228 struct sk_buff *skb; 229 struct mgmt_hdr *hdr; 230 struct mgmt_ev_cmd_complete *ev; 231 int err; 232 233 BT_DBG("sock %p", sk); 234 235 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL); 236 if (!skb) 237 return -ENOMEM; 238 239 hdr = (void *) skb_put(skb, sizeof(*hdr)); 240 241 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE); 242 hdr->index = cpu_to_le16(index); 243 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len); 244 245 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len); 246 ev->opcode = cpu_to_le16(cmd); 247 ev->status = status; 248 249 if (rp) 250 memcpy(ev->data, rp, rp_len); 251 252 err = sock_queue_rcv_skb(sk, skb); 253 if (err < 0) 254 kfree_skb(skb); 255 256 return err; 257 } 258 259 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 260 u16 data_len) 261 { 262 struct mgmt_rp_read_version rp; 263 264 BT_DBG("sock %p", sk); 265 266 rp.version = MGMT_VERSION; 267 rp.revision = __constant_cpu_to_le16(MGMT_REVISION); 268 269 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp, 270 sizeof(rp)); 271 } 272 273 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 274 u16 data_len) 275 { 276 struct mgmt_rp_read_commands *rp; 277 const u16 num_commands = ARRAY_SIZE(mgmt_commands); 278 const u16 num_events = ARRAY_SIZE(mgmt_events); 279 __le16 *opcode; 280 size_t rp_size; 281 int i, err; 282 283 BT_DBG("sock %p", sk); 284 285 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 286 287 rp = kmalloc(rp_size, GFP_KERNEL); 288 if (!rp) 289 return -ENOMEM; 290 291 rp->num_commands = __constant_cpu_to_le16(num_commands); 292 rp->num_events = __constant_cpu_to_le16(num_events); 293 294 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++) 295 put_unaligned_le16(mgmt_commands[i], opcode); 296 297 for (i = 0; i < num_events; i++, opcode++) 298 put_unaligned_le16(mgmt_events[i], opcode); 299 300 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp, 301 rp_size); 302 kfree(rp); 303 304 return err; 305 } 306 307 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 308 u16 data_len) 309 { 310 struct mgmt_rp_read_index_list *rp; 311 struct hci_dev *d; 312 size_t rp_len; 313 u16 count; 314 int err; 315 316 BT_DBG("sock %p", sk); 317 318 read_lock(&hci_dev_list_lock); 319 320 count = 0; 321 list_for_each_entry(d, &hci_dev_list, list) { 322 if (d->dev_type == HCI_BREDR) 323 count++; 324 } 325 326 rp_len = sizeof(*rp) + (2 * count); 327 rp = kmalloc(rp_len, GFP_ATOMIC); 328 if (!rp) { 329 read_unlock(&hci_dev_list_lock); 330 return -ENOMEM; 331 } 332 333 count = 0; 334 list_for_each_entry(d, &hci_dev_list, list) { 335 if (test_bit(HCI_SETUP, &d->dev_flags)) 336 continue; 337 338 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags)) 339 continue; 340 341 if (d->dev_type == HCI_BREDR) { 342 rp->index[count++] = cpu_to_le16(d->id); 343 BT_DBG("Added hci%u", d->id); 344 } 345 } 346 347 rp->num_controllers = cpu_to_le16(count); 348 rp_len = sizeof(*rp) + (2 * count); 349 350 read_unlock(&hci_dev_list_lock); 351 352 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp, 353 rp_len); 354 355 kfree(rp); 356 357 return err; 358 } 359 360 static u32 get_supported_settings(struct hci_dev *hdev) 361 { 362 u32 settings = 0; 363 364 settings |= MGMT_SETTING_POWERED; 365 settings |= MGMT_SETTING_PAIRABLE; 366 367 if (lmp_bredr_capable(hdev)) { 368 settings |= MGMT_SETTING_CONNECTABLE; 369 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 370 settings |= MGMT_SETTING_FAST_CONNECTABLE; 371 settings |= MGMT_SETTING_DISCOVERABLE; 372 settings |= MGMT_SETTING_BREDR; 373 settings |= MGMT_SETTING_LINK_SECURITY; 374 375 if (lmp_ssp_capable(hdev)) { 376 settings |= MGMT_SETTING_SSP; 377 settings |= MGMT_SETTING_HS; 378 } 379 } 380 381 if (lmp_le_capable(hdev)) { 382 settings |= MGMT_SETTING_LE; 383 settings |= MGMT_SETTING_ADVERTISING; 384 } 385 386 return settings; 387 } 388 389 static u32 get_current_settings(struct hci_dev *hdev) 390 { 391 u32 settings = 0; 392 393 if (hdev_is_powered(hdev)) 394 settings |= MGMT_SETTING_POWERED; 395 396 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 397 settings |= MGMT_SETTING_CONNECTABLE; 398 399 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) 400 settings |= MGMT_SETTING_FAST_CONNECTABLE; 401 402 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 403 settings |= MGMT_SETTING_DISCOVERABLE; 404 405 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags)) 406 settings |= MGMT_SETTING_PAIRABLE; 407 408 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 409 settings |= MGMT_SETTING_BREDR; 410 411 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 412 settings |= MGMT_SETTING_LE; 413 414 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 415 settings |= MGMT_SETTING_LINK_SECURITY; 416 417 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 418 settings |= MGMT_SETTING_SSP; 419 420 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags)) 421 settings |= MGMT_SETTING_HS; 422 423 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 424 settings |= MGMT_SETTING_ADVERTISING; 425 426 return settings; 427 } 428 429 #define PNP_INFO_SVCLASS_ID 0x1200 430 431 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 432 { 433 u8 *ptr = data, *uuids_start = NULL; 434 struct bt_uuid *uuid; 435 436 if (len < 4) 437 return ptr; 438 439 list_for_each_entry(uuid, &hdev->uuids, list) { 440 u16 uuid16; 441 442 if (uuid->size != 16) 443 continue; 444 445 uuid16 = get_unaligned_le16(&uuid->uuid[12]); 446 if (uuid16 < 0x1100) 447 continue; 448 449 if (uuid16 == PNP_INFO_SVCLASS_ID) 450 continue; 451 452 if (!uuids_start) { 453 uuids_start = ptr; 454 uuids_start[0] = 1; 455 uuids_start[1] = EIR_UUID16_ALL; 456 ptr += 2; 457 } 458 459 /* Stop if not enough space to put next UUID */ 460 if ((ptr - data) + sizeof(u16) > len) { 461 uuids_start[1] = EIR_UUID16_SOME; 462 break; 463 } 464 465 *ptr++ = (uuid16 & 0x00ff); 466 *ptr++ = (uuid16 & 0xff00) >> 8; 467 uuids_start[0] += sizeof(uuid16); 468 } 469 470 return ptr; 471 } 472 473 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 474 { 475 u8 *ptr = data, *uuids_start = NULL; 476 struct bt_uuid *uuid; 477 478 if (len < 6) 479 return ptr; 480 481 list_for_each_entry(uuid, &hdev->uuids, list) { 482 if (uuid->size != 32) 483 continue; 484 485 if (!uuids_start) { 486 uuids_start = ptr; 487 uuids_start[0] = 1; 488 uuids_start[1] = EIR_UUID32_ALL; 489 ptr += 2; 490 } 491 492 /* Stop if not enough space to put next UUID */ 493 if ((ptr - data) + sizeof(u32) > len) { 494 uuids_start[1] = EIR_UUID32_SOME; 495 break; 496 } 497 498 memcpy(ptr, &uuid->uuid[12], sizeof(u32)); 499 ptr += sizeof(u32); 500 uuids_start[0] += sizeof(u32); 501 } 502 503 return ptr; 504 } 505 506 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 507 { 508 u8 *ptr = data, *uuids_start = NULL; 509 struct bt_uuid *uuid; 510 511 if (len < 18) 512 return ptr; 513 514 list_for_each_entry(uuid, &hdev->uuids, list) { 515 if (uuid->size != 128) 516 continue; 517 518 if (!uuids_start) { 519 uuids_start = ptr; 520 uuids_start[0] = 1; 521 uuids_start[1] = EIR_UUID128_ALL; 522 ptr += 2; 523 } 524 525 /* Stop if not enough space to put next UUID */ 526 if ((ptr - data) + 16 > len) { 527 uuids_start[1] = EIR_UUID128_SOME; 528 break; 529 } 530 531 memcpy(ptr, uuid->uuid, 16); 532 ptr += 16; 533 uuids_start[0] += 16; 534 } 535 536 return ptr; 537 } 538 539 static u8 create_ad(struct hci_dev *hdev, u8 *ptr) 540 { 541 u8 ad_len = 0, flags = 0; 542 size_t name_len; 543 544 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 545 flags |= LE_AD_GENERAL; 546 547 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) { 548 if (lmp_le_br_capable(hdev)) 549 flags |= LE_AD_SIM_LE_BREDR_CTRL; 550 if (lmp_host_le_br_capable(hdev)) 551 flags |= LE_AD_SIM_LE_BREDR_HOST; 552 } else { 553 flags |= LE_AD_NO_BREDR; 554 } 555 556 if (flags) { 557 BT_DBG("adv flags 0x%02x", flags); 558 559 ptr[0] = 2; 560 ptr[1] = EIR_FLAGS; 561 ptr[2] = flags; 562 563 ad_len += 3; 564 ptr += 3; 565 } 566 567 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) { 568 ptr[0] = 2; 569 ptr[1] = EIR_TX_POWER; 570 ptr[2] = (u8) hdev->adv_tx_power; 571 572 ad_len += 3; 573 ptr += 3; 574 } 575 576 name_len = strlen(hdev->dev_name); 577 if (name_len > 0) { 578 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2; 579 580 if (name_len > max_len) { 581 name_len = max_len; 582 ptr[1] = EIR_NAME_SHORT; 583 } else 584 ptr[1] = EIR_NAME_COMPLETE; 585 586 ptr[0] = name_len + 1; 587 588 memcpy(ptr + 2, hdev->dev_name, name_len); 589 590 ad_len += (name_len + 2); 591 ptr += (name_len + 2); 592 } 593 594 return ad_len; 595 } 596 597 static void update_ad(struct hci_request *req) 598 { 599 struct hci_dev *hdev = req->hdev; 600 struct hci_cp_le_set_adv_data cp; 601 u8 len; 602 603 if (!lmp_le_capable(hdev)) 604 return; 605 606 memset(&cp, 0, sizeof(cp)); 607 608 len = create_ad(hdev, cp.data); 609 610 if (hdev->adv_data_len == len && 611 memcmp(cp.data, hdev->adv_data, len) == 0) 612 return; 613 614 memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); 615 hdev->adv_data_len = len; 616 617 cp.length = len; 618 619 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp); 620 } 621 622 static void create_eir(struct hci_dev *hdev, u8 *data) 623 { 624 u8 *ptr = data; 625 size_t name_len; 626 627 name_len = strlen(hdev->dev_name); 628 629 if (name_len > 0) { 630 /* EIR Data type */ 631 if (name_len > 48) { 632 name_len = 48; 633 ptr[1] = EIR_NAME_SHORT; 634 } else 635 ptr[1] = EIR_NAME_COMPLETE; 636 637 /* EIR Data length */ 638 ptr[0] = name_len + 1; 639 640 memcpy(ptr + 2, hdev->dev_name, name_len); 641 642 ptr += (name_len + 2); 643 } 644 645 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) { 646 ptr[0] = 2; 647 ptr[1] = EIR_TX_POWER; 648 ptr[2] = (u8) hdev->inq_tx_power; 649 650 ptr += 3; 651 } 652 653 if (hdev->devid_source > 0) { 654 ptr[0] = 9; 655 ptr[1] = EIR_DEVICE_ID; 656 657 put_unaligned_le16(hdev->devid_source, ptr + 2); 658 put_unaligned_le16(hdev->devid_vendor, ptr + 4); 659 put_unaligned_le16(hdev->devid_product, ptr + 6); 660 put_unaligned_le16(hdev->devid_version, ptr + 8); 661 662 ptr += 10; 663 } 664 665 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 666 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 667 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 668 } 669 670 static void update_eir(struct hci_request *req) 671 { 672 struct hci_dev *hdev = req->hdev; 673 struct hci_cp_write_eir cp; 674 675 if (!hdev_is_powered(hdev)) 676 return; 677 678 if (!lmp_ext_inq_capable(hdev)) 679 return; 680 681 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 682 return; 683 684 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 685 return; 686 687 memset(&cp, 0, sizeof(cp)); 688 689 create_eir(hdev, cp.data); 690 691 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 692 return; 693 694 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 695 696 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 697 } 698 699 static u8 get_service_classes(struct hci_dev *hdev) 700 { 701 struct bt_uuid *uuid; 702 u8 val = 0; 703 704 list_for_each_entry(uuid, &hdev->uuids, list) 705 val |= uuid->svc_hint; 706 707 return val; 708 } 709 710 static void update_class(struct hci_request *req) 711 { 712 struct hci_dev *hdev = req->hdev; 713 u8 cod[3]; 714 715 BT_DBG("%s", hdev->name); 716 717 if (!hdev_is_powered(hdev)) 718 return; 719 720 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 721 return; 722 723 cod[0] = hdev->minor_class; 724 cod[1] = hdev->major_class; 725 cod[2] = get_service_classes(hdev); 726 727 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags)) 728 cod[1] |= 0x20; 729 730 if (memcmp(cod, hdev->dev_class, 3) == 0) 731 return; 732 733 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod); 734 } 735 736 static void service_cache_off(struct work_struct *work) 737 { 738 struct hci_dev *hdev = container_of(work, struct hci_dev, 739 service_cache.work); 740 struct hci_request req; 741 742 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 743 return; 744 745 hci_req_init(&req, hdev); 746 747 hci_dev_lock(hdev); 748 749 update_eir(&req); 750 update_class(&req); 751 752 hci_dev_unlock(hdev); 753 754 hci_req_run(&req, NULL); 755 } 756 757 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 758 { 759 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) 760 return; 761 762 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 763 764 /* Non-mgmt controlled devices get this bit set 765 * implicitly so that pairing works for them, however 766 * for mgmt we require user-space to explicitly enable 767 * it 768 */ 769 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 770 } 771 772 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 773 void *data, u16 data_len) 774 { 775 struct mgmt_rp_read_info rp; 776 777 BT_DBG("sock %p %s", sk, hdev->name); 778 779 hci_dev_lock(hdev); 780 781 memset(&rp, 0, sizeof(rp)); 782 783 bacpy(&rp.bdaddr, &hdev->bdaddr); 784 785 rp.version = hdev->hci_ver; 786 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 787 788 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 789 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 790 791 memcpy(rp.dev_class, hdev->dev_class, 3); 792 793 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 794 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 795 796 hci_dev_unlock(hdev); 797 798 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 799 sizeof(rp)); 800 } 801 802 static void mgmt_pending_free(struct pending_cmd *cmd) 803 { 804 sock_put(cmd->sk); 805 kfree(cmd->param); 806 kfree(cmd); 807 } 808 809 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode, 810 struct hci_dev *hdev, void *data, 811 u16 len) 812 { 813 struct pending_cmd *cmd; 814 815 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); 816 if (!cmd) 817 return NULL; 818 819 cmd->opcode = opcode; 820 cmd->index = hdev->id; 821 822 cmd->param = kmalloc(len, GFP_KERNEL); 823 if (!cmd->param) { 824 kfree(cmd); 825 return NULL; 826 } 827 828 if (data) 829 memcpy(cmd->param, data, len); 830 831 cmd->sk = sk; 832 sock_hold(sk); 833 834 list_add(&cmd->list, &hdev->mgmt_pending); 835 836 return cmd; 837 } 838 839 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, 840 void (*cb)(struct pending_cmd *cmd, 841 void *data), 842 void *data) 843 { 844 struct pending_cmd *cmd, *tmp; 845 846 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) { 847 if (opcode > 0 && cmd->opcode != opcode) 848 continue; 849 850 cb(cmd, data); 851 } 852 } 853 854 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev) 855 { 856 struct pending_cmd *cmd; 857 858 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 859 if (cmd->opcode == opcode) 860 return cmd; 861 } 862 863 return NULL; 864 } 865 866 static void mgmt_pending_remove(struct pending_cmd *cmd) 867 { 868 list_del(&cmd->list); 869 mgmt_pending_free(cmd); 870 } 871 872 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 873 { 874 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 875 876 return cmd_complete(sk, hdev->id, opcode, 0, &settings, 877 sizeof(settings)); 878 } 879 880 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 881 u16 len) 882 { 883 struct mgmt_mode *cp = data; 884 struct pending_cmd *cmd; 885 int err; 886 887 BT_DBG("request for %s", hdev->name); 888 889 if (cp->val != 0x00 && cp->val != 0x01) 890 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 891 MGMT_STATUS_INVALID_PARAMS); 892 893 hci_dev_lock(hdev); 894 895 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) { 896 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 897 MGMT_STATUS_BUSY); 898 goto failed; 899 } 900 901 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) { 902 cancel_delayed_work(&hdev->power_off); 903 904 if (cp->val) { 905 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, 906 data, len); 907 err = mgmt_powered(hdev, 1); 908 goto failed; 909 } 910 } 911 912 if (!!cp->val == hdev_is_powered(hdev)) { 913 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 914 goto failed; 915 } 916 917 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 918 if (!cmd) { 919 err = -ENOMEM; 920 goto failed; 921 } 922 923 if (cp->val) 924 queue_work(hdev->req_workqueue, &hdev->power_on); 925 else 926 queue_work(hdev->req_workqueue, &hdev->power_off.work); 927 928 err = 0; 929 930 failed: 931 hci_dev_unlock(hdev); 932 return err; 933 } 934 935 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len, 936 struct sock *skip_sk) 937 { 938 struct sk_buff *skb; 939 struct mgmt_hdr *hdr; 940 941 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL); 942 if (!skb) 943 return -ENOMEM; 944 945 hdr = (void *) skb_put(skb, sizeof(*hdr)); 946 hdr->opcode = cpu_to_le16(event); 947 if (hdev) 948 hdr->index = cpu_to_le16(hdev->id); 949 else 950 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE); 951 hdr->len = cpu_to_le16(data_len); 952 953 if (data) 954 memcpy(skb_put(skb, data_len), data, data_len); 955 956 /* Time stamp */ 957 __net_timestamp(skb); 958 959 hci_send_to_control(skb, skip_sk); 960 kfree_skb(skb); 961 962 return 0; 963 } 964 965 static int new_settings(struct hci_dev *hdev, struct sock *skip) 966 { 967 __le32 ev; 968 969 ev = cpu_to_le32(get_current_settings(hdev)); 970 971 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip); 972 } 973 974 struct cmd_lookup { 975 struct sock *sk; 976 struct hci_dev *hdev; 977 u8 mgmt_status; 978 }; 979 980 static void settings_rsp(struct pending_cmd *cmd, void *data) 981 { 982 struct cmd_lookup *match = data; 983 984 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 985 986 list_del(&cmd->list); 987 988 if (match->sk == NULL) { 989 match->sk = cmd->sk; 990 sock_hold(match->sk); 991 } 992 993 mgmt_pending_free(cmd); 994 } 995 996 static void cmd_status_rsp(struct pending_cmd *cmd, void *data) 997 { 998 u8 *status = data; 999 1000 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1001 mgmt_pending_remove(cmd); 1002 } 1003 1004 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1005 { 1006 if (!lmp_bredr_capable(hdev)) 1007 return MGMT_STATUS_NOT_SUPPORTED; 1008 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 1009 return MGMT_STATUS_REJECTED; 1010 else 1011 return MGMT_STATUS_SUCCESS; 1012 } 1013 1014 static u8 mgmt_le_support(struct hci_dev *hdev) 1015 { 1016 if (!lmp_le_capable(hdev)) 1017 return MGMT_STATUS_NOT_SUPPORTED; 1018 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 1019 return MGMT_STATUS_REJECTED; 1020 else 1021 return MGMT_STATUS_SUCCESS; 1022 } 1023 1024 static void set_discoverable_complete(struct hci_dev *hdev, u8 status) 1025 { 1026 struct pending_cmd *cmd; 1027 struct mgmt_mode *cp; 1028 bool changed; 1029 1030 BT_DBG("status 0x%02x", status); 1031 1032 hci_dev_lock(hdev); 1033 1034 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1035 if (!cmd) 1036 goto unlock; 1037 1038 if (status) { 1039 u8 mgmt_err = mgmt_status(status); 1040 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1041 goto remove_cmd; 1042 } 1043 1044 cp = cmd->param; 1045 if (cp->val) 1046 changed = !test_and_set_bit(HCI_DISCOVERABLE, 1047 &hdev->dev_flags); 1048 else 1049 changed = test_and_clear_bit(HCI_DISCOVERABLE, 1050 &hdev->dev_flags); 1051 1052 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1053 1054 if (changed) 1055 new_settings(hdev, cmd->sk); 1056 1057 remove_cmd: 1058 mgmt_pending_remove(cmd); 1059 1060 unlock: 1061 hci_dev_unlock(hdev); 1062 } 1063 1064 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1065 u16 len) 1066 { 1067 struct mgmt_cp_set_discoverable *cp = data; 1068 struct pending_cmd *cmd; 1069 struct hci_request req; 1070 u16 timeout; 1071 u8 scan, status; 1072 int err; 1073 1074 BT_DBG("request for %s", hdev->name); 1075 1076 status = mgmt_bredr_support(hdev); 1077 if (status) 1078 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1079 status); 1080 1081 if (cp->val != 0x00 && cp->val != 0x01) 1082 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1083 MGMT_STATUS_INVALID_PARAMS); 1084 1085 timeout = __le16_to_cpu(cp->timeout); 1086 if (!cp->val && timeout > 0) 1087 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1088 MGMT_STATUS_INVALID_PARAMS); 1089 1090 hci_dev_lock(hdev); 1091 1092 if (!hdev_is_powered(hdev) && timeout > 0) { 1093 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1094 MGMT_STATUS_NOT_POWERED); 1095 goto failed; 1096 } 1097 1098 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1099 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1100 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1101 MGMT_STATUS_BUSY); 1102 goto failed; 1103 } 1104 1105 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) { 1106 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1107 MGMT_STATUS_REJECTED); 1108 goto failed; 1109 } 1110 1111 if (!hdev_is_powered(hdev)) { 1112 bool changed = false; 1113 1114 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 1115 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 1116 changed = true; 1117 } 1118 1119 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1120 if (err < 0) 1121 goto failed; 1122 1123 if (changed) 1124 err = new_settings(hdev, sk); 1125 1126 goto failed; 1127 } 1128 1129 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 1130 if (hdev->discov_timeout > 0) { 1131 cancel_delayed_work(&hdev->discov_off); 1132 hdev->discov_timeout = 0; 1133 } 1134 1135 if (cp->val && timeout > 0) { 1136 hdev->discov_timeout = timeout; 1137 queue_delayed_work(hdev->workqueue, &hdev->discov_off, 1138 msecs_to_jiffies(hdev->discov_timeout * 1000)); 1139 } 1140 1141 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1142 goto failed; 1143 } 1144 1145 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1146 if (!cmd) { 1147 err = -ENOMEM; 1148 goto failed; 1149 } 1150 1151 hci_req_init(&req, hdev); 1152 1153 scan = SCAN_PAGE; 1154 1155 if (cp->val) 1156 scan |= SCAN_INQUIRY; 1157 else 1158 cancel_delayed_work(&hdev->discov_off); 1159 1160 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1161 1162 err = hci_req_run(&req, set_discoverable_complete); 1163 if (err < 0) 1164 mgmt_pending_remove(cmd); 1165 1166 if (cp->val) 1167 hdev->discov_timeout = timeout; 1168 1169 failed: 1170 hci_dev_unlock(hdev); 1171 return err; 1172 } 1173 1174 static void write_fast_connectable(struct hci_request *req, bool enable) 1175 { 1176 struct hci_dev *hdev = req->hdev; 1177 struct hci_cp_write_page_scan_activity acp; 1178 u8 type; 1179 1180 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 1181 return; 1182 1183 if (enable) { 1184 type = PAGE_SCAN_TYPE_INTERLACED; 1185 1186 /* 160 msec page scan interval */ 1187 acp.interval = __constant_cpu_to_le16(0x0100); 1188 } else { 1189 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 1190 1191 /* default 1.28 sec page scan */ 1192 acp.interval = __constant_cpu_to_le16(0x0800); 1193 } 1194 1195 acp.window = __constant_cpu_to_le16(0x0012); 1196 1197 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval || 1198 __cpu_to_le16(hdev->page_scan_window) != acp.window) 1199 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, 1200 sizeof(acp), &acp); 1201 1202 if (hdev->page_scan_type != type) 1203 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type); 1204 } 1205 1206 static u8 get_adv_type(struct hci_dev *hdev) 1207 { 1208 struct pending_cmd *cmd; 1209 bool connectable; 1210 1211 /* If there's a pending mgmt command the flag will not yet have 1212 * it's final value, so check for this first. 1213 */ 1214 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1215 if (cmd) { 1216 struct mgmt_mode *cp = cmd->param; 1217 connectable = !!cp->val; 1218 } else { 1219 connectable = test_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1220 } 1221 1222 return connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND; 1223 } 1224 1225 static void enable_advertising(struct hci_request *req) 1226 { 1227 struct hci_dev *hdev = req->hdev; 1228 struct hci_cp_le_set_adv_param cp; 1229 u8 enable = 0x01; 1230 1231 memset(&cp, 0, sizeof(cp)); 1232 cp.min_interval = __constant_cpu_to_le16(0x0800); 1233 cp.max_interval = __constant_cpu_to_le16(0x0800); 1234 cp.type = get_adv_type(hdev); 1235 if (bacmp(&hdev->bdaddr, BDADDR_ANY)) 1236 cp.own_address_type = ADDR_LE_DEV_PUBLIC; 1237 else 1238 cp.own_address_type = ADDR_LE_DEV_RANDOM; 1239 cp.channel_map = 0x07; 1240 1241 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 1242 1243 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 1244 } 1245 1246 static void disable_advertising(struct hci_request *req) 1247 { 1248 u8 enable = 0x00; 1249 1250 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 1251 } 1252 1253 static void set_connectable_complete(struct hci_dev *hdev, u8 status) 1254 { 1255 struct pending_cmd *cmd; 1256 struct mgmt_mode *cp; 1257 bool changed; 1258 1259 BT_DBG("status 0x%02x", status); 1260 1261 hci_dev_lock(hdev); 1262 1263 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1264 if (!cmd) 1265 goto unlock; 1266 1267 if (status) { 1268 u8 mgmt_err = mgmt_status(status); 1269 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1270 goto remove_cmd; 1271 } 1272 1273 cp = cmd->param; 1274 if (cp->val) 1275 changed = !test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1276 else 1277 changed = test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1278 1279 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1280 1281 if (changed) 1282 new_settings(hdev, cmd->sk); 1283 1284 remove_cmd: 1285 mgmt_pending_remove(cmd); 1286 1287 unlock: 1288 hci_dev_unlock(hdev); 1289 } 1290 1291 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1292 u16 len) 1293 { 1294 struct mgmt_mode *cp = data; 1295 struct pending_cmd *cmd; 1296 struct hci_request req; 1297 u8 scan; 1298 int err; 1299 1300 BT_DBG("request for %s", hdev->name); 1301 1302 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) && 1303 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 1304 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1305 MGMT_STATUS_REJECTED); 1306 1307 if (cp->val != 0x00 && cp->val != 0x01) 1308 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1309 MGMT_STATUS_INVALID_PARAMS); 1310 1311 hci_dev_lock(hdev); 1312 1313 if (!hdev_is_powered(hdev)) { 1314 bool changed = false; 1315 1316 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 1317 changed = true; 1318 1319 if (cp->val) { 1320 set_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1321 } else { 1322 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1323 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 1324 } 1325 1326 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1327 if (err < 0) 1328 goto failed; 1329 1330 if (changed) 1331 err = new_settings(hdev, sk); 1332 1333 goto failed; 1334 } 1335 1336 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1337 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1338 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1339 MGMT_STATUS_BUSY); 1340 goto failed; 1341 } 1342 1343 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1344 if (!cmd) { 1345 err = -ENOMEM; 1346 goto failed; 1347 } 1348 1349 hci_req_init(&req, hdev); 1350 1351 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) && 1352 cp->val != test_bit(HCI_PSCAN, &hdev->flags)) { 1353 if (cp->val) { 1354 scan = SCAN_PAGE; 1355 } else { 1356 scan = 0; 1357 1358 if (test_bit(HCI_ISCAN, &hdev->flags) && 1359 hdev->discov_timeout > 0) 1360 cancel_delayed_work(&hdev->discov_off); 1361 } 1362 1363 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1364 } 1365 1366 /* If we're going from non-connectable to connectable or 1367 * vice-versa when fast connectable is enabled ensure that fast 1368 * connectable gets disabled. write_fast_connectable won't do 1369 * anything if the page scan parameters are already what they 1370 * should be. 1371 */ 1372 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) 1373 write_fast_connectable(&req, false); 1374 1375 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && 1376 hci_conn_num(hdev, LE_LINK) == 0) { 1377 disable_advertising(&req); 1378 enable_advertising(&req); 1379 } 1380 1381 err = hci_req_run(&req, set_connectable_complete); 1382 if (err < 0) { 1383 mgmt_pending_remove(cmd); 1384 if (err == -ENODATA) 1385 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, 1386 hdev); 1387 goto failed; 1388 } 1389 1390 failed: 1391 hci_dev_unlock(hdev); 1392 return err; 1393 } 1394 1395 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data, 1396 u16 len) 1397 { 1398 struct mgmt_mode *cp = data; 1399 bool changed; 1400 int err; 1401 1402 BT_DBG("request for %s", hdev->name); 1403 1404 if (cp->val != 0x00 && cp->val != 0x01) 1405 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE, 1406 MGMT_STATUS_INVALID_PARAMS); 1407 1408 hci_dev_lock(hdev); 1409 1410 if (cp->val) 1411 changed = !test_and_set_bit(HCI_PAIRABLE, &hdev->dev_flags); 1412 else 1413 changed = test_and_clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 1414 1415 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev); 1416 if (err < 0) 1417 goto unlock; 1418 1419 if (changed) 1420 err = new_settings(hdev, sk); 1421 1422 unlock: 1423 hci_dev_unlock(hdev); 1424 return err; 1425 } 1426 1427 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1428 u16 len) 1429 { 1430 struct mgmt_mode *cp = data; 1431 struct pending_cmd *cmd; 1432 u8 val, status; 1433 int err; 1434 1435 BT_DBG("request for %s", hdev->name); 1436 1437 status = mgmt_bredr_support(hdev); 1438 if (status) 1439 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1440 status); 1441 1442 if (cp->val != 0x00 && cp->val != 0x01) 1443 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1444 MGMT_STATUS_INVALID_PARAMS); 1445 1446 hci_dev_lock(hdev); 1447 1448 if (!hdev_is_powered(hdev)) { 1449 bool changed = false; 1450 1451 if (!!cp->val != test_bit(HCI_LINK_SECURITY, 1452 &hdev->dev_flags)) { 1453 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 1454 changed = true; 1455 } 1456 1457 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1458 if (err < 0) 1459 goto failed; 1460 1461 if (changed) 1462 err = new_settings(hdev, sk); 1463 1464 goto failed; 1465 } 1466 1467 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1468 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1469 MGMT_STATUS_BUSY); 1470 goto failed; 1471 } 1472 1473 val = !!cp->val; 1474 1475 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1476 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1477 goto failed; 1478 } 1479 1480 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1481 if (!cmd) { 1482 err = -ENOMEM; 1483 goto failed; 1484 } 1485 1486 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1487 if (err < 0) { 1488 mgmt_pending_remove(cmd); 1489 goto failed; 1490 } 1491 1492 failed: 1493 hci_dev_unlock(hdev); 1494 return err; 1495 } 1496 1497 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1498 { 1499 struct mgmt_mode *cp = data; 1500 struct pending_cmd *cmd; 1501 u8 status; 1502 int err; 1503 1504 BT_DBG("request for %s", hdev->name); 1505 1506 status = mgmt_bredr_support(hdev); 1507 if (status) 1508 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1509 1510 if (!lmp_ssp_capable(hdev)) 1511 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1512 MGMT_STATUS_NOT_SUPPORTED); 1513 1514 if (cp->val != 0x00 && cp->val != 0x01) 1515 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1516 MGMT_STATUS_INVALID_PARAMS); 1517 1518 hci_dev_lock(hdev); 1519 1520 if (!hdev_is_powered(hdev)) { 1521 bool changed; 1522 1523 if (cp->val) { 1524 changed = !test_and_set_bit(HCI_SSP_ENABLED, 1525 &hdev->dev_flags); 1526 } else { 1527 changed = test_and_clear_bit(HCI_SSP_ENABLED, 1528 &hdev->dev_flags); 1529 if (!changed) 1530 changed = test_and_clear_bit(HCI_HS_ENABLED, 1531 &hdev->dev_flags); 1532 else 1533 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1534 } 1535 1536 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1537 if (err < 0) 1538 goto failed; 1539 1540 if (changed) 1541 err = new_settings(hdev, sk); 1542 1543 goto failed; 1544 } 1545 1546 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) || 1547 mgmt_pending_find(MGMT_OP_SET_HS, hdev)) { 1548 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1549 MGMT_STATUS_BUSY); 1550 goto failed; 1551 } 1552 1553 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) { 1554 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1555 goto failed; 1556 } 1557 1558 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1559 if (!cmd) { 1560 err = -ENOMEM; 1561 goto failed; 1562 } 1563 1564 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1565 if (err < 0) { 1566 mgmt_pending_remove(cmd); 1567 goto failed; 1568 } 1569 1570 failed: 1571 hci_dev_unlock(hdev); 1572 return err; 1573 } 1574 1575 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1576 { 1577 struct mgmt_mode *cp = data; 1578 bool changed; 1579 u8 status; 1580 int err; 1581 1582 BT_DBG("request for %s", hdev->name); 1583 1584 status = mgmt_bredr_support(hdev); 1585 if (status) 1586 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1587 1588 if (!lmp_ssp_capable(hdev)) 1589 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1590 MGMT_STATUS_NOT_SUPPORTED); 1591 1592 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 1593 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1594 MGMT_STATUS_REJECTED); 1595 1596 if (cp->val != 0x00 && cp->val != 0x01) 1597 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1598 MGMT_STATUS_INVALID_PARAMS); 1599 1600 hci_dev_lock(hdev); 1601 1602 if (cp->val) { 1603 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1604 } else { 1605 if (hdev_is_powered(hdev)) { 1606 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1607 MGMT_STATUS_REJECTED); 1608 goto unlock; 1609 } 1610 1611 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1612 } 1613 1614 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1615 if (err < 0) 1616 goto unlock; 1617 1618 if (changed) 1619 err = new_settings(hdev, sk); 1620 1621 unlock: 1622 hci_dev_unlock(hdev); 1623 return err; 1624 } 1625 1626 static void le_enable_complete(struct hci_dev *hdev, u8 status) 1627 { 1628 struct cmd_lookup match = { NULL, hdev }; 1629 1630 if (status) { 1631 u8 mgmt_err = mgmt_status(status); 1632 1633 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1634 &mgmt_err); 1635 return; 1636 } 1637 1638 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1639 1640 new_settings(hdev, match.sk); 1641 1642 if (match.sk) 1643 sock_put(match.sk); 1644 1645 /* Make sure the controller has a good default for 1646 * advertising data. Restrict the update to when LE 1647 * has actually been enabled. During power on, the 1648 * update in powered_update_hci will take care of it. 1649 */ 1650 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { 1651 struct hci_request req; 1652 1653 hci_dev_lock(hdev); 1654 1655 hci_req_init(&req, hdev); 1656 update_ad(&req); 1657 hci_req_run(&req, NULL); 1658 1659 hci_dev_unlock(hdev); 1660 } 1661 } 1662 1663 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1664 { 1665 struct mgmt_mode *cp = data; 1666 struct hci_cp_write_le_host_supported hci_cp; 1667 struct pending_cmd *cmd; 1668 struct hci_request req; 1669 int err; 1670 u8 val, enabled; 1671 1672 BT_DBG("request for %s", hdev->name); 1673 1674 if (!lmp_le_capable(hdev)) 1675 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1676 MGMT_STATUS_NOT_SUPPORTED); 1677 1678 if (cp->val != 0x00 && cp->val != 0x01) 1679 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1680 MGMT_STATUS_INVALID_PARAMS); 1681 1682 /* LE-only devices do not allow toggling LE on/off */ 1683 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 1684 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1685 MGMT_STATUS_REJECTED); 1686 1687 hci_dev_lock(hdev); 1688 1689 val = !!cp->val; 1690 enabled = lmp_host_le_capable(hdev); 1691 1692 if (!hdev_is_powered(hdev) || val == enabled) { 1693 bool changed = false; 1694 1695 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { 1696 change_bit(HCI_LE_ENABLED, &hdev->dev_flags); 1697 changed = true; 1698 } 1699 1700 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 1701 clear_bit(HCI_ADVERTISING, &hdev->dev_flags); 1702 changed = true; 1703 } 1704 1705 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1706 if (err < 0) 1707 goto unlock; 1708 1709 if (changed) 1710 err = new_settings(hdev, sk); 1711 1712 goto unlock; 1713 } 1714 1715 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) || 1716 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1717 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1718 MGMT_STATUS_BUSY); 1719 goto unlock; 1720 } 1721 1722 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1723 if (!cmd) { 1724 err = -ENOMEM; 1725 goto unlock; 1726 } 1727 1728 hci_req_init(&req, hdev); 1729 1730 memset(&hci_cp, 0, sizeof(hci_cp)); 1731 1732 if (val) { 1733 hci_cp.le = val; 1734 hci_cp.simul = lmp_le_br_capable(hdev); 1735 } else { 1736 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 1737 disable_advertising(&req); 1738 } 1739 1740 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 1741 &hci_cp); 1742 1743 err = hci_req_run(&req, le_enable_complete); 1744 if (err < 0) 1745 mgmt_pending_remove(cmd); 1746 1747 unlock: 1748 hci_dev_unlock(hdev); 1749 return err; 1750 } 1751 1752 /* This is a helper function to test for pending mgmt commands that can 1753 * cause CoD or EIR HCI commands. We can only allow one such pending 1754 * mgmt command at a time since otherwise we cannot easily track what 1755 * the current values are, will be, and based on that calculate if a new 1756 * HCI command needs to be sent and if yes with what value. 1757 */ 1758 static bool pending_eir_or_class(struct hci_dev *hdev) 1759 { 1760 struct pending_cmd *cmd; 1761 1762 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 1763 switch (cmd->opcode) { 1764 case MGMT_OP_ADD_UUID: 1765 case MGMT_OP_REMOVE_UUID: 1766 case MGMT_OP_SET_DEV_CLASS: 1767 case MGMT_OP_SET_POWERED: 1768 return true; 1769 } 1770 } 1771 1772 return false; 1773 } 1774 1775 static const u8 bluetooth_base_uuid[] = { 1776 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 1777 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 1778 }; 1779 1780 static u8 get_uuid_size(const u8 *uuid) 1781 { 1782 u32 val; 1783 1784 if (memcmp(uuid, bluetooth_base_uuid, 12)) 1785 return 128; 1786 1787 val = get_unaligned_le32(&uuid[12]); 1788 if (val > 0xffff) 1789 return 32; 1790 1791 return 16; 1792 } 1793 1794 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 1795 { 1796 struct pending_cmd *cmd; 1797 1798 hci_dev_lock(hdev); 1799 1800 cmd = mgmt_pending_find(mgmt_op, hdev); 1801 if (!cmd) 1802 goto unlock; 1803 1804 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status), 1805 hdev->dev_class, 3); 1806 1807 mgmt_pending_remove(cmd); 1808 1809 unlock: 1810 hci_dev_unlock(hdev); 1811 } 1812 1813 static void add_uuid_complete(struct hci_dev *hdev, u8 status) 1814 { 1815 BT_DBG("status 0x%02x", status); 1816 1817 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 1818 } 1819 1820 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1821 { 1822 struct mgmt_cp_add_uuid *cp = data; 1823 struct pending_cmd *cmd; 1824 struct hci_request req; 1825 struct bt_uuid *uuid; 1826 int err; 1827 1828 BT_DBG("request for %s", hdev->name); 1829 1830 hci_dev_lock(hdev); 1831 1832 if (pending_eir_or_class(hdev)) { 1833 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 1834 MGMT_STATUS_BUSY); 1835 goto failed; 1836 } 1837 1838 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 1839 if (!uuid) { 1840 err = -ENOMEM; 1841 goto failed; 1842 } 1843 1844 memcpy(uuid->uuid, cp->uuid, 16); 1845 uuid->svc_hint = cp->svc_hint; 1846 uuid->size = get_uuid_size(cp->uuid); 1847 1848 list_add_tail(&uuid->list, &hdev->uuids); 1849 1850 hci_req_init(&req, hdev); 1851 1852 update_class(&req); 1853 update_eir(&req); 1854 1855 err = hci_req_run(&req, add_uuid_complete); 1856 if (err < 0) { 1857 if (err != -ENODATA) 1858 goto failed; 1859 1860 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 1861 hdev->dev_class, 3); 1862 goto failed; 1863 } 1864 1865 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 1866 if (!cmd) { 1867 err = -ENOMEM; 1868 goto failed; 1869 } 1870 1871 err = 0; 1872 1873 failed: 1874 hci_dev_unlock(hdev); 1875 return err; 1876 } 1877 1878 static bool enable_service_cache(struct hci_dev *hdev) 1879 { 1880 if (!hdev_is_powered(hdev)) 1881 return false; 1882 1883 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1884 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 1885 CACHE_TIMEOUT); 1886 return true; 1887 } 1888 1889 return false; 1890 } 1891 1892 static void remove_uuid_complete(struct hci_dev *hdev, u8 status) 1893 { 1894 BT_DBG("status 0x%02x", status); 1895 1896 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 1897 } 1898 1899 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 1900 u16 len) 1901 { 1902 struct mgmt_cp_remove_uuid *cp = data; 1903 struct pending_cmd *cmd; 1904 struct bt_uuid *match, *tmp; 1905 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 1906 struct hci_request req; 1907 int err, found; 1908 1909 BT_DBG("request for %s", hdev->name); 1910 1911 hci_dev_lock(hdev); 1912 1913 if (pending_eir_or_class(hdev)) { 1914 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1915 MGMT_STATUS_BUSY); 1916 goto unlock; 1917 } 1918 1919 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 1920 err = hci_uuids_clear(hdev); 1921 1922 if (enable_service_cache(hdev)) { 1923 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1924 0, hdev->dev_class, 3); 1925 goto unlock; 1926 } 1927 1928 goto update_class; 1929 } 1930 1931 found = 0; 1932 1933 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 1934 if (memcmp(match->uuid, cp->uuid, 16) != 0) 1935 continue; 1936 1937 list_del(&match->list); 1938 kfree(match); 1939 found++; 1940 } 1941 1942 if (found == 0) { 1943 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1944 MGMT_STATUS_INVALID_PARAMS); 1945 goto unlock; 1946 } 1947 1948 update_class: 1949 hci_req_init(&req, hdev); 1950 1951 update_class(&req); 1952 update_eir(&req); 1953 1954 err = hci_req_run(&req, remove_uuid_complete); 1955 if (err < 0) { 1956 if (err != -ENODATA) 1957 goto unlock; 1958 1959 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 1960 hdev->dev_class, 3); 1961 goto unlock; 1962 } 1963 1964 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 1965 if (!cmd) { 1966 err = -ENOMEM; 1967 goto unlock; 1968 } 1969 1970 err = 0; 1971 1972 unlock: 1973 hci_dev_unlock(hdev); 1974 return err; 1975 } 1976 1977 static void set_class_complete(struct hci_dev *hdev, u8 status) 1978 { 1979 BT_DBG("status 0x%02x", status); 1980 1981 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 1982 } 1983 1984 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 1985 u16 len) 1986 { 1987 struct mgmt_cp_set_dev_class *cp = data; 1988 struct pending_cmd *cmd; 1989 struct hci_request req; 1990 int err; 1991 1992 BT_DBG("request for %s", hdev->name); 1993 1994 if (!lmp_bredr_capable(hdev)) 1995 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 1996 MGMT_STATUS_NOT_SUPPORTED); 1997 1998 hci_dev_lock(hdev); 1999 2000 if (pending_eir_or_class(hdev)) { 2001 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2002 MGMT_STATUS_BUSY); 2003 goto unlock; 2004 } 2005 2006 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2007 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2008 MGMT_STATUS_INVALID_PARAMS); 2009 goto unlock; 2010 } 2011 2012 hdev->major_class = cp->major; 2013 hdev->minor_class = cp->minor; 2014 2015 if (!hdev_is_powered(hdev)) { 2016 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2017 hdev->dev_class, 3); 2018 goto unlock; 2019 } 2020 2021 hci_req_init(&req, hdev); 2022 2023 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 2024 hci_dev_unlock(hdev); 2025 cancel_delayed_work_sync(&hdev->service_cache); 2026 hci_dev_lock(hdev); 2027 update_eir(&req); 2028 } 2029 2030 update_class(&req); 2031 2032 err = hci_req_run(&req, set_class_complete); 2033 if (err < 0) { 2034 if (err != -ENODATA) 2035 goto unlock; 2036 2037 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2038 hdev->dev_class, 3); 2039 goto unlock; 2040 } 2041 2042 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2043 if (!cmd) { 2044 err = -ENOMEM; 2045 goto unlock; 2046 } 2047 2048 err = 0; 2049 2050 unlock: 2051 hci_dev_unlock(hdev); 2052 return err; 2053 } 2054 2055 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2056 u16 len) 2057 { 2058 struct mgmt_cp_load_link_keys *cp = data; 2059 u16 key_count, expected_len; 2060 int i; 2061 2062 BT_DBG("request for %s", hdev->name); 2063 2064 if (!lmp_bredr_capable(hdev)) 2065 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2066 MGMT_STATUS_NOT_SUPPORTED); 2067 2068 key_count = __le16_to_cpu(cp->key_count); 2069 2070 expected_len = sizeof(*cp) + key_count * 2071 sizeof(struct mgmt_link_key_info); 2072 if (expected_len != len) { 2073 BT_ERR("load_link_keys: expected %u bytes, got %u bytes", 2074 len, expected_len); 2075 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2076 MGMT_STATUS_INVALID_PARAMS); 2077 } 2078 2079 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2080 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2081 MGMT_STATUS_INVALID_PARAMS); 2082 2083 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys, 2084 key_count); 2085 2086 for (i = 0; i < key_count; i++) { 2087 struct mgmt_link_key_info *key = &cp->keys[i]; 2088 2089 if (key->addr.type != BDADDR_BREDR) 2090 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2091 MGMT_STATUS_INVALID_PARAMS); 2092 } 2093 2094 hci_dev_lock(hdev); 2095 2096 hci_link_keys_clear(hdev); 2097 2098 if (cp->debug_keys) 2099 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 2100 else 2101 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 2102 2103 for (i = 0; i < key_count; i++) { 2104 struct mgmt_link_key_info *key = &cp->keys[i]; 2105 2106 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val, 2107 key->type, key->pin_len); 2108 } 2109 2110 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2111 2112 hci_dev_unlock(hdev); 2113 2114 return 0; 2115 } 2116 2117 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2118 u8 addr_type, struct sock *skip_sk) 2119 { 2120 struct mgmt_ev_device_unpaired ev; 2121 2122 bacpy(&ev.addr.bdaddr, bdaddr); 2123 ev.addr.type = addr_type; 2124 2125 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2126 skip_sk); 2127 } 2128 2129 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2130 u16 len) 2131 { 2132 struct mgmt_cp_unpair_device *cp = data; 2133 struct mgmt_rp_unpair_device rp; 2134 struct hci_cp_disconnect dc; 2135 struct pending_cmd *cmd; 2136 struct hci_conn *conn; 2137 int err; 2138 2139 memset(&rp, 0, sizeof(rp)); 2140 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2141 rp.addr.type = cp->addr.type; 2142 2143 if (!bdaddr_type_is_valid(cp->addr.type)) 2144 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2145 MGMT_STATUS_INVALID_PARAMS, 2146 &rp, sizeof(rp)); 2147 2148 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2149 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2150 MGMT_STATUS_INVALID_PARAMS, 2151 &rp, sizeof(rp)); 2152 2153 hci_dev_lock(hdev); 2154 2155 if (!hdev_is_powered(hdev)) { 2156 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2157 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 2158 goto unlock; 2159 } 2160 2161 if (cp->addr.type == BDADDR_BREDR) 2162 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2163 else 2164 err = hci_remove_ltk(hdev, &cp->addr.bdaddr); 2165 2166 if (err < 0) { 2167 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2168 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp)); 2169 goto unlock; 2170 } 2171 2172 if (cp->disconnect) { 2173 if (cp->addr.type == BDADDR_BREDR) 2174 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2175 &cp->addr.bdaddr); 2176 else 2177 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, 2178 &cp->addr.bdaddr); 2179 } else { 2180 conn = NULL; 2181 } 2182 2183 if (!conn) { 2184 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2185 &rp, sizeof(rp)); 2186 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2187 goto unlock; 2188 } 2189 2190 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2191 sizeof(*cp)); 2192 if (!cmd) { 2193 err = -ENOMEM; 2194 goto unlock; 2195 } 2196 2197 dc.handle = cpu_to_le16(conn->handle); 2198 dc.reason = 0x13; /* Remote User Terminated Connection */ 2199 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 2200 if (err < 0) 2201 mgmt_pending_remove(cmd); 2202 2203 unlock: 2204 hci_dev_unlock(hdev); 2205 return err; 2206 } 2207 2208 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2209 u16 len) 2210 { 2211 struct mgmt_cp_disconnect *cp = data; 2212 struct mgmt_rp_disconnect rp; 2213 struct hci_cp_disconnect dc; 2214 struct pending_cmd *cmd; 2215 struct hci_conn *conn; 2216 int err; 2217 2218 BT_DBG(""); 2219 2220 memset(&rp, 0, sizeof(rp)); 2221 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2222 rp.addr.type = cp->addr.type; 2223 2224 if (!bdaddr_type_is_valid(cp->addr.type)) 2225 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2226 MGMT_STATUS_INVALID_PARAMS, 2227 &rp, sizeof(rp)); 2228 2229 hci_dev_lock(hdev); 2230 2231 if (!test_bit(HCI_UP, &hdev->flags)) { 2232 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2233 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 2234 goto failed; 2235 } 2236 2237 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) { 2238 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2239 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2240 goto failed; 2241 } 2242 2243 if (cp->addr.type == BDADDR_BREDR) 2244 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2245 &cp->addr.bdaddr); 2246 else 2247 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 2248 2249 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2250 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2251 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp)); 2252 goto failed; 2253 } 2254 2255 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2256 if (!cmd) { 2257 err = -ENOMEM; 2258 goto failed; 2259 } 2260 2261 dc.handle = cpu_to_le16(conn->handle); 2262 dc.reason = HCI_ERROR_REMOTE_USER_TERM; 2263 2264 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 2265 if (err < 0) 2266 mgmt_pending_remove(cmd); 2267 2268 failed: 2269 hci_dev_unlock(hdev); 2270 return err; 2271 } 2272 2273 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2274 { 2275 switch (link_type) { 2276 case LE_LINK: 2277 switch (addr_type) { 2278 case ADDR_LE_DEV_PUBLIC: 2279 return BDADDR_LE_PUBLIC; 2280 2281 default: 2282 /* Fallback to LE Random address type */ 2283 return BDADDR_LE_RANDOM; 2284 } 2285 2286 default: 2287 /* Fallback to BR/EDR type */ 2288 return BDADDR_BREDR; 2289 } 2290 } 2291 2292 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2293 u16 data_len) 2294 { 2295 struct mgmt_rp_get_connections *rp; 2296 struct hci_conn *c; 2297 size_t rp_len; 2298 int err; 2299 u16 i; 2300 2301 BT_DBG(""); 2302 2303 hci_dev_lock(hdev); 2304 2305 if (!hdev_is_powered(hdev)) { 2306 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2307 MGMT_STATUS_NOT_POWERED); 2308 goto unlock; 2309 } 2310 2311 i = 0; 2312 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2313 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2314 i++; 2315 } 2316 2317 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2318 rp = kmalloc(rp_len, GFP_KERNEL); 2319 if (!rp) { 2320 err = -ENOMEM; 2321 goto unlock; 2322 } 2323 2324 i = 0; 2325 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2326 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2327 continue; 2328 bacpy(&rp->addr[i].bdaddr, &c->dst); 2329 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2330 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2331 continue; 2332 i++; 2333 } 2334 2335 rp->conn_count = cpu_to_le16(i); 2336 2337 /* Recalculate length in case of filtered SCO connections, etc */ 2338 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2339 2340 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2341 rp_len); 2342 2343 kfree(rp); 2344 2345 unlock: 2346 hci_dev_unlock(hdev); 2347 return err; 2348 } 2349 2350 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2351 struct mgmt_cp_pin_code_neg_reply *cp) 2352 { 2353 struct pending_cmd *cmd; 2354 int err; 2355 2356 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2357 sizeof(*cp)); 2358 if (!cmd) 2359 return -ENOMEM; 2360 2361 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2362 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2363 if (err < 0) 2364 mgmt_pending_remove(cmd); 2365 2366 return err; 2367 } 2368 2369 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2370 u16 len) 2371 { 2372 struct hci_conn *conn; 2373 struct mgmt_cp_pin_code_reply *cp = data; 2374 struct hci_cp_pin_code_reply reply; 2375 struct pending_cmd *cmd; 2376 int err; 2377 2378 BT_DBG(""); 2379 2380 hci_dev_lock(hdev); 2381 2382 if (!hdev_is_powered(hdev)) { 2383 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2384 MGMT_STATUS_NOT_POWERED); 2385 goto failed; 2386 } 2387 2388 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2389 if (!conn) { 2390 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2391 MGMT_STATUS_NOT_CONNECTED); 2392 goto failed; 2393 } 2394 2395 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2396 struct mgmt_cp_pin_code_neg_reply ncp; 2397 2398 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2399 2400 BT_ERR("PIN code is not 16 bytes long"); 2401 2402 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2403 if (err >= 0) 2404 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2405 MGMT_STATUS_INVALID_PARAMS); 2406 2407 goto failed; 2408 } 2409 2410 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2411 if (!cmd) { 2412 err = -ENOMEM; 2413 goto failed; 2414 } 2415 2416 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2417 reply.pin_len = cp->pin_len; 2418 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2419 2420 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2421 if (err < 0) 2422 mgmt_pending_remove(cmd); 2423 2424 failed: 2425 hci_dev_unlock(hdev); 2426 return err; 2427 } 2428 2429 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2430 u16 len) 2431 { 2432 struct mgmt_cp_set_io_capability *cp = data; 2433 2434 BT_DBG(""); 2435 2436 hci_dev_lock(hdev); 2437 2438 hdev->io_capability = cp->io_capability; 2439 2440 BT_DBG("%s IO capability set to 0x%02x", hdev->name, 2441 hdev->io_capability); 2442 2443 hci_dev_unlock(hdev); 2444 2445 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 2446 0); 2447 } 2448 2449 static struct pending_cmd *find_pairing(struct hci_conn *conn) 2450 { 2451 struct hci_dev *hdev = conn->hdev; 2452 struct pending_cmd *cmd; 2453 2454 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2455 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2456 continue; 2457 2458 if (cmd->user_data != conn) 2459 continue; 2460 2461 return cmd; 2462 } 2463 2464 return NULL; 2465 } 2466 2467 static void pairing_complete(struct pending_cmd *cmd, u8 status) 2468 { 2469 struct mgmt_rp_pair_device rp; 2470 struct hci_conn *conn = cmd->user_data; 2471 2472 bacpy(&rp.addr.bdaddr, &conn->dst); 2473 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2474 2475 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status, 2476 &rp, sizeof(rp)); 2477 2478 /* So we don't get further callbacks for this connection */ 2479 conn->connect_cfm_cb = NULL; 2480 conn->security_cfm_cb = NULL; 2481 conn->disconn_cfm_cb = NULL; 2482 2483 hci_conn_drop(conn); 2484 2485 mgmt_pending_remove(cmd); 2486 } 2487 2488 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2489 { 2490 struct pending_cmd *cmd; 2491 2492 BT_DBG("status %u", status); 2493 2494 cmd = find_pairing(conn); 2495 if (!cmd) 2496 BT_DBG("Unable to find a pending command"); 2497 else 2498 pairing_complete(cmd, mgmt_status(status)); 2499 } 2500 2501 static void le_connect_complete_cb(struct hci_conn *conn, u8 status) 2502 { 2503 struct pending_cmd *cmd; 2504 2505 BT_DBG("status %u", status); 2506 2507 if (!status) 2508 return; 2509 2510 cmd = find_pairing(conn); 2511 if (!cmd) 2512 BT_DBG("Unable to find a pending command"); 2513 else 2514 pairing_complete(cmd, mgmt_status(status)); 2515 } 2516 2517 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2518 u16 len) 2519 { 2520 struct mgmt_cp_pair_device *cp = data; 2521 struct mgmt_rp_pair_device rp; 2522 struct pending_cmd *cmd; 2523 u8 sec_level, auth_type; 2524 struct hci_conn *conn; 2525 int err; 2526 2527 BT_DBG(""); 2528 2529 memset(&rp, 0, sizeof(rp)); 2530 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2531 rp.addr.type = cp->addr.type; 2532 2533 if (!bdaddr_type_is_valid(cp->addr.type)) 2534 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2535 MGMT_STATUS_INVALID_PARAMS, 2536 &rp, sizeof(rp)); 2537 2538 hci_dev_lock(hdev); 2539 2540 if (!hdev_is_powered(hdev)) { 2541 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2542 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 2543 goto unlock; 2544 } 2545 2546 sec_level = BT_SECURITY_MEDIUM; 2547 if (cp->io_cap == 0x03) 2548 auth_type = HCI_AT_DEDICATED_BONDING; 2549 else 2550 auth_type = HCI_AT_DEDICATED_BONDING_MITM; 2551 2552 if (cp->addr.type == BDADDR_BREDR) 2553 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, 2554 cp->addr.type, sec_level, auth_type); 2555 else 2556 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, 2557 cp->addr.type, sec_level, auth_type); 2558 2559 if (IS_ERR(conn)) { 2560 int status; 2561 2562 if (PTR_ERR(conn) == -EBUSY) 2563 status = MGMT_STATUS_BUSY; 2564 else 2565 status = MGMT_STATUS_CONNECT_FAILED; 2566 2567 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2568 status, &rp, 2569 sizeof(rp)); 2570 goto unlock; 2571 } 2572 2573 if (conn->connect_cfm_cb) { 2574 hci_conn_drop(conn); 2575 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2576 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2577 goto unlock; 2578 } 2579 2580 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 2581 if (!cmd) { 2582 err = -ENOMEM; 2583 hci_conn_drop(conn); 2584 goto unlock; 2585 } 2586 2587 /* For LE, just connecting isn't a proof that the pairing finished */ 2588 if (cp->addr.type == BDADDR_BREDR) 2589 conn->connect_cfm_cb = pairing_complete_cb; 2590 else 2591 conn->connect_cfm_cb = le_connect_complete_cb; 2592 2593 conn->security_cfm_cb = pairing_complete_cb; 2594 conn->disconn_cfm_cb = pairing_complete_cb; 2595 conn->io_capability = cp->io_cap; 2596 cmd->user_data = conn; 2597 2598 if (conn->state == BT_CONNECTED && 2599 hci_conn_security(conn, sec_level, auth_type)) 2600 pairing_complete(cmd, 0); 2601 2602 err = 0; 2603 2604 unlock: 2605 hci_dev_unlock(hdev); 2606 return err; 2607 } 2608 2609 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2610 u16 len) 2611 { 2612 struct mgmt_addr_info *addr = data; 2613 struct pending_cmd *cmd; 2614 struct hci_conn *conn; 2615 int err; 2616 2617 BT_DBG(""); 2618 2619 hci_dev_lock(hdev); 2620 2621 if (!hdev_is_powered(hdev)) { 2622 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2623 MGMT_STATUS_NOT_POWERED); 2624 goto unlock; 2625 } 2626 2627 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev); 2628 if (!cmd) { 2629 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2630 MGMT_STATUS_INVALID_PARAMS); 2631 goto unlock; 2632 } 2633 2634 conn = cmd->user_data; 2635 2636 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 2637 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2638 MGMT_STATUS_INVALID_PARAMS); 2639 goto unlock; 2640 } 2641 2642 pairing_complete(cmd, MGMT_STATUS_CANCELLED); 2643 2644 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 2645 addr, sizeof(*addr)); 2646 unlock: 2647 hci_dev_unlock(hdev); 2648 return err; 2649 } 2650 2651 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 2652 struct mgmt_addr_info *addr, u16 mgmt_op, 2653 u16 hci_op, __le32 passkey) 2654 { 2655 struct pending_cmd *cmd; 2656 struct hci_conn *conn; 2657 int err; 2658 2659 hci_dev_lock(hdev); 2660 2661 if (!hdev_is_powered(hdev)) { 2662 err = cmd_complete(sk, hdev->id, mgmt_op, 2663 MGMT_STATUS_NOT_POWERED, addr, 2664 sizeof(*addr)); 2665 goto done; 2666 } 2667 2668 if (addr->type == BDADDR_BREDR) 2669 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 2670 else 2671 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr); 2672 2673 if (!conn) { 2674 err = cmd_complete(sk, hdev->id, mgmt_op, 2675 MGMT_STATUS_NOT_CONNECTED, addr, 2676 sizeof(*addr)); 2677 goto done; 2678 } 2679 2680 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 2681 /* Continue with pairing via SMP */ 2682 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 2683 2684 if (!err) 2685 err = cmd_complete(sk, hdev->id, mgmt_op, 2686 MGMT_STATUS_SUCCESS, addr, 2687 sizeof(*addr)); 2688 else 2689 err = cmd_complete(sk, hdev->id, mgmt_op, 2690 MGMT_STATUS_FAILED, addr, 2691 sizeof(*addr)); 2692 2693 goto done; 2694 } 2695 2696 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 2697 if (!cmd) { 2698 err = -ENOMEM; 2699 goto done; 2700 } 2701 2702 /* Continue with pairing via HCI */ 2703 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 2704 struct hci_cp_user_passkey_reply cp; 2705 2706 bacpy(&cp.bdaddr, &addr->bdaddr); 2707 cp.passkey = passkey; 2708 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 2709 } else 2710 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 2711 &addr->bdaddr); 2712 2713 if (err < 0) 2714 mgmt_pending_remove(cmd); 2715 2716 done: 2717 hci_dev_unlock(hdev); 2718 return err; 2719 } 2720 2721 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2722 void *data, u16 len) 2723 { 2724 struct mgmt_cp_pin_code_neg_reply *cp = data; 2725 2726 BT_DBG(""); 2727 2728 return user_pairing_resp(sk, hdev, &cp->addr, 2729 MGMT_OP_PIN_CODE_NEG_REPLY, 2730 HCI_OP_PIN_CODE_NEG_REPLY, 0); 2731 } 2732 2733 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2734 u16 len) 2735 { 2736 struct mgmt_cp_user_confirm_reply *cp = data; 2737 2738 BT_DBG(""); 2739 2740 if (len != sizeof(*cp)) 2741 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 2742 MGMT_STATUS_INVALID_PARAMS); 2743 2744 return user_pairing_resp(sk, hdev, &cp->addr, 2745 MGMT_OP_USER_CONFIRM_REPLY, 2746 HCI_OP_USER_CONFIRM_REPLY, 0); 2747 } 2748 2749 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 2750 void *data, u16 len) 2751 { 2752 struct mgmt_cp_user_confirm_neg_reply *cp = data; 2753 2754 BT_DBG(""); 2755 2756 return user_pairing_resp(sk, hdev, &cp->addr, 2757 MGMT_OP_USER_CONFIRM_NEG_REPLY, 2758 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 2759 } 2760 2761 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2762 u16 len) 2763 { 2764 struct mgmt_cp_user_passkey_reply *cp = data; 2765 2766 BT_DBG(""); 2767 2768 return user_pairing_resp(sk, hdev, &cp->addr, 2769 MGMT_OP_USER_PASSKEY_REPLY, 2770 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 2771 } 2772 2773 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 2774 void *data, u16 len) 2775 { 2776 struct mgmt_cp_user_passkey_neg_reply *cp = data; 2777 2778 BT_DBG(""); 2779 2780 return user_pairing_resp(sk, hdev, &cp->addr, 2781 MGMT_OP_USER_PASSKEY_NEG_REPLY, 2782 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 2783 } 2784 2785 static void update_name(struct hci_request *req) 2786 { 2787 struct hci_dev *hdev = req->hdev; 2788 struct hci_cp_write_local_name cp; 2789 2790 memcpy(cp.name, hdev->dev_name, sizeof(cp.name)); 2791 2792 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp); 2793 } 2794 2795 static void set_name_complete(struct hci_dev *hdev, u8 status) 2796 { 2797 struct mgmt_cp_set_local_name *cp; 2798 struct pending_cmd *cmd; 2799 2800 BT_DBG("status 0x%02x", status); 2801 2802 hci_dev_lock(hdev); 2803 2804 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 2805 if (!cmd) 2806 goto unlock; 2807 2808 cp = cmd->param; 2809 2810 if (status) 2811 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 2812 mgmt_status(status)); 2813 else 2814 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2815 cp, sizeof(*cp)); 2816 2817 mgmt_pending_remove(cmd); 2818 2819 unlock: 2820 hci_dev_unlock(hdev); 2821 } 2822 2823 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 2824 u16 len) 2825 { 2826 struct mgmt_cp_set_local_name *cp = data; 2827 struct pending_cmd *cmd; 2828 struct hci_request req; 2829 int err; 2830 2831 BT_DBG(""); 2832 2833 hci_dev_lock(hdev); 2834 2835 /* If the old values are the same as the new ones just return a 2836 * direct command complete event. 2837 */ 2838 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 2839 !memcmp(hdev->short_name, cp->short_name, 2840 sizeof(hdev->short_name))) { 2841 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2842 data, len); 2843 goto failed; 2844 } 2845 2846 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 2847 2848 if (!hdev_is_powered(hdev)) { 2849 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 2850 2851 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2852 data, len); 2853 if (err < 0) 2854 goto failed; 2855 2856 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len, 2857 sk); 2858 2859 goto failed; 2860 } 2861 2862 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 2863 if (!cmd) { 2864 err = -ENOMEM; 2865 goto failed; 2866 } 2867 2868 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 2869 2870 hci_req_init(&req, hdev); 2871 2872 if (lmp_bredr_capable(hdev)) { 2873 update_name(&req); 2874 update_eir(&req); 2875 } 2876 2877 if (lmp_le_capable(hdev)) 2878 update_ad(&req); 2879 2880 err = hci_req_run(&req, set_name_complete); 2881 if (err < 0) 2882 mgmt_pending_remove(cmd); 2883 2884 failed: 2885 hci_dev_unlock(hdev); 2886 return err; 2887 } 2888 2889 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 2890 void *data, u16 data_len) 2891 { 2892 struct pending_cmd *cmd; 2893 int err; 2894 2895 BT_DBG("%s", hdev->name); 2896 2897 hci_dev_lock(hdev); 2898 2899 if (!hdev_is_powered(hdev)) { 2900 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2901 MGMT_STATUS_NOT_POWERED); 2902 goto unlock; 2903 } 2904 2905 if (!lmp_ssp_capable(hdev)) { 2906 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2907 MGMT_STATUS_NOT_SUPPORTED); 2908 goto unlock; 2909 } 2910 2911 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 2912 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2913 MGMT_STATUS_BUSY); 2914 goto unlock; 2915 } 2916 2917 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 2918 if (!cmd) { 2919 err = -ENOMEM; 2920 goto unlock; 2921 } 2922 2923 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 2924 if (err < 0) 2925 mgmt_pending_remove(cmd); 2926 2927 unlock: 2928 hci_dev_unlock(hdev); 2929 return err; 2930 } 2931 2932 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2933 void *data, u16 len) 2934 { 2935 struct mgmt_cp_add_remote_oob_data *cp = data; 2936 u8 status; 2937 int err; 2938 2939 BT_DBG("%s ", hdev->name); 2940 2941 hci_dev_lock(hdev); 2942 2943 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash, 2944 cp->randomizer); 2945 if (err < 0) 2946 status = MGMT_STATUS_FAILED; 2947 else 2948 status = MGMT_STATUS_SUCCESS; 2949 2950 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status, 2951 &cp->addr, sizeof(cp->addr)); 2952 2953 hci_dev_unlock(hdev); 2954 return err; 2955 } 2956 2957 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2958 void *data, u16 len) 2959 { 2960 struct mgmt_cp_remove_remote_oob_data *cp = data; 2961 u8 status; 2962 int err; 2963 2964 BT_DBG("%s", hdev->name); 2965 2966 hci_dev_lock(hdev); 2967 2968 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr); 2969 if (err < 0) 2970 status = MGMT_STATUS_INVALID_PARAMS; 2971 else 2972 status = MGMT_STATUS_SUCCESS; 2973 2974 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 2975 status, &cp->addr, sizeof(cp->addr)); 2976 2977 hci_dev_unlock(hdev); 2978 return err; 2979 } 2980 2981 static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status) 2982 { 2983 struct pending_cmd *cmd; 2984 u8 type; 2985 int err; 2986 2987 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2988 2989 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 2990 if (!cmd) 2991 return -ENOENT; 2992 2993 type = hdev->discovery.type; 2994 2995 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 2996 &type, sizeof(type)); 2997 mgmt_pending_remove(cmd); 2998 2999 return err; 3000 } 3001 3002 static void start_discovery_complete(struct hci_dev *hdev, u8 status) 3003 { 3004 BT_DBG("status %d", status); 3005 3006 if (status) { 3007 hci_dev_lock(hdev); 3008 mgmt_start_discovery_failed(hdev, status); 3009 hci_dev_unlock(hdev); 3010 return; 3011 } 3012 3013 hci_dev_lock(hdev); 3014 hci_discovery_set_state(hdev, DISCOVERY_FINDING); 3015 hci_dev_unlock(hdev); 3016 3017 switch (hdev->discovery.type) { 3018 case DISCOV_TYPE_LE: 3019 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, 3020 DISCOV_LE_TIMEOUT); 3021 break; 3022 3023 case DISCOV_TYPE_INTERLEAVED: 3024 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, 3025 DISCOV_INTERLEAVED_TIMEOUT); 3026 break; 3027 3028 case DISCOV_TYPE_BREDR: 3029 break; 3030 3031 default: 3032 BT_ERR("Invalid discovery type %d", hdev->discovery.type); 3033 } 3034 } 3035 3036 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 3037 void *data, u16 len) 3038 { 3039 struct mgmt_cp_start_discovery *cp = data; 3040 struct pending_cmd *cmd; 3041 struct hci_cp_le_set_scan_param param_cp; 3042 struct hci_cp_le_set_scan_enable enable_cp; 3043 struct hci_cp_inquiry inq_cp; 3044 struct hci_request req; 3045 /* General inquiry access code (GIAC) */ 3046 u8 lap[3] = { 0x33, 0x8b, 0x9e }; 3047 u8 status; 3048 int err; 3049 3050 BT_DBG("%s", hdev->name); 3051 3052 hci_dev_lock(hdev); 3053 3054 if (!hdev_is_powered(hdev)) { 3055 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3056 MGMT_STATUS_NOT_POWERED); 3057 goto failed; 3058 } 3059 3060 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) { 3061 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3062 MGMT_STATUS_BUSY); 3063 goto failed; 3064 } 3065 3066 if (hdev->discovery.state != DISCOVERY_STOPPED) { 3067 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3068 MGMT_STATUS_BUSY); 3069 goto failed; 3070 } 3071 3072 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0); 3073 if (!cmd) { 3074 err = -ENOMEM; 3075 goto failed; 3076 } 3077 3078 hdev->discovery.type = cp->type; 3079 3080 hci_req_init(&req, hdev); 3081 3082 switch (hdev->discovery.type) { 3083 case DISCOV_TYPE_BREDR: 3084 status = mgmt_bredr_support(hdev); 3085 if (status) { 3086 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3087 status); 3088 mgmt_pending_remove(cmd); 3089 goto failed; 3090 } 3091 3092 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 3093 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3094 MGMT_STATUS_BUSY); 3095 mgmt_pending_remove(cmd); 3096 goto failed; 3097 } 3098 3099 hci_inquiry_cache_flush(hdev); 3100 3101 memset(&inq_cp, 0, sizeof(inq_cp)); 3102 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap)); 3103 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN; 3104 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp); 3105 break; 3106 3107 case DISCOV_TYPE_LE: 3108 case DISCOV_TYPE_INTERLEAVED: 3109 status = mgmt_le_support(hdev); 3110 if (status) { 3111 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3112 status); 3113 mgmt_pending_remove(cmd); 3114 goto failed; 3115 } 3116 3117 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED && 3118 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) { 3119 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3120 MGMT_STATUS_NOT_SUPPORTED); 3121 mgmt_pending_remove(cmd); 3122 goto failed; 3123 } 3124 3125 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 3126 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3127 MGMT_STATUS_REJECTED); 3128 mgmt_pending_remove(cmd); 3129 goto failed; 3130 } 3131 3132 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) { 3133 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3134 MGMT_STATUS_BUSY); 3135 mgmt_pending_remove(cmd); 3136 goto failed; 3137 } 3138 3139 memset(¶m_cp, 0, sizeof(param_cp)); 3140 param_cp.type = LE_SCAN_ACTIVE; 3141 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT); 3142 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN); 3143 if (bacmp(&hdev->bdaddr, BDADDR_ANY)) 3144 param_cp.own_address_type = ADDR_LE_DEV_PUBLIC; 3145 else 3146 param_cp.own_address_type = ADDR_LE_DEV_RANDOM; 3147 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp), 3148 ¶m_cp); 3149 3150 memset(&enable_cp, 0, sizeof(enable_cp)); 3151 enable_cp.enable = LE_SCAN_ENABLE; 3152 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 3153 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp), 3154 &enable_cp); 3155 break; 3156 3157 default: 3158 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 3159 MGMT_STATUS_INVALID_PARAMS); 3160 mgmt_pending_remove(cmd); 3161 goto failed; 3162 } 3163 3164 err = hci_req_run(&req, start_discovery_complete); 3165 if (err < 0) 3166 mgmt_pending_remove(cmd); 3167 else 3168 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 3169 3170 failed: 3171 hci_dev_unlock(hdev); 3172 return err; 3173 } 3174 3175 static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status) 3176 { 3177 struct pending_cmd *cmd; 3178 int err; 3179 3180 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 3181 if (!cmd) 3182 return -ENOENT; 3183 3184 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 3185 &hdev->discovery.type, sizeof(hdev->discovery.type)); 3186 mgmt_pending_remove(cmd); 3187 3188 return err; 3189 } 3190 3191 static void stop_discovery_complete(struct hci_dev *hdev, u8 status) 3192 { 3193 BT_DBG("status %d", status); 3194 3195 hci_dev_lock(hdev); 3196 3197 if (status) { 3198 mgmt_stop_discovery_failed(hdev, status); 3199 goto unlock; 3200 } 3201 3202 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3203 3204 unlock: 3205 hci_dev_unlock(hdev); 3206 } 3207 3208 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 3209 u16 len) 3210 { 3211 struct mgmt_cp_stop_discovery *mgmt_cp = data; 3212 struct pending_cmd *cmd; 3213 struct hci_cp_remote_name_req_cancel cp; 3214 struct inquiry_entry *e; 3215 struct hci_request req; 3216 struct hci_cp_le_set_scan_enable enable_cp; 3217 int err; 3218 3219 BT_DBG("%s", hdev->name); 3220 3221 hci_dev_lock(hdev); 3222 3223 if (!hci_discovery_active(hdev)) { 3224 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3225 MGMT_STATUS_REJECTED, &mgmt_cp->type, 3226 sizeof(mgmt_cp->type)); 3227 goto unlock; 3228 } 3229 3230 if (hdev->discovery.type != mgmt_cp->type) { 3231 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3232 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type, 3233 sizeof(mgmt_cp->type)); 3234 goto unlock; 3235 } 3236 3237 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0); 3238 if (!cmd) { 3239 err = -ENOMEM; 3240 goto unlock; 3241 } 3242 3243 hci_req_init(&req, hdev); 3244 3245 switch (hdev->discovery.state) { 3246 case DISCOVERY_FINDING: 3247 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 3248 hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL); 3249 } else { 3250 cancel_delayed_work(&hdev->le_scan_disable); 3251 3252 memset(&enable_cp, 0, sizeof(enable_cp)); 3253 enable_cp.enable = LE_SCAN_DISABLE; 3254 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, 3255 sizeof(enable_cp), &enable_cp); 3256 } 3257 3258 break; 3259 3260 case DISCOVERY_RESOLVING: 3261 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 3262 NAME_PENDING); 3263 if (!e) { 3264 mgmt_pending_remove(cmd); 3265 err = cmd_complete(sk, hdev->id, 3266 MGMT_OP_STOP_DISCOVERY, 0, 3267 &mgmt_cp->type, 3268 sizeof(mgmt_cp->type)); 3269 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3270 goto unlock; 3271 } 3272 3273 bacpy(&cp.bdaddr, &e->data.bdaddr); 3274 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp), 3275 &cp); 3276 3277 break; 3278 3279 default: 3280 BT_DBG("unknown discovery state %u", hdev->discovery.state); 3281 3282 mgmt_pending_remove(cmd); 3283 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3284 MGMT_STATUS_FAILED, &mgmt_cp->type, 3285 sizeof(mgmt_cp->type)); 3286 goto unlock; 3287 } 3288 3289 err = hci_req_run(&req, stop_discovery_complete); 3290 if (err < 0) 3291 mgmt_pending_remove(cmd); 3292 else 3293 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 3294 3295 unlock: 3296 hci_dev_unlock(hdev); 3297 return err; 3298 } 3299 3300 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 3301 u16 len) 3302 { 3303 struct mgmt_cp_confirm_name *cp = data; 3304 struct inquiry_entry *e; 3305 int err; 3306 3307 BT_DBG("%s", hdev->name); 3308 3309 hci_dev_lock(hdev); 3310 3311 if (!hci_discovery_active(hdev)) { 3312 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 3313 MGMT_STATUS_FAILED); 3314 goto failed; 3315 } 3316 3317 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 3318 if (!e) { 3319 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 3320 MGMT_STATUS_INVALID_PARAMS); 3321 goto failed; 3322 } 3323 3324 if (cp->name_known) { 3325 e->name_state = NAME_KNOWN; 3326 list_del(&e->list); 3327 } else { 3328 e->name_state = NAME_NEEDED; 3329 hci_inquiry_cache_update_resolve(hdev, e); 3330 } 3331 3332 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr, 3333 sizeof(cp->addr)); 3334 3335 failed: 3336 hci_dev_unlock(hdev); 3337 return err; 3338 } 3339 3340 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 3341 u16 len) 3342 { 3343 struct mgmt_cp_block_device *cp = data; 3344 u8 status; 3345 int err; 3346 3347 BT_DBG("%s", hdev->name); 3348 3349 if (!bdaddr_type_is_valid(cp->addr.type)) 3350 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 3351 MGMT_STATUS_INVALID_PARAMS, 3352 &cp->addr, sizeof(cp->addr)); 3353 3354 hci_dev_lock(hdev); 3355 3356 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type); 3357 if (err < 0) 3358 status = MGMT_STATUS_FAILED; 3359 else 3360 status = MGMT_STATUS_SUCCESS; 3361 3362 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 3363 &cp->addr, sizeof(cp->addr)); 3364 3365 hci_dev_unlock(hdev); 3366 3367 return err; 3368 } 3369 3370 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 3371 u16 len) 3372 { 3373 struct mgmt_cp_unblock_device *cp = data; 3374 u8 status; 3375 int err; 3376 3377 BT_DBG("%s", hdev->name); 3378 3379 if (!bdaddr_type_is_valid(cp->addr.type)) 3380 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 3381 MGMT_STATUS_INVALID_PARAMS, 3382 &cp->addr, sizeof(cp->addr)); 3383 3384 hci_dev_lock(hdev); 3385 3386 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type); 3387 if (err < 0) 3388 status = MGMT_STATUS_INVALID_PARAMS; 3389 else 3390 status = MGMT_STATUS_SUCCESS; 3391 3392 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 3393 &cp->addr, sizeof(cp->addr)); 3394 3395 hci_dev_unlock(hdev); 3396 3397 return err; 3398 } 3399 3400 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 3401 u16 len) 3402 { 3403 struct mgmt_cp_set_device_id *cp = data; 3404 struct hci_request req; 3405 int err; 3406 __u16 source; 3407 3408 BT_DBG("%s", hdev->name); 3409 3410 source = __le16_to_cpu(cp->source); 3411 3412 if (source > 0x0002) 3413 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 3414 MGMT_STATUS_INVALID_PARAMS); 3415 3416 hci_dev_lock(hdev); 3417 3418 hdev->devid_source = source; 3419 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 3420 hdev->devid_product = __le16_to_cpu(cp->product); 3421 hdev->devid_version = __le16_to_cpu(cp->version); 3422 3423 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0); 3424 3425 hci_req_init(&req, hdev); 3426 update_eir(&req); 3427 hci_req_run(&req, NULL); 3428 3429 hci_dev_unlock(hdev); 3430 3431 return err; 3432 } 3433 3434 static void set_advertising_complete(struct hci_dev *hdev, u8 status) 3435 { 3436 struct cmd_lookup match = { NULL, hdev }; 3437 3438 if (status) { 3439 u8 mgmt_err = mgmt_status(status); 3440 3441 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 3442 cmd_status_rsp, &mgmt_err); 3443 return; 3444 } 3445 3446 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 3447 &match); 3448 3449 new_settings(hdev, match.sk); 3450 3451 if (match.sk) 3452 sock_put(match.sk); 3453 } 3454 3455 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 3456 u16 len) 3457 { 3458 struct mgmt_mode *cp = data; 3459 struct pending_cmd *cmd; 3460 struct hci_request req; 3461 u8 val, enabled, status; 3462 int err; 3463 3464 BT_DBG("request for %s", hdev->name); 3465 3466 status = mgmt_le_support(hdev); 3467 if (status) 3468 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3469 status); 3470 3471 if (cp->val != 0x00 && cp->val != 0x01) 3472 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3473 MGMT_STATUS_INVALID_PARAMS); 3474 3475 hci_dev_lock(hdev); 3476 3477 val = !!cp->val; 3478 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags); 3479 3480 /* The following conditions are ones which mean that we should 3481 * not do any HCI communication but directly send a mgmt 3482 * response to user space (after toggling the flag if 3483 * necessary). 3484 */ 3485 if (!hdev_is_powered(hdev) || val == enabled || 3486 hci_conn_num(hdev, LE_LINK) > 0) { 3487 bool changed = false; 3488 3489 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 3490 change_bit(HCI_ADVERTISING, &hdev->dev_flags); 3491 changed = true; 3492 } 3493 3494 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 3495 if (err < 0) 3496 goto unlock; 3497 3498 if (changed) 3499 err = new_settings(hdev, sk); 3500 3501 goto unlock; 3502 } 3503 3504 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 3505 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) { 3506 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3507 MGMT_STATUS_BUSY); 3508 goto unlock; 3509 } 3510 3511 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 3512 if (!cmd) { 3513 err = -ENOMEM; 3514 goto unlock; 3515 } 3516 3517 hci_req_init(&req, hdev); 3518 3519 if (val) 3520 enable_advertising(&req); 3521 else 3522 disable_advertising(&req); 3523 3524 err = hci_req_run(&req, set_advertising_complete); 3525 if (err < 0) 3526 mgmt_pending_remove(cmd); 3527 3528 unlock: 3529 hci_dev_unlock(hdev); 3530 return err; 3531 } 3532 3533 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 3534 void *data, u16 len) 3535 { 3536 struct mgmt_cp_set_static_address *cp = data; 3537 int err; 3538 3539 BT_DBG("%s", hdev->name); 3540 3541 if (!lmp_le_capable(hdev)) 3542 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 3543 MGMT_STATUS_NOT_SUPPORTED); 3544 3545 if (hdev_is_powered(hdev)) 3546 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 3547 MGMT_STATUS_REJECTED); 3548 3549 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 3550 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 3551 return cmd_status(sk, hdev->id, 3552 MGMT_OP_SET_STATIC_ADDRESS, 3553 MGMT_STATUS_INVALID_PARAMS); 3554 3555 /* Two most significant bits shall be set */ 3556 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 3557 return cmd_status(sk, hdev->id, 3558 MGMT_OP_SET_STATIC_ADDRESS, 3559 MGMT_STATUS_INVALID_PARAMS); 3560 } 3561 3562 hci_dev_lock(hdev); 3563 3564 bacpy(&hdev->static_addr, &cp->bdaddr); 3565 3566 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0); 3567 3568 hci_dev_unlock(hdev); 3569 3570 return err; 3571 } 3572 3573 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 3574 void *data, u16 len) 3575 { 3576 struct mgmt_cp_set_scan_params *cp = data; 3577 __u16 interval, window; 3578 int err; 3579 3580 BT_DBG("%s", hdev->name); 3581 3582 if (!lmp_le_capable(hdev)) 3583 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 3584 MGMT_STATUS_NOT_SUPPORTED); 3585 3586 interval = __le16_to_cpu(cp->interval); 3587 3588 if (interval < 0x0004 || interval > 0x4000) 3589 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 3590 MGMT_STATUS_INVALID_PARAMS); 3591 3592 window = __le16_to_cpu(cp->window); 3593 3594 if (window < 0x0004 || window > 0x4000) 3595 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 3596 MGMT_STATUS_INVALID_PARAMS); 3597 3598 if (window > interval) 3599 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 3600 MGMT_STATUS_INVALID_PARAMS); 3601 3602 hci_dev_lock(hdev); 3603 3604 hdev->le_scan_interval = interval; 3605 hdev->le_scan_window = window; 3606 3607 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0); 3608 3609 hci_dev_unlock(hdev); 3610 3611 return err; 3612 } 3613 3614 static void fast_connectable_complete(struct hci_dev *hdev, u8 status) 3615 { 3616 struct pending_cmd *cmd; 3617 3618 BT_DBG("status 0x%02x", status); 3619 3620 hci_dev_lock(hdev); 3621 3622 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 3623 if (!cmd) 3624 goto unlock; 3625 3626 if (status) { 3627 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3628 mgmt_status(status)); 3629 } else { 3630 struct mgmt_mode *cp = cmd->param; 3631 3632 if (cp->val) 3633 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags); 3634 else 3635 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags); 3636 3637 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 3638 new_settings(hdev, cmd->sk); 3639 } 3640 3641 mgmt_pending_remove(cmd); 3642 3643 unlock: 3644 hci_dev_unlock(hdev); 3645 } 3646 3647 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 3648 void *data, u16 len) 3649 { 3650 struct mgmt_mode *cp = data; 3651 struct pending_cmd *cmd; 3652 struct hci_request req; 3653 int err; 3654 3655 BT_DBG("%s", hdev->name); 3656 3657 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) || 3658 hdev->hci_ver < BLUETOOTH_VER_1_2) 3659 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3660 MGMT_STATUS_NOT_SUPPORTED); 3661 3662 if (cp->val != 0x00 && cp->val != 0x01) 3663 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3664 MGMT_STATUS_INVALID_PARAMS); 3665 3666 if (!hdev_is_powered(hdev)) 3667 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3668 MGMT_STATUS_NOT_POWERED); 3669 3670 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3671 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3672 MGMT_STATUS_REJECTED); 3673 3674 hci_dev_lock(hdev); 3675 3676 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 3677 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3678 MGMT_STATUS_BUSY); 3679 goto unlock; 3680 } 3681 3682 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) { 3683 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 3684 hdev); 3685 goto unlock; 3686 } 3687 3688 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 3689 data, len); 3690 if (!cmd) { 3691 err = -ENOMEM; 3692 goto unlock; 3693 } 3694 3695 hci_req_init(&req, hdev); 3696 3697 write_fast_connectable(&req, cp->val); 3698 3699 err = hci_req_run(&req, fast_connectable_complete); 3700 if (err < 0) { 3701 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3702 MGMT_STATUS_FAILED); 3703 mgmt_pending_remove(cmd); 3704 } 3705 3706 unlock: 3707 hci_dev_unlock(hdev); 3708 3709 return err; 3710 } 3711 3712 static void set_bredr_scan(struct hci_request *req) 3713 { 3714 struct hci_dev *hdev = req->hdev; 3715 u8 scan = 0; 3716 3717 /* Ensure that fast connectable is disabled. This function will 3718 * not do anything if the page scan parameters are already what 3719 * they should be. 3720 */ 3721 write_fast_connectable(req, false); 3722 3723 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3724 scan |= SCAN_PAGE; 3725 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 3726 scan |= SCAN_INQUIRY; 3727 3728 if (scan) 3729 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 3730 } 3731 3732 static void set_bredr_complete(struct hci_dev *hdev, u8 status) 3733 { 3734 struct pending_cmd *cmd; 3735 3736 BT_DBG("status 0x%02x", status); 3737 3738 hci_dev_lock(hdev); 3739 3740 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev); 3741 if (!cmd) 3742 goto unlock; 3743 3744 if (status) { 3745 u8 mgmt_err = mgmt_status(status); 3746 3747 /* We need to restore the flag if related HCI commands 3748 * failed. 3749 */ 3750 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags); 3751 3752 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 3753 } else { 3754 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 3755 new_settings(hdev, cmd->sk); 3756 } 3757 3758 mgmt_pending_remove(cmd); 3759 3760 unlock: 3761 hci_dev_unlock(hdev); 3762 } 3763 3764 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 3765 { 3766 struct mgmt_mode *cp = data; 3767 struct pending_cmd *cmd; 3768 struct hci_request req; 3769 int err; 3770 3771 BT_DBG("request for %s", hdev->name); 3772 3773 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 3774 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3775 MGMT_STATUS_NOT_SUPPORTED); 3776 3777 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 3778 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3779 MGMT_STATUS_REJECTED); 3780 3781 if (cp->val != 0x00 && cp->val != 0x01) 3782 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3783 MGMT_STATUS_INVALID_PARAMS); 3784 3785 hci_dev_lock(hdev); 3786 3787 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) { 3788 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 3789 goto unlock; 3790 } 3791 3792 if (!hdev_is_powered(hdev)) { 3793 if (!cp->val) { 3794 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 3795 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 3796 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 3797 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags); 3798 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 3799 } 3800 3801 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags); 3802 3803 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 3804 if (err < 0) 3805 goto unlock; 3806 3807 err = new_settings(hdev, sk); 3808 goto unlock; 3809 } 3810 3811 /* Reject disabling when powered on */ 3812 if (!cp->val) { 3813 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3814 MGMT_STATUS_REJECTED); 3815 goto unlock; 3816 } 3817 3818 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) { 3819 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3820 MGMT_STATUS_BUSY); 3821 goto unlock; 3822 } 3823 3824 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 3825 if (!cmd) { 3826 err = -ENOMEM; 3827 goto unlock; 3828 } 3829 3830 /* We need to flip the bit already here so that update_ad 3831 * generates the correct flags. 3832 */ 3833 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags); 3834 3835 hci_req_init(&req, hdev); 3836 3837 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3838 set_bredr_scan(&req); 3839 3840 update_ad(&req); 3841 3842 err = hci_req_run(&req, set_bredr_complete); 3843 if (err < 0) 3844 mgmt_pending_remove(cmd); 3845 3846 unlock: 3847 hci_dev_unlock(hdev); 3848 return err; 3849 } 3850 3851 static bool ltk_is_valid(struct mgmt_ltk_info *key) 3852 { 3853 if (key->authenticated != 0x00 && key->authenticated != 0x01) 3854 return false; 3855 if (key->master != 0x00 && key->master != 0x01) 3856 return false; 3857 if (!bdaddr_type_is_le(key->addr.type)) 3858 return false; 3859 return true; 3860 } 3861 3862 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 3863 void *cp_data, u16 len) 3864 { 3865 struct mgmt_cp_load_long_term_keys *cp = cp_data; 3866 u16 key_count, expected_len; 3867 int i, err; 3868 3869 BT_DBG("request for %s", hdev->name); 3870 3871 if (!lmp_le_capable(hdev)) 3872 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 3873 MGMT_STATUS_NOT_SUPPORTED); 3874 3875 key_count = __le16_to_cpu(cp->key_count); 3876 3877 expected_len = sizeof(*cp) + key_count * 3878 sizeof(struct mgmt_ltk_info); 3879 if (expected_len != len) { 3880 BT_ERR("load_keys: expected %u bytes, got %u bytes", 3881 len, expected_len); 3882 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 3883 MGMT_STATUS_INVALID_PARAMS); 3884 } 3885 3886 BT_DBG("%s key_count %u", hdev->name, key_count); 3887 3888 for (i = 0; i < key_count; i++) { 3889 struct mgmt_ltk_info *key = &cp->keys[i]; 3890 3891 if (!ltk_is_valid(key)) 3892 return cmd_status(sk, hdev->id, 3893 MGMT_OP_LOAD_LONG_TERM_KEYS, 3894 MGMT_STATUS_INVALID_PARAMS); 3895 } 3896 3897 hci_dev_lock(hdev); 3898 3899 hci_smp_ltks_clear(hdev); 3900 3901 for (i = 0; i < key_count; i++) { 3902 struct mgmt_ltk_info *key = &cp->keys[i]; 3903 u8 type, addr_type; 3904 3905 if (key->addr.type == BDADDR_LE_PUBLIC) 3906 addr_type = ADDR_LE_DEV_PUBLIC; 3907 else 3908 addr_type = ADDR_LE_DEV_RANDOM; 3909 3910 if (key->master) 3911 type = HCI_SMP_LTK; 3912 else 3913 type = HCI_SMP_LTK_SLAVE; 3914 3915 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, 3916 type, 0, key->authenticated, key->val, 3917 key->enc_size, key->ediv, key->rand); 3918 } 3919 3920 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 3921 NULL, 0); 3922 3923 hci_dev_unlock(hdev); 3924 3925 return err; 3926 } 3927 3928 static const struct mgmt_handler { 3929 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data, 3930 u16 data_len); 3931 bool var_len; 3932 size_t data_len; 3933 } mgmt_handlers[] = { 3934 { NULL }, /* 0x0000 (no command) */ 3935 { read_version, false, MGMT_READ_VERSION_SIZE }, 3936 { read_commands, false, MGMT_READ_COMMANDS_SIZE }, 3937 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE }, 3938 { read_controller_info, false, MGMT_READ_INFO_SIZE }, 3939 { set_powered, false, MGMT_SETTING_SIZE }, 3940 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE }, 3941 { set_connectable, false, MGMT_SETTING_SIZE }, 3942 { set_fast_connectable, false, MGMT_SETTING_SIZE }, 3943 { set_pairable, false, MGMT_SETTING_SIZE }, 3944 { set_link_security, false, MGMT_SETTING_SIZE }, 3945 { set_ssp, false, MGMT_SETTING_SIZE }, 3946 { set_hs, false, MGMT_SETTING_SIZE }, 3947 { set_le, false, MGMT_SETTING_SIZE }, 3948 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE }, 3949 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE }, 3950 { add_uuid, false, MGMT_ADD_UUID_SIZE }, 3951 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE }, 3952 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE }, 3953 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE }, 3954 { disconnect, false, MGMT_DISCONNECT_SIZE }, 3955 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE }, 3956 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE }, 3957 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 3958 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE }, 3959 { pair_device, false, MGMT_PAIR_DEVICE_SIZE }, 3960 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 3961 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE }, 3962 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE }, 3963 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 3964 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE }, 3965 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 3966 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 3967 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE }, 3968 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 3969 { start_discovery, false, MGMT_START_DISCOVERY_SIZE }, 3970 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE }, 3971 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE }, 3972 { block_device, false, MGMT_BLOCK_DEVICE_SIZE }, 3973 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE }, 3974 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE }, 3975 { set_advertising, false, MGMT_SETTING_SIZE }, 3976 { set_bredr, false, MGMT_SETTING_SIZE }, 3977 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE }, 3978 { set_scan_params, false, MGMT_SET_SCAN_PARAMS_SIZE }, 3979 }; 3980 3981 3982 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen) 3983 { 3984 void *buf; 3985 u8 *cp; 3986 struct mgmt_hdr *hdr; 3987 u16 opcode, index, len; 3988 struct hci_dev *hdev = NULL; 3989 const struct mgmt_handler *handler; 3990 int err; 3991 3992 BT_DBG("got %zu bytes", msglen); 3993 3994 if (msglen < sizeof(*hdr)) 3995 return -EINVAL; 3996 3997 buf = kmalloc(msglen, GFP_KERNEL); 3998 if (!buf) 3999 return -ENOMEM; 4000 4001 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) { 4002 err = -EFAULT; 4003 goto done; 4004 } 4005 4006 hdr = buf; 4007 opcode = __le16_to_cpu(hdr->opcode); 4008 index = __le16_to_cpu(hdr->index); 4009 len = __le16_to_cpu(hdr->len); 4010 4011 if (len != msglen - sizeof(*hdr)) { 4012 err = -EINVAL; 4013 goto done; 4014 } 4015 4016 if (index != MGMT_INDEX_NONE) { 4017 hdev = hci_dev_get(index); 4018 if (!hdev) { 4019 err = cmd_status(sk, index, opcode, 4020 MGMT_STATUS_INVALID_INDEX); 4021 goto done; 4022 } 4023 4024 if (test_bit(HCI_SETUP, &hdev->dev_flags) || 4025 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) { 4026 err = cmd_status(sk, index, opcode, 4027 MGMT_STATUS_INVALID_INDEX); 4028 goto done; 4029 } 4030 } 4031 4032 if (opcode >= ARRAY_SIZE(mgmt_handlers) || 4033 mgmt_handlers[opcode].func == NULL) { 4034 BT_DBG("Unknown op %u", opcode); 4035 err = cmd_status(sk, index, opcode, 4036 MGMT_STATUS_UNKNOWN_COMMAND); 4037 goto done; 4038 } 4039 4040 if ((hdev && opcode < MGMT_OP_READ_INFO) || 4041 (!hdev && opcode >= MGMT_OP_READ_INFO)) { 4042 err = cmd_status(sk, index, opcode, 4043 MGMT_STATUS_INVALID_INDEX); 4044 goto done; 4045 } 4046 4047 handler = &mgmt_handlers[opcode]; 4048 4049 if ((handler->var_len && len < handler->data_len) || 4050 (!handler->var_len && len != handler->data_len)) { 4051 err = cmd_status(sk, index, opcode, 4052 MGMT_STATUS_INVALID_PARAMS); 4053 goto done; 4054 } 4055 4056 if (hdev) 4057 mgmt_init_hdev(sk, hdev); 4058 4059 cp = buf + sizeof(*hdr); 4060 4061 err = handler->func(sk, hdev, cp, len); 4062 if (err < 0) 4063 goto done; 4064 4065 err = msglen; 4066 4067 done: 4068 if (hdev) 4069 hci_dev_put(hdev); 4070 4071 kfree(buf); 4072 return err; 4073 } 4074 4075 void mgmt_index_added(struct hci_dev *hdev) 4076 { 4077 if (hdev->dev_type != HCI_BREDR) 4078 return; 4079 4080 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL); 4081 } 4082 4083 void mgmt_index_removed(struct hci_dev *hdev) 4084 { 4085 u8 status = MGMT_STATUS_INVALID_INDEX; 4086 4087 if (hdev->dev_type != HCI_BREDR) 4088 return; 4089 4090 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status); 4091 4092 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL); 4093 } 4094 4095 static void powered_complete(struct hci_dev *hdev, u8 status) 4096 { 4097 struct cmd_lookup match = { NULL, hdev }; 4098 4099 BT_DBG("status 0x%02x", status); 4100 4101 hci_dev_lock(hdev); 4102 4103 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 4104 4105 new_settings(hdev, match.sk); 4106 4107 hci_dev_unlock(hdev); 4108 4109 if (match.sk) 4110 sock_put(match.sk); 4111 } 4112 4113 static int powered_update_hci(struct hci_dev *hdev) 4114 { 4115 struct hci_request req; 4116 u8 link_sec; 4117 4118 hci_req_init(&req, hdev); 4119 4120 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) && 4121 !lmp_host_ssp_capable(hdev)) { 4122 u8 ssp = 1; 4123 4124 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp); 4125 } 4126 4127 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) && 4128 lmp_bredr_capable(hdev)) { 4129 struct hci_cp_write_le_host_supported cp; 4130 4131 cp.le = 1; 4132 cp.simul = lmp_le_br_capable(hdev); 4133 4134 /* Check first if we already have the right 4135 * host state (host features set) 4136 */ 4137 if (cp.le != lmp_host_le_capable(hdev) || 4138 cp.simul != lmp_host_le_br_capable(hdev)) 4139 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, 4140 sizeof(cp), &cp); 4141 } 4142 4143 if (lmp_le_capable(hdev)) { 4144 /* Set random address to static address if configured */ 4145 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 4146 hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6, 4147 &hdev->static_addr); 4148 4149 /* Make sure the controller has a good default for 4150 * advertising data. This also applies to the case 4151 * where BR/EDR was toggled during the AUTO_OFF phase. 4152 */ 4153 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 4154 update_ad(&req); 4155 4156 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 4157 enable_advertising(&req); 4158 } 4159 4160 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 4161 if (link_sec != test_bit(HCI_AUTH, &hdev->flags)) 4162 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE, 4163 sizeof(link_sec), &link_sec); 4164 4165 if (lmp_bredr_capable(hdev)) { 4166 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 4167 set_bredr_scan(&req); 4168 update_class(&req); 4169 update_name(&req); 4170 update_eir(&req); 4171 } 4172 4173 return hci_req_run(&req, powered_complete); 4174 } 4175 4176 int mgmt_powered(struct hci_dev *hdev, u8 powered) 4177 { 4178 struct cmd_lookup match = { NULL, hdev }; 4179 u8 status_not_powered = MGMT_STATUS_NOT_POWERED; 4180 u8 zero_cod[] = { 0, 0, 0 }; 4181 int err; 4182 4183 if (!test_bit(HCI_MGMT, &hdev->dev_flags)) 4184 return 0; 4185 4186 if (powered) { 4187 if (powered_update_hci(hdev) == 0) 4188 return 0; 4189 4190 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, 4191 &match); 4192 goto new_settings; 4193 } 4194 4195 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 4196 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered); 4197 4198 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) 4199 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 4200 zero_cod, sizeof(zero_cod), NULL); 4201 4202 new_settings: 4203 err = new_settings(hdev, match.sk); 4204 4205 if (match.sk) 4206 sock_put(match.sk); 4207 4208 return err; 4209 } 4210 4211 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 4212 { 4213 struct pending_cmd *cmd; 4214 u8 status; 4215 4216 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev); 4217 if (!cmd) 4218 return; 4219 4220 if (err == -ERFKILL) 4221 status = MGMT_STATUS_RFKILLED; 4222 else 4223 status = MGMT_STATUS_FAILED; 4224 4225 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 4226 4227 mgmt_pending_remove(cmd); 4228 } 4229 4230 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable) 4231 { 4232 bool changed = false; 4233 int err = 0; 4234 4235 /* Nothing needed here if there's a pending command since that 4236 * commands request completion callback takes care of everything 4237 * necessary. 4238 */ 4239 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 4240 return 0; 4241 4242 if (discoverable) { 4243 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 4244 changed = true; 4245 } else { 4246 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 4247 changed = true; 4248 } 4249 4250 if (changed) 4251 err = new_settings(hdev, NULL); 4252 4253 return err; 4254 } 4255 4256 int mgmt_connectable(struct hci_dev *hdev, u8 connectable) 4257 { 4258 bool changed = false; 4259 int err = 0; 4260 4261 /* Nothing needed here if there's a pending command since that 4262 * commands request completion callback takes care of everything 4263 * necessary. 4264 */ 4265 if (mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 4266 return 0; 4267 4268 if (connectable) { 4269 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 4270 changed = true; 4271 } else { 4272 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 4273 changed = true; 4274 } 4275 4276 if (changed) 4277 err = new_settings(hdev, NULL); 4278 4279 return err; 4280 } 4281 4282 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status) 4283 { 4284 u8 mgmt_err = mgmt_status(status); 4285 4286 if (scan & SCAN_PAGE) 4287 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, 4288 cmd_status_rsp, &mgmt_err); 4289 4290 if (scan & SCAN_INQUIRY) 4291 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, 4292 cmd_status_rsp, &mgmt_err); 4293 4294 return 0; 4295 } 4296 4297 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 4298 bool persistent) 4299 { 4300 struct mgmt_ev_new_link_key ev; 4301 4302 memset(&ev, 0, sizeof(ev)); 4303 4304 ev.store_hint = persistent; 4305 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 4306 ev.key.addr.type = BDADDR_BREDR; 4307 ev.key.type = key->type; 4308 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 4309 ev.key.pin_len = key->pin_len; 4310 4311 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 4312 } 4313 4314 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent) 4315 { 4316 struct mgmt_ev_new_long_term_key ev; 4317 4318 memset(&ev, 0, sizeof(ev)); 4319 4320 ev.store_hint = persistent; 4321 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 4322 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 4323 ev.key.authenticated = key->authenticated; 4324 ev.key.enc_size = key->enc_size; 4325 ev.key.ediv = key->ediv; 4326 4327 if (key->type == HCI_SMP_LTK) 4328 ev.key.master = 1; 4329 4330 memcpy(ev.key.rand, key->rand, sizeof(key->rand)); 4331 memcpy(ev.key.val, key->val, sizeof(key->val)); 4332 4333 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), 4334 NULL); 4335 } 4336 4337 void mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4338 u8 addr_type, u32 flags, u8 *name, u8 name_len, 4339 u8 *dev_class) 4340 { 4341 char buf[512]; 4342 struct mgmt_ev_device_connected *ev = (void *) buf; 4343 u16 eir_len = 0; 4344 4345 bacpy(&ev->addr.bdaddr, bdaddr); 4346 ev->addr.type = link_to_bdaddr(link_type, addr_type); 4347 4348 ev->flags = __cpu_to_le32(flags); 4349 4350 if (name_len > 0) 4351 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 4352 name, name_len); 4353 4354 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0) 4355 eir_len = eir_append_data(ev->eir, eir_len, 4356 EIR_CLASS_OF_DEV, dev_class, 3); 4357 4358 ev->eir_len = cpu_to_le16(eir_len); 4359 4360 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 4361 sizeof(*ev) + eir_len, NULL); 4362 } 4363 4364 static void disconnect_rsp(struct pending_cmd *cmd, void *data) 4365 { 4366 struct mgmt_cp_disconnect *cp = cmd->param; 4367 struct sock **sk = data; 4368 struct mgmt_rp_disconnect rp; 4369 4370 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4371 rp.addr.type = cp->addr.type; 4372 4373 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp, 4374 sizeof(rp)); 4375 4376 *sk = cmd->sk; 4377 sock_hold(*sk); 4378 4379 mgmt_pending_remove(cmd); 4380 } 4381 4382 static void unpair_device_rsp(struct pending_cmd *cmd, void *data) 4383 { 4384 struct hci_dev *hdev = data; 4385 struct mgmt_cp_unpair_device *cp = cmd->param; 4386 struct mgmt_rp_unpair_device rp; 4387 4388 memset(&rp, 0, sizeof(rp)); 4389 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4390 rp.addr.type = cp->addr.type; 4391 4392 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 4393 4394 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp)); 4395 4396 mgmt_pending_remove(cmd); 4397 } 4398 4399 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 4400 u8 link_type, u8 addr_type, u8 reason) 4401 { 4402 struct mgmt_ev_device_disconnected ev; 4403 struct sock *sk = NULL; 4404 4405 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 4406 4407 bacpy(&ev.addr.bdaddr, bdaddr); 4408 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4409 ev.reason = reason; 4410 4411 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 4412 4413 if (sk) 4414 sock_put(sk); 4415 4416 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 4417 hdev); 4418 } 4419 4420 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 4421 u8 link_type, u8 addr_type, u8 status) 4422 { 4423 struct mgmt_rp_disconnect rp; 4424 struct pending_cmd *cmd; 4425 4426 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 4427 hdev); 4428 4429 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev); 4430 if (!cmd) 4431 return; 4432 4433 bacpy(&rp.addr.bdaddr, bdaddr); 4434 rp.addr.type = link_to_bdaddr(link_type, addr_type); 4435 4436 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 4437 mgmt_status(status), &rp, sizeof(rp)); 4438 4439 mgmt_pending_remove(cmd); 4440 } 4441 4442 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4443 u8 addr_type, u8 status) 4444 { 4445 struct mgmt_ev_connect_failed ev; 4446 4447 bacpy(&ev.addr.bdaddr, bdaddr); 4448 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4449 ev.status = mgmt_status(status); 4450 4451 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 4452 } 4453 4454 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 4455 { 4456 struct mgmt_ev_pin_code_request ev; 4457 4458 bacpy(&ev.addr.bdaddr, bdaddr); 4459 ev.addr.type = BDADDR_BREDR; 4460 ev.secure = secure; 4461 4462 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), 4463 NULL); 4464 } 4465 4466 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4467 u8 status) 4468 { 4469 struct pending_cmd *cmd; 4470 struct mgmt_rp_pin_code_reply rp; 4471 int err; 4472 4473 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 4474 if (!cmd) 4475 return -ENOENT; 4476 4477 bacpy(&rp.addr.bdaddr, bdaddr); 4478 rp.addr.type = BDADDR_BREDR; 4479 4480 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 4481 mgmt_status(status), &rp, sizeof(rp)); 4482 4483 mgmt_pending_remove(cmd); 4484 4485 return err; 4486 } 4487 4488 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4489 u8 status) 4490 { 4491 struct pending_cmd *cmd; 4492 struct mgmt_rp_pin_code_reply rp; 4493 int err; 4494 4495 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 4496 if (!cmd) 4497 return -ENOENT; 4498 4499 bacpy(&rp.addr.bdaddr, bdaddr); 4500 rp.addr.type = BDADDR_BREDR; 4501 4502 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, 4503 mgmt_status(status), &rp, sizeof(rp)); 4504 4505 mgmt_pending_remove(cmd); 4506 4507 return err; 4508 } 4509 4510 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 4511 u8 link_type, u8 addr_type, __le32 value, 4512 u8 confirm_hint) 4513 { 4514 struct mgmt_ev_user_confirm_request ev; 4515 4516 BT_DBG("%s", hdev->name); 4517 4518 bacpy(&ev.addr.bdaddr, bdaddr); 4519 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4520 ev.confirm_hint = confirm_hint; 4521 ev.value = value; 4522 4523 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 4524 NULL); 4525 } 4526 4527 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 4528 u8 link_type, u8 addr_type) 4529 { 4530 struct mgmt_ev_user_passkey_request ev; 4531 4532 BT_DBG("%s", hdev->name); 4533 4534 bacpy(&ev.addr.bdaddr, bdaddr); 4535 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4536 4537 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 4538 NULL); 4539 } 4540 4541 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4542 u8 link_type, u8 addr_type, u8 status, 4543 u8 opcode) 4544 { 4545 struct pending_cmd *cmd; 4546 struct mgmt_rp_user_confirm_reply rp; 4547 int err; 4548 4549 cmd = mgmt_pending_find(opcode, hdev); 4550 if (!cmd) 4551 return -ENOENT; 4552 4553 bacpy(&rp.addr.bdaddr, bdaddr); 4554 rp.addr.type = link_to_bdaddr(link_type, addr_type); 4555 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status), 4556 &rp, sizeof(rp)); 4557 4558 mgmt_pending_remove(cmd); 4559 4560 return err; 4561 } 4562 4563 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4564 u8 link_type, u8 addr_type, u8 status) 4565 { 4566 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4567 status, MGMT_OP_USER_CONFIRM_REPLY); 4568 } 4569 4570 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4571 u8 link_type, u8 addr_type, u8 status) 4572 { 4573 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4574 status, 4575 MGMT_OP_USER_CONFIRM_NEG_REPLY); 4576 } 4577 4578 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4579 u8 link_type, u8 addr_type, u8 status) 4580 { 4581 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4582 status, MGMT_OP_USER_PASSKEY_REPLY); 4583 } 4584 4585 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4586 u8 link_type, u8 addr_type, u8 status) 4587 { 4588 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4589 status, 4590 MGMT_OP_USER_PASSKEY_NEG_REPLY); 4591 } 4592 4593 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 4594 u8 link_type, u8 addr_type, u32 passkey, 4595 u8 entered) 4596 { 4597 struct mgmt_ev_passkey_notify ev; 4598 4599 BT_DBG("%s", hdev->name); 4600 4601 bacpy(&ev.addr.bdaddr, bdaddr); 4602 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4603 ev.passkey = __cpu_to_le32(passkey); 4604 ev.entered = entered; 4605 4606 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 4607 } 4608 4609 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4610 u8 addr_type, u8 status) 4611 { 4612 struct mgmt_ev_auth_failed ev; 4613 4614 bacpy(&ev.addr.bdaddr, bdaddr); 4615 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4616 ev.status = mgmt_status(status); 4617 4618 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL); 4619 } 4620 4621 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 4622 { 4623 struct cmd_lookup match = { NULL, hdev }; 4624 bool changed = false; 4625 int err = 0; 4626 4627 if (status) { 4628 u8 mgmt_err = mgmt_status(status); 4629 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 4630 cmd_status_rsp, &mgmt_err); 4631 return 0; 4632 } 4633 4634 if (test_bit(HCI_AUTH, &hdev->flags)) { 4635 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 4636 changed = true; 4637 } else { 4638 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 4639 changed = true; 4640 } 4641 4642 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 4643 &match); 4644 4645 if (changed) 4646 err = new_settings(hdev, match.sk); 4647 4648 if (match.sk) 4649 sock_put(match.sk); 4650 4651 return err; 4652 } 4653 4654 static void clear_eir(struct hci_request *req) 4655 { 4656 struct hci_dev *hdev = req->hdev; 4657 struct hci_cp_write_eir cp; 4658 4659 if (!lmp_ext_inq_capable(hdev)) 4660 return; 4661 4662 memset(hdev->eir, 0, sizeof(hdev->eir)); 4663 4664 memset(&cp, 0, sizeof(cp)); 4665 4666 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 4667 } 4668 4669 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 4670 { 4671 struct cmd_lookup match = { NULL, hdev }; 4672 struct hci_request req; 4673 bool changed = false; 4674 int err = 0; 4675 4676 if (status) { 4677 u8 mgmt_err = mgmt_status(status); 4678 4679 if (enable && test_and_clear_bit(HCI_SSP_ENABLED, 4680 &hdev->dev_flags)) { 4681 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 4682 err = new_settings(hdev, NULL); 4683 } 4684 4685 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 4686 &mgmt_err); 4687 4688 return err; 4689 } 4690 4691 if (enable) { 4692 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 4693 } else { 4694 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 4695 if (!changed) 4696 changed = test_and_clear_bit(HCI_HS_ENABLED, 4697 &hdev->dev_flags); 4698 else 4699 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 4700 } 4701 4702 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 4703 4704 if (changed) 4705 err = new_settings(hdev, match.sk); 4706 4707 if (match.sk) 4708 sock_put(match.sk); 4709 4710 hci_req_init(&req, hdev); 4711 4712 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 4713 update_eir(&req); 4714 else 4715 clear_eir(&req); 4716 4717 hci_req_run(&req, NULL); 4718 4719 return err; 4720 } 4721 4722 static void sk_lookup(struct pending_cmd *cmd, void *data) 4723 { 4724 struct cmd_lookup *match = data; 4725 4726 if (match->sk == NULL) { 4727 match->sk = cmd->sk; 4728 sock_hold(match->sk); 4729 } 4730 } 4731 4732 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 4733 u8 status) 4734 { 4735 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 4736 int err = 0; 4737 4738 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 4739 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 4740 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 4741 4742 if (!status) 4743 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 4744 3, NULL); 4745 4746 if (match.sk) 4747 sock_put(match.sk); 4748 4749 return err; 4750 } 4751 4752 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 4753 { 4754 struct mgmt_cp_set_local_name ev; 4755 struct pending_cmd *cmd; 4756 4757 if (status) 4758 return 0; 4759 4760 memset(&ev, 0, sizeof(ev)); 4761 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 4762 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 4763 4764 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 4765 if (!cmd) { 4766 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 4767 4768 /* If this is a HCI command related to powering on the 4769 * HCI dev don't send any mgmt signals. 4770 */ 4771 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) 4772 return 0; 4773 } 4774 4775 return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 4776 cmd ? cmd->sk : NULL); 4777 } 4778 4779 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash, 4780 u8 *randomizer, u8 status) 4781 { 4782 struct pending_cmd *cmd; 4783 int err; 4784 4785 BT_DBG("%s status %u", hdev->name, status); 4786 4787 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 4788 if (!cmd) 4789 return -ENOENT; 4790 4791 if (status) { 4792 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4793 mgmt_status(status)); 4794 } else { 4795 struct mgmt_rp_read_local_oob_data rp; 4796 4797 memcpy(rp.hash, hash, sizeof(rp.hash)); 4798 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer)); 4799 4800 err = cmd_complete(cmd->sk, hdev->id, 4801 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp, 4802 sizeof(rp)); 4803 } 4804 4805 mgmt_pending_remove(cmd); 4806 4807 return err; 4808 } 4809 4810 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4811 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8 4812 ssp, u8 *eir, u16 eir_len) 4813 { 4814 char buf[512]; 4815 struct mgmt_ev_device_found *ev = (void *) buf; 4816 size_t ev_size; 4817 4818 if (!hci_discovery_active(hdev)) 4819 return; 4820 4821 /* Leave 5 bytes for a potential CoD field */ 4822 if (sizeof(*ev) + eir_len + 5 > sizeof(buf)) 4823 return; 4824 4825 memset(buf, 0, sizeof(buf)); 4826 4827 bacpy(&ev->addr.bdaddr, bdaddr); 4828 ev->addr.type = link_to_bdaddr(link_type, addr_type); 4829 ev->rssi = rssi; 4830 if (cfm_name) 4831 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME); 4832 if (!ssp) 4833 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING); 4834 4835 if (eir_len > 0) 4836 memcpy(ev->eir, eir, eir_len); 4837 4838 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV)) 4839 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 4840 dev_class, 3); 4841 4842 ev->eir_len = cpu_to_le16(eir_len); 4843 ev_size = sizeof(*ev) + eir_len; 4844 4845 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 4846 } 4847 4848 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4849 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 4850 { 4851 struct mgmt_ev_device_found *ev; 4852 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 4853 u16 eir_len; 4854 4855 ev = (struct mgmt_ev_device_found *) buf; 4856 4857 memset(buf, 0, sizeof(buf)); 4858 4859 bacpy(&ev->addr.bdaddr, bdaddr); 4860 ev->addr.type = link_to_bdaddr(link_type, addr_type); 4861 ev->rssi = rssi; 4862 4863 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 4864 name_len); 4865 4866 ev->eir_len = cpu_to_le16(eir_len); 4867 4868 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 4869 } 4870 4871 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 4872 { 4873 struct mgmt_ev_discovering ev; 4874 struct pending_cmd *cmd; 4875 4876 BT_DBG("%s discovering %u", hdev->name, discovering); 4877 4878 if (discovering) 4879 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 4880 else 4881 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 4882 4883 if (cmd != NULL) { 4884 u8 type = hdev->discovery.type; 4885 4886 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type, 4887 sizeof(type)); 4888 mgmt_pending_remove(cmd); 4889 } 4890 4891 memset(&ev, 0, sizeof(ev)); 4892 ev.type = hdev->discovery.type; 4893 ev.discovering = discovering; 4894 4895 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 4896 } 4897 4898 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 4899 { 4900 struct pending_cmd *cmd; 4901 struct mgmt_ev_device_blocked ev; 4902 4903 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev); 4904 4905 bacpy(&ev.addr.bdaddr, bdaddr); 4906 ev.addr.type = type; 4907 4908 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev), 4909 cmd ? cmd->sk : NULL); 4910 } 4911 4912 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 4913 { 4914 struct pending_cmd *cmd; 4915 struct mgmt_ev_device_unblocked ev; 4916 4917 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev); 4918 4919 bacpy(&ev.addr.bdaddr, bdaddr); 4920 ev.addr.type = type; 4921 4922 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev), 4923 cmd ? cmd->sk : NULL); 4924 } 4925 4926 static void adv_enable_complete(struct hci_dev *hdev, u8 status) 4927 { 4928 BT_DBG("%s status %u", hdev->name, status); 4929 4930 /* Clear the advertising mgmt setting if we failed to re-enable it */ 4931 if (status) { 4932 clear_bit(HCI_ADVERTISING, &hdev->dev_flags); 4933 new_settings(hdev, NULL); 4934 } 4935 } 4936 4937 void mgmt_reenable_advertising(struct hci_dev *hdev) 4938 { 4939 struct hci_request req; 4940 4941 if (hci_conn_num(hdev, LE_LINK) > 0) 4942 return; 4943 4944 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 4945 return; 4946 4947 hci_req_init(&req, hdev); 4948 enable_advertising(&req); 4949 4950 /* If this fails we have no option but to let user space know 4951 * that we've disabled advertising. 4952 */ 4953 if (hci_req_run(&req, adv_enable_complete) < 0) { 4954 clear_bit(HCI_ADVERTISING, &hdev->dev_flags); 4955 new_settings(hdev, NULL); 4956 } 4957 } 4958