1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/kernel.h> 28 #include <linux/uaccess.h> 29 #include <linux/module.h> 30 #include <asm/unaligned.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/mgmt.h> 35 #include <net/bluetooth/smp.h> 36 37 bool enable_hs; 38 bool enable_le; 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 0 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_PAIRABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 }; 82 83 static const u16 mgmt_events[] = { 84 MGMT_EV_CONTROLLER_ERROR, 85 MGMT_EV_INDEX_ADDED, 86 MGMT_EV_INDEX_REMOVED, 87 MGMT_EV_NEW_SETTINGS, 88 MGMT_EV_CLASS_OF_DEV_CHANGED, 89 MGMT_EV_LOCAL_NAME_CHANGED, 90 MGMT_EV_NEW_LINK_KEY, 91 MGMT_EV_NEW_LONG_TERM_KEY, 92 MGMT_EV_DEVICE_CONNECTED, 93 MGMT_EV_DEVICE_DISCONNECTED, 94 MGMT_EV_CONNECT_FAILED, 95 MGMT_EV_PIN_CODE_REQUEST, 96 MGMT_EV_USER_CONFIRM_REQUEST, 97 MGMT_EV_USER_PASSKEY_REQUEST, 98 MGMT_EV_AUTH_FAILED, 99 MGMT_EV_DEVICE_FOUND, 100 MGMT_EV_DISCOVERING, 101 MGMT_EV_DEVICE_BLOCKED, 102 MGMT_EV_DEVICE_UNBLOCKED, 103 MGMT_EV_DEVICE_UNPAIRED, 104 }; 105 106 /* 107 * These LE scan and inquiry parameters were chosen according to LE General 108 * Discovery Procedure specification. 109 */ 110 #define LE_SCAN_TYPE 0x01 111 #define LE_SCAN_WIN 0x12 112 #define LE_SCAN_INT 0x12 113 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */ 114 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */ 115 116 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */ 117 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */ 118 119 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 120 121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \ 122 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) 123 124 struct pending_cmd { 125 struct list_head list; 126 u16 opcode; 127 int index; 128 void *param; 129 struct sock *sk; 130 void *user_data; 131 }; 132 133 /* HCI to MGMT error code conversion table */ 134 static u8 mgmt_status_table[] = { 135 MGMT_STATUS_SUCCESS, 136 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 137 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 138 MGMT_STATUS_FAILED, /* Hardware Failure */ 139 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 140 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 141 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */ 142 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 143 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 144 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 145 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 146 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 147 MGMT_STATUS_BUSY, /* Command Disallowed */ 148 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 149 MGMT_STATUS_REJECTED, /* Rejected Security */ 150 MGMT_STATUS_REJECTED, /* Rejected Personal */ 151 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 152 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 153 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 154 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 155 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 156 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 157 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 158 MGMT_STATUS_BUSY, /* Repeated Attempts */ 159 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 160 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 161 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 162 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 163 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 164 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 165 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 166 MGMT_STATUS_FAILED, /* Unspecified Error */ 167 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 168 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 169 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 170 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 171 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 172 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 173 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 174 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 175 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 176 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 177 MGMT_STATUS_FAILED, /* Transaction Collision */ 178 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 179 MGMT_STATUS_REJECTED, /* QoS Rejected */ 180 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 181 MGMT_STATUS_REJECTED, /* Insufficient Security */ 182 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 183 MGMT_STATUS_BUSY, /* Role Switch Pending */ 184 MGMT_STATUS_FAILED, /* Slot Violation */ 185 MGMT_STATUS_FAILED, /* Role Switch Failed */ 186 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 187 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 188 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 189 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 190 MGMT_STATUS_BUSY, /* Controller Busy */ 191 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 192 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 193 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 194 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 195 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 196 }; 197 198 static u8 mgmt_status(u8 hci_status) 199 { 200 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 201 return mgmt_status_table[hci_status]; 202 203 return MGMT_STATUS_FAILED; 204 } 205 206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status) 207 { 208 struct sk_buff *skb; 209 struct mgmt_hdr *hdr; 210 struct mgmt_ev_cmd_status *ev; 211 int err; 212 213 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status); 214 215 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC); 216 if (!skb) 217 return -ENOMEM; 218 219 hdr = (void *) skb_put(skb, sizeof(*hdr)); 220 221 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS); 222 hdr->index = cpu_to_le16(index); 223 hdr->len = cpu_to_le16(sizeof(*ev)); 224 225 ev = (void *) skb_put(skb, sizeof(*ev)); 226 ev->status = status; 227 put_unaligned_le16(cmd, &ev->opcode); 228 229 err = sock_queue_rcv_skb(sk, skb); 230 if (err < 0) 231 kfree_skb(skb); 232 233 return err; 234 } 235 236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status, 237 void *rp, size_t rp_len) 238 { 239 struct sk_buff *skb; 240 struct mgmt_hdr *hdr; 241 struct mgmt_ev_cmd_complete *ev; 242 int err; 243 244 BT_DBG("sock %p", sk); 245 246 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC); 247 if (!skb) 248 return -ENOMEM; 249 250 hdr = (void *) skb_put(skb, sizeof(*hdr)); 251 252 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE); 253 hdr->index = cpu_to_le16(index); 254 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len); 255 256 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len); 257 put_unaligned_le16(cmd, &ev->opcode); 258 ev->status = status; 259 260 if (rp) 261 memcpy(ev->data, rp, rp_len); 262 263 err = sock_queue_rcv_skb(sk, skb); 264 if (err < 0) 265 kfree_skb(skb); 266 267 return err; 268 } 269 270 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 271 u16 data_len) 272 { 273 struct mgmt_rp_read_version rp; 274 275 BT_DBG("sock %p", sk); 276 277 rp.version = MGMT_VERSION; 278 put_unaligned_le16(MGMT_REVISION, &rp.revision); 279 280 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp, 281 sizeof(rp)); 282 } 283 284 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 285 u16 data_len) 286 { 287 struct mgmt_rp_read_commands *rp; 288 u16 num_commands = ARRAY_SIZE(mgmt_commands); 289 u16 num_events = ARRAY_SIZE(mgmt_events); 290 u16 *opcode; 291 size_t rp_size; 292 int i, err; 293 294 BT_DBG("sock %p", sk); 295 296 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 297 298 rp = kmalloc(rp_size, GFP_KERNEL); 299 if (!rp) 300 return -ENOMEM; 301 302 put_unaligned_le16(num_commands, &rp->num_commands); 303 put_unaligned_le16(num_events, &rp->num_events); 304 305 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++) 306 put_unaligned_le16(mgmt_commands[i], opcode); 307 308 for (i = 0; i < num_events; i++, opcode++) 309 put_unaligned_le16(mgmt_events[i], opcode); 310 311 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp, 312 rp_size); 313 kfree(rp); 314 315 return err; 316 } 317 318 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 319 u16 data_len) 320 { 321 struct mgmt_rp_read_index_list *rp; 322 struct list_head *p; 323 struct hci_dev *d; 324 size_t rp_len; 325 u16 count; 326 int i, err; 327 328 BT_DBG("sock %p", sk); 329 330 read_lock(&hci_dev_list_lock); 331 332 count = 0; 333 list_for_each(p, &hci_dev_list) { 334 count++; 335 } 336 337 rp_len = sizeof(*rp) + (2 * count); 338 rp = kmalloc(rp_len, GFP_ATOMIC); 339 if (!rp) { 340 read_unlock(&hci_dev_list_lock); 341 return -ENOMEM; 342 } 343 344 put_unaligned_le16(count, &rp->num_controllers); 345 346 i = 0; 347 list_for_each_entry(d, &hci_dev_list, list) { 348 if (test_bit(HCI_SETUP, &d->dev_flags)) 349 continue; 350 351 put_unaligned_le16(d->id, &rp->index[i++]); 352 BT_DBG("Added hci%u", d->id); 353 } 354 355 read_unlock(&hci_dev_list_lock); 356 357 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp, 358 rp_len); 359 360 kfree(rp); 361 362 return err; 363 } 364 365 static u32 get_supported_settings(struct hci_dev *hdev) 366 { 367 u32 settings = 0; 368 369 settings |= MGMT_SETTING_POWERED; 370 settings |= MGMT_SETTING_CONNECTABLE; 371 settings |= MGMT_SETTING_FAST_CONNECTABLE; 372 settings |= MGMT_SETTING_DISCOVERABLE; 373 settings |= MGMT_SETTING_PAIRABLE; 374 375 if (hdev->features[6] & LMP_SIMPLE_PAIR) 376 settings |= MGMT_SETTING_SSP; 377 378 if (!(hdev->features[4] & LMP_NO_BREDR)) { 379 settings |= MGMT_SETTING_BREDR; 380 settings |= MGMT_SETTING_LINK_SECURITY; 381 } 382 383 if (enable_hs) 384 settings |= MGMT_SETTING_HS; 385 386 if (enable_le) { 387 if (hdev->features[4] & LMP_LE) 388 settings |= MGMT_SETTING_LE; 389 } 390 391 return settings; 392 } 393 394 static u32 get_current_settings(struct hci_dev *hdev) 395 { 396 u32 settings = 0; 397 398 if (hdev_is_powered(hdev)) 399 settings |= MGMT_SETTING_POWERED; 400 401 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 402 settings |= MGMT_SETTING_CONNECTABLE; 403 404 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 405 settings |= MGMT_SETTING_DISCOVERABLE; 406 407 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags)) 408 settings |= MGMT_SETTING_PAIRABLE; 409 410 if (!(hdev->features[4] & LMP_NO_BREDR)) 411 settings |= MGMT_SETTING_BREDR; 412 413 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 414 settings |= MGMT_SETTING_LE; 415 416 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 417 settings |= MGMT_SETTING_LINK_SECURITY; 418 419 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 420 settings |= MGMT_SETTING_SSP; 421 422 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags)) 423 settings |= MGMT_SETTING_HS; 424 425 return settings; 426 } 427 428 #define PNP_INFO_SVCLASS_ID 0x1200 429 430 static u8 bluetooth_base_uuid[] = { 431 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80, 432 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 433 }; 434 435 static u16 get_uuid16(u8 *uuid128) 436 { 437 u32 val; 438 int i; 439 440 for (i = 0; i < 12; i++) { 441 if (bluetooth_base_uuid[i] != uuid128[i]) 442 return 0; 443 } 444 445 memcpy(&val, &uuid128[12], 4); 446 447 val = le32_to_cpu(val); 448 if (val > 0xffff) 449 return 0; 450 451 return (u16) val; 452 } 453 454 static void create_eir(struct hci_dev *hdev, u8 *data) 455 { 456 u8 *ptr = data; 457 u16 eir_len = 0; 458 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)]; 459 int i, truncated = 0; 460 struct bt_uuid *uuid; 461 size_t name_len; 462 463 name_len = strlen(hdev->dev_name); 464 465 if (name_len > 0) { 466 /* EIR Data type */ 467 if (name_len > 48) { 468 name_len = 48; 469 ptr[1] = EIR_NAME_SHORT; 470 } else 471 ptr[1] = EIR_NAME_COMPLETE; 472 473 /* EIR Data length */ 474 ptr[0] = name_len + 1; 475 476 memcpy(ptr + 2, hdev->dev_name, name_len); 477 478 eir_len += (name_len + 2); 479 ptr += (name_len + 2); 480 } 481 482 memset(uuid16_list, 0, sizeof(uuid16_list)); 483 484 /* Group all UUID16 types */ 485 list_for_each_entry(uuid, &hdev->uuids, list) { 486 u16 uuid16; 487 488 uuid16 = get_uuid16(uuid->uuid); 489 if (uuid16 == 0) 490 return; 491 492 if (uuid16 < 0x1100) 493 continue; 494 495 if (uuid16 == PNP_INFO_SVCLASS_ID) 496 continue; 497 498 /* Stop if not enough space to put next UUID */ 499 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) { 500 truncated = 1; 501 break; 502 } 503 504 /* Check for duplicates */ 505 for (i = 0; uuid16_list[i] != 0; i++) 506 if (uuid16_list[i] == uuid16) 507 break; 508 509 if (uuid16_list[i] == 0) { 510 uuid16_list[i] = uuid16; 511 eir_len += sizeof(u16); 512 } 513 } 514 515 if (uuid16_list[0] != 0) { 516 u8 *length = ptr; 517 518 /* EIR Data type */ 519 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL; 520 521 ptr += 2; 522 eir_len += 2; 523 524 for (i = 0; uuid16_list[i] != 0; i++) { 525 *ptr++ = (uuid16_list[i] & 0x00ff); 526 *ptr++ = (uuid16_list[i] & 0xff00) >> 8; 527 } 528 529 /* EIR Data length */ 530 *length = (i * sizeof(u16)) + 1; 531 } 532 } 533 534 static int update_eir(struct hci_dev *hdev) 535 { 536 struct hci_cp_write_eir cp; 537 538 if (!hdev_is_powered(hdev)) 539 return 0; 540 541 if (!(hdev->features[6] & LMP_EXT_INQ)) 542 return 0; 543 544 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 545 return 0; 546 547 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 548 return 0; 549 550 memset(&cp, 0, sizeof(cp)); 551 552 create_eir(hdev, cp.data); 553 554 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 555 return 0; 556 557 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 558 559 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 560 } 561 562 static u8 get_service_classes(struct hci_dev *hdev) 563 { 564 struct bt_uuid *uuid; 565 u8 val = 0; 566 567 list_for_each_entry(uuid, &hdev->uuids, list) 568 val |= uuid->svc_hint; 569 570 return val; 571 } 572 573 static int update_class(struct hci_dev *hdev) 574 { 575 u8 cod[3]; 576 int err; 577 578 BT_DBG("%s", hdev->name); 579 580 if (!hdev_is_powered(hdev)) 581 return 0; 582 583 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 584 return 0; 585 586 cod[0] = hdev->minor_class; 587 cod[1] = hdev->major_class; 588 cod[2] = get_service_classes(hdev); 589 590 if (memcmp(cod, hdev->dev_class, 3) == 0) 591 return 0; 592 593 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod); 594 if (err == 0) 595 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags); 596 597 return err; 598 } 599 600 static void service_cache_off(struct work_struct *work) 601 { 602 struct hci_dev *hdev = container_of(work, struct hci_dev, 603 service_cache.work); 604 605 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 606 return; 607 608 hci_dev_lock(hdev); 609 610 update_eir(hdev); 611 update_class(hdev); 612 613 hci_dev_unlock(hdev); 614 } 615 616 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 617 { 618 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) 619 return; 620 621 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 622 623 /* Non-mgmt controlled devices get this bit set 624 * implicitly so that pairing works for them, however 625 * for mgmt we require user-space to explicitly enable 626 * it 627 */ 628 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 629 } 630 631 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 632 void *data, u16 data_len) 633 { 634 struct mgmt_rp_read_info rp; 635 636 BT_DBG("sock %p %s", sk, hdev->name); 637 638 hci_dev_lock(hdev); 639 640 memset(&rp, 0, sizeof(rp)); 641 642 bacpy(&rp.bdaddr, &hdev->bdaddr); 643 644 rp.version = hdev->hci_ver; 645 646 put_unaligned_le16(hdev->manufacturer, &rp.manufacturer); 647 648 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 649 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 650 651 memcpy(rp.dev_class, hdev->dev_class, 3); 652 653 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 654 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 655 656 hci_dev_unlock(hdev); 657 658 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 659 sizeof(rp)); 660 } 661 662 static void mgmt_pending_free(struct pending_cmd *cmd) 663 { 664 sock_put(cmd->sk); 665 kfree(cmd->param); 666 kfree(cmd); 667 } 668 669 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode, 670 struct hci_dev *hdev, void *data, 671 u16 len) 672 { 673 struct pending_cmd *cmd; 674 675 cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC); 676 if (!cmd) 677 return NULL; 678 679 cmd->opcode = opcode; 680 cmd->index = hdev->id; 681 682 cmd->param = kmalloc(len, GFP_ATOMIC); 683 if (!cmd->param) { 684 kfree(cmd); 685 return NULL; 686 } 687 688 if (data) 689 memcpy(cmd->param, data, len); 690 691 cmd->sk = sk; 692 sock_hold(sk); 693 694 list_add(&cmd->list, &hdev->mgmt_pending); 695 696 return cmd; 697 } 698 699 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, 700 void (*cb)(struct pending_cmd *cmd, void *data), 701 void *data) 702 { 703 struct list_head *p, *n; 704 705 list_for_each_safe(p, n, &hdev->mgmt_pending) { 706 struct pending_cmd *cmd; 707 708 cmd = list_entry(p, struct pending_cmd, list); 709 710 if (opcode > 0 && cmd->opcode != opcode) 711 continue; 712 713 cb(cmd, data); 714 } 715 } 716 717 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev) 718 { 719 struct pending_cmd *cmd; 720 721 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 722 if (cmd->opcode == opcode) 723 return cmd; 724 } 725 726 return NULL; 727 } 728 729 static void mgmt_pending_remove(struct pending_cmd *cmd) 730 { 731 list_del(&cmd->list); 732 mgmt_pending_free(cmd); 733 } 734 735 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 736 { 737 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 738 739 return cmd_complete(sk, hdev->id, opcode, 0, &settings, 740 sizeof(settings)); 741 } 742 743 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 744 u16 len) 745 { 746 struct mgmt_mode *cp = data; 747 struct pending_cmd *cmd; 748 int err; 749 750 BT_DBG("request for %s", hdev->name); 751 752 hci_dev_lock(hdev); 753 754 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) { 755 cancel_delayed_work(&hdev->power_off); 756 757 if (cp->val) { 758 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 759 mgmt_powered(hdev, 1); 760 goto failed; 761 } 762 } 763 764 if (!!cp->val == hdev_is_powered(hdev)) { 765 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 766 goto failed; 767 } 768 769 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) { 770 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 771 MGMT_STATUS_BUSY); 772 goto failed; 773 } 774 775 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 776 if (!cmd) { 777 err = -ENOMEM; 778 goto failed; 779 } 780 781 if (cp->val) 782 schedule_work(&hdev->power_on); 783 else 784 schedule_work(&hdev->power_off.work); 785 786 err = 0; 787 788 failed: 789 hci_dev_unlock(hdev); 790 return err; 791 } 792 793 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len, 794 struct sock *skip_sk) 795 { 796 struct sk_buff *skb; 797 struct mgmt_hdr *hdr; 798 799 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC); 800 if (!skb) 801 return -ENOMEM; 802 803 hdr = (void *) skb_put(skb, sizeof(*hdr)); 804 hdr->opcode = cpu_to_le16(event); 805 if (hdev) 806 hdr->index = cpu_to_le16(hdev->id); 807 else 808 hdr->index = cpu_to_le16(MGMT_INDEX_NONE); 809 hdr->len = cpu_to_le16(data_len); 810 811 if (data) 812 memcpy(skb_put(skb, data_len), data, data_len); 813 814 /* Time stamp */ 815 __net_timestamp(skb); 816 817 hci_send_to_control(skb, skip_sk); 818 kfree_skb(skb); 819 820 return 0; 821 } 822 823 static int new_settings(struct hci_dev *hdev, struct sock *skip) 824 { 825 __le32 ev; 826 827 ev = cpu_to_le32(get_current_settings(hdev)); 828 829 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip); 830 } 831 832 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 833 u16 len) 834 { 835 struct mgmt_cp_set_discoverable *cp = data; 836 struct pending_cmd *cmd; 837 u16 timeout; 838 u8 scan; 839 int err; 840 841 BT_DBG("request for %s", hdev->name); 842 843 timeout = get_unaligned_le16(&cp->timeout); 844 if (!cp->val && timeout > 0) 845 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 846 MGMT_STATUS_INVALID_PARAMS); 847 848 hci_dev_lock(hdev); 849 850 if (!hdev_is_powered(hdev) && timeout > 0) { 851 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 852 MGMT_STATUS_NOT_POWERED); 853 goto failed; 854 } 855 856 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 857 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 858 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 859 MGMT_STATUS_BUSY); 860 goto failed; 861 } 862 863 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) { 864 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 865 MGMT_STATUS_REJECTED); 866 goto failed; 867 } 868 869 if (!hdev_is_powered(hdev)) { 870 bool changed = false; 871 872 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 873 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 874 changed = true; 875 } 876 877 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 878 if (err < 0) 879 goto failed; 880 881 if (changed) 882 err = new_settings(hdev, sk); 883 884 goto failed; 885 } 886 887 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 888 if (hdev->discov_timeout > 0) { 889 cancel_delayed_work(&hdev->discov_off); 890 hdev->discov_timeout = 0; 891 } 892 893 if (cp->val && timeout > 0) { 894 hdev->discov_timeout = timeout; 895 queue_delayed_work(hdev->workqueue, &hdev->discov_off, 896 msecs_to_jiffies(hdev->discov_timeout * 1000)); 897 } 898 899 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 900 goto failed; 901 } 902 903 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 904 if (!cmd) { 905 err = -ENOMEM; 906 goto failed; 907 } 908 909 scan = SCAN_PAGE; 910 911 if (cp->val) 912 scan |= SCAN_INQUIRY; 913 else 914 cancel_delayed_work(&hdev->discov_off); 915 916 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 917 if (err < 0) 918 mgmt_pending_remove(cmd); 919 920 if (cp->val) 921 hdev->discov_timeout = timeout; 922 923 failed: 924 hci_dev_unlock(hdev); 925 return err; 926 } 927 928 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 929 u16 len) 930 { 931 struct mgmt_mode *cp = data; 932 struct pending_cmd *cmd; 933 u8 scan; 934 int err; 935 936 BT_DBG("request for %s", hdev->name); 937 938 hci_dev_lock(hdev); 939 940 if (!hdev_is_powered(hdev)) { 941 bool changed = false; 942 943 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 944 changed = true; 945 946 if (cp->val) { 947 set_bit(HCI_CONNECTABLE, &hdev->dev_flags); 948 } else { 949 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags); 950 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 951 } 952 953 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 954 if (err < 0) 955 goto failed; 956 957 if (changed) 958 err = new_settings(hdev, sk); 959 960 goto failed; 961 } 962 963 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 964 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 965 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 966 MGMT_STATUS_BUSY); 967 goto failed; 968 } 969 970 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) { 971 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 972 goto failed; 973 } 974 975 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 976 if (!cmd) { 977 err = -ENOMEM; 978 goto failed; 979 } 980 981 if (cp->val) { 982 scan = SCAN_PAGE; 983 } else { 984 scan = 0; 985 986 if (test_bit(HCI_ISCAN, &hdev->flags) && 987 hdev->discov_timeout > 0) 988 cancel_delayed_work(&hdev->discov_off); 989 } 990 991 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 992 if (err < 0) 993 mgmt_pending_remove(cmd); 994 995 failed: 996 hci_dev_unlock(hdev); 997 return err; 998 } 999 1000 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data, 1001 u16 len) 1002 { 1003 struct mgmt_mode *cp = data; 1004 int err; 1005 1006 BT_DBG("request for %s", hdev->name); 1007 1008 hci_dev_lock(hdev); 1009 1010 if (cp->val) 1011 set_bit(HCI_PAIRABLE, &hdev->dev_flags); 1012 else 1013 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 1014 1015 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev); 1016 if (err < 0) 1017 goto failed; 1018 1019 err = new_settings(hdev, sk); 1020 1021 failed: 1022 hci_dev_unlock(hdev); 1023 return err; 1024 } 1025 1026 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1027 u16 len) 1028 { 1029 struct mgmt_mode *cp = data; 1030 struct pending_cmd *cmd; 1031 u8 val; 1032 int err; 1033 1034 BT_DBG("request for %s", hdev->name); 1035 1036 hci_dev_lock(hdev); 1037 1038 if (!hdev_is_powered(hdev)) { 1039 bool changed = false; 1040 1041 if (!!cp->val != test_bit(HCI_LINK_SECURITY, 1042 &hdev->dev_flags)) { 1043 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 1044 changed = true; 1045 } 1046 1047 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1048 if (err < 0) 1049 goto failed; 1050 1051 if (changed) 1052 err = new_settings(hdev, sk); 1053 1054 goto failed; 1055 } 1056 1057 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1058 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1059 MGMT_STATUS_BUSY); 1060 goto failed; 1061 } 1062 1063 val = !!cp->val; 1064 1065 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1066 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1067 goto failed; 1068 } 1069 1070 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1071 if (!cmd) { 1072 err = -ENOMEM; 1073 goto failed; 1074 } 1075 1076 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1077 if (err < 0) { 1078 mgmt_pending_remove(cmd); 1079 goto failed; 1080 } 1081 1082 failed: 1083 hci_dev_unlock(hdev); 1084 return err; 1085 } 1086 1087 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1088 { 1089 struct mgmt_mode *cp = data; 1090 struct pending_cmd *cmd; 1091 u8 val; 1092 int err; 1093 1094 BT_DBG("request for %s", hdev->name); 1095 1096 hci_dev_lock(hdev); 1097 1098 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) { 1099 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1100 MGMT_STATUS_NOT_SUPPORTED); 1101 goto failed; 1102 } 1103 1104 val = !!cp->val; 1105 1106 if (!hdev_is_powered(hdev)) { 1107 bool changed = false; 1108 1109 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) { 1110 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 1111 changed = true; 1112 } 1113 1114 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1115 if (err < 0) 1116 goto failed; 1117 1118 if (changed) 1119 err = new_settings(hdev, sk); 1120 1121 goto failed; 1122 } 1123 1124 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) { 1125 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1126 MGMT_STATUS_BUSY); 1127 goto failed; 1128 } 1129 1130 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) { 1131 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1132 goto failed; 1133 } 1134 1135 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1136 if (!cmd) { 1137 err = -ENOMEM; 1138 goto failed; 1139 } 1140 1141 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val); 1142 if (err < 0) { 1143 mgmt_pending_remove(cmd); 1144 goto failed; 1145 } 1146 1147 failed: 1148 hci_dev_unlock(hdev); 1149 return err; 1150 } 1151 1152 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1153 { 1154 struct mgmt_mode *cp = data; 1155 1156 BT_DBG("request for %s", hdev->name); 1157 1158 if (!enable_hs) 1159 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1160 MGMT_STATUS_NOT_SUPPORTED); 1161 1162 if (cp->val) 1163 set_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1164 else 1165 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1166 1167 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1168 } 1169 1170 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1171 { 1172 struct mgmt_mode *cp = data; 1173 struct hci_cp_write_le_host_supported hci_cp; 1174 struct pending_cmd *cmd; 1175 int err; 1176 u8 val, enabled; 1177 1178 BT_DBG("request for %s", hdev->name); 1179 1180 hci_dev_lock(hdev); 1181 1182 if (!enable_le || !(hdev->features[4] & LMP_LE)) { 1183 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1184 MGMT_STATUS_NOT_SUPPORTED); 1185 goto unlock; 1186 } 1187 1188 val = !!cp->val; 1189 enabled = !!(hdev->host_features[0] & LMP_HOST_LE); 1190 1191 if (!hdev_is_powered(hdev) || val == enabled) { 1192 bool changed = false; 1193 1194 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { 1195 change_bit(HCI_LE_ENABLED, &hdev->dev_flags); 1196 changed = true; 1197 } 1198 1199 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1200 if (err < 0) 1201 goto unlock; 1202 1203 if (changed) 1204 err = new_settings(hdev, sk); 1205 1206 goto unlock; 1207 } 1208 1209 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) { 1210 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1211 MGMT_STATUS_BUSY); 1212 goto unlock; 1213 } 1214 1215 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1216 if (!cmd) { 1217 err = -ENOMEM; 1218 goto unlock; 1219 } 1220 1221 memset(&hci_cp, 0, sizeof(hci_cp)); 1222 1223 if (val) { 1224 hci_cp.le = val; 1225 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR); 1226 } 1227 1228 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 1229 &hci_cp); 1230 if (err < 0) { 1231 mgmt_pending_remove(cmd); 1232 goto unlock; 1233 } 1234 1235 unlock: 1236 hci_dev_unlock(hdev); 1237 return err; 1238 } 1239 1240 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1241 { 1242 struct mgmt_cp_add_uuid *cp = data; 1243 struct pending_cmd *cmd; 1244 struct bt_uuid *uuid; 1245 int err; 1246 1247 BT_DBG("request for %s", hdev->name); 1248 1249 hci_dev_lock(hdev); 1250 1251 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1252 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 1253 MGMT_STATUS_BUSY); 1254 goto failed; 1255 } 1256 1257 uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC); 1258 if (!uuid) { 1259 err = -ENOMEM; 1260 goto failed; 1261 } 1262 1263 memcpy(uuid->uuid, cp->uuid, 16); 1264 uuid->svc_hint = cp->svc_hint; 1265 1266 list_add(&uuid->list, &hdev->uuids); 1267 1268 err = update_class(hdev); 1269 if (err < 0) 1270 goto failed; 1271 1272 err = update_eir(hdev); 1273 if (err < 0) 1274 goto failed; 1275 1276 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1277 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 1278 hdev->dev_class, 3); 1279 goto failed; 1280 } 1281 1282 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 1283 if (!cmd) { 1284 err = -ENOMEM; 1285 goto failed; 1286 } 1287 1288 failed: 1289 hci_dev_unlock(hdev); 1290 return err; 1291 } 1292 1293 static bool enable_service_cache(struct hci_dev *hdev) 1294 { 1295 if (!hdev_is_powered(hdev)) 1296 return false; 1297 1298 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1299 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT); 1300 return true; 1301 } 1302 1303 return false; 1304 } 1305 1306 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 1307 u16 len) 1308 { 1309 struct mgmt_cp_remove_uuid *cp = data; 1310 struct pending_cmd *cmd; 1311 struct list_head *p, *n; 1312 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 1313 int err, found; 1314 1315 BT_DBG("request for %s", hdev->name); 1316 1317 hci_dev_lock(hdev); 1318 1319 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1320 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1321 MGMT_STATUS_BUSY); 1322 goto unlock; 1323 } 1324 1325 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 1326 err = hci_uuids_clear(hdev); 1327 1328 if (enable_service_cache(hdev)) { 1329 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1330 0, hdev->dev_class, 3); 1331 goto unlock; 1332 } 1333 1334 goto update_class; 1335 } 1336 1337 found = 0; 1338 1339 list_for_each_safe(p, n, &hdev->uuids) { 1340 struct bt_uuid *match = list_entry(p, struct bt_uuid, list); 1341 1342 if (memcmp(match->uuid, cp->uuid, 16) != 0) 1343 continue; 1344 1345 list_del(&match->list); 1346 found++; 1347 } 1348 1349 if (found == 0) { 1350 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1351 MGMT_STATUS_INVALID_PARAMS); 1352 goto unlock; 1353 } 1354 1355 update_class: 1356 err = update_class(hdev); 1357 if (err < 0) 1358 goto unlock; 1359 1360 err = update_eir(hdev); 1361 if (err < 0) 1362 goto unlock; 1363 1364 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1365 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 1366 hdev->dev_class, 3); 1367 goto unlock; 1368 } 1369 1370 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 1371 if (!cmd) { 1372 err = -ENOMEM; 1373 goto unlock; 1374 } 1375 1376 unlock: 1377 hci_dev_unlock(hdev); 1378 return err; 1379 } 1380 1381 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 1382 u16 len) 1383 { 1384 struct mgmt_cp_set_dev_class *cp = data; 1385 struct pending_cmd *cmd; 1386 int err; 1387 1388 BT_DBG("request for %s", hdev->name); 1389 1390 hci_dev_lock(hdev); 1391 1392 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1393 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 1394 MGMT_STATUS_BUSY); 1395 goto unlock; 1396 } 1397 1398 hdev->major_class = cp->major; 1399 hdev->minor_class = cp->minor; 1400 1401 if (!hdev_is_powered(hdev)) { 1402 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 1403 hdev->dev_class, 3); 1404 goto unlock; 1405 } 1406 1407 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1408 hci_dev_unlock(hdev); 1409 cancel_delayed_work_sync(&hdev->service_cache); 1410 hci_dev_lock(hdev); 1411 update_eir(hdev); 1412 } 1413 1414 err = update_class(hdev); 1415 if (err < 0) 1416 goto unlock; 1417 1418 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) { 1419 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 1420 hdev->dev_class, 3); 1421 goto unlock; 1422 } 1423 1424 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 1425 if (!cmd) { 1426 err = -ENOMEM; 1427 goto unlock; 1428 } 1429 1430 unlock: 1431 hci_dev_unlock(hdev); 1432 return err; 1433 } 1434 1435 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 1436 u16 len) 1437 { 1438 struct mgmt_cp_load_link_keys *cp = data; 1439 u16 key_count, expected_len; 1440 int i; 1441 1442 key_count = get_unaligned_le16(&cp->key_count); 1443 1444 expected_len = sizeof(*cp) + key_count * 1445 sizeof(struct mgmt_link_key_info); 1446 if (expected_len != len) { 1447 BT_ERR("load_link_keys: expected %u bytes, got %u bytes", 1448 len, expected_len); 1449 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 1450 MGMT_STATUS_INVALID_PARAMS); 1451 } 1452 1453 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys, 1454 key_count); 1455 1456 hci_dev_lock(hdev); 1457 1458 hci_link_keys_clear(hdev); 1459 1460 set_bit(HCI_LINK_KEYS, &hdev->dev_flags); 1461 1462 if (cp->debug_keys) 1463 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 1464 else 1465 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 1466 1467 for (i = 0; i < key_count; i++) { 1468 struct mgmt_link_key_info *key = &cp->keys[i]; 1469 1470 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val, 1471 key->type, key->pin_len); 1472 } 1473 1474 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 1475 1476 hci_dev_unlock(hdev); 1477 1478 return 0; 1479 } 1480 1481 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 1482 u8 addr_type, struct sock *skip_sk) 1483 { 1484 struct mgmt_ev_device_unpaired ev; 1485 1486 bacpy(&ev.addr.bdaddr, bdaddr); 1487 ev.addr.type = addr_type; 1488 1489 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 1490 skip_sk); 1491 } 1492 1493 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1494 u16 len) 1495 { 1496 struct mgmt_cp_unpair_device *cp = data; 1497 struct mgmt_rp_unpair_device rp; 1498 struct hci_cp_disconnect dc; 1499 struct pending_cmd *cmd; 1500 struct hci_conn *conn; 1501 int err; 1502 1503 hci_dev_lock(hdev); 1504 1505 memset(&rp, 0, sizeof(rp)); 1506 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 1507 rp.addr.type = cp->addr.type; 1508 1509 if (!hdev_is_powered(hdev)) { 1510 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1511 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 1512 goto unlock; 1513 } 1514 1515 if (cp->addr.type == MGMT_ADDR_BREDR) 1516 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 1517 else 1518 err = hci_remove_ltk(hdev, &cp->addr.bdaddr); 1519 1520 if (err < 0) { 1521 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1522 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp)); 1523 goto unlock; 1524 } 1525 1526 if (cp->disconnect) { 1527 if (cp->addr.type == MGMT_ADDR_BREDR) 1528 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 1529 &cp->addr.bdaddr); 1530 else 1531 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, 1532 &cp->addr.bdaddr); 1533 } else { 1534 conn = NULL; 1535 } 1536 1537 if (!conn) { 1538 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 1539 &rp, sizeof(rp)); 1540 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 1541 goto unlock; 1542 } 1543 1544 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 1545 sizeof(*cp)); 1546 if (!cmd) { 1547 err = -ENOMEM; 1548 goto unlock; 1549 } 1550 1551 put_unaligned_le16(conn->handle, &dc.handle); 1552 dc.reason = 0x13; /* Remote User Terminated Connection */ 1553 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 1554 if (err < 0) 1555 mgmt_pending_remove(cmd); 1556 1557 unlock: 1558 hci_dev_unlock(hdev); 1559 return err; 1560 } 1561 1562 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 1563 u16 len) 1564 { 1565 struct mgmt_cp_disconnect *cp = data; 1566 struct hci_cp_disconnect dc; 1567 struct pending_cmd *cmd; 1568 struct hci_conn *conn; 1569 int err; 1570 1571 BT_DBG(""); 1572 1573 hci_dev_lock(hdev); 1574 1575 if (!test_bit(HCI_UP, &hdev->flags)) { 1576 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1577 MGMT_STATUS_NOT_POWERED); 1578 goto failed; 1579 } 1580 1581 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) { 1582 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1583 MGMT_STATUS_BUSY); 1584 goto failed; 1585 } 1586 1587 if (cp->addr.type == MGMT_ADDR_BREDR) 1588 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 1589 else 1590 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 1591 1592 if (!conn) { 1593 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1594 MGMT_STATUS_NOT_CONNECTED); 1595 goto failed; 1596 } 1597 1598 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 1599 if (!cmd) { 1600 err = -ENOMEM; 1601 goto failed; 1602 } 1603 1604 put_unaligned_le16(conn->handle, &dc.handle); 1605 dc.reason = 0x13; /* Remote User Terminated Connection */ 1606 1607 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 1608 if (err < 0) 1609 mgmt_pending_remove(cmd); 1610 1611 failed: 1612 hci_dev_unlock(hdev); 1613 return err; 1614 } 1615 1616 static u8 link_to_mgmt(u8 link_type, u8 addr_type) 1617 { 1618 switch (link_type) { 1619 case LE_LINK: 1620 switch (addr_type) { 1621 case ADDR_LE_DEV_PUBLIC: 1622 return MGMT_ADDR_LE_PUBLIC; 1623 case ADDR_LE_DEV_RANDOM: 1624 return MGMT_ADDR_LE_RANDOM; 1625 default: 1626 return MGMT_ADDR_INVALID; 1627 } 1628 case ACL_LINK: 1629 return MGMT_ADDR_BREDR; 1630 default: 1631 return MGMT_ADDR_INVALID; 1632 } 1633 } 1634 1635 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 1636 u16 data_len) 1637 { 1638 struct mgmt_rp_get_connections *rp; 1639 struct hci_conn *c; 1640 size_t rp_len; 1641 int err; 1642 u16 i; 1643 1644 BT_DBG(""); 1645 1646 hci_dev_lock(hdev); 1647 1648 if (!hdev_is_powered(hdev)) { 1649 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 1650 MGMT_STATUS_NOT_POWERED); 1651 goto unlock; 1652 } 1653 1654 i = 0; 1655 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1656 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 1657 i++; 1658 } 1659 1660 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 1661 rp = kmalloc(rp_len, GFP_ATOMIC); 1662 if (!rp) { 1663 err = -ENOMEM; 1664 goto unlock; 1665 } 1666 1667 i = 0; 1668 list_for_each_entry(c, &hdev->conn_hash.list, list) { 1669 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 1670 continue; 1671 bacpy(&rp->addr[i].bdaddr, &c->dst); 1672 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type); 1673 if (rp->addr[i].type == MGMT_ADDR_INVALID) 1674 continue; 1675 i++; 1676 } 1677 1678 put_unaligned_le16(i, &rp->conn_count); 1679 1680 /* Recalculate length in case of filtered SCO connections, etc */ 1681 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 1682 1683 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 1684 rp_len); 1685 1686 kfree(rp); 1687 1688 unlock: 1689 hci_dev_unlock(hdev); 1690 return err; 1691 } 1692 1693 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 1694 struct mgmt_cp_pin_code_neg_reply *cp) 1695 { 1696 struct pending_cmd *cmd; 1697 int err; 1698 1699 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 1700 sizeof(*cp)); 1701 if (!cmd) 1702 return -ENOMEM; 1703 1704 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 1705 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 1706 if (err < 0) 1707 mgmt_pending_remove(cmd); 1708 1709 return err; 1710 } 1711 1712 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 1713 u16 len) 1714 { 1715 struct hci_conn *conn; 1716 struct mgmt_cp_pin_code_reply *cp = data; 1717 struct hci_cp_pin_code_reply reply; 1718 struct pending_cmd *cmd; 1719 int err; 1720 1721 BT_DBG(""); 1722 1723 hci_dev_lock(hdev); 1724 1725 if (!hdev_is_powered(hdev)) { 1726 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 1727 MGMT_STATUS_NOT_POWERED); 1728 goto failed; 1729 } 1730 1731 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 1732 if (!conn) { 1733 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 1734 MGMT_STATUS_NOT_CONNECTED); 1735 goto failed; 1736 } 1737 1738 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 1739 struct mgmt_cp_pin_code_neg_reply ncp; 1740 1741 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 1742 1743 BT_ERR("PIN code is not 16 bytes long"); 1744 1745 err = send_pin_code_neg_reply(sk, hdev, &ncp); 1746 if (err >= 0) 1747 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 1748 MGMT_STATUS_INVALID_PARAMS); 1749 1750 goto failed; 1751 } 1752 1753 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 1754 if (!cmd) { 1755 err = -ENOMEM; 1756 goto failed; 1757 } 1758 1759 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 1760 reply.pin_len = cp->pin_len; 1761 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 1762 1763 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 1764 if (err < 0) 1765 mgmt_pending_remove(cmd); 1766 1767 failed: 1768 hci_dev_unlock(hdev); 1769 return err; 1770 } 1771 1772 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 1773 void *data, u16 len) 1774 { 1775 struct mgmt_cp_pin_code_neg_reply *cp = data; 1776 int err; 1777 1778 BT_DBG(""); 1779 1780 hci_dev_lock(hdev); 1781 1782 if (!hdev_is_powered(hdev)) { 1783 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, 1784 MGMT_STATUS_NOT_POWERED); 1785 goto failed; 1786 } 1787 1788 err = send_pin_code_neg_reply(sk, hdev, cp); 1789 1790 failed: 1791 hci_dev_unlock(hdev); 1792 return err; 1793 } 1794 1795 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 1796 u16 len) 1797 { 1798 struct mgmt_cp_set_io_capability *cp = data; 1799 1800 BT_DBG(""); 1801 1802 hci_dev_lock(hdev); 1803 1804 hdev->io_capability = cp->io_capability; 1805 1806 BT_DBG("%s IO capability set to 0x%02x", hdev->name, 1807 hdev->io_capability); 1808 1809 hci_dev_unlock(hdev); 1810 1811 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 1812 0); 1813 } 1814 1815 static inline struct pending_cmd *find_pairing(struct hci_conn *conn) 1816 { 1817 struct hci_dev *hdev = conn->hdev; 1818 struct pending_cmd *cmd; 1819 1820 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 1821 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 1822 continue; 1823 1824 if (cmd->user_data != conn) 1825 continue; 1826 1827 return cmd; 1828 } 1829 1830 return NULL; 1831 } 1832 1833 static void pairing_complete(struct pending_cmd *cmd, u8 status) 1834 { 1835 struct mgmt_rp_pair_device rp; 1836 struct hci_conn *conn = cmd->user_data; 1837 1838 bacpy(&rp.addr.bdaddr, &conn->dst); 1839 rp.addr.type = link_to_mgmt(conn->type, conn->dst_type); 1840 1841 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status, 1842 &rp, sizeof(rp)); 1843 1844 /* So we don't get further callbacks for this connection */ 1845 conn->connect_cfm_cb = NULL; 1846 conn->security_cfm_cb = NULL; 1847 conn->disconn_cfm_cb = NULL; 1848 1849 hci_conn_put(conn); 1850 1851 mgmt_pending_remove(cmd); 1852 } 1853 1854 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 1855 { 1856 struct pending_cmd *cmd; 1857 1858 BT_DBG("status %u", status); 1859 1860 cmd = find_pairing(conn); 1861 if (!cmd) 1862 BT_DBG("Unable to find a pending command"); 1863 else 1864 pairing_complete(cmd, mgmt_status(status)); 1865 } 1866 1867 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1868 u16 len) 1869 { 1870 struct mgmt_cp_pair_device *cp = data; 1871 struct mgmt_rp_pair_device rp; 1872 struct pending_cmd *cmd; 1873 u8 sec_level, auth_type; 1874 struct hci_conn *conn; 1875 int err; 1876 1877 BT_DBG(""); 1878 1879 hci_dev_lock(hdev); 1880 1881 if (!hdev_is_powered(hdev)) { 1882 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 1883 MGMT_STATUS_NOT_POWERED); 1884 goto unlock; 1885 } 1886 1887 sec_level = BT_SECURITY_MEDIUM; 1888 if (cp->io_cap == 0x03) 1889 auth_type = HCI_AT_DEDICATED_BONDING; 1890 else 1891 auth_type = HCI_AT_DEDICATED_BONDING_MITM; 1892 1893 if (cp->addr.type == MGMT_ADDR_BREDR) 1894 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level, 1895 auth_type); 1896 else 1897 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level, 1898 auth_type); 1899 1900 memset(&rp, 0, sizeof(rp)); 1901 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 1902 rp.addr.type = cp->addr.type; 1903 1904 if (IS_ERR(conn)) { 1905 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 1906 MGMT_STATUS_CONNECT_FAILED, &rp, 1907 sizeof(rp)); 1908 goto unlock; 1909 } 1910 1911 if (conn->connect_cfm_cb) { 1912 hci_conn_put(conn); 1913 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 1914 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 1915 goto unlock; 1916 } 1917 1918 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 1919 if (!cmd) { 1920 err = -ENOMEM; 1921 hci_conn_put(conn); 1922 goto unlock; 1923 } 1924 1925 /* For LE, just connecting isn't a proof that the pairing finished */ 1926 if (cp->addr.type == MGMT_ADDR_BREDR) 1927 conn->connect_cfm_cb = pairing_complete_cb; 1928 1929 conn->security_cfm_cb = pairing_complete_cb; 1930 conn->disconn_cfm_cb = pairing_complete_cb; 1931 conn->io_capability = cp->io_cap; 1932 cmd->user_data = conn; 1933 1934 if (conn->state == BT_CONNECTED && 1935 hci_conn_security(conn, sec_level, auth_type)) 1936 pairing_complete(cmd, 0); 1937 1938 err = 0; 1939 1940 unlock: 1941 hci_dev_unlock(hdev); 1942 return err; 1943 } 1944 1945 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1946 u16 len) 1947 { 1948 struct mgmt_addr_info *addr = data; 1949 struct pending_cmd *cmd; 1950 struct hci_conn *conn; 1951 int err; 1952 1953 BT_DBG(""); 1954 1955 hci_dev_lock(hdev); 1956 1957 if (!hdev_is_powered(hdev)) { 1958 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 1959 MGMT_STATUS_NOT_POWERED); 1960 goto unlock; 1961 } 1962 1963 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev); 1964 if (!cmd) { 1965 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 1966 MGMT_STATUS_INVALID_PARAMS); 1967 goto unlock; 1968 } 1969 1970 conn = cmd->user_data; 1971 1972 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 1973 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 1974 MGMT_STATUS_INVALID_PARAMS); 1975 goto unlock; 1976 } 1977 1978 pairing_complete(cmd, MGMT_STATUS_CANCELLED); 1979 1980 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 1981 addr, sizeof(*addr)); 1982 unlock: 1983 hci_dev_unlock(hdev); 1984 return err; 1985 } 1986 1987 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 1988 bdaddr_t *bdaddr, u8 type, u16 mgmt_op, 1989 u16 hci_op, __le32 passkey) 1990 { 1991 struct pending_cmd *cmd; 1992 struct hci_conn *conn; 1993 int err; 1994 1995 hci_dev_lock(hdev); 1996 1997 if (!hdev_is_powered(hdev)) { 1998 err = cmd_status(sk, hdev->id, mgmt_op, 1999 MGMT_STATUS_NOT_POWERED); 2000 goto done; 2001 } 2002 2003 if (type == MGMT_ADDR_BREDR) 2004 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr); 2005 else 2006 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr); 2007 2008 if (!conn) { 2009 err = cmd_status(sk, hdev->id, mgmt_op, 2010 MGMT_STATUS_NOT_CONNECTED); 2011 goto done; 2012 } 2013 2014 if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) { 2015 /* Continue with pairing via SMP */ 2016 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 2017 2018 if (!err) 2019 err = cmd_status(sk, hdev->id, mgmt_op, 2020 MGMT_STATUS_SUCCESS); 2021 else 2022 err = cmd_status(sk, hdev->id, mgmt_op, 2023 MGMT_STATUS_FAILED); 2024 2025 goto done; 2026 } 2027 2028 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr)); 2029 if (!cmd) { 2030 err = -ENOMEM; 2031 goto done; 2032 } 2033 2034 /* Continue with pairing via HCI */ 2035 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 2036 struct hci_cp_user_passkey_reply cp; 2037 2038 bacpy(&cp.bdaddr, bdaddr); 2039 cp.passkey = passkey; 2040 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 2041 } else 2042 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr); 2043 2044 if (err < 0) 2045 mgmt_pending_remove(cmd); 2046 2047 done: 2048 hci_dev_unlock(hdev); 2049 return err; 2050 } 2051 2052 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2053 u16 len) 2054 { 2055 struct mgmt_cp_user_confirm_reply *cp = data; 2056 2057 BT_DBG(""); 2058 2059 if (len != sizeof(*cp)) 2060 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 2061 MGMT_STATUS_INVALID_PARAMS); 2062 2063 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2064 MGMT_OP_USER_CONFIRM_REPLY, 2065 HCI_OP_USER_CONFIRM_REPLY, 0); 2066 } 2067 2068 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 2069 void *data, u16 len) 2070 { 2071 struct mgmt_cp_user_confirm_neg_reply *cp = data; 2072 2073 BT_DBG(""); 2074 2075 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2076 MGMT_OP_USER_CONFIRM_NEG_REPLY, 2077 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 2078 } 2079 2080 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2081 u16 len) 2082 { 2083 struct mgmt_cp_user_passkey_reply *cp = data; 2084 2085 BT_DBG(""); 2086 2087 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2088 MGMT_OP_USER_PASSKEY_REPLY, 2089 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 2090 } 2091 2092 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 2093 void *data, u16 len) 2094 { 2095 struct mgmt_cp_user_passkey_neg_reply *cp = data; 2096 2097 BT_DBG(""); 2098 2099 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 2100 MGMT_OP_USER_PASSKEY_NEG_REPLY, 2101 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 2102 } 2103 2104 static int update_name(struct hci_dev *hdev, const char *name) 2105 { 2106 struct hci_cp_write_local_name cp; 2107 2108 memcpy(cp.name, name, sizeof(cp.name)); 2109 2110 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp); 2111 } 2112 2113 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 2114 u16 len) 2115 { 2116 struct mgmt_cp_set_local_name *cp = data; 2117 struct pending_cmd *cmd; 2118 int err; 2119 2120 BT_DBG(""); 2121 2122 hci_dev_lock(hdev); 2123 2124 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 2125 2126 if (!hdev_is_powered(hdev)) { 2127 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 2128 2129 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2130 data, len); 2131 if (err < 0) 2132 goto failed; 2133 2134 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len, 2135 sk); 2136 2137 goto failed; 2138 } 2139 2140 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 2141 if (!cmd) { 2142 err = -ENOMEM; 2143 goto failed; 2144 } 2145 2146 err = update_name(hdev, cp->name); 2147 if (err < 0) 2148 mgmt_pending_remove(cmd); 2149 2150 failed: 2151 hci_dev_unlock(hdev); 2152 return err; 2153 } 2154 2155 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 2156 void *data, u16 data_len) 2157 { 2158 struct pending_cmd *cmd; 2159 int err; 2160 2161 BT_DBG("%s", hdev->name); 2162 2163 hci_dev_lock(hdev); 2164 2165 if (!hdev_is_powered(hdev)) { 2166 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2167 MGMT_STATUS_NOT_POWERED); 2168 goto unlock; 2169 } 2170 2171 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) { 2172 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2173 MGMT_STATUS_NOT_SUPPORTED); 2174 goto unlock; 2175 } 2176 2177 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 2178 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2179 MGMT_STATUS_BUSY); 2180 goto unlock; 2181 } 2182 2183 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 2184 if (!cmd) { 2185 err = -ENOMEM; 2186 goto unlock; 2187 } 2188 2189 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 2190 if (err < 0) 2191 mgmt_pending_remove(cmd); 2192 2193 unlock: 2194 hci_dev_unlock(hdev); 2195 return err; 2196 } 2197 2198 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2199 void *data, u16 len) 2200 { 2201 struct mgmt_cp_add_remote_oob_data *cp = data; 2202 u8 status; 2203 int err; 2204 2205 BT_DBG("%s ", hdev->name); 2206 2207 hci_dev_lock(hdev); 2208 2209 if (!hdev_is_powered(hdev)) { 2210 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 2211 MGMT_STATUS_NOT_POWERED, &cp->addr, 2212 sizeof(cp->addr)); 2213 goto unlock; 2214 } 2215 2216 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash, 2217 cp->randomizer); 2218 if (err < 0) 2219 status = MGMT_STATUS_FAILED; 2220 else 2221 status = 0; 2222 2223 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status, 2224 &cp->addr, sizeof(cp->addr)); 2225 2226 unlock: 2227 hci_dev_unlock(hdev); 2228 return err; 2229 } 2230 2231 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2232 void *data, u16 len) 2233 { 2234 struct mgmt_cp_remove_remote_oob_data *cp = data; 2235 u8 status; 2236 int err; 2237 2238 BT_DBG("%s", hdev->name); 2239 2240 hci_dev_lock(hdev); 2241 2242 if (!hdev_is_powered(hdev)) { 2243 err = cmd_complete(sk, hdev->id, 2244 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 2245 MGMT_STATUS_NOT_POWERED, &cp->addr, 2246 sizeof(cp->addr)); 2247 goto unlock; 2248 } 2249 2250 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr); 2251 if (err < 0) 2252 status = MGMT_STATUS_INVALID_PARAMS; 2253 else 2254 status = 0; 2255 2256 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 2257 status, &cp->addr, sizeof(cp->addr)); 2258 2259 unlock: 2260 hci_dev_unlock(hdev); 2261 return err; 2262 } 2263 2264 int mgmt_interleaved_discovery(struct hci_dev *hdev) 2265 { 2266 int err; 2267 2268 BT_DBG("%s", hdev->name); 2269 2270 hci_dev_lock(hdev); 2271 2272 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE); 2273 if (err < 0) 2274 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2275 2276 hci_dev_unlock(hdev); 2277 2278 return err; 2279 } 2280 2281 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 2282 void *data, u16 len) 2283 { 2284 struct mgmt_cp_start_discovery *cp = data; 2285 struct pending_cmd *cmd; 2286 int err; 2287 2288 BT_DBG("%s", hdev->name); 2289 2290 hci_dev_lock(hdev); 2291 2292 if (!hdev_is_powered(hdev)) { 2293 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2294 MGMT_STATUS_NOT_POWERED); 2295 goto failed; 2296 } 2297 2298 if (hdev->discovery.state != DISCOVERY_STOPPED) { 2299 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2300 MGMT_STATUS_BUSY); 2301 goto failed; 2302 } 2303 2304 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0); 2305 if (!cmd) { 2306 err = -ENOMEM; 2307 goto failed; 2308 } 2309 2310 hdev->discovery.type = cp->type; 2311 2312 switch (hdev->discovery.type) { 2313 case DISCOV_TYPE_BREDR: 2314 if (lmp_bredr_capable(hdev)) 2315 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR); 2316 else 2317 err = -ENOTSUPP; 2318 break; 2319 2320 case DISCOV_TYPE_LE: 2321 if (lmp_host_le_capable(hdev)) 2322 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, 2323 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY); 2324 else 2325 err = -ENOTSUPP; 2326 break; 2327 2328 case DISCOV_TYPE_INTERLEAVED: 2329 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev)) 2330 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT, 2331 LE_SCAN_WIN, 2332 LE_SCAN_TIMEOUT_BREDR_LE); 2333 else 2334 err = -ENOTSUPP; 2335 break; 2336 2337 default: 2338 err = -EINVAL; 2339 } 2340 2341 if (err < 0) 2342 mgmt_pending_remove(cmd); 2343 else 2344 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 2345 2346 failed: 2347 hci_dev_unlock(hdev); 2348 return err; 2349 } 2350 2351 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 2352 u16 len) 2353 { 2354 struct mgmt_cp_stop_discovery *mgmt_cp = data; 2355 struct pending_cmd *cmd; 2356 struct hci_cp_remote_name_req_cancel cp; 2357 struct inquiry_entry *e; 2358 int err; 2359 2360 BT_DBG("%s", hdev->name); 2361 2362 hci_dev_lock(hdev); 2363 2364 if (!hci_discovery_active(hdev)) { 2365 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 2366 MGMT_STATUS_REJECTED, &mgmt_cp->type, 2367 sizeof(mgmt_cp->type)); 2368 goto unlock; 2369 } 2370 2371 if (hdev->discovery.type != mgmt_cp->type) { 2372 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 2373 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type, 2374 sizeof(mgmt_cp->type)); 2375 goto unlock; 2376 } 2377 2378 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0); 2379 if (!cmd) { 2380 err = -ENOMEM; 2381 goto unlock; 2382 } 2383 2384 if (hdev->discovery.state == DISCOVERY_FINDING) { 2385 err = hci_cancel_inquiry(hdev); 2386 if (err < 0) 2387 mgmt_pending_remove(cmd); 2388 else 2389 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 2390 goto unlock; 2391 } 2392 2393 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING); 2394 if (!e) { 2395 mgmt_pending_remove(cmd); 2396 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0, 2397 &mgmt_cp->type, sizeof(mgmt_cp->type)); 2398 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2399 goto unlock; 2400 } 2401 2402 bacpy(&cp.bdaddr, &e->data.bdaddr); 2403 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp), 2404 &cp); 2405 if (err < 0) 2406 mgmt_pending_remove(cmd); 2407 else 2408 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 2409 2410 unlock: 2411 hci_dev_unlock(hdev); 2412 return err; 2413 } 2414 2415 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 2416 u16 len) 2417 { 2418 struct mgmt_cp_confirm_name *cp = data; 2419 struct inquiry_entry *e; 2420 int err; 2421 2422 BT_DBG("%s", hdev->name); 2423 2424 hci_dev_lock(hdev); 2425 2426 if (!hci_discovery_active(hdev)) { 2427 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 2428 MGMT_STATUS_FAILED); 2429 goto failed; 2430 } 2431 2432 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 2433 if (!e) { 2434 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 2435 MGMT_STATUS_INVALID_PARAMS); 2436 goto failed; 2437 } 2438 2439 if (cp->name_known) { 2440 e->name_state = NAME_KNOWN; 2441 list_del(&e->list); 2442 } else { 2443 e->name_state = NAME_NEEDED; 2444 hci_inquiry_cache_update_resolve(hdev, e); 2445 } 2446 2447 err = 0; 2448 2449 failed: 2450 hci_dev_unlock(hdev); 2451 return err; 2452 } 2453 2454 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 2455 u16 len) 2456 { 2457 struct mgmt_cp_block_device *cp = data; 2458 u8 status; 2459 int err; 2460 2461 BT_DBG("%s", hdev->name); 2462 2463 hci_dev_lock(hdev); 2464 2465 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type); 2466 if (err < 0) 2467 status = MGMT_STATUS_FAILED; 2468 else 2469 status = 0; 2470 2471 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 2472 &cp->addr, sizeof(cp->addr)); 2473 2474 hci_dev_unlock(hdev); 2475 2476 return err; 2477 } 2478 2479 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 2480 u16 len) 2481 { 2482 struct mgmt_cp_unblock_device *cp = data; 2483 u8 status; 2484 int err; 2485 2486 BT_DBG("%s", hdev->name); 2487 2488 hci_dev_lock(hdev); 2489 2490 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type); 2491 if (err < 0) 2492 status = MGMT_STATUS_INVALID_PARAMS; 2493 else 2494 status = 0; 2495 2496 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 2497 &cp->addr, sizeof(cp->addr)); 2498 2499 hci_dev_unlock(hdev); 2500 2501 return err; 2502 } 2503 2504 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 2505 void *data, u16 len) 2506 { 2507 struct mgmt_mode *cp = data; 2508 struct hci_cp_write_page_scan_activity acp; 2509 u8 type; 2510 int err; 2511 2512 BT_DBG("%s", hdev->name); 2513 2514 if (!hdev_is_powered(hdev)) 2515 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2516 MGMT_STATUS_NOT_POWERED); 2517 2518 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2519 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2520 MGMT_STATUS_REJECTED); 2521 2522 hci_dev_lock(hdev); 2523 2524 if (cp->val) { 2525 type = PAGE_SCAN_TYPE_INTERLACED; 2526 2527 /* 22.5 msec page scan interval */ 2528 acp.interval = __constant_cpu_to_le16(0x0024); 2529 } else { 2530 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 2531 2532 /* default 1.28 sec page scan */ 2533 acp.interval = __constant_cpu_to_le16(0x0800); 2534 } 2535 2536 /* default 11.25 msec page scan window */ 2537 acp.window = __constant_cpu_to_le16(0x0012); 2538 2539 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp), 2540 &acp); 2541 if (err < 0) { 2542 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2543 MGMT_STATUS_FAILED); 2544 goto done; 2545 } 2546 2547 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type); 2548 if (err < 0) { 2549 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 2550 MGMT_STATUS_FAILED); 2551 goto done; 2552 } 2553 2554 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0, 2555 NULL, 0); 2556 done: 2557 hci_dev_unlock(hdev); 2558 return err; 2559 } 2560 2561 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 2562 void *cp_data, u16 len) 2563 { 2564 struct mgmt_cp_load_long_term_keys *cp = cp_data; 2565 u16 key_count, expected_len; 2566 int i; 2567 2568 key_count = get_unaligned_le16(&cp->key_count); 2569 2570 expected_len = sizeof(*cp) + key_count * 2571 sizeof(struct mgmt_ltk_info); 2572 if (expected_len != len) { 2573 BT_ERR("load_keys: expected %u bytes, got %u bytes", 2574 len, expected_len); 2575 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 2576 EINVAL); 2577 } 2578 2579 BT_DBG("%s key_count %u", hdev->name, key_count); 2580 2581 hci_dev_lock(hdev); 2582 2583 hci_smp_ltks_clear(hdev); 2584 2585 for (i = 0; i < key_count; i++) { 2586 struct mgmt_ltk_info *key = &cp->keys[i]; 2587 u8 type; 2588 2589 if (key->master) 2590 type = HCI_SMP_LTK; 2591 else 2592 type = HCI_SMP_LTK_SLAVE; 2593 2594 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type, 2595 type, 0, key->authenticated, key->val, 2596 key->enc_size, key->ediv, key->rand); 2597 } 2598 2599 hci_dev_unlock(hdev); 2600 2601 return 0; 2602 } 2603 2604 struct mgmt_handler { 2605 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data, 2606 u16 data_len); 2607 bool var_len; 2608 size_t data_len; 2609 } mgmt_handlers[] = { 2610 { NULL }, /* 0x0000 (no command) */ 2611 { read_version, false, MGMT_READ_VERSION_SIZE }, 2612 { read_commands, false, MGMT_READ_COMMANDS_SIZE }, 2613 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE }, 2614 { read_controller_info, false, MGMT_READ_INFO_SIZE }, 2615 { set_powered, false, MGMT_SETTING_SIZE }, 2616 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE }, 2617 { set_connectable, false, MGMT_SETTING_SIZE }, 2618 { set_fast_connectable, false, MGMT_SETTING_SIZE }, 2619 { set_pairable, false, MGMT_SETTING_SIZE }, 2620 { set_link_security, false, MGMT_SETTING_SIZE }, 2621 { set_ssp, false, MGMT_SETTING_SIZE }, 2622 { set_hs, false, MGMT_SETTING_SIZE }, 2623 { set_le, false, MGMT_SETTING_SIZE }, 2624 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE }, 2625 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE }, 2626 { add_uuid, false, MGMT_ADD_UUID_SIZE }, 2627 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE }, 2628 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE }, 2629 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE }, 2630 { disconnect, false, MGMT_DISCONNECT_SIZE }, 2631 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE }, 2632 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE }, 2633 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 2634 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE }, 2635 { pair_device, false, MGMT_PAIR_DEVICE_SIZE }, 2636 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 2637 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE }, 2638 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE }, 2639 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 2640 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE }, 2641 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 2642 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 2643 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE }, 2644 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 2645 { start_discovery, false, MGMT_START_DISCOVERY_SIZE }, 2646 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE }, 2647 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE }, 2648 { block_device, false, MGMT_BLOCK_DEVICE_SIZE }, 2649 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE }, 2650 }; 2651 2652 2653 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen) 2654 { 2655 void *buf; 2656 u8 *cp; 2657 struct mgmt_hdr *hdr; 2658 u16 opcode, index, len; 2659 struct hci_dev *hdev = NULL; 2660 struct mgmt_handler *handler; 2661 int err; 2662 2663 BT_DBG("got %zu bytes", msglen); 2664 2665 if (msglen < sizeof(*hdr)) 2666 return -EINVAL; 2667 2668 buf = kmalloc(msglen, GFP_KERNEL); 2669 if (!buf) 2670 return -ENOMEM; 2671 2672 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) { 2673 err = -EFAULT; 2674 goto done; 2675 } 2676 2677 hdr = buf; 2678 opcode = get_unaligned_le16(&hdr->opcode); 2679 index = get_unaligned_le16(&hdr->index); 2680 len = get_unaligned_le16(&hdr->len); 2681 2682 if (len != msglen - sizeof(*hdr)) { 2683 err = -EINVAL; 2684 goto done; 2685 } 2686 2687 if (index != MGMT_INDEX_NONE) { 2688 hdev = hci_dev_get(index); 2689 if (!hdev) { 2690 err = cmd_status(sk, index, opcode, 2691 MGMT_STATUS_INVALID_INDEX); 2692 goto done; 2693 } 2694 } 2695 2696 if (opcode >= ARRAY_SIZE(mgmt_handlers) || 2697 mgmt_handlers[opcode].func == NULL) { 2698 BT_DBG("Unknown op %u", opcode); 2699 err = cmd_status(sk, index, opcode, 2700 MGMT_STATUS_UNKNOWN_COMMAND); 2701 goto done; 2702 } 2703 2704 if ((hdev && opcode < MGMT_OP_READ_INFO) || 2705 (!hdev && opcode >= MGMT_OP_READ_INFO)) { 2706 err = cmd_status(sk, index, opcode, 2707 MGMT_STATUS_INVALID_INDEX); 2708 goto done; 2709 } 2710 2711 handler = &mgmt_handlers[opcode]; 2712 2713 if ((handler->var_len && len < handler->data_len) || 2714 (!handler->var_len && len != handler->data_len)) { 2715 err = cmd_status(sk, index, opcode, 2716 MGMT_STATUS_INVALID_PARAMS); 2717 goto done; 2718 } 2719 2720 if (hdev) 2721 mgmt_init_hdev(sk, hdev); 2722 2723 cp = buf + sizeof(*hdr); 2724 2725 err = handler->func(sk, hdev, cp, len); 2726 if (err < 0) 2727 goto done; 2728 2729 err = msglen; 2730 2731 done: 2732 if (hdev) 2733 hci_dev_put(hdev); 2734 2735 kfree(buf); 2736 return err; 2737 } 2738 2739 static void cmd_status_rsp(struct pending_cmd *cmd, void *data) 2740 { 2741 u8 *status = data; 2742 2743 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 2744 mgmt_pending_remove(cmd); 2745 } 2746 2747 int mgmt_index_added(struct hci_dev *hdev) 2748 { 2749 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL); 2750 } 2751 2752 int mgmt_index_removed(struct hci_dev *hdev) 2753 { 2754 u8 status = MGMT_STATUS_INVALID_INDEX; 2755 2756 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status); 2757 2758 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL); 2759 } 2760 2761 struct cmd_lookup { 2762 struct sock *sk; 2763 struct hci_dev *hdev; 2764 u8 mgmt_status; 2765 }; 2766 2767 static void settings_rsp(struct pending_cmd *cmd, void *data) 2768 { 2769 struct cmd_lookup *match = data; 2770 2771 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 2772 2773 list_del(&cmd->list); 2774 2775 if (match->sk == NULL) { 2776 match->sk = cmd->sk; 2777 sock_hold(match->sk); 2778 } 2779 2780 mgmt_pending_free(cmd); 2781 } 2782 2783 int mgmt_powered(struct hci_dev *hdev, u8 powered) 2784 { 2785 struct cmd_lookup match = { NULL, hdev }; 2786 int err; 2787 2788 if (!test_bit(HCI_MGMT, &hdev->dev_flags)) 2789 return 0; 2790 2791 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 2792 2793 if (powered) { 2794 u8 scan = 0; 2795 2796 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2797 scan |= SCAN_PAGE; 2798 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 2799 scan |= SCAN_INQUIRY; 2800 2801 if (scan) 2802 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 2803 2804 update_class(hdev); 2805 update_name(hdev, hdev->dev_name); 2806 update_eir(hdev); 2807 } else { 2808 u8 status = MGMT_STATUS_NOT_POWERED; 2809 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status); 2810 } 2811 2812 err = new_settings(hdev, match.sk); 2813 2814 if (match.sk) 2815 sock_put(match.sk); 2816 2817 return err; 2818 } 2819 2820 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable) 2821 { 2822 struct cmd_lookup match = { NULL, hdev }; 2823 bool changed = false; 2824 int err = 0; 2825 2826 if (discoverable) { 2827 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 2828 changed = true; 2829 } else { 2830 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 2831 changed = true; 2832 } 2833 2834 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, 2835 &match); 2836 2837 if (changed) 2838 err = new_settings(hdev, match.sk); 2839 2840 if (match.sk) 2841 sock_put(match.sk); 2842 2843 return err; 2844 } 2845 2846 int mgmt_connectable(struct hci_dev *hdev, u8 connectable) 2847 { 2848 struct cmd_lookup match = { NULL, hdev }; 2849 bool changed = false; 2850 int err = 0; 2851 2852 if (connectable) { 2853 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2854 changed = true; 2855 } else { 2856 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 2857 changed = true; 2858 } 2859 2860 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp, 2861 &match); 2862 2863 if (changed) 2864 err = new_settings(hdev, match.sk); 2865 2866 if (match.sk) 2867 sock_put(match.sk); 2868 2869 return err; 2870 } 2871 2872 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status) 2873 { 2874 u8 mgmt_err = mgmt_status(status); 2875 2876 if (scan & SCAN_PAGE) 2877 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, 2878 cmd_status_rsp, &mgmt_err); 2879 2880 if (scan & SCAN_INQUIRY) 2881 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, 2882 cmd_status_rsp, &mgmt_err); 2883 2884 return 0; 2885 } 2886 2887 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent) 2888 { 2889 struct mgmt_ev_new_link_key ev; 2890 2891 memset(&ev, 0, sizeof(ev)); 2892 2893 ev.store_hint = persistent; 2894 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 2895 ev.key.addr.type = MGMT_ADDR_BREDR; 2896 ev.key.type = key->type; 2897 memcpy(ev.key.val, key->val, 16); 2898 ev.key.pin_len = key->pin_len; 2899 2900 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 2901 } 2902 2903 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent) 2904 { 2905 struct mgmt_ev_new_long_term_key ev; 2906 2907 memset(&ev, 0, sizeof(ev)); 2908 2909 ev.store_hint = persistent; 2910 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 2911 ev.key.addr.type = key->bdaddr_type; 2912 ev.key.authenticated = key->authenticated; 2913 ev.key.enc_size = key->enc_size; 2914 ev.key.ediv = key->ediv; 2915 2916 if (key->type == HCI_SMP_LTK) 2917 ev.key.master = 1; 2918 2919 memcpy(ev.key.rand, key->rand, sizeof(key->rand)); 2920 memcpy(ev.key.val, key->val, sizeof(key->val)); 2921 2922 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), 2923 NULL); 2924 } 2925 2926 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 2927 u8 addr_type, u32 flags, u8 *name, u8 name_len, 2928 u8 *dev_class) 2929 { 2930 char buf[512]; 2931 struct mgmt_ev_device_connected *ev = (void *) buf; 2932 u16 eir_len = 0; 2933 2934 bacpy(&ev->addr.bdaddr, bdaddr); 2935 ev->addr.type = link_to_mgmt(link_type, addr_type); 2936 2937 ev->flags = __cpu_to_le32(flags); 2938 2939 if (name_len > 0) 2940 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 2941 name, name_len); 2942 2943 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0) 2944 eir_len = eir_append_data(ev->eir, eir_len, 2945 EIR_CLASS_OF_DEV, dev_class, 3); 2946 2947 put_unaligned_le16(eir_len, &ev->eir_len); 2948 2949 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 2950 sizeof(*ev) + eir_len, NULL); 2951 } 2952 2953 static void disconnect_rsp(struct pending_cmd *cmd, void *data) 2954 { 2955 struct mgmt_cp_disconnect *cp = cmd->param; 2956 struct sock **sk = data; 2957 struct mgmt_rp_disconnect rp; 2958 2959 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2960 rp.addr.type = cp->addr.type; 2961 2962 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp, 2963 sizeof(rp)); 2964 2965 *sk = cmd->sk; 2966 sock_hold(*sk); 2967 2968 mgmt_pending_remove(cmd); 2969 } 2970 2971 static void unpair_device_rsp(struct pending_cmd *cmd, void *data) 2972 { 2973 struct hci_dev *hdev = data; 2974 struct mgmt_cp_unpair_device *cp = cmd->param; 2975 struct mgmt_rp_unpair_device rp; 2976 2977 memset(&rp, 0, sizeof(rp)); 2978 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2979 rp.addr.type = cp->addr.type; 2980 2981 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2982 2983 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp)); 2984 2985 mgmt_pending_remove(cmd); 2986 } 2987 2988 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 2989 u8 link_type, u8 addr_type) 2990 { 2991 struct mgmt_addr_info ev; 2992 struct sock *sk = NULL; 2993 int err; 2994 2995 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 2996 2997 bacpy(&ev.bdaddr, bdaddr); 2998 ev.type = link_to_mgmt(link_type, addr_type); 2999 3000 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), 3001 sk); 3002 3003 if (sk) 3004 sock_put(sk); 3005 3006 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 3007 hdev); 3008 3009 return err; 3010 } 3011 3012 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 3013 u8 link_type, u8 addr_type, u8 status) 3014 { 3015 struct mgmt_rp_disconnect rp; 3016 struct pending_cmd *cmd; 3017 int err; 3018 3019 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev); 3020 if (!cmd) 3021 return -ENOENT; 3022 3023 bacpy(&rp.addr.bdaddr, bdaddr); 3024 rp.addr.type = link_to_mgmt(link_type, addr_type); 3025 3026 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 3027 mgmt_status(status), &rp, sizeof(rp)); 3028 3029 mgmt_pending_remove(cmd); 3030 3031 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 3032 hdev); 3033 return err; 3034 } 3035 3036 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3037 u8 addr_type, u8 status) 3038 { 3039 struct mgmt_ev_connect_failed ev; 3040 3041 bacpy(&ev.addr.bdaddr, bdaddr); 3042 ev.addr.type = link_to_mgmt(link_type, addr_type); 3043 ev.status = mgmt_status(status); 3044 3045 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 3046 } 3047 3048 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 3049 { 3050 struct mgmt_ev_pin_code_request ev; 3051 3052 bacpy(&ev.addr.bdaddr, bdaddr); 3053 ev.addr.type = MGMT_ADDR_BREDR; 3054 ev.secure = secure; 3055 3056 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), 3057 NULL); 3058 } 3059 3060 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3061 u8 status) 3062 { 3063 struct pending_cmd *cmd; 3064 struct mgmt_rp_pin_code_reply rp; 3065 int err; 3066 3067 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 3068 if (!cmd) 3069 return -ENOENT; 3070 3071 bacpy(&rp.addr.bdaddr, bdaddr); 3072 rp.addr.type = MGMT_ADDR_BREDR; 3073 3074 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3075 mgmt_status(status), &rp, sizeof(rp)); 3076 3077 mgmt_pending_remove(cmd); 3078 3079 return err; 3080 } 3081 3082 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3083 u8 status) 3084 { 3085 struct pending_cmd *cmd; 3086 struct mgmt_rp_pin_code_reply rp; 3087 int err; 3088 3089 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 3090 if (!cmd) 3091 return -ENOENT; 3092 3093 bacpy(&rp.addr.bdaddr, bdaddr); 3094 rp.addr.type = MGMT_ADDR_BREDR; 3095 3096 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, 3097 mgmt_status(status), &rp, sizeof(rp)); 3098 3099 mgmt_pending_remove(cmd); 3100 3101 return err; 3102 } 3103 3104 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 3105 u8 link_type, u8 addr_type, __le32 value, 3106 u8 confirm_hint) 3107 { 3108 struct mgmt_ev_user_confirm_request ev; 3109 3110 BT_DBG("%s", hdev->name); 3111 3112 bacpy(&ev.addr.bdaddr, bdaddr); 3113 ev.addr.type = link_to_mgmt(link_type, addr_type); 3114 ev.confirm_hint = confirm_hint; 3115 put_unaligned_le32(value, &ev.value); 3116 3117 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 3118 NULL); 3119 } 3120 3121 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 3122 u8 link_type, u8 addr_type) 3123 { 3124 struct mgmt_ev_user_passkey_request ev; 3125 3126 BT_DBG("%s", hdev->name); 3127 3128 bacpy(&ev.addr.bdaddr, bdaddr); 3129 ev.addr.type = link_to_mgmt(link_type, addr_type); 3130 3131 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 3132 NULL); 3133 } 3134 3135 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3136 u8 link_type, u8 addr_type, u8 status, 3137 u8 opcode) 3138 { 3139 struct pending_cmd *cmd; 3140 struct mgmt_rp_user_confirm_reply rp; 3141 int err; 3142 3143 cmd = mgmt_pending_find(opcode, hdev); 3144 if (!cmd) 3145 return -ENOENT; 3146 3147 bacpy(&rp.addr.bdaddr, bdaddr); 3148 rp.addr.type = link_to_mgmt(link_type, addr_type); 3149 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status), 3150 &rp, sizeof(rp)); 3151 3152 mgmt_pending_remove(cmd); 3153 3154 return err; 3155 } 3156 3157 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3158 u8 link_type, u8 addr_type, u8 status) 3159 { 3160 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3161 status, MGMT_OP_USER_CONFIRM_REPLY); 3162 } 3163 3164 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3165 u8 link_type, u8 addr_type, u8 status) 3166 { 3167 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3168 status, MGMT_OP_USER_CONFIRM_NEG_REPLY); 3169 } 3170 3171 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3172 u8 link_type, u8 addr_type, u8 status) 3173 { 3174 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3175 status, MGMT_OP_USER_PASSKEY_REPLY); 3176 } 3177 3178 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 3179 u8 link_type, u8 addr_type, u8 status) 3180 { 3181 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 3182 status, MGMT_OP_USER_PASSKEY_NEG_REPLY); 3183 } 3184 3185 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3186 u8 addr_type, u8 status) 3187 { 3188 struct mgmt_ev_auth_failed ev; 3189 3190 bacpy(&ev.addr.bdaddr, bdaddr); 3191 ev.addr.type = link_to_mgmt(link_type, addr_type); 3192 ev.status = mgmt_status(status); 3193 3194 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL); 3195 } 3196 3197 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 3198 { 3199 struct cmd_lookup match = { NULL, hdev }; 3200 bool changed = false; 3201 int err = 0; 3202 3203 if (status) { 3204 u8 mgmt_err = mgmt_status(status); 3205 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 3206 cmd_status_rsp, &mgmt_err); 3207 return 0; 3208 } 3209 3210 if (test_bit(HCI_AUTH, &hdev->flags)) { 3211 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 3212 changed = true; 3213 } else { 3214 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 3215 changed = true; 3216 } 3217 3218 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 3219 &match); 3220 3221 if (changed) 3222 err = new_settings(hdev, match.sk); 3223 3224 if (match.sk) 3225 sock_put(match.sk); 3226 3227 return err; 3228 } 3229 3230 static int clear_eir(struct hci_dev *hdev) 3231 { 3232 struct hci_cp_write_eir cp; 3233 3234 if (!(hdev->features[6] & LMP_EXT_INQ)) 3235 return 0; 3236 3237 memset(hdev->eir, 0, sizeof(hdev->eir)); 3238 3239 memset(&cp, 0, sizeof(cp)); 3240 3241 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 3242 } 3243 3244 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 3245 { 3246 struct cmd_lookup match = { NULL, hdev }; 3247 bool changed = false; 3248 int err = 0; 3249 3250 if (status) { 3251 u8 mgmt_err = mgmt_status(status); 3252 3253 if (enable && test_and_clear_bit(HCI_SSP_ENABLED, 3254 &hdev->dev_flags)) 3255 err = new_settings(hdev, NULL); 3256 3257 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 3258 &mgmt_err); 3259 3260 return err; 3261 } 3262 3263 if (enable) { 3264 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 3265 changed = true; 3266 } else { 3267 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 3268 changed = true; 3269 } 3270 3271 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 3272 3273 if (changed) 3274 err = new_settings(hdev, match.sk); 3275 3276 if (match.sk) 3277 sock_put(match.sk); 3278 3279 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 3280 update_eir(hdev); 3281 else 3282 clear_eir(hdev); 3283 3284 return err; 3285 } 3286 3287 static void class_rsp(struct pending_cmd *cmd, void *data) 3288 { 3289 struct cmd_lookup *match = data; 3290 3291 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status, 3292 match->hdev->dev_class, 3); 3293 3294 list_del(&cmd->list); 3295 3296 if (match->sk == NULL) { 3297 match->sk = cmd->sk; 3298 sock_hold(match->sk); 3299 } 3300 3301 mgmt_pending_free(cmd); 3302 } 3303 3304 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 3305 u8 status) 3306 { 3307 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 3308 int err = 0; 3309 3310 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags); 3311 3312 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match); 3313 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match); 3314 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match); 3315 3316 if (!status) 3317 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3318 3, NULL); 3319 3320 if (match.sk) 3321 sock_put(match.sk); 3322 3323 return err; 3324 } 3325 3326 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 3327 { 3328 struct pending_cmd *cmd; 3329 struct mgmt_cp_set_local_name ev; 3330 bool changed = false; 3331 int err = 0; 3332 3333 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) { 3334 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 3335 changed = true; 3336 } 3337 3338 memset(&ev, 0, sizeof(ev)); 3339 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 3340 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 3341 3342 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3343 if (!cmd) 3344 goto send_event; 3345 3346 /* Always assume that either the short or the complete name has 3347 * changed if there was a pending mgmt command */ 3348 changed = true; 3349 3350 if (status) { 3351 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3352 mgmt_status(status)); 3353 goto failed; 3354 } 3355 3356 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev, 3357 sizeof(ev)); 3358 if (err < 0) 3359 goto failed; 3360 3361 send_event: 3362 if (changed) 3363 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, 3364 sizeof(ev), cmd ? cmd->sk : NULL); 3365 3366 update_eir(hdev); 3367 3368 failed: 3369 if (cmd) 3370 mgmt_pending_remove(cmd); 3371 return err; 3372 } 3373 3374 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash, 3375 u8 *randomizer, u8 status) 3376 { 3377 struct pending_cmd *cmd; 3378 int err; 3379 3380 BT_DBG("%s status %u", hdev->name, status); 3381 3382 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 3383 if (!cmd) 3384 return -ENOENT; 3385 3386 if (status) { 3387 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 3388 mgmt_status(status)); 3389 } else { 3390 struct mgmt_rp_read_local_oob_data rp; 3391 3392 memcpy(rp.hash, hash, sizeof(rp.hash)); 3393 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer)); 3394 3395 err = cmd_complete(cmd->sk, hdev->id, 3396 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp, 3397 sizeof(rp)); 3398 } 3399 3400 mgmt_pending_remove(cmd); 3401 3402 return err; 3403 } 3404 3405 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 3406 { 3407 struct cmd_lookup match = { NULL, hdev }; 3408 bool changed = false; 3409 int err = 0; 3410 3411 if (status) { 3412 u8 mgmt_err = mgmt_status(status); 3413 3414 if (enable && test_and_clear_bit(HCI_LE_ENABLED, 3415 &hdev->dev_flags)) 3416 err = new_settings(hdev, NULL); 3417 3418 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, 3419 cmd_status_rsp, &mgmt_err); 3420 3421 return err; 3422 } 3423 3424 if (enable) { 3425 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 3426 changed = true; 3427 } else { 3428 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 3429 changed = true; 3430 } 3431 3432 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 3433 3434 if (changed) 3435 err = new_settings(hdev, match.sk); 3436 3437 if (match.sk) 3438 sock_put(match.sk); 3439 3440 return err; 3441 } 3442 3443 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3444 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8 3445 ssp, u8 *eir, u16 eir_len) 3446 { 3447 char buf[512]; 3448 struct mgmt_ev_device_found *ev = (void *) buf; 3449 size_t ev_size; 3450 3451 /* Leave 5 bytes for a potential CoD field */ 3452 if (sizeof(*ev) + eir_len + 5 > sizeof(buf)) 3453 return -EINVAL; 3454 3455 memset(buf, 0, sizeof(buf)); 3456 3457 bacpy(&ev->addr.bdaddr, bdaddr); 3458 ev->addr.type = link_to_mgmt(link_type, addr_type); 3459 ev->rssi = rssi; 3460 if (cfm_name) 3461 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME; 3462 if (!ssp) 3463 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING; 3464 3465 if (eir_len > 0) 3466 memcpy(ev->eir, eir, eir_len); 3467 3468 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV)) 3469 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 3470 dev_class, 3); 3471 3472 put_unaligned_le16(eir_len, &ev->eir_len); 3473 3474 ev_size = sizeof(*ev) + eir_len; 3475 3476 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 3477 } 3478 3479 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 3480 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 3481 { 3482 struct mgmt_ev_device_found *ev; 3483 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 3484 u16 eir_len; 3485 3486 ev = (struct mgmt_ev_device_found *) buf; 3487 3488 memset(buf, 0, sizeof(buf)); 3489 3490 bacpy(&ev->addr.bdaddr, bdaddr); 3491 ev->addr.type = link_to_mgmt(link_type, addr_type); 3492 ev->rssi = rssi; 3493 3494 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 3495 name_len); 3496 3497 put_unaligned_le16(eir_len, &ev->eir_len); 3498 3499 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, 3500 sizeof(*ev) + eir_len, NULL); 3501 } 3502 3503 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status) 3504 { 3505 struct pending_cmd *cmd; 3506 u8 type; 3507 int err; 3508 3509 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3510 3511 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 3512 if (!cmd) 3513 return -ENOENT; 3514 3515 type = hdev->discovery.type; 3516 3517 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 3518 &type, sizeof(type)); 3519 mgmt_pending_remove(cmd); 3520 3521 return err; 3522 } 3523 3524 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status) 3525 { 3526 struct pending_cmd *cmd; 3527 int err; 3528 3529 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 3530 if (!cmd) 3531 return -ENOENT; 3532 3533 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 3534 &hdev->discovery.type, sizeof(hdev->discovery.type)); 3535 mgmt_pending_remove(cmd); 3536 3537 return err; 3538 } 3539 3540 int mgmt_discovering(struct hci_dev *hdev, u8 discovering) 3541 { 3542 struct mgmt_ev_discovering ev; 3543 struct pending_cmd *cmd; 3544 3545 BT_DBG("%s discovering %u", hdev->name, discovering); 3546 3547 if (discovering) 3548 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 3549 else 3550 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 3551 3552 if (cmd != NULL) { 3553 u8 type = hdev->discovery.type; 3554 3555 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type, 3556 sizeof(type)); 3557 mgmt_pending_remove(cmd); 3558 } 3559 3560 memset(&ev, 0, sizeof(ev)); 3561 ev.type = hdev->discovery.type; 3562 ev.discovering = discovering; 3563 3564 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 3565 } 3566 3567 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 3568 { 3569 struct pending_cmd *cmd; 3570 struct mgmt_ev_device_blocked ev; 3571 3572 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev); 3573 3574 bacpy(&ev.addr.bdaddr, bdaddr); 3575 ev.addr.type = type; 3576 3577 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev), 3578 cmd ? cmd->sk : NULL); 3579 } 3580 3581 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 3582 { 3583 struct pending_cmd *cmd; 3584 struct mgmt_ev_device_unblocked ev; 3585 3586 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev); 3587 3588 bacpy(&ev.addr.bdaddr, bdaddr); 3589 ev.addr.type = type; 3590 3591 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev), 3592 cmd ? cmd->sk : NULL); 3593 } 3594 3595 module_param(enable_hs, bool, 0644); 3596 MODULE_PARM_DESC(enable_hs, "Enable High Speed support"); 3597 3598 module_param(enable_le, bool, 0644); 3599 MODULE_PARM_DESC(enable_le, "Enable Low Energy support"); 3600