Gitiles
Code Review Sign In
192.168.1.100 / T106_DC / a73b55e6fed1dd12bd51da4bc1baf68c0ff35d59 / . / ap / os / linux / linux-3.4.x / net / bluetooth / mgmt.c
blob: bd227e6a85a62e11e26e56b6ffc8fd382966897a [file] [log] [blame]
lh9ed821d2023-04-07 01:36:19 -0700[diff] [blame]1/*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
27#include <linux/kernel.h>
28#include <linux/uaccess.h>
29#include <linux/module.h>
30#include <asm/unaligned.h>
31
32#include <net/bluetooth/bluetooth.h>
33#include <net/bluetooth/hci_core.h>
34#include <net/bluetooth/mgmt.h>
35#include <net/bluetooth/smp.h>
36
37bool enable_hs;
38bool enable_le;
39
40#define MGMT_VERSION 1
41#define MGMT_REVISION 0
42
43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_PAIRABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81};
82
83static const u16 mgmt_events[] = {
84 MGMT_EV_CONTROLLER_ERROR,
85 MGMT_EV_INDEX_ADDED,
86 MGMT_EV_INDEX_REMOVED,
87 MGMT_EV_NEW_SETTINGS,
88 MGMT_EV_CLASS_OF_DEV_CHANGED,
89 MGMT_EV_LOCAL_NAME_CHANGED,
90 MGMT_EV_NEW_LINK_KEY,
91 MGMT_EV_NEW_LONG_TERM_KEY,
92 MGMT_EV_DEVICE_CONNECTED,
93 MGMT_EV_DEVICE_DISCONNECTED,
94 MGMT_EV_CONNECT_FAILED,
95 MGMT_EV_PIN_CODE_REQUEST,
96 MGMT_EV_USER_CONFIRM_REQUEST,
97 MGMT_EV_USER_PASSKEY_REQUEST,
98 MGMT_EV_AUTH_FAILED,
99 MGMT_EV_DEVICE_FOUND,
100 MGMT_EV_DISCOVERING,
101 MGMT_EV_DEVICE_BLOCKED,
102 MGMT_EV_DEVICE_UNBLOCKED,
103 MGMT_EV_DEVICE_UNPAIRED,
104};
105
106/*
107 * These LE scan and inquiry parameters were chosen according to LE General
108 * Discovery Procedure specification.
109 */
110#define LE_SCAN_TYPE 0x01
111#define LE_SCAN_WIN 0x12
112#define LE_SCAN_INT 0x12
113#define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
114#define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
115
116#define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
117#define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
118
119#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
120
121#define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
122 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
123
124struct pending_cmd {
125 struct list_head list;
126 u16 opcode;
127 int index;
128 void *param;
129 struct sock *sk;
130 void *user_data;
131};
132
133/* HCI to MGMT error code conversion table */
134static u8 mgmt_status_table[] = {
135 MGMT_STATUS_SUCCESS,
136 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
137 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
138 MGMT_STATUS_FAILED, /* Hardware Failure */
139 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
140 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
141 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
142 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
143 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
144 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
145 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
146 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
147 MGMT_STATUS_BUSY, /* Command Disallowed */
148 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
149 MGMT_STATUS_REJECTED, /* Rejected Security */
150 MGMT_STATUS_REJECTED, /* Rejected Personal */
151 MGMT_STATUS_TIMEOUT, /* Host Timeout */
152 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
153 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
154 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
155 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
156 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
157 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
158 MGMT_STATUS_BUSY, /* Repeated Attempts */
159 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
160 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
161 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
162 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
163 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
164 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
165 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
166 MGMT_STATUS_FAILED, /* Unspecified Error */
167 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
168 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
169 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
170 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
171 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
172 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
173 MGMT_STATUS_FAILED, /* Unit Link Key Used */
174 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
175 MGMT_STATUS_TIMEOUT, /* Instant Passed */
176 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
177 MGMT_STATUS_FAILED, /* Transaction Collision */
178 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
179 MGMT_STATUS_REJECTED, /* QoS Rejected */
180 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
181 MGMT_STATUS_REJECTED, /* Insufficient Security */
182 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
183 MGMT_STATUS_BUSY, /* Role Switch Pending */
184 MGMT_STATUS_FAILED, /* Slot Violation */
185 MGMT_STATUS_FAILED, /* Role Switch Failed */
186 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
187 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
188 MGMT_STATUS_BUSY, /* Host Busy Pairing */
189 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
190 MGMT_STATUS_BUSY, /* Controller Busy */
191 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
192 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
193 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
194 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
195 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
196};
197
198static u8 mgmt_status(u8 hci_status)
199{
200 if (hci_status < ARRAY_SIZE(mgmt_status_table))
201 return mgmt_status_table[hci_status];
202
203 return MGMT_STATUS_FAILED;
204}
205
206static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
207{
208 struct sk_buff *skb;
209 struct mgmt_hdr *hdr;
210 struct mgmt_ev_cmd_status *ev;
211 int err;
212
213 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
214
215 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
216 if (!skb)
217 return -ENOMEM;
218
219 hdr = (void *) skb_put(skb, sizeof(*hdr));
220
221 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
222 hdr->index = cpu_to_le16(index);
223 hdr->len = cpu_to_le16(sizeof(*ev));
224
225 ev = (void *) skb_put(skb, sizeof(*ev));
226 ev->status = status;
227 put_unaligned_le16(cmd, &ev->opcode);
228
229 err = sock_queue_rcv_skb(sk, skb);
230 if (err < 0)
231 kfree_skb(skb);
232
233 return err;
234}
235
236static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
237 void *rp, size_t rp_len)
238{
239 struct sk_buff *skb;
240 struct mgmt_hdr *hdr;
241 struct mgmt_ev_cmd_complete *ev;
242 int err;
243
244 BT_DBG("sock %p", sk);
245
246 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
247 if (!skb)
248 return -ENOMEM;
249
250 hdr = (void *) skb_put(skb, sizeof(*hdr));
251
252 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
253 hdr->index = cpu_to_le16(index);
254 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
255
256 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
257 put_unaligned_le16(cmd, &ev->opcode);
258 ev->status = status;
259
260 if (rp)
261 memcpy(ev->data, rp, rp_len);
262
263 err = sock_queue_rcv_skb(sk, skb);
264 if (err < 0)
265 kfree_skb(skb);
266
267 return err;
268}
269
270static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
271 u16 data_len)
272{
273 struct mgmt_rp_read_version rp;
274
275 BT_DBG("sock %p", sk);
276
277 rp.version = MGMT_VERSION;
278 put_unaligned_le16(MGMT_REVISION, &rp.revision);
279
280 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
281 sizeof(rp));
282}
283
284static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
285 u16 data_len)
286{
287 struct mgmt_rp_read_commands *rp;
288 u16 num_commands = ARRAY_SIZE(mgmt_commands);
289 u16 num_events = ARRAY_SIZE(mgmt_events);
290 u16 *opcode;
291 size_t rp_size;
292 int i, err;
293
294 BT_DBG("sock %p", sk);
295
296 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
297
298 rp = kmalloc(rp_size, GFP_KERNEL);
299 if (!rp)
300 return -ENOMEM;
301
302 put_unaligned_le16(num_commands, &rp->num_commands);
303 put_unaligned_le16(num_events, &rp->num_events);
304
305 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
306 put_unaligned_le16(mgmt_commands[i], opcode);
307
308 for (i = 0; i < num_events; i++, opcode++)
309 put_unaligned_le16(mgmt_events[i], opcode);
310
311 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
312 rp_size);
313 kfree(rp);
314
315 return err;
316}
317
318static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
319 u16 data_len)
320{
321 struct mgmt_rp_read_index_list *rp;
322 struct list_head *p;
323 struct hci_dev *d;
324 size_t rp_len;
325 u16 count;
326 int i, err;
327
328 BT_DBG("sock %p", sk);
329
330 read_lock(&hci_dev_list_lock);
331
332 count = 0;
333 list_for_each(p, &hci_dev_list) {
334 count++;
335 }
336
337 rp_len = sizeof(*rp) + (2 * count);
338 rp = kmalloc(rp_len, GFP_ATOMIC);
339 if (!rp) {
340 read_unlock(&hci_dev_list_lock);
341 return -ENOMEM;
342 }
343
344 put_unaligned_le16(count, &rp->num_controllers);
345
346 i = 0;
347 list_for_each_entry(d, &hci_dev_list, list) {
348 if (test_bit(HCI_SETUP, &d->dev_flags))
349 continue;
350
351 put_unaligned_le16(d->id, &rp->index[i++]);
352 BT_DBG("Added hci%u", d->id);
353 }
354
355 read_unlock(&hci_dev_list_lock);
356
357 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
358 rp_len);
359
360 kfree(rp);
361
362 return err;
363}
364
365static u32 get_supported_settings(struct hci_dev *hdev)
366{
367 u32 settings = 0;
368
369 settings |= MGMT_SETTING_POWERED;
370 settings |= MGMT_SETTING_CONNECTABLE;
371 settings |= MGMT_SETTING_FAST_CONNECTABLE;
372 settings |= MGMT_SETTING_DISCOVERABLE;
373 settings |= MGMT_SETTING_PAIRABLE;
374
375 if (hdev->features[6] & LMP_SIMPLE_PAIR)
376 settings |= MGMT_SETTING_SSP;
377
378 if (!(hdev->features[4] & LMP_NO_BREDR)) {
379 settings |= MGMT_SETTING_BREDR;
380 settings |= MGMT_SETTING_LINK_SECURITY;
381 }
382
383 if (enable_hs)
384 settings |= MGMT_SETTING_HS;
385
386 if (enable_le) {
387 if (hdev->features[4] & LMP_LE)
388 settings |= MGMT_SETTING_LE;
389 }
390
391 return settings;
392}
393
394static u32 get_current_settings(struct hci_dev *hdev)
395{
396 u32 settings = 0;
397
398 if (hdev_is_powered(hdev))
399 settings |= MGMT_SETTING_POWERED;
400
401 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
402 settings |= MGMT_SETTING_CONNECTABLE;
403
404 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
405 settings |= MGMT_SETTING_DISCOVERABLE;
406
407 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
408 settings |= MGMT_SETTING_PAIRABLE;
409
410 if (!(hdev->features[4] & LMP_NO_BREDR))
411 settings |= MGMT_SETTING_BREDR;
412
413 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
414 settings |= MGMT_SETTING_LE;
415
416 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
417 settings |= MGMT_SETTING_LINK_SECURITY;
418
419 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
420 settings |= MGMT_SETTING_SSP;
421
422 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
423 settings |= MGMT_SETTING_HS;
424
425 return settings;
426}
427
428#define PNP_INFO_SVCLASS_ID 0x1200
429
430static u8 bluetooth_base_uuid[] = {
431 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
432 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
433};
434
435static u16 get_uuid16(u8 *uuid128)
436{
437 u32 val;
438 int i;
439
440 for (i = 0; i < 12; i++) {
441 if (bluetooth_base_uuid[i] != uuid128[i])
442 return 0;
443 }
444
445 memcpy(&val, &uuid128[12], 4);
446
447 val = le32_to_cpu(val);
448 if (val > 0xffff)
449 return 0;
450
451 return (u16) val;
452}
453
454static void create_eir(struct hci_dev *hdev, u8 *data)
455{
456 u8 *ptr = data;
457 u16 eir_len = 0;
458 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
459 int i, truncated = 0;
460 struct bt_uuid *uuid;
461 size_t name_len;
462
463 name_len = strlen(hdev->dev_name);
464
465 if (name_len > 0) {
466 /* EIR Data type */
467 if (name_len > 48) {
468 name_len = 48;
469 ptr[1] = EIR_NAME_SHORT;
470 } else
471 ptr[1] = EIR_NAME_COMPLETE;
472
473 /* EIR Data length */
474 ptr[0] = name_len + 1;
475
476 memcpy(ptr + 2, hdev->dev_name, name_len);
477
478 eir_len += (name_len + 2);
479 ptr += (name_len + 2);
480 }
481
482 memset(uuid16_list, 0, sizeof(uuid16_list));
483
484 /* Group all UUID16 types */
485 list_for_each_entry(uuid, &hdev->uuids, list) {
486 u16 uuid16;
487
488 uuid16 = get_uuid16(uuid->uuid);
489 if (uuid16 == 0)
490 return;
491
492 if (uuid16 < 0x1100)
493 continue;
494
495 if (uuid16 == PNP_INFO_SVCLASS_ID)
496 continue;
497
498 /* Stop if not enough space to put next UUID */
499 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
500 truncated = 1;
501 break;
502 }
503
504 /* Check for duplicates */
505 for (i = 0; uuid16_list[i] != 0; i++)
506 if (uuid16_list[i] == uuid16)
507 break;
508
509 if (uuid16_list[i] == 0) {
510 uuid16_list[i] = uuid16;
511 eir_len += sizeof(u16);
512 }
513 }
514
515 if (uuid16_list[0] != 0) {
516 u8 *length = ptr;
517
518 /* EIR Data type */
519 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
520
521 ptr += 2;
522 eir_len += 2;
523
524 for (i = 0; uuid16_list[i] != 0; i++) {
525 *ptr++ = (uuid16_list[i] & 0x00ff);
526 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
527 }
528
529 /* EIR Data length */
530 *length = (i * sizeof(u16)) + 1;
531 }
532}
533
534static int update_eir(struct hci_dev *hdev)
535{
536 struct hci_cp_write_eir cp;
537
538 if (!hdev_is_powered(hdev))
539 return 0;
540
541 if (!(hdev->features[6] & LMP_EXT_INQ))
542 return 0;
543
544 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
545 return 0;
546
547 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
548 return 0;
549
550 memset(&cp, 0, sizeof(cp));
551
552 create_eir(hdev, cp.data);
553
554 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
555 return 0;
556
557 memcpy(hdev->eir, cp.data, sizeof(cp.data));
558
559 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
560}
561
562static u8 get_service_classes(struct hci_dev *hdev)
563{
564 struct bt_uuid *uuid;
565 u8 val = 0;
566
567 list_for_each_entry(uuid, &hdev->uuids, list)
568 val |= uuid->svc_hint;
569
570 return val;
571}
572
573static int update_class(struct hci_dev *hdev)
574{
575 u8 cod[3];
576 int err;
577
578 BT_DBG("%s", hdev->name);
579
580 if (!hdev_is_powered(hdev))
581 return 0;
582
583 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
584 return 0;
585
586 cod[0] = hdev->minor_class;
587 cod[1] = hdev->major_class;
588 cod[2] = get_service_classes(hdev);
589
590 if (memcmp(cod, hdev->dev_class, 3) == 0)
591 return 0;
592
593 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
594 if (err == 0)
595 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
596
597 return err;
598}
599
600static void service_cache_off(struct work_struct *work)
601{
602 struct hci_dev *hdev = container_of(work, struct hci_dev,
603 service_cache.work);
604
605 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
606 return;
607
608 hci_dev_lock(hdev);
609
610 update_eir(hdev);
611 update_class(hdev);
612
613 hci_dev_unlock(hdev);
614}
615
616static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
617{
618 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
619 return;
620
621 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
622
623 /* Non-mgmt controlled devices get this bit set
624 * implicitly so that pairing works for them, however
625 * for mgmt we require user-space to explicitly enable
626 * it
627 */
628 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
629}
630
631static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
632 void *data, u16 data_len)
633{
634 struct mgmt_rp_read_info rp;
635
636 BT_DBG("sock %p %s", sk, hdev->name);
637
638 hci_dev_lock(hdev);
639
640 memset(&rp, 0, sizeof(rp));
641
642 bacpy(&rp.bdaddr, &hdev->bdaddr);
643
644 rp.version = hdev->hci_ver;
645
646 put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
647
648 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
649 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
650
651 memcpy(rp.dev_class, hdev->dev_class, 3);
652
653 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
654 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
655
656 hci_dev_unlock(hdev);
657
658 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
659 sizeof(rp));
660}
661
662static void mgmt_pending_free(struct pending_cmd *cmd)
663{
664 sock_put(cmd->sk);
665 kfree(cmd->param);
666 kfree(cmd);
667}
668
669static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
670 struct hci_dev *hdev, void *data,
671 u16 len)
672{
673 struct pending_cmd *cmd;
674
675 cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
676 if (!cmd)
677 return NULL;
678
679 cmd->opcode = opcode;
680 cmd->index = hdev->id;
681
682 cmd->param = kmalloc(len, GFP_ATOMIC);
683 if (!cmd->param) {
684 kfree(cmd);
685 return NULL;
686 }
687
688 if (data)
689 memcpy(cmd->param, data, len);
690
691 cmd->sk = sk;
692 sock_hold(sk);
693
694 list_add(&cmd->list, &hdev->mgmt_pending);
695
696 return cmd;
697}
698
699static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
700 void (*cb)(struct pending_cmd *cmd, void *data),
701 void *data)
702{
703 struct list_head *p, *n;
704
705 list_for_each_safe(p, n, &hdev->mgmt_pending) {
706 struct pending_cmd *cmd;
707
708 cmd = list_entry(p, struct pending_cmd, list);
709
710 if (opcode > 0 && cmd->opcode != opcode)
711 continue;
712
713 cb(cmd, data);
714 }
715}
716
717static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
718{
719 struct pending_cmd *cmd;
720
721 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
722 if (cmd->opcode == opcode)
723 return cmd;
724 }
725
726 return NULL;
727}
728
729static void mgmt_pending_remove(struct pending_cmd *cmd)
730{
731 list_del(&cmd->list);
732 mgmt_pending_free(cmd);
733}
734
735static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
736{
737 __le32 settings = cpu_to_le32(get_current_settings(hdev));
738
739 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
740 sizeof(settings));
741}
742
743static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
744 u16 len)
745{
746 struct mgmt_mode *cp = data;
747 struct pending_cmd *cmd;
748 int err;
749
750 BT_DBG("request for %s", hdev->name);
751
752 hci_dev_lock(hdev);
753
754 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
755 cancel_delayed_work(&hdev->power_off);
756
757 if (cp->val) {
758 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
759 mgmt_powered(hdev, 1);
760 goto failed;
761 }
762 }
763
764 if (!!cp->val == hdev_is_powered(hdev)) {
765 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
766 goto failed;
767 }
768
769 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
770 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
771 MGMT_STATUS_BUSY);
772 goto failed;
773 }
774
775 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
776 if (!cmd) {
777 err = -ENOMEM;
778 goto failed;
779 }
780
781 if (cp->val)
782 schedule_work(&hdev->power_on);
783 else
784 schedule_work(&hdev->power_off.work);
785
786 err = 0;
787
788failed:
789 hci_dev_unlock(hdev);
790 return err;
791}
792
793static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
794 struct sock *skip_sk)
795{
796 struct sk_buff *skb;
797 struct mgmt_hdr *hdr;
798
799 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
800 if (!skb)
801 return -ENOMEM;
802
803 hdr = (void *) skb_put(skb, sizeof(*hdr));
804 hdr->opcode = cpu_to_le16(event);
805 if (hdev)
806 hdr->index = cpu_to_le16(hdev->id);
807 else
808 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
809 hdr->len = cpu_to_le16(data_len);
810
811 if (data)
812 memcpy(skb_put(skb, data_len), data, data_len);
813
814 /* Time stamp */
815 __net_timestamp(skb);
816
817 hci_send_to_control(skb, skip_sk);
818 kfree_skb(skb);
819
820 return 0;
821}
822
823static int new_settings(struct hci_dev *hdev, struct sock *skip)
824{
825 __le32 ev;
826
827 ev = cpu_to_le32(get_current_settings(hdev));
828
829 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
830}
831
832static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
833 u16 len)
834{
835 struct mgmt_cp_set_discoverable *cp = data;
836 struct pending_cmd *cmd;
837 u16 timeout;
838 u8 scan;
839 int err;
840
841 BT_DBG("request for %s", hdev->name);
842
843 timeout = get_unaligned_le16(&cp->timeout);
844 if (!cp->val && timeout > 0)
845 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
846 MGMT_STATUS_INVALID_PARAMS);
847
848 hci_dev_lock(hdev);
849
850 if (!hdev_is_powered(hdev) && timeout > 0) {
851 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
852 MGMT_STATUS_NOT_POWERED);
853 goto failed;
854 }
855
856 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
857 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
858 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
859 MGMT_STATUS_BUSY);
860 goto failed;
861 }
862
863 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
864 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
865 MGMT_STATUS_REJECTED);
866 goto failed;
867 }
868
869 if (!hdev_is_powered(hdev)) {
870 bool changed = false;
871
872 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
873 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
874 changed = true;
875 }
876
877 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
878 if (err < 0)
879 goto failed;
880
881 if (changed)
882 err = new_settings(hdev, sk);
883
884 goto failed;
885 }
886
887 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
888 if (hdev->discov_timeout > 0) {
889 cancel_delayed_work(&hdev->discov_off);
890 hdev->discov_timeout = 0;
891 }
892
893 if (cp->val && timeout > 0) {
894 hdev->discov_timeout = timeout;
895 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
896 msecs_to_jiffies(hdev->discov_timeout * 1000));
897 }
898
899 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
900 goto failed;
901 }
902
903 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
904 if (!cmd) {
905 err = -ENOMEM;
906 goto failed;
907 }
908
909 scan = SCAN_PAGE;
910
911 if (cp->val)
912 scan |= SCAN_INQUIRY;
913 else
914 cancel_delayed_work(&hdev->discov_off);
915
916 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
917 if (err < 0)
918 mgmt_pending_remove(cmd);
919
920 if (cp->val)
921 hdev->discov_timeout = timeout;
922
923failed:
924 hci_dev_unlock(hdev);
925 return err;
926}
927
928static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
929 u16 len)
930{
931 struct mgmt_mode *cp = data;
932 struct pending_cmd *cmd;
933 u8 scan;
934 int err;
935
936 BT_DBG("request for %s", hdev->name);
937
938 hci_dev_lock(hdev);
939
940 if (!hdev_is_powered(hdev)) {
941 bool changed = false;
942
943 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
944 changed = true;
945
946 if (cp->val) {
947 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
948 } else {
949 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
950 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
951 }
952
953 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
954 if (err < 0)
955 goto failed;
956
957 if (changed)
958 err = new_settings(hdev, sk);
959
960 goto failed;
961 }
962
963 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
964 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
965 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
966 MGMT_STATUS_BUSY);
967 goto failed;
968 }
969
970 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
971 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
972 goto failed;
973 }
974
975 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
976 if (!cmd) {
977 err = -ENOMEM;
978 goto failed;
979 }
980
981 if (cp->val) {
982 scan = SCAN_PAGE;
983 } else {
984 scan = 0;
985
986 if (test_bit(HCI_ISCAN, &hdev->flags) &&
987 hdev->discov_timeout > 0)
988 cancel_delayed_work(&hdev->discov_off);
989 }
990
991 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
992 if (err < 0)
993 mgmt_pending_remove(cmd);
994
995failed:
996 hci_dev_unlock(hdev);
997 return err;
998}
999
1000static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1001 u16 len)
1002{
1003 struct mgmt_mode *cp = data;
1004 int err;
1005
1006 BT_DBG("request for %s", hdev->name);
1007
1008 hci_dev_lock(hdev);
1009
1010 if (cp->val)
1011 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1012 else
1013 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1014
1015 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1016 if (err < 0)
1017 goto failed;
1018
1019 err = new_settings(hdev, sk);
1020
1021failed:
1022 hci_dev_unlock(hdev);
1023 return err;
1024}
1025
1026static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1027 u16 len)
1028{
1029 struct mgmt_mode *cp = data;
1030 struct pending_cmd *cmd;
1031 u8 val;
1032 int err;
1033
1034 BT_DBG("request for %s", hdev->name);
1035
1036 hci_dev_lock(hdev);
1037
1038 if (!hdev_is_powered(hdev)) {
1039 bool changed = false;
1040
1041 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1042 &hdev->dev_flags)) {
1043 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1044 changed = true;
1045 }
1046
1047 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1048 if (err < 0)
1049 goto failed;
1050
1051 if (changed)
1052 err = new_settings(hdev, sk);
1053
1054 goto failed;
1055 }
1056
1057 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1058 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1059 MGMT_STATUS_BUSY);
1060 goto failed;
1061 }
1062
1063 val = !!cp->val;
1064
1065 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1066 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1067 goto failed;
1068 }
1069
1070 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1071 if (!cmd) {
1072 err = -ENOMEM;
1073 goto failed;
1074 }
1075
1076 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1077 if (err < 0) {
1078 mgmt_pending_remove(cmd);
1079 goto failed;
1080 }
1081
1082failed:
1083 hci_dev_unlock(hdev);
1084 return err;
1085}
1086
1087static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1088{
1089 struct mgmt_mode *cp = data;
1090 struct pending_cmd *cmd;
1091 u8 val;
1092 int err;
1093
1094 BT_DBG("request for %s", hdev->name);
1095
1096 hci_dev_lock(hdev);
1097
1098 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1099 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1100 MGMT_STATUS_NOT_SUPPORTED);
1101 goto failed;
1102 }
1103
1104 val = !!cp->val;
1105
1106 if (!hdev_is_powered(hdev)) {
1107 bool changed = false;
1108
1109 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1110 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1111 changed = true;
1112 }
1113
1114 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1115 if (err < 0)
1116 goto failed;
1117
1118 if (changed)
1119 err = new_settings(hdev, sk);
1120
1121 goto failed;
1122 }
1123
1124 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1125 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1126 MGMT_STATUS_BUSY);
1127 goto failed;
1128 }
1129
1130 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1131 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1132 goto failed;
1133 }
1134
1135 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1136 if (!cmd) {
1137 err = -ENOMEM;
1138 goto failed;
1139 }
1140
1141 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1142 if (err < 0) {
1143 mgmt_pending_remove(cmd);
1144 goto failed;
1145 }
1146
1147failed:
1148 hci_dev_unlock(hdev);
1149 return err;
1150}
1151
1152static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1153{
1154 struct mgmt_mode *cp = data;
1155
1156 BT_DBG("request for %s", hdev->name);
1157
1158 if (!enable_hs)
1159 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1160 MGMT_STATUS_NOT_SUPPORTED);
1161
1162 if (cp->val)
1163 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1164 else
1165 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1166
1167 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1168}
1169
1170static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1171{
1172 struct mgmt_mode *cp = data;
1173 struct hci_cp_write_le_host_supported hci_cp;
1174 struct pending_cmd *cmd;
1175 int err;
1176 u8 val, enabled;
1177
1178 BT_DBG("request for %s", hdev->name);
1179
1180 hci_dev_lock(hdev);
1181
1182 if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1183 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1184 MGMT_STATUS_NOT_SUPPORTED);
1185 goto unlock;
1186 }
1187
1188 val = !!cp->val;
1189 enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1190
1191 if (!hdev_is_powered(hdev) || val == enabled) {
1192 bool changed = false;
1193
1194 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1195 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1196 changed = true;
1197 }
1198
1199 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1200 if (err < 0)
1201 goto unlock;
1202
1203 if (changed)
1204 err = new_settings(hdev, sk);
1205
1206 goto unlock;
1207 }
1208
1209 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1210 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1211 MGMT_STATUS_BUSY);
1212 goto unlock;
1213 }
1214
1215 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1216 if (!cmd) {
1217 err = -ENOMEM;
1218 goto unlock;
1219 }
1220
1221 memset(&hci_cp, 0, sizeof(hci_cp));
1222
1223 if (val) {
1224 hci_cp.le = val;
1225 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1226 }
1227
1228 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1229 &hci_cp);
1230 if (err < 0) {
1231 mgmt_pending_remove(cmd);
1232 goto unlock;
1233 }
1234
1235unlock:
1236 hci_dev_unlock(hdev);
1237 return err;
1238}
1239
1240static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1241{
1242 struct mgmt_cp_add_uuid *cp = data;
1243 struct pending_cmd *cmd;
1244 struct bt_uuid *uuid;
1245 int err;
1246
1247 BT_DBG("request for %s", hdev->name);
1248
1249 hci_dev_lock(hdev);
1250
1251 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1252 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1253 MGMT_STATUS_BUSY);
1254 goto failed;
1255 }
1256
1257 uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1258 if (!uuid) {
1259 err = -ENOMEM;
1260 goto failed;
1261 }
1262
1263 memcpy(uuid->uuid, cp->uuid, 16);
1264 uuid->svc_hint = cp->svc_hint;
1265
1266 list_add(&uuid->list, &hdev->uuids);
1267
1268 err = update_class(hdev);
1269 if (err < 0)
1270 goto failed;
1271
1272 err = update_eir(hdev);
1273 if (err < 0)
1274 goto failed;
1275
1276 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1277 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1278 hdev->dev_class, 3);
1279 goto failed;
1280 }
1281
1282 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1283 if (!cmd) {
1284 err = -ENOMEM;
1285 goto failed;
1286 }
1287
1288failed:
1289 hci_dev_unlock(hdev);
1290 return err;
1291}
1292
1293static bool enable_service_cache(struct hci_dev *hdev)
1294{
1295 if (!hdev_is_powered(hdev))
1296 return false;
1297
1298 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1299 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1300 return true;
1301 }
1302
1303 return false;
1304}
1305
1306static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1307 u16 len)
1308{
1309 struct mgmt_cp_remove_uuid *cp = data;
1310 struct pending_cmd *cmd;
1311 struct list_head *p, *n;
1312 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1313 int err, found;
1314
1315 BT_DBG("request for %s", hdev->name);
1316
1317 hci_dev_lock(hdev);
1318
1319 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1320 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1321 MGMT_STATUS_BUSY);
1322 goto unlock;
1323 }
1324
1325 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1326 err = hci_uuids_clear(hdev);
1327
1328 if (enable_service_cache(hdev)) {
1329 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1330 0, hdev->dev_class, 3);
1331 goto unlock;
1332 }
1333
1334 goto update_class;
1335 }
1336
1337 found = 0;
1338
1339 list_for_each_safe(p, n, &hdev->uuids) {
1340 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1341
1342 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1343 continue;
1344
1345 list_del(&match->list);
1346 found++;
1347 }
1348
1349 if (found == 0) {
1350 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1351 MGMT_STATUS_INVALID_PARAMS);
1352 goto unlock;
1353 }
1354
1355update_class:
1356 err = update_class(hdev);
1357 if (err < 0)
1358 goto unlock;
1359
1360 err = update_eir(hdev);
1361 if (err < 0)
1362 goto unlock;
1363
1364 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1365 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1366 hdev->dev_class, 3);
1367 goto unlock;
1368 }
1369
1370 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1371 if (!cmd) {
1372 err = -ENOMEM;
1373 goto unlock;
1374 }
1375
1376unlock:
1377 hci_dev_unlock(hdev);
1378 return err;
1379}
1380
1381static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1382 u16 len)
1383{
1384 struct mgmt_cp_set_dev_class *cp = data;
1385 struct pending_cmd *cmd;
1386 int err;
1387
1388 BT_DBG("request for %s", hdev->name);
1389
1390 hci_dev_lock(hdev);
1391
1392 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1393 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1394 MGMT_STATUS_BUSY);
1395 goto unlock;
1396 }
1397
1398 hdev->major_class = cp->major;
1399 hdev->minor_class = cp->minor;
1400
1401 if (!hdev_is_powered(hdev)) {
1402 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1403 hdev->dev_class, 3);
1404 goto unlock;
1405 }
1406
1407 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1408 hci_dev_unlock(hdev);
1409 cancel_delayed_work_sync(&hdev->service_cache);
1410 hci_dev_lock(hdev);
1411 update_eir(hdev);
1412 }
1413
1414 err = update_class(hdev);
1415 if (err < 0)
1416 goto unlock;
1417
1418 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1419 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1420 hdev->dev_class, 3);
1421 goto unlock;
1422 }
1423
1424 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1425 if (!cmd) {
1426 err = -ENOMEM;
1427 goto unlock;
1428 }
1429
1430unlock:
1431 hci_dev_unlock(hdev);
1432 return err;
1433}
1434
1435static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1436 u16 len)
1437{
1438 struct mgmt_cp_load_link_keys *cp = data;
1439 u16 key_count, expected_len;
1440 int i;
1441
1442 key_count = get_unaligned_le16(&cp->key_count);
1443
1444 expected_len = sizeof(*cp) + key_count *
1445 sizeof(struct mgmt_link_key_info);
1446 if (expected_len != len) {
1447 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1448 len, expected_len);
1449 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1450 MGMT_STATUS_INVALID_PARAMS);
1451 }
1452
1453 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1454 key_count);
1455
1456 hci_dev_lock(hdev);
1457
1458 hci_link_keys_clear(hdev);
1459
1460 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1461
1462 if (cp->debug_keys)
1463 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1464 else
1465 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1466
1467 for (i = 0; i < key_count; i++) {
1468 struct mgmt_link_key_info *key = &cp->keys[i];
1469
1470 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1471 key->type, key->pin_len);
1472 }
1473
1474 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1475
1476 hci_dev_unlock(hdev);
1477
1478 return 0;
1479}
1480
1481static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1482 u8 addr_type, struct sock *skip_sk)
1483{
1484 struct mgmt_ev_device_unpaired ev;
1485
1486 bacpy(&ev.addr.bdaddr, bdaddr);
1487 ev.addr.type = addr_type;
1488
1489 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1490 skip_sk);
1491}
1492
1493static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1494 u16 len)
1495{
1496 struct mgmt_cp_unpair_device *cp = data;
1497 struct mgmt_rp_unpair_device rp;
1498 struct hci_cp_disconnect dc;
1499 struct pending_cmd *cmd;
1500 struct hci_conn *conn;
1501 int err;
1502
1503 hci_dev_lock(hdev);
1504
1505 memset(&rp, 0, sizeof(rp));
1506 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1507 rp.addr.type = cp->addr.type;
1508
1509 if (!hdev_is_powered(hdev)) {
1510 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1511 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1512 goto unlock;
1513 }
1514
1515 if (cp->addr.type == MGMT_ADDR_BREDR)
1516 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1517 else
1518 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1519
1520 if (err < 0) {
1521 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1522 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1523 goto unlock;
1524 }
1525
1526 if (cp->disconnect) {
1527 if (cp->addr.type == MGMT_ADDR_BREDR)
1528 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1529 &cp->addr.bdaddr);
1530 else
1531 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1532 &cp->addr.bdaddr);
1533 } else {
1534 conn = NULL;
1535 }
1536
1537 if (!conn) {
1538 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1539 &rp, sizeof(rp));
1540 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1541 goto unlock;
1542 }
1543
1544 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1545 sizeof(*cp));
1546 if (!cmd) {
1547 err = -ENOMEM;
1548 goto unlock;
1549 }
1550
1551 put_unaligned_le16(conn->handle, &dc.handle);
1552 dc.reason = 0x13; /* Remote User Terminated Connection */
1553 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1554 if (err < 0)
1555 mgmt_pending_remove(cmd);
1556
1557unlock:
1558 hci_dev_unlock(hdev);
1559 return err;
1560}
1561
1562static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1563 u16 len)
1564{
1565 struct mgmt_cp_disconnect *cp = data;
1566 struct hci_cp_disconnect dc;
1567 struct pending_cmd *cmd;
1568 struct hci_conn *conn;
1569 int err;
1570
1571 BT_DBG("");
1572
1573 hci_dev_lock(hdev);
1574
1575 if (!test_bit(HCI_UP, &hdev->flags)) {
1576 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1577 MGMT_STATUS_NOT_POWERED);
1578 goto failed;
1579 }
1580
1581 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1582 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1583 MGMT_STATUS_BUSY);
1584 goto failed;
1585 }
1586
1587 if (cp->addr.type == MGMT_ADDR_BREDR)
1588 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1589 else
1590 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1591
1592 if (!conn) {
1593 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1594 MGMT_STATUS_NOT_CONNECTED);
1595 goto failed;
1596 }
1597
1598 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1599 if (!cmd) {
1600 err = -ENOMEM;
1601 goto failed;
1602 }
1603
1604 put_unaligned_le16(conn->handle, &dc.handle);
1605 dc.reason = 0x13; /* Remote User Terminated Connection */
1606
1607 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1608 if (err < 0)
1609 mgmt_pending_remove(cmd);
1610
1611failed:
1612 hci_dev_unlock(hdev);
1613 return err;
1614}
1615
1616static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1617{
1618 switch (link_type) {
1619 case LE_LINK:
1620 switch (addr_type) {
1621 case ADDR_LE_DEV_PUBLIC:
1622 return MGMT_ADDR_LE_PUBLIC;
1623 case ADDR_LE_DEV_RANDOM:
1624 return MGMT_ADDR_LE_RANDOM;
1625 default:
1626 return MGMT_ADDR_INVALID;
1627 }
1628 case ACL_LINK:
1629 return MGMT_ADDR_BREDR;
1630 default:
1631 return MGMT_ADDR_INVALID;
1632 }
1633}
1634
1635static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1636 u16 data_len)
1637{
1638 struct mgmt_rp_get_connections *rp;
1639 struct hci_conn *c;
1640 size_t rp_len;
1641 int err;
1642 u16 i;
1643
1644 BT_DBG("");
1645
1646 hci_dev_lock(hdev);
1647
1648 if (!hdev_is_powered(hdev)) {
1649 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1650 MGMT_STATUS_NOT_POWERED);
1651 goto unlock;
1652 }
1653
1654 i = 0;
1655 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1656 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1657 i++;
1658 }
1659
1660 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1661 rp = kmalloc(rp_len, GFP_ATOMIC);
1662 if (!rp) {
1663 err = -ENOMEM;
1664 goto unlock;
1665 }
1666
1667 i = 0;
1668 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1669 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1670 continue;
1671 bacpy(&rp->addr[i].bdaddr, &c->dst);
1672 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1673 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1674 continue;
1675 i++;
1676 }
1677
1678 put_unaligned_le16(i, &rp->conn_count);
1679
1680 /* Recalculate length in case of filtered SCO connections, etc */
1681 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1682
1683 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1684 rp_len);
1685
1686 kfree(rp);
1687
1688unlock:
1689 hci_dev_unlock(hdev);
1690 return err;
1691}
1692
1693static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1694 struct mgmt_cp_pin_code_neg_reply *cp)
1695{
1696 struct pending_cmd *cmd;
1697 int err;
1698
1699 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1700 sizeof(*cp));
1701 if (!cmd)
1702 return -ENOMEM;
1703
1704 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1705 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1706 if (err < 0)
1707 mgmt_pending_remove(cmd);
1708
1709 return err;
1710}
1711
1712static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1713 u16 len)
1714{
1715 struct hci_conn *conn;
1716 struct mgmt_cp_pin_code_reply *cp = data;
1717 struct hci_cp_pin_code_reply reply;
1718 struct pending_cmd *cmd;
1719 int err;
1720
1721 BT_DBG("");
1722
1723 hci_dev_lock(hdev);
1724
1725 if (!hdev_is_powered(hdev)) {
1726 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1727 MGMT_STATUS_NOT_POWERED);
1728 goto failed;
1729 }
1730
1731 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1732 if (!conn) {
1733 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1734 MGMT_STATUS_NOT_CONNECTED);
1735 goto failed;
1736 }
1737
1738 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1739 struct mgmt_cp_pin_code_neg_reply ncp;
1740
1741 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1742
1743 BT_ERR("PIN code is not 16 bytes long");
1744
1745 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1746 if (err >= 0)
1747 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1748 MGMT_STATUS_INVALID_PARAMS);
1749
1750 goto failed;
1751 }
1752
1753 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1754 if (!cmd) {
1755 err = -ENOMEM;
1756 goto failed;
1757 }
1758
1759 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1760 reply.pin_len = cp->pin_len;
1761 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1762
1763 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1764 if (err < 0)
1765 mgmt_pending_remove(cmd);
1766
1767failed:
1768 hci_dev_unlock(hdev);
1769 return err;
1770}
1771
1772static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1773 void *data, u16 len)
1774{
1775 struct mgmt_cp_pin_code_neg_reply *cp = data;
1776 int err;
1777
1778 BT_DBG("");
1779
1780 hci_dev_lock(hdev);
1781
1782 if (!hdev_is_powered(hdev)) {
1783 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1784 MGMT_STATUS_NOT_POWERED);
1785 goto failed;
1786 }
1787
1788 err = send_pin_code_neg_reply(sk, hdev, cp);
1789
1790failed:
1791 hci_dev_unlock(hdev);
1792 return err;
1793}
1794
1795static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1796 u16 len)
1797{
1798 struct mgmt_cp_set_io_capability *cp = data;
1799
1800 BT_DBG("");
1801
1802 hci_dev_lock(hdev);
1803
1804 hdev->io_capability = cp->io_capability;
1805
1806 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1807 hdev->io_capability);
1808
1809 hci_dev_unlock(hdev);
1810
1811 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1812 0);
1813}
1814
1815static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1816{
1817 struct hci_dev *hdev = conn->hdev;
1818 struct pending_cmd *cmd;
1819
1820 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1821 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1822 continue;
1823
1824 if (cmd->user_data != conn)
1825 continue;
1826
1827 return cmd;
1828 }
1829
1830 return NULL;
1831}
1832
1833static void pairing_complete(struct pending_cmd *cmd, u8 status)
1834{
1835 struct mgmt_rp_pair_device rp;
1836 struct hci_conn *conn = cmd->user_data;
1837
1838 bacpy(&rp.addr.bdaddr, &conn->dst);
1839 rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1840
1841 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1842 &rp, sizeof(rp));
1843
1844 /* So we don't get further callbacks for this connection */
1845 conn->connect_cfm_cb = NULL;
1846 conn->security_cfm_cb = NULL;
1847 conn->disconn_cfm_cb = NULL;
1848
1849 hci_conn_put(conn);
1850
1851 mgmt_pending_remove(cmd);
1852}
1853
1854static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1855{
1856 struct pending_cmd *cmd;
1857
1858 BT_DBG("status %u", status);
1859
1860 cmd = find_pairing(conn);
1861 if (!cmd)
1862 BT_DBG("Unable to find a pending command");
1863 else
1864 pairing_complete(cmd, mgmt_status(status));
1865}
1866
1867static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1868 u16 len)
1869{
1870 struct mgmt_cp_pair_device *cp = data;
1871 struct mgmt_rp_pair_device rp;
1872 struct pending_cmd *cmd;
1873 u8 sec_level, auth_type;
1874 struct hci_conn *conn;
1875 int err;
1876
1877 BT_DBG("");
1878
1879 hci_dev_lock(hdev);
1880
1881 if (!hdev_is_powered(hdev)) {
1882 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1883 MGMT_STATUS_NOT_POWERED);
1884 goto unlock;
1885 }
1886
1887 sec_level = BT_SECURITY_MEDIUM;
1888 if (cp->io_cap == 0x03)
1889 auth_type = HCI_AT_DEDICATED_BONDING;
1890 else
1891 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1892
1893 if (cp->addr.type == MGMT_ADDR_BREDR)
1894 conn = hci_connect(hdev, ACL_LINK, 0, &cp->addr.bdaddr,
1895 sec_level, auth_type);
1896 else
1897 conn = hci_connect(hdev, LE_LINK, 0, &cp->addr.bdaddr,
1898 sec_level, auth_type);
1899
1900 memset(&rp, 0, sizeof(rp));
1901 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1902 rp.addr.type = cp->addr.type;
1903
1904 if (IS_ERR(conn)) {
1905 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1906 MGMT_STATUS_CONNECT_FAILED, &rp,
1907 sizeof(rp));
1908 goto unlock;
1909 }
1910
1911 if (conn->connect_cfm_cb) {
1912 hci_conn_put(conn);
1913 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1914 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1915 goto unlock;
1916 }
1917
1918 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1919 if (!cmd) {
1920 err = -ENOMEM;
1921 hci_conn_put(conn);
1922 goto unlock;
1923 }
1924
1925 /* For LE, just connecting isn't a proof that the pairing finished */
1926 if (cp->addr.type == MGMT_ADDR_BREDR)
1927 conn->connect_cfm_cb = pairing_complete_cb;
1928
1929 conn->security_cfm_cb = pairing_complete_cb;
1930 conn->disconn_cfm_cb = pairing_complete_cb;
1931 conn->io_capability = cp->io_cap;
1932 cmd->user_data = conn;
1933
1934 if (conn->state == BT_CONNECTED &&
1935 hci_conn_security(conn, sec_level, auth_type))
1936 pairing_complete(cmd, 0);
1937
1938 err = 0;
1939
1940unlock:
1941 hci_dev_unlock(hdev);
1942 return err;
1943}
1944
1945static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1946 u16 len)
1947{
1948 struct mgmt_addr_info *addr = data;
1949 struct pending_cmd *cmd;
1950 struct hci_conn *conn;
1951 int err;
1952
1953 BT_DBG("");
1954
1955 hci_dev_lock(hdev);
1956
1957 if (!hdev_is_powered(hdev)) {
1958 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1959 MGMT_STATUS_NOT_POWERED);
1960 goto unlock;
1961 }
1962
1963 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1964 if (!cmd) {
1965 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1966 MGMT_STATUS_INVALID_PARAMS);
1967 goto unlock;
1968 }
1969
1970 conn = cmd->user_data;
1971
1972 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1973 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1974 MGMT_STATUS_INVALID_PARAMS);
1975 goto unlock;
1976 }
1977
1978 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1979
1980 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1981 addr, sizeof(*addr));
1982unlock:
1983 hci_dev_unlock(hdev);
1984 return err;
1985}
1986
1987static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1988 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
1989 u16 hci_op, __le32 passkey)
1990{
1991 struct pending_cmd *cmd;
1992 struct hci_conn *conn;
1993 int err;
1994
1995 hci_dev_lock(hdev);
1996
1997 if (!hdev_is_powered(hdev)) {
1998 err = cmd_status(sk, hdev->id, mgmt_op,
1999 MGMT_STATUS_NOT_POWERED);
2000 goto done;
2001 }
2002
2003 if (type == MGMT_ADDR_BREDR)
2004 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2005 else
2006 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2007
2008 if (!conn) {
2009 err = cmd_status(sk, hdev->id, mgmt_op,
2010 MGMT_STATUS_NOT_CONNECTED);
2011 goto done;
2012 }
2013
2014 if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2015 /* Continue with pairing via SMP */
2016 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2017
2018 if (!err)
2019 err = cmd_status(sk, hdev->id, mgmt_op,
2020 MGMT_STATUS_SUCCESS);
2021 else
2022 err = cmd_status(sk, hdev->id, mgmt_op,
2023 MGMT_STATUS_FAILED);
2024
2025 goto done;
2026 }
2027
2028 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2029 if (!cmd) {
2030 err = -ENOMEM;
2031 goto done;
2032 }
2033
2034 /* Continue with pairing via HCI */
2035 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2036 struct hci_cp_user_passkey_reply cp;
2037
2038 bacpy(&cp.bdaddr, bdaddr);
2039 cp.passkey = passkey;
2040 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2041 } else
2042 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2043
2044 if (err < 0)
2045 mgmt_pending_remove(cmd);
2046
2047done:
2048 hci_dev_unlock(hdev);
2049 return err;
2050}
2051
2052static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2053 u16 len)
2054{
2055 struct mgmt_cp_user_confirm_reply *cp = data;
2056
2057 BT_DBG("");
2058
2059 if (len != sizeof(*cp))
2060 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2061 MGMT_STATUS_INVALID_PARAMS);
2062
2063 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2064 MGMT_OP_USER_CONFIRM_REPLY,
2065 HCI_OP_USER_CONFIRM_REPLY, 0);
2066}
2067
2068static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2069 void *data, u16 len)
2070{
2071 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2072
2073 BT_DBG("");
2074
2075 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2076 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2077 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2078}
2079
2080static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2081 u16 len)
2082{
2083 struct mgmt_cp_user_passkey_reply *cp = data;
2084
2085 BT_DBG("");
2086
2087 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2088 MGMT_OP_USER_PASSKEY_REPLY,
2089 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2090}
2091
2092static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2093 void *data, u16 len)
2094{
2095 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2096
2097 BT_DBG("");
2098
2099 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2100 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2101 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2102}
2103
2104static int update_name(struct hci_dev *hdev, const char *name)
2105{
2106 struct hci_cp_write_local_name cp;
2107
2108 memcpy(cp.name, name, sizeof(cp.name));
2109
2110 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2111}
2112
2113static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2114 u16 len)
2115{
2116 struct mgmt_cp_set_local_name *cp = data;
2117 struct pending_cmd *cmd;
2118 int err;
2119
2120 BT_DBG("");
2121
2122 hci_dev_lock(hdev);
2123
2124 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2125
2126 if (!hdev_is_powered(hdev)) {
2127 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2128
2129 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2130 data, len);
2131 if (err < 0)
2132 goto failed;
2133
2134 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2135 sk);
2136
2137 goto failed;
2138 }
2139
2140 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2141 if (!cmd) {
2142 err = -ENOMEM;
2143 goto failed;
2144 }
2145
2146 err = update_name(hdev, cp->name);
2147 if (err < 0)
2148 mgmt_pending_remove(cmd);
2149
2150failed:
2151 hci_dev_unlock(hdev);
2152 return err;
2153}
2154
2155static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2156 void *data, u16 data_len)
2157{
2158 struct pending_cmd *cmd;
2159 int err;
2160
2161 BT_DBG("%s", hdev->name);
2162
2163 hci_dev_lock(hdev);
2164
2165 if (!hdev_is_powered(hdev)) {
2166 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2167 MGMT_STATUS_NOT_POWERED);
2168 goto unlock;
2169 }
2170
2171 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2172 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2173 MGMT_STATUS_NOT_SUPPORTED);
2174 goto unlock;
2175 }
2176
2177 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2178 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2179 MGMT_STATUS_BUSY);
2180 goto unlock;
2181 }
2182
2183 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2184 if (!cmd) {
2185 err = -ENOMEM;
2186 goto unlock;
2187 }
2188
2189 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2190 if (err < 0)
2191 mgmt_pending_remove(cmd);
2192
2193unlock:
2194 hci_dev_unlock(hdev);
2195 return err;
2196}
2197
2198static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2199 void *data, u16 len)
2200{
2201 struct mgmt_cp_add_remote_oob_data *cp = data;
2202 u8 status;
2203 int err;
2204
2205 BT_DBG("%s ", hdev->name);
2206
2207 hci_dev_lock(hdev);
2208
2209 if (!hdev_is_powered(hdev)) {
2210 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2211 MGMT_STATUS_NOT_POWERED, &cp->addr,
2212 sizeof(cp->addr));
2213 goto unlock;
2214 }
2215
2216 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2217 cp->randomizer);
2218 if (err < 0)
2219 status = MGMT_STATUS_FAILED;
2220 else
2221 status = 0;
2222
2223 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2224 &cp->addr, sizeof(cp->addr));
2225
2226unlock:
2227 hci_dev_unlock(hdev);
2228 return err;
2229}
2230
2231static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2232 void *data, u16 len)
2233{
2234 struct mgmt_cp_remove_remote_oob_data *cp = data;
2235 u8 status;
2236 int err;
2237
2238 BT_DBG("%s", hdev->name);
2239
2240 hci_dev_lock(hdev);
2241
2242 if (!hdev_is_powered(hdev)) {
2243 err = cmd_complete(sk, hdev->id,
2244 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2245 MGMT_STATUS_NOT_POWERED, &cp->addr,
2246 sizeof(cp->addr));
2247 goto unlock;
2248 }
2249
2250 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2251 if (err < 0)
2252 status = MGMT_STATUS_INVALID_PARAMS;
2253 else
2254 status = 0;
2255
2256 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2257 status, &cp->addr, sizeof(cp->addr));
2258
2259unlock:
2260 hci_dev_unlock(hdev);
2261 return err;
2262}
2263
2264int mgmt_interleaved_discovery(struct hci_dev *hdev)
2265{
2266 int err;
2267
2268 BT_DBG("%s", hdev->name);
2269
2270 hci_dev_lock(hdev);
2271
2272 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2273 if (err < 0)
2274 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2275
2276 hci_dev_unlock(hdev);
2277
2278 return err;
2279}
2280
2281static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2282 void *data, u16 len)
2283{
2284 struct mgmt_cp_start_discovery *cp = data;
2285 struct pending_cmd *cmd;
2286 int err;
2287
2288 BT_DBG("%s", hdev->name);
2289
2290 hci_dev_lock(hdev);
2291
2292 if (!hdev_is_powered(hdev)) {
2293 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2294 MGMT_STATUS_NOT_POWERED);
2295 goto failed;
2296 }
2297
2298 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2299 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2300 MGMT_STATUS_BUSY);
2301 goto failed;
2302 }
2303
2304 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2305 if (!cmd) {
2306 err = -ENOMEM;
2307 goto failed;
2308 }
2309
2310 hdev->discovery.type = cp->type;
2311
2312 switch (hdev->discovery.type) {
2313 case DISCOV_TYPE_BREDR:
2314 if (lmp_bredr_capable(hdev))
2315 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2316 else
2317 err = -ENOTSUPP;
2318 break;
2319
2320 case DISCOV_TYPE_LE:
2321 if (lmp_host_le_capable(hdev))
2322 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2323 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2324 else
2325 err = -ENOTSUPP;
2326 break;
2327
2328 case DISCOV_TYPE_INTERLEAVED:
2329 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2330 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2331 LE_SCAN_WIN,
2332 LE_SCAN_TIMEOUT_BREDR_LE);
2333 else
2334 err = -ENOTSUPP;
2335 break;
2336
2337 default:
2338 err = -EINVAL;
2339 }
2340
2341 if (err < 0)
2342 mgmt_pending_remove(cmd);
2343 else
2344 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2345
2346failed:
2347 hci_dev_unlock(hdev);
2348 return err;
2349}
2350
2351static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2352 u16 len)
2353{
2354 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2355 struct pending_cmd *cmd;
2356 struct hci_cp_remote_name_req_cancel cp;
2357 struct inquiry_entry *e;
2358 int err;
2359
2360 BT_DBG("%s", hdev->name);
2361
2362 hci_dev_lock(hdev);
2363
2364 if (!hci_discovery_active(hdev)) {
2365 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2366 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2367 sizeof(mgmt_cp->type));
2368 goto unlock;
2369 }
2370
2371 if (hdev->discovery.type != mgmt_cp->type) {
2372 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2373 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2374 sizeof(mgmt_cp->type));
2375 goto unlock;
2376 }
2377
2378 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2379 if (!cmd) {
2380 err = -ENOMEM;
2381 goto unlock;
2382 }
2383
2384 if (hdev->discovery.state == DISCOVERY_FINDING) {
2385 err = hci_cancel_inquiry(hdev);
2386 if (err < 0)
2387 mgmt_pending_remove(cmd);
2388 else
2389 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2390 goto unlock;
2391 }
2392
2393 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2394 if (!e) {
2395 mgmt_pending_remove(cmd);
2396 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
2397 &mgmt_cp->type, sizeof(mgmt_cp->type));
2398 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2399 goto unlock;
2400 }
2401
2402 bacpy(&cp.bdaddr, &e->data.bdaddr);
2403 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2404 &cp);
2405 if (err < 0)
2406 mgmt_pending_remove(cmd);
2407 else
2408 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2409
2410unlock:
2411 hci_dev_unlock(hdev);
2412 return err;
2413}
2414
2415static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2416 u16 len)
2417{
2418 struct mgmt_cp_confirm_name *cp = data;
2419 struct inquiry_entry *e;
2420 int err;
2421
2422 BT_DBG("%s", hdev->name);
2423
2424 hci_dev_lock(hdev);
2425
2426 if (!hci_discovery_active(hdev)) {
2427 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2428 MGMT_STATUS_FAILED);
2429 goto failed;
2430 }
2431
2432 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2433 if (!e) {
2434 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2435 MGMT_STATUS_INVALID_PARAMS);
2436 goto failed;
2437 }
2438
2439 if (cp->name_known) {
2440 e->name_state = NAME_KNOWN;
2441 list_del(&e->list);
2442 } else {
2443 e->name_state = NAME_NEEDED;
2444 hci_inquiry_cache_update_resolve(hdev, e);
2445 }
2446
2447 err = 0;
2448
2449failed:
2450 hci_dev_unlock(hdev);
2451 return err;
2452}
2453
2454static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2455 u16 len)
2456{
2457 struct mgmt_cp_block_device *cp = data;
2458 u8 status;
2459 int err;
2460
2461 BT_DBG("%s", hdev->name);
2462
2463 hci_dev_lock(hdev);
2464
2465 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2466 if (err < 0)
2467 status = MGMT_STATUS_FAILED;
2468 else
2469 status = 0;
2470
2471 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2472 &cp->addr, sizeof(cp->addr));
2473
2474 hci_dev_unlock(hdev);
2475
2476 return err;
2477}
2478
2479static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2480 u16 len)
2481{
2482 struct mgmt_cp_unblock_device *cp = data;
2483 u8 status;
2484 int err;
2485
2486 BT_DBG("%s", hdev->name);
2487
2488 hci_dev_lock(hdev);
2489
2490 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2491 if (err < 0)
2492 status = MGMT_STATUS_INVALID_PARAMS;
2493 else
2494 status = 0;
2495
2496 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2497 &cp->addr, sizeof(cp->addr));
2498
2499 hci_dev_unlock(hdev);
2500
2501 return err;
2502}
2503
2504static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2505 void *data, u16 len)
2506{
2507 struct mgmt_mode *cp = data;
2508 struct hci_cp_write_page_scan_activity acp;
2509 u8 type;
2510 int err;
2511
2512 BT_DBG("%s", hdev->name);
2513
2514 if (!hdev_is_powered(hdev))
2515 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2516 MGMT_STATUS_NOT_POWERED);
2517
2518 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2519 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2520 MGMT_STATUS_REJECTED);
2521
2522 hci_dev_lock(hdev);
2523
2524 if (cp->val) {
2525 type = PAGE_SCAN_TYPE_INTERLACED;
2526
2527 /* 22.5 msec page scan interval */
2528 acp.interval = __constant_cpu_to_le16(0x0024);
2529 } else {
2530 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2531
2532 /* default 1.28 sec page scan */
2533 acp.interval = __constant_cpu_to_le16(0x0800);
2534 }
2535
2536 /* default 11.25 msec page scan window */
2537 acp.window = __constant_cpu_to_le16(0x0012);
2538
2539 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2540 &acp);
2541 if (err < 0) {
2542 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2543 MGMT_STATUS_FAILED);
2544 goto done;
2545 }
2546
2547 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2548 if (err < 0) {
2549 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2550 MGMT_STATUS_FAILED);
2551 goto done;
2552 }
2553
2554 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2555 NULL, 0);
2556done:
2557 hci_dev_unlock(hdev);
2558 return err;
2559}
2560
2561static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2562 void *cp_data, u16 len)
2563{
2564 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2565 u16 key_count, expected_len;
2566 int i;
2567
2568 key_count = get_unaligned_le16(&cp->key_count);
2569
2570 expected_len = sizeof(*cp) + key_count *
2571 sizeof(struct mgmt_ltk_info);
2572 if (expected_len != len) {
2573 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2574 len, expected_len);
2575 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2576 EINVAL);
2577 }
2578
2579 BT_DBG("%s key_count %u", hdev->name, key_count);
2580
2581 hci_dev_lock(hdev);
2582
2583 hci_smp_ltks_clear(hdev);
2584
2585 for (i = 0; i < key_count; i++) {
2586 struct mgmt_ltk_info *key = &cp->keys[i];
2587 u8 type;
2588
2589 if (key->master)
2590 type = HCI_SMP_LTK;
2591 else
2592 type = HCI_SMP_LTK_SLAVE;
2593
2594 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2595 type, 0, key->authenticated, key->val,
2596 key->enc_size, key->ediv, key->rand);
2597 }
2598
2599 hci_dev_unlock(hdev);
2600
2601 return 0;
2602}
2603
2604struct mgmt_handler {
2605 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2606 u16 data_len);
2607 bool var_len;
2608 size_t data_len;
2609} mgmt_handlers[] = {
2610 { NULL }, /* 0x0000 (no command) */
2611 { read_version, false, MGMT_READ_VERSION_SIZE },
2612 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2613 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2614 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2615 { set_powered, false, MGMT_SETTING_SIZE },
2616 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2617 { set_connectable, false, MGMT_SETTING_SIZE },
2618 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2619 { set_pairable, false, MGMT_SETTING_SIZE },
2620 { set_link_security, false, MGMT_SETTING_SIZE },
2621 { set_ssp, false, MGMT_SETTING_SIZE },
2622 { set_hs, false, MGMT_SETTING_SIZE },
2623 { set_le, false, MGMT_SETTING_SIZE },
2624 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2625 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2626 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2627 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2628 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2629 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2630 { disconnect, false, MGMT_DISCONNECT_SIZE },
2631 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2632 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2633 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2634 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2635 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2636 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2637 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2638 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2639 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2640 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2641 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2642 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2643 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2644 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2645 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2646 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2647 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2648 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2649 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2650};
2651
2652
2653int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2654{
2655 void *buf;
2656 u8 *cp;
2657 struct mgmt_hdr *hdr;
2658 u16 opcode, index, len;
2659 struct hci_dev *hdev = NULL;
2660 struct mgmt_handler *handler;
2661 int err;
2662
2663 BT_DBG("got %zu bytes", msglen);
2664
2665 if (msglen < sizeof(*hdr))
2666 return -EINVAL;
2667
2668 buf = kmalloc(msglen, GFP_KERNEL);
2669 if (!buf)
2670 return -ENOMEM;
2671
2672 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2673 err = -EFAULT;
2674 goto done;
2675 }
2676
2677 hdr = buf;
2678 opcode = get_unaligned_le16(&hdr->opcode);
2679 index = get_unaligned_le16(&hdr->index);
2680 len = get_unaligned_le16(&hdr->len);
2681
2682 if (len != msglen - sizeof(*hdr)) {
2683 err = -EINVAL;
2684 goto done;
2685 }
2686
2687 if (index != MGMT_INDEX_NONE) {
2688 hdev = hci_dev_get(index);
2689 if (!hdev) {
2690 err = cmd_status(sk, index, opcode,
2691 MGMT_STATUS_INVALID_INDEX);
2692 goto done;
2693 }
2694 }
2695
2696 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2697 mgmt_handlers[opcode].func == NULL) {
2698 BT_DBG("Unknown op %u", opcode);
2699 err = cmd_status(sk, index, opcode,
2700 MGMT_STATUS_UNKNOWN_COMMAND);
2701 goto done;
2702 }
2703
2704 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2705 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2706 err = cmd_status(sk, index, opcode,
2707 MGMT_STATUS_INVALID_INDEX);
2708 goto done;
2709 }
2710
2711 handler = &mgmt_handlers[opcode];
2712
2713 if ((handler->var_len && len < handler->data_len) ||
2714 (!handler->var_len && len != handler->data_len)) {
2715 err = cmd_status(sk, index, opcode,
2716 MGMT_STATUS_INVALID_PARAMS);
2717 goto done;
2718 }
2719
2720 if (hdev)
2721 mgmt_init_hdev(sk, hdev);
2722
2723 cp = buf + sizeof(*hdr);
2724
2725 err = handler->func(sk, hdev, cp, len);
2726 if (err < 0)
2727 goto done;
2728
2729 err = msglen;
2730
2731done:
2732 if (hdev)
2733 hci_dev_put(hdev);
2734
2735 kfree(buf);
2736 return err;
2737}
2738
2739static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2740{
2741 u8 *status = data;
2742
2743 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2744 mgmt_pending_remove(cmd);
2745}
2746
2747int mgmt_index_added(struct hci_dev *hdev)
2748{
2749 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2750}
2751
2752int mgmt_index_removed(struct hci_dev *hdev)
2753{
2754 u8 status = MGMT_STATUS_INVALID_INDEX;
2755
2756 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2757
2758 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2759}
2760
2761struct cmd_lookup {
2762 struct sock *sk;
2763 struct hci_dev *hdev;
2764 u8 mgmt_status;
2765};
2766
2767static void settings_rsp(struct pending_cmd *cmd, void *data)
2768{
2769 struct cmd_lookup *match = data;
2770
2771 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2772
2773 list_del(&cmd->list);
2774
2775 if (match->sk == NULL) {
2776 match->sk = cmd->sk;
2777 sock_hold(match->sk);
2778 }
2779
2780 mgmt_pending_free(cmd);
2781}
2782
2783int mgmt_powered(struct hci_dev *hdev, u8 powered)
2784{
2785 struct cmd_lookup match = { NULL, hdev };
2786 int err;
2787
2788 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2789 return 0;
2790
2791 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2792
2793 if (powered) {
2794 u8 scan = 0;
2795
2796 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2797 scan |= SCAN_PAGE;
2798 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2799 scan |= SCAN_INQUIRY;
2800
2801 if (scan)
2802 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2803
2804 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2805 u8 ssp = 1;
2806
2807 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2808 }
2809
2810 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2811 struct hci_cp_write_le_host_supported cp;
2812
2813 cp.le = 1;
2814 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
2815
2816 hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2817 sizeof(cp), &cp);
2818 }
2819
2820 update_class(hdev);
2821 update_name(hdev, hdev->dev_name);
2822 update_eir(hdev);
2823 } else {
2824 u8 status = MGMT_STATUS_NOT_POWERED;
2825 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2826 }
2827
2828 err = new_settings(hdev, match.sk);
2829
2830 if (match.sk)
2831 sock_put(match.sk);
2832
2833 return err;
2834}
2835
2836int mgmt_set_powered_failed(struct hci_dev *hdev, int err)
2837{
2838 struct pending_cmd *cmd;
2839 u8 status;
2840
2841 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
2842 if (!cmd)
2843 return -ENOENT;
2844
2845 if (err == -ERFKILL)
2846 status = MGMT_STATUS_RFKILLED;
2847 else
2848 status = MGMT_STATUS_FAILED;
2849
2850 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
2851
2852 mgmt_pending_remove(cmd);
2853
2854 return err;
2855}
2856
2857int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2858{
2859 struct cmd_lookup match = { NULL, hdev };
2860 bool changed = false;
2861 int err = 0;
2862
2863 if (discoverable) {
2864 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2865 changed = true;
2866 } else {
2867 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2868 changed = true;
2869 }
2870
2871 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2872 &match);
2873
2874 if (changed)
2875 err = new_settings(hdev, match.sk);
2876
2877 if (match.sk)
2878 sock_put(match.sk);
2879
2880 return err;
2881}
2882
2883int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2884{
2885 struct cmd_lookup match = { NULL, hdev };
2886 bool changed = false;
2887 int err = 0;
2888
2889 if (connectable) {
2890 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2891 changed = true;
2892 } else {
2893 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2894 changed = true;
2895 }
2896
2897 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2898 &match);
2899
2900 if (changed)
2901 err = new_settings(hdev, match.sk);
2902
2903 if (match.sk)
2904 sock_put(match.sk);
2905
2906 return err;
2907}
2908
2909int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2910{
2911 u8 mgmt_err = mgmt_status(status);
2912
2913 if (scan & SCAN_PAGE)
2914 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2915 cmd_status_rsp, &mgmt_err);
2916
2917 if (scan & SCAN_INQUIRY)
2918 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2919 cmd_status_rsp, &mgmt_err);
2920
2921 return 0;
2922}
2923
2924int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent)
2925{
2926 struct mgmt_ev_new_link_key ev;
2927
2928 memset(&ev, 0, sizeof(ev));
2929
2930 ev.store_hint = persistent;
2931 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2932 ev.key.addr.type = MGMT_ADDR_BREDR;
2933 ev.key.type = key->type;
2934 memcpy(ev.key.val, key->val, 16);
2935 ev.key.pin_len = key->pin_len;
2936
2937 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2938}
2939
2940int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2941{
2942 struct mgmt_ev_new_long_term_key ev;
2943
2944 memset(&ev, 0, sizeof(ev));
2945
2946 ev.store_hint = persistent;
2947 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2948 ev.key.addr.type = key->bdaddr_type;
2949 ev.key.authenticated = key->authenticated;
2950 ev.key.enc_size = key->enc_size;
2951 ev.key.ediv = key->ediv;
2952
2953 if (key->type == HCI_SMP_LTK)
2954 ev.key.master = 1;
2955
2956 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2957 memcpy(ev.key.val, key->val, sizeof(key->val));
2958
2959 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2960 NULL);
2961}
2962
2963int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2964 u8 addr_type, u32 flags, u8 *name, u8 name_len,
2965 u8 *dev_class)
2966{
2967 char buf[512];
2968 struct mgmt_ev_device_connected *ev = (void *) buf;
2969 u16 eir_len = 0;
2970
2971 bacpy(&ev->addr.bdaddr, bdaddr);
2972 ev->addr.type = link_to_mgmt(link_type, addr_type);
2973
2974 ev->flags = __cpu_to_le32(flags);
2975
2976 if (name_len > 0)
2977 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
2978 name, name_len);
2979
2980 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2981 eir_len = eir_append_data(ev->eir, eir_len,
2982 EIR_CLASS_OF_DEV, dev_class, 3);
2983
2984 put_unaligned_le16(eir_len, &ev->eir_len);
2985
2986 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
2987 sizeof(*ev) + eir_len, NULL);
2988}
2989
2990static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2991{
2992 struct mgmt_cp_disconnect *cp = cmd->param;
2993 struct sock **sk = data;
2994 struct mgmt_rp_disconnect rp;
2995
2996 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2997 rp.addr.type = cp->addr.type;
2998
2999 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3000 sizeof(rp));
3001
3002 *sk = cmd->sk;
3003 sock_hold(*sk);
3004
3005 mgmt_pending_remove(cmd);
3006}
3007
3008static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3009{
3010 struct hci_dev *hdev = data;
3011 struct mgmt_cp_unpair_device *cp = cmd->param;
3012 struct mgmt_rp_unpair_device rp;
3013
3014 memset(&rp, 0, sizeof(rp));
3015 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3016 rp.addr.type = cp->addr.type;
3017
3018 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3019
3020 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3021
3022 mgmt_pending_remove(cmd);
3023}
3024
3025int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3026 u8 link_type, u8 addr_type)
3027{
3028 struct mgmt_addr_info ev;
3029 struct sock *sk = NULL;
3030 int err;
3031
3032 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3033
3034 bacpy(&ev.bdaddr, bdaddr);
3035 ev.type = link_to_mgmt(link_type, addr_type);
3036
3037 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3038 sk);
3039
3040 if (sk)
3041 sock_put(sk);
3042
3043 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3044 hdev);
3045
3046 return err;
3047}
3048
3049int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3050 u8 link_type, u8 addr_type, u8 status)
3051{
3052 struct mgmt_rp_disconnect rp;
3053 struct pending_cmd *cmd;
3054 int err;
3055
3056 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3057 if (!cmd)
3058 return -ENOENT;
3059
3060 bacpy(&rp.addr.bdaddr, bdaddr);
3061 rp.addr.type = link_to_mgmt(link_type, addr_type);
3062
3063 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3064 mgmt_status(status), &rp, sizeof(rp));
3065
3066 mgmt_pending_remove(cmd);
3067
3068 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3069 hdev);
3070 return err;
3071}
3072
3073int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3074 u8 addr_type, u8 status)
3075{
3076 struct mgmt_ev_connect_failed ev;
3077
3078 bacpy(&ev.addr.bdaddr, bdaddr);
3079 ev.addr.type = link_to_mgmt(link_type, addr_type);
3080 ev.status = mgmt_status(status);
3081
3082 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3083}
3084
3085int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3086{
3087 struct mgmt_ev_pin_code_request ev;
3088
3089 bacpy(&ev.addr.bdaddr, bdaddr);
3090 ev.addr.type = MGMT_ADDR_BREDR;
3091 ev.secure = secure;
3092
3093 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3094 NULL);
3095}
3096
3097int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3098 u8 status)
3099{
3100 struct pending_cmd *cmd;
3101 struct mgmt_rp_pin_code_reply rp;
3102 int err;
3103
3104 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3105 if (!cmd)
3106 return -ENOENT;
3107
3108 bacpy(&rp.addr.bdaddr, bdaddr);
3109 rp.addr.type = MGMT_ADDR_BREDR;
3110
3111 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3112 mgmt_status(status), &rp, sizeof(rp));
3113
3114 mgmt_pending_remove(cmd);
3115
3116 return err;
3117}
3118
3119int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3120 u8 status)
3121{
3122 struct pending_cmd *cmd;
3123 struct mgmt_rp_pin_code_reply rp;
3124 int err;
3125
3126 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3127 if (!cmd)
3128 return -ENOENT;
3129
3130 bacpy(&rp.addr.bdaddr, bdaddr);
3131 rp.addr.type = MGMT_ADDR_BREDR;
3132
3133 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3134 mgmt_status(status), &rp, sizeof(rp));
3135
3136 mgmt_pending_remove(cmd);
3137
3138 return err;
3139}
3140
3141int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3142 u8 link_type, u8 addr_type, __le32 value,
3143 u8 confirm_hint)
3144{
3145 struct mgmt_ev_user_confirm_request ev;
3146
3147 BT_DBG("%s", hdev->name);
3148
3149 bacpy(&ev.addr.bdaddr, bdaddr);
3150 ev.addr.type = link_to_mgmt(link_type, addr_type);
3151 ev.confirm_hint = confirm_hint;
3152 put_unaligned_le32(value, &ev.value);
3153
3154 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3155 NULL);
3156}
3157
3158int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3159 u8 link_type, u8 addr_type)
3160{
3161 struct mgmt_ev_user_passkey_request ev;
3162
3163 BT_DBG("%s", hdev->name);
3164
3165 bacpy(&ev.addr.bdaddr, bdaddr);
3166 ev.addr.type = link_to_mgmt(link_type, addr_type);
3167
3168 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3169 NULL);
3170}
3171
3172static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3173 u8 link_type, u8 addr_type, u8 status,
3174 u8 opcode)
3175{
3176 struct pending_cmd *cmd;
3177 struct mgmt_rp_user_confirm_reply rp;
3178 int err;
3179
3180 cmd = mgmt_pending_find(opcode, hdev);
3181 if (!cmd)
3182 return -ENOENT;
3183
3184 bacpy(&rp.addr.bdaddr, bdaddr);
3185 rp.addr.type = link_to_mgmt(link_type, addr_type);
3186 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3187 &rp, sizeof(rp));
3188
3189 mgmt_pending_remove(cmd);
3190
3191 return err;
3192}
3193
3194int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3195 u8 link_type, u8 addr_type, u8 status)
3196{
3197 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3198 status, MGMT_OP_USER_CONFIRM_REPLY);
3199}
3200
3201int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3202 u8 link_type, u8 addr_type, u8 status)
3203{
3204 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3205 status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3206}
3207
3208int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3209 u8 link_type, u8 addr_type, u8 status)
3210{
3211 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3212 status, MGMT_OP_USER_PASSKEY_REPLY);
3213}
3214
3215int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3216 u8 link_type, u8 addr_type, u8 status)
3217{
3218 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3219 status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3220}
3221
3222int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3223 u8 addr_type, u8 status)
3224{
3225 struct mgmt_ev_auth_failed ev;
3226
3227 bacpy(&ev.addr.bdaddr, bdaddr);
3228 ev.addr.type = link_to_mgmt(link_type, addr_type);
3229 ev.status = mgmt_status(status);
3230
3231 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3232}
3233
3234int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3235{
3236 struct cmd_lookup match = { NULL, hdev };
3237 bool changed = false;
3238 int err = 0;
3239
3240 if (status) {
3241 u8 mgmt_err = mgmt_status(status);
3242 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3243 cmd_status_rsp, &mgmt_err);
3244 return 0;
3245 }
3246
3247 if (test_bit(HCI_AUTH, &hdev->flags)) {
3248 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3249 changed = true;
3250 } else {
3251 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3252 changed = true;
3253 }
3254
3255 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3256 &match);
3257
3258 if (changed)
3259 err = new_settings(hdev, match.sk);
3260
3261 if (match.sk)
3262 sock_put(match.sk);
3263
3264 return err;
3265}
3266
3267static int clear_eir(struct hci_dev *hdev)
3268{
3269 struct hci_cp_write_eir cp;
3270
3271 if (!(hdev->features[6] & LMP_EXT_INQ))
3272 return 0;
3273
3274 memset(hdev->eir, 0, sizeof(hdev->eir));
3275
3276 memset(&cp, 0, sizeof(cp));
3277
3278 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3279}
3280
3281int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3282{
3283 struct cmd_lookup match = { NULL, hdev };
3284 bool changed = false;
3285 int err = 0;
3286
3287 if (status) {
3288 u8 mgmt_err = mgmt_status(status);
3289
3290 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3291 &hdev->dev_flags))
3292 err = new_settings(hdev, NULL);
3293
3294 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3295 &mgmt_err);
3296
3297 return err;
3298 }
3299
3300 if (enable) {
3301 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3302 changed = true;
3303 } else {
3304 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3305 changed = true;
3306 }
3307
3308 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3309
3310 if (changed)
3311 err = new_settings(hdev, match.sk);
3312
3313 if (match.sk)
3314 sock_put(match.sk);
3315
3316 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3317 update_eir(hdev);
3318 else
3319 clear_eir(hdev);
3320
3321 return err;
3322}
3323
3324static void class_rsp(struct pending_cmd *cmd, void *data)
3325{
3326 struct cmd_lookup *match = data;
3327
3328 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3329 match->hdev->dev_class, 3);
3330
3331 list_del(&cmd->list);
3332
3333 if (match->sk == NULL) {
3334 match->sk = cmd->sk;
3335 sock_hold(match->sk);
3336 }
3337
3338 mgmt_pending_free(cmd);
3339}
3340
3341int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3342 u8 status)
3343{
3344 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3345 int err = 0;
3346
3347 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3348
3349 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3350 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3351 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3352
3353 if (!status)
3354 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3355 3, NULL);
3356
3357 if (match.sk)
3358 sock_put(match.sk);
3359
3360 return err;
3361}
3362
3363int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3364{
3365 struct pending_cmd *cmd;
3366 struct mgmt_cp_set_local_name ev;
3367 bool changed = false;
3368 int err = 0;
3369
3370 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3371 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3372 changed = true;
3373 }
3374
3375 memset(&ev, 0, sizeof(ev));
3376 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3377 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3378
3379 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3380 if (!cmd)
3381 goto send_event;
3382
3383 /* Always assume that either the short or the complete name has
3384 * changed if there was a pending mgmt command */
3385 changed = true;
3386
3387 if (status) {
3388 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3389 mgmt_status(status));
3390 goto failed;
3391 }
3392
3393 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3394 sizeof(ev));
3395 if (err < 0)
3396 goto failed;
3397
3398send_event:
3399 if (changed)
3400 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3401 sizeof(ev), cmd ? cmd->sk : NULL);
3402
3403 update_eir(hdev);
3404
3405failed:
3406 if (cmd)
3407 mgmt_pending_remove(cmd);
3408 return err;
3409}
3410
3411int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3412 u8 *randomizer, u8 status)
3413{
3414 struct pending_cmd *cmd;
3415 int err;
3416
3417 BT_DBG("%s status %u", hdev->name, status);
3418
3419 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3420 if (!cmd)
3421 return -ENOENT;
3422
3423 if (status) {
3424 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3425 mgmt_status(status));
3426 } else {
3427 struct mgmt_rp_read_local_oob_data rp;
3428
3429 memcpy(rp.hash, hash, sizeof(rp.hash));
3430 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3431
3432 err = cmd_complete(cmd->sk, hdev->id,
3433 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3434 sizeof(rp));
3435 }
3436
3437 mgmt_pending_remove(cmd);
3438
3439 return err;
3440}
3441
3442int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3443{
3444 struct cmd_lookup match = { NULL, hdev };
3445 bool changed = false;
3446 int err = 0;
3447
3448 if (status) {
3449 u8 mgmt_err = mgmt_status(status);
3450
3451 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3452 &hdev->dev_flags))
3453 err = new_settings(hdev, NULL);
3454
3455 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev,
3456 cmd_status_rsp, &mgmt_err);
3457
3458 return err;
3459 }
3460
3461 if (enable) {
3462 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3463 changed = true;
3464 } else {
3465 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3466 changed = true;
3467 }
3468
3469 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3470
3471 if (changed)
3472 err = new_settings(hdev, match.sk);
3473
3474 if (match.sk)
3475 sock_put(match.sk);
3476
3477 return err;
3478}
3479
3480int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3481 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3482 ssp, u8 *eir, u16 eir_len)
3483{
3484 char buf[512];
3485 struct mgmt_ev_device_found *ev = (void *) buf;
3486 size_t ev_size;
3487
3488 /* Leave 5 bytes for a potential CoD field */
3489 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3490 return -EINVAL;
3491
3492 memset(buf, 0, sizeof(buf));
3493
3494 bacpy(&ev->addr.bdaddr, bdaddr);
3495 ev->addr.type = link_to_mgmt(link_type, addr_type);
3496 ev->rssi = rssi;
3497 if (cfm_name)
3498 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3499 if (!ssp)
3500 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3501
3502 if (eir_len > 0)
3503 memcpy(ev->eir, eir, eir_len);
3504
3505 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3506 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3507 dev_class, 3);
3508
3509 put_unaligned_le16(eir_len, &ev->eir_len);
3510
3511 ev_size = sizeof(*ev) + eir_len;
3512
3513 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3514}
3515
3516int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3517 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3518{
3519 struct mgmt_ev_device_found *ev;
3520 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3521 u16 eir_len;
3522
3523 ev = (struct mgmt_ev_device_found *) buf;
3524
3525 memset(buf, 0, sizeof(buf));
3526
3527 bacpy(&ev->addr.bdaddr, bdaddr);
3528 ev->addr.type = link_to_mgmt(link_type, addr_type);
3529 ev->rssi = rssi;
3530
3531 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3532 name_len);
3533
3534 put_unaligned_le16(eir_len, &ev->eir_len);
3535
3536 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3537 sizeof(*ev) + eir_len, NULL);
3538}
3539
3540int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3541{
3542 struct pending_cmd *cmd;
3543 u8 type;
3544 int err;
3545
3546 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3547
3548 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3549 if (!cmd)
3550 return -ENOENT;
3551
3552 type = hdev->discovery.type;
3553
3554 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3555 &type, sizeof(type));
3556 mgmt_pending_remove(cmd);
3557
3558 return err;
3559}
3560
3561int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3562{
3563 struct pending_cmd *cmd;
3564 int err;
3565
3566 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3567 if (!cmd)
3568 return -ENOENT;
3569
3570 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3571 &hdev->discovery.type, sizeof(hdev->discovery.type));
3572 mgmt_pending_remove(cmd);
3573
3574 return err;
3575}
3576
3577int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3578{
3579 struct mgmt_ev_discovering ev;
3580 struct pending_cmd *cmd;
3581
3582 BT_DBG("%s discovering %u", hdev->name, discovering);
3583
3584 if (discovering)
3585 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3586 else
3587 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3588
3589 if (cmd != NULL) {
3590 u8 type = hdev->discovery.type;
3591
3592 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3593 sizeof(type));
3594 mgmt_pending_remove(cmd);
3595 }
3596
3597 memset(&ev, 0, sizeof(ev));
3598 ev.type = hdev->discovery.type;
3599 ev.discovering = discovering;
3600
3601 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3602}
3603
3604int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3605{
3606 struct pending_cmd *cmd;
3607 struct mgmt_ev_device_blocked ev;
3608
3609 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3610
3611 bacpy(&ev.addr.bdaddr, bdaddr);
3612 ev.addr.type = type;
3613
3614 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3615 cmd ? cmd->sk : NULL);
3616}
3617
3618int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3619{
3620 struct pending_cmd *cmd;
3621 struct mgmt_ev_device_unblocked ev;
3622
3623 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3624
3625 bacpy(&ev.addr.bdaddr, bdaddr);
3626 ev.addr.type = type;
3627
3628 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3629 cmd ? cmd->sk : NULL);
3630}
3631
3632module_param(enable_hs, bool, 0644);
3633MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3634
3635module_param(enable_le, bool, 0644);
3636MODULE_PARM_DESC(enable_le, "Enable Low Energy support");