projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/mgmt.h>
33 #include <net/bluetooth/smp.h>
34
35 bool enable_hs;
36
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 2
39
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
42 MGMT_OP_READ_INFO,
43 MGMT_OP_SET_POWERED,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
47 MGMT_OP_SET_PAIRABLE,
48 MGMT_OP_SET_LINK_SECURITY,
49 MGMT_OP_SET_SSP,
50 MGMT_OP_SET_HS,
51 MGMT_OP_SET_LE,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
54 MGMT_OP_ADD_UUID,
55 MGMT_OP_REMOVE_UUID,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
58 MGMT_OP_DISCONNECT,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
63 MGMT_OP_PAIR_DEVICE,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
75 MGMT_OP_CONFIRM_NAME,
76 MGMT_OP_BLOCK_DEVICE,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 };
80
81 static const u16 mgmt_events[] = {
82 MGMT_EV_CONTROLLER_ERROR,
83 MGMT_EV_INDEX_ADDED,
84 MGMT_EV_INDEX_REMOVED,
85 MGMT_EV_NEW_SETTINGS,
86 MGMT_EV_CLASS_OF_DEV_CHANGED,
87 MGMT_EV_LOCAL_NAME_CHANGED,
88 MGMT_EV_NEW_LINK_KEY,
89 MGMT_EV_NEW_LONG_TERM_KEY,
90 MGMT_EV_DEVICE_CONNECTED,
91 MGMT_EV_DEVICE_DISCONNECTED,
92 MGMT_EV_CONNECT_FAILED,
93 MGMT_EV_PIN_CODE_REQUEST,
94 MGMT_EV_USER_CONFIRM_REQUEST,
95 MGMT_EV_USER_PASSKEY_REQUEST,
96 MGMT_EV_AUTH_FAILED,
97 MGMT_EV_DEVICE_FOUND,
98 MGMT_EV_DISCOVERING,
99 MGMT_EV_DEVICE_BLOCKED,
100 MGMT_EV_DEVICE_UNBLOCKED,
101 MGMT_EV_DEVICE_UNPAIRED,
102 MGMT_EV_PASSKEY_NOTIFY,
103 };
104
105 /*
106 * These LE scan and inquiry parameters were chosen according to LE General
107 * Discovery Procedure specification.
108 */
109 #define LE_SCAN_TYPE 0x01
110 #define LE_SCAN_WIN 0x12
111 #define LE_SCAN_INT 0x12
112 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
113 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
114
115 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
116 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
117
118 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
119
120 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
121 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
122
123 struct pending_cmd {
124 struct list_head list;
125 u16 opcode;
126 int index;
127 void *param;
128 struct sock *sk;
129 void *user_data;
130 };
131
132 /* HCI to MGMT error code conversion table */
133 static u8 mgmt_status_table[] = {
134 MGMT_STATUS_SUCCESS,
135 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
136 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
137 MGMT_STATUS_FAILED, /* Hardware Failure */
138 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
139 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
140 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
141 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
142 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
143 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
144 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
145 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
146 MGMT_STATUS_BUSY, /* Command Disallowed */
147 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
148 MGMT_STATUS_REJECTED, /* Rejected Security */
149 MGMT_STATUS_REJECTED, /* Rejected Personal */
150 MGMT_STATUS_TIMEOUT, /* Host Timeout */
151 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
152 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
153 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
154 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
155 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
156 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
157 MGMT_STATUS_BUSY, /* Repeated Attempts */
158 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
159 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
160 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
161 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
162 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
163 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
164 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
165 MGMT_STATUS_FAILED, /* Unspecified Error */
166 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
167 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
168 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
169 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
170 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
171 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
172 MGMT_STATUS_FAILED, /* Unit Link Key Used */
173 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
174 MGMT_STATUS_TIMEOUT, /* Instant Passed */
175 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
176 MGMT_STATUS_FAILED, /* Transaction Collision */
177 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
178 MGMT_STATUS_REJECTED, /* QoS Rejected */
179 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
180 MGMT_STATUS_REJECTED, /* Insufficient Security */
181 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
182 MGMT_STATUS_BUSY, /* Role Switch Pending */
183 MGMT_STATUS_FAILED, /* Slot Violation */
184 MGMT_STATUS_FAILED, /* Role Switch Failed */
185 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
186 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
187 MGMT_STATUS_BUSY, /* Host Busy Pairing */
188 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
189 MGMT_STATUS_BUSY, /* Controller Busy */
190 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
191 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
192 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
193 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
194 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
195 };
196
197 bool mgmt_valid_hdev(struct hci_dev *hdev)
198 {
199 return hdev->dev_type == HCI_BREDR;
200 }
201
202 static u8 mgmt_status(u8 hci_status)
203 {
204 if (hci_status < ARRAY_SIZE(mgmt_status_table))
205 return mgmt_status_table[hci_status];
206
207 return MGMT_STATUS_FAILED;
208 }
209
210 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
211 {
212 struct sk_buff *skb;
213 struct mgmt_hdr *hdr;
214 struct mgmt_ev_cmd_status *ev;
215 int err;
216
217 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
218
219 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
220 if (!skb)
221 return -ENOMEM;
222
223 hdr = (void *) skb_put(skb, sizeof(*hdr));
224
225 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS);
226 hdr->index = cpu_to_le16(index);
227 hdr->len = cpu_to_le16(sizeof(*ev));
228
229 ev = (void *) skb_put(skb, sizeof(*ev));
230 ev->status = status;
231 ev->opcode = cpu_to_le16(cmd);
232
233 err = sock_queue_rcv_skb(sk, skb);
234 if (err < 0)
235 kfree_skb(skb);
236
237 return err;
238 }
239
240 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
241 void *rp, size_t rp_len)
242 {
243 struct sk_buff *skb;
244 struct mgmt_hdr *hdr;
245 struct mgmt_ev_cmd_complete *ev;
246 int err;
247
248 BT_DBG("sock %p", sk);
249
250 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
251 if (!skb)
252 return -ENOMEM;
253
254 hdr = (void *) skb_put(skb, sizeof(*hdr));
255
256 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE);
257 hdr->index = cpu_to_le16(index);
258 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
259
260 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
261 ev->opcode = cpu_to_le16(cmd);
262 ev->status = status;
263
264 if (rp)
265 memcpy(ev->data, rp, rp_len);
266
267 err = sock_queue_rcv_skb(sk, skb);
268 if (err < 0)
269 kfree_skb(skb);
270
271 return err;
272 }
273
274 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
275 u16 data_len)
276 {
277 struct mgmt_rp_read_version rp;
278
279 BT_DBG("sock %p", sk);
280
281 rp.version = MGMT_VERSION;
282 rp.revision = __constant_cpu_to_le16(MGMT_REVISION);
283
284 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
285 sizeof(rp));
286 }
287
288 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
289 u16 data_len)
290 {
291 struct mgmt_rp_read_commands *rp;
292 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
293 const u16 num_events = ARRAY_SIZE(mgmt_events);
294 __le16 *opcode;
295 size_t rp_size;
296 int i, err;
297
298 BT_DBG("sock %p", sk);
299
300 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
301
302 rp = kmalloc(rp_size, GFP_KERNEL);
303 if (!rp)
304 return -ENOMEM;
305
306 rp->num_commands = __constant_cpu_to_le16(num_commands);
307 rp->num_events = __constant_cpu_to_le16(num_events);
308
309 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
310 put_unaligned_le16(mgmt_commands[i], opcode);
311
312 for (i = 0; i < num_events; i++, opcode++)
313 put_unaligned_le16(mgmt_events[i], opcode);
314
315 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
316 rp_size);
317 kfree(rp);
318
319 return err;
320 }
321
322 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
323 u16 data_len)
324 {
325 struct mgmt_rp_read_index_list *rp;
326 struct hci_dev *d;
327 size_t rp_len;
328 u16 count;
329 int err;
330
331 BT_DBG("sock %p", sk);
332
333 read_lock(&hci_dev_list_lock);
334
335 count = 0;
336 list_for_each_entry(d, &hci_dev_list, list) {
337 if (!mgmt_valid_hdev(d))
338 continue;
339
340 count++;
341 }
342
343 rp_len = sizeof(*rp) + (2 * count);
344 rp = kmalloc(rp_len, GFP_ATOMIC);
345 if (!rp) {
346 read_unlock(&hci_dev_list_lock);
347 return -ENOMEM;
348 }
349
350 count = 0;
351 list_for_each_entry(d, &hci_dev_list, list) {
352 if (test_bit(HCI_SETUP, &d->dev_flags))
353 continue;
354
355 if (!mgmt_valid_hdev(d))
356 continue;
357
358 rp->index[count++] = cpu_to_le16(d->id);
359 BT_DBG("Added hci%u", d->id);
360 }
361
362 rp->num_controllers = cpu_to_le16(count);
363 rp_len = sizeof(*rp) + (2 * count);
364
365 read_unlock(&hci_dev_list_lock);
366
367 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
368 rp_len);
369
370 kfree(rp);
371
372 return err;
373 }
374
375 static u32 get_supported_settings(struct hci_dev *hdev)
376 {
377 u32 settings = 0;
378
379 settings |= MGMT_SETTING_POWERED;
380 settings |= MGMT_SETTING_PAIRABLE;
381
382 if (lmp_ssp_capable(hdev))
383 settings |= MGMT_SETTING_SSP;
384
385 if (lmp_bredr_capable(hdev)) {
386 settings |= MGMT_SETTING_CONNECTABLE;
387 settings |= MGMT_SETTING_FAST_CONNECTABLE;
388 settings |= MGMT_SETTING_DISCOVERABLE;
389 settings |= MGMT_SETTING_BREDR;
390 settings |= MGMT_SETTING_LINK_SECURITY;
391 }
392
393 if (enable_hs)
394 settings |= MGMT_SETTING_HS;
395
396 if (lmp_le_capable(hdev))
397 settings |= MGMT_SETTING_LE;
398
399 return settings;
400 }
401
402 static u32 get_current_settings(struct hci_dev *hdev)
403 {
404 u32 settings = 0;
405
406 if (hdev_is_powered(hdev))
407 settings |= MGMT_SETTING_POWERED;
408
409 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
410 settings |= MGMT_SETTING_CONNECTABLE;
411
412 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
413 settings |= MGMT_SETTING_DISCOVERABLE;
414
415 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
416 settings |= MGMT_SETTING_PAIRABLE;
417
418 if (lmp_bredr_capable(hdev))
419 settings |= MGMT_SETTING_BREDR;
420
421 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
422 settings |= MGMT_SETTING_LE;
423
424 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
425 settings |= MGMT_SETTING_LINK_SECURITY;
426
427 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
428 settings |= MGMT_SETTING_SSP;
429
430 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
431 settings |= MGMT_SETTING_HS;
432
433 return settings;
434 }
435
436 #define PNP_INFO_SVCLASS_ID 0x1200
437
438 static u8 bluetooth_base_uuid[] = {
439 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
440 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
441 };
442
443 static u16 get_uuid16(u8 *uuid128)
444 {
445 u32 val;
446 int i;
447
448 for (i = 0; i < 12; i++) {
449 if (bluetooth_base_uuid[i] != uuid128[i])
450 return 0;
451 }
452
453 val = get_unaligned_le32(&uuid128[12]);
454 if (val > 0xffff)
455 return 0;
456
457 return (u16) val;
458 }
459
460 static void create_eir(struct hci_dev *hdev, u8 *data)
461 {
462 u8 *ptr = data;
463 u16 eir_len = 0;
464 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
465 int i, truncated = 0;
466 struct bt_uuid *uuid;
467 size_t name_len;
468
469 name_len = strlen(hdev->dev_name);
470
471 if (name_len > 0) {
472 /* EIR Data type */
473 if (name_len > 48) {
474 name_len = 48;
475 ptr[1] = EIR_NAME_SHORT;
476 } else
477 ptr[1] = EIR_NAME_COMPLETE;
478
479 /* EIR Data length */
480 ptr[0] = name_len + 1;
481
482 memcpy(ptr + 2, hdev->dev_name, name_len);
483
484 eir_len += (name_len + 2);
485 ptr += (name_len + 2);
486 }
487
488 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
489 ptr[0] = 2;
490 ptr[1] = EIR_TX_POWER;
491 ptr[2] = (u8) hdev->inq_tx_power;
492
493 eir_len += 3;
494 ptr += 3;
495 }
496
497 if (hdev->devid_source > 0) {
498 ptr[0] = 9;
499 ptr[1] = EIR_DEVICE_ID;
500
501 put_unaligned_le16(hdev->devid_source, ptr + 2);
502 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
503 put_unaligned_le16(hdev->devid_product, ptr + 6);
504 put_unaligned_le16(hdev->devid_version, ptr + 8);
505
506 eir_len += 10;
507 ptr += 10;
508 }
509
510 memset(uuid16_list, 0, sizeof(uuid16_list));
511
512 /* Group all UUID16 types */
513 list_for_each_entry(uuid, &hdev->uuids, list) {
514 u16 uuid16;
515
516 uuid16 = get_uuid16(uuid->uuid);
517 if (uuid16 == 0)
518 return;
519
520 if (uuid16 < 0x1100)
521 continue;
522
523 if (uuid16 == PNP_INFO_SVCLASS_ID)
524 continue;
525
526 /* Stop if not enough space to put next UUID */
527 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
528 truncated = 1;
529 break;
530 }
531
532 /* Check for duplicates */
533 for (i = 0; uuid16_list[i] != 0; i++)
534 if (uuid16_list[i] == uuid16)
535 break;
536
537 if (uuid16_list[i] == 0) {
538 uuid16_list[i] = uuid16;
539 eir_len += sizeof(u16);
540 }
541 }
542
543 if (uuid16_list[0] != 0) {
544 u8 *length = ptr;
545
546 /* EIR Data type */
547 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
548
549 ptr += 2;
550 eir_len += 2;
551
552 for (i = 0; uuid16_list[i] != 0; i++) {
553 *ptr++ = (uuid16_list[i] & 0x00ff);
554 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
555 }
556
557 /* EIR Data length */
558 *length = (i * sizeof(u16)) + 1;
559 }
560 }
561
562 static int update_eir(struct hci_dev *hdev)
563 {
564 struct hci_cp_write_eir cp;
565
566 if (!hdev_is_powered(hdev))
567 return 0;
568
569 if (!lmp_ext_inq_capable(hdev))
570 return 0;
571
572 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
573 return 0;
574
575 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
576 return 0;
577
578 memset(&cp, 0, sizeof(cp));
579
580 create_eir(hdev, cp.data);
581
582 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
583 return 0;
584
585 memcpy(hdev->eir, cp.data, sizeof(cp.data));
586
587 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
588 }
589
590 static u8 get_service_classes(struct hci_dev *hdev)
591 {
592 struct bt_uuid *uuid;
593 u8 val = 0;
594
595 list_for_each_entry(uuid, &hdev->uuids, list)
596 val |= uuid->svc_hint;
597
598 return val;
599 }
600
601 static int update_class(struct hci_dev *hdev)
602 {
603 u8 cod[3];
604 int err;
605
606 BT_DBG("%s", hdev->name);
607
608 if (!hdev_is_powered(hdev))
609 return 0;
610
611 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
612 return 0;
613
614 cod[0] = hdev->minor_class;
615 cod[1] = hdev->major_class;
616 cod[2] = get_service_classes(hdev);
617
618 if (memcmp(cod, hdev->dev_class, 3) == 0)
619 return 0;
620
621 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
622 if (err == 0)
623 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
624
625 return err;
626 }
627
628 static void service_cache_off(struct work_struct *work)
629 {
630 struct hci_dev *hdev = container_of(work, struct hci_dev,
631 service_cache.work);
632
633 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
634 return;
635
636 hci_dev_lock(hdev);
637
638 update_eir(hdev);
639 update_class(hdev);
640
641 hci_dev_unlock(hdev);
642 }
643
644 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
645 {
646 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
647 return;
648
649 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
650
651 /* Non-mgmt controlled devices get this bit set
652 * implicitly so that pairing works for them, however
653 * for mgmt we require user-space to explicitly enable
654 * it
655 */
656 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
657 }
658
659 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
660 void *data, u16 data_len)
661 {
662 struct mgmt_rp_read_info rp;
663
664 BT_DBG("sock %p %s", sk, hdev->name);
665
666 hci_dev_lock(hdev);
667
668 memset(&rp, 0, sizeof(rp));
669
670 bacpy(&rp.bdaddr, &hdev->bdaddr);
671
672 rp.version = hdev->hci_ver;
673 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
674
675 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
676 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
677
678 memcpy(rp.dev_class, hdev->dev_class, 3);
679
680 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
681 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
682
683 hci_dev_unlock(hdev);
684
685 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
686 sizeof(rp));
687 }
688
689 static void mgmt_pending_free(struct pending_cmd *cmd)
690 {
691 sock_put(cmd->sk);
692 kfree(cmd->param);
693 kfree(cmd);
694 }
695
696 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
697 struct hci_dev *hdev, void *data,
698 u16 len)
699 {
700 struct pending_cmd *cmd;
701
702 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
703 if (!cmd)
704 return NULL;
705
706 cmd->opcode = opcode;
707 cmd->index = hdev->id;
708
709 cmd->param = kmalloc(len, GFP_KERNEL);
710 if (!cmd->param) {
711 kfree(cmd);
712 return NULL;
713 }
714
715 if (data)
716 memcpy(cmd->param, data, len);
717
718 cmd->sk = sk;
719 sock_hold(sk);
720
721 list_add(&cmd->list, &hdev->mgmt_pending);
722
723 return cmd;
724 }
725
726 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
727 void (*cb)(struct pending_cmd *cmd,
728 void *data),
729 void *data)
730 {
731 struct list_head *p, *n;
732
733 list_for_each_safe(p, n, &hdev->mgmt_pending) {
734 struct pending_cmd *cmd;
735
736 cmd = list_entry(p, struct pending_cmd, list);
737
738 if (opcode > 0 && cmd->opcode != opcode)
739 continue;
740
741 cb(cmd, data);
742 }
743 }
744
745 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
746 {
747 struct pending_cmd *cmd;
748
749 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
750 if (cmd->opcode == opcode)
751 return cmd;
752 }
753
754 return NULL;
755 }
756
757 static void mgmt_pending_remove(struct pending_cmd *cmd)
758 {
759 list_del(&cmd->list);
760 mgmt_pending_free(cmd);
761 }
762
763 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
764 {
765 __le32 settings = cpu_to_le32(get_current_settings(hdev));
766
767 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
768 sizeof(settings));
769 }
770
771 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
772 u16 len)
773 {
774 struct mgmt_mode *cp = data;
775 struct pending_cmd *cmd;
776 int err;
777
778 BT_DBG("request for %s", hdev->name);
779
780 hci_dev_lock(hdev);
781
782 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
783 cancel_delayed_work(&hdev->power_off);
784
785 if (cp->val) {
786 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
787 mgmt_powered(hdev, 1);
788 goto failed;
789 }
790 }
791
792 if (!!cp->val == hdev_is_powered(hdev)) {
793 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
794 goto failed;
795 }
796
797 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
798 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
799 MGMT_STATUS_BUSY);
800 goto failed;
801 }
802
803 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
804 if (!cmd) {
805 err = -ENOMEM;
806 goto failed;
807 }
808
809 if (cp->val)
810 schedule_work(&hdev->power_on);
811 else
812 schedule_work(&hdev->power_off.work);
813
814 err = 0;
815
816 failed:
817 hci_dev_unlock(hdev);
818 return err;
819 }
820
821 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
822 struct sock *skip_sk)
823 {
824 struct sk_buff *skb;
825 struct mgmt_hdr *hdr;
826
827 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
828 if (!skb)
829 return -ENOMEM;
830
831 hdr = (void *) skb_put(skb, sizeof(*hdr));
832 hdr->opcode = cpu_to_le16(event);
833 if (hdev)
834 hdr->index = cpu_to_le16(hdev->id);
835 else
836 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE);
837 hdr->len = cpu_to_le16(data_len);
838
839 if (data)
840 memcpy(skb_put(skb, data_len), data, data_len);
841
842 /* Time stamp */
843 __net_timestamp(skb);
844
845 hci_send_to_control(skb, skip_sk);
846 kfree_skb(skb);
847
848 return 0;
849 }
850
851 static int new_settings(struct hci_dev *hdev, struct sock *skip)
852 {
853 __le32 ev;
854
855 ev = cpu_to_le32(get_current_settings(hdev));
856
857 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
858 }
859
860 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
861 u16 len)
862 {
863 struct mgmt_cp_set_discoverable *cp = data;
864 struct pending_cmd *cmd;
865 u16 timeout;
866 u8 scan;
867 int err;
868
869 BT_DBG("request for %s", hdev->name);
870
871 if (!lmp_bredr_capable(hdev))
872 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
873 MGMT_STATUS_NOT_SUPPORTED);
874
875 timeout = __le16_to_cpu(cp->timeout);
876 if (!cp->val && timeout > 0)
877 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
878 MGMT_STATUS_INVALID_PARAMS);
879
880 hci_dev_lock(hdev);
881
882 if (!hdev_is_powered(hdev) && timeout > 0) {
883 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
884 MGMT_STATUS_NOT_POWERED);
885 goto failed;
886 }
887
888 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
889 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
890 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
891 MGMT_STATUS_BUSY);
892 goto failed;
893 }
894
895 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
896 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
897 MGMT_STATUS_REJECTED);
898 goto failed;
899 }
900
901 if (!hdev_is_powered(hdev)) {
902 bool changed = false;
903
904 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
905 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
906 changed = true;
907 }
908
909 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
910 if (err < 0)
911 goto failed;
912
913 if (changed)
914 err = new_settings(hdev, sk);
915
916 goto failed;
917 }
918
919 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
920 if (hdev->discov_timeout > 0) {
921 cancel_delayed_work(&hdev->discov_off);
922 hdev->discov_timeout = 0;
923 }
924
925 if (cp->val && timeout > 0) {
926 hdev->discov_timeout = timeout;
927 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
928 msecs_to_jiffies(hdev->discov_timeout * 1000));
929 }
930
931 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
932 goto failed;
933 }
934
935 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
936 if (!cmd) {
937 err = -ENOMEM;
938 goto failed;
939 }
940
941 scan = SCAN_PAGE;
942
943 if (cp->val)
944 scan |= SCAN_INQUIRY;
945 else
946 cancel_delayed_work(&hdev->discov_off);
947
948 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
949 if (err < 0)
950 mgmt_pending_remove(cmd);
951
952 if (cp->val)
953 hdev->discov_timeout = timeout;
954
955 failed:
956 hci_dev_unlock(hdev);
957 return err;
958 }
959
960 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
961 u16 len)
962 {
963 struct mgmt_mode *cp = data;
964 struct pending_cmd *cmd;
965 u8 scan;
966 int err;
967
968 BT_DBG("request for %s", hdev->name);
969
970 if (!lmp_bredr_capable(hdev))
971 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
972 MGMT_STATUS_NOT_SUPPORTED);
973
974 hci_dev_lock(hdev);
975
976 if (!hdev_is_powered(hdev)) {
977 bool changed = false;
978
979 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
980 changed = true;
981
982 if (cp->val) {
983 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
984 } else {
985 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
986 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
987 }
988
989 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
990 if (err < 0)
991 goto failed;
992
993 if (changed)
994 err = new_settings(hdev, sk);
995
996 goto failed;
997 }
998
999 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1000 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1001 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1002 MGMT_STATUS_BUSY);
1003 goto failed;
1004 }
1005
1006 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
1007 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1008 goto failed;
1009 }
1010
1011 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1012 if (!cmd) {
1013 err = -ENOMEM;
1014 goto failed;
1015 }
1016
1017 if (cp->val) {
1018 scan = SCAN_PAGE;
1019 } else {
1020 scan = 0;
1021
1022 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1023 hdev->discov_timeout > 0)
1024 cancel_delayed_work(&hdev->discov_off);
1025 }
1026
1027 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1028 if (err < 0)
1029 mgmt_pending_remove(cmd);
1030
1031 failed:
1032 hci_dev_unlock(hdev);
1033 return err;
1034 }
1035
1036 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1037 u16 len)
1038 {
1039 struct mgmt_mode *cp = data;
1040 int err;
1041
1042 BT_DBG("request for %s", hdev->name);
1043
1044 hci_dev_lock(hdev);
1045
1046 if (cp->val)
1047 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1048 else
1049 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1050
1051 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1052 if (err < 0)
1053 goto failed;
1054
1055 err = new_settings(hdev, sk);
1056
1057 failed:
1058 hci_dev_unlock(hdev);
1059 return err;
1060 }
1061
1062 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1063 u16 len)
1064 {
1065 struct mgmt_mode *cp = data;
1066 struct pending_cmd *cmd;
1067 u8 val;
1068 int err;
1069
1070 BT_DBG("request for %s", hdev->name);
1071
1072 if (!lmp_bredr_capable(hdev))
1073 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1074 MGMT_STATUS_NOT_SUPPORTED);
1075
1076 hci_dev_lock(hdev);
1077
1078 if (!hdev_is_powered(hdev)) {
1079 bool changed = false;
1080
1081 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1082 &hdev->dev_flags)) {
1083 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1084 changed = true;
1085 }
1086
1087 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1088 if (err < 0)
1089 goto failed;
1090
1091 if (changed)
1092 err = new_settings(hdev, sk);
1093
1094 goto failed;
1095 }
1096
1097 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1098 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1099 MGMT_STATUS_BUSY);
1100 goto failed;
1101 }
1102
1103 val = !!cp->val;
1104
1105 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1106 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1107 goto failed;
1108 }
1109
1110 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1111 if (!cmd) {
1112 err = -ENOMEM;
1113 goto failed;
1114 }
1115
1116 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1117 if (err < 0) {
1118 mgmt_pending_remove(cmd);
1119 goto failed;
1120 }
1121
1122 failed:
1123 hci_dev_unlock(hdev);
1124 return err;
1125 }
1126
1127 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1128 {
1129 struct mgmt_mode *cp = data;
1130 struct pending_cmd *cmd;
1131 u8 val;
1132 int err;
1133
1134 BT_DBG("request for %s", hdev->name);
1135
1136 hci_dev_lock(hdev);
1137
1138 if (!lmp_ssp_capable(hdev)) {
1139 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1140 MGMT_STATUS_NOT_SUPPORTED);
1141 goto failed;
1142 }
1143
1144 val = !!cp->val;
1145
1146 if (!hdev_is_powered(hdev)) {
1147 bool changed = false;
1148
1149 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1150 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1151 changed = true;
1152 }
1153
1154 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1155 if (err < 0)
1156 goto failed;
1157
1158 if (changed)
1159 err = new_settings(hdev, sk);
1160
1161 goto failed;
1162 }
1163
1164 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1165 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1166 MGMT_STATUS_BUSY);
1167 goto failed;
1168 }
1169
1170 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1171 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1172 goto failed;
1173 }
1174
1175 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1176 if (!cmd) {
1177 err = -ENOMEM;
1178 goto failed;
1179 }
1180
1181 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1182 if (err < 0) {
1183 mgmt_pending_remove(cmd);
1184 goto failed;
1185 }
1186
1187 failed:
1188 hci_dev_unlock(hdev);
1189 return err;
1190 }
1191
1192 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1193 {
1194 struct mgmt_mode *cp = data;
1195
1196 BT_DBG("request for %s", hdev->name);
1197
1198 if (!enable_hs)
1199 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1200 MGMT_STATUS_NOT_SUPPORTED);
1201
1202 if (cp->val)
1203 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1204 else
1205 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1206
1207 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1208 }
1209
1210 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1211 {
1212 struct mgmt_mode *cp = data;
1213 struct hci_cp_write_le_host_supported hci_cp;
1214 struct pending_cmd *cmd;
1215 int err;
1216 u8 val, enabled;
1217
1218 BT_DBG("request for %s", hdev->name);
1219
1220 hci_dev_lock(hdev);
1221
1222 if (!lmp_le_capable(hdev)) {
1223 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1224 MGMT_STATUS_NOT_SUPPORTED);
1225 goto unlock;
1226 }
1227
1228 val = !!cp->val;
1229 enabled = lmp_host_le_capable(hdev);
1230
1231 if (!hdev_is_powered(hdev) || val == enabled) {
1232 bool changed = false;
1233
1234 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1235 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1236 changed = true;
1237 }
1238
1239 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1240 if (err < 0)
1241 goto unlock;
1242
1243 if (changed)
1244 err = new_settings(hdev, sk);
1245
1246 goto unlock;
1247 }
1248
1249 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1250 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1251 MGMT_STATUS_BUSY);
1252 goto unlock;
1253 }
1254
1255 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1256 if (!cmd) {
1257 err = -ENOMEM;
1258 goto unlock;
1259 }
1260
1261 memset(&hci_cp, 0, sizeof(hci_cp));
1262
1263 if (val) {
1264 hci_cp.le = val;
1265 hci_cp.simul = lmp_le_br_capable(hdev);
1266 }
1267
1268 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1269 &hci_cp);
1270 if (err < 0)
1271 mgmt_pending_remove(cmd);
1272
1273 unlock:
1274 hci_dev_unlock(hdev);
1275 return err;
1276 }
1277
1278 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1279 {
1280 struct mgmt_cp_add_uuid *cp = data;
1281 struct pending_cmd *cmd;
1282 struct bt_uuid *uuid;
1283 int err;
1284
1285 BT_DBG("request for %s", hdev->name);
1286
1287 hci_dev_lock(hdev);
1288
1289 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1290 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1291 MGMT_STATUS_BUSY);
1292 goto failed;
1293 }
1294
1295 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
1296 if (!uuid) {
1297 err = -ENOMEM;
1298 goto failed;
1299 }
1300
1301 memcpy(uuid->uuid, cp->uuid, 16);
1302 uuid->svc_hint = cp->svc_hint;
1303
1304 list_add(&uuid->list, &hdev->uuids);
1305
1306 err = update_class(hdev);
1307 if (err < 0)
1308 goto failed;
1309
1310 err = update_eir(hdev);
1311 if (err < 0)
1312 goto failed;
1313
1314 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1315 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1316 hdev->dev_class, 3);
1317 goto failed;
1318 }
1319
1320 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1321 if (!cmd)
1322 err = -ENOMEM;
1323
1324 failed:
1325 hci_dev_unlock(hdev);
1326 return err;
1327 }
1328
1329 static bool enable_service_cache(struct hci_dev *hdev)
1330 {
1331 if (!hdev_is_powered(hdev))
1332 return false;
1333
1334 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1335 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1336 return true;
1337 }
1338
1339 return false;
1340 }
1341
1342 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1343 u16 len)
1344 {
1345 struct mgmt_cp_remove_uuid *cp = data;
1346 struct pending_cmd *cmd;
1347 struct list_head *p, *n;
1348 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1349 int err, found;
1350
1351 BT_DBG("request for %s", hdev->name);
1352
1353 hci_dev_lock(hdev);
1354
1355 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1356 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1357 MGMT_STATUS_BUSY);
1358 goto unlock;
1359 }
1360
1361 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1362 err = hci_uuids_clear(hdev);
1363
1364 if (enable_service_cache(hdev)) {
1365 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1366 0, hdev->dev_class, 3);
1367 goto unlock;
1368 }
1369
1370 goto update_class;
1371 }
1372
1373 found = 0;
1374
1375 list_for_each_safe(p, n, &hdev->uuids) {
1376 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1377
1378 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1379 continue;
1380
1381 list_del(&match->list);
1382 kfree(match);
1383 found++;
1384 }
1385
1386 if (found == 0) {
1387 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1388 MGMT_STATUS_INVALID_PARAMS);
1389 goto unlock;
1390 }
1391
1392 update_class:
1393 err = update_class(hdev);
1394 if (err < 0)
1395 goto unlock;
1396
1397 err = update_eir(hdev);
1398 if (err < 0)
1399 goto unlock;
1400
1401 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1402 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1403 hdev->dev_class, 3);
1404 goto unlock;
1405 }
1406
1407 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1408 if (!cmd)
1409 err = -ENOMEM;
1410
1411 unlock:
1412 hci_dev_unlock(hdev);
1413 return err;
1414 }
1415
1416 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1417 u16 len)
1418 {
1419 struct mgmt_cp_set_dev_class *cp = data;
1420 struct pending_cmd *cmd;
1421 int err;
1422
1423 BT_DBG("request for %s", hdev->name);
1424
1425 hci_dev_lock(hdev);
1426
1427 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1428 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1429 MGMT_STATUS_BUSY);
1430 goto unlock;
1431 }
1432
1433 hdev->major_class = cp->major;
1434 hdev->minor_class = cp->minor;
1435
1436 if (!hdev_is_powered(hdev)) {
1437 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1438 hdev->dev_class, 3);
1439 goto unlock;
1440 }
1441
1442 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1443 hci_dev_unlock(hdev);
1444 cancel_delayed_work_sync(&hdev->service_cache);
1445 hci_dev_lock(hdev);
1446 update_eir(hdev);
1447 }
1448
1449 err = update_class(hdev);
1450 if (err < 0)
1451 goto unlock;
1452
1453 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1454 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1455 hdev->dev_class, 3);
1456 goto unlock;
1457 }
1458
1459 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1460 if (!cmd)
1461 err = -ENOMEM;
1462
1463 unlock:
1464 hci_dev_unlock(hdev);
1465 return err;
1466 }
1467
1468 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1469 u16 len)
1470 {
1471 struct mgmt_cp_load_link_keys *cp = data;
1472 u16 key_count, expected_len;
1473 int i;
1474
1475 key_count = __le16_to_cpu(cp->key_count);
1476
1477 expected_len = sizeof(*cp) + key_count *
1478 sizeof(struct mgmt_link_key_info);
1479 if (expected_len != len) {
1480 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1481 len, expected_len);
1482 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1483 MGMT_STATUS_INVALID_PARAMS);
1484 }
1485
1486 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1487 key_count);
1488
1489 hci_dev_lock(hdev);
1490
1491 hci_link_keys_clear(hdev);
1492
1493 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1494
1495 if (cp->debug_keys)
1496 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1497 else
1498 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1499
1500 for (i = 0; i < key_count; i++) {
1501 struct mgmt_link_key_info *key = &cp->keys[i];
1502
1503 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1504 key->type, key->pin_len);
1505 }
1506
1507 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1508
1509 hci_dev_unlock(hdev);
1510
1511 return 0;
1512 }
1513
1514 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1515 u8 addr_type, struct sock *skip_sk)
1516 {
1517 struct mgmt_ev_device_unpaired ev;
1518
1519 bacpy(&ev.addr.bdaddr, bdaddr);
1520 ev.addr.type = addr_type;
1521
1522 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1523 skip_sk);
1524 }
1525
1526 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1527 u16 len)
1528 {
1529 struct mgmt_cp_unpair_device *cp = data;
1530 struct mgmt_rp_unpair_device rp;
1531 struct hci_cp_disconnect dc;
1532 struct pending_cmd *cmd;
1533 struct hci_conn *conn;
1534 int err;
1535
1536 hci_dev_lock(hdev);
1537
1538 memset(&rp, 0, sizeof(rp));
1539 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1540 rp.addr.type = cp->addr.type;
1541
1542 if (!hdev_is_powered(hdev)) {
1543 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1544 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1545 goto unlock;
1546 }
1547
1548 if (cp->addr.type == BDADDR_BREDR)
1549 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1550 else
1551 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1552
1553 if (err < 0) {
1554 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1555 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1556 goto unlock;
1557 }
1558
1559 if (cp->disconnect) {
1560 if (cp->addr.type == BDADDR_BREDR)
1561 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1562 &cp->addr.bdaddr);
1563 else
1564 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1565 &cp->addr.bdaddr);
1566 } else {
1567 conn = NULL;
1568 }
1569
1570 if (!conn) {
1571 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1572 &rp, sizeof(rp));
1573 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1574 goto unlock;
1575 }
1576
1577 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1578 sizeof(*cp));
1579 if (!cmd) {
1580 err = -ENOMEM;
1581 goto unlock;
1582 }
1583
1584 dc.handle = cpu_to_le16(conn->handle);
1585 dc.reason = 0x13; /* Remote User Terminated Connection */
1586 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1587 if (err < 0)
1588 mgmt_pending_remove(cmd);
1589
1590 unlock:
1591 hci_dev_unlock(hdev);
1592 return err;
1593 }
1594
1595 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1596 u16 len)
1597 {
1598 struct mgmt_cp_disconnect *cp = data;
1599 struct hci_cp_disconnect dc;
1600 struct pending_cmd *cmd;
1601 struct hci_conn *conn;
1602 int err;
1603
1604 BT_DBG("");
1605
1606 hci_dev_lock(hdev);
1607
1608 if (!test_bit(HCI_UP, &hdev->flags)) {
1609 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1610 MGMT_STATUS_NOT_POWERED);
1611 goto failed;
1612 }
1613
1614 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1615 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1616 MGMT_STATUS_BUSY);
1617 goto failed;
1618 }
1619
1620 if (cp->addr.type == BDADDR_BREDR)
1621 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1622 &cp->addr.bdaddr);
1623 else
1624 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1625
1626 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1627 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1628 MGMT_STATUS_NOT_CONNECTED);
1629 goto failed;
1630 }
1631
1632 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1633 if (!cmd) {
1634 err = -ENOMEM;
1635 goto failed;
1636 }
1637
1638 dc.handle = cpu_to_le16(conn->handle);
1639 dc.reason = HCI_ERROR_REMOTE_USER_TERM;
1640
1641 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1642 if (err < 0)
1643 mgmt_pending_remove(cmd);
1644
1645 failed:
1646 hci_dev_unlock(hdev);
1647 return err;
1648 }
1649
1650 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
1651 {
1652 switch (link_type) {
1653 case LE_LINK:
1654 switch (addr_type) {
1655 case ADDR_LE_DEV_PUBLIC:
1656 return BDADDR_LE_PUBLIC;
1657
1658 default:
1659 /* Fallback to LE Random address type */
1660 return BDADDR_LE_RANDOM;
1661 }
1662
1663 default:
1664 /* Fallback to BR/EDR type */
1665 return BDADDR_BREDR;
1666 }
1667 }
1668
1669 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1670 u16 data_len)
1671 {
1672 struct mgmt_rp_get_connections *rp;
1673 struct hci_conn *c;
1674 size_t rp_len;
1675 int err;
1676 u16 i;
1677
1678 BT_DBG("");
1679
1680 hci_dev_lock(hdev);
1681
1682 if (!hdev_is_powered(hdev)) {
1683 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1684 MGMT_STATUS_NOT_POWERED);
1685 goto unlock;
1686 }
1687
1688 i = 0;
1689 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1690 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1691 i++;
1692 }
1693
1694 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1695 rp = kmalloc(rp_len, GFP_KERNEL);
1696 if (!rp) {
1697 err = -ENOMEM;
1698 goto unlock;
1699 }
1700
1701 i = 0;
1702 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1703 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1704 continue;
1705 bacpy(&rp->addr[i].bdaddr, &c->dst);
1706 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
1707 if (c->type == SCO_LINK || c->type == ESCO_LINK)
1708 continue;
1709 i++;
1710 }
1711
1712 rp->conn_count = cpu_to_le16(i);
1713
1714 /* Recalculate length in case of filtered SCO connections, etc */
1715 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1716
1717 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1718 rp_len);
1719
1720 kfree(rp);
1721
1722 unlock:
1723 hci_dev_unlock(hdev);
1724 return err;
1725 }
1726
1727 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1728 struct mgmt_cp_pin_code_neg_reply *cp)
1729 {
1730 struct pending_cmd *cmd;
1731 int err;
1732
1733 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1734 sizeof(*cp));
1735 if (!cmd)
1736 return -ENOMEM;
1737
1738 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1739 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1740 if (err < 0)
1741 mgmt_pending_remove(cmd);
1742
1743 return err;
1744 }
1745
1746 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1747 u16 len)
1748 {
1749 struct hci_conn *conn;
1750 struct mgmt_cp_pin_code_reply *cp = data;
1751 struct hci_cp_pin_code_reply reply;
1752 struct pending_cmd *cmd;
1753 int err;
1754
1755 BT_DBG("");
1756
1757 hci_dev_lock(hdev);
1758
1759 if (!hdev_is_powered(hdev)) {
1760 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1761 MGMT_STATUS_NOT_POWERED);
1762 goto failed;
1763 }
1764
1765 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1766 if (!conn) {
1767 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1768 MGMT_STATUS_NOT_CONNECTED);
1769 goto failed;
1770 }
1771
1772 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1773 struct mgmt_cp_pin_code_neg_reply ncp;
1774
1775 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1776
1777 BT_ERR("PIN code is not 16 bytes long");
1778
1779 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1780 if (err >= 0)
1781 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1782 MGMT_STATUS_INVALID_PARAMS);
1783
1784 goto failed;
1785 }
1786
1787 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1788 if (!cmd) {
1789 err = -ENOMEM;
1790 goto failed;
1791 }
1792
1793 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1794 reply.pin_len = cp->pin_len;
1795 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1796
1797 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1798 if (err < 0)
1799 mgmt_pending_remove(cmd);
1800
1801 failed:
1802 hci_dev_unlock(hdev);
1803 return err;
1804 }
1805
1806 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1807 u16 len)
1808 {
1809 struct mgmt_cp_set_io_capability *cp = data;
1810
1811 BT_DBG("");
1812
1813 hci_dev_lock(hdev);
1814
1815 hdev->io_capability = cp->io_capability;
1816
1817 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1818 hdev->io_capability);
1819
1820 hci_dev_unlock(hdev);
1821
1822 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1823 0);
1824 }
1825
1826 static struct pending_cmd *find_pairing(struct hci_conn *conn)
1827 {
1828 struct hci_dev *hdev = conn->hdev;
1829 struct pending_cmd *cmd;
1830
1831 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1832 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1833 continue;
1834
1835 if (cmd->user_data != conn)
1836 continue;
1837
1838 return cmd;
1839 }
1840
1841 return NULL;
1842 }
1843
1844 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1845 {
1846 struct mgmt_rp_pair_device rp;
1847 struct hci_conn *conn = cmd->user_data;
1848
1849 bacpy(&rp.addr.bdaddr, &conn->dst);
1850 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
1851
1852 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1853 &rp, sizeof(rp));
1854
1855 /* So we don't get further callbacks for this connection */
1856 conn->connect_cfm_cb = NULL;
1857 conn->security_cfm_cb = NULL;
1858 conn->disconn_cfm_cb = NULL;
1859
1860 hci_conn_put(conn);
1861
1862 mgmt_pending_remove(cmd);
1863 }
1864
1865 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1866 {
1867 struct pending_cmd *cmd;
1868
1869 BT_DBG("status %u", status);
1870
1871 cmd = find_pairing(conn);
1872 if (!cmd)
1873 BT_DBG("Unable to find a pending command");
1874 else
1875 pairing_complete(cmd, mgmt_status(status));
1876 }
1877
1878 static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1879 {
1880 struct pending_cmd *cmd;
1881
1882 BT_DBG("status %u", status);
1883
1884 if (!status)
1885 return;
1886
1887 cmd = find_pairing(conn);
1888 if (!cmd)
1889 BT_DBG("Unable to find a pending command");
1890 else
1891 pairing_complete(cmd, mgmt_status(status));
1892 }
1893
1894 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1895 u16 len)
1896 {
1897 struct mgmt_cp_pair_device *cp = data;
1898 struct mgmt_rp_pair_device rp;
1899 struct pending_cmd *cmd;
1900 u8 sec_level, auth_type;
1901 struct hci_conn *conn;
1902 int err;
1903
1904 BT_DBG("");
1905
1906 hci_dev_lock(hdev);
1907
1908 if (!hdev_is_powered(hdev)) {
1909 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1910 MGMT_STATUS_NOT_POWERED);
1911 goto unlock;
1912 }
1913
1914 sec_level = BT_SECURITY_MEDIUM;
1915 if (cp->io_cap == 0x03)
1916 auth_type = HCI_AT_DEDICATED_BONDING;
1917 else
1918 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1919
1920 if (cp->addr.type == BDADDR_BREDR)
1921 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr,
1922 cp->addr.type, sec_level, auth_type);
1923 else
1924 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr,
1925 cp->addr.type, sec_level, auth_type);
1926
1927 memset(&rp, 0, sizeof(rp));
1928 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1929 rp.addr.type = cp->addr.type;
1930
1931 if (IS_ERR(conn)) {
1932 int status;
1933
1934 if (PTR_ERR(conn) == -EBUSY)
1935 status = MGMT_STATUS_BUSY;
1936 else
1937 status = MGMT_STATUS_CONNECT_FAILED;
1938
1939 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1940 status, &rp,
1941 sizeof(rp));
1942 goto unlock;
1943 }
1944
1945 if (conn->connect_cfm_cb) {
1946 hci_conn_put(conn);
1947 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1948 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1949 goto unlock;
1950 }
1951
1952 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1953 if (!cmd) {
1954 err = -ENOMEM;
1955 hci_conn_put(conn);
1956 goto unlock;
1957 }
1958
1959 /* For LE, just connecting isn't a proof that the pairing finished */
1960 if (cp->addr.type == BDADDR_BREDR)
1961 conn->connect_cfm_cb = pairing_complete_cb;
1962 else
1963 conn->connect_cfm_cb = le_connect_complete_cb;
1964
1965 conn->security_cfm_cb = pairing_complete_cb;
1966 conn->disconn_cfm_cb = pairing_complete_cb;
1967 conn->io_capability = cp->io_cap;
1968 cmd->user_data = conn;
1969
1970 if (conn->state == BT_CONNECTED &&
1971 hci_conn_security(conn, sec_level, auth_type))
1972 pairing_complete(cmd, 0);
1973
1974 err = 0;
1975
1976 unlock:
1977 hci_dev_unlock(hdev);
1978 return err;
1979 }
1980
1981 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1982 u16 len)
1983 {
1984 struct mgmt_addr_info *addr = data;
1985 struct pending_cmd *cmd;
1986 struct hci_conn *conn;
1987 int err;
1988
1989 BT_DBG("");
1990
1991 hci_dev_lock(hdev);
1992
1993 if (!hdev_is_powered(hdev)) {
1994 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1995 MGMT_STATUS_NOT_POWERED);
1996 goto unlock;
1997 }
1998
1999 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
2000 if (!cmd) {
2001 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2002 MGMT_STATUS_INVALID_PARAMS);
2003 goto unlock;
2004 }
2005
2006 conn = cmd->user_data;
2007
2008 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
2009 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
2010 MGMT_STATUS_INVALID_PARAMS);
2011 goto unlock;
2012 }
2013
2014 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
2015
2016 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
2017 addr, sizeof(*addr));
2018 unlock:
2019 hci_dev_unlock(hdev);
2020 return err;
2021 }
2022
2023 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
2024 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
2025 u16 hci_op, __le32 passkey)
2026 {
2027 struct pending_cmd *cmd;
2028 struct hci_conn *conn;
2029 int err;
2030
2031 hci_dev_lock(hdev);
2032
2033 if (!hdev_is_powered(hdev)) {
2034 err = cmd_status(sk, hdev->id, mgmt_op,
2035 MGMT_STATUS_NOT_POWERED);
2036 goto done;
2037 }
2038
2039 if (type == BDADDR_BREDR)
2040 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2041 else
2042 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2043
2044 if (!conn) {
2045 err = cmd_status(sk, hdev->id, mgmt_op,
2046 MGMT_STATUS_NOT_CONNECTED);
2047 goto done;
2048 }
2049
2050 if (type == BDADDR_LE_PUBLIC || type == BDADDR_LE_RANDOM) {
2051 /* Continue with pairing via SMP */
2052 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2053
2054 if (!err)
2055 err = cmd_status(sk, hdev->id, mgmt_op,
2056 MGMT_STATUS_SUCCESS);
2057 else
2058 err = cmd_status(sk, hdev->id, mgmt_op,
2059 MGMT_STATUS_FAILED);
2060
2061 goto done;
2062 }
2063
2064 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2065 if (!cmd) {
2066 err = -ENOMEM;
2067 goto done;
2068 }
2069
2070 /* Continue with pairing via HCI */
2071 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2072 struct hci_cp_user_passkey_reply cp;
2073
2074 bacpy(&cp.bdaddr, bdaddr);
2075 cp.passkey = passkey;
2076 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2077 } else
2078 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2079
2080 if (err < 0)
2081 mgmt_pending_remove(cmd);
2082
2083 done:
2084 hci_dev_unlock(hdev);
2085 return err;
2086 }
2087
2088 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2089 void *data, u16 len)
2090 {
2091 struct mgmt_cp_pin_code_neg_reply *cp = data;
2092
2093 BT_DBG("");
2094
2095 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2096 MGMT_OP_PIN_CODE_NEG_REPLY,
2097 HCI_OP_PIN_CODE_NEG_REPLY, 0);
2098 }
2099
2100 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2101 u16 len)
2102 {
2103 struct mgmt_cp_user_confirm_reply *cp = data;
2104
2105 BT_DBG("");
2106
2107 if (len != sizeof(*cp))
2108 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2109 MGMT_STATUS_INVALID_PARAMS);
2110
2111 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2112 MGMT_OP_USER_CONFIRM_REPLY,
2113 HCI_OP_USER_CONFIRM_REPLY, 0);
2114 }
2115
2116 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2117 void *data, u16 len)
2118 {
2119 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2120
2121 BT_DBG("");
2122
2123 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2124 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2125 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2126 }
2127
2128 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2129 u16 len)
2130 {
2131 struct mgmt_cp_user_passkey_reply *cp = data;
2132
2133 BT_DBG("");
2134
2135 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2136 MGMT_OP_USER_PASSKEY_REPLY,
2137 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2138 }
2139
2140 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2141 void *data, u16 len)
2142 {
2143 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2144
2145 BT_DBG("");
2146
2147 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2148 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2149 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2150 }
2151
2152 static int update_name(struct hci_dev *hdev, const char *name)
2153 {
2154 struct hci_cp_write_local_name cp;
2155
2156 memcpy(cp.name, name, sizeof(cp.name));
2157
2158 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2159 }
2160
2161 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2162 u16 len)
2163 {
2164 struct mgmt_cp_set_local_name *cp = data;
2165 struct pending_cmd *cmd;
2166 int err;
2167
2168 BT_DBG("");
2169
2170 hci_dev_lock(hdev);
2171
2172 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2173
2174 if (!hdev_is_powered(hdev)) {
2175 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2176
2177 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2178 data, len);
2179 if (err < 0)
2180 goto failed;
2181
2182 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2183 sk);
2184
2185 goto failed;
2186 }
2187
2188 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2189 if (!cmd) {
2190 err = -ENOMEM;
2191 goto failed;
2192 }
2193
2194 err = update_name(hdev, cp->name);
2195 if (err < 0)
2196 mgmt_pending_remove(cmd);
2197
2198 failed:
2199 hci_dev_unlock(hdev);
2200 return err;
2201 }
2202
2203 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2204 void *data, u16 data_len)
2205 {
2206 struct pending_cmd *cmd;
2207 int err;
2208
2209 BT_DBG("%s", hdev->name);
2210
2211 hci_dev_lock(hdev);
2212
2213 if (!hdev_is_powered(hdev)) {
2214 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2215 MGMT_STATUS_NOT_POWERED);
2216 goto unlock;
2217 }
2218
2219 if (!lmp_ssp_capable(hdev)) {
2220 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2221 MGMT_STATUS_NOT_SUPPORTED);
2222 goto unlock;
2223 }
2224
2225 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2226 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2227 MGMT_STATUS_BUSY);
2228 goto unlock;
2229 }
2230
2231 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2232 if (!cmd) {
2233 err = -ENOMEM;
2234 goto unlock;
2235 }
2236
2237 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2238 if (err < 0)
2239 mgmt_pending_remove(cmd);
2240
2241 unlock:
2242 hci_dev_unlock(hdev);
2243 return err;
2244 }
2245
2246 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2247 void *data, u16 len)
2248 {
2249 struct mgmt_cp_add_remote_oob_data *cp = data;
2250 u8 status;
2251 int err;
2252
2253 BT_DBG("%s ", hdev->name);
2254
2255 hci_dev_lock(hdev);
2256
2257 if (!hdev_is_powered(hdev)) {
2258 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2259 MGMT_STATUS_NOT_POWERED, &cp->addr,
2260 sizeof(cp->addr));
2261 goto unlock;
2262 }
2263
2264 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2265 cp->randomizer);
2266 if (err < 0)
2267 status = MGMT_STATUS_FAILED;
2268 else
2269 status = 0;
2270
2271 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2272 &cp->addr, sizeof(cp->addr));
2273
2274 unlock:
2275 hci_dev_unlock(hdev);
2276 return err;
2277 }
2278
2279 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2280 void *data, u16 len)
2281 {
2282 struct mgmt_cp_remove_remote_oob_data *cp = data;
2283 u8 status;
2284 int err;
2285
2286 BT_DBG("%s", hdev->name);
2287
2288 hci_dev_lock(hdev);
2289
2290 if (!hdev_is_powered(hdev)) {
2291 err = cmd_complete(sk, hdev->id,
2292 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2293 MGMT_STATUS_NOT_POWERED, &cp->addr,
2294 sizeof(cp->addr));
2295 goto unlock;
2296 }
2297
2298 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2299 if (err < 0)
2300 status = MGMT_STATUS_INVALID_PARAMS;
2301 else
2302 status = 0;
2303
2304 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2305 status, &cp->addr, sizeof(cp->addr));
2306
2307 unlock:
2308 hci_dev_unlock(hdev);
2309 return err;
2310 }
2311
2312 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2313 {
2314 int err;
2315
2316 BT_DBG("%s", hdev->name);
2317
2318 hci_dev_lock(hdev);
2319
2320 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2321 if (err < 0)
2322 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2323
2324 hci_dev_unlock(hdev);
2325
2326 return err;
2327 }
2328
2329 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2330 void *data, u16 len)
2331 {
2332 struct mgmt_cp_start_discovery *cp = data;
2333 struct pending_cmd *cmd;
2334 int err;
2335
2336 BT_DBG("%s", hdev->name);
2337
2338 hci_dev_lock(hdev);
2339
2340 if (!hdev_is_powered(hdev)) {
2341 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2342 MGMT_STATUS_NOT_POWERED);
2343 goto failed;
2344 }
2345
2346 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
2347 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2348 MGMT_STATUS_BUSY);
2349 goto failed;
2350 }
2351
2352 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2353 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2354 MGMT_STATUS_BUSY);
2355 goto failed;
2356 }
2357
2358 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2359 if (!cmd) {
2360 err = -ENOMEM;
2361 goto failed;
2362 }
2363
2364 hdev->discovery.type = cp->type;
2365
2366 switch (hdev->discovery.type) {
2367 case DISCOV_TYPE_BREDR:
2368 if (lmp_bredr_capable(hdev))
2369 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2370 else
2371 err = -ENOTSUPP;
2372 break;
2373
2374 case DISCOV_TYPE_LE:
2375 if (lmp_host_le_capable(hdev))
2376 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2377 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2378 else
2379 err = -ENOTSUPP;
2380 break;
2381
2382 case DISCOV_TYPE_INTERLEAVED:
2383 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2384 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2385 LE_SCAN_WIN,
2386 LE_SCAN_TIMEOUT_BREDR_LE);
2387 else
2388 err = -ENOTSUPP;
2389 break;
2390
2391 default:
2392 err = -EINVAL;
2393 }
2394
2395 if (err < 0)
2396 mgmt_pending_remove(cmd);
2397 else
2398 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2399
2400 failed:
2401 hci_dev_unlock(hdev);
2402 return err;
2403 }
2404
2405 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2406 u16 len)
2407 {
2408 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2409 struct pending_cmd *cmd;
2410 struct hci_cp_remote_name_req_cancel cp;
2411 struct inquiry_entry *e;
2412 int err;
2413
2414 BT_DBG("%s", hdev->name);
2415
2416 hci_dev_lock(hdev);
2417
2418 if (!hci_discovery_active(hdev)) {
2419 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2420 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2421 sizeof(mgmt_cp->type));
2422 goto unlock;
2423 }
2424
2425 if (hdev->discovery.type != mgmt_cp->type) {
2426 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2427 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2428 sizeof(mgmt_cp->type));
2429 goto unlock;
2430 }
2431
2432 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2433 if (!cmd) {
2434 err = -ENOMEM;
2435 goto unlock;
2436 }
2437
2438 switch (hdev->discovery.state) {
2439 case DISCOVERY_FINDING:
2440 if (test_bit(HCI_INQUIRY, &hdev->flags))
2441 err = hci_cancel_inquiry(hdev);
2442 else
2443 err = hci_cancel_le_scan(hdev);
2444
2445 break;
2446
2447 case DISCOVERY_RESOLVING:
2448 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2449 NAME_PENDING);
2450 if (!e) {
2451 mgmt_pending_remove(cmd);
2452 err = cmd_complete(sk, hdev->id,
2453 MGMT_OP_STOP_DISCOVERY, 0,
2454 &mgmt_cp->type,
2455 sizeof(mgmt_cp->type));
2456 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2457 goto unlock;
2458 }
2459
2460 bacpy(&cp.bdaddr, &e->data.bdaddr);
2461 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
2462 sizeof(cp), &cp);
2463
2464 break;
2465
2466 default:
2467 BT_DBG("unknown discovery state %u", hdev->discovery.state);
2468 err = -EFAULT;
2469 }
2470
2471 if (err < 0)
2472 mgmt_pending_remove(cmd);
2473 else
2474 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2475
2476 unlock:
2477 hci_dev_unlock(hdev);
2478 return err;
2479 }
2480
2481 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2482 u16 len)
2483 {
2484 struct mgmt_cp_confirm_name *cp = data;
2485 struct inquiry_entry *e;
2486 int err;
2487
2488 BT_DBG("%s", hdev->name);
2489
2490 hci_dev_lock(hdev);
2491
2492 if (!hci_discovery_active(hdev)) {
2493 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2494 MGMT_STATUS_FAILED);
2495 goto failed;
2496 }
2497
2498 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2499 if (!e) {
2500 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2501 MGMT_STATUS_INVALID_PARAMS);
2502 goto failed;
2503 }
2504
2505 if (cp->name_known) {
2506 e->name_state = NAME_KNOWN;
2507 list_del(&e->list);
2508 } else {
2509 e->name_state = NAME_NEEDED;
2510 hci_inquiry_cache_update_resolve(hdev, e);
2511 }
2512
2513 err = 0;
2514
2515 failed:
2516 hci_dev_unlock(hdev);
2517 return err;
2518 }
2519
2520 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2521 u16 len)
2522 {
2523 struct mgmt_cp_block_device *cp = data;
2524 u8 status;
2525 int err;
2526
2527 BT_DBG("%s", hdev->name);
2528
2529 hci_dev_lock(hdev);
2530
2531 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2532 if (err < 0)
2533 status = MGMT_STATUS_FAILED;
2534 else
2535 status = 0;
2536
2537 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2538 &cp->addr, sizeof(cp->addr));
2539
2540 hci_dev_unlock(hdev);
2541
2542 return err;
2543 }
2544
2545 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2546 u16 len)
2547 {
2548 struct mgmt_cp_unblock_device *cp = data;
2549 u8 status;
2550 int err;
2551
2552 BT_DBG("%s", hdev->name);
2553
2554 hci_dev_lock(hdev);
2555
2556 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2557 if (err < 0)
2558 status = MGMT_STATUS_INVALID_PARAMS;
2559 else
2560 status = 0;
2561
2562 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2563 &cp->addr, sizeof(cp->addr));
2564
2565 hci_dev_unlock(hdev);
2566
2567 return err;
2568 }
2569
2570 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
2571 u16 len)
2572 {
2573 struct mgmt_cp_set_device_id *cp = data;
2574 int err;
2575 __u16 source;
2576
2577 BT_DBG("%s", hdev->name);
2578
2579 source = __le16_to_cpu(cp->source);
2580
2581 if (source > 0x0002)
2582 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
2583 MGMT_STATUS_INVALID_PARAMS);
2584
2585 hci_dev_lock(hdev);
2586
2587 hdev->devid_source = source;
2588 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
2589 hdev->devid_product = __le16_to_cpu(cp->product);
2590 hdev->devid_version = __le16_to_cpu(cp->version);
2591
2592 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
2593
2594 update_eir(hdev);
2595
2596 hci_dev_unlock(hdev);
2597
2598 return err;
2599 }
2600
2601 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2602 void *data, u16 len)
2603 {
2604 struct mgmt_mode *cp = data;
2605 struct hci_cp_write_page_scan_activity acp;
2606 u8 type;
2607 int err;
2608
2609 BT_DBG("%s", hdev->name);
2610
2611 if (!lmp_bredr_capable(hdev))
2612 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2613 MGMT_STATUS_NOT_SUPPORTED);
2614
2615 if (!hdev_is_powered(hdev))
2616 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2617 MGMT_STATUS_NOT_POWERED);
2618
2619 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2620 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2621 MGMT_STATUS_REJECTED);
2622
2623 hci_dev_lock(hdev);
2624
2625 if (cp->val) {
2626 type = PAGE_SCAN_TYPE_INTERLACED;
2627
2628 /* 160 msec page scan interval */
2629 acp.interval = __constant_cpu_to_le16(0x0100);
2630 } else {
2631 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2632
2633 /* default 1.28 sec page scan */
2634 acp.interval = __constant_cpu_to_le16(0x0800);
2635 }
2636
2637 /* default 11.25 msec page scan window */
2638 acp.window = __constant_cpu_to_le16(0x0012);
2639
2640 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2641 &acp);
2642 if (err < 0) {
2643 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2644 MGMT_STATUS_FAILED);
2645 goto done;
2646 }
2647
2648 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2649 if (err < 0) {
2650 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2651 MGMT_STATUS_FAILED);
2652 goto done;
2653 }
2654
2655 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2656 NULL, 0);
2657 done:
2658 hci_dev_unlock(hdev);
2659 return err;
2660 }
2661
2662 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2663 void *cp_data, u16 len)
2664 {
2665 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2666 u16 key_count, expected_len;
2667 int i;
2668
2669 key_count = __le16_to_cpu(cp->key_count);
2670
2671 expected_len = sizeof(*cp) + key_count *
2672 sizeof(struct mgmt_ltk_info);
2673 if (expected_len != len) {
2674 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2675 len, expected_len);
2676 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2677 EINVAL);
2678 }
2679
2680 BT_DBG("%s key_count %u", hdev->name, key_count);
2681
2682 hci_dev_lock(hdev);
2683
2684 hci_smp_ltks_clear(hdev);
2685
2686 for (i = 0; i < key_count; i++) {
2687 struct mgmt_ltk_info *key = &cp->keys[i];
2688 u8 type;
2689
2690 if (key->master)
2691 type = HCI_SMP_LTK;
2692 else
2693 type = HCI_SMP_LTK_SLAVE;
2694
2695 hci_add_ltk(hdev, &key->addr.bdaddr,
2696 bdaddr_to_le(key->addr.type),
2697 type, 0, key->authenticated, key->val,
2698 key->enc_size, key->ediv, key->rand);
2699 }
2700
2701 hci_dev_unlock(hdev);
2702
2703 return 0;
2704 }
2705
2706 static const struct mgmt_handler {
2707 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2708 u16 data_len);
2709 bool var_len;
2710 size_t data_len;
2711 } mgmt_handlers[] = {
2712 { NULL }, /* 0x0000 (no command) */
2713 { read_version, false, MGMT_READ_VERSION_SIZE },
2714 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2715 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2716 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2717 { set_powered, false, MGMT_SETTING_SIZE },
2718 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2719 { set_connectable, false, MGMT_SETTING_SIZE },
2720 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2721 { set_pairable, false, MGMT_SETTING_SIZE },
2722 { set_link_security, false, MGMT_SETTING_SIZE },
2723 { set_ssp, false, MGMT_SETTING_SIZE },
2724 { set_hs, false, MGMT_SETTING_SIZE },
2725 { set_le, false, MGMT_SETTING_SIZE },
2726 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2727 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2728 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2729 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2730 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2731 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2732 { disconnect, false, MGMT_DISCONNECT_SIZE },
2733 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2734 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2735 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2736 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2737 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2738 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2739 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2740 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2741 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2742 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2743 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2744 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2745 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2746 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2747 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2748 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2749 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2750 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2751 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2752 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
2753 };
2754
2755
2756 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2757 {
2758 void *buf;
2759 u8 *cp;
2760 struct mgmt_hdr *hdr;
2761 u16 opcode, index, len;
2762 struct hci_dev *hdev = NULL;
2763 const struct mgmt_handler *handler;
2764 int err;
2765
2766 BT_DBG("got %zu bytes", msglen);
2767
2768 if (msglen < sizeof(*hdr))
2769 return -EINVAL;
2770
2771 buf = kmalloc(msglen, GFP_KERNEL);
2772 if (!buf)
2773 return -ENOMEM;
2774
2775 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2776 err = -EFAULT;
2777 goto done;
2778 }
2779
2780 hdr = buf;
2781 opcode = __le16_to_cpu(hdr->opcode);
2782 index = __le16_to_cpu(hdr->index);
2783 len = __le16_to_cpu(hdr->len);
2784
2785 if (len != msglen - sizeof(*hdr)) {
2786 err = -EINVAL;
2787 goto done;
2788 }
2789
2790 if (index != MGMT_INDEX_NONE) {
2791 hdev = hci_dev_get(index);
2792 if (!hdev) {
2793 err = cmd_status(sk, index, opcode,
2794 MGMT_STATUS_INVALID_INDEX);
2795 goto done;
2796 }
2797 }
2798
2799 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2800 mgmt_handlers[opcode].func == NULL) {
2801 BT_DBG("Unknown op %u", opcode);
2802 err = cmd_status(sk, index, opcode,
2803 MGMT_STATUS_UNKNOWN_COMMAND);
2804 goto done;
2805 }
2806
2807 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2808 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2809 err = cmd_status(sk, index, opcode,
2810 MGMT_STATUS_INVALID_INDEX);
2811 goto done;
2812 }
2813
2814 handler = &mgmt_handlers[opcode];
2815
2816 if ((handler->var_len && len < handler->data_len) ||
2817 (!handler->var_len && len != handler->data_len)) {
2818 err = cmd_status(sk, index, opcode,
2819 MGMT_STATUS_INVALID_PARAMS);
2820 goto done;
2821 }
2822
2823 if (hdev)
2824 mgmt_init_hdev(sk, hdev);
2825
2826 cp = buf + sizeof(*hdr);
2827
2828 err = handler->func(sk, hdev, cp, len);
2829 if (err < 0)
2830 goto done;
2831
2832 err = msglen;
2833
2834 done:
2835 if (hdev)
2836 hci_dev_put(hdev);
2837
2838 kfree(buf);
2839 return err;
2840 }
2841
2842 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2843 {
2844 u8 *status = data;
2845
2846 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2847 mgmt_pending_remove(cmd);
2848 }
2849
2850 int mgmt_index_added(struct hci_dev *hdev)
2851 {
2852 if (!mgmt_valid_hdev(hdev))
2853 return -ENOTSUPP;
2854
2855 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2856 }
2857
2858 int mgmt_index_removed(struct hci_dev *hdev)
2859 {
2860 u8 status = MGMT_STATUS_INVALID_INDEX;
2861
2862 if (!mgmt_valid_hdev(hdev))
2863 return -ENOTSUPP;
2864
2865 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2866
2867 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2868 }
2869
2870 struct cmd_lookup {
2871 struct sock *sk;
2872 struct hci_dev *hdev;
2873 u8 mgmt_status;
2874 };
2875
2876 static void settings_rsp(struct pending_cmd *cmd, void *data)
2877 {
2878 struct cmd_lookup *match = data;
2879
2880 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2881
2882 list_del(&cmd->list);
2883
2884 if (match->sk == NULL) {
2885 match->sk = cmd->sk;
2886 sock_hold(match->sk);
2887 }
2888
2889 mgmt_pending_free(cmd);
2890 }
2891
2892 static int set_bredr_scan(struct hci_dev *hdev)
2893 {
2894 u8 scan = 0;
2895
2896 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2897 scan |= SCAN_PAGE;
2898 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2899 scan |= SCAN_INQUIRY;
2900
2901 if (!scan)
2902 return 0;
2903
2904 return hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2905 }
2906
2907 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2908 {
2909 struct cmd_lookup match = { NULL, hdev };
2910 int err;
2911
2912 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2913 return 0;
2914
2915 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2916
2917 if (powered) {
2918 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
2919 !lmp_host_ssp_capable(hdev)) {
2920 u8 ssp = 1;
2921
2922 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
2923 }
2924
2925 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2926 struct hci_cp_write_le_host_supported cp;
2927
2928 cp.le = 1;
2929 cp.simul = lmp_le_br_capable(hdev);
2930
2931 /* Check first if we already have the right
2932 * host state (host features set)
2933 */
2934 if (cp.le != lmp_host_le_capable(hdev) ||
2935 cp.simul != lmp_host_le_br_capable(hdev))
2936 hci_send_cmd(hdev,
2937 HCI_OP_WRITE_LE_HOST_SUPPORTED,
2938 sizeof(cp), &cp);
2939 }
2940
2941 if (lmp_bredr_capable(hdev)) {
2942 set_bredr_scan(hdev);
2943 update_class(hdev);
2944 update_name(hdev, hdev->dev_name);
2945 update_eir(hdev);
2946 }
2947 } else {
2948 u8 status = MGMT_STATUS_NOT_POWERED;
2949 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2950 }
2951
2952 err = new_settings(hdev, match.sk);
2953
2954 if (match.sk)
2955 sock_put(match.sk);
2956
2957 return err;
2958 }
2959
2960 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2961 {
2962 struct cmd_lookup match = { NULL, hdev };
2963 bool changed = false;
2964 int err = 0;
2965
2966 if (discoverable) {
2967 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2968 changed = true;
2969 } else {
2970 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2971 changed = true;
2972 }
2973
2974 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2975 &match);
2976
2977 if (changed)
2978 err = new_settings(hdev, match.sk);
2979
2980 if (match.sk)
2981 sock_put(match.sk);
2982
2983 return err;
2984 }
2985
2986 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2987 {
2988 struct cmd_lookup match = { NULL, hdev };
2989 bool changed = false;
2990 int err = 0;
2991
2992 if (connectable) {
2993 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2994 changed = true;
2995 } else {
2996 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2997 changed = true;
2998 }
2999
3000 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
3001 &match);
3002
3003 if (changed)
3004 err = new_settings(hdev, match.sk);
3005
3006 if (match.sk)
3007 sock_put(match.sk);
3008
3009 return err;
3010 }
3011
3012 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
3013 {
3014 u8 mgmt_err = mgmt_status(status);
3015
3016 if (scan & SCAN_PAGE)
3017 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
3018 cmd_status_rsp, &mgmt_err);
3019
3020 if (scan & SCAN_INQUIRY)
3021 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
3022 cmd_status_rsp, &mgmt_err);
3023
3024 return 0;
3025 }
3026
3027 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
3028 bool persistent)
3029 {
3030 struct mgmt_ev_new_link_key ev;
3031
3032 memset(&ev, 0, sizeof(ev));
3033
3034 ev.store_hint = persistent;
3035 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3036 ev.key.addr.type = BDADDR_BREDR;
3037 ev.key.type = key->type;
3038 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
3039 ev.key.pin_len = key->pin_len;
3040
3041 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
3042 }
3043
3044 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
3045 {
3046 struct mgmt_ev_new_long_term_key ev;
3047
3048 memset(&ev, 0, sizeof(ev));
3049
3050 ev.store_hint = persistent;
3051 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
3052 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
3053 ev.key.authenticated = key->authenticated;
3054 ev.key.enc_size = key->enc_size;
3055 ev.key.ediv = key->ediv;
3056
3057 if (key->type == HCI_SMP_LTK)
3058 ev.key.master = 1;
3059
3060 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
3061 memcpy(ev.key.val, key->val, sizeof(key->val));
3062
3063 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
3064 NULL);
3065 }
3066
3067 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3068 u8 addr_type, u32 flags, u8 *name, u8 name_len,
3069 u8 *dev_class)
3070 {
3071 char buf[512];
3072 struct mgmt_ev_device_connected *ev = (void *) buf;
3073 u16 eir_len = 0;
3074
3075 bacpy(&ev->addr.bdaddr, bdaddr);
3076 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3077
3078 ev->flags = __cpu_to_le32(flags);
3079
3080 if (name_len > 0)
3081 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
3082 name, name_len);
3083
3084 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
3085 eir_len = eir_append_data(ev->eir, eir_len,
3086 EIR_CLASS_OF_DEV, dev_class, 3);
3087
3088 ev->eir_len = cpu_to_le16(eir_len);
3089
3090 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
3091 sizeof(*ev) + eir_len, NULL);
3092 }
3093
3094 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
3095 {
3096 struct mgmt_cp_disconnect *cp = cmd->param;
3097 struct sock **sk = data;
3098 struct mgmt_rp_disconnect rp;
3099
3100 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3101 rp.addr.type = cp->addr.type;
3102
3103 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
3104 sizeof(rp));
3105
3106 *sk = cmd->sk;
3107 sock_hold(*sk);
3108
3109 mgmt_pending_remove(cmd);
3110 }
3111
3112 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
3113 {
3114 struct hci_dev *hdev = data;
3115 struct mgmt_cp_unpair_device *cp = cmd->param;
3116 struct mgmt_rp_unpair_device rp;
3117
3118 memset(&rp, 0, sizeof(rp));
3119 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3120 rp.addr.type = cp->addr.type;
3121
3122 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
3123
3124 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
3125
3126 mgmt_pending_remove(cmd);
3127 }
3128
3129 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
3130 u8 link_type, u8 addr_type, u8 reason)
3131 {
3132 struct mgmt_ev_device_disconnected ev;
3133 struct sock *sk = NULL;
3134 int err;
3135
3136 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3137
3138 bacpy(&ev.addr.bdaddr, bdaddr);
3139 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3140 ev.reason = reason;
3141
3142 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3143 sk);
3144
3145 if (sk)
3146 sock_put(sk);
3147
3148 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3149 hdev);
3150
3151 return err;
3152 }
3153
3154 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3155 u8 link_type, u8 addr_type, u8 status)
3156 {
3157 struct mgmt_rp_disconnect rp;
3158 struct pending_cmd *cmd;
3159 int err;
3160
3161 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3162 hdev);
3163
3164 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3165 if (!cmd)
3166 return -ENOENT;
3167
3168 bacpy(&rp.addr.bdaddr, bdaddr);
3169 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3170
3171 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3172 mgmt_status(status), &rp, sizeof(rp));
3173
3174 mgmt_pending_remove(cmd);
3175
3176 return err;
3177 }
3178
3179 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3180 u8 addr_type, u8 status)
3181 {
3182 struct mgmt_ev_connect_failed ev;
3183
3184 bacpy(&ev.addr.bdaddr, bdaddr);
3185 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3186 ev.status = mgmt_status(status);
3187
3188 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3189 }
3190
3191 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3192 {
3193 struct mgmt_ev_pin_code_request ev;
3194
3195 bacpy(&ev.addr.bdaddr, bdaddr);
3196 ev.addr.type = BDADDR_BREDR;
3197 ev.secure = secure;
3198
3199 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3200 NULL);
3201 }
3202
3203 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3204 u8 status)
3205 {
3206 struct pending_cmd *cmd;
3207 struct mgmt_rp_pin_code_reply rp;
3208 int err;
3209
3210 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3211 if (!cmd)
3212 return -ENOENT;
3213
3214 bacpy(&rp.addr.bdaddr, bdaddr);
3215 rp.addr.type = BDADDR_BREDR;
3216
3217 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3218 mgmt_status(status), &rp, sizeof(rp));
3219
3220 mgmt_pending_remove(cmd);
3221
3222 return err;
3223 }
3224
3225 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3226 u8 status)
3227 {
3228 struct pending_cmd *cmd;
3229 struct mgmt_rp_pin_code_reply rp;
3230 int err;
3231
3232 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3233 if (!cmd)
3234 return -ENOENT;
3235
3236 bacpy(&rp.addr.bdaddr, bdaddr);
3237 rp.addr.type = BDADDR_BREDR;
3238
3239 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3240 mgmt_status(status), &rp, sizeof(rp));
3241
3242 mgmt_pending_remove(cmd);
3243
3244 return err;
3245 }
3246
3247 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3248 u8 link_type, u8 addr_type, __le32 value,
3249 u8 confirm_hint)
3250 {
3251 struct mgmt_ev_user_confirm_request ev;
3252
3253 BT_DBG("%s", hdev->name);
3254
3255 bacpy(&ev.addr.bdaddr, bdaddr);
3256 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3257 ev.confirm_hint = confirm_hint;
3258 ev.value = value;
3259
3260 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3261 NULL);
3262 }
3263
3264 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3265 u8 link_type, u8 addr_type)
3266 {
3267 struct mgmt_ev_user_passkey_request ev;
3268
3269 BT_DBG("%s", hdev->name);
3270
3271 bacpy(&ev.addr.bdaddr, bdaddr);
3272 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3273
3274 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3275 NULL);
3276 }
3277
3278 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3279 u8 link_type, u8 addr_type, u8 status,
3280 u8 opcode)
3281 {
3282 struct pending_cmd *cmd;
3283 struct mgmt_rp_user_confirm_reply rp;
3284 int err;
3285
3286 cmd = mgmt_pending_find(opcode, hdev);
3287 if (!cmd)
3288 return -ENOENT;
3289
3290 bacpy(&rp.addr.bdaddr, bdaddr);
3291 rp.addr.type = link_to_bdaddr(link_type, addr_type);
3292 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3293 &rp, sizeof(rp));
3294
3295 mgmt_pending_remove(cmd);
3296
3297 return err;
3298 }
3299
3300 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3301 u8 link_type, u8 addr_type, u8 status)
3302 {
3303 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3304 status, MGMT_OP_USER_CONFIRM_REPLY);
3305 }
3306
3307 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3308 u8 link_type, u8 addr_type, u8 status)
3309 {
3310 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3311 status,
3312 MGMT_OP_USER_CONFIRM_NEG_REPLY);
3313 }
3314
3315 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3316 u8 link_type, u8 addr_type, u8 status)
3317 {
3318 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3319 status, MGMT_OP_USER_PASSKEY_REPLY);
3320 }
3321
3322 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3323 u8 link_type, u8 addr_type, u8 status)
3324 {
3325 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3326 status,
3327 MGMT_OP_USER_PASSKEY_NEG_REPLY);
3328 }
3329
3330 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
3331 u8 link_type, u8 addr_type, u32 passkey,
3332 u8 entered)
3333 {
3334 struct mgmt_ev_passkey_notify ev;
3335
3336 BT_DBG("%s", hdev->name);
3337
3338 bacpy(&ev.addr.bdaddr, bdaddr);
3339 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3340 ev.passkey = __cpu_to_le32(passkey);
3341 ev.entered = entered;
3342
3343 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
3344 }
3345
3346 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3347 u8 addr_type, u8 status)
3348 {
3349 struct mgmt_ev_auth_failed ev;
3350
3351 bacpy(&ev.addr.bdaddr, bdaddr);
3352 ev.addr.type = link_to_bdaddr(link_type, addr_type);
3353 ev.status = mgmt_status(status);
3354
3355 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3356 }
3357
3358 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3359 {
3360 struct cmd_lookup match = { NULL, hdev };
3361 bool changed = false;
3362 int err = 0;
3363
3364 if (status) {
3365 u8 mgmt_err = mgmt_status(status);
3366 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3367 cmd_status_rsp, &mgmt_err);
3368 return 0;
3369 }
3370
3371 if (test_bit(HCI_AUTH, &hdev->flags)) {
3372 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3373 changed = true;
3374 } else {
3375 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3376 changed = true;
3377 }
3378
3379 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3380 &match);
3381
3382 if (changed)
3383 err = new_settings(hdev, match.sk);
3384
3385 if (match.sk)
3386 sock_put(match.sk);
3387
3388 return err;
3389 }
3390
3391 static int clear_eir(struct hci_dev *hdev)
3392 {
3393 struct hci_cp_write_eir cp;
3394
3395 if (!lmp_ext_inq_capable(hdev))
3396 return 0;
3397
3398 memset(hdev->eir, 0, sizeof(hdev->eir));
3399
3400 memset(&cp, 0, sizeof(cp));
3401
3402 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3403 }
3404
3405 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3406 {
3407 struct cmd_lookup match = { NULL, hdev };
3408 bool changed = false;
3409 int err = 0;
3410
3411 if (status) {
3412 u8 mgmt_err = mgmt_status(status);
3413
3414 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3415 &hdev->dev_flags))
3416 err = new_settings(hdev, NULL);
3417
3418 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3419 &mgmt_err);
3420
3421 return err;
3422 }
3423
3424 if (enable) {
3425 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3426 changed = true;
3427 } else {
3428 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3429 changed = true;
3430 }
3431
3432 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3433
3434 if (changed)
3435 err = new_settings(hdev, match.sk);
3436
3437 if (match.sk)
3438 sock_put(match.sk);
3439
3440 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3441 update_eir(hdev);
3442 else
3443 clear_eir(hdev);
3444
3445 return err;
3446 }
3447
3448 static void class_rsp(struct pending_cmd *cmd, void *data)
3449 {
3450 struct cmd_lookup *match = data;
3451
3452 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3453 match->hdev->dev_class, 3);
3454
3455 list_del(&cmd->list);
3456
3457 if (match->sk == NULL) {
3458 match->sk = cmd->sk;
3459 sock_hold(match->sk);
3460 }
3461
3462 mgmt_pending_free(cmd);
3463 }
3464
3465 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3466 u8 status)
3467 {
3468 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3469 int err = 0;
3470
3471 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3472
3473 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3474 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3475 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3476
3477 if (!status)
3478 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3479 3, NULL);
3480
3481 if (match.sk)
3482 sock_put(match.sk);
3483
3484 return err;
3485 }
3486
3487 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3488 {
3489 struct pending_cmd *cmd;
3490 struct mgmt_cp_set_local_name ev;
3491 bool changed = false;
3492 int err = 0;
3493
3494 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3495 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3496 changed = true;
3497 }
3498
3499 memset(&ev, 0, sizeof(ev));
3500 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3501 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3502
3503 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3504 if (!cmd)
3505 goto send_event;
3506
3507 /* Always assume that either the short or the complete name has
3508 * changed if there was a pending mgmt command */
3509 changed = true;
3510
3511 if (status) {
3512 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3513 mgmt_status(status));
3514 goto failed;
3515 }
3516
3517 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3518 sizeof(ev));
3519 if (err < 0)
3520 goto failed;
3521
3522 send_event:
3523 if (changed)
3524 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3525 sizeof(ev), cmd ? cmd->sk : NULL);
3526
3527 /* EIR is taken care of separately when powering on the
3528 * adapter so only update them here if this is a name change
3529 * unrelated to power on.
3530 */
3531 if (!test_bit(HCI_INIT, &hdev->flags))
3532 update_eir(hdev);
3533
3534 failed:
3535 if (cmd)
3536 mgmt_pending_remove(cmd);
3537 return err;
3538 }
3539
3540 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3541 u8 *randomizer, u8 status)
3542 {
3543 struct pending_cmd *cmd;
3544 int err;
3545
3546 BT_DBG("%s status %u", hdev->name, status);
3547
3548 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3549 if (!cmd)
3550 return -ENOENT;
3551
3552 if (status) {
3553 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3554 mgmt_status(status));
3555 } else {
3556 struct mgmt_rp_read_local_oob_data rp;
3557
3558 memcpy(rp.hash, hash, sizeof(rp.hash));
3559 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3560
3561 err = cmd_complete(cmd->sk, hdev->id,
3562 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3563 sizeof(rp));
3564 }
3565
3566 mgmt_pending_remove(cmd);
3567
3568 return err;
3569 }
3570
3571 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3572 {
3573 struct cmd_lookup match = { NULL, hdev };
3574 bool changed = false;
3575 int err = 0;
3576
3577 if (status) {
3578 u8 mgmt_err = mgmt_status(status);
3579
3580 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3581 &hdev->dev_flags))
3582 err = new_settings(hdev, NULL);
3583
3584 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
3585 &mgmt_err);
3586
3587 return err;
3588 }
3589
3590 if (enable) {
3591 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3592 changed = true;
3593 } else {
3594 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3595 changed = true;
3596 }
3597
3598 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3599
3600 if (changed)
3601 err = new_settings(hdev, match.sk);
3602
3603 if (match.sk)
3604 sock_put(match.sk);
3605
3606 return err;
3607 }
3608
3609 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3610 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3611 ssp, u8 *eir, u16 eir_len)
3612 {
3613 char buf[512];
3614 struct mgmt_ev_device_found *ev = (void *) buf;
3615 size_t ev_size;
3616
3617 /* Leave 5 bytes for a potential CoD field */
3618 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3619 return -EINVAL;
3620
3621 memset(buf, 0, sizeof(buf));
3622
3623 bacpy(&ev->addr.bdaddr, bdaddr);
3624 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3625 ev->rssi = rssi;
3626 if (cfm_name)
3627 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME);
3628 if (!ssp)
3629 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING);
3630
3631 if (eir_len > 0)
3632 memcpy(ev->eir, eir, eir_len);
3633
3634 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3635 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3636 dev_class, 3);
3637
3638 ev->eir_len = cpu_to_le16(eir_len);
3639 ev_size = sizeof(*ev) + eir_len;
3640
3641 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3642 }
3643
3644 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3645 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3646 {
3647 struct mgmt_ev_device_found *ev;
3648 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3649 u16 eir_len;
3650
3651 ev = (struct mgmt_ev_device_found *) buf;
3652
3653 memset(buf, 0, sizeof(buf));
3654
3655 bacpy(&ev->addr.bdaddr, bdaddr);
3656 ev->addr.type = link_to_bdaddr(link_type, addr_type);
3657 ev->rssi = rssi;
3658
3659 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3660 name_len);
3661
3662 ev->eir_len = cpu_to_le16(eir_len);
3663
3664 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3665 sizeof(*ev) + eir_len, NULL);
3666 }
3667
3668 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3669 {
3670 struct pending_cmd *cmd;
3671 u8 type;
3672 int err;
3673
3674 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3675
3676 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3677 if (!cmd)
3678 return -ENOENT;
3679
3680 type = hdev->discovery.type;
3681
3682 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3683 &type, sizeof(type));
3684 mgmt_pending_remove(cmd);
3685
3686 return err;
3687 }
3688
3689 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3690 {
3691 struct pending_cmd *cmd;
3692 int err;
3693
3694 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3695 if (!cmd)
3696 return -ENOENT;
3697
3698 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3699 &hdev->discovery.type, sizeof(hdev->discovery.type));
3700 mgmt_pending_remove(cmd);
3701
3702 return err;
3703 }
3704
3705 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3706 {
3707 struct mgmt_ev_discovering ev;
3708 struct pending_cmd *cmd;
3709
3710 BT_DBG("%s discovering %u", hdev->name, discovering);
3711
3712 if (discovering)
3713 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3714 else
3715 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3716
3717 if (cmd != NULL) {
3718 u8 type = hdev->discovery.type;
3719
3720 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3721 sizeof(type));
3722 mgmt_pending_remove(cmd);
3723 }
3724
3725 memset(&ev, 0, sizeof(ev));
3726 ev.type = hdev->discovery.type;
3727 ev.discovering = discovering;
3728
3729 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3730 }
3731
3732 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3733 {
3734 struct pending_cmd *cmd;
3735 struct mgmt_ev_device_blocked ev;
3736
3737 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3738
3739 bacpy(&ev.addr.bdaddr, bdaddr);
3740 ev.addr.type = type;
3741
3742 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3743 cmd ? cmd->sk : NULL);
3744 }
3745
3746 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3747 {
3748 struct pending_cmd *cmd;
3749 struct mgmt_ev_device_unblocked ev;
3750
3751 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3752
3753 bacpy(&ev.addr.bdaddr, bdaddr);
3754 ev.addr.type = type;
3755
3756 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3757 cmd ? cmd->sk : NULL);
3758 }
3759
3760 module_param(enable_hs, bool, 0644);
3761 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
kernel source for telekom puls (alcatel/mediatek)