projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Bluetooth: Add TX power tag to EIR data
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / mgmt.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI Management interface */
26
27 #include <linux/kernel.h>
28 #include <linux/uaccess.h>
29 #include <linux/module.h>
30 #include <asm/unaligned.h>
31
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 #include <net/bluetooth/mgmt.h>
35 #include <net/bluetooth/smp.h>
36
37 bool enable_hs;
38 bool enable_le;
39
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 0
42
43 static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
50 MGMT_OP_SET_PAIRABLE,
51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
81 };
82
83 static const u16 mgmt_events[] = {
84 MGMT_EV_CONTROLLER_ERROR,
85 MGMT_EV_INDEX_ADDED,
86 MGMT_EV_INDEX_REMOVED,
87 MGMT_EV_NEW_SETTINGS,
88 MGMT_EV_CLASS_OF_DEV_CHANGED,
89 MGMT_EV_LOCAL_NAME_CHANGED,
90 MGMT_EV_NEW_LINK_KEY,
91 MGMT_EV_NEW_LONG_TERM_KEY,
92 MGMT_EV_DEVICE_CONNECTED,
93 MGMT_EV_DEVICE_DISCONNECTED,
94 MGMT_EV_CONNECT_FAILED,
95 MGMT_EV_PIN_CODE_REQUEST,
96 MGMT_EV_USER_CONFIRM_REQUEST,
97 MGMT_EV_USER_PASSKEY_REQUEST,
98 MGMT_EV_AUTH_FAILED,
99 MGMT_EV_DEVICE_FOUND,
100 MGMT_EV_DISCOVERING,
101 MGMT_EV_DEVICE_BLOCKED,
102 MGMT_EV_DEVICE_UNBLOCKED,
103 MGMT_EV_DEVICE_UNPAIRED,
104 };
105
106 /*
107 * These LE scan and inquiry parameters were chosen according to LE General
108 * Discovery Procedure specification.
109 */
110 #define LE_SCAN_TYPE 0x01
111 #define LE_SCAN_WIN 0x12
112 #define LE_SCAN_INT 0x12
113 #define LE_SCAN_TIMEOUT_LE_ONLY 10240 /* TGAP(gen_disc_scan_min) */
114 #define LE_SCAN_TIMEOUT_BREDR_LE 5120 /* TGAP(100)/2 */
115
116 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
117 #define INQUIRY_LEN_BREDR_LE 0x04 /* TGAP(100)/2 */
118
119 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
120
121 #define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \
122 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
123
124 struct pending_cmd {
125 struct list_head list;
126 u16 opcode;
127 int index;
128 void *param;
129 struct sock *sk;
130 void *user_data;
131 };
132
133 /* HCI to MGMT error code conversion table */
134 static u8 mgmt_status_table[] = {
135 MGMT_STATUS_SUCCESS,
136 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
137 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
138 MGMT_STATUS_FAILED, /* Hardware Failure */
139 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
140 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
141 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */
142 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
143 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
144 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
145 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
146 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
147 MGMT_STATUS_BUSY, /* Command Disallowed */
148 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
149 MGMT_STATUS_REJECTED, /* Rejected Security */
150 MGMT_STATUS_REJECTED, /* Rejected Personal */
151 MGMT_STATUS_TIMEOUT, /* Host Timeout */
152 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
153 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
154 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
155 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
156 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
157 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
158 MGMT_STATUS_BUSY, /* Repeated Attempts */
159 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
160 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
161 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
162 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
163 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
164 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
165 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
166 MGMT_STATUS_FAILED, /* Unspecified Error */
167 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
168 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
169 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
170 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
171 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
172 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
173 MGMT_STATUS_FAILED, /* Unit Link Key Used */
174 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
175 MGMT_STATUS_TIMEOUT, /* Instant Passed */
176 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
177 MGMT_STATUS_FAILED, /* Transaction Collision */
178 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
179 MGMT_STATUS_REJECTED, /* QoS Rejected */
180 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
181 MGMT_STATUS_REJECTED, /* Insufficient Security */
182 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
183 MGMT_STATUS_BUSY, /* Role Switch Pending */
184 MGMT_STATUS_FAILED, /* Slot Violation */
185 MGMT_STATUS_FAILED, /* Role Switch Failed */
186 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
187 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
188 MGMT_STATUS_BUSY, /* Host Busy Pairing */
189 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
190 MGMT_STATUS_BUSY, /* Controller Busy */
191 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
192 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
193 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
194 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
195 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
196 };
197
198 static u8 mgmt_status(u8 hci_status)
199 {
200 if (hci_status < ARRAY_SIZE(mgmt_status_table))
201 return mgmt_status_table[hci_status];
202
203 return MGMT_STATUS_FAILED;
204 }
205
206 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
207 {
208 struct sk_buff *skb;
209 struct mgmt_hdr *hdr;
210 struct mgmt_ev_cmd_status *ev;
211 int err;
212
213 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
214
215 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
216 if (!skb)
217 return -ENOMEM;
218
219 hdr = (void *) skb_put(skb, sizeof(*hdr));
220
221 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
222 hdr->index = cpu_to_le16(index);
223 hdr->len = cpu_to_le16(sizeof(*ev));
224
225 ev = (void *) skb_put(skb, sizeof(*ev));
226 ev->status = status;
227 put_unaligned_le16(cmd, &ev->opcode);
228
229 err = sock_queue_rcv_skb(sk, skb);
230 if (err < 0)
231 kfree_skb(skb);
232
233 return err;
234 }
235
236 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
237 void *rp, size_t rp_len)
238 {
239 struct sk_buff *skb;
240 struct mgmt_hdr *hdr;
241 struct mgmt_ev_cmd_complete *ev;
242 int err;
243
244 BT_DBG("sock %p", sk);
245
246 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
247 if (!skb)
248 return -ENOMEM;
249
250 hdr = (void *) skb_put(skb, sizeof(*hdr));
251
252 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
253 hdr->index = cpu_to_le16(index);
254 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
255
256 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
257 put_unaligned_le16(cmd, &ev->opcode);
258 ev->status = status;
259
260 if (rp)
261 memcpy(ev->data, rp, rp_len);
262
263 err = sock_queue_rcv_skb(sk, skb);
264 if (err < 0)
265 kfree_skb(skb);
266
267 return err;
268 }
269
270 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
271 u16 data_len)
272 {
273 struct mgmt_rp_read_version rp;
274
275 BT_DBG("sock %p", sk);
276
277 rp.version = MGMT_VERSION;
278 put_unaligned_le16(MGMT_REVISION, &rp.revision);
279
280 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
281 sizeof(rp));
282 }
283
284 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
285 u16 data_len)
286 {
287 struct mgmt_rp_read_commands *rp;
288 u16 num_commands = ARRAY_SIZE(mgmt_commands);
289 u16 num_events = ARRAY_SIZE(mgmt_events);
290 u16 *opcode;
291 size_t rp_size;
292 int i, err;
293
294 BT_DBG("sock %p", sk);
295
296 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
297
298 rp = kmalloc(rp_size, GFP_KERNEL);
299 if (!rp)
300 return -ENOMEM;
301
302 put_unaligned_le16(num_commands, &rp->num_commands);
303 put_unaligned_le16(num_events, &rp->num_events);
304
305 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
306 put_unaligned_le16(mgmt_commands[i], opcode);
307
308 for (i = 0; i < num_events; i++, opcode++)
309 put_unaligned_le16(mgmt_events[i], opcode);
310
311 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
312 rp_size);
313 kfree(rp);
314
315 return err;
316 }
317
318 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
319 u16 data_len)
320 {
321 struct mgmt_rp_read_index_list *rp;
322 struct list_head *p;
323 struct hci_dev *d;
324 size_t rp_len;
325 u16 count;
326 int i, err;
327
328 BT_DBG("sock %p", sk);
329
330 read_lock(&hci_dev_list_lock);
331
332 count = 0;
333 list_for_each(p, &hci_dev_list) {
334 count++;
335 }
336
337 rp_len = sizeof(*rp) + (2 * count);
338 rp = kmalloc(rp_len, GFP_ATOMIC);
339 if (!rp) {
340 read_unlock(&hci_dev_list_lock);
341 return -ENOMEM;
342 }
343
344 put_unaligned_le16(count, &rp->num_controllers);
345
346 i = 0;
347 list_for_each_entry(d, &hci_dev_list, list) {
348 if (test_bit(HCI_SETUP, &d->dev_flags))
349 continue;
350
351 put_unaligned_le16(d->id, &rp->index[i++]);
352 BT_DBG("Added hci%u", d->id);
353 }
354
355 read_unlock(&hci_dev_list_lock);
356
357 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
358 rp_len);
359
360 kfree(rp);
361
362 return err;
363 }
364
365 static u32 get_supported_settings(struct hci_dev *hdev)
366 {
367 u32 settings = 0;
368
369 settings |= MGMT_SETTING_POWERED;
370 settings |= MGMT_SETTING_CONNECTABLE;
371 settings |= MGMT_SETTING_FAST_CONNECTABLE;
372 settings |= MGMT_SETTING_DISCOVERABLE;
373 settings |= MGMT_SETTING_PAIRABLE;
374
375 if (hdev->features[6] & LMP_SIMPLE_PAIR)
376 settings |= MGMT_SETTING_SSP;
377
378 if (!(hdev->features[4] & LMP_NO_BREDR)) {
379 settings |= MGMT_SETTING_BREDR;
380 settings |= MGMT_SETTING_LINK_SECURITY;
381 }
382
383 if (enable_hs)
384 settings |= MGMT_SETTING_HS;
385
386 if (enable_le) {
387 if (hdev->features[4] & LMP_LE)
388 settings |= MGMT_SETTING_LE;
389 }
390
391 return settings;
392 }
393
394 static u32 get_current_settings(struct hci_dev *hdev)
395 {
396 u32 settings = 0;
397
398 if (hdev_is_powered(hdev))
399 settings |= MGMT_SETTING_POWERED;
400
401 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
402 settings |= MGMT_SETTING_CONNECTABLE;
403
404 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
405 settings |= MGMT_SETTING_DISCOVERABLE;
406
407 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
408 settings |= MGMT_SETTING_PAIRABLE;
409
410 if (!(hdev->features[4] & LMP_NO_BREDR))
411 settings |= MGMT_SETTING_BREDR;
412
413 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
414 settings |= MGMT_SETTING_LE;
415
416 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
417 settings |= MGMT_SETTING_LINK_SECURITY;
418
419 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
420 settings |= MGMT_SETTING_SSP;
421
422 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
423 settings |= MGMT_SETTING_HS;
424
425 return settings;
426 }
427
428 #define PNP_INFO_SVCLASS_ID 0x1200
429
430 static u8 bluetooth_base_uuid[] = {
431 0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
432 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
433 };
434
435 static u16 get_uuid16(u8 *uuid128)
436 {
437 u32 val;
438 int i;
439
440 for (i = 0; i < 12; i++) {
441 if (bluetooth_base_uuid[i] != uuid128[i])
442 return 0;
443 }
444
445 memcpy(&val, &uuid128[12], 4);
446
447 val = le32_to_cpu(val);
448 if (val > 0xffff)
449 return 0;
450
451 return (u16) val;
452 }
453
454 static void create_eir(struct hci_dev *hdev, u8 *data)
455 {
456 u8 *ptr = data;
457 u16 eir_len = 0;
458 u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
459 int i, truncated = 0;
460 struct bt_uuid *uuid;
461 size_t name_len;
462
463 name_len = strlen(hdev->dev_name);
464
465 if (name_len > 0) {
466 /* EIR Data type */
467 if (name_len > 48) {
468 name_len = 48;
469 ptr[1] = EIR_NAME_SHORT;
470 } else
471 ptr[1] = EIR_NAME_COMPLETE;
472
473 /* EIR Data length */
474 ptr[0] = name_len + 1;
475
476 memcpy(ptr + 2, hdev->dev_name, name_len);
477
478 eir_len += (name_len + 2);
479 ptr += (name_len + 2);
480 }
481
482 if (hdev->inq_tx_power) {
483 ptr[0] = 2;
484 ptr[1] = EIR_TX_POWER;
485 ptr[2] = (u8) hdev->inq_tx_power;
486
487 eir_len += 3;
488 ptr += 3;
489 }
490
491 memset(uuid16_list, 0, sizeof(uuid16_list));
492
493 /* Group all UUID16 types */
494 list_for_each_entry(uuid, &hdev->uuids, list) {
495 u16 uuid16;
496
497 uuid16 = get_uuid16(uuid->uuid);
498 if (uuid16 == 0)
499 return;
500
501 if (uuid16 < 0x1100)
502 continue;
503
504 if (uuid16 == PNP_INFO_SVCLASS_ID)
505 continue;
506
507 /* Stop if not enough space to put next UUID */
508 if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
509 truncated = 1;
510 break;
511 }
512
513 /* Check for duplicates */
514 for (i = 0; uuid16_list[i] != 0; i++)
515 if (uuid16_list[i] == uuid16)
516 break;
517
518 if (uuid16_list[i] == 0) {
519 uuid16_list[i] = uuid16;
520 eir_len += sizeof(u16);
521 }
522 }
523
524 if (uuid16_list[0] != 0) {
525 u8 *length = ptr;
526
527 /* EIR Data type */
528 ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
529
530 ptr += 2;
531 eir_len += 2;
532
533 for (i = 0; uuid16_list[i] != 0; i++) {
534 *ptr++ = (uuid16_list[i] & 0x00ff);
535 *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
536 }
537
538 /* EIR Data length */
539 *length = (i * sizeof(u16)) + 1;
540 }
541 }
542
543 static int update_eir(struct hci_dev *hdev)
544 {
545 struct hci_cp_write_eir cp;
546
547 if (!hdev_is_powered(hdev))
548 return 0;
549
550 if (!(hdev->features[6] & LMP_EXT_INQ))
551 return 0;
552
553 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
554 return 0;
555
556 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
557 return 0;
558
559 memset(&cp, 0, sizeof(cp));
560
561 create_eir(hdev, cp.data);
562
563 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
564 return 0;
565
566 memcpy(hdev->eir, cp.data, sizeof(cp.data));
567
568 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
569 }
570
571 static u8 get_service_classes(struct hci_dev *hdev)
572 {
573 struct bt_uuid *uuid;
574 u8 val = 0;
575
576 list_for_each_entry(uuid, &hdev->uuids, list)
577 val |= uuid->svc_hint;
578
579 return val;
580 }
581
582 static int update_class(struct hci_dev *hdev)
583 {
584 u8 cod[3];
585 int err;
586
587 BT_DBG("%s", hdev->name);
588
589 if (!hdev_is_powered(hdev))
590 return 0;
591
592 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
593 return 0;
594
595 cod[0] = hdev->minor_class;
596 cod[1] = hdev->major_class;
597 cod[2] = get_service_classes(hdev);
598
599 if (memcmp(cod, hdev->dev_class, 3) == 0)
600 return 0;
601
602 err = hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
603 if (err == 0)
604 set_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
605
606 return err;
607 }
608
609 static void service_cache_off(struct work_struct *work)
610 {
611 struct hci_dev *hdev = container_of(work, struct hci_dev,
612 service_cache.work);
613
614 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
615 return;
616
617 hci_dev_lock(hdev);
618
619 update_eir(hdev);
620 update_class(hdev);
621
622 hci_dev_unlock(hdev);
623 }
624
625 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
626 {
627 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
628 return;
629
630 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
631
632 /* Non-mgmt controlled devices get this bit set
633 * implicitly so that pairing works for them, however
634 * for mgmt we require user-space to explicitly enable
635 * it
636 */
637 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
638 }
639
640 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
641 void *data, u16 data_len)
642 {
643 struct mgmt_rp_read_info rp;
644
645 BT_DBG("sock %p %s", sk, hdev->name);
646
647 hci_dev_lock(hdev);
648
649 memset(&rp, 0, sizeof(rp));
650
651 bacpy(&rp.bdaddr, &hdev->bdaddr);
652
653 rp.version = hdev->hci_ver;
654
655 put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
656
657 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
658 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
659
660 memcpy(rp.dev_class, hdev->dev_class, 3);
661
662 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
663 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
664
665 hci_dev_unlock(hdev);
666
667 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
668 sizeof(rp));
669 }
670
671 static void mgmt_pending_free(struct pending_cmd *cmd)
672 {
673 sock_put(cmd->sk);
674 kfree(cmd->param);
675 kfree(cmd);
676 }
677
678 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
679 struct hci_dev *hdev, void *data,
680 u16 len)
681 {
682 struct pending_cmd *cmd;
683
684 cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
685 if (!cmd)
686 return NULL;
687
688 cmd->opcode = opcode;
689 cmd->index = hdev->id;
690
691 cmd->param = kmalloc(len, GFP_ATOMIC);
692 if (!cmd->param) {
693 kfree(cmd);
694 return NULL;
695 }
696
697 if (data)
698 memcpy(cmd->param, data, len);
699
700 cmd->sk = sk;
701 sock_hold(sk);
702
703 list_add(&cmd->list, &hdev->mgmt_pending);
704
705 return cmd;
706 }
707
708 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
709 void (*cb)(struct pending_cmd *cmd, void *data),
710 void *data)
711 {
712 struct list_head *p, *n;
713
714 list_for_each_safe(p, n, &hdev->mgmt_pending) {
715 struct pending_cmd *cmd;
716
717 cmd = list_entry(p, struct pending_cmd, list);
718
719 if (opcode > 0 && cmd->opcode != opcode)
720 continue;
721
722 cb(cmd, data);
723 }
724 }
725
726 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
727 {
728 struct pending_cmd *cmd;
729
730 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
731 if (cmd->opcode == opcode)
732 return cmd;
733 }
734
735 return NULL;
736 }
737
738 static void mgmt_pending_remove(struct pending_cmd *cmd)
739 {
740 list_del(&cmd->list);
741 mgmt_pending_free(cmd);
742 }
743
744 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
745 {
746 __le32 settings = cpu_to_le32(get_current_settings(hdev));
747
748 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
749 sizeof(settings));
750 }
751
752 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
753 u16 len)
754 {
755 struct mgmt_mode *cp = data;
756 struct pending_cmd *cmd;
757 int err;
758
759 BT_DBG("request for %s", hdev->name);
760
761 hci_dev_lock(hdev);
762
763 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
764 cancel_delayed_work(&hdev->power_off);
765
766 if (cp->val) {
767 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
768 mgmt_powered(hdev, 1);
769 goto failed;
770 }
771 }
772
773 if (!!cp->val == hdev_is_powered(hdev)) {
774 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
775 goto failed;
776 }
777
778 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
779 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
780 MGMT_STATUS_BUSY);
781 goto failed;
782 }
783
784 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
785 if (!cmd) {
786 err = -ENOMEM;
787 goto failed;
788 }
789
790 if (cp->val)
791 schedule_work(&hdev->power_on);
792 else
793 schedule_work(&hdev->power_off.work);
794
795 err = 0;
796
797 failed:
798 hci_dev_unlock(hdev);
799 return err;
800 }
801
802 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
803 struct sock *skip_sk)
804 {
805 struct sk_buff *skb;
806 struct mgmt_hdr *hdr;
807
808 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
809 if (!skb)
810 return -ENOMEM;
811
812 hdr = (void *) skb_put(skb, sizeof(*hdr));
813 hdr->opcode = cpu_to_le16(event);
814 if (hdev)
815 hdr->index = cpu_to_le16(hdev->id);
816 else
817 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
818 hdr->len = cpu_to_le16(data_len);
819
820 if (data)
821 memcpy(skb_put(skb, data_len), data, data_len);
822
823 /* Time stamp */
824 __net_timestamp(skb);
825
826 hci_send_to_control(skb, skip_sk);
827 kfree_skb(skb);
828
829 return 0;
830 }
831
832 static int new_settings(struct hci_dev *hdev, struct sock *skip)
833 {
834 __le32 ev;
835
836 ev = cpu_to_le32(get_current_settings(hdev));
837
838 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
839 }
840
841 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
842 u16 len)
843 {
844 struct mgmt_cp_set_discoverable *cp = data;
845 struct pending_cmd *cmd;
846 u16 timeout;
847 u8 scan;
848 int err;
849
850 BT_DBG("request for %s", hdev->name);
851
852 timeout = get_unaligned_le16(&cp->timeout);
853 if (!cp->val && timeout > 0)
854 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
855 MGMT_STATUS_INVALID_PARAMS);
856
857 hci_dev_lock(hdev);
858
859 if (!hdev_is_powered(hdev) && timeout > 0) {
860 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
861 MGMT_STATUS_NOT_POWERED);
862 goto failed;
863 }
864
865 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
866 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
867 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
868 MGMT_STATUS_BUSY);
869 goto failed;
870 }
871
872 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
873 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
874 MGMT_STATUS_REJECTED);
875 goto failed;
876 }
877
878 if (!hdev_is_powered(hdev)) {
879 bool changed = false;
880
881 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
882 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
883 changed = true;
884 }
885
886 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
887 if (err < 0)
888 goto failed;
889
890 if (changed)
891 err = new_settings(hdev, sk);
892
893 goto failed;
894 }
895
896 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
897 if (hdev->discov_timeout > 0) {
898 cancel_delayed_work(&hdev->discov_off);
899 hdev->discov_timeout = 0;
900 }
901
902 if (cp->val && timeout > 0) {
903 hdev->discov_timeout = timeout;
904 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
905 msecs_to_jiffies(hdev->discov_timeout * 1000));
906 }
907
908 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
909 goto failed;
910 }
911
912 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
913 if (!cmd) {
914 err = -ENOMEM;
915 goto failed;
916 }
917
918 scan = SCAN_PAGE;
919
920 if (cp->val)
921 scan |= SCAN_INQUIRY;
922 else
923 cancel_delayed_work(&hdev->discov_off);
924
925 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
926 if (err < 0)
927 mgmt_pending_remove(cmd);
928
929 if (cp->val)
930 hdev->discov_timeout = timeout;
931
932 failed:
933 hci_dev_unlock(hdev);
934 return err;
935 }
936
937 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
938 u16 len)
939 {
940 struct mgmt_mode *cp = data;
941 struct pending_cmd *cmd;
942 u8 scan;
943 int err;
944
945 BT_DBG("request for %s", hdev->name);
946
947 hci_dev_lock(hdev);
948
949 if (!hdev_is_powered(hdev)) {
950 bool changed = false;
951
952 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
953 changed = true;
954
955 if (cp->val) {
956 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
957 } else {
958 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
959 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
960 }
961
962 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
963 if (err < 0)
964 goto failed;
965
966 if (changed)
967 err = new_settings(hdev, sk);
968
969 goto failed;
970 }
971
972 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
973 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
974 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
975 MGMT_STATUS_BUSY);
976 goto failed;
977 }
978
979 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
980 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
981 goto failed;
982 }
983
984 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
985 if (!cmd) {
986 err = -ENOMEM;
987 goto failed;
988 }
989
990 if (cp->val) {
991 scan = SCAN_PAGE;
992 } else {
993 scan = 0;
994
995 if (test_bit(HCI_ISCAN, &hdev->flags) &&
996 hdev->discov_timeout > 0)
997 cancel_delayed_work(&hdev->discov_off);
998 }
999
1000 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1001 if (err < 0)
1002 mgmt_pending_remove(cmd);
1003
1004 failed:
1005 hci_dev_unlock(hdev);
1006 return err;
1007 }
1008
1009 static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data,
1010 u16 len)
1011 {
1012 struct mgmt_mode *cp = data;
1013 int err;
1014
1015 BT_DBG("request for %s", hdev->name);
1016
1017 hci_dev_lock(hdev);
1018
1019 if (cp->val)
1020 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1021 else
1022 clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
1023
1024 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
1025 if (err < 0)
1026 goto failed;
1027
1028 err = new_settings(hdev, sk);
1029
1030 failed:
1031 hci_dev_unlock(hdev);
1032 return err;
1033 }
1034
1035 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1036 u16 len)
1037 {
1038 struct mgmt_mode *cp = data;
1039 struct pending_cmd *cmd;
1040 u8 val;
1041 int err;
1042
1043 BT_DBG("request for %s", hdev->name);
1044
1045 hci_dev_lock(hdev);
1046
1047 if (!hdev_is_powered(hdev)) {
1048 bool changed = false;
1049
1050 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
1051 &hdev->dev_flags)) {
1052 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
1053 changed = true;
1054 }
1055
1056 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1057 if (err < 0)
1058 goto failed;
1059
1060 if (changed)
1061 err = new_settings(hdev, sk);
1062
1063 goto failed;
1064 }
1065
1066 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
1067 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1068 MGMT_STATUS_BUSY);
1069 goto failed;
1070 }
1071
1072 val = !!cp->val;
1073
1074 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1075 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1076 goto failed;
1077 }
1078
1079 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1080 if (!cmd) {
1081 err = -ENOMEM;
1082 goto failed;
1083 }
1084
1085 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
1086 if (err < 0) {
1087 mgmt_pending_remove(cmd);
1088 goto failed;
1089 }
1090
1091 failed:
1092 hci_dev_unlock(hdev);
1093 return err;
1094 }
1095
1096 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1097 {
1098 struct mgmt_mode *cp = data;
1099 struct pending_cmd *cmd;
1100 u8 val;
1101 int err;
1102
1103 BT_DBG("request for %s", hdev->name);
1104
1105 hci_dev_lock(hdev);
1106
1107 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
1108 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1109 MGMT_STATUS_NOT_SUPPORTED);
1110 goto failed;
1111 }
1112
1113 val = !!cp->val;
1114
1115 if (!hdev_is_powered(hdev)) {
1116 bool changed = false;
1117
1118 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1119 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
1120 changed = true;
1121 }
1122
1123 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1124 if (err < 0)
1125 goto failed;
1126
1127 if (changed)
1128 err = new_settings(hdev, sk);
1129
1130 goto failed;
1131 }
1132
1133 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
1134 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
1135 MGMT_STATUS_BUSY);
1136 goto failed;
1137 }
1138
1139 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
1140 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
1141 goto failed;
1142 }
1143
1144 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
1145 if (!cmd) {
1146 err = -ENOMEM;
1147 goto failed;
1148 }
1149
1150 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
1151 if (err < 0) {
1152 mgmt_pending_remove(cmd);
1153 goto failed;
1154 }
1155
1156 failed:
1157 hci_dev_unlock(hdev);
1158 return err;
1159 }
1160
1161 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1162 {
1163 struct mgmt_mode *cp = data;
1164
1165 BT_DBG("request for %s", hdev->name);
1166
1167 if (!enable_hs)
1168 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
1169 MGMT_STATUS_NOT_SUPPORTED);
1170
1171 if (cp->val)
1172 set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1173 else
1174 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
1175
1176 return send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
1177 }
1178
1179 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1180 {
1181 struct mgmt_mode *cp = data;
1182 struct hci_cp_write_le_host_supported hci_cp;
1183 struct pending_cmd *cmd;
1184 int err;
1185 u8 val, enabled;
1186
1187 BT_DBG("request for %s", hdev->name);
1188
1189 hci_dev_lock(hdev);
1190
1191 if (!enable_le || !(hdev->features[4] & LMP_LE)) {
1192 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1193 MGMT_STATUS_NOT_SUPPORTED);
1194 goto unlock;
1195 }
1196
1197 val = !!cp->val;
1198 enabled = !!(hdev->host_features[0] & LMP_HOST_LE);
1199
1200 if (!hdev_is_powered(hdev) || val == enabled) {
1201 bool changed = false;
1202
1203 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1204 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1205 changed = true;
1206 }
1207
1208 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
1209 if (err < 0)
1210 goto unlock;
1211
1212 if (changed)
1213 err = new_settings(hdev, sk);
1214
1215 goto unlock;
1216 }
1217
1218 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
1219 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
1220 MGMT_STATUS_BUSY);
1221 goto unlock;
1222 }
1223
1224 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
1225 if (!cmd) {
1226 err = -ENOMEM;
1227 goto unlock;
1228 }
1229
1230 memset(&hci_cp, 0, sizeof(hci_cp));
1231
1232 if (val) {
1233 hci_cp.le = val;
1234 hci_cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
1235 }
1236
1237 err = hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
1238 &hci_cp);
1239 if (err < 0) {
1240 mgmt_pending_remove(cmd);
1241 goto unlock;
1242 }
1243
1244 unlock:
1245 hci_dev_unlock(hdev);
1246 return err;
1247 }
1248
1249 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
1250 {
1251 struct mgmt_cp_add_uuid *cp = data;
1252 struct pending_cmd *cmd;
1253 struct bt_uuid *uuid;
1254 int err;
1255
1256 BT_DBG("request for %s", hdev->name);
1257
1258 hci_dev_lock(hdev);
1259
1260 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1261 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
1262 MGMT_STATUS_BUSY);
1263 goto failed;
1264 }
1265
1266 uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
1267 if (!uuid) {
1268 err = -ENOMEM;
1269 goto failed;
1270 }
1271
1272 memcpy(uuid->uuid, cp->uuid, 16);
1273 uuid->svc_hint = cp->svc_hint;
1274
1275 list_add(&uuid->list, &hdev->uuids);
1276
1277 err = update_class(hdev);
1278 if (err < 0)
1279 goto failed;
1280
1281 err = update_eir(hdev);
1282 if (err < 0)
1283 goto failed;
1284
1285 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1286 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
1287 hdev->dev_class, 3);
1288 goto failed;
1289 }
1290
1291 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
1292 if (!cmd) {
1293 err = -ENOMEM;
1294 goto failed;
1295 }
1296
1297 failed:
1298 hci_dev_unlock(hdev);
1299 return err;
1300 }
1301
1302 static bool enable_service_cache(struct hci_dev *hdev)
1303 {
1304 if (!hdev_is_powered(hdev))
1305 return false;
1306
1307 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1308 schedule_delayed_work(&hdev->service_cache, CACHE_TIMEOUT);
1309 return true;
1310 }
1311
1312 return false;
1313 }
1314
1315 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
1316 u16 len)
1317 {
1318 struct mgmt_cp_remove_uuid *cp = data;
1319 struct pending_cmd *cmd;
1320 struct list_head *p, *n;
1321 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1322 int err, found;
1323
1324 BT_DBG("request for %s", hdev->name);
1325
1326 hci_dev_lock(hdev);
1327
1328 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1329 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1330 MGMT_STATUS_BUSY);
1331 goto unlock;
1332 }
1333
1334 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
1335 err = hci_uuids_clear(hdev);
1336
1337 if (enable_service_cache(hdev)) {
1338 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1339 0, hdev->dev_class, 3);
1340 goto unlock;
1341 }
1342
1343 goto update_class;
1344 }
1345
1346 found = 0;
1347
1348 list_for_each_safe(p, n, &hdev->uuids) {
1349 struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
1350
1351 if (memcmp(match->uuid, cp->uuid, 16) != 0)
1352 continue;
1353
1354 list_del(&match->list);
1355 found++;
1356 }
1357
1358 if (found == 0) {
1359 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
1360 MGMT_STATUS_INVALID_PARAMS);
1361 goto unlock;
1362 }
1363
1364 update_class:
1365 err = update_class(hdev);
1366 if (err < 0)
1367 goto unlock;
1368
1369 err = update_eir(hdev);
1370 if (err < 0)
1371 goto unlock;
1372
1373 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1374 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
1375 hdev->dev_class, 3);
1376 goto unlock;
1377 }
1378
1379 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
1380 if (!cmd) {
1381 err = -ENOMEM;
1382 goto unlock;
1383 }
1384
1385 unlock:
1386 hci_dev_unlock(hdev);
1387 return err;
1388 }
1389
1390 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
1391 u16 len)
1392 {
1393 struct mgmt_cp_set_dev_class *cp = data;
1394 struct pending_cmd *cmd;
1395 int err;
1396
1397 BT_DBG("request for %s", hdev->name);
1398
1399 hci_dev_lock(hdev);
1400
1401 if (test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1402 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
1403 MGMT_STATUS_BUSY);
1404 goto unlock;
1405 }
1406
1407 hdev->major_class = cp->major;
1408 hdev->minor_class = cp->minor;
1409
1410 if (!hdev_is_powered(hdev)) {
1411 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1412 hdev->dev_class, 3);
1413 goto unlock;
1414 }
1415
1416 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
1417 hci_dev_unlock(hdev);
1418 cancel_delayed_work_sync(&hdev->service_cache);
1419 hci_dev_lock(hdev);
1420 update_eir(hdev);
1421 }
1422
1423 err = update_class(hdev);
1424 if (err < 0)
1425 goto unlock;
1426
1427 if (!test_bit(HCI_PENDING_CLASS, &hdev->dev_flags)) {
1428 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
1429 hdev->dev_class, 3);
1430 goto unlock;
1431 }
1432
1433 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
1434 if (!cmd) {
1435 err = -ENOMEM;
1436 goto unlock;
1437 }
1438
1439 unlock:
1440 hci_dev_unlock(hdev);
1441 return err;
1442 }
1443
1444 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
1445 u16 len)
1446 {
1447 struct mgmt_cp_load_link_keys *cp = data;
1448 u16 key_count, expected_len;
1449 int i;
1450
1451 key_count = get_unaligned_le16(&cp->key_count);
1452
1453 expected_len = sizeof(*cp) + key_count *
1454 sizeof(struct mgmt_link_key_info);
1455 if (expected_len != len) {
1456 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
1457 len, expected_len);
1458 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
1459 MGMT_STATUS_INVALID_PARAMS);
1460 }
1461
1462 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
1463 key_count);
1464
1465 hci_dev_lock(hdev);
1466
1467 hci_link_keys_clear(hdev);
1468
1469 set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
1470
1471 if (cp->debug_keys)
1472 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1473 else
1474 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
1475
1476 for (i = 0; i < key_count; i++) {
1477 struct mgmt_link_key_info *key = &cp->keys[i];
1478
1479 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
1480 key->type, key->pin_len);
1481 }
1482
1483 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
1484
1485 hci_dev_unlock(hdev);
1486
1487 return 0;
1488 }
1489
1490 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
1491 u8 addr_type, struct sock *skip_sk)
1492 {
1493 struct mgmt_ev_device_unpaired ev;
1494
1495 bacpy(&ev.addr.bdaddr, bdaddr);
1496 ev.addr.type = addr_type;
1497
1498 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
1499 skip_sk);
1500 }
1501
1502 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1503 u16 len)
1504 {
1505 struct mgmt_cp_unpair_device *cp = data;
1506 struct mgmt_rp_unpair_device rp;
1507 struct hci_cp_disconnect dc;
1508 struct pending_cmd *cmd;
1509 struct hci_conn *conn;
1510 int err;
1511
1512 hci_dev_lock(hdev);
1513
1514 memset(&rp, 0, sizeof(rp));
1515 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1516 rp.addr.type = cp->addr.type;
1517
1518 if (!hdev_is_powered(hdev)) {
1519 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1520 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
1521 goto unlock;
1522 }
1523
1524 if (cp->addr.type == MGMT_ADDR_BREDR)
1525 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
1526 else
1527 err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
1528
1529 if (err < 0) {
1530 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
1531 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
1532 goto unlock;
1533 }
1534
1535 if (cp->disconnect) {
1536 if (cp->addr.type == MGMT_ADDR_BREDR)
1537 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
1538 &cp->addr.bdaddr);
1539 else
1540 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
1541 &cp->addr.bdaddr);
1542 } else {
1543 conn = NULL;
1544 }
1545
1546 if (!conn) {
1547 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
1548 &rp, sizeof(rp));
1549 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
1550 goto unlock;
1551 }
1552
1553 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
1554 sizeof(*cp));
1555 if (!cmd) {
1556 err = -ENOMEM;
1557 goto unlock;
1558 }
1559
1560 put_unaligned_le16(conn->handle, &dc.handle);
1561 dc.reason = 0x13; /* Remote User Terminated Connection */
1562 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1563 if (err < 0)
1564 mgmt_pending_remove(cmd);
1565
1566 unlock:
1567 hci_dev_unlock(hdev);
1568 return err;
1569 }
1570
1571 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1572 u16 len)
1573 {
1574 struct mgmt_cp_disconnect *cp = data;
1575 struct hci_cp_disconnect dc;
1576 struct pending_cmd *cmd;
1577 struct hci_conn *conn;
1578 int err;
1579
1580 BT_DBG("");
1581
1582 hci_dev_lock(hdev);
1583
1584 if (!test_bit(HCI_UP, &hdev->flags)) {
1585 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1586 MGMT_STATUS_NOT_POWERED);
1587 goto failed;
1588 }
1589
1590 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
1591 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1592 MGMT_STATUS_BUSY);
1593 goto failed;
1594 }
1595
1596 if (cp->addr.type == MGMT_ADDR_BREDR)
1597 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1598 else
1599 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1600
1601 if (!conn) {
1602 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603 MGMT_STATUS_NOT_CONNECTED);
1604 goto failed;
1605 }
1606
1607 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
1608 if (!cmd) {
1609 err = -ENOMEM;
1610 goto failed;
1611 }
1612
1613 put_unaligned_le16(conn->handle, &dc.handle);
1614 dc.reason = 0x13; /* Remote User Terminated Connection */
1615
1616 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1617 if (err < 0)
1618 mgmt_pending_remove(cmd);
1619
1620 failed:
1621 hci_dev_unlock(hdev);
1622 return err;
1623 }
1624
1625 static u8 link_to_mgmt(u8 link_type, u8 addr_type)
1626 {
1627 switch (link_type) {
1628 case LE_LINK:
1629 switch (addr_type) {
1630 case ADDR_LE_DEV_PUBLIC:
1631 return MGMT_ADDR_LE_PUBLIC;
1632 case ADDR_LE_DEV_RANDOM:
1633 return MGMT_ADDR_LE_RANDOM;
1634 default:
1635 return MGMT_ADDR_INVALID;
1636 }
1637 case ACL_LINK:
1638 return MGMT_ADDR_BREDR;
1639 default:
1640 return MGMT_ADDR_INVALID;
1641 }
1642 }
1643
1644 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
1645 u16 data_len)
1646 {
1647 struct mgmt_rp_get_connections *rp;
1648 struct hci_conn *c;
1649 size_t rp_len;
1650 int err;
1651 u16 i;
1652
1653 BT_DBG("");
1654
1655 hci_dev_lock(hdev);
1656
1657 if (!hdev_is_powered(hdev)) {
1658 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
1659 MGMT_STATUS_NOT_POWERED);
1660 goto unlock;
1661 }
1662
1663 i = 0;
1664 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1665 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1666 i++;
1667 }
1668
1669 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1670 rp = kmalloc(rp_len, GFP_ATOMIC);
1671 if (!rp) {
1672 err = -ENOMEM;
1673 goto unlock;
1674 }
1675
1676 i = 0;
1677 list_for_each_entry(c, &hdev->conn_hash.list, list) {
1678 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
1679 continue;
1680 bacpy(&rp->addr[i].bdaddr, &c->dst);
1681 rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
1682 if (rp->addr[i].type == MGMT_ADDR_INVALID)
1683 continue;
1684 i++;
1685 }
1686
1687 put_unaligned_le16(i, &rp->conn_count);
1688
1689 /* Recalculate length in case of filtered SCO connections, etc */
1690 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
1691
1692 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
1693 rp_len);
1694
1695 kfree(rp);
1696
1697 unlock:
1698 hci_dev_unlock(hdev);
1699 return err;
1700 }
1701
1702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1703 struct mgmt_cp_pin_code_neg_reply *cp)
1704 {
1705 struct pending_cmd *cmd;
1706 int err;
1707
1708 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
1709 sizeof(*cp));
1710 if (!cmd)
1711 return -ENOMEM;
1712
1713 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
1714 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
1715 if (err < 0)
1716 mgmt_pending_remove(cmd);
1717
1718 return err;
1719 }
1720
1721 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
1722 u16 len)
1723 {
1724 struct hci_conn *conn;
1725 struct mgmt_cp_pin_code_reply *cp = data;
1726 struct hci_cp_pin_code_reply reply;
1727 struct pending_cmd *cmd;
1728 int err;
1729
1730 BT_DBG("");
1731
1732 hci_dev_lock(hdev);
1733
1734 if (!hdev_is_powered(hdev)) {
1735 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1736 MGMT_STATUS_NOT_POWERED);
1737 goto failed;
1738 }
1739
1740 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
1741 if (!conn) {
1742 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1743 MGMT_STATUS_NOT_CONNECTED);
1744 goto failed;
1745 }
1746
1747 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
1748 struct mgmt_cp_pin_code_neg_reply ncp;
1749
1750 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
1751
1752 BT_ERR("PIN code is not 16 bytes long");
1753
1754 err = send_pin_code_neg_reply(sk, hdev, &ncp);
1755 if (err >= 0)
1756 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
1757 MGMT_STATUS_INVALID_PARAMS);
1758
1759 goto failed;
1760 }
1761
1762 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
1763 if (!cmd) {
1764 err = -ENOMEM;
1765 goto failed;
1766 }
1767
1768 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
1769 reply.pin_len = cp->pin_len;
1770 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
1771
1772 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
1773 if (err < 0)
1774 mgmt_pending_remove(cmd);
1775
1776 failed:
1777 hci_dev_unlock(hdev);
1778 return err;
1779 }
1780
1781 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
1782 void *data, u16 len)
1783 {
1784 struct mgmt_cp_pin_code_neg_reply *cp = data;
1785 int err;
1786
1787 BT_DBG("");
1788
1789 hci_dev_lock(hdev);
1790
1791 if (!hdev_is_powered(hdev)) {
1792 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
1793 MGMT_STATUS_NOT_POWERED);
1794 goto failed;
1795 }
1796
1797 err = send_pin_code_neg_reply(sk, hdev, cp);
1798
1799 failed:
1800 hci_dev_unlock(hdev);
1801 return err;
1802 }
1803
1804 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
1805 u16 len)
1806 {
1807 struct mgmt_cp_set_io_capability *cp = data;
1808
1809 BT_DBG("");
1810
1811 hci_dev_lock(hdev);
1812
1813 hdev->io_capability = cp->io_capability;
1814
1815 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
1816 hdev->io_capability);
1817
1818 hci_dev_unlock(hdev);
1819
1820 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
1821 0);
1822 }
1823
1824 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
1825 {
1826 struct hci_dev *hdev = conn->hdev;
1827 struct pending_cmd *cmd;
1828
1829 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
1830 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
1831 continue;
1832
1833 if (cmd->user_data != conn)
1834 continue;
1835
1836 return cmd;
1837 }
1838
1839 return NULL;
1840 }
1841
1842 static void pairing_complete(struct pending_cmd *cmd, u8 status)
1843 {
1844 struct mgmt_rp_pair_device rp;
1845 struct hci_conn *conn = cmd->user_data;
1846
1847 bacpy(&rp.addr.bdaddr, &conn->dst);
1848 rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
1849
1850 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
1851 &rp, sizeof(rp));
1852
1853 /* So we don't get further callbacks for this connection */
1854 conn->connect_cfm_cb = NULL;
1855 conn->security_cfm_cb = NULL;
1856 conn->disconn_cfm_cb = NULL;
1857
1858 hci_conn_put(conn);
1859
1860 mgmt_pending_remove(cmd);
1861 }
1862
1863 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1864 {
1865 struct pending_cmd *cmd;
1866
1867 BT_DBG("status %u", status);
1868
1869 cmd = find_pairing(conn);
1870 if (!cmd)
1871 BT_DBG("Unable to find a pending command");
1872 else
1873 pairing_complete(cmd, mgmt_status(status));
1874 }
1875
1876 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1877 u16 len)
1878 {
1879 struct mgmt_cp_pair_device *cp = data;
1880 struct mgmt_rp_pair_device rp;
1881 struct pending_cmd *cmd;
1882 u8 sec_level, auth_type;
1883 struct hci_conn *conn;
1884 int err;
1885
1886 BT_DBG("");
1887
1888 hci_dev_lock(hdev);
1889
1890 if (!hdev_is_powered(hdev)) {
1891 err = cmd_status(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1892 MGMT_STATUS_NOT_POWERED);
1893 goto unlock;
1894 }
1895
1896 sec_level = BT_SECURITY_MEDIUM;
1897 if (cp->io_cap == 0x03)
1898 auth_type = HCI_AT_DEDICATED_BONDING;
1899 else
1900 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
1901
1902 if (cp->addr.type == MGMT_ADDR_BREDR)
1903 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, sec_level,
1904 auth_type);
1905 else
1906 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, sec_level,
1907 auth_type);
1908
1909 memset(&rp, 0, sizeof(rp));
1910 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
1911 rp.addr.type = cp->addr.type;
1912
1913 if (IS_ERR(conn)) {
1914 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1915 MGMT_STATUS_CONNECT_FAILED, &rp,
1916 sizeof(rp));
1917 goto unlock;
1918 }
1919
1920 if (conn->connect_cfm_cb) {
1921 hci_conn_put(conn);
1922 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
1923 MGMT_STATUS_BUSY, &rp, sizeof(rp));
1924 goto unlock;
1925 }
1926
1927 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
1928 if (!cmd) {
1929 err = -ENOMEM;
1930 hci_conn_put(conn);
1931 goto unlock;
1932 }
1933
1934 /* For LE, just connecting isn't a proof that the pairing finished */
1935 if (cp->addr.type == MGMT_ADDR_BREDR)
1936 conn->connect_cfm_cb = pairing_complete_cb;
1937
1938 conn->security_cfm_cb = pairing_complete_cb;
1939 conn->disconn_cfm_cb = pairing_complete_cb;
1940 conn->io_capability = cp->io_cap;
1941 cmd->user_data = conn;
1942
1943 if (conn->state == BT_CONNECTED &&
1944 hci_conn_security(conn, sec_level, auth_type))
1945 pairing_complete(cmd, 0);
1946
1947 err = 0;
1948
1949 unlock:
1950 hci_dev_unlock(hdev);
1951 return err;
1952 }
1953
1954 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1955 u16 len)
1956 {
1957 struct mgmt_addr_info *addr = data;
1958 struct pending_cmd *cmd;
1959 struct hci_conn *conn;
1960 int err;
1961
1962 BT_DBG("");
1963
1964 hci_dev_lock(hdev);
1965
1966 if (!hdev_is_powered(hdev)) {
1967 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1968 MGMT_STATUS_NOT_POWERED);
1969 goto unlock;
1970 }
1971
1972 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
1973 if (!cmd) {
1974 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1975 MGMT_STATUS_INVALID_PARAMS);
1976 goto unlock;
1977 }
1978
1979 conn = cmd->user_data;
1980
1981 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
1982 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
1983 MGMT_STATUS_INVALID_PARAMS);
1984 goto unlock;
1985 }
1986
1987 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
1988
1989 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
1990 addr, sizeof(*addr));
1991 unlock:
1992 hci_dev_unlock(hdev);
1993 return err;
1994 }
1995
1996 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1997 bdaddr_t *bdaddr, u8 type, u16 mgmt_op,
1998 u16 hci_op, __le32 passkey)
1999 {
2000 struct pending_cmd *cmd;
2001 struct hci_conn *conn;
2002 int err;
2003
2004 hci_dev_lock(hdev);
2005
2006 if (!hdev_is_powered(hdev)) {
2007 err = cmd_status(sk, hdev->id, mgmt_op,
2008 MGMT_STATUS_NOT_POWERED);
2009 goto done;
2010 }
2011
2012 if (type == MGMT_ADDR_BREDR)
2013 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
2014 else
2015 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
2016
2017 if (!conn) {
2018 err = cmd_status(sk, hdev->id, mgmt_op,
2019 MGMT_STATUS_NOT_CONNECTED);
2020 goto done;
2021 }
2022
2023 if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
2024 /* Continue with pairing via SMP */
2025 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
2026
2027 if (!err)
2028 err = cmd_status(sk, hdev->id, mgmt_op,
2029 MGMT_STATUS_SUCCESS);
2030 else
2031 err = cmd_status(sk, hdev->id, mgmt_op,
2032 MGMT_STATUS_FAILED);
2033
2034 goto done;
2035 }
2036
2037 cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
2038 if (!cmd) {
2039 err = -ENOMEM;
2040 goto done;
2041 }
2042
2043 /* Continue with pairing via HCI */
2044 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
2045 struct hci_cp_user_passkey_reply cp;
2046
2047 bacpy(&cp.bdaddr, bdaddr);
2048 cp.passkey = passkey;
2049 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
2050 } else
2051 err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
2052
2053 if (err < 0)
2054 mgmt_pending_remove(cmd);
2055
2056 done:
2057 hci_dev_unlock(hdev);
2058 return err;
2059 }
2060
2061 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2062 u16 len)
2063 {
2064 struct mgmt_cp_user_confirm_reply *cp = data;
2065
2066 BT_DBG("");
2067
2068 if (len != sizeof(*cp))
2069 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
2070 MGMT_STATUS_INVALID_PARAMS);
2071
2072 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2073 MGMT_OP_USER_CONFIRM_REPLY,
2074 HCI_OP_USER_CONFIRM_REPLY, 0);
2075 }
2076
2077 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
2078 void *data, u16 len)
2079 {
2080 struct mgmt_cp_user_confirm_neg_reply *cp = data;
2081
2082 BT_DBG("");
2083
2084 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2085 MGMT_OP_USER_CONFIRM_NEG_REPLY,
2086 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
2087 }
2088
2089 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2090 u16 len)
2091 {
2092 struct mgmt_cp_user_passkey_reply *cp = data;
2093
2094 BT_DBG("");
2095
2096 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2097 MGMT_OP_USER_PASSKEY_REPLY,
2098 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
2099 }
2100
2101 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
2102 void *data, u16 len)
2103 {
2104 struct mgmt_cp_user_passkey_neg_reply *cp = data;
2105
2106 BT_DBG("");
2107
2108 return user_pairing_resp(sk, hdev, &cp->addr.bdaddr, cp->addr.type,
2109 MGMT_OP_USER_PASSKEY_NEG_REPLY,
2110 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
2111 }
2112
2113 static int update_name(struct hci_dev *hdev, const char *name)
2114 {
2115 struct hci_cp_write_local_name cp;
2116
2117 memcpy(cp.name, name, sizeof(cp.name));
2118
2119 return hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2120 }
2121
2122 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
2123 u16 len)
2124 {
2125 struct mgmt_cp_set_local_name *cp = data;
2126 struct pending_cmd *cmd;
2127 int err;
2128
2129 BT_DBG("");
2130
2131 hci_dev_lock(hdev);
2132
2133 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
2134
2135 if (!hdev_is_powered(hdev)) {
2136 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
2137
2138 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
2139 data, len);
2140 if (err < 0)
2141 goto failed;
2142
2143 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
2144 sk);
2145
2146 goto failed;
2147 }
2148
2149 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
2150 if (!cmd) {
2151 err = -ENOMEM;
2152 goto failed;
2153 }
2154
2155 err = update_name(hdev, cp->name);
2156 if (err < 0)
2157 mgmt_pending_remove(cmd);
2158
2159 failed:
2160 hci_dev_unlock(hdev);
2161 return err;
2162 }
2163
2164 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
2165 void *data, u16 data_len)
2166 {
2167 struct pending_cmd *cmd;
2168 int err;
2169
2170 BT_DBG("%s", hdev->name);
2171
2172 hci_dev_lock(hdev);
2173
2174 if (!hdev_is_powered(hdev)) {
2175 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2176 MGMT_STATUS_NOT_POWERED);
2177 goto unlock;
2178 }
2179
2180 if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
2181 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2182 MGMT_STATUS_NOT_SUPPORTED);
2183 goto unlock;
2184 }
2185
2186 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
2187 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
2188 MGMT_STATUS_BUSY);
2189 goto unlock;
2190 }
2191
2192 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
2193 if (!cmd) {
2194 err = -ENOMEM;
2195 goto unlock;
2196 }
2197
2198 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
2199 if (err < 0)
2200 mgmt_pending_remove(cmd);
2201
2202 unlock:
2203 hci_dev_unlock(hdev);
2204 return err;
2205 }
2206
2207 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2208 void *data, u16 len)
2209 {
2210 struct mgmt_cp_add_remote_oob_data *cp = data;
2211 u8 status;
2212 int err;
2213
2214 BT_DBG("%s ", hdev->name);
2215
2216 hci_dev_lock(hdev);
2217
2218 if (!hdev_is_powered(hdev)) {
2219 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
2220 MGMT_STATUS_NOT_POWERED, &cp->addr,
2221 sizeof(cp->addr));
2222 goto unlock;
2223 }
2224
2225 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
2226 cp->randomizer);
2227 if (err < 0)
2228 status = MGMT_STATUS_FAILED;
2229 else
2230 status = 0;
2231
2232 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
2233 &cp->addr, sizeof(cp->addr));
2234
2235 unlock:
2236 hci_dev_unlock(hdev);
2237 return err;
2238 }
2239
2240 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
2241 void *data, u16 len)
2242 {
2243 struct mgmt_cp_remove_remote_oob_data *cp = data;
2244 u8 status;
2245 int err;
2246
2247 BT_DBG("%s", hdev->name);
2248
2249 hci_dev_lock(hdev);
2250
2251 if (!hdev_is_powered(hdev)) {
2252 err = cmd_complete(sk, hdev->id,
2253 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2254 MGMT_STATUS_NOT_POWERED, &cp->addr,
2255 sizeof(cp->addr));
2256 goto unlock;
2257 }
2258
2259 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
2260 if (err < 0)
2261 status = MGMT_STATUS_INVALID_PARAMS;
2262 else
2263 status = 0;
2264
2265 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
2266 status, &cp->addr, sizeof(cp->addr));
2267
2268 unlock:
2269 hci_dev_unlock(hdev);
2270 return err;
2271 }
2272
2273 int mgmt_interleaved_discovery(struct hci_dev *hdev)
2274 {
2275 int err;
2276
2277 BT_DBG("%s", hdev->name);
2278
2279 hci_dev_lock(hdev);
2280
2281 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
2282 if (err < 0)
2283 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2284
2285 hci_dev_unlock(hdev);
2286
2287 return err;
2288 }
2289
2290 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
2291 void *data, u16 len)
2292 {
2293 struct mgmt_cp_start_discovery *cp = data;
2294 struct pending_cmd *cmd;
2295 int err;
2296
2297 BT_DBG("%s", hdev->name);
2298
2299 hci_dev_lock(hdev);
2300
2301 if (!hdev_is_powered(hdev)) {
2302 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2303 MGMT_STATUS_NOT_POWERED);
2304 goto failed;
2305 }
2306
2307 if (hdev->discovery.state != DISCOVERY_STOPPED) {
2308 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY,
2309 MGMT_STATUS_BUSY);
2310 goto failed;
2311 }
2312
2313 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
2314 if (!cmd) {
2315 err = -ENOMEM;
2316 goto failed;
2317 }
2318
2319 hdev->discovery.type = cp->type;
2320
2321 switch (hdev->discovery.type) {
2322 case DISCOV_TYPE_BREDR:
2323 if (lmp_bredr_capable(hdev))
2324 err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
2325 else
2326 err = -ENOTSUPP;
2327 break;
2328
2329 case DISCOV_TYPE_LE:
2330 if (lmp_host_le_capable(hdev))
2331 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2332 LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
2333 else
2334 err = -ENOTSUPP;
2335 break;
2336
2337 case DISCOV_TYPE_INTERLEAVED:
2338 if (lmp_host_le_capable(hdev) && lmp_bredr_capable(hdev))
2339 err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
2340 LE_SCAN_WIN,
2341 LE_SCAN_TIMEOUT_BREDR_LE);
2342 else
2343 err = -ENOTSUPP;
2344 break;
2345
2346 default:
2347 err = -EINVAL;
2348 }
2349
2350 if (err < 0)
2351 mgmt_pending_remove(cmd);
2352 else
2353 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
2354
2355 failed:
2356 hci_dev_unlock(hdev);
2357 return err;
2358 }
2359
2360 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
2361 u16 len)
2362 {
2363 struct mgmt_cp_stop_discovery *mgmt_cp = data;
2364 struct pending_cmd *cmd;
2365 struct hci_cp_remote_name_req_cancel cp;
2366 struct inquiry_entry *e;
2367 int err;
2368
2369 BT_DBG("%s", hdev->name);
2370
2371 hci_dev_lock(hdev);
2372
2373 if (!hci_discovery_active(hdev)) {
2374 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2375 MGMT_STATUS_REJECTED, &mgmt_cp->type,
2376 sizeof(mgmt_cp->type));
2377 goto unlock;
2378 }
2379
2380 if (hdev->discovery.type != mgmt_cp->type) {
2381 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
2382 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
2383 sizeof(mgmt_cp->type));
2384 goto unlock;
2385 }
2386
2387 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
2388 if (!cmd) {
2389 err = -ENOMEM;
2390 goto unlock;
2391 }
2392
2393 if (hdev->discovery.state == DISCOVERY_FINDING) {
2394 err = hci_cancel_inquiry(hdev);
2395 if (err < 0)
2396 mgmt_pending_remove(cmd);
2397 else
2398 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2399 goto unlock;
2400 }
2401
2402 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
2403 if (!e) {
2404 mgmt_pending_remove(cmd);
2405 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
2406 &mgmt_cp->type, sizeof(mgmt_cp->type));
2407 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2408 goto unlock;
2409 }
2410
2411 bacpy(&cp.bdaddr, &e->data.bdaddr);
2412 err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2413 &cp);
2414 if (err < 0)
2415 mgmt_pending_remove(cmd);
2416 else
2417 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
2418
2419 unlock:
2420 hci_dev_unlock(hdev);
2421 return err;
2422 }
2423
2424 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
2425 u16 len)
2426 {
2427 struct mgmt_cp_confirm_name *cp = data;
2428 struct inquiry_entry *e;
2429 int err;
2430
2431 BT_DBG("%s", hdev->name);
2432
2433 hci_dev_lock(hdev);
2434
2435 if (!hci_discovery_active(hdev)) {
2436 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2437 MGMT_STATUS_FAILED);
2438 goto failed;
2439 }
2440
2441 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
2442 if (!e) {
2443 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
2444 MGMT_STATUS_INVALID_PARAMS);
2445 goto failed;
2446 }
2447
2448 if (cp->name_known) {
2449 e->name_state = NAME_KNOWN;
2450 list_del(&e->list);
2451 } else {
2452 e->name_state = NAME_NEEDED;
2453 hci_inquiry_cache_update_resolve(hdev, e);
2454 }
2455
2456 err = 0;
2457
2458 failed:
2459 hci_dev_unlock(hdev);
2460 return err;
2461 }
2462
2463 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
2464 u16 len)
2465 {
2466 struct mgmt_cp_block_device *cp = data;
2467 u8 status;
2468 int err;
2469
2470 BT_DBG("%s", hdev->name);
2471
2472 hci_dev_lock(hdev);
2473
2474 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
2475 if (err < 0)
2476 status = MGMT_STATUS_FAILED;
2477 else
2478 status = 0;
2479
2480 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
2481 &cp->addr, sizeof(cp->addr));
2482
2483 hci_dev_unlock(hdev);
2484
2485 return err;
2486 }
2487
2488 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
2489 u16 len)
2490 {
2491 struct mgmt_cp_unblock_device *cp = data;
2492 u8 status;
2493 int err;
2494
2495 BT_DBG("%s", hdev->name);
2496
2497 hci_dev_lock(hdev);
2498
2499 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
2500 if (err < 0)
2501 status = MGMT_STATUS_INVALID_PARAMS;
2502 else
2503 status = 0;
2504
2505 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
2506 &cp->addr, sizeof(cp->addr));
2507
2508 hci_dev_unlock(hdev);
2509
2510 return err;
2511 }
2512
2513 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2514 void *data, u16 len)
2515 {
2516 struct mgmt_mode *cp = data;
2517 struct hci_cp_write_page_scan_activity acp;
2518 u8 type;
2519 int err;
2520
2521 BT_DBG("%s", hdev->name);
2522
2523 if (!hdev_is_powered(hdev))
2524 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2525 MGMT_STATUS_NOT_POWERED);
2526
2527 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2528 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2529 MGMT_STATUS_REJECTED);
2530
2531 hci_dev_lock(hdev);
2532
2533 if (cp->val) {
2534 type = PAGE_SCAN_TYPE_INTERLACED;
2535
2536 /* 22.5 msec page scan interval */
2537 acp.interval = __constant_cpu_to_le16(0x0024);
2538 } else {
2539 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2540
2541 /* default 1.28 sec page scan */
2542 acp.interval = __constant_cpu_to_le16(0x0800);
2543 }
2544
2545 /* default 11.25 msec page scan window */
2546 acp.window = __constant_cpu_to_le16(0x0012);
2547
2548 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2549 &acp);
2550 if (err < 0) {
2551 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2552 MGMT_STATUS_FAILED);
2553 goto done;
2554 }
2555
2556 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
2557 if (err < 0) {
2558 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
2559 MGMT_STATUS_FAILED);
2560 goto done;
2561 }
2562
2563 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 0,
2564 NULL, 0);
2565 done:
2566 hci_dev_unlock(hdev);
2567 return err;
2568 }
2569
2570 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
2571 void *cp_data, u16 len)
2572 {
2573 struct mgmt_cp_load_long_term_keys *cp = cp_data;
2574 u16 key_count, expected_len;
2575 int i;
2576
2577 key_count = get_unaligned_le16(&cp->key_count);
2578
2579 expected_len = sizeof(*cp) + key_count *
2580 sizeof(struct mgmt_ltk_info);
2581 if (expected_len != len) {
2582 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2583 len, expected_len);
2584 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
2585 EINVAL);
2586 }
2587
2588 BT_DBG("%s key_count %u", hdev->name, key_count);
2589
2590 hci_dev_lock(hdev);
2591
2592 hci_smp_ltks_clear(hdev);
2593
2594 for (i = 0; i < key_count; i++) {
2595 struct mgmt_ltk_info *key = &cp->keys[i];
2596 u8 type;
2597
2598 if (key->master)
2599 type = HCI_SMP_LTK;
2600 else
2601 type = HCI_SMP_LTK_SLAVE;
2602
2603 hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
2604 type, 0, key->authenticated, key->val,
2605 key->enc_size, key->ediv, key->rand);
2606 }
2607
2608 hci_dev_unlock(hdev);
2609
2610 return 0;
2611 }
2612
2613 struct mgmt_handler {
2614 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
2615 u16 data_len);
2616 bool var_len;
2617 size_t data_len;
2618 } mgmt_handlers[] = {
2619 { NULL }, /* 0x0000 (no command) */
2620 { read_version, false, MGMT_READ_VERSION_SIZE },
2621 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
2622 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
2623 { read_controller_info, false, MGMT_READ_INFO_SIZE },
2624 { set_powered, false, MGMT_SETTING_SIZE },
2625 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
2626 { set_connectable, false, MGMT_SETTING_SIZE },
2627 { set_fast_connectable, false, MGMT_SETTING_SIZE },
2628 { set_pairable, false, MGMT_SETTING_SIZE },
2629 { set_link_security, false, MGMT_SETTING_SIZE },
2630 { set_ssp, false, MGMT_SETTING_SIZE },
2631 { set_hs, false, MGMT_SETTING_SIZE },
2632 { set_le, false, MGMT_SETTING_SIZE },
2633 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
2634 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
2635 { add_uuid, false, MGMT_ADD_UUID_SIZE },
2636 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
2637 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
2638 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
2639 { disconnect, false, MGMT_DISCONNECT_SIZE },
2640 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
2641 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
2642 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
2643 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
2644 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
2645 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
2646 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
2647 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
2648 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
2649 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
2650 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
2651 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
2652 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
2653 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
2654 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
2655 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
2656 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
2657 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
2658 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
2659 };
2660
2661
2662 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
2663 {
2664 void *buf;
2665 u8 *cp;
2666 struct mgmt_hdr *hdr;
2667 u16 opcode, index, len;
2668 struct hci_dev *hdev = NULL;
2669 struct mgmt_handler *handler;
2670 int err;
2671
2672 BT_DBG("got %zu bytes", msglen);
2673
2674 if (msglen < sizeof(*hdr))
2675 return -EINVAL;
2676
2677 buf = kmalloc(msglen, GFP_KERNEL);
2678 if (!buf)
2679 return -ENOMEM;
2680
2681 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
2682 err = -EFAULT;
2683 goto done;
2684 }
2685
2686 hdr = buf;
2687 opcode = get_unaligned_le16(&hdr->opcode);
2688 index = get_unaligned_le16(&hdr->index);
2689 len = get_unaligned_le16(&hdr->len);
2690
2691 if (len != msglen - sizeof(*hdr)) {
2692 err = -EINVAL;
2693 goto done;
2694 }
2695
2696 if (index != MGMT_INDEX_NONE) {
2697 hdev = hci_dev_get(index);
2698 if (!hdev) {
2699 err = cmd_status(sk, index, opcode,
2700 MGMT_STATUS_INVALID_INDEX);
2701 goto done;
2702 }
2703 }
2704
2705 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
2706 mgmt_handlers[opcode].func == NULL) {
2707 BT_DBG("Unknown op %u", opcode);
2708 err = cmd_status(sk, index, opcode,
2709 MGMT_STATUS_UNKNOWN_COMMAND);
2710 goto done;
2711 }
2712
2713 if ((hdev && opcode < MGMT_OP_READ_INFO) ||
2714 (!hdev && opcode >= MGMT_OP_READ_INFO)) {
2715 err = cmd_status(sk, index, opcode,
2716 MGMT_STATUS_INVALID_INDEX);
2717 goto done;
2718 }
2719
2720 handler = &mgmt_handlers[opcode];
2721
2722 if ((handler->var_len && len < handler->data_len) ||
2723 (!handler->var_len && len != handler->data_len)) {
2724 err = cmd_status(sk, index, opcode,
2725 MGMT_STATUS_INVALID_PARAMS);
2726 goto done;
2727 }
2728
2729 if (hdev)
2730 mgmt_init_hdev(sk, hdev);
2731
2732 cp = buf + sizeof(*hdr);
2733
2734 err = handler->func(sk, hdev, cp, len);
2735 if (err < 0)
2736 goto done;
2737
2738 err = msglen;
2739
2740 done:
2741 if (hdev)
2742 hci_dev_put(hdev);
2743
2744 kfree(buf);
2745 return err;
2746 }
2747
2748 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
2749 {
2750 u8 *status = data;
2751
2752 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
2753 mgmt_pending_remove(cmd);
2754 }
2755
2756 int mgmt_index_added(struct hci_dev *hdev)
2757 {
2758 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
2759 }
2760
2761 int mgmt_index_removed(struct hci_dev *hdev)
2762 {
2763 u8 status = MGMT_STATUS_INVALID_INDEX;
2764
2765 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2766
2767 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
2768 }
2769
2770 struct cmd_lookup {
2771 struct sock *sk;
2772 struct hci_dev *hdev;
2773 u8 mgmt_status;
2774 };
2775
2776 static void settings_rsp(struct pending_cmd *cmd, void *data)
2777 {
2778 struct cmd_lookup *match = data;
2779
2780 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
2781
2782 list_del(&cmd->list);
2783
2784 if (match->sk == NULL) {
2785 match->sk = cmd->sk;
2786 sock_hold(match->sk);
2787 }
2788
2789 mgmt_pending_free(cmd);
2790 }
2791
2792 int mgmt_powered(struct hci_dev *hdev, u8 powered)
2793 {
2794 struct cmd_lookup match = { NULL, hdev };
2795 int err;
2796
2797 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2798 return 0;
2799
2800 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
2801
2802 if (powered) {
2803 u8 scan = 0;
2804
2805 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2806 scan |= SCAN_PAGE;
2807 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2808 scan |= SCAN_INQUIRY;
2809
2810 if (scan)
2811 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2812
2813 update_class(hdev);
2814 update_name(hdev, hdev->dev_name);
2815 update_eir(hdev);
2816 } else {
2817 u8 status = MGMT_STATUS_NOT_POWERED;
2818 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
2819 }
2820
2821 err = new_settings(hdev, match.sk);
2822
2823 if (match.sk)
2824 sock_put(match.sk);
2825
2826 return err;
2827 }
2828
2829 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
2830 {
2831 struct cmd_lookup match = { NULL, hdev };
2832 bool changed = false;
2833 int err = 0;
2834
2835 if (discoverable) {
2836 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2837 changed = true;
2838 } else {
2839 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
2840 changed = true;
2841 }
2842
2843 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp,
2844 &match);
2845
2846 if (changed)
2847 err = new_settings(hdev, match.sk);
2848
2849 if (match.sk)
2850 sock_put(match.sk);
2851
2852 return err;
2853 }
2854
2855 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
2856 {
2857 struct cmd_lookup match = { NULL, hdev };
2858 bool changed = false;
2859 int err = 0;
2860
2861 if (connectable) {
2862 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2863 changed = true;
2864 } else {
2865 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags))
2866 changed = true;
2867 }
2868
2869 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
2870 &match);
2871
2872 if (changed)
2873 err = new_settings(hdev, match.sk);
2874
2875 if (match.sk)
2876 sock_put(match.sk);
2877
2878 return err;
2879 }
2880
2881 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
2882 {
2883 u8 mgmt_err = mgmt_status(status);
2884
2885 if (scan & SCAN_PAGE)
2886 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev,
2887 cmd_status_rsp, &mgmt_err);
2888
2889 if (scan & SCAN_INQUIRY)
2890 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev,
2891 cmd_status_rsp, &mgmt_err);
2892
2893 return 0;
2894 }
2895
2896 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent)
2897 {
2898 struct mgmt_ev_new_link_key ev;
2899
2900 memset(&ev, 0, sizeof(ev));
2901
2902 ev.store_hint = persistent;
2903 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2904 ev.key.addr.type = MGMT_ADDR_BREDR;
2905 ev.key.type = key->type;
2906 memcpy(ev.key.val, key->val, 16);
2907 ev.key.pin_len = key->pin_len;
2908
2909 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
2910 }
2911
2912 int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
2913 {
2914 struct mgmt_ev_new_long_term_key ev;
2915
2916 memset(&ev, 0, sizeof(ev));
2917
2918 ev.store_hint = persistent;
2919 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
2920 ev.key.addr.type = key->bdaddr_type;
2921 ev.key.authenticated = key->authenticated;
2922 ev.key.enc_size = key->enc_size;
2923 ev.key.ediv = key->ediv;
2924
2925 if (key->type == HCI_SMP_LTK)
2926 ev.key.master = 1;
2927
2928 memcpy(ev.key.rand, key->rand, sizeof(key->rand));
2929 memcpy(ev.key.val, key->val, sizeof(key->val));
2930
2931 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev),
2932 NULL);
2933 }
2934
2935 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2936 u8 addr_type, u32 flags, u8 *name, u8 name_len,
2937 u8 *dev_class)
2938 {
2939 char buf[512];
2940 struct mgmt_ev_device_connected *ev = (void *) buf;
2941 u16 eir_len = 0;
2942
2943 bacpy(&ev->addr.bdaddr, bdaddr);
2944 ev->addr.type = link_to_mgmt(link_type, addr_type);
2945
2946 ev->flags = __cpu_to_le32(flags);
2947
2948 if (name_len > 0)
2949 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
2950 name, name_len);
2951
2952 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2953 eir_len = eir_append_data(ev->eir, eir_len,
2954 EIR_CLASS_OF_DEV, dev_class, 3);
2955
2956 put_unaligned_le16(eir_len, &ev->eir_len);
2957
2958 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
2959 sizeof(*ev) + eir_len, NULL);
2960 }
2961
2962 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
2963 {
2964 struct mgmt_cp_disconnect *cp = cmd->param;
2965 struct sock **sk = data;
2966 struct mgmt_rp_disconnect rp;
2967
2968 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2969 rp.addr.type = cp->addr.type;
2970
2971 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
2972 sizeof(rp));
2973
2974 *sk = cmd->sk;
2975 sock_hold(*sk);
2976
2977 mgmt_pending_remove(cmd);
2978 }
2979
2980 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
2981 {
2982 struct hci_dev *hdev = data;
2983 struct mgmt_cp_unpair_device *cp = cmd->param;
2984 struct mgmt_rp_unpair_device rp;
2985
2986 memset(&rp, 0, sizeof(rp));
2987 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2988 rp.addr.type = cp->addr.type;
2989
2990 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
2991
2992 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
2993
2994 mgmt_pending_remove(cmd);
2995 }
2996
2997 int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
2998 u8 link_type, u8 addr_type)
2999 {
3000 struct mgmt_addr_info ev;
3001 struct sock *sk = NULL;
3002 int err;
3003
3004 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
3005
3006 bacpy(&ev.bdaddr, bdaddr);
3007 ev.type = link_to_mgmt(link_type, addr_type);
3008
3009 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
3010 sk);
3011
3012 if (sk)
3013 sock_put(sk);
3014
3015 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3016 hdev);
3017
3018 return err;
3019 }
3020
3021 int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
3022 u8 link_type, u8 addr_type, u8 status)
3023 {
3024 struct mgmt_rp_disconnect rp;
3025 struct pending_cmd *cmd;
3026 int err;
3027
3028 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
3029 if (!cmd)
3030 return -ENOENT;
3031
3032 bacpy(&rp.addr.bdaddr, bdaddr);
3033 rp.addr.type = link_to_mgmt(link_type, addr_type);
3034
3035 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
3036 mgmt_status(status), &rp, sizeof(rp));
3037
3038 mgmt_pending_remove(cmd);
3039
3040 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
3041 hdev);
3042 return err;
3043 }
3044
3045 int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3046 u8 addr_type, u8 status)
3047 {
3048 struct mgmt_ev_connect_failed ev;
3049
3050 bacpy(&ev.addr.bdaddr, bdaddr);
3051 ev.addr.type = link_to_mgmt(link_type, addr_type);
3052 ev.status = mgmt_status(status);
3053
3054 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
3055 }
3056
3057 int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
3058 {
3059 struct mgmt_ev_pin_code_request ev;
3060
3061 bacpy(&ev.addr.bdaddr, bdaddr);
3062 ev.addr.type = MGMT_ADDR_BREDR;
3063 ev.secure = secure;
3064
3065 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
3066 NULL);
3067 }
3068
3069 int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3070 u8 status)
3071 {
3072 struct pending_cmd *cmd;
3073 struct mgmt_rp_pin_code_reply rp;
3074 int err;
3075
3076 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
3077 if (!cmd)
3078 return -ENOENT;
3079
3080 bacpy(&rp.addr.bdaddr, bdaddr);
3081 rp.addr.type = MGMT_ADDR_BREDR;
3082
3083 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3084 mgmt_status(status), &rp, sizeof(rp));
3085
3086 mgmt_pending_remove(cmd);
3087
3088 return err;
3089 }
3090
3091 int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3092 u8 status)
3093 {
3094 struct pending_cmd *cmd;
3095 struct mgmt_rp_pin_code_reply rp;
3096 int err;
3097
3098 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
3099 if (!cmd)
3100 return -ENOENT;
3101
3102 bacpy(&rp.addr.bdaddr, bdaddr);
3103 rp.addr.type = MGMT_ADDR_BREDR;
3104
3105 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
3106 mgmt_status(status), &rp, sizeof(rp));
3107
3108 mgmt_pending_remove(cmd);
3109
3110 return err;
3111 }
3112
3113 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3114 u8 link_type, u8 addr_type, __le32 value,
3115 u8 confirm_hint)
3116 {
3117 struct mgmt_ev_user_confirm_request ev;
3118
3119 BT_DBG("%s", hdev->name);
3120
3121 bacpy(&ev.addr.bdaddr, bdaddr);
3122 ev.addr.type = link_to_mgmt(link_type, addr_type);
3123 ev.confirm_hint = confirm_hint;
3124 ev.value = value;
3125
3126 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
3127 NULL);
3128 }
3129
3130 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
3131 u8 link_type, u8 addr_type)
3132 {
3133 struct mgmt_ev_user_passkey_request ev;
3134
3135 BT_DBG("%s", hdev->name);
3136
3137 bacpy(&ev.addr.bdaddr, bdaddr);
3138 ev.addr.type = link_to_mgmt(link_type, addr_type);
3139
3140 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
3141 NULL);
3142 }
3143
3144 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3145 u8 link_type, u8 addr_type, u8 status,
3146 u8 opcode)
3147 {
3148 struct pending_cmd *cmd;
3149 struct mgmt_rp_user_confirm_reply rp;
3150 int err;
3151
3152 cmd = mgmt_pending_find(opcode, hdev);
3153 if (!cmd)
3154 return -ENOENT;
3155
3156 bacpy(&rp.addr.bdaddr, bdaddr);
3157 rp.addr.type = link_to_mgmt(link_type, addr_type);
3158 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
3159 &rp, sizeof(rp));
3160
3161 mgmt_pending_remove(cmd);
3162
3163 return err;
3164 }
3165
3166 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3167 u8 link_type, u8 addr_type, u8 status)
3168 {
3169 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3170 status, MGMT_OP_USER_CONFIRM_REPLY);
3171 }
3172
3173 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3174 u8 link_type, u8 addr_type, u8 status)
3175 {
3176 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3177 status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
3178 }
3179
3180 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3181 u8 link_type, u8 addr_type, u8 status)
3182 {
3183 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3184 status, MGMT_OP_USER_PASSKEY_REPLY);
3185 }
3186
3187 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
3188 u8 link_type, u8 addr_type, u8 status)
3189 {
3190 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
3191 status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
3192 }
3193
3194 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3195 u8 addr_type, u8 status)
3196 {
3197 struct mgmt_ev_auth_failed ev;
3198
3199 bacpy(&ev.addr.bdaddr, bdaddr);
3200 ev.addr.type = link_to_mgmt(link_type, addr_type);
3201 ev.status = mgmt_status(status);
3202
3203 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
3204 }
3205
3206 int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
3207 {
3208 struct cmd_lookup match = { NULL, hdev };
3209 bool changed = false;
3210 int err = 0;
3211
3212 if (status) {
3213 u8 mgmt_err = mgmt_status(status);
3214 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
3215 cmd_status_rsp, &mgmt_err);
3216 return 0;
3217 }
3218
3219 if (test_bit(HCI_AUTH, &hdev->flags)) {
3220 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3221 changed = true;
3222 } else {
3223 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
3224 changed = true;
3225 }
3226
3227 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
3228 &match);
3229
3230 if (changed)
3231 err = new_settings(hdev, match.sk);
3232
3233 if (match.sk)
3234 sock_put(match.sk);
3235
3236 return err;
3237 }
3238
3239 static int clear_eir(struct hci_dev *hdev)
3240 {
3241 struct hci_cp_write_eir cp;
3242
3243 if (!(hdev->features[6] & LMP_EXT_INQ))
3244 return 0;
3245
3246 memset(hdev->eir, 0, sizeof(hdev->eir));
3247
3248 memset(&cp, 0, sizeof(cp));
3249
3250 return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
3251 }
3252
3253 int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3254 {
3255 struct cmd_lookup match = { NULL, hdev };
3256 bool changed = false;
3257 int err = 0;
3258
3259 if (status) {
3260 u8 mgmt_err = mgmt_status(status);
3261
3262 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
3263 &hdev->dev_flags))
3264 err = new_settings(hdev, NULL);
3265
3266 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
3267 &mgmt_err);
3268
3269 return err;
3270 }
3271
3272 if (enable) {
3273 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3274 changed = true;
3275 } else {
3276 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3277 changed = true;
3278 }
3279
3280 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
3281
3282 if (changed)
3283 err = new_settings(hdev, match.sk);
3284
3285 if (match.sk)
3286 sock_put(match.sk);
3287
3288 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
3289 update_eir(hdev);
3290 else
3291 clear_eir(hdev);
3292
3293 return err;
3294 }
3295
3296 static void class_rsp(struct pending_cmd *cmd, void *data)
3297 {
3298 struct cmd_lookup *match = data;
3299
3300 cmd_complete(cmd->sk, cmd->index, cmd->opcode, match->mgmt_status,
3301 match->hdev->dev_class, 3);
3302
3303 list_del(&cmd->list);
3304
3305 if (match->sk == NULL) {
3306 match->sk = cmd->sk;
3307 sock_hold(match->sk);
3308 }
3309
3310 mgmt_pending_free(cmd);
3311 }
3312
3313 int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
3314 u8 status)
3315 {
3316 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
3317 int err = 0;
3318
3319 clear_bit(HCI_PENDING_CLASS, &hdev->dev_flags);
3320
3321 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, class_rsp, &match);
3322 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, class_rsp, &match);
3323 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, class_rsp, &match);
3324
3325 if (!status)
3326 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class,
3327 3, NULL);
3328
3329 if (match.sk)
3330 sock_put(match.sk);
3331
3332 return err;
3333 }
3334
3335 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
3336 {
3337 struct pending_cmd *cmd;
3338 struct mgmt_cp_set_local_name ev;
3339 bool changed = false;
3340 int err = 0;
3341
3342 if (memcmp(name, hdev->dev_name, sizeof(hdev->dev_name)) != 0) {
3343 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
3344 changed = true;
3345 }
3346
3347 memset(&ev, 0, sizeof(ev));
3348 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
3349 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
3350
3351 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3352 if (!cmd)
3353 goto send_event;
3354
3355 /* Always assume that either the short or the complete name has
3356 * changed if there was a pending mgmt command */
3357 changed = true;
3358
3359 if (status) {
3360 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3361 mgmt_status(status));
3362 goto failed;
3363 }
3364
3365 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
3366 sizeof(ev));
3367 if (err < 0)
3368 goto failed;
3369
3370 send_event:
3371 if (changed)
3372 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev,
3373 sizeof(ev), cmd ? cmd->sk : NULL);
3374
3375 update_eir(hdev);
3376
3377 failed:
3378 if (cmd)
3379 mgmt_pending_remove(cmd);
3380 return err;
3381 }
3382
3383 int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
3384 u8 *randomizer, u8 status)
3385 {
3386 struct pending_cmd *cmd;
3387 int err;
3388
3389 BT_DBG("%s status %u", hdev->name, status);
3390
3391 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3392 if (!cmd)
3393 return -ENOENT;
3394
3395 if (status) {
3396 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3397 mgmt_status(status));
3398 } else {
3399 struct mgmt_rp_read_local_oob_data rp;
3400
3401 memcpy(rp.hash, hash, sizeof(rp.hash));
3402 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
3403
3404 err = cmd_complete(cmd->sk, hdev->id,
3405 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp,
3406 sizeof(rp));
3407 }
3408
3409 mgmt_pending_remove(cmd);
3410
3411 return err;
3412 }
3413
3414 int mgmt_le_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
3415 {
3416 struct cmd_lookup match = { NULL, hdev };
3417 bool changed = false;
3418 int err = 0;
3419
3420 if (status) {
3421 u8 mgmt_err = mgmt_status(status);
3422
3423 if (enable && test_and_clear_bit(HCI_LE_ENABLED,
3424 &hdev->dev_flags))
3425 err = new_settings(hdev, NULL);
3426
3427 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev,
3428 cmd_status_rsp, &mgmt_err);
3429
3430 return err;
3431 }
3432
3433 if (enable) {
3434 if (!test_and_set_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3435 changed = true;
3436 } else {
3437 if (test_and_clear_bit(HCI_LE_ENABLED, &hdev->dev_flags))
3438 changed = true;
3439 }
3440
3441 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
3442
3443 if (changed)
3444 err = new_settings(hdev, match.sk);
3445
3446 if (match.sk)
3447 sock_put(match.sk);
3448
3449 return err;
3450 }
3451
3452 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3453 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
3454 ssp, u8 *eir, u16 eir_len)
3455 {
3456 char buf[512];
3457 struct mgmt_ev_device_found *ev = (void *) buf;
3458 size_t ev_size;
3459
3460 /* Leave 5 bytes for a potential CoD field */
3461 if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
3462 return -EINVAL;
3463
3464 memset(buf, 0, sizeof(buf));
3465
3466 bacpy(&ev->addr.bdaddr, bdaddr);
3467 ev->addr.type = link_to_mgmt(link_type, addr_type);
3468 ev->rssi = rssi;
3469 if (cfm_name)
3470 ev->flags[0] |= MGMT_DEV_FOUND_CONFIRM_NAME;
3471 if (!ssp)
3472 ev->flags[0] |= MGMT_DEV_FOUND_LEGACY_PAIRING;
3473
3474 if (eir_len > 0)
3475 memcpy(ev->eir, eir, eir_len);
3476
3477 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
3478 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
3479 dev_class, 3);
3480
3481 put_unaligned_le16(eir_len, &ev->eir_len);
3482
3483 ev_size = sizeof(*ev) + eir_len;
3484
3485 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
3486 }
3487
3488 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
3489 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
3490 {
3491 struct mgmt_ev_device_found *ev;
3492 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
3493 u16 eir_len;
3494
3495 ev = (struct mgmt_ev_device_found *) buf;
3496
3497 memset(buf, 0, sizeof(buf));
3498
3499 bacpy(&ev->addr.bdaddr, bdaddr);
3500 ev->addr.type = link_to_mgmt(link_type, addr_type);
3501 ev->rssi = rssi;
3502
3503 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
3504 name_len);
3505
3506 put_unaligned_le16(eir_len, &ev->eir_len);
3507
3508 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
3509 sizeof(*ev) + eir_len, NULL);
3510 }
3511
3512 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
3513 {
3514 struct pending_cmd *cmd;
3515 u8 type;
3516 int err;
3517
3518 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3519
3520 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3521 if (!cmd)
3522 return -ENOENT;
3523
3524 type = hdev->discovery.type;
3525
3526 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3527 &type, sizeof(type));
3528 mgmt_pending_remove(cmd);
3529
3530 return err;
3531 }
3532
3533 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
3534 {
3535 struct pending_cmd *cmd;
3536 int err;
3537
3538 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3539 if (!cmd)
3540 return -ENOENT;
3541
3542 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
3543 &hdev->discovery.type, sizeof(hdev->discovery.type));
3544 mgmt_pending_remove(cmd);
3545
3546 return err;
3547 }
3548
3549 int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
3550 {
3551 struct mgmt_ev_discovering ev;
3552 struct pending_cmd *cmd;
3553
3554 BT_DBG("%s discovering %u", hdev->name, discovering);
3555
3556 if (discovering)
3557 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3558 else
3559 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
3560
3561 if (cmd != NULL) {
3562 u8 type = hdev->discovery.type;
3563
3564 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type,
3565 sizeof(type));
3566 mgmt_pending_remove(cmd);
3567 }
3568
3569 memset(&ev, 0, sizeof(ev));
3570 ev.type = hdev->discovery.type;
3571 ev.discovering = discovering;
3572
3573 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
3574 }
3575
3576 int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3577 {
3578 struct pending_cmd *cmd;
3579 struct mgmt_ev_device_blocked ev;
3580
3581 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
3582
3583 bacpy(&ev.addr.bdaddr, bdaddr);
3584 ev.addr.type = type;
3585
3586 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
3587 cmd ? cmd->sk : NULL);
3588 }
3589
3590 int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3591 {
3592 struct pending_cmd *cmd;
3593 struct mgmt_ev_device_unblocked ev;
3594
3595 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
3596
3597 bacpy(&ev.addr.bdaddr, bdaddr);
3598 ev.addr.type = type;
3599
3600 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
3601 cmd ? cmd->sk : NULL);
3602 }
3603
3604 module_param(enable_hs, bool, 0644);
3605 MODULE_PARM_DESC(enable_hs, "Enable High Speed support");
3606
3607 module_param(enable_le, bool, 0644);
3608 MODULE_PARM_DESC(enable_le, "Enable Low Energy support");
kernel source for telekom puls (alcatel/mediatek)