mgmt.c revision 03d87419defc809261c4953e5b44f9e0c8f9029a
1/* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23*/ 24 25/* Bluetooth HCI Management interface */ 26 27#include <linux/module.h> 28#include <asm/unaligned.h> 29 30#include <net/bluetooth/bluetooth.h> 31#include <net/bluetooth/hci_core.h> 32#include <net/bluetooth/mgmt.h> 33#include <net/bluetooth/smp.h> 34 35#define MGMT_VERSION 1 36#define MGMT_REVISION 4 37 38static const u16 mgmt_commands[] = { 39 MGMT_OP_READ_INDEX_LIST, 40 MGMT_OP_READ_INFO, 41 MGMT_OP_SET_POWERED, 42 MGMT_OP_SET_DISCOVERABLE, 43 MGMT_OP_SET_CONNECTABLE, 44 MGMT_OP_SET_FAST_CONNECTABLE, 45 MGMT_OP_SET_PAIRABLE, 46 MGMT_OP_SET_LINK_SECURITY, 47 MGMT_OP_SET_SSP, 48 MGMT_OP_SET_HS, 49 MGMT_OP_SET_LE, 50 MGMT_OP_SET_DEV_CLASS, 51 MGMT_OP_SET_LOCAL_NAME, 52 MGMT_OP_ADD_UUID, 53 MGMT_OP_REMOVE_UUID, 54 MGMT_OP_LOAD_LINK_KEYS, 55 MGMT_OP_LOAD_LONG_TERM_KEYS, 56 MGMT_OP_DISCONNECT, 57 MGMT_OP_GET_CONNECTIONS, 58 MGMT_OP_PIN_CODE_REPLY, 59 MGMT_OP_PIN_CODE_NEG_REPLY, 60 MGMT_OP_SET_IO_CAPABILITY, 61 MGMT_OP_PAIR_DEVICE, 62 MGMT_OP_CANCEL_PAIR_DEVICE, 63 MGMT_OP_UNPAIR_DEVICE, 64 MGMT_OP_USER_CONFIRM_REPLY, 65 MGMT_OP_USER_CONFIRM_NEG_REPLY, 66 MGMT_OP_USER_PASSKEY_REPLY, 67 MGMT_OP_USER_PASSKEY_NEG_REPLY, 68 MGMT_OP_READ_LOCAL_OOB_DATA, 69 MGMT_OP_ADD_REMOTE_OOB_DATA, 70 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 71 MGMT_OP_START_DISCOVERY, 72 MGMT_OP_STOP_DISCOVERY, 73 MGMT_OP_CONFIRM_NAME, 74 MGMT_OP_BLOCK_DEVICE, 75 MGMT_OP_UNBLOCK_DEVICE, 76 MGMT_OP_SET_DEVICE_ID, 77 MGMT_OP_SET_ADVERTISING, 78 MGMT_OP_SET_BREDR, 79 MGMT_OP_SET_STATIC_ADDRESS, 80}; 81 82static const u16 mgmt_events[] = { 83 MGMT_EV_CONTROLLER_ERROR, 84 MGMT_EV_INDEX_ADDED, 85 MGMT_EV_INDEX_REMOVED, 86 MGMT_EV_NEW_SETTINGS, 87 MGMT_EV_CLASS_OF_DEV_CHANGED, 88 MGMT_EV_LOCAL_NAME_CHANGED, 89 MGMT_EV_NEW_LINK_KEY, 90 MGMT_EV_NEW_LONG_TERM_KEY, 91 MGMT_EV_DEVICE_CONNECTED, 92 MGMT_EV_DEVICE_DISCONNECTED, 93 MGMT_EV_CONNECT_FAILED, 94 MGMT_EV_PIN_CODE_REQUEST, 95 MGMT_EV_USER_CONFIRM_REQUEST, 96 MGMT_EV_USER_PASSKEY_REQUEST, 97 MGMT_EV_AUTH_FAILED, 98 MGMT_EV_DEVICE_FOUND, 99 MGMT_EV_DISCOVERING, 100 MGMT_EV_DEVICE_BLOCKED, 101 MGMT_EV_DEVICE_UNBLOCKED, 102 MGMT_EV_DEVICE_UNPAIRED, 103 MGMT_EV_PASSKEY_NOTIFY, 104}; 105 106#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 107 108#define hdev_is_powered(hdev) (test_bit(HCI_UP, &hdev->flags) && \ 109 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) 110 111struct pending_cmd { 112 struct list_head list; 113 u16 opcode; 114 int index; 115 void *param; 116 struct sock *sk; 117 void *user_data; 118}; 119 120/* HCI to MGMT error code conversion table */ 121static u8 mgmt_status_table[] = { 122 MGMT_STATUS_SUCCESS, 123 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 124 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 125 MGMT_STATUS_FAILED, /* Hardware Failure */ 126 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 127 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 128 MGMT_STATUS_NOT_PAIRED, /* PIN or Key Missing */ 129 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 130 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 131 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 132 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 133 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 134 MGMT_STATUS_BUSY, /* Command Disallowed */ 135 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 136 MGMT_STATUS_REJECTED, /* Rejected Security */ 137 MGMT_STATUS_REJECTED, /* Rejected Personal */ 138 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 139 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 140 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 141 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 142 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 143 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 144 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 145 MGMT_STATUS_BUSY, /* Repeated Attempts */ 146 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 147 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 148 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 149 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 150 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 151 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 152 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 153 MGMT_STATUS_FAILED, /* Unspecified Error */ 154 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 155 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 156 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 157 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 158 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 159 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 160 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 161 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 162 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 163 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 164 MGMT_STATUS_FAILED, /* Transaction Collision */ 165 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 166 MGMT_STATUS_REJECTED, /* QoS Rejected */ 167 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 168 MGMT_STATUS_REJECTED, /* Insufficient Security */ 169 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 170 MGMT_STATUS_BUSY, /* Role Switch Pending */ 171 MGMT_STATUS_FAILED, /* Slot Violation */ 172 MGMT_STATUS_FAILED, /* Role Switch Failed */ 173 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 174 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 175 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 176 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 177 MGMT_STATUS_BUSY, /* Controller Busy */ 178 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 179 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 180 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 181 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 182 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 183}; 184 185bool mgmt_valid_hdev(struct hci_dev *hdev) 186{ 187 return hdev->dev_type == HCI_BREDR; 188} 189 190static u8 mgmt_status(u8 hci_status) 191{ 192 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 193 return mgmt_status_table[hci_status]; 194 195 return MGMT_STATUS_FAILED; 196} 197 198static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status) 199{ 200 struct sk_buff *skb; 201 struct mgmt_hdr *hdr; 202 struct mgmt_ev_cmd_status *ev; 203 int err; 204 205 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status); 206 207 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL); 208 if (!skb) 209 return -ENOMEM; 210 211 hdr = (void *) skb_put(skb, sizeof(*hdr)); 212 213 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_STATUS); 214 hdr->index = cpu_to_le16(index); 215 hdr->len = cpu_to_le16(sizeof(*ev)); 216 217 ev = (void *) skb_put(skb, sizeof(*ev)); 218 ev->status = status; 219 ev->opcode = cpu_to_le16(cmd); 220 221 err = sock_queue_rcv_skb(sk, skb); 222 if (err < 0) 223 kfree_skb(skb); 224 225 return err; 226} 227 228static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status, 229 void *rp, size_t rp_len) 230{ 231 struct sk_buff *skb; 232 struct mgmt_hdr *hdr; 233 struct mgmt_ev_cmd_complete *ev; 234 int err; 235 236 BT_DBG("sock %p", sk); 237 238 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL); 239 if (!skb) 240 return -ENOMEM; 241 242 hdr = (void *) skb_put(skb, sizeof(*hdr)); 243 244 hdr->opcode = __constant_cpu_to_le16(MGMT_EV_CMD_COMPLETE); 245 hdr->index = cpu_to_le16(index); 246 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len); 247 248 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len); 249 ev->opcode = cpu_to_le16(cmd); 250 ev->status = status; 251 252 if (rp) 253 memcpy(ev->data, rp, rp_len); 254 255 err = sock_queue_rcv_skb(sk, skb); 256 if (err < 0) 257 kfree_skb(skb); 258 259 return err; 260} 261 262static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 263 u16 data_len) 264{ 265 struct mgmt_rp_read_version rp; 266 267 BT_DBG("sock %p", sk); 268 269 rp.version = MGMT_VERSION; 270 rp.revision = __constant_cpu_to_le16(MGMT_REVISION); 271 272 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp, 273 sizeof(rp)); 274} 275 276static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 277 u16 data_len) 278{ 279 struct mgmt_rp_read_commands *rp; 280 const u16 num_commands = ARRAY_SIZE(mgmt_commands); 281 const u16 num_events = ARRAY_SIZE(mgmt_events); 282 __le16 *opcode; 283 size_t rp_size; 284 int i, err; 285 286 BT_DBG("sock %p", sk); 287 288 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 289 290 rp = kmalloc(rp_size, GFP_KERNEL); 291 if (!rp) 292 return -ENOMEM; 293 294 rp->num_commands = __constant_cpu_to_le16(num_commands); 295 rp->num_events = __constant_cpu_to_le16(num_events); 296 297 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++) 298 put_unaligned_le16(mgmt_commands[i], opcode); 299 300 for (i = 0; i < num_events; i++, opcode++) 301 put_unaligned_le16(mgmt_events[i], opcode); 302 303 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp, 304 rp_size); 305 kfree(rp); 306 307 return err; 308} 309 310static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 311 u16 data_len) 312{ 313 struct mgmt_rp_read_index_list *rp; 314 struct hci_dev *d; 315 size_t rp_len; 316 u16 count; 317 int err; 318 319 BT_DBG("sock %p", sk); 320 321 read_lock(&hci_dev_list_lock); 322 323 count = 0; 324 list_for_each_entry(d, &hci_dev_list, list) { 325 if (!mgmt_valid_hdev(d)) 326 continue; 327 328 count++; 329 } 330 331 rp_len = sizeof(*rp) + (2 * count); 332 rp = kmalloc(rp_len, GFP_ATOMIC); 333 if (!rp) { 334 read_unlock(&hci_dev_list_lock); 335 return -ENOMEM; 336 } 337 338 count = 0; 339 list_for_each_entry(d, &hci_dev_list, list) { 340 if (test_bit(HCI_SETUP, &d->dev_flags)) 341 continue; 342 343 if (test_bit(HCI_USER_CHANNEL, &d->dev_flags)) 344 continue; 345 346 if (!mgmt_valid_hdev(d)) 347 continue; 348 349 rp->index[count++] = cpu_to_le16(d->id); 350 BT_DBG("Added hci%u", d->id); 351 } 352 353 rp->num_controllers = cpu_to_le16(count); 354 rp_len = sizeof(*rp) + (2 * count); 355 356 read_unlock(&hci_dev_list_lock); 357 358 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp, 359 rp_len); 360 361 kfree(rp); 362 363 return err; 364} 365 366static u32 get_supported_settings(struct hci_dev *hdev) 367{ 368 u32 settings = 0; 369 370 settings |= MGMT_SETTING_POWERED; 371 settings |= MGMT_SETTING_PAIRABLE; 372 373 if (lmp_ssp_capable(hdev)) 374 settings |= MGMT_SETTING_SSP; 375 376 if (lmp_bredr_capable(hdev)) { 377 settings |= MGMT_SETTING_CONNECTABLE; 378 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 379 settings |= MGMT_SETTING_FAST_CONNECTABLE; 380 settings |= MGMT_SETTING_DISCOVERABLE; 381 settings |= MGMT_SETTING_BREDR; 382 settings |= MGMT_SETTING_LINK_SECURITY; 383 settings |= MGMT_SETTING_HS; 384 } 385 386 if (lmp_le_capable(hdev)) { 387 settings |= MGMT_SETTING_LE; 388 settings |= MGMT_SETTING_ADVERTISING; 389 } 390 391 return settings; 392} 393 394static u32 get_current_settings(struct hci_dev *hdev) 395{ 396 u32 settings = 0; 397 398 if (hdev_is_powered(hdev)) 399 settings |= MGMT_SETTING_POWERED; 400 401 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 402 settings |= MGMT_SETTING_CONNECTABLE; 403 404 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) 405 settings |= MGMT_SETTING_FAST_CONNECTABLE; 406 407 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 408 settings |= MGMT_SETTING_DISCOVERABLE; 409 410 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags)) 411 settings |= MGMT_SETTING_PAIRABLE; 412 413 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 414 settings |= MGMT_SETTING_BREDR; 415 416 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 417 settings |= MGMT_SETTING_LE; 418 419 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 420 settings |= MGMT_SETTING_LINK_SECURITY; 421 422 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 423 settings |= MGMT_SETTING_SSP; 424 425 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags)) 426 settings |= MGMT_SETTING_HS; 427 428 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) 429 settings |= MGMT_SETTING_ADVERTISING; 430 431 return settings; 432} 433 434#define PNP_INFO_SVCLASS_ID 0x1200 435 436static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 437{ 438 u8 *ptr = data, *uuids_start = NULL; 439 struct bt_uuid *uuid; 440 441 if (len < 4) 442 return ptr; 443 444 list_for_each_entry(uuid, &hdev->uuids, list) { 445 u16 uuid16; 446 447 if (uuid->size != 16) 448 continue; 449 450 uuid16 = get_unaligned_le16(&uuid->uuid[12]); 451 if (uuid16 < 0x1100) 452 continue; 453 454 if (uuid16 == PNP_INFO_SVCLASS_ID) 455 continue; 456 457 if (!uuids_start) { 458 uuids_start = ptr; 459 uuids_start[0] = 1; 460 uuids_start[1] = EIR_UUID16_ALL; 461 ptr += 2; 462 } 463 464 /* Stop if not enough space to put next UUID */ 465 if ((ptr - data) + sizeof(u16) > len) { 466 uuids_start[1] = EIR_UUID16_SOME; 467 break; 468 } 469 470 *ptr++ = (uuid16 & 0x00ff); 471 *ptr++ = (uuid16 & 0xff00) >> 8; 472 uuids_start[0] += sizeof(uuid16); 473 } 474 475 return ptr; 476} 477 478static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 479{ 480 u8 *ptr = data, *uuids_start = NULL; 481 struct bt_uuid *uuid; 482 483 if (len < 6) 484 return ptr; 485 486 list_for_each_entry(uuid, &hdev->uuids, list) { 487 if (uuid->size != 32) 488 continue; 489 490 if (!uuids_start) { 491 uuids_start = ptr; 492 uuids_start[0] = 1; 493 uuids_start[1] = EIR_UUID32_ALL; 494 ptr += 2; 495 } 496 497 /* Stop if not enough space to put next UUID */ 498 if ((ptr - data) + sizeof(u32) > len) { 499 uuids_start[1] = EIR_UUID32_SOME; 500 break; 501 } 502 503 memcpy(ptr, &uuid->uuid[12], sizeof(u32)); 504 ptr += sizeof(u32); 505 uuids_start[0] += sizeof(u32); 506 } 507 508 return ptr; 509} 510 511static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 512{ 513 u8 *ptr = data, *uuids_start = NULL; 514 struct bt_uuid *uuid; 515 516 if (len < 18) 517 return ptr; 518 519 list_for_each_entry(uuid, &hdev->uuids, list) { 520 if (uuid->size != 128) 521 continue; 522 523 if (!uuids_start) { 524 uuids_start = ptr; 525 uuids_start[0] = 1; 526 uuids_start[1] = EIR_UUID128_ALL; 527 ptr += 2; 528 } 529 530 /* Stop if not enough space to put next UUID */ 531 if ((ptr - data) + 16 > len) { 532 uuids_start[1] = EIR_UUID128_SOME; 533 break; 534 } 535 536 memcpy(ptr, uuid->uuid, 16); 537 ptr += 16; 538 uuids_start[0] += 16; 539 } 540 541 return ptr; 542} 543 544static void create_eir(struct hci_dev *hdev, u8 *data) 545{ 546 u8 *ptr = data; 547 size_t name_len; 548 549 name_len = strlen(hdev->dev_name); 550 551 if (name_len > 0) { 552 /* EIR Data type */ 553 if (name_len > 48) { 554 name_len = 48; 555 ptr[1] = EIR_NAME_SHORT; 556 } else 557 ptr[1] = EIR_NAME_COMPLETE; 558 559 /* EIR Data length */ 560 ptr[0] = name_len + 1; 561 562 memcpy(ptr + 2, hdev->dev_name, name_len); 563 564 ptr += (name_len + 2); 565 } 566 567 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) { 568 ptr[0] = 2; 569 ptr[1] = EIR_TX_POWER; 570 ptr[2] = (u8) hdev->inq_tx_power; 571 572 ptr += 3; 573 } 574 575 if (hdev->devid_source > 0) { 576 ptr[0] = 9; 577 ptr[1] = EIR_DEVICE_ID; 578 579 put_unaligned_le16(hdev->devid_source, ptr + 2); 580 put_unaligned_le16(hdev->devid_vendor, ptr + 4); 581 put_unaligned_le16(hdev->devid_product, ptr + 6); 582 put_unaligned_le16(hdev->devid_version, ptr + 8); 583 584 ptr += 10; 585 } 586 587 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 588 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 589 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 590} 591 592static void update_eir(struct hci_request *req) 593{ 594 struct hci_dev *hdev = req->hdev; 595 struct hci_cp_write_eir cp; 596 597 if (!hdev_is_powered(hdev)) 598 return; 599 600 if (!lmp_ext_inq_capable(hdev)) 601 return; 602 603 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 604 return; 605 606 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 607 return; 608 609 memset(&cp, 0, sizeof(cp)); 610 611 create_eir(hdev, cp.data); 612 613 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 614 return; 615 616 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 617 618 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 619} 620 621static u8 get_service_classes(struct hci_dev *hdev) 622{ 623 struct bt_uuid *uuid; 624 u8 val = 0; 625 626 list_for_each_entry(uuid, &hdev->uuids, list) 627 val |= uuid->svc_hint; 628 629 return val; 630} 631 632static void update_class(struct hci_request *req) 633{ 634 struct hci_dev *hdev = req->hdev; 635 u8 cod[3]; 636 637 BT_DBG("%s", hdev->name); 638 639 if (!hdev_is_powered(hdev)) 640 return; 641 642 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 643 return; 644 645 cod[0] = hdev->minor_class; 646 cod[1] = hdev->major_class; 647 cod[2] = get_service_classes(hdev); 648 649 if (memcmp(cod, hdev->dev_class, 3) == 0) 650 return; 651 652 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod); 653} 654 655static void service_cache_off(struct work_struct *work) 656{ 657 struct hci_dev *hdev = container_of(work, struct hci_dev, 658 service_cache.work); 659 struct hci_request req; 660 661 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) 662 return; 663 664 hci_req_init(&req, hdev); 665 666 hci_dev_lock(hdev); 667 668 update_eir(&req); 669 update_class(&req); 670 671 hci_dev_unlock(hdev); 672 673 hci_req_run(&req, NULL); 674} 675 676static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 677{ 678 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags)) 679 return; 680 681 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 682 683 /* Non-mgmt controlled devices get this bit set 684 * implicitly so that pairing works for them, however 685 * for mgmt we require user-space to explicitly enable 686 * it 687 */ 688 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 689} 690 691static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 692 void *data, u16 data_len) 693{ 694 struct mgmt_rp_read_info rp; 695 696 BT_DBG("sock %p %s", sk, hdev->name); 697 698 hci_dev_lock(hdev); 699 700 memset(&rp, 0, sizeof(rp)); 701 702 bacpy(&rp.bdaddr, &hdev->bdaddr); 703 704 rp.version = hdev->hci_ver; 705 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 706 707 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 708 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 709 710 memcpy(rp.dev_class, hdev->dev_class, 3); 711 712 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 713 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 714 715 hci_dev_unlock(hdev); 716 717 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 718 sizeof(rp)); 719} 720 721static void mgmt_pending_free(struct pending_cmd *cmd) 722{ 723 sock_put(cmd->sk); 724 kfree(cmd->param); 725 kfree(cmd); 726} 727 728static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode, 729 struct hci_dev *hdev, void *data, 730 u16 len) 731{ 732 struct pending_cmd *cmd; 733 734 cmd = kmalloc(sizeof(*cmd), GFP_KERNEL); 735 if (!cmd) 736 return NULL; 737 738 cmd->opcode = opcode; 739 cmd->index = hdev->id; 740 741 cmd->param = kmalloc(len, GFP_KERNEL); 742 if (!cmd->param) { 743 kfree(cmd); 744 return NULL; 745 } 746 747 if (data) 748 memcpy(cmd->param, data, len); 749 750 cmd->sk = sk; 751 sock_hold(sk); 752 753 list_add(&cmd->list, &hdev->mgmt_pending); 754 755 return cmd; 756} 757 758static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev, 759 void (*cb)(struct pending_cmd *cmd, 760 void *data), 761 void *data) 762{ 763 struct pending_cmd *cmd, *tmp; 764 765 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) { 766 if (opcode > 0 && cmd->opcode != opcode) 767 continue; 768 769 cb(cmd, data); 770 } 771} 772 773static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev) 774{ 775 struct pending_cmd *cmd; 776 777 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 778 if (cmd->opcode == opcode) 779 return cmd; 780 } 781 782 return NULL; 783} 784 785static void mgmt_pending_remove(struct pending_cmd *cmd) 786{ 787 list_del(&cmd->list); 788 mgmt_pending_free(cmd); 789} 790 791static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 792{ 793 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 794 795 return cmd_complete(sk, hdev->id, opcode, 0, &settings, 796 sizeof(settings)); 797} 798 799static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 800 u16 len) 801{ 802 struct mgmt_mode *cp = data; 803 struct pending_cmd *cmd; 804 int err; 805 806 BT_DBG("request for %s", hdev->name); 807 808 if (cp->val != 0x00 && cp->val != 0x01) 809 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 810 MGMT_STATUS_INVALID_PARAMS); 811 812 hci_dev_lock(hdev); 813 814 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) { 815 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 816 MGMT_STATUS_BUSY); 817 goto failed; 818 } 819 820 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) { 821 cancel_delayed_work(&hdev->power_off); 822 823 if (cp->val) { 824 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, 825 data, len); 826 err = mgmt_powered(hdev, 1); 827 goto failed; 828 } 829 } 830 831 if (!!cp->val == hdev_is_powered(hdev)) { 832 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 833 goto failed; 834 } 835 836 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 837 if (!cmd) { 838 err = -ENOMEM; 839 goto failed; 840 } 841 842 if (cp->val) 843 queue_work(hdev->req_workqueue, &hdev->power_on); 844 else 845 queue_work(hdev->req_workqueue, &hdev->power_off.work); 846 847 err = 0; 848 849failed: 850 hci_dev_unlock(hdev); 851 return err; 852} 853 854static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len, 855 struct sock *skip_sk) 856{ 857 struct sk_buff *skb; 858 struct mgmt_hdr *hdr; 859 860 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL); 861 if (!skb) 862 return -ENOMEM; 863 864 hdr = (void *) skb_put(skb, sizeof(*hdr)); 865 hdr->opcode = cpu_to_le16(event); 866 if (hdev) 867 hdr->index = cpu_to_le16(hdev->id); 868 else 869 hdr->index = __constant_cpu_to_le16(MGMT_INDEX_NONE); 870 hdr->len = cpu_to_le16(data_len); 871 872 if (data) 873 memcpy(skb_put(skb, data_len), data, data_len); 874 875 /* Time stamp */ 876 __net_timestamp(skb); 877 878 hci_send_to_control(skb, skip_sk); 879 kfree_skb(skb); 880 881 return 0; 882} 883 884static int new_settings(struct hci_dev *hdev, struct sock *skip) 885{ 886 __le32 ev; 887 888 ev = cpu_to_le32(get_current_settings(hdev)); 889 890 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip); 891} 892 893int mgmt_new_settings(struct hci_dev *hdev) 894{ 895 return new_settings(hdev, NULL); 896} 897 898struct cmd_lookup { 899 struct sock *sk; 900 struct hci_dev *hdev; 901 u8 mgmt_status; 902}; 903 904static void settings_rsp(struct pending_cmd *cmd, void *data) 905{ 906 struct cmd_lookup *match = data; 907 908 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 909 910 list_del(&cmd->list); 911 912 if (match->sk == NULL) { 913 match->sk = cmd->sk; 914 sock_hold(match->sk); 915 } 916 917 mgmt_pending_free(cmd); 918} 919 920static void cmd_status_rsp(struct pending_cmd *cmd, void *data) 921{ 922 u8 *status = data; 923 924 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 925 mgmt_pending_remove(cmd); 926} 927 928static u8 mgmt_bredr_support(struct hci_dev *hdev) 929{ 930 if (!lmp_bredr_capable(hdev)) 931 return MGMT_STATUS_NOT_SUPPORTED; 932 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 933 return MGMT_STATUS_REJECTED; 934 else 935 return MGMT_STATUS_SUCCESS; 936} 937 938static u8 mgmt_le_support(struct hci_dev *hdev) 939{ 940 if (!lmp_le_capable(hdev)) 941 return MGMT_STATUS_NOT_SUPPORTED; 942 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 943 return MGMT_STATUS_REJECTED; 944 else 945 return MGMT_STATUS_SUCCESS; 946} 947 948static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 949 u16 len) 950{ 951 struct mgmt_cp_set_discoverable *cp = data; 952 struct pending_cmd *cmd; 953 u16 timeout; 954 u8 scan, status; 955 int err; 956 957 BT_DBG("request for %s", hdev->name); 958 959 status = mgmt_bredr_support(hdev); 960 if (status) 961 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 962 status); 963 964 if (cp->val != 0x00 && cp->val != 0x01) 965 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 966 MGMT_STATUS_INVALID_PARAMS); 967 968 timeout = __le16_to_cpu(cp->timeout); 969 if (!cp->val && timeout > 0) 970 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 971 MGMT_STATUS_INVALID_PARAMS); 972 973 hci_dev_lock(hdev); 974 975 if (!hdev_is_powered(hdev) && timeout > 0) { 976 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 977 MGMT_STATUS_NOT_POWERED); 978 goto failed; 979 } 980 981 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 982 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 983 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 984 MGMT_STATUS_BUSY); 985 goto failed; 986 } 987 988 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) { 989 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 990 MGMT_STATUS_REJECTED); 991 goto failed; 992 } 993 994 if (!hdev_is_powered(hdev)) { 995 bool changed = false; 996 997 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 998 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 999 changed = true; 1000 } 1001 1002 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1003 if (err < 0) 1004 goto failed; 1005 1006 if (changed) 1007 err = new_settings(hdev, sk); 1008 1009 goto failed; 1010 } 1011 1012 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) { 1013 if (hdev->discov_timeout > 0) { 1014 cancel_delayed_work(&hdev->discov_off); 1015 hdev->discov_timeout = 0; 1016 } 1017 1018 if (cp->val && timeout > 0) { 1019 hdev->discov_timeout = timeout; 1020 queue_delayed_work(hdev->workqueue, &hdev->discov_off, 1021 msecs_to_jiffies(hdev->discov_timeout * 1000)); 1022 } 1023 1024 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1025 goto failed; 1026 } 1027 1028 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1029 if (!cmd) { 1030 err = -ENOMEM; 1031 goto failed; 1032 } 1033 1034 scan = SCAN_PAGE; 1035 1036 if (cp->val) 1037 scan |= SCAN_INQUIRY; 1038 else 1039 cancel_delayed_work(&hdev->discov_off); 1040 1041 err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1042 if (err < 0) 1043 mgmt_pending_remove(cmd); 1044 1045 if (cp->val) 1046 hdev->discov_timeout = timeout; 1047 1048failed: 1049 hci_dev_unlock(hdev); 1050 return err; 1051} 1052 1053static void write_fast_connectable(struct hci_request *req, bool enable) 1054{ 1055 struct hci_dev *hdev = req->hdev; 1056 struct hci_cp_write_page_scan_activity acp; 1057 u8 type; 1058 1059 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 1060 return; 1061 1062 if (enable) { 1063 type = PAGE_SCAN_TYPE_INTERLACED; 1064 1065 /* 160 msec page scan interval */ 1066 acp.interval = __constant_cpu_to_le16(0x0100); 1067 } else { 1068 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 1069 1070 /* default 1.28 sec page scan */ 1071 acp.interval = __constant_cpu_to_le16(0x0800); 1072 } 1073 1074 acp.window = __constant_cpu_to_le16(0x0012); 1075 1076 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval || 1077 __cpu_to_le16(hdev->page_scan_window) != acp.window) 1078 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, 1079 sizeof(acp), &acp); 1080 1081 if (hdev->page_scan_type != type) 1082 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type); 1083} 1084 1085static void set_connectable_complete(struct hci_dev *hdev, u8 status) 1086{ 1087 struct pending_cmd *cmd; 1088 1089 BT_DBG("status 0x%02x", status); 1090 1091 hci_dev_lock(hdev); 1092 1093 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1094 if (!cmd) 1095 goto unlock; 1096 1097 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1098 1099 mgmt_pending_remove(cmd); 1100 1101unlock: 1102 hci_dev_unlock(hdev); 1103} 1104 1105static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1106 u16 len) 1107{ 1108 struct mgmt_mode *cp = data; 1109 struct pending_cmd *cmd; 1110 struct hci_request req; 1111 u8 scan, status; 1112 int err; 1113 1114 BT_DBG("request for %s", hdev->name); 1115 1116 status = mgmt_bredr_support(hdev); 1117 if (status) 1118 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1119 status); 1120 1121 if (cp->val != 0x00 && cp->val != 0x01) 1122 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1123 MGMT_STATUS_INVALID_PARAMS); 1124 1125 hci_dev_lock(hdev); 1126 1127 if (!hdev_is_powered(hdev)) { 1128 bool changed = false; 1129 1130 if (!!cp->val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 1131 changed = true; 1132 1133 if (cp->val) { 1134 set_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1135 } else { 1136 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags); 1137 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 1138 } 1139 1140 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1141 if (err < 0) 1142 goto failed; 1143 1144 if (changed) 1145 err = new_settings(hdev, sk); 1146 1147 goto failed; 1148 } 1149 1150 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1151 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1152 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1153 MGMT_STATUS_BUSY); 1154 goto failed; 1155 } 1156 1157 if (!!cp->val == test_bit(HCI_PSCAN, &hdev->flags)) { 1158 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1159 goto failed; 1160 } 1161 1162 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1163 if (!cmd) { 1164 err = -ENOMEM; 1165 goto failed; 1166 } 1167 1168 if (cp->val) { 1169 scan = SCAN_PAGE; 1170 } else { 1171 scan = 0; 1172 1173 if (test_bit(HCI_ISCAN, &hdev->flags) && 1174 hdev->discov_timeout > 0) 1175 cancel_delayed_work(&hdev->discov_off); 1176 } 1177 1178 hci_req_init(&req, hdev); 1179 1180 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1181 1182 /* If we're going from non-connectable to connectable or 1183 * vice-versa when fast connectable is enabled ensure that fast 1184 * connectable gets disabled. write_fast_connectable won't do 1185 * anything if the page scan parameters are already what they 1186 * should be. 1187 */ 1188 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) 1189 write_fast_connectable(&req, false); 1190 1191 err = hci_req_run(&req, set_connectable_complete); 1192 if (err < 0) 1193 mgmt_pending_remove(cmd); 1194 1195failed: 1196 hci_dev_unlock(hdev); 1197 return err; 1198} 1199 1200static int set_pairable(struct sock *sk, struct hci_dev *hdev, void *data, 1201 u16 len) 1202{ 1203 struct mgmt_mode *cp = data; 1204 int err; 1205 1206 BT_DBG("request for %s", hdev->name); 1207 1208 if (cp->val != 0x00 && cp->val != 0x01) 1209 return cmd_status(sk, hdev->id, MGMT_OP_SET_PAIRABLE, 1210 MGMT_STATUS_INVALID_PARAMS); 1211 1212 hci_dev_lock(hdev); 1213 1214 if (cp->val) 1215 set_bit(HCI_PAIRABLE, &hdev->dev_flags); 1216 else 1217 clear_bit(HCI_PAIRABLE, &hdev->dev_flags); 1218 1219 err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev); 1220 if (err < 0) 1221 goto failed; 1222 1223 err = new_settings(hdev, sk); 1224 1225failed: 1226 hci_dev_unlock(hdev); 1227 return err; 1228} 1229 1230static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1231 u16 len) 1232{ 1233 struct mgmt_mode *cp = data; 1234 struct pending_cmd *cmd; 1235 u8 val, status; 1236 int err; 1237 1238 BT_DBG("request for %s", hdev->name); 1239 1240 status = mgmt_bredr_support(hdev); 1241 if (status) 1242 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1243 status); 1244 1245 if (cp->val != 0x00 && cp->val != 0x01) 1246 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1247 MGMT_STATUS_INVALID_PARAMS); 1248 1249 hci_dev_lock(hdev); 1250 1251 if (!hdev_is_powered(hdev)) { 1252 bool changed = false; 1253 1254 if (!!cp->val != test_bit(HCI_LINK_SECURITY, 1255 &hdev->dev_flags)) { 1256 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 1257 changed = true; 1258 } 1259 1260 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1261 if (err < 0) 1262 goto failed; 1263 1264 if (changed) 1265 err = new_settings(hdev, sk); 1266 1267 goto failed; 1268 } 1269 1270 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1271 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1272 MGMT_STATUS_BUSY); 1273 goto failed; 1274 } 1275 1276 val = !!cp->val; 1277 1278 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1279 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1280 goto failed; 1281 } 1282 1283 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1284 if (!cmd) { 1285 err = -ENOMEM; 1286 goto failed; 1287 } 1288 1289 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1290 if (err < 0) { 1291 mgmt_pending_remove(cmd); 1292 goto failed; 1293 } 1294 1295failed: 1296 hci_dev_unlock(hdev); 1297 return err; 1298} 1299 1300static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1301{ 1302 struct mgmt_mode *cp = data; 1303 struct pending_cmd *cmd; 1304 u8 val, status; 1305 int err; 1306 1307 BT_DBG("request for %s", hdev->name); 1308 1309 status = mgmt_bredr_support(hdev); 1310 if (status) 1311 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1312 1313 if (!lmp_ssp_capable(hdev)) 1314 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1315 MGMT_STATUS_NOT_SUPPORTED); 1316 1317 if (cp->val != 0x00 && cp->val != 0x01) 1318 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1319 MGMT_STATUS_INVALID_PARAMS); 1320 1321 hci_dev_lock(hdev); 1322 1323 val = !!cp->val; 1324 1325 if (!hdev_is_powered(hdev)) { 1326 bool changed = false; 1327 1328 if (val != test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) { 1329 change_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 1330 changed = true; 1331 } 1332 1333 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1334 if (err < 0) 1335 goto failed; 1336 1337 if (changed) 1338 err = new_settings(hdev, sk); 1339 1340 goto failed; 1341 } 1342 1343 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) { 1344 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1345 MGMT_STATUS_BUSY); 1346 goto failed; 1347 } 1348 1349 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) { 1350 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1351 goto failed; 1352 } 1353 1354 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1355 if (!cmd) { 1356 err = -ENOMEM; 1357 goto failed; 1358 } 1359 1360 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val); 1361 if (err < 0) { 1362 mgmt_pending_remove(cmd); 1363 goto failed; 1364 } 1365 1366failed: 1367 hci_dev_unlock(hdev); 1368 return err; 1369} 1370 1371static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1372{ 1373 struct mgmt_mode *cp = data; 1374 bool changed; 1375 u8 status; 1376 int err; 1377 1378 BT_DBG("request for %s", hdev->name); 1379 1380 status = mgmt_bredr_support(hdev); 1381 if (status) 1382 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1383 1384 if (cp->val != 0x00 && cp->val != 0x01) 1385 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1386 MGMT_STATUS_INVALID_PARAMS); 1387 1388 hci_dev_lock(hdev); 1389 1390 if (cp->val) { 1391 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1392 } else { 1393 if (hdev_is_powered(hdev)) { 1394 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1395 MGMT_STATUS_REJECTED); 1396 goto unlock; 1397 } 1398 1399 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 1400 } 1401 1402 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1403 if (err < 0) 1404 goto unlock; 1405 1406 if (changed) 1407 err = new_settings(hdev, sk); 1408 1409unlock: 1410 hci_dev_unlock(hdev); 1411 return err; 1412} 1413 1414static void le_enable_complete(struct hci_dev *hdev, u8 status) 1415{ 1416 struct cmd_lookup match = { NULL, hdev }; 1417 1418 if (status) { 1419 u8 mgmt_err = mgmt_status(status); 1420 1421 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1422 &mgmt_err); 1423 return; 1424 } 1425 1426 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1427 1428 new_settings(hdev, match.sk); 1429 1430 if (match.sk) 1431 sock_put(match.sk); 1432} 1433 1434static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1435{ 1436 struct mgmt_mode *cp = data; 1437 struct hci_cp_write_le_host_supported hci_cp; 1438 struct pending_cmd *cmd; 1439 struct hci_request req; 1440 int err; 1441 u8 val, enabled; 1442 1443 BT_DBG("request for %s", hdev->name); 1444 1445 if (!lmp_le_capable(hdev)) 1446 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1447 MGMT_STATUS_NOT_SUPPORTED); 1448 1449 if (cp->val != 0x00 && cp->val != 0x01) 1450 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1451 MGMT_STATUS_INVALID_PARAMS); 1452 1453 /* LE-only devices do not allow toggling LE on/off */ 1454 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 1455 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1456 MGMT_STATUS_REJECTED); 1457 1458 hci_dev_lock(hdev); 1459 1460 val = !!cp->val; 1461 enabled = lmp_host_le_capable(hdev); 1462 1463 if (!hdev_is_powered(hdev) || val == enabled) { 1464 bool changed = false; 1465 1466 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) { 1467 change_bit(HCI_LE_ENABLED, &hdev->dev_flags); 1468 changed = true; 1469 } 1470 1471 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 1472 clear_bit(HCI_ADVERTISING, &hdev->dev_flags); 1473 changed = true; 1474 } 1475 1476 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1477 if (err < 0) 1478 goto unlock; 1479 1480 if (changed) 1481 err = new_settings(hdev, sk); 1482 1483 goto unlock; 1484 } 1485 1486 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) || 1487 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1488 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1489 MGMT_STATUS_BUSY); 1490 goto unlock; 1491 } 1492 1493 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1494 if (!cmd) { 1495 err = -ENOMEM; 1496 goto unlock; 1497 } 1498 1499 memset(&hci_cp, 0, sizeof(hci_cp)); 1500 1501 if (val) { 1502 hci_cp.le = val; 1503 hci_cp.simul = lmp_le_br_capable(hdev); 1504 } 1505 1506 hci_req_init(&req, hdev); 1507 1508 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) && !val) { 1509 u8 adv = 0x00; 1510 1511 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv); 1512 } 1513 1514 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 1515 &hci_cp); 1516 1517 err = hci_req_run(&req, le_enable_complete); 1518 if (err < 0) 1519 mgmt_pending_remove(cmd); 1520 1521unlock: 1522 hci_dev_unlock(hdev); 1523 return err; 1524} 1525 1526/* This is a helper function to test for pending mgmt commands that can 1527 * cause CoD or EIR HCI commands. We can only allow one such pending 1528 * mgmt command at a time since otherwise we cannot easily track what 1529 * the current values are, will be, and based on that calculate if a new 1530 * HCI command needs to be sent and if yes with what value. 1531 */ 1532static bool pending_eir_or_class(struct hci_dev *hdev) 1533{ 1534 struct pending_cmd *cmd; 1535 1536 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 1537 switch (cmd->opcode) { 1538 case MGMT_OP_ADD_UUID: 1539 case MGMT_OP_REMOVE_UUID: 1540 case MGMT_OP_SET_DEV_CLASS: 1541 case MGMT_OP_SET_POWERED: 1542 return true; 1543 } 1544 } 1545 1546 return false; 1547} 1548 1549static const u8 bluetooth_base_uuid[] = { 1550 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 1551 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 1552}; 1553 1554static u8 get_uuid_size(const u8 *uuid) 1555{ 1556 u32 val; 1557 1558 if (memcmp(uuid, bluetooth_base_uuid, 12)) 1559 return 128; 1560 1561 val = get_unaligned_le32(&uuid[12]); 1562 if (val > 0xffff) 1563 return 32; 1564 1565 return 16; 1566} 1567 1568static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 1569{ 1570 struct pending_cmd *cmd; 1571 1572 hci_dev_lock(hdev); 1573 1574 cmd = mgmt_pending_find(mgmt_op, hdev); 1575 if (!cmd) 1576 goto unlock; 1577 1578 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status), 1579 hdev->dev_class, 3); 1580 1581 mgmt_pending_remove(cmd); 1582 1583unlock: 1584 hci_dev_unlock(hdev); 1585} 1586 1587static void add_uuid_complete(struct hci_dev *hdev, u8 status) 1588{ 1589 BT_DBG("status 0x%02x", status); 1590 1591 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 1592} 1593 1594static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1595{ 1596 struct mgmt_cp_add_uuid *cp = data; 1597 struct pending_cmd *cmd; 1598 struct hci_request req; 1599 struct bt_uuid *uuid; 1600 int err; 1601 1602 BT_DBG("request for %s", hdev->name); 1603 1604 hci_dev_lock(hdev); 1605 1606 if (pending_eir_or_class(hdev)) { 1607 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 1608 MGMT_STATUS_BUSY); 1609 goto failed; 1610 } 1611 1612 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 1613 if (!uuid) { 1614 err = -ENOMEM; 1615 goto failed; 1616 } 1617 1618 memcpy(uuid->uuid, cp->uuid, 16); 1619 uuid->svc_hint = cp->svc_hint; 1620 uuid->size = get_uuid_size(cp->uuid); 1621 1622 list_add_tail(&uuid->list, &hdev->uuids); 1623 1624 hci_req_init(&req, hdev); 1625 1626 update_class(&req); 1627 update_eir(&req); 1628 1629 err = hci_req_run(&req, add_uuid_complete); 1630 if (err < 0) { 1631 if (err != -ENODATA) 1632 goto failed; 1633 1634 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 1635 hdev->dev_class, 3); 1636 goto failed; 1637 } 1638 1639 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 1640 if (!cmd) { 1641 err = -ENOMEM; 1642 goto failed; 1643 } 1644 1645 err = 0; 1646 1647failed: 1648 hci_dev_unlock(hdev); 1649 return err; 1650} 1651 1652static bool enable_service_cache(struct hci_dev *hdev) 1653{ 1654 if (!hdev_is_powered(hdev)) 1655 return false; 1656 1657 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1658 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 1659 CACHE_TIMEOUT); 1660 return true; 1661 } 1662 1663 return false; 1664} 1665 1666static void remove_uuid_complete(struct hci_dev *hdev, u8 status) 1667{ 1668 BT_DBG("status 0x%02x", status); 1669 1670 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 1671} 1672 1673static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 1674 u16 len) 1675{ 1676 struct mgmt_cp_remove_uuid *cp = data; 1677 struct pending_cmd *cmd; 1678 struct bt_uuid *match, *tmp; 1679 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 1680 struct hci_request req; 1681 int err, found; 1682 1683 BT_DBG("request for %s", hdev->name); 1684 1685 hci_dev_lock(hdev); 1686 1687 if (pending_eir_or_class(hdev)) { 1688 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1689 MGMT_STATUS_BUSY); 1690 goto unlock; 1691 } 1692 1693 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 1694 err = hci_uuids_clear(hdev); 1695 1696 if (enable_service_cache(hdev)) { 1697 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1698 0, hdev->dev_class, 3); 1699 goto unlock; 1700 } 1701 1702 goto update_class; 1703 } 1704 1705 found = 0; 1706 1707 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 1708 if (memcmp(match->uuid, cp->uuid, 16) != 0) 1709 continue; 1710 1711 list_del(&match->list); 1712 kfree(match); 1713 found++; 1714 } 1715 1716 if (found == 0) { 1717 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 1718 MGMT_STATUS_INVALID_PARAMS); 1719 goto unlock; 1720 } 1721 1722update_class: 1723 hci_req_init(&req, hdev); 1724 1725 update_class(&req); 1726 update_eir(&req); 1727 1728 err = hci_req_run(&req, remove_uuid_complete); 1729 if (err < 0) { 1730 if (err != -ENODATA) 1731 goto unlock; 1732 1733 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 1734 hdev->dev_class, 3); 1735 goto unlock; 1736 } 1737 1738 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 1739 if (!cmd) { 1740 err = -ENOMEM; 1741 goto unlock; 1742 } 1743 1744 err = 0; 1745 1746unlock: 1747 hci_dev_unlock(hdev); 1748 return err; 1749} 1750 1751static void set_class_complete(struct hci_dev *hdev, u8 status) 1752{ 1753 BT_DBG("status 0x%02x", status); 1754 1755 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 1756} 1757 1758static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 1759 u16 len) 1760{ 1761 struct mgmt_cp_set_dev_class *cp = data; 1762 struct pending_cmd *cmd; 1763 struct hci_request req; 1764 int err; 1765 1766 BT_DBG("request for %s", hdev->name); 1767 1768 if (!lmp_bredr_capable(hdev)) 1769 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 1770 MGMT_STATUS_NOT_SUPPORTED); 1771 1772 hci_dev_lock(hdev); 1773 1774 if (pending_eir_or_class(hdev)) { 1775 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 1776 MGMT_STATUS_BUSY); 1777 goto unlock; 1778 } 1779 1780 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 1781 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 1782 MGMT_STATUS_INVALID_PARAMS); 1783 goto unlock; 1784 } 1785 1786 hdev->major_class = cp->major; 1787 hdev->minor_class = cp->minor; 1788 1789 if (!hdev_is_powered(hdev)) { 1790 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 1791 hdev->dev_class, 3); 1792 goto unlock; 1793 } 1794 1795 hci_req_init(&req, hdev); 1796 1797 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) { 1798 hci_dev_unlock(hdev); 1799 cancel_delayed_work_sync(&hdev->service_cache); 1800 hci_dev_lock(hdev); 1801 update_eir(&req); 1802 } 1803 1804 update_class(&req); 1805 1806 err = hci_req_run(&req, set_class_complete); 1807 if (err < 0) { 1808 if (err != -ENODATA) 1809 goto unlock; 1810 1811 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 1812 hdev->dev_class, 3); 1813 goto unlock; 1814 } 1815 1816 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 1817 if (!cmd) { 1818 err = -ENOMEM; 1819 goto unlock; 1820 } 1821 1822 err = 0; 1823 1824unlock: 1825 hci_dev_unlock(hdev); 1826 return err; 1827} 1828 1829static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 1830 u16 len) 1831{ 1832 struct mgmt_cp_load_link_keys *cp = data; 1833 u16 key_count, expected_len; 1834 int i; 1835 1836 BT_DBG("request for %s", hdev->name); 1837 1838 if (!lmp_bredr_capable(hdev)) 1839 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 1840 MGMT_STATUS_NOT_SUPPORTED); 1841 1842 key_count = __le16_to_cpu(cp->key_count); 1843 1844 expected_len = sizeof(*cp) + key_count * 1845 sizeof(struct mgmt_link_key_info); 1846 if (expected_len != len) { 1847 BT_ERR("load_link_keys: expected %u bytes, got %u bytes", 1848 len, expected_len); 1849 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 1850 MGMT_STATUS_INVALID_PARAMS); 1851 } 1852 1853 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 1854 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 1855 MGMT_STATUS_INVALID_PARAMS); 1856 1857 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys, 1858 key_count); 1859 1860 for (i = 0; i < key_count; i++) { 1861 struct mgmt_link_key_info *key = &cp->keys[i]; 1862 1863 if (key->addr.type != BDADDR_BREDR) 1864 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 1865 MGMT_STATUS_INVALID_PARAMS); 1866 } 1867 1868 hci_dev_lock(hdev); 1869 1870 hci_link_keys_clear(hdev); 1871 1872 if (cp->debug_keys) 1873 set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 1874 else 1875 clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags); 1876 1877 for (i = 0; i < key_count; i++) { 1878 struct mgmt_link_key_info *key = &cp->keys[i]; 1879 1880 hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val, 1881 key->type, key->pin_len); 1882 } 1883 1884 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 1885 1886 hci_dev_unlock(hdev); 1887 1888 return 0; 1889} 1890 1891static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 1892 u8 addr_type, struct sock *skip_sk) 1893{ 1894 struct mgmt_ev_device_unpaired ev; 1895 1896 bacpy(&ev.addr.bdaddr, bdaddr); 1897 ev.addr.type = addr_type; 1898 1899 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 1900 skip_sk); 1901} 1902 1903static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1904 u16 len) 1905{ 1906 struct mgmt_cp_unpair_device *cp = data; 1907 struct mgmt_rp_unpair_device rp; 1908 struct hci_cp_disconnect dc; 1909 struct pending_cmd *cmd; 1910 struct hci_conn *conn; 1911 int err; 1912 1913 memset(&rp, 0, sizeof(rp)); 1914 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 1915 rp.addr.type = cp->addr.type; 1916 1917 if (!bdaddr_type_is_valid(cp->addr.type)) 1918 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1919 MGMT_STATUS_INVALID_PARAMS, 1920 &rp, sizeof(rp)); 1921 1922 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 1923 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1924 MGMT_STATUS_INVALID_PARAMS, 1925 &rp, sizeof(rp)); 1926 1927 hci_dev_lock(hdev); 1928 1929 if (!hdev_is_powered(hdev)) { 1930 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1931 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 1932 goto unlock; 1933 } 1934 1935 if (cp->addr.type == BDADDR_BREDR) 1936 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 1937 else 1938 err = hci_remove_ltk(hdev, &cp->addr.bdaddr); 1939 1940 if (err < 0) { 1941 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 1942 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp)); 1943 goto unlock; 1944 } 1945 1946 if (cp->disconnect) { 1947 if (cp->addr.type == BDADDR_BREDR) 1948 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 1949 &cp->addr.bdaddr); 1950 else 1951 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, 1952 &cp->addr.bdaddr); 1953 } else { 1954 conn = NULL; 1955 } 1956 1957 if (!conn) { 1958 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 1959 &rp, sizeof(rp)); 1960 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 1961 goto unlock; 1962 } 1963 1964 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 1965 sizeof(*cp)); 1966 if (!cmd) { 1967 err = -ENOMEM; 1968 goto unlock; 1969 } 1970 1971 dc.handle = cpu_to_le16(conn->handle); 1972 dc.reason = 0x13; /* Remote User Terminated Connection */ 1973 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 1974 if (err < 0) 1975 mgmt_pending_remove(cmd); 1976 1977unlock: 1978 hci_dev_unlock(hdev); 1979 return err; 1980} 1981 1982static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 1983 u16 len) 1984{ 1985 struct mgmt_cp_disconnect *cp = data; 1986 struct mgmt_rp_disconnect rp; 1987 struct hci_cp_disconnect dc; 1988 struct pending_cmd *cmd; 1989 struct hci_conn *conn; 1990 int err; 1991 1992 BT_DBG(""); 1993 1994 memset(&rp, 0, sizeof(rp)); 1995 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 1996 rp.addr.type = cp->addr.type; 1997 1998 if (!bdaddr_type_is_valid(cp->addr.type)) 1999 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2000 MGMT_STATUS_INVALID_PARAMS, 2001 &rp, sizeof(rp)); 2002 2003 hci_dev_lock(hdev); 2004 2005 if (!test_bit(HCI_UP, &hdev->flags)) { 2006 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2007 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 2008 goto failed; 2009 } 2010 2011 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) { 2012 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2013 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2014 goto failed; 2015 } 2016 2017 if (cp->addr.type == BDADDR_BREDR) 2018 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2019 &cp->addr.bdaddr); 2020 else 2021 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 2022 2023 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2024 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2025 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp)); 2026 goto failed; 2027 } 2028 2029 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2030 if (!cmd) { 2031 err = -ENOMEM; 2032 goto failed; 2033 } 2034 2035 dc.handle = cpu_to_le16(conn->handle); 2036 dc.reason = HCI_ERROR_REMOTE_USER_TERM; 2037 2038 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc); 2039 if (err < 0) 2040 mgmt_pending_remove(cmd); 2041 2042failed: 2043 hci_dev_unlock(hdev); 2044 return err; 2045} 2046 2047static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2048{ 2049 switch (link_type) { 2050 case LE_LINK: 2051 switch (addr_type) { 2052 case ADDR_LE_DEV_PUBLIC: 2053 return BDADDR_LE_PUBLIC; 2054 2055 default: 2056 /* Fallback to LE Random address type */ 2057 return BDADDR_LE_RANDOM; 2058 } 2059 2060 default: 2061 /* Fallback to BR/EDR type */ 2062 return BDADDR_BREDR; 2063 } 2064} 2065 2066static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2067 u16 data_len) 2068{ 2069 struct mgmt_rp_get_connections *rp; 2070 struct hci_conn *c; 2071 size_t rp_len; 2072 int err; 2073 u16 i; 2074 2075 BT_DBG(""); 2076 2077 hci_dev_lock(hdev); 2078 2079 if (!hdev_is_powered(hdev)) { 2080 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2081 MGMT_STATUS_NOT_POWERED); 2082 goto unlock; 2083 } 2084 2085 i = 0; 2086 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2087 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2088 i++; 2089 } 2090 2091 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2092 rp = kmalloc(rp_len, GFP_KERNEL); 2093 if (!rp) { 2094 err = -ENOMEM; 2095 goto unlock; 2096 } 2097 2098 i = 0; 2099 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2100 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2101 continue; 2102 bacpy(&rp->addr[i].bdaddr, &c->dst); 2103 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2104 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2105 continue; 2106 i++; 2107 } 2108 2109 rp->conn_count = cpu_to_le16(i); 2110 2111 /* Recalculate length in case of filtered SCO connections, etc */ 2112 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info)); 2113 2114 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2115 rp_len); 2116 2117 kfree(rp); 2118 2119unlock: 2120 hci_dev_unlock(hdev); 2121 return err; 2122} 2123 2124static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2125 struct mgmt_cp_pin_code_neg_reply *cp) 2126{ 2127 struct pending_cmd *cmd; 2128 int err; 2129 2130 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2131 sizeof(*cp)); 2132 if (!cmd) 2133 return -ENOMEM; 2134 2135 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2136 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2137 if (err < 0) 2138 mgmt_pending_remove(cmd); 2139 2140 return err; 2141} 2142 2143static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2144 u16 len) 2145{ 2146 struct hci_conn *conn; 2147 struct mgmt_cp_pin_code_reply *cp = data; 2148 struct hci_cp_pin_code_reply reply; 2149 struct pending_cmd *cmd; 2150 int err; 2151 2152 BT_DBG(""); 2153 2154 hci_dev_lock(hdev); 2155 2156 if (!hdev_is_powered(hdev)) { 2157 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2158 MGMT_STATUS_NOT_POWERED); 2159 goto failed; 2160 } 2161 2162 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2163 if (!conn) { 2164 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2165 MGMT_STATUS_NOT_CONNECTED); 2166 goto failed; 2167 } 2168 2169 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2170 struct mgmt_cp_pin_code_neg_reply ncp; 2171 2172 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2173 2174 BT_ERR("PIN code is not 16 bytes long"); 2175 2176 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2177 if (err >= 0) 2178 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2179 MGMT_STATUS_INVALID_PARAMS); 2180 2181 goto failed; 2182 } 2183 2184 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2185 if (!cmd) { 2186 err = -ENOMEM; 2187 goto failed; 2188 } 2189 2190 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2191 reply.pin_len = cp->pin_len; 2192 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2193 2194 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2195 if (err < 0) 2196 mgmt_pending_remove(cmd); 2197 2198failed: 2199 hci_dev_unlock(hdev); 2200 return err; 2201} 2202 2203static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2204 u16 len) 2205{ 2206 struct mgmt_cp_set_io_capability *cp = data; 2207 2208 BT_DBG(""); 2209 2210 hci_dev_lock(hdev); 2211 2212 hdev->io_capability = cp->io_capability; 2213 2214 BT_DBG("%s IO capability set to 0x%02x", hdev->name, 2215 hdev->io_capability); 2216 2217 hci_dev_unlock(hdev); 2218 2219 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 2220 0); 2221} 2222 2223static struct pending_cmd *find_pairing(struct hci_conn *conn) 2224{ 2225 struct hci_dev *hdev = conn->hdev; 2226 struct pending_cmd *cmd; 2227 2228 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2229 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2230 continue; 2231 2232 if (cmd->user_data != conn) 2233 continue; 2234 2235 return cmd; 2236 } 2237 2238 return NULL; 2239} 2240 2241static void pairing_complete(struct pending_cmd *cmd, u8 status) 2242{ 2243 struct mgmt_rp_pair_device rp; 2244 struct hci_conn *conn = cmd->user_data; 2245 2246 bacpy(&rp.addr.bdaddr, &conn->dst); 2247 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2248 2249 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status, 2250 &rp, sizeof(rp)); 2251 2252 /* So we don't get further callbacks for this connection */ 2253 conn->connect_cfm_cb = NULL; 2254 conn->security_cfm_cb = NULL; 2255 conn->disconn_cfm_cb = NULL; 2256 2257 hci_conn_drop(conn); 2258 2259 mgmt_pending_remove(cmd); 2260} 2261 2262static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2263{ 2264 struct pending_cmd *cmd; 2265 2266 BT_DBG("status %u", status); 2267 2268 cmd = find_pairing(conn); 2269 if (!cmd) 2270 BT_DBG("Unable to find a pending command"); 2271 else 2272 pairing_complete(cmd, mgmt_status(status)); 2273} 2274 2275static void le_connect_complete_cb(struct hci_conn *conn, u8 status) 2276{ 2277 struct pending_cmd *cmd; 2278 2279 BT_DBG("status %u", status); 2280 2281 if (!status) 2282 return; 2283 2284 cmd = find_pairing(conn); 2285 if (!cmd) 2286 BT_DBG("Unable to find a pending command"); 2287 else 2288 pairing_complete(cmd, mgmt_status(status)); 2289} 2290 2291static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2292 u16 len) 2293{ 2294 struct mgmt_cp_pair_device *cp = data; 2295 struct mgmt_rp_pair_device rp; 2296 struct pending_cmd *cmd; 2297 u8 sec_level, auth_type; 2298 struct hci_conn *conn; 2299 int err; 2300 2301 BT_DBG(""); 2302 2303 memset(&rp, 0, sizeof(rp)); 2304 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2305 rp.addr.type = cp->addr.type; 2306 2307 if (!bdaddr_type_is_valid(cp->addr.type)) 2308 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2309 MGMT_STATUS_INVALID_PARAMS, 2310 &rp, sizeof(rp)); 2311 2312 hci_dev_lock(hdev); 2313 2314 if (!hdev_is_powered(hdev)) { 2315 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2316 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp)); 2317 goto unlock; 2318 } 2319 2320 sec_level = BT_SECURITY_MEDIUM; 2321 if (cp->io_cap == 0x03) 2322 auth_type = HCI_AT_DEDICATED_BONDING; 2323 else 2324 auth_type = HCI_AT_DEDICATED_BONDING_MITM; 2325 2326 if (cp->addr.type == BDADDR_BREDR) 2327 conn = hci_connect(hdev, ACL_LINK, &cp->addr.bdaddr, 2328 cp->addr.type, sec_level, auth_type); 2329 else 2330 conn = hci_connect(hdev, LE_LINK, &cp->addr.bdaddr, 2331 cp->addr.type, sec_level, auth_type); 2332 2333 if (IS_ERR(conn)) { 2334 int status; 2335 2336 if (PTR_ERR(conn) == -EBUSY) 2337 status = MGMT_STATUS_BUSY; 2338 else 2339 status = MGMT_STATUS_CONNECT_FAILED; 2340 2341 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2342 status, &rp, 2343 sizeof(rp)); 2344 goto unlock; 2345 } 2346 2347 if (conn->connect_cfm_cb) { 2348 hci_conn_drop(conn); 2349 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2350 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2351 goto unlock; 2352 } 2353 2354 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 2355 if (!cmd) { 2356 err = -ENOMEM; 2357 hci_conn_drop(conn); 2358 goto unlock; 2359 } 2360 2361 /* For LE, just connecting isn't a proof that the pairing finished */ 2362 if (cp->addr.type == BDADDR_BREDR) 2363 conn->connect_cfm_cb = pairing_complete_cb; 2364 else 2365 conn->connect_cfm_cb = le_connect_complete_cb; 2366 2367 conn->security_cfm_cb = pairing_complete_cb; 2368 conn->disconn_cfm_cb = pairing_complete_cb; 2369 conn->io_capability = cp->io_cap; 2370 cmd->user_data = conn; 2371 2372 if (conn->state == BT_CONNECTED && 2373 hci_conn_security(conn, sec_level, auth_type)) 2374 pairing_complete(cmd, 0); 2375 2376 err = 0; 2377 2378unlock: 2379 hci_dev_unlock(hdev); 2380 return err; 2381} 2382 2383static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2384 u16 len) 2385{ 2386 struct mgmt_addr_info *addr = data; 2387 struct pending_cmd *cmd; 2388 struct hci_conn *conn; 2389 int err; 2390 2391 BT_DBG(""); 2392 2393 hci_dev_lock(hdev); 2394 2395 if (!hdev_is_powered(hdev)) { 2396 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2397 MGMT_STATUS_NOT_POWERED); 2398 goto unlock; 2399 } 2400 2401 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev); 2402 if (!cmd) { 2403 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2404 MGMT_STATUS_INVALID_PARAMS); 2405 goto unlock; 2406 } 2407 2408 conn = cmd->user_data; 2409 2410 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 2411 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 2412 MGMT_STATUS_INVALID_PARAMS); 2413 goto unlock; 2414 } 2415 2416 pairing_complete(cmd, MGMT_STATUS_CANCELLED); 2417 2418 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 2419 addr, sizeof(*addr)); 2420unlock: 2421 hci_dev_unlock(hdev); 2422 return err; 2423} 2424 2425static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 2426 struct mgmt_addr_info *addr, u16 mgmt_op, 2427 u16 hci_op, __le32 passkey) 2428{ 2429 struct pending_cmd *cmd; 2430 struct hci_conn *conn; 2431 int err; 2432 2433 hci_dev_lock(hdev); 2434 2435 if (!hdev_is_powered(hdev)) { 2436 err = cmd_complete(sk, hdev->id, mgmt_op, 2437 MGMT_STATUS_NOT_POWERED, addr, 2438 sizeof(*addr)); 2439 goto done; 2440 } 2441 2442 if (addr->type == BDADDR_BREDR) 2443 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 2444 else 2445 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr); 2446 2447 if (!conn) { 2448 err = cmd_complete(sk, hdev->id, mgmt_op, 2449 MGMT_STATUS_NOT_CONNECTED, addr, 2450 sizeof(*addr)); 2451 goto done; 2452 } 2453 2454 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 2455 /* Continue with pairing via SMP */ 2456 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 2457 2458 if (!err) 2459 err = cmd_complete(sk, hdev->id, mgmt_op, 2460 MGMT_STATUS_SUCCESS, addr, 2461 sizeof(*addr)); 2462 else 2463 err = cmd_complete(sk, hdev->id, mgmt_op, 2464 MGMT_STATUS_FAILED, addr, 2465 sizeof(*addr)); 2466 2467 goto done; 2468 } 2469 2470 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 2471 if (!cmd) { 2472 err = -ENOMEM; 2473 goto done; 2474 } 2475 2476 /* Continue with pairing via HCI */ 2477 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 2478 struct hci_cp_user_passkey_reply cp; 2479 2480 bacpy(&cp.bdaddr, &addr->bdaddr); 2481 cp.passkey = passkey; 2482 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 2483 } else 2484 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 2485 &addr->bdaddr); 2486 2487 if (err < 0) 2488 mgmt_pending_remove(cmd); 2489 2490done: 2491 hci_dev_unlock(hdev); 2492 return err; 2493} 2494 2495static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2496 void *data, u16 len) 2497{ 2498 struct mgmt_cp_pin_code_neg_reply *cp = data; 2499 2500 BT_DBG(""); 2501 2502 return user_pairing_resp(sk, hdev, &cp->addr, 2503 MGMT_OP_PIN_CODE_NEG_REPLY, 2504 HCI_OP_PIN_CODE_NEG_REPLY, 0); 2505} 2506 2507static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2508 u16 len) 2509{ 2510 struct mgmt_cp_user_confirm_reply *cp = data; 2511 2512 BT_DBG(""); 2513 2514 if (len != sizeof(*cp)) 2515 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 2516 MGMT_STATUS_INVALID_PARAMS); 2517 2518 return user_pairing_resp(sk, hdev, &cp->addr, 2519 MGMT_OP_USER_CONFIRM_REPLY, 2520 HCI_OP_USER_CONFIRM_REPLY, 0); 2521} 2522 2523static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 2524 void *data, u16 len) 2525{ 2526 struct mgmt_cp_user_confirm_neg_reply *cp = data; 2527 2528 BT_DBG(""); 2529 2530 return user_pairing_resp(sk, hdev, &cp->addr, 2531 MGMT_OP_USER_CONFIRM_NEG_REPLY, 2532 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 2533} 2534 2535static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2536 u16 len) 2537{ 2538 struct mgmt_cp_user_passkey_reply *cp = data; 2539 2540 BT_DBG(""); 2541 2542 return user_pairing_resp(sk, hdev, &cp->addr, 2543 MGMT_OP_USER_PASSKEY_REPLY, 2544 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 2545} 2546 2547static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 2548 void *data, u16 len) 2549{ 2550 struct mgmt_cp_user_passkey_neg_reply *cp = data; 2551 2552 BT_DBG(""); 2553 2554 return user_pairing_resp(sk, hdev, &cp->addr, 2555 MGMT_OP_USER_PASSKEY_NEG_REPLY, 2556 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 2557} 2558 2559static void update_name(struct hci_request *req) 2560{ 2561 struct hci_dev *hdev = req->hdev; 2562 struct hci_cp_write_local_name cp; 2563 2564 memcpy(cp.name, hdev->dev_name, sizeof(cp.name)); 2565 2566 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp); 2567} 2568 2569static void set_name_complete(struct hci_dev *hdev, u8 status) 2570{ 2571 struct mgmt_cp_set_local_name *cp; 2572 struct pending_cmd *cmd; 2573 2574 BT_DBG("status 0x%02x", status); 2575 2576 hci_dev_lock(hdev); 2577 2578 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 2579 if (!cmd) 2580 goto unlock; 2581 2582 cp = cmd->param; 2583 2584 if (status) 2585 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 2586 mgmt_status(status)); 2587 else 2588 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2589 cp, sizeof(*cp)); 2590 2591 mgmt_pending_remove(cmd); 2592 2593unlock: 2594 hci_dev_unlock(hdev); 2595} 2596 2597static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 2598 u16 len) 2599{ 2600 struct mgmt_cp_set_local_name *cp = data; 2601 struct pending_cmd *cmd; 2602 struct hci_request req; 2603 int err; 2604 2605 BT_DBG(""); 2606 2607 hci_dev_lock(hdev); 2608 2609 /* If the old values are the same as the new ones just return a 2610 * direct command complete event. 2611 */ 2612 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 2613 !memcmp(hdev->short_name, cp->short_name, 2614 sizeof(hdev->short_name))) { 2615 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2616 data, len); 2617 goto failed; 2618 } 2619 2620 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 2621 2622 if (!hdev_is_powered(hdev)) { 2623 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 2624 2625 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 2626 data, len); 2627 if (err < 0) 2628 goto failed; 2629 2630 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len, 2631 sk); 2632 2633 goto failed; 2634 } 2635 2636 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 2637 if (!cmd) { 2638 err = -ENOMEM; 2639 goto failed; 2640 } 2641 2642 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 2643 2644 hci_req_init(&req, hdev); 2645 2646 if (lmp_bredr_capable(hdev)) { 2647 update_name(&req); 2648 update_eir(&req); 2649 } 2650 2651 if (lmp_le_capable(hdev)) 2652 hci_update_ad(&req); 2653 2654 err = hci_req_run(&req, set_name_complete); 2655 if (err < 0) 2656 mgmt_pending_remove(cmd); 2657 2658failed: 2659 hci_dev_unlock(hdev); 2660 return err; 2661} 2662 2663static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 2664 void *data, u16 data_len) 2665{ 2666 struct pending_cmd *cmd; 2667 int err; 2668 2669 BT_DBG("%s", hdev->name); 2670 2671 hci_dev_lock(hdev); 2672 2673 if (!hdev_is_powered(hdev)) { 2674 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2675 MGMT_STATUS_NOT_POWERED); 2676 goto unlock; 2677 } 2678 2679 if (!lmp_ssp_capable(hdev)) { 2680 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2681 MGMT_STATUS_NOT_SUPPORTED); 2682 goto unlock; 2683 } 2684 2685 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 2686 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 2687 MGMT_STATUS_BUSY); 2688 goto unlock; 2689 } 2690 2691 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 2692 if (!cmd) { 2693 err = -ENOMEM; 2694 goto unlock; 2695 } 2696 2697 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 2698 if (err < 0) 2699 mgmt_pending_remove(cmd); 2700 2701unlock: 2702 hci_dev_unlock(hdev); 2703 return err; 2704} 2705 2706static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2707 void *data, u16 len) 2708{ 2709 struct mgmt_cp_add_remote_oob_data *cp = data; 2710 u8 status; 2711 int err; 2712 2713 BT_DBG("%s ", hdev->name); 2714 2715 hci_dev_lock(hdev); 2716 2717 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash, 2718 cp->randomizer); 2719 if (err < 0) 2720 status = MGMT_STATUS_FAILED; 2721 else 2722 status = MGMT_STATUS_SUCCESS; 2723 2724 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, status, 2725 &cp->addr, sizeof(cp->addr)); 2726 2727 hci_dev_unlock(hdev); 2728 return err; 2729} 2730 2731static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 2732 void *data, u16 len) 2733{ 2734 struct mgmt_cp_remove_remote_oob_data *cp = data; 2735 u8 status; 2736 int err; 2737 2738 BT_DBG("%s", hdev->name); 2739 2740 hci_dev_lock(hdev); 2741 2742 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr); 2743 if (err < 0) 2744 status = MGMT_STATUS_INVALID_PARAMS; 2745 else 2746 status = MGMT_STATUS_SUCCESS; 2747 2748 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 2749 status, &cp->addr, sizeof(cp->addr)); 2750 2751 hci_dev_unlock(hdev); 2752 return err; 2753} 2754 2755static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status) 2756{ 2757 struct pending_cmd *cmd; 2758 u8 type; 2759 int err; 2760 2761 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2762 2763 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 2764 if (!cmd) 2765 return -ENOENT; 2766 2767 type = hdev->discovery.type; 2768 2769 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 2770 &type, sizeof(type)); 2771 mgmt_pending_remove(cmd); 2772 2773 return err; 2774} 2775 2776static void start_discovery_complete(struct hci_dev *hdev, u8 status) 2777{ 2778 BT_DBG("status %d", status); 2779 2780 if (status) { 2781 hci_dev_lock(hdev); 2782 mgmt_start_discovery_failed(hdev, status); 2783 hci_dev_unlock(hdev); 2784 return; 2785 } 2786 2787 hci_dev_lock(hdev); 2788 hci_discovery_set_state(hdev, DISCOVERY_FINDING); 2789 hci_dev_unlock(hdev); 2790 2791 switch (hdev->discovery.type) { 2792 case DISCOV_TYPE_LE: 2793 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, 2794 DISCOV_LE_TIMEOUT); 2795 break; 2796 2797 case DISCOV_TYPE_INTERLEAVED: 2798 queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, 2799 DISCOV_INTERLEAVED_TIMEOUT); 2800 break; 2801 2802 case DISCOV_TYPE_BREDR: 2803 break; 2804 2805 default: 2806 BT_ERR("Invalid discovery type %d", hdev->discovery.type); 2807 } 2808} 2809 2810static int start_discovery(struct sock *sk, struct hci_dev *hdev, 2811 void *data, u16 len) 2812{ 2813 struct mgmt_cp_start_discovery *cp = data; 2814 struct pending_cmd *cmd; 2815 struct hci_cp_le_set_scan_param param_cp; 2816 struct hci_cp_le_set_scan_enable enable_cp; 2817 struct hci_cp_inquiry inq_cp; 2818 struct hci_request req; 2819 /* General inquiry access code (GIAC) */ 2820 u8 lap[3] = { 0x33, 0x8b, 0x9e }; 2821 u8 status; 2822 int err; 2823 2824 BT_DBG("%s", hdev->name); 2825 2826 hci_dev_lock(hdev); 2827 2828 if (!hdev_is_powered(hdev)) { 2829 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2830 MGMT_STATUS_NOT_POWERED); 2831 goto failed; 2832 } 2833 2834 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) { 2835 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2836 MGMT_STATUS_BUSY); 2837 goto failed; 2838 } 2839 2840 if (hdev->discovery.state != DISCOVERY_STOPPED) { 2841 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2842 MGMT_STATUS_BUSY); 2843 goto failed; 2844 } 2845 2846 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0); 2847 if (!cmd) { 2848 err = -ENOMEM; 2849 goto failed; 2850 } 2851 2852 hdev->discovery.type = cp->type; 2853 2854 hci_req_init(&req, hdev); 2855 2856 switch (hdev->discovery.type) { 2857 case DISCOV_TYPE_BREDR: 2858 status = mgmt_bredr_support(hdev); 2859 if (status) { 2860 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2861 status); 2862 mgmt_pending_remove(cmd); 2863 goto failed; 2864 } 2865 2866 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 2867 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2868 MGMT_STATUS_BUSY); 2869 mgmt_pending_remove(cmd); 2870 goto failed; 2871 } 2872 2873 hci_inquiry_cache_flush(hdev); 2874 2875 memset(&inq_cp, 0, sizeof(inq_cp)); 2876 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap)); 2877 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN; 2878 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp); 2879 break; 2880 2881 case DISCOV_TYPE_LE: 2882 case DISCOV_TYPE_INTERLEAVED: 2883 status = mgmt_le_support(hdev); 2884 if (status) { 2885 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2886 status); 2887 mgmt_pending_remove(cmd); 2888 goto failed; 2889 } 2890 2891 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED && 2892 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) { 2893 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2894 MGMT_STATUS_NOT_SUPPORTED); 2895 mgmt_pending_remove(cmd); 2896 goto failed; 2897 } 2898 2899 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 2900 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2901 MGMT_STATUS_REJECTED); 2902 mgmt_pending_remove(cmd); 2903 goto failed; 2904 } 2905 2906 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) { 2907 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2908 MGMT_STATUS_BUSY); 2909 mgmt_pending_remove(cmd); 2910 goto failed; 2911 } 2912 2913 memset(¶m_cp, 0, sizeof(param_cp)); 2914 param_cp.type = LE_SCAN_ACTIVE; 2915 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT); 2916 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN); 2917 if (bacmp(&hdev->bdaddr, BDADDR_ANY)) 2918 param_cp.own_address_type = ADDR_LE_DEV_PUBLIC; 2919 else 2920 param_cp.own_address_type = ADDR_LE_DEV_RANDOM; 2921 hci_req_add(&req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp), 2922 ¶m_cp); 2923 2924 memset(&enable_cp, 0, sizeof(enable_cp)); 2925 enable_cp.enable = LE_SCAN_ENABLE; 2926 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 2927 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp), 2928 &enable_cp); 2929 break; 2930 2931 default: 2932 err = cmd_status(sk, hdev->id, MGMT_OP_START_DISCOVERY, 2933 MGMT_STATUS_INVALID_PARAMS); 2934 mgmt_pending_remove(cmd); 2935 goto failed; 2936 } 2937 2938 err = hci_req_run(&req, start_discovery_complete); 2939 if (err < 0) 2940 mgmt_pending_remove(cmd); 2941 else 2942 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 2943 2944failed: 2945 hci_dev_unlock(hdev); 2946 return err; 2947} 2948 2949static int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status) 2950{ 2951 struct pending_cmd *cmd; 2952 int err; 2953 2954 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 2955 if (!cmd) 2956 return -ENOENT; 2957 2958 err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status), 2959 &hdev->discovery.type, sizeof(hdev->discovery.type)); 2960 mgmt_pending_remove(cmd); 2961 2962 return err; 2963} 2964 2965static void stop_discovery_complete(struct hci_dev *hdev, u8 status) 2966{ 2967 BT_DBG("status %d", status); 2968 2969 hci_dev_lock(hdev); 2970 2971 if (status) { 2972 mgmt_stop_discovery_failed(hdev, status); 2973 goto unlock; 2974 } 2975 2976 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2977 2978unlock: 2979 hci_dev_unlock(hdev); 2980} 2981 2982static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 2983 u16 len) 2984{ 2985 struct mgmt_cp_stop_discovery *mgmt_cp = data; 2986 struct pending_cmd *cmd; 2987 struct hci_cp_remote_name_req_cancel cp; 2988 struct inquiry_entry *e; 2989 struct hci_request req; 2990 struct hci_cp_le_set_scan_enable enable_cp; 2991 int err; 2992 2993 BT_DBG("%s", hdev->name); 2994 2995 hci_dev_lock(hdev); 2996 2997 if (!hci_discovery_active(hdev)) { 2998 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 2999 MGMT_STATUS_REJECTED, &mgmt_cp->type, 3000 sizeof(mgmt_cp->type)); 3001 goto unlock; 3002 } 3003 3004 if (hdev->discovery.type != mgmt_cp->type) { 3005 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3006 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type, 3007 sizeof(mgmt_cp->type)); 3008 goto unlock; 3009 } 3010 3011 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0); 3012 if (!cmd) { 3013 err = -ENOMEM; 3014 goto unlock; 3015 } 3016 3017 hci_req_init(&req, hdev); 3018 3019 switch (hdev->discovery.state) { 3020 case DISCOVERY_FINDING: 3021 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 3022 hci_req_add(&req, HCI_OP_INQUIRY_CANCEL, 0, NULL); 3023 } else { 3024 cancel_delayed_work(&hdev->le_scan_disable); 3025 3026 memset(&enable_cp, 0, sizeof(enable_cp)); 3027 enable_cp.enable = LE_SCAN_DISABLE; 3028 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, 3029 sizeof(enable_cp), &enable_cp); 3030 } 3031 3032 break; 3033 3034 case DISCOVERY_RESOLVING: 3035 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 3036 NAME_PENDING); 3037 if (!e) { 3038 mgmt_pending_remove(cmd); 3039 err = cmd_complete(sk, hdev->id, 3040 MGMT_OP_STOP_DISCOVERY, 0, 3041 &mgmt_cp->type, 3042 sizeof(mgmt_cp->type)); 3043 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3044 goto unlock; 3045 } 3046 3047 bacpy(&cp.bdaddr, &e->data.bdaddr); 3048 hci_req_add(&req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp), 3049 &cp); 3050 3051 break; 3052 3053 default: 3054 BT_DBG("unknown discovery state %u", hdev->discovery.state); 3055 3056 mgmt_pending_remove(cmd); 3057 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 3058 MGMT_STATUS_FAILED, &mgmt_cp->type, 3059 sizeof(mgmt_cp->type)); 3060 goto unlock; 3061 } 3062 3063 err = hci_req_run(&req, stop_discovery_complete); 3064 if (err < 0) 3065 mgmt_pending_remove(cmd); 3066 else 3067 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 3068 3069unlock: 3070 hci_dev_unlock(hdev); 3071 return err; 3072} 3073 3074static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 3075 u16 len) 3076{ 3077 struct mgmt_cp_confirm_name *cp = data; 3078 struct inquiry_entry *e; 3079 int err; 3080 3081 BT_DBG("%s", hdev->name); 3082 3083 hci_dev_lock(hdev); 3084 3085 if (!hci_discovery_active(hdev)) { 3086 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 3087 MGMT_STATUS_FAILED); 3088 goto failed; 3089 } 3090 3091 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 3092 if (!e) { 3093 err = cmd_status(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 3094 MGMT_STATUS_INVALID_PARAMS); 3095 goto failed; 3096 } 3097 3098 if (cp->name_known) { 3099 e->name_state = NAME_KNOWN; 3100 list_del(&e->list); 3101 } else { 3102 e->name_state = NAME_NEEDED; 3103 hci_inquiry_cache_update_resolve(hdev, e); 3104 } 3105 3106 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr, 3107 sizeof(cp->addr)); 3108 3109failed: 3110 hci_dev_unlock(hdev); 3111 return err; 3112} 3113 3114static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 3115 u16 len) 3116{ 3117 struct mgmt_cp_block_device *cp = data; 3118 u8 status; 3119 int err; 3120 3121 BT_DBG("%s", hdev->name); 3122 3123 if (!bdaddr_type_is_valid(cp->addr.type)) 3124 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 3125 MGMT_STATUS_INVALID_PARAMS, 3126 &cp->addr, sizeof(cp->addr)); 3127 3128 hci_dev_lock(hdev); 3129 3130 err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type); 3131 if (err < 0) 3132 status = MGMT_STATUS_FAILED; 3133 else 3134 status = MGMT_STATUS_SUCCESS; 3135 3136 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 3137 &cp->addr, sizeof(cp->addr)); 3138 3139 hci_dev_unlock(hdev); 3140 3141 return err; 3142} 3143 3144static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 3145 u16 len) 3146{ 3147 struct mgmt_cp_unblock_device *cp = data; 3148 u8 status; 3149 int err; 3150 3151 BT_DBG("%s", hdev->name); 3152 3153 if (!bdaddr_type_is_valid(cp->addr.type)) 3154 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 3155 MGMT_STATUS_INVALID_PARAMS, 3156 &cp->addr, sizeof(cp->addr)); 3157 3158 hci_dev_lock(hdev); 3159 3160 err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type); 3161 if (err < 0) 3162 status = MGMT_STATUS_INVALID_PARAMS; 3163 else 3164 status = MGMT_STATUS_SUCCESS; 3165 3166 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 3167 &cp->addr, sizeof(cp->addr)); 3168 3169 hci_dev_unlock(hdev); 3170 3171 return err; 3172} 3173 3174static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 3175 u16 len) 3176{ 3177 struct mgmt_cp_set_device_id *cp = data; 3178 struct hci_request req; 3179 int err; 3180 __u16 source; 3181 3182 BT_DBG("%s", hdev->name); 3183 3184 source = __le16_to_cpu(cp->source); 3185 3186 if (source > 0x0002) 3187 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 3188 MGMT_STATUS_INVALID_PARAMS); 3189 3190 hci_dev_lock(hdev); 3191 3192 hdev->devid_source = source; 3193 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 3194 hdev->devid_product = __le16_to_cpu(cp->product); 3195 hdev->devid_version = __le16_to_cpu(cp->version); 3196 3197 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0); 3198 3199 hci_req_init(&req, hdev); 3200 update_eir(&req); 3201 hci_req_run(&req, NULL); 3202 3203 hci_dev_unlock(hdev); 3204 3205 return err; 3206} 3207 3208static void set_advertising_complete(struct hci_dev *hdev, u8 status) 3209{ 3210 struct cmd_lookup match = { NULL, hdev }; 3211 3212 if (status) { 3213 u8 mgmt_err = mgmt_status(status); 3214 3215 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 3216 cmd_status_rsp, &mgmt_err); 3217 return; 3218 } 3219 3220 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 3221 &match); 3222 3223 new_settings(hdev, match.sk); 3224 3225 if (match.sk) 3226 sock_put(match.sk); 3227} 3228 3229static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 3230{ 3231 struct mgmt_mode *cp = data; 3232 struct pending_cmd *cmd; 3233 struct hci_request req; 3234 u8 val, enabled, status; 3235 int err; 3236 3237 BT_DBG("request for %s", hdev->name); 3238 3239 status = mgmt_le_support(hdev); 3240 if (status) 3241 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3242 status); 3243 3244 if (cp->val != 0x00 && cp->val != 0x01) 3245 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3246 MGMT_STATUS_INVALID_PARAMS); 3247 3248 hci_dev_lock(hdev); 3249 3250 val = !!cp->val; 3251 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags); 3252 3253 if (!hdev_is_powered(hdev) || val == enabled) { 3254 bool changed = false; 3255 3256 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 3257 change_bit(HCI_ADVERTISING, &hdev->dev_flags); 3258 changed = true; 3259 } 3260 3261 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 3262 if (err < 0) 3263 goto unlock; 3264 3265 if (changed) 3266 err = new_settings(hdev, sk); 3267 3268 goto unlock; 3269 } 3270 3271 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 3272 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) { 3273 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 3274 MGMT_STATUS_BUSY); 3275 goto unlock; 3276 } 3277 3278 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 3279 if (!cmd) { 3280 err = -ENOMEM; 3281 goto unlock; 3282 } 3283 3284 hci_req_init(&req, hdev); 3285 3286 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(val), &val); 3287 3288 err = hci_req_run(&req, set_advertising_complete); 3289 if (err < 0) 3290 mgmt_pending_remove(cmd); 3291 3292unlock: 3293 hci_dev_unlock(hdev); 3294 return err; 3295} 3296 3297static int set_static_address(struct sock *sk, struct hci_dev *hdev, 3298 void *data, u16 len) 3299{ 3300 struct mgmt_cp_set_static_address *cp = data; 3301 int err; 3302 3303 BT_DBG("%s", hdev->name); 3304 3305 if (!lmp_le_capable(hdev)) 3306 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 3307 MGMT_STATUS_NOT_SUPPORTED); 3308 3309 if (hdev_is_powered(hdev)) 3310 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 3311 MGMT_STATUS_REJECTED); 3312 3313 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 3314 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 3315 return cmd_status(sk, hdev->id, 3316 MGMT_OP_SET_STATIC_ADDRESS, 3317 MGMT_STATUS_INVALID_PARAMS); 3318 3319 /* Two most significant bits shall be set */ 3320 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 3321 return cmd_status(sk, hdev->id, 3322 MGMT_OP_SET_STATIC_ADDRESS, 3323 MGMT_STATUS_INVALID_PARAMS); 3324 } 3325 3326 hci_dev_lock(hdev); 3327 3328 bacpy(&hdev->static_addr, &cp->bdaddr); 3329 3330 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0); 3331 3332 hci_dev_unlock(hdev); 3333 3334 return err; 3335} 3336 3337static void fast_connectable_complete(struct hci_dev *hdev, u8 status) 3338{ 3339 struct pending_cmd *cmd; 3340 3341 BT_DBG("status 0x%02x", status); 3342 3343 hci_dev_lock(hdev); 3344 3345 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 3346 if (!cmd) 3347 goto unlock; 3348 3349 if (status) { 3350 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3351 mgmt_status(status)); 3352 } else { 3353 struct mgmt_mode *cp = cmd->param; 3354 3355 if (cp->val) 3356 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags); 3357 else 3358 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags); 3359 3360 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 3361 new_settings(hdev, cmd->sk); 3362 } 3363 3364 mgmt_pending_remove(cmd); 3365 3366unlock: 3367 hci_dev_unlock(hdev); 3368} 3369 3370static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 3371 void *data, u16 len) 3372{ 3373 struct mgmt_mode *cp = data; 3374 struct pending_cmd *cmd; 3375 struct hci_request req; 3376 int err; 3377 3378 BT_DBG("%s", hdev->name); 3379 3380 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) || 3381 hdev->hci_ver < BLUETOOTH_VER_1_2) 3382 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3383 MGMT_STATUS_NOT_SUPPORTED); 3384 3385 if (cp->val != 0x00 && cp->val != 0x01) 3386 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3387 MGMT_STATUS_INVALID_PARAMS); 3388 3389 if (!hdev_is_powered(hdev)) 3390 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3391 MGMT_STATUS_NOT_POWERED); 3392 3393 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3394 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3395 MGMT_STATUS_REJECTED); 3396 3397 hci_dev_lock(hdev); 3398 3399 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 3400 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3401 MGMT_STATUS_BUSY); 3402 goto unlock; 3403 } 3404 3405 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) { 3406 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 3407 hdev); 3408 goto unlock; 3409 } 3410 3411 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 3412 data, len); 3413 if (!cmd) { 3414 err = -ENOMEM; 3415 goto unlock; 3416 } 3417 3418 hci_req_init(&req, hdev); 3419 3420 write_fast_connectable(&req, cp->val); 3421 3422 err = hci_req_run(&req, fast_connectable_complete); 3423 if (err < 0) { 3424 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 3425 MGMT_STATUS_FAILED); 3426 mgmt_pending_remove(cmd); 3427 } 3428 3429unlock: 3430 hci_dev_unlock(hdev); 3431 3432 return err; 3433} 3434 3435static void set_bredr_complete(struct hci_dev *hdev, u8 status) 3436{ 3437 struct pending_cmd *cmd; 3438 3439 BT_DBG("status 0x%02x", status); 3440 3441 hci_dev_lock(hdev); 3442 3443 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev); 3444 if (!cmd) 3445 goto unlock; 3446 3447 if (status) { 3448 u8 mgmt_err = mgmt_status(status); 3449 3450 /* We need to restore the flag if related HCI commands 3451 * failed. 3452 */ 3453 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags); 3454 3455 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 3456 } else { 3457 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 3458 new_settings(hdev, cmd->sk); 3459 } 3460 3461 mgmt_pending_remove(cmd); 3462 3463unlock: 3464 hci_dev_unlock(hdev); 3465} 3466 3467static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 3468{ 3469 struct mgmt_mode *cp = data; 3470 struct pending_cmd *cmd; 3471 struct hci_request req; 3472 int err; 3473 3474 BT_DBG("request for %s", hdev->name); 3475 3476 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 3477 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3478 MGMT_STATUS_NOT_SUPPORTED); 3479 3480 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) 3481 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3482 MGMT_STATUS_REJECTED); 3483 3484 if (cp->val != 0x00 && cp->val != 0x01) 3485 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3486 MGMT_STATUS_INVALID_PARAMS); 3487 3488 hci_dev_lock(hdev); 3489 3490 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) { 3491 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 3492 goto unlock; 3493 } 3494 3495 if (!hdev_is_powered(hdev)) { 3496 if (!cp->val) { 3497 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags); 3498 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags); 3499 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags); 3500 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 3501 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags); 3502 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags); 3503 } 3504 3505 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags); 3506 3507 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 3508 if (err < 0) 3509 goto unlock; 3510 3511 err = new_settings(hdev, sk); 3512 goto unlock; 3513 } 3514 3515 /* Reject disabling when powered on */ 3516 if (!cp->val) { 3517 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3518 MGMT_STATUS_REJECTED); 3519 goto unlock; 3520 } 3521 3522 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) { 3523 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 3524 MGMT_STATUS_BUSY); 3525 goto unlock; 3526 } 3527 3528 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 3529 if (!cmd) { 3530 err = -ENOMEM; 3531 goto unlock; 3532 } 3533 3534 /* We need to flip the bit already here so that hci_update_ad 3535 * generates the correct flags. 3536 */ 3537 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags); 3538 3539 hci_req_init(&req, hdev); 3540 hci_update_ad(&req); 3541 err = hci_req_run(&req, set_bredr_complete); 3542 if (err < 0) 3543 mgmt_pending_remove(cmd); 3544 3545unlock: 3546 hci_dev_unlock(hdev); 3547 return err; 3548} 3549 3550static bool ltk_is_valid(struct mgmt_ltk_info *key) 3551{ 3552 if (key->authenticated != 0x00 && key->authenticated != 0x01) 3553 return false; 3554 if (key->master != 0x00 && key->master != 0x01) 3555 return false; 3556 if (!bdaddr_type_is_le(key->addr.type)) 3557 return false; 3558 return true; 3559} 3560 3561static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 3562 void *cp_data, u16 len) 3563{ 3564 struct mgmt_cp_load_long_term_keys *cp = cp_data; 3565 u16 key_count, expected_len; 3566 int i, err; 3567 3568 BT_DBG("request for %s", hdev->name); 3569 3570 if (!lmp_le_capable(hdev)) 3571 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 3572 MGMT_STATUS_NOT_SUPPORTED); 3573 3574 key_count = __le16_to_cpu(cp->key_count); 3575 3576 expected_len = sizeof(*cp) + key_count * 3577 sizeof(struct mgmt_ltk_info); 3578 if (expected_len != len) { 3579 BT_ERR("load_keys: expected %u bytes, got %u bytes", 3580 len, expected_len); 3581 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 3582 MGMT_STATUS_INVALID_PARAMS); 3583 } 3584 3585 BT_DBG("%s key_count %u", hdev->name, key_count); 3586 3587 for (i = 0; i < key_count; i++) { 3588 struct mgmt_ltk_info *key = &cp->keys[i]; 3589 3590 if (!ltk_is_valid(key)) 3591 return cmd_status(sk, hdev->id, 3592 MGMT_OP_LOAD_LONG_TERM_KEYS, 3593 MGMT_STATUS_INVALID_PARAMS); 3594 } 3595 3596 hci_dev_lock(hdev); 3597 3598 hci_smp_ltks_clear(hdev); 3599 3600 for (i = 0; i < key_count; i++) { 3601 struct mgmt_ltk_info *key = &cp->keys[i]; 3602 u8 type; 3603 3604 if (key->master) 3605 type = HCI_SMP_LTK; 3606 else 3607 type = HCI_SMP_LTK_SLAVE; 3608 3609 hci_add_ltk(hdev, &key->addr.bdaddr, 3610 bdaddr_to_le(key->addr.type), 3611 type, 0, key->authenticated, key->val, 3612 key->enc_size, key->ediv, key->rand); 3613 } 3614 3615 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 3616 NULL, 0); 3617 3618 hci_dev_unlock(hdev); 3619 3620 return err; 3621} 3622 3623static const struct mgmt_handler { 3624 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data, 3625 u16 data_len); 3626 bool var_len; 3627 size_t data_len; 3628} mgmt_handlers[] = { 3629 { NULL }, /* 0x0000 (no command) */ 3630 { read_version, false, MGMT_READ_VERSION_SIZE }, 3631 { read_commands, false, MGMT_READ_COMMANDS_SIZE }, 3632 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE }, 3633 { read_controller_info, false, MGMT_READ_INFO_SIZE }, 3634 { set_powered, false, MGMT_SETTING_SIZE }, 3635 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE }, 3636 { set_connectable, false, MGMT_SETTING_SIZE }, 3637 { set_fast_connectable, false, MGMT_SETTING_SIZE }, 3638 { set_pairable, false, MGMT_SETTING_SIZE }, 3639 { set_link_security, false, MGMT_SETTING_SIZE }, 3640 { set_ssp, false, MGMT_SETTING_SIZE }, 3641 { set_hs, false, MGMT_SETTING_SIZE }, 3642 { set_le, false, MGMT_SETTING_SIZE }, 3643 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE }, 3644 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE }, 3645 { add_uuid, false, MGMT_ADD_UUID_SIZE }, 3646 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE }, 3647 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE }, 3648 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE }, 3649 { disconnect, false, MGMT_DISCONNECT_SIZE }, 3650 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE }, 3651 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE }, 3652 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 3653 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE }, 3654 { pair_device, false, MGMT_PAIR_DEVICE_SIZE }, 3655 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 3656 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE }, 3657 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE }, 3658 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 3659 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE }, 3660 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 3661 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 3662 { add_remote_oob_data, false, MGMT_ADD_REMOTE_OOB_DATA_SIZE }, 3663 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 3664 { start_discovery, false, MGMT_START_DISCOVERY_SIZE }, 3665 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE }, 3666 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE }, 3667 { block_device, false, MGMT_BLOCK_DEVICE_SIZE }, 3668 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE }, 3669 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE }, 3670 { set_advertising, false, MGMT_SETTING_SIZE }, 3671 { set_bredr, false, MGMT_SETTING_SIZE }, 3672 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE }, 3673}; 3674 3675 3676int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen) 3677{ 3678 void *buf; 3679 u8 *cp; 3680 struct mgmt_hdr *hdr; 3681 u16 opcode, index, len; 3682 struct hci_dev *hdev = NULL; 3683 const struct mgmt_handler *handler; 3684 int err; 3685 3686 BT_DBG("got %zu bytes", msglen); 3687 3688 if (msglen < sizeof(*hdr)) 3689 return -EINVAL; 3690 3691 buf = kmalloc(msglen, GFP_KERNEL); 3692 if (!buf) 3693 return -ENOMEM; 3694 3695 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) { 3696 err = -EFAULT; 3697 goto done; 3698 } 3699 3700 hdr = buf; 3701 opcode = __le16_to_cpu(hdr->opcode); 3702 index = __le16_to_cpu(hdr->index); 3703 len = __le16_to_cpu(hdr->len); 3704 3705 if (len != msglen - sizeof(*hdr)) { 3706 err = -EINVAL; 3707 goto done; 3708 } 3709 3710 if (index != MGMT_INDEX_NONE) { 3711 hdev = hci_dev_get(index); 3712 if (!hdev) { 3713 err = cmd_status(sk, index, opcode, 3714 MGMT_STATUS_INVALID_INDEX); 3715 goto done; 3716 } 3717 3718 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) { 3719 err = cmd_status(sk, index, opcode, 3720 MGMT_STATUS_INVALID_INDEX); 3721 goto done; 3722 } 3723 } 3724 3725 if (opcode >= ARRAY_SIZE(mgmt_handlers) || 3726 mgmt_handlers[opcode].func == NULL) { 3727 BT_DBG("Unknown op %u", opcode); 3728 err = cmd_status(sk, index, opcode, 3729 MGMT_STATUS_UNKNOWN_COMMAND); 3730 goto done; 3731 } 3732 3733 if ((hdev && opcode < MGMT_OP_READ_INFO) || 3734 (!hdev && opcode >= MGMT_OP_READ_INFO)) { 3735 err = cmd_status(sk, index, opcode, 3736 MGMT_STATUS_INVALID_INDEX); 3737 goto done; 3738 } 3739 3740 handler = &mgmt_handlers[opcode]; 3741 3742 if ((handler->var_len && len < handler->data_len) || 3743 (!handler->var_len && len != handler->data_len)) { 3744 err = cmd_status(sk, index, opcode, 3745 MGMT_STATUS_INVALID_PARAMS); 3746 goto done; 3747 } 3748 3749 if (hdev) 3750 mgmt_init_hdev(sk, hdev); 3751 3752 cp = buf + sizeof(*hdr); 3753 3754 err = handler->func(sk, hdev, cp, len); 3755 if (err < 0) 3756 goto done; 3757 3758 err = msglen; 3759 3760done: 3761 if (hdev) 3762 hci_dev_put(hdev); 3763 3764 kfree(buf); 3765 return err; 3766} 3767 3768int mgmt_index_added(struct hci_dev *hdev) 3769{ 3770 if (!mgmt_valid_hdev(hdev)) 3771 return -ENOTSUPP; 3772 3773 return mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL); 3774} 3775 3776int mgmt_index_removed(struct hci_dev *hdev) 3777{ 3778 u8 status = MGMT_STATUS_INVALID_INDEX; 3779 3780 if (!mgmt_valid_hdev(hdev)) 3781 return -ENOTSUPP; 3782 3783 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status); 3784 3785 return mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL); 3786} 3787 3788static void set_bredr_scan(struct hci_request *req) 3789{ 3790 struct hci_dev *hdev = req->hdev; 3791 u8 scan = 0; 3792 3793 /* Ensure that fast connectable is disabled. This function will 3794 * not do anything if the page scan parameters are already what 3795 * they should be. 3796 */ 3797 write_fast_connectable(req, false); 3798 3799 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3800 scan |= SCAN_PAGE; 3801 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 3802 scan |= SCAN_INQUIRY; 3803 3804 if (scan) 3805 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 3806} 3807 3808static void powered_complete(struct hci_dev *hdev, u8 status) 3809{ 3810 struct cmd_lookup match = { NULL, hdev }; 3811 3812 BT_DBG("status 0x%02x", status); 3813 3814 hci_dev_lock(hdev); 3815 3816 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 3817 3818 new_settings(hdev, match.sk); 3819 3820 hci_dev_unlock(hdev); 3821 3822 if (match.sk) 3823 sock_put(match.sk); 3824} 3825 3826static int powered_update_hci(struct hci_dev *hdev) 3827{ 3828 struct hci_request req; 3829 u8 link_sec; 3830 3831 hci_req_init(&req, hdev); 3832 3833 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) && 3834 !lmp_host_ssp_capable(hdev)) { 3835 u8 ssp = 1; 3836 3837 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp); 3838 } 3839 3840 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) && 3841 lmp_bredr_capable(hdev)) { 3842 struct hci_cp_write_le_host_supported cp; 3843 3844 cp.le = 1; 3845 cp.simul = lmp_le_br_capable(hdev); 3846 3847 /* Check first if we already have the right 3848 * host state (host features set) 3849 */ 3850 if (cp.le != lmp_host_le_capable(hdev) || 3851 cp.simul != lmp_host_le_br_capable(hdev)) 3852 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, 3853 sizeof(cp), &cp); 3854 3855 /* In case BR/EDR was toggled during the AUTO_OFF phase */ 3856 hci_update_ad(&req); 3857 } 3858 3859 if (lmp_le_capable(hdev)) { 3860 /* Set random address to static address if configured */ 3861 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 3862 hci_req_add(&req, HCI_OP_LE_SET_RANDOM_ADDR, 6, 3863 &hdev->static_addr); 3864 } 3865 3866 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) { 3867 u8 adv = 0x01; 3868 3869 hci_req_add(&req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(adv), &adv); 3870 } 3871 3872 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags); 3873 if (link_sec != test_bit(HCI_AUTH, &hdev->flags)) 3874 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE, 3875 sizeof(link_sec), &link_sec); 3876 3877 if (lmp_bredr_capable(hdev)) { 3878 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) 3879 set_bredr_scan(&req); 3880 update_class(&req); 3881 update_name(&req); 3882 update_eir(&req); 3883 } 3884 3885 return hci_req_run(&req, powered_complete); 3886} 3887 3888int mgmt_powered(struct hci_dev *hdev, u8 powered) 3889{ 3890 struct cmd_lookup match = { NULL, hdev }; 3891 u8 status_not_powered = MGMT_STATUS_NOT_POWERED; 3892 u8 zero_cod[] = { 0, 0, 0 }; 3893 int err; 3894 3895 if (!test_bit(HCI_MGMT, &hdev->dev_flags)) 3896 return 0; 3897 3898 if (powered) { 3899 if (powered_update_hci(hdev) == 0) 3900 return 0; 3901 3902 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, 3903 &match); 3904 goto new_settings; 3905 } 3906 3907 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 3908 mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status_not_powered); 3909 3910 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) 3911 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 3912 zero_cod, sizeof(zero_cod), NULL); 3913 3914new_settings: 3915 err = new_settings(hdev, match.sk); 3916 3917 if (match.sk) 3918 sock_put(match.sk); 3919 3920 return err; 3921} 3922 3923int mgmt_set_powered_failed(struct hci_dev *hdev, int err) 3924{ 3925 struct pending_cmd *cmd; 3926 u8 status; 3927 3928 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev); 3929 if (!cmd) 3930 return -ENOENT; 3931 3932 if (err == -ERFKILL) 3933 status = MGMT_STATUS_RFKILLED; 3934 else 3935 status = MGMT_STATUS_FAILED; 3936 3937 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 3938 3939 mgmt_pending_remove(cmd); 3940 3941 return err; 3942} 3943 3944int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable) 3945{ 3946 struct cmd_lookup match = { NULL, hdev }; 3947 bool changed = false; 3948 int err = 0; 3949 3950 if (discoverable) { 3951 if (!test_and_set_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 3952 changed = true; 3953 } else { 3954 if (test_and_clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) 3955 changed = true; 3956 } 3957 3958 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, 3959 &match); 3960 3961 if (changed) 3962 err = new_settings(hdev, match.sk); 3963 3964 if (match.sk) 3965 sock_put(match.sk); 3966 3967 return err; 3968} 3969 3970int mgmt_connectable(struct hci_dev *hdev, u8 connectable) 3971{ 3972 struct pending_cmd *cmd; 3973 bool changed = false; 3974 int err = 0; 3975 3976 if (connectable) { 3977 if (!test_and_set_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3978 changed = true; 3979 } else { 3980 if (test_and_clear_bit(HCI_CONNECTABLE, &hdev->dev_flags)) 3981 changed = true; 3982 } 3983 3984 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 3985 3986 if (changed) 3987 err = new_settings(hdev, cmd ? cmd->sk : NULL); 3988 3989 return err; 3990} 3991 3992int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status) 3993{ 3994 u8 mgmt_err = mgmt_status(status); 3995 3996 if (scan & SCAN_PAGE) 3997 mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, 3998 cmd_status_rsp, &mgmt_err); 3999 4000 if (scan & SCAN_INQUIRY) 4001 mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, 4002 cmd_status_rsp, &mgmt_err); 4003 4004 return 0; 4005} 4006 4007int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 4008 bool persistent) 4009{ 4010 struct mgmt_ev_new_link_key ev; 4011 4012 memset(&ev, 0, sizeof(ev)); 4013 4014 ev.store_hint = persistent; 4015 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 4016 ev.key.addr.type = BDADDR_BREDR; 4017 ev.key.type = key->type; 4018 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 4019 ev.key.pin_len = key->pin_len; 4020 4021 return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 4022} 4023 4024int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent) 4025{ 4026 struct mgmt_ev_new_long_term_key ev; 4027 4028 memset(&ev, 0, sizeof(ev)); 4029 4030 ev.store_hint = persistent; 4031 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 4032 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 4033 ev.key.authenticated = key->authenticated; 4034 ev.key.enc_size = key->enc_size; 4035 ev.key.ediv = key->ediv; 4036 4037 if (key->type == HCI_SMP_LTK) 4038 ev.key.master = 1; 4039 4040 memcpy(ev.key.rand, key->rand, sizeof(key->rand)); 4041 memcpy(ev.key.val, key->val, sizeof(key->val)); 4042 4043 return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), 4044 NULL); 4045} 4046 4047int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4048 u8 addr_type, u32 flags, u8 *name, u8 name_len, 4049 u8 *dev_class) 4050{ 4051 char buf[512]; 4052 struct mgmt_ev_device_connected *ev = (void *) buf; 4053 u16 eir_len = 0; 4054 4055 bacpy(&ev->addr.bdaddr, bdaddr); 4056 ev->addr.type = link_to_bdaddr(link_type, addr_type); 4057 4058 ev->flags = __cpu_to_le32(flags); 4059 4060 if (name_len > 0) 4061 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 4062 name, name_len); 4063 4064 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0) 4065 eir_len = eir_append_data(ev->eir, eir_len, 4066 EIR_CLASS_OF_DEV, dev_class, 3); 4067 4068 ev->eir_len = cpu_to_le16(eir_len); 4069 4070 return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 4071 sizeof(*ev) + eir_len, NULL); 4072} 4073 4074static void disconnect_rsp(struct pending_cmd *cmd, void *data) 4075{ 4076 struct mgmt_cp_disconnect *cp = cmd->param; 4077 struct sock **sk = data; 4078 struct mgmt_rp_disconnect rp; 4079 4080 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4081 rp.addr.type = cp->addr.type; 4082 4083 cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp, 4084 sizeof(rp)); 4085 4086 *sk = cmd->sk; 4087 sock_hold(*sk); 4088 4089 mgmt_pending_remove(cmd); 4090} 4091 4092static void unpair_device_rsp(struct pending_cmd *cmd, void *data) 4093{ 4094 struct hci_dev *hdev = data; 4095 struct mgmt_cp_unpair_device *cp = cmd->param; 4096 struct mgmt_rp_unpair_device rp; 4097 4098 memset(&rp, 0, sizeof(rp)); 4099 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4100 rp.addr.type = cp->addr.type; 4101 4102 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 4103 4104 cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp)); 4105 4106 mgmt_pending_remove(cmd); 4107} 4108 4109int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 4110 u8 link_type, u8 addr_type, u8 reason) 4111{ 4112 struct mgmt_ev_device_disconnected ev; 4113 struct sock *sk = NULL; 4114 int err; 4115 4116 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 4117 4118 bacpy(&ev.addr.bdaddr, bdaddr); 4119 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4120 ev.reason = reason; 4121 4122 err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), 4123 sk); 4124 4125 if (sk) 4126 sock_put(sk); 4127 4128 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 4129 hdev); 4130 4131 return err; 4132} 4133 4134int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 4135 u8 link_type, u8 addr_type, u8 status) 4136{ 4137 struct mgmt_rp_disconnect rp; 4138 struct pending_cmd *cmd; 4139 int err; 4140 4141 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 4142 hdev); 4143 4144 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev); 4145 if (!cmd) 4146 return -ENOENT; 4147 4148 bacpy(&rp.addr.bdaddr, bdaddr); 4149 rp.addr.type = link_to_bdaddr(link_type, addr_type); 4150 4151 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 4152 mgmt_status(status), &rp, sizeof(rp)); 4153 4154 mgmt_pending_remove(cmd); 4155 4156 return err; 4157} 4158 4159int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4160 u8 addr_type, u8 status) 4161{ 4162 struct mgmt_ev_connect_failed ev; 4163 4164 bacpy(&ev.addr.bdaddr, bdaddr); 4165 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4166 ev.status = mgmt_status(status); 4167 4168 return mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 4169} 4170 4171int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 4172{ 4173 struct mgmt_ev_pin_code_request ev; 4174 4175 bacpy(&ev.addr.bdaddr, bdaddr); 4176 ev.addr.type = BDADDR_BREDR; 4177 ev.secure = secure; 4178 4179 return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), 4180 NULL); 4181} 4182 4183int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4184 u8 status) 4185{ 4186 struct pending_cmd *cmd; 4187 struct mgmt_rp_pin_code_reply rp; 4188 int err; 4189 4190 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 4191 if (!cmd) 4192 return -ENOENT; 4193 4194 bacpy(&rp.addr.bdaddr, bdaddr); 4195 rp.addr.type = BDADDR_BREDR; 4196 4197 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 4198 mgmt_status(status), &rp, sizeof(rp)); 4199 4200 mgmt_pending_remove(cmd); 4201 4202 return err; 4203} 4204 4205int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4206 u8 status) 4207{ 4208 struct pending_cmd *cmd; 4209 struct mgmt_rp_pin_code_reply rp; 4210 int err; 4211 4212 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 4213 if (!cmd) 4214 return -ENOENT; 4215 4216 bacpy(&rp.addr.bdaddr, bdaddr); 4217 rp.addr.type = BDADDR_BREDR; 4218 4219 err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, 4220 mgmt_status(status), &rp, sizeof(rp)); 4221 4222 mgmt_pending_remove(cmd); 4223 4224 return err; 4225} 4226 4227int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 4228 u8 link_type, u8 addr_type, __le32 value, 4229 u8 confirm_hint) 4230{ 4231 struct mgmt_ev_user_confirm_request ev; 4232 4233 BT_DBG("%s", hdev->name); 4234 4235 bacpy(&ev.addr.bdaddr, bdaddr); 4236 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4237 ev.confirm_hint = confirm_hint; 4238 ev.value = value; 4239 4240 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 4241 NULL); 4242} 4243 4244int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 4245 u8 link_type, u8 addr_type) 4246{ 4247 struct mgmt_ev_user_passkey_request ev; 4248 4249 BT_DBG("%s", hdev->name); 4250 4251 bacpy(&ev.addr.bdaddr, bdaddr); 4252 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4253 4254 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 4255 NULL); 4256} 4257 4258static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4259 u8 link_type, u8 addr_type, u8 status, 4260 u8 opcode) 4261{ 4262 struct pending_cmd *cmd; 4263 struct mgmt_rp_user_confirm_reply rp; 4264 int err; 4265 4266 cmd = mgmt_pending_find(opcode, hdev); 4267 if (!cmd) 4268 return -ENOENT; 4269 4270 bacpy(&rp.addr.bdaddr, bdaddr); 4271 rp.addr.type = link_to_bdaddr(link_type, addr_type); 4272 err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status), 4273 &rp, sizeof(rp)); 4274 4275 mgmt_pending_remove(cmd); 4276 4277 return err; 4278} 4279 4280int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4281 u8 link_type, u8 addr_type, u8 status) 4282{ 4283 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4284 status, MGMT_OP_USER_CONFIRM_REPLY); 4285} 4286 4287int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4288 u8 link_type, u8 addr_type, u8 status) 4289{ 4290 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4291 status, 4292 MGMT_OP_USER_CONFIRM_NEG_REPLY); 4293} 4294 4295int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4296 u8 link_type, u8 addr_type, u8 status) 4297{ 4298 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4299 status, MGMT_OP_USER_PASSKEY_REPLY); 4300} 4301 4302int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 4303 u8 link_type, u8 addr_type, u8 status) 4304{ 4305 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 4306 status, 4307 MGMT_OP_USER_PASSKEY_NEG_REPLY); 4308} 4309 4310int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 4311 u8 link_type, u8 addr_type, u32 passkey, 4312 u8 entered) 4313{ 4314 struct mgmt_ev_passkey_notify ev; 4315 4316 BT_DBG("%s", hdev->name); 4317 4318 bacpy(&ev.addr.bdaddr, bdaddr); 4319 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4320 ev.passkey = __cpu_to_le32(passkey); 4321 ev.entered = entered; 4322 4323 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 4324} 4325 4326int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4327 u8 addr_type, u8 status) 4328{ 4329 struct mgmt_ev_auth_failed ev; 4330 4331 bacpy(&ev.addr.bdaddr, bdaddr); 4332 ev.addr.type = link_to_bdaddr(link_type, addr_type); 4333 ev.status = mgmt_status(status); 4334 4335 return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL); 4336} 4337 4338int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 4339{ 4340 struct cmd_lookup match = { NULL, hdev }; 4341 bool changed = false; 4342 int err = 0; 4343 4344 if (status) { 4345 u8 mgmt_err = mgmt_status(status); 4346 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 4347 cmd_status_rsp, &mgmt_err); 4348 return 0; 4349 } 4350 4351 if (test_bit(HCI_AUTH, &hdev->flags)) { 4352 if (!test_and_set_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 4353 changed = true; 4354 } else { 4355 if (test_and_clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) 4356 changed = true; 4357 } 4358 4359 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 4360 &match); 4361 4362 if (changed) 4363 err = new_settings(hdev, match.sk); 4364 4365 if (match.sk) 4366 sock_put(match.sk); 4367 4368 return err; 4369} 4370 4371static void clear_eir(struct hci_request *req) 4372{ 4373 struct hci_dev *hdev = req->hdev; 4374 struct hci_cp_write_eir cp; 4375 4376 if (!lmp_ext_inq_capable(hdev)) 4377 return; 4378 4379 memset(hdev->eir, 0, sizeof(hdev->eir)); 4380 4381 memset(&cp, 0, sizeof(cp)); 4382 4383 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 4384} 4385 4386int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 4387{ 4388 struct cmd_lookup match = { NULL, hdev }; 4389 struct hci_request req; 4390 bool changed = false; 4391 int err = 0; 4392 4393 if (status) { 4394 u8 mgmt_err = mgmt_status(status); 4395 4396 if (enable && test_and_clear_bit(HCI_SSP_ENABLED, 4397 &hdev->dev_flags)) 4398 err = new_settings(hdev, NULL); 4399 4400 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 4401 &mgmt_err); 4402 4403 return err; 4404 } 4405 4406 if (enable) { 4407 if (!test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 4408 changed = true; 4409 } else { 4410 if (test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 4411 changed = true; 4412 } 4413 4414 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 4415 4416 if (changed) 4417 err = new_settings(hdev, match.sk); 4418 4419 if (match.sk) 4420 sock_put(match.sk); 4421 4422 hci_req_init(&req, hdev); 4423 4424 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) 4425 update_eir(&req); 4426 else 4427 clear_eir(&req); 4428 4429 hci_req_run(&req, NULL); 4430 4431 return err; 4432} 4433 4434static void sk_lookup(struct pending_cmd *cmd, void *data) 4435{ 4436 struct cmd_lookup *match = data; 4437 4438 if (match->sk == NULL) { 4439 match->sk = cmd->sk; 4440 sock_hold(match->sk); 4441 } 4442} 4443 4444int mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 4445 u8 status) 4446{ 4447 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 4448 int err = 0; 4449 4450 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 4451 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 4452 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 4453 4454 if (!status) 4455 err = mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 4456 3, NULL); 4457 4458 if (match.sk) 4459 sock_put(match.sk); 4460 4461 return err; 4462} 4463 4464int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 4465{ 4466 struct mgmt_cp_set_local_name ev; 4467 struct pending_cmd *cmd; 4468 4469 if (status) 4470 return 0; 4471 4472 memset(&ev, 0, sizeof(ev)); 4473 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 4474 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 4475 4476 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 4477 if (!cmd) { 4478 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 4479 4480 /* If this is a HCI command related to powering on the 4481 * HCI dev don't send any mgmt signals. 4482 */ 4483 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) 4484 return 0; 4485 } 4486 4487 return mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 4488 cmd ? cmd->sk : NULL); 4489} 4490 4491int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash, 4492 u8 *randomizer, u8 status) 4493{ 4494 struct pending_cmd *cmd; 4495 int err; 4496 4497 BT_DBG("%s status %u", hdev->name, status); 4498 4499 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 4500 if (!cmd) 4501 return -ENOENT; 4502 4503 if (status) { 4504 err = cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4505 mgmt_status(status)); 4506 } else { 4507 struct mgmt_rp_read_local_oob_data rp; 4508 4509 memcpy(rp.hash, hash, sizeof(rp.hash)); 4510 memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer)); 4511 4512 err = cmd_complete(cmd->sk, hdev->id, 4513 MGMT_OP_READ_LOCAL_OOB_DATA, 0, &rp, 4514 sizeof(rp)); 4515 } 4516 4517 mgmt_pending_remove(cmd); 4518 4519 return err; 4520} 4521 4522int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4523 u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8 4524 ssp, u8 *eir, u16 eir_len) 4525{ 4526 char buf[512]; 4527 struct mgmt_ev_device_found *ev = (void *) buf; 4528 size_t ev_size; 4529 4530 if (!hci_discovery_active(hdev)) 4531 return -EPERM; 4532 4533 /* Leave 5 bytes for a potential CoD field */ 4534 if (sizeof(*ev) + eir_len + 5 > sizeof(buf)) 4535 return -EINVAL; 4536 4537 memset(buf, 0, sizeof(buf)); 4538 4539 bacpy(&ev->addr.bdaddr, bdaddr); 4540 ev->addr.type = link_to_bdaddr(link_type, addr_type); 4541 ev->rssi = rssi; 4542 if (cfm_name) 4543 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_CONFIRM_NAME); 4544 if (!ssp) 4545 ev->flags |= __constant_cpu_to_le32(MGMT_DEV_FOUND_LEGACY_PAIRING); 4546 4547 if (eir_len > 0) 4548 memcpy(ev->eir, eir, eir_len); 4549 4550 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV)) 4551 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 4552 dev_class, 3); 4553 4554 ev->eir_len = cpu_to_le16(eir_len); 4555 ev_size = sizeof(*ev) + eir_len; 4556 4557 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 4558} 4559 4560int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 4561 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 4562{ 4563 struct mgmt_ev_device_found *ev; 4564 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 4565 u16 eir_len; 4566 4567 ev = (struct mgmt_ev_device_found *) buf; 4568 4569 memset(buf, 0, sizeof(buf)); 4570 4571 bacpy(&ev->addr.bdaddr, bdaddr); 4572 ev->addr.type = link_to_bdaddr(link_type, addr_type); 4573 ev->rssi = rssi; 4574 4575 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 4576 name_len); 4577 4578 ev->eir_len = cpu_to_le16(eir_len); 4579 4580 return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, 4581 sizeof(*ev) + eir_len, NULL); 4582} 4583 4584int mgmt_discovering(struct hci_dev *hdev, u8 discovering) 4585{ 4586 struct mgmt_ev_discovering ev; 4587 struct pending_cmd *cmd; 4588 4589 BT_DBG("%s discovering %u", hdev->name, discovering); 4590 4591 if (discovering) 4592 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev); 4593 else 4594 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 4595 4596 if (cmd != NULL) { 4597 u8 type = hdev->discovery.type; 4598 4599 cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0, &type, 4600 sizeof(type)); 4601 mgmt_pending_remove(cmd); 4602 } 4603 4604 memset(&ev, 0, sizeof(ev)); 4605 ev.type = hdev->discovery.type; 4606 ev.discovering = discovering; 4607 4608 return mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 4609} 4610 4611int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 4612{ 4613 struct pending_cmd *cmd; 4614 struct mgmt_ev_device_blocked ev; 4615 4616 cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev); 4617 4618 bacpy(&ev.addr.bdaddr, bdaddr); 4619 ev.addr.type = type; 4620 4621 return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev), 4622 cmd ? cmd->sk : NULL); 4623} 4624 4625int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 4626{ 4627 struct pending_cmd *cmd; 4628 struct mgmt_ev_device_unblocked ev; 4629 4630 cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev); 4631 4632 bacpy(&ev.addr.bdaddr, bdaddr); 4633 ev.addr.type = type; 4634 4635 return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev), 4636 cmd ? cmd->sk : NULL); 4637} 4638