Linux bluetooth development
 help / color / mirror / Atom feed
* Re: [RFC v2 7/9] Bluetooth: Add support for SMP confirmation checks
From: Koustuv Ghosh @ 2010-12-08  6:19 UTC (permalink / raw)
  To: Vinicius Costa Gomes; +Cc: linux-bluetooth
In-Reply-To: <1291671832-13435-8-git-send-email-vinicius.gomes@openbossa.org>

Hello ,
pls I apologise for top posting. So I request to ignore my first mail.

On Tue, Dec 7, 2010 at 3:13 AM, Vinicius Costa Gomes
<vinicius.gomes@openbossa.org> wrote:
> This adds supports for verifying the confirmation value that the
> remote side has sent. This includes support for generating and sending
> the random value used to produce the confirmation value.
>
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  include/net/bluetooth/l2cap.h |    5 ++
>  net/bluetooth/smp.c           |  121 ++++++++++++++++++++++++++++++++---------
>  2 files changed, 101 insertions(+), 25 deletions(-)
>
> diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
> index a3cb1ab..bcda2aa 100644
> --- a/include/net/bluetooth/l2cap.h
> +++ b/include/net/bluetooth/l2cap.h
> @@ -290,6 +290,11 @@ struct l2cap_conn {
>
>        __u8            disc_reason;
>
> +       __u8            preq[7];
> +       __u8            pres[7];
> +       __u8            prnd[16];
> +       __u8            pcnf[16];
> +
>        struct l2cap_chan_list chan_list;
>  };
>
> diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> index b62160e..7d7e8ad 100644
> --- a/net/bluetooth/smp.c
> +++ b/net/bluetooth/smp.c
> @@ -203,7 +203,9 @@ static void smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
>
>        BT_DBG("");
>
> -       skb_pull(skb, sizeof(struct smp_cmd_pairing));
> +       conn->preq[0] = SMP_CMD_PAIRING_REQ;
> +       memcpy(&conn->preq[1], rp, sizeof(*rp));
> +       skb_pull(skb, sizeof(*rp));
>
>        rp->io_capability = 0x00;
>        rp->oob_flag = 0x00;
> @@ -212,64 +214,125 @@ static void smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
>        rp->resp_key_dist = 0x00;
>        rp->auth_req &= 0x05;
>
> +       conn->pres[0] = SMP_CMD_PAIRING_RSP;
> +       memcpy(&conn->pres[1], rp, sizeof(rp));
> +
>        smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(*rp), rp);
>  }
>
>  static void smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
>  {
> +       struct smp_cmd_pairing *rp = (void *) skb->data;
>        struct smp_cmd_pairing_confirm cp;
> +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
> +       int ret;
> +       u8 k[16], res[16];
>
> -       BT_DBG("");
> +       /* Just Works */
> +       memset(k, 0, sizeof(k));
> +
> +       conn->pres[0] = SMP_CMD_PAIRING_RSP;
> +       memcpy(&conn->pres[1], rp, sizeof(*rp));
> +       skb_pull(skb, sizeof(*rp));
> +
> +       ret = smp_rand(conn->prnd);
> +       if (ret)
> +               return;
>
> -       memset(&cp, 0, sizeof(struct smp_cmd_pairing_confirm));
> +       ret = smp_c1(tfm, k, conn->prnd, conn->preq, conn->pres, 0,
> +                       conn->src, 0, conn->dst, res);
> +       if (ret)
> +               return;
> +
> +       swap128(res, cp.confirm_val);
>
>        smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
>  }
>
>  static void smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
>  {
> +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
> +
>        BT_DBG("");
>
> -       if (conn->hcon->out) {
> -               struct smp_cmd_pairing_random random;
> +       memcpy(conn->pcnf, skb->data, 16);
> +       skb_pull(skb, 16);
>
> -               BT_DBG("master");
> +       if (conn->hcon->out) {
> +               u8 random[16];
>
> -               memset(&random, 0, sizeof(struct smp_cmd_pairing_random));
> +               swap128(conn->prnd, random);
>
> -               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
> -                                                               &random);
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 16, random);
>        } else {
> -               struct smp_cmd_pairing_confirm confirm;
> +               struct smp_cmd_pairing_confirm cp;
> +               int ret;
> +               u8 k[16], res[16];
> +
> +               /* Just Works */
> +               memset(k, 0, sizeof(k));
>
> -               BT_DBG("slave");
> +               ret = smp_rand(conn->prnd);
> +               if (ret)
> +                       return;
>
> -               memset(&confirm, 0, sizeof(struct smp_cmd_pairing_confirm));
> +               ret = smp_c1(tfm, k, conn->prnd, conn->preq, conn->pres, 0,
> +                               conn->dst, 0, conn->src, res);
> +               if (ret)
> +                       return;
>
> -               smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(confirm),
> -                                                               &confirm);
> +               swap128(res, cp.confirm_val);
> +
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
>        }
>  }
>
>  static void smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
>  {
> -       struct smp_cmd_pairing_random cp;
> +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
> +       int ret;
> +       u8 k[16], key[16], res[16], random[16], confirm[16], buf[128];
> +
> +       swap128(skb->data, random);
> +       skb_pull(skb, 16);
> +
> +       memset(k, 0, sizeof(k));
> +
> +       if (conn->hcon->out)
> +               ret = smp_c1(tfm, k, random, conn->preq, conn->pres, 0,
> +                               conn->src, 0, conn->dst, res);
> +       else
> +               ret = smp_c1(tfm, k, random, conn->preq, conn->pres, 0,
> +                               conn->dst, 0, conn->src, res);
> +       if (ret)
> +               return;
>
> -       BT_DBG("");
> +       swap128(res, confirm);
>
> -       skb_pull(skb, sizeof(struct smp_cmd_pairing_random));
> +       if (memcmp(conn->pcnf, confirm, 16) != 0) {
> +               struct smp_cmd_pairing_fail cp;
>
> -       /* FIXME: check if random matches */
> +               BT_ERR("Pairing failed (confirmation values mismatch)");
> +               cp.reason = SMP_CONFIRM_FAILED;
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(cp), &cp);
> +               return;
> +       }
>
>        if (conn->hcon->out) {
> -               BT_DBG("master");
> -               /* FIXME: start encryption */
> +               smp_s1(tfm, k, random, conn->prnd, key);
> +
> +               hex_dump_to_buffer(key, sizeof(key), 16, 1, buf, sizeof(buf), 0);
> +               BT_DBG("key %s", buf);
>        } else {
> -               BT_DBG("slave");
> +               u8 r[16];
>
> -               memset(&cp, 0, sizeof(struct smp_cmd_pairing_random));
> +               swap128(conn->prnd, r);
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 16, r);
>
> -               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(cp), &cp);
> +               smp_s1(tfm, k, conn->prnd, random, key);
> +
> +               hex_dump_to_buffer(key, sizeof(key), 16, 1, buf, sizeof(buf), 0);
> +               BT_DBG("key %s", buf);
>        }
>  }
>
> @@ -280,8 +343,9 @@ static void smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
>
>        BT_DBG("");
>
> -       skb_pull(skb, sizeof(struct smp_cmd_security_req));
> -       memset(&cp, 0, sizeof(struct smp_cmd_pairing));
> +       skb_pull(skb, sizeof(*rp));
> +
> +       memset(&cp, 0, sizeof(cp));
>
>        cp.io_capability = 0x00;
>        cp.oob_flag = 0x00;
> @@ -290,6 +354,9 @@ static void smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
>        cp.resp_key_dist = 0x00;
>        cp.auth_req = rp->auth_req & 0x05;
>
> +       conn->preq[0] = SMP_CMD_PAIRING_REQ;
> +       memcpy(&conn->preq[1], &cp, sizeof(cp));
> +
>        smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
>  }
>
> @@ -323,6 +390,10 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
>                cp.init_key_dist = 0x00;
>                cp.resp_key_dist = 0x00;
>                cp.auth_req = authreq;
> +
> +               conn->preq[0] = SMP_CMD_PAIRING_REQ;
> +               memcpy(&conn->preq[1], &cp, sizeof(cp));
> +
>                smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
>        } else {
>                struct smp_cmd_security_req cp;
> --
> 1.7.3.2
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Hello Vinicus,
 regarding the below routine,
 is it not good to check the IO capabilities and authentication
rquirement of the remote device from the skb inside this routine and
based on that we can trigger JustWorks or PassKey paring method.
Though I know you are implementing  only JustWorks
 but I feel it will be good approach to parse the response and then
trigger the paring method.



 static void smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 {
+       struct smp_cmd_pairing *rp = (void *) skb->data;
       struct smp_cmd_pairing_confirm cp;
 +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
 +       int ret;
 +       u8 k[16], res[16];

 -       BT_DBG("");
 +       /* Just Works */
 +       memset(k, 0, sizeof(k));
 +
 +       conn->pres[0] = SMP_CMD_PAIRING_RSP;
 +       memcpy(&conn->pres[1], rp, sizeof(*rp));
 +       skb_pull(skb, sizeof(*rp));


 -       memset(&cp, 0, sizeof(struct smp_cmd_pairing_confirm));
 +       ret = smp_rand(conn->prnd);
 +       if (ret)
 +               return;
 +
 +       ret = smp_c1(tfm, k, conn->prnd, conn->preq, conn->pres, 0,

 +                       conn->src, 0, conn->dst, res);
 +       if (ret)
 +               return;


       smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 }

^ permalink raw reply

* Re: [RFC v2 7/9] Bluetooth: Add support for SMP confirmation checks
From: Koustuv Ghosh @ 2010-12-08  5:48 UTC (permalink / raw)
  To: Vinicius Costa Gomes; +Cc: linux-bluetooth
In-Reply-To: <1291671832-13435-8-git-send-email-vinicius.gomes@openbossa.org>

 Hello Vinicus,
 regarding the below routine,
 is it not good to check the IO capabilities and authentication
rquirement of the remote device from the skb inside this routine and
based on that we can trigger JustWorks or PassKey paring method.
Though I know you are implementing  only JustWorks
 but I feel it will be good approach to parse the response and then
trigger the paring method.


  static void smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
  {
+       struct smp_cmd_pairing *rp = (void *) skb->data;
        struct smp_cmd_pairing_confirm cp;
 +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
 +       int ret;
 +       u8 k[16], res[16];

 -       BT_DBG("");
 +       /* Just Works */
 +       memset(k, 0, sizeof(k));
 +
 +       conn->pres[0] = SMP_CMD_PAIRING_RSP;
 +       memcpy(&conn->pres[1], rp, sizeof(*rp));
 +       skb_pull(skb, sizeof(*rp));

 -       memset(&cp, 0, sizeof(struct smp_cmd_pairing_confirm));
 +       ret = smp_rand(conn->prnd);
 +       if (ret)
 +               return;
 +
 +       ret = smp_c1(tfm, k, conn->prnd, conn->preq, conn->pres, 0,
 +                       conn->src, 0, conn->dst, res);
 +       if (ret)
 +               return;

        smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
  }

On Tue, Dec 7, 2010 at 3:13 AM, Vinicius Costa Gomes
<vinicius.gomes@openbossa.org> wrote:
> This adds supports for verifying the confirmation value that the
> remote side has sent. This includes support for generating and sending
> the random value used to produce the confirmation value.
>
> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> ---
>  include/net/bluetooth/l2cap.h |    5 ++
>  net/bluetooth/smp.c           |  121 ++++++++++++++++++++++++++++++++---------
>  2 files changed, 101 insertions(+), 25 deletions(-)
>
> diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
> index a3cb1ab..bcda2aa 100644
> --- a/include/net/bluetooth/l2cap.h
> +++ b/include/net/bluetooth/l2cap.h
> @@ -290,6 +290,11 @@ struct l2cap_conn {
>
>        __u8            disc_reason;
>
> +       __u8            preq[7];
> +       __u8            pres[7];
> +       __u8            prnd[16];
> +       __u8            pcnf[16];
> +
>        struct l2cap_chan_list chan_list;
>  };
>
> diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> index b62160e..7d7e8ad 100644
> --- a/net/bluetooth/smp.c
> +++ b/net/bluetooth/smp.c
> @@ -203,7 +203,9 @@ static void smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
>
>        BT_DBG("");
>
> -       skb_pull(skb, sizeof(struct smp_cmd_pairing));
> +       conn->preq[0] = SMP_CMD_PAIRING_REQ;
> +       memcpy(&conn->preq[1], rp, sizeof(*rp));
> +       skb_pull(skb, sizeof(*rp));
>
>        rp->io_capability = 0x00;
>        rp->oob_flag = 0x00;
> @@ -212,64 +214,125 @@ static void smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
>        rp->resp_key_dist = 0x00;
>        rp->auth_req &= 0x05;
>
> +       conn->pres[0] = SMP_CMD_PAIRING_RSP;
> +       memcpy(&conn->pres[1], rp, sizeof(rp));
> +
>        smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(*rp), rp);
>  }
>
>  static void smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
>  {
> +       struct smp_cmd_pairing *rp = (void *) skb->data;
>        struct smp_cmd_pairing_confirm cp;
> +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
> +       int ret;
> +       u8 k[16], res[16];
>
> -       BT_DBG("");
> +       /* Just Works */
> +       memset(k, 0, sizeof(k));
> +
> +       conn->pres[0] = SMP_CMD_PAIRING_RSP;
> +       memcpy(&conn->pres[1], rp, sizeof(*rp));
> +       skb_pull(skb, sizeof(*rp));
> +
> +       ret = smp_rand(conn->prnd);
> +       if (ret)
> +               return;
>
> -       memset(&cp, 0, sizeof(struct smp_cmd_pairing_confirm));
> +       ret = smp_c1(tfm, k, conn->prnd, conn->preq, conn->pres, 0,
> +                       conn->src, 0, conn->dst, res);
> +       if (ret)
> +               return;
> +
> +       swap128(res, cp.confirm_val);
>
>        smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
>  }
>
>  static void smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
>  {
> +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
> +
>        BT_DBG("");
>
> -       if (conn->hcon->out) {
> -               struct smp_cmd_pairing_random random;
> +       memcpy(conn->pcnf, skb->data, 16);
> +       skb_pull(skb, 16);
>
> -               BT_DBG("master");
> +       if (conn->hcon->out) {
> +               u8 random[16];
>
> -               memset(&random, 0, sizeof(struct smp_cmd_pairing_random));
> +               swap128(conn->prnd, random);
>
> -               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
> -                                                               &random);
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 16, random);
>        } else {
> -               struct smp_cmd_pairing_confirm confirm;
> +               struct smp_cmd_pairing_confirm cp;
> +               int ret;
> +               u8 k[16], res[16];
> +
> +               /* Just Works */
> +               memset(k, 0, sizeof(k));
>
> -               BT_DBG("slave");
> +               ret = smp_rand(conn->prnd);
> +               if (ret)
> +                       return;
>
> -               memset(&confirm, 0, sizeof(struct smp_cmd_pairing_confirm));
> +               ret = smp_c1(tfm, k, conn->prnd, conn->preq, conn->pres, 0,
> +                               conn->dst, 0, conn->src, res);
> +               if (ret)
> +                       return;
>
> -               smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(confirm),
> -                                                               &confirm);
> +               swap128(res, cp.confirm_val);
> +
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
>        }
>  }
>
>  static void smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
>  {
> -       struct smp_cmd_pairing_random cp;
> +       struct crypto_blkcipher *tfm = conn->hcon->hdev->tfm;
> +       int ret;
> +       u8 k[16], key[16], res[16], random[16], confirm[16], buf[128];
> +
> +       swap128(skb->data, random);
> +       skb_pull(skb, 16);
> +
> +       memset(k, 0, sizeof(k));
> +
> +       if (conn->hcon->out)
> +               ret = smp_c1(tfm, k, random, conn->preq, conn->pres, 0,
> +                               conn->src, 0, conn->dst, res);
> +       else
> +               ret = smp_c1(tfm, k, random, conn->preq, conn->pres, 0,
> +                               conn->dst, 0, conn->src, res);
> +       if (ret)
> +               return;
>
> -       BT_DBG("");
> +       swap128(res, confirm);
>
> -       skb_pull(skb, sizeof(struct smp_cmd_pairing_random));
> +       if (memcmp(conn->pcnf, confirm, 16) != 0) {
> +               struct smp_cmd_pairing_fail cp;
>
> -       /* FIXME: check if random matches */
> +               BT_ERR("Pairing failed (confirmation values mismatch)");
> +               cp.reason = SMP_CONFIRM_FAILED;
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, sizeof(cp), &cp);
> +               return;
> +       }
>
>        if (conn->hcon->out) {
> -               BT_DBG("master");
> -               /* FIXME: start encryption */
> +               smp_s1(tfm, k, random, conn->prnd, key);
> +
> +               hex_dump_to_buffer(key, sizeof(key), 16, 1, buf, sizeof(buf), 0);
> +               BT_DBG("key %s", buf);
>        } else {
> -               BT_DBG("slave");
> +               u8 r[16];
>
> -               memset(&cp, 0, sizeof(struct smp_cmd_pairing_random));
> +               swap128(conn->prnd, r);
> +               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, 16, r);
>
> -               smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(cp), &cp);
> +               smp_s1(tfm, k, conn->prnd, random, key);
> +
> +               hex_dump_to_buffer(key, sizeof(key), 16, 1, buf, sizeof(buf), 0);
> +               BT_DBG("key %s", buf);
>        }
>  }
>
> @@ -280,8 +343,9 @@ static void smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
>
>        BT_DBG("");
>
> -       skb_pull(skb, sizeof(struct smp_cmd_security_req));
> -       memset(&cp, 0, sizeof(struct smp_cmd_pairing));
> +       skb_pull(skb, sizeof(*rp));
> +
> +       memset(&cp, 0, sizeof(cp));
>
>        cp.io_capability = 0x00;
>        cp.oob_flag = 0x00;
> @@ -290,6 +354,9 @@ static void smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
>        cp.resp_key_dist = 0x00;
>        cp.auth_req = rp->auth_req & 0x05;
>
> +       conn->preq[0] = SMP_CMD_PAIRING_REQ;
> +       memcpy(&conn->preq[1], &cp, sizeof(cp));
> +
>        smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
>  }
>
> @@ -323,6 +390,10 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
>                cp.init_key_dist = 0x00;
>                cp.resp_key_dist = 0x00;
>                cp.auth_req = authreq;
> +
> +               conn->preq[0] = SMP_CMD_PAIRING_REQ;
> +               memcpy(&conn->preq[1], &cp, sizeof(cp));
> +
>                smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
>        } else {
>                struct smp_cmd_security_req cp;
> --
> 1.7.3.2
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

^ permalink raw reply

* Re: [PATCH 1/1] bluetooth: add NULL pointer check in hci
From: Jun Nie @ 2010-12-08  5:46 UTC (permalink / raw)
  To: Gustavo F. Padovan; +Cc: Vinicius Costa Gomes, Brian Gix, linux-bluetooth
In-Reply-To: <20101207150608.GA1867@vigoh>

[-- Attachment #1: Type: text/plain, Size: 576 bytes --]

2010/12/7 Gustavo F. Padovan <padovan@profusion.mobi>:
> Hi Jun,
>
> * Jun Nie <niej0001@gmail.com> [2010-12-07 15:01:21 +0800]:
>
>> Resend it to fix checkpatch.pl warning.
>
>> From 75dc111b5d9f62619bbeec803b15e84412ae050e Mon Sep 17 00:00:00 2001
>> From: Jun Nie <njun@marvell.com>
>> Date: Tue, 7 Dec 2010 14:03:38 +0800
>> Subject: [PATCH] bluetooth: add NULL pointer check in hci
>
> Clearly a bug fix, but can you add a commit message to your patch. Thanks.
>
> --
> Gustavo F. Padovan
> http://profusion.mobi
>

Add commit message for understanding in a glance.

Jun

[-- Attachment #2: 0001-bluetooth-add-NULL-pointer-check-in-hci.patch --]
[-- Type: text/x-diff, Size: 939 bytes --]

From e729eda3b2cfae501c704e2eb39e07aa1b8607f0 Mon Sep 17 00:00:00 2001
From: Jun Nie <njun@marvell.com>
Date: Tue, 7 Dec 2010 14:03:38 +0800
Subject: [PATCH] bluetooth: add NULL pointer check in hci

If we fail to find a hci device pointer in hci_uart, don't try
to deref the NULL one we do have.

Signed-off-by: Jun Nie <njun@marvell.com>
---
 drivers/bluetooth/hci_ldisc.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 7201482..3c6cabc 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -311,8 +311,10 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 
 		if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
 			hu->proto->close(hu);
-			hci_unregister_dev(hdev);
-			hci_free_dev(hdev);
+			if (hdev) {
+				hci_unregister_dev(hdev);
+				hci_free_dev(hdev);
+			}
 		}
 	}
 }
-- 
1.7.0.4


^ permalink raw reply related

* Re: [PATCH 3/3] Bluetooth: Make hci_send_to_sock usable for management control sockets
From: Gustavo F. Padovan @ 2010-12-08  1:09 UTC (permalink / raw)
  To: johan.hedberg; +Cc: linux-bluetooth, Johan Hedberg
In-Reply-To: <1291760467-1569-4-git-send-email-johan.hedberg@gmail.com>

Hi Johan,

* johan.hedberg@gmail.com <johan.hedberg@gmail.com> [2010-12-08 00:21:07 +0200]:

> From: Johan Hedberg <johan.hedberg@nokia.com>
> 
> In order to send data to management control sockets the function should:
> 
>   - skip checks intended for raw HCI data and stack internal events
>   - make sure RAW HCI data or stack internal events don't go to
>     management control sockets
> 
> In order to accomplish this the patch adds a new member to the bluetooth
> skb private data to flag skb's that are destined for management control
> sockets.
> 
> Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
> Acked-by: Marcel Holtmann <marcel@holtmann.org>

All 3 patches have been applied. Thanks.

-- 
Gustavo F. Padovan
http://profusion.mobi

^ permalink raw reply

* [PATCH] Revert use of new error function for Blocked
From: Gustavo F. Padovan @ 2010-12-08  1:02 UTC (permalink / raw)
  To: linux-bluetooth

The error message says a lot about what the user need to do, I'm reverting
this change and will fix in the next patch series about the DBus error
handling.
---
 src/device.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/src/device.c b/src/device.c
index cfe00c5..b9341a2 100644
--- a/src/device.c
+++ b/src/device.c
@@ -532,7 +532,9 @@ static DBusMessage *set_blocked(DBusConnection *conn, DBusMessage *msg,
 	case 0:
 		return dbus_message_new_method_return(msg);
 	case EINVAL:
-		return btd_error_not_supported(msg);
+		return g_dbus_create_error(msg,
+					ERROR_INTERFACE ".NotSupported",
+					"Kernel lacks blacklist support");
 	default:
 		return g_dbus_create_error(msg, ERROR_INTERFACE ".Failed",
 						"%s", strerror(-err));
-- 
1.7.3.2


^ permalink raw reply related

* Re: [RFC v2 4/9] Bluetooth: simple SMP pairing negotiation
From: Vinicius Costa Gomes @ 2010-12-07 22:27 UTC (permalink / raw)
  To: Brian Gix; +Cc: linux-bluetooth, 'Anderson Briglia'
In-Reply-To: <002e01cb963c$560392b0$020ab810$@org>

Hi Brian,

On 10:26 Tue 07 Dec, Brian Gix wrote:
> 
> 
> Hi Vinicius,
> 
> > -----Original Message-----
> > From: linux-bluetooth-owner@vger.kernel.org [mailto:linux-bluetooth-
> > owner@vger.kernel.org] On Behalf Of Vinicius Costa Gomes
> > Sent: 06 December, 2010 1:44 PM
> > To: linux-bluetooth@vger.kernel.org
> > Cc: Anderson Briglia; Vinicius Costa Gomes
> > Subject: [RFC v2 4/9] Bluetooth: simple SMP pairing negotiation
> > 
> > From: Anderson Briglia <anderson.briglia@openbossa.org>
> > 
> > This implementation only exchanges SMP messages between the Host and
> > the
> > Remote. No keys are being generated. TK and STK generation will be
> > provided in further patches.
> > 
> > Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> > ---
> >  net/bluetooth/l2cap_core.c |    3 +-
> >  net/bluetooth/smp.c        |  114
> > ++++++++++++++++++++++++++++++++++++++++++--
> >  2 files changed, 112 insertions(+), 5 deletions(-)
> > 
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 674799c..da4f13d 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -4630,7 +4630,8 @@ static void l2cap_recv_frame(struct l2cap_conn
> > *conn, struct sk_buff *skb)
> >  		break;
> > 
> >  	case L2CAP_CID_SMP:
> > -		smp_sig_channel(conn, skb);
> > +		if (smp_sig_channel(conn, skb))
> > +			l2cap_conn_del(conn->hcon, 0x05);
> >  		break;
> > 
> >  	default:
> > diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> > index e9dde5f..b25010f 100644
> > --- a/net/bluetooth/smp.c
> > +++ b/net/bluetooth/smp.c
> > @@ -64,6 +64,102 @@ static void smp_send_cmd(struct l2cap_conn *conn,
> > u8 code, u16 len, void *data)
> >  	hci_send_acl(conn->hcon, skb, 0);
> >  }
> > 
> > +static void smp_cmd_pairing_req(struct l2cap_conn *conn, struct
> > sk_buff *skb)
> > +{
> > +	struct smp_cmd_pairing *rp = (void *) skb->data;
> > +
> > +	BT_DBG("");
> > +
> > +	skb_pull(skb, sizeof(struct smp_cmd_pairing));
> > +
> > +	rp->io_capability = 0x00;
> > +	rp->oob_flag = 0x00;
> > +	rp->max_key_size = 16;
> > +	rp->init_key_dist = 0x00;
> > +	rp->resp_key_dist = 0x00;
> > +	rp->auth_req &= 0x05;
> > +
> > +	smp_send_cmd(conn, SMP_CMD_PAIRING_RSP, sizeof(*rp), rp);
> > +}
> 
> As a "placeholder" I understand that there is a fair amount of fleshing
> out that these changes need.  However, as you have an conn->hcon->out
> flag that indicates direction (which hopefully is based on Link Master),
> I would like to see checking in this function and next, that the
> correct role has received these SMP packets, with a rejection if they
> were received by the incorrect role. Also, although the placeholder is
> requesting no key distribution, in the fleshed out version, the responder
> should be returning the subset (logical AND) of the requesters and the
> responders key_dist masks, which in this case is still of course Zero.
> 

Yeah, that kind of protocol checking is something that is really lacking.

This RFC is just the implementation of the Just Works pairing procedure,
without any support for key distribution. And as you noted, many things were
implemented using this assumption.

> I'm sorry if this is to many comments for this starting point.

Keep them coming :-) they are being very helpful.

> 
> > +
> > +static void smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct
> > sk_buff *skb)
> > +{
> > +	struct smp_cmd_pairing_confirm cp;
> > +
> > +	BT_DBG("");
> > +
> > +	memset(&cp, 0, sizeof(struct smp_cmd_pairing_confirm));
> > +
> > +	smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
> > +}
> > +
> > +static void smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct
> > sk_buff *skb)
> > +{
> > +	BT_DBG("");
> > +
> > +	if (conn->hcon->out) {
> > +		struct smp_cmd_pairing_random random;
> > +
> > +		BT_DBG("master");
> > +
> > +		memset(&random, 0, sizeof(struct smp_cmd_pairing_random));
> > +
> > +		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(random),
> > +								&random);
> > +	} else {
> > +		struct smp_cmd_pairing_confirm confirm;
> > +
> > +		BT_DBG("slave");
> > +
> > +		memset(&confirm, 0, sizeof(struct
> > smp_cmd_pairing_confirm));
> > +
> > +		smp_send_cmd(conn, SMP_CMD_PAIRING_CONFIRM,
> > sizeof(confirm),
> > +								&confirm);
> > +	}
> > +}
> > +
> > +static void smp_cmd_pairing_random(struct l2cap_conn *conn, struct
> > sk_buff *skb)
> > +{
> > +	struct smp_cmd_pairing_random cp;
> > +
> > +	BT_DBG("");
> > +
> > +	skb_pull(skb, sizeof(struct smp_cmd_pairing_random));
> > +
> > +	/* FIXME: check if random matches */
> 
> The random numbers will not match. The correct check will be that
> when the encryption with p1, p2, k, and the remote's random number,
> is performed, that it matches the confirm previously received
> via smp_cmd_pairing_confirm.

The comment is wrong. Will fix.

> 
> > +
> > +	if (conn->hcon->out) {
> > +		BT_DBG("master");
> > +		/* FIXME: start encryption */
> > +	} else {
> > +		BT_DBG("slave");
> > +
> > +		memset(&cp, 0, sizeof(struct smp_cmd_pairing_random));
> > +
> > +		smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(cp),
> > &cp);
> > +	}
> > +}
> > +
> > +static void smp_cmd_security_req(struct l2cap_conn *conn, struct
> > sk_buff *skb)
> > +{
> > +	struct smp_cmd_security_req *rp = (void *) skb->data;
> > +	struct smp_cmd_pairing cp;
> > +
> > +	BT_DBG("");
> > +
> > +	skb_pull(skb, sizeof(struct smp_cmd_security_req));
> > +	memset(&cp, 0, sizeof(struct smp_cmd_pairing));
> > +
> > +	cp.io_capability = 0x00;
> > +	cp.oob_flag = 0x00;
> > +	cp.max_key_size = 16;
> > +	cp.init_key_dist = 0x00;
> > +	cp.resp_key_dist = 0x00;
> > +	cp.auth_req = rp->auth_req & 0x05;
> > +
> > +	smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
> > +}
> > +
> 
> This function may need to be overloaded, such that if an existing
> set of keys already exist (from an earlier pairing) that they are
> used by simply encrypting the link, or signing the WRITE_CMD pkt
> as needed.  Should the link encryption fail due to remote rejection,
> we might then request security, subject to the same limitations
> used by BR/EDR's SSP. 

This particular function is just for the actual SMP Security Request Command.
But yeah, we need to have a single starting point for both when we have the
keys or not. How signing will be implemented is still an open point on my
mind.

> 
> But I do not know where the division lies between the key storage dB,
> the kernel mode code and the user mode code.
> 
> 
> >  int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
> >  {
> >  	__u8 authreq;
> > @@ -114,23 +210,33 @@ int smp_sig_channel(struct l2cap_conn *conn,
> > struct sk_buff *skb)
> > 
> >  	switch (code) {
> >  	case SMP_CMD_PAIRING_REQ:
> > -		reason = SMP_PAIRING_NOTSUPP;
> > -		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, 1, &reason);
> > -		err = -1;
> > +		smp_cmd_pairing_req(conn, skb);
> >  		break;
> > 
> >  	case SMP_CMD_PAIRING_FAIL:
> >  		break;
> > 
> >  	case SMP_CMD_PAIRING_RSP:
> > +		smp_cmd_pairing_rsp(conn, skb);
> > +		break;
> > +
> > +	case SMP_CMD_SECURITY_REQ:
> > +		smp_cmd_security_req(conn, skb);
> > +		break;
> > +
> >  	case SMP_CMD_PAIRING_CONFIRM:
> > +		smp_cmd_pairing_confirm(conn, skb);
> > +		break;
> > +
> >  	case SMP_CMD_PAIRING_RANDOM:
> > +		smp_cmd_pairing_random(conn, skb);
> > +		break;
> > +
> >  	case SMP_CMD_ENCRYPT_INFO:
> >  	case SMP_CMD_MASTER_IDENT:
> >  	case SMP_CMD_IDENT_INFO:
> >  	case SMP_CMD_IDENT_ADDR_INFO:
> >  	case SMP_CMD_SIGN_INFO:
> > -	case SMP_CMD_SECURITY_REQ:
> >  	default:
> >  		BT_DBG("Unknown command code 0x%2.2x", code);
> > 
> > --
> > 1.7.3.2
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-
> > bluetooth" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Cheers,
-- 
Vinicius

^ permalink raw reply

* Re: [PATCH] Remove fixed item from TODO
From: Johan Hedberg @ 2010-12-07 22:24 UTC (permalink / raw)
  To: Claudio Takahasi; +Cc: linux-bluetooth
In-Reply-To: <1291760437-32216-1-git-send-email-claudio.takahasi@openbossa.org>

Hi Claudio,

On Tue, Dec 07, 2010, Claudio Takahasi wrote:
> Read by UUID is already supported by attribute server and gatttool.
> ---
>  TODO |    5 -----
>  1 files changed, 0 insertions(+), 5 deletions(-)

Pushed upstream. Thanks.

Johan

^ permalink raw reply

* [PATCH 3/3] Bluetooth: Make hci_send_to_sock usable for management control sockets
From: johan.hedberg @ 2010-12-07 22:21 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Johan Hedberg
In-Reply-To: <1291760467-1569-1-git-send-email-johan.hedberg@gmail.com>

From: Johan Hedberg <johan.hedberg@nokia.com>

In order to send data to management control sockets the function should:

  - skip checks intended for raw HCI data and stack internal events
  - make sure RAW HCI data or stack internal events don't go to
    management control sockets

In order to accomplish this the patch adds a new member to the bluetooth
skb private data to flag skb's that are destined for management control
sockets.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
---
 include/net/bluetooth/bluetooth.h |    1 +
 net/bluetooth/hci_sock.c          |   10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index d81ea79..0c5e725 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -144,6 +144,7 @@ struct bt_skb_cb {
 	__u8 tx_seq;
 	__u8 retries;
 	__u8 sar;
+	unsigned short channel;
 };
 #define bt_cb(skb) ((struct bt_skb_cb *)((skb)->cb))
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 207be7a..f6c18ab 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -104,6 +104,12 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 		if (skb->sk == sk)
 			continue;
 
+		if (bt_cb(skb)->channel != hci_pi(sk)->channel)
+			continue;
+
+		if (bt_cb(skb)->channel == HCI_CHANNEL_CONTROL)
+			goto clone;
+
 		/* Apply filter */
 		flt = &hci_pi(sk)->filter;
 
@@ -127,12 +133,14 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 				continue;
 		}
 
+clone:
 		nskb = skb_clone(skb, GFP_ATOMIC);
 		if (!nskb)
 			continue;
 
 		/* Put type byte before the data */
-		memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
+		if (bt_cb(skb)->channel == HCI_CHANNEL_RAW)
+			memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
 
 		if (sock_queue_rcv_skb(sk, nskb))
 			kfree_skb(nskb);
-- 
1.7.2.3


^ permalink raw reply related

* [PATCH 2/3] Bluetooth: Add initial Bluetooth Management interface callbacks
From: johan.hedberg @ 2010-12-07 22:21 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Johan Hedberg
In-Reply-To: <1291760467-1569-1-git-send-email-johan.hedberg@gmail.com>

From: Johan Hedberg <johan.hedberg@nokia.com>

Add initial code for handling Bluetooth Management interface messages.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
 include/net/bluetooth/hci_core.h |    3 +
 net/bluetooth/Makefile           |    2 +-
 net/bluetooth/hci_sock.c         |   39 +++++++++++++--
 net/bluetooth/mgmt.c             |   99 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 136 insertions(+), 7 deletions(-)
 create mode 100644 net/bluetooth/mgmt.c

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3e34359..1992fac 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -660,6 +660,9 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data);
 /* ----- HCI Sockets ----- */
 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb);
 
+/* Management interface */
+int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
+
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
 
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index 7ca1f46..250f954 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -10,4 +10,4 @@ obj-$(CONFIG_BT_BNEP)	+= bnep/
 obj-$(CONFIG_BT_CMTP)	+= cmtp/
 obj-$(CONFIG_BT_HIDP)	+= hidp/
 
-bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
+bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o hci_sock.o hci_sysfs.o lib.o
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index b3753ba..207be7a 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -49,6 +49,8 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+static int enable_mgmt;
+
 /* ----- HCI socket interface ----- */
 
 static inline int hci_test_bit(int nr, void *addr)
@@ -353,25 +355,35 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long a
 
 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
-	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
+	struct sockaddr_hci haddr;
 	struct sock *sk = sock->sk;
 	struct hci_dev *hdev = NULL;
-	int err = 0;
+	int len, err = 0;
 
 	BT_DBG("sock %p sk %p", sock, sk);
 
-	if (!haddr || haddr->hci_family != AF_BLUETOOTH)
+	if (!addr)
+		return -EINVAL;
+
+	memset(&haddr, 0, sizeof(haddr));
+	len = min_t(unsigned int, sizeof(haddr), addr_len);
+	memcpy(&haddr, addr, len);
+
+	if (haddr.hci_family != AF_BLUETOOTH)
+		return -EINVAL;
+
+	if (haddr.hci_channel != HCI_CHANNEL_RAW && !enable_mgmt)
 		return -EINVAL;
 
 	lock_sock(sk);
 
-	if (hci_pi(sk)->hdev) {
+	if (sk->sk_state == BT_BOUND || hci_pi(sk)->hdev) {
 		err = -EALREADY;
 		goto done;
 	}
 
-	if (haddr->hci_dev != HCI_DEV_NONE) {
-		hdev = hci_dev_get(haddr->hci_dev);
+	if (haddr.hci_dev != HCI_DEV_NONE) {
+		hdev = hci_dev_get(haddr.hci_dev);
 		if (!hdev) {
 			err = -ENODEV;
 			goto done;
@@ -380,6 +392,7 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
 		atomic_inc(&hdev->promisc);
 	}
 
+	hci_pi(sk)->channel = haddr.hci_channel;
 	hci_pi(sk)->hdev = hdev;
 	sk->sk_state = BT_BOUND;
 
@@ -502,6 +515,17 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
 	lock_sock(sk);
 
+	switch (hci_pi(sk)->channel) {
+	case HCI_CHANNEL_RAW:
+		break;
+	case HCI_CHANNEL_CONTROL:
+		err = mgmt_control(sk, msg, len);
+		goto done;
+	default:
+		err = -EINVAL;
+		goto done;
+	}
+
 	hdev = hci_pi(sk)->hdev;
 	if (!hdev) {
 		err = -EBADFD;
@@ -831,3 +855,6 @@ void __exit hci_sock_cleanup(void)
 
 	proto_unregister(&hci_sk_proto);
 }
+
+module_param(enable_mgmt, bool, 0644);
+MODULE_PARM_DESC(enable_mgmt, "Enable Management interface");
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
new file mode 100644
index 0000000..d15bf67
--- /dev/null
+++ b/net/bluetooth/mgmt.c
@@ -0,0 +1,99 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2010  Nokia Corporation
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth HCI Management interface */
+
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/mgmt.h>
+
+static void cmd_status(struct sock *sk, u16 cmd, u8 status)
+{
+	struct sk_buff *skb;
+	struct mgmt_hdr *hdr;
+	struct mgmt_ev_cmd_status *ev;
+
+	BT_DBG("sock %p", sk);
+
+	skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
+	if (!skb)
+		return;
+
+	hdr = (void *) skb_put(skb, sizeof(*hdr));
+
+	hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
+	hdr->len = cpu_to_le16(sizeof(*ev));
+
+	ev = (void *) skb_put(skb, sizeof(*ev));
+	ev->status = status;
+	put_unaligned_le16(cmd, &ev->opcode);
+
+	if (sock_queue_rcv_skb(sk, skb) < 0)
+		kfree_skb(skb);
+}
+
+int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
+{
+	unsigned char *buf;
+	struct mgmt_hdr *hdr;
+	u16 opcode, len;
+	int err;
+
+	BT_DBG("got %zu bytes", msglen);
+
+	if (msglen < sizeof(*hdr))
+		return -EINVAL;
+
+	buf = kmalloc(msglen, GFP_ATOMIC);
+	if (!buf)
+		return -ENOMEM;
+
+	if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
+		err = -EFAULT;
+		goto done;
+	}
+
+	hdr = (struct mgmt_hdr *) buf;
+	opcode = get_unaligned_le16(&hdr->opcode);
+	len = get_unaligned_le16(&hdr->len);
+
+	if (len != msglen - sizeof(*hdr)) {
+		err = -EINVAL;
+		goto done;
+	}
+
+	switch (opcode) {
+	default:
+		BT_DBG("Unknown op %u", opcode);
+		cmd_status(sk, opcode, 0x01);
+		break;
+	}
+
+	err = msglen;
+
+done:
+	kfree(buf);
+	return err;
+}
-- 
1.7.2.3


^ permalink raw reply related

* [PATCH 1/3] Bluetooth: Add Bluetooth Management interface definitions
From: johan.hedberg @ 2010-12-07 22:21 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Johan Hedberg
In-Reply-To: <1291760467-1569-1-git-send-email-johan.hedberg@gmail.com>

From: Johan Hedberg <johan.hedberg@nokia.com>

Add initial definitions for the new Bluetooth Management interface to
the bluetooth headers.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
---
 include/net/bluetooth/hci.h      |    4 +++
 include/net/bluetooth/hci_core.h |    1 +
 include/net/bluetooth/mgmt.h     |   46 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 0 deletions(-)
 create mode 100644 include/net/bluetooth/mgmt.h

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index f3c5ed6..29a7a8c 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -934,9 +934,13 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
 struct sockaddr_hci {
 	sa_family_t    hci_family;
 	unsigned short hci_dev;
+	unsigned short hci_channel;
 };
 #define HCI_DEV_NONE	0xffff
 
+#define HCI_CHANNEL_RAW		0
+#define HCI_CHANNEL_CONTROL	1
+
 struct hci_filter {
 	unsigned long type_mask;
 	unsigned long event_mask[2];
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9c08625..3e34359 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -668,6 +668,7 @@ struct hci_pinfo {
 	struct hci_dev    *hdev;
 	struct hci_filter filter;
 	__u32             cmsg_mask;
+	unsigned short   channel;
 };
 
 /* HCI security filter */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
new file mode 100644
index 0000000..95974da
--- /dev/null
+++ b/include/net/bluetooth/mgmt.h
@@ -0,0 +1,46 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+
+   Copyright (C) 2010  Nokia Corporation
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+struct mgmt_hdr {
+	__le16 opcode;
+	__le16 len;
+} __packed;
+#define MGMT_HDR_SIZE			4
+
+#define MGMT_EV_CMD_COMPLETE		0x0001
+struct mgmt_ev_cmd_complete {
+	__le16 opcode;
+	__u8 data[0];
+} __packed;
+
+#define MGMT_EV_CMD_STATUS		0x0002
+struct mgmt_ev_cmd_status {
+	__u8 status;
+	__le16 opcode;
+} __packed;
+
+#define MGMT_EV_CONTROLLER_ERROR	0x0003
+struct mgmt_ev_controller_error {
+	__le16 index;
+	__u8 error_code;
+} __packed;
-- 
1.7.2.3


^ permalink raw reply related

* Initial Management patches (rebased again)
From: johan.hedberg @ 2010-12-07 22:21 UTC (permalink / raw)
  To: linux-bluetooth

Hi,

Same patches rebased against latest bluetooth-next-2.6. The coding style
issues with sizeof() usage (brought up by Lizardo) have also been fixed.

Johan


^ permalink raw reply

* [PATCH] Remove fixed item from TODO
From: Claudio Takahasi @ 2010-12-07 22:20 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Claudio Takahasi

Read by UUID is already supported by attribute server and gatttool.
---
 TODO |    5 -----
 1 files changed, 0 insertions(+), 5 deletions(-)

diff --git a/TODO b/TODO
index 32d3a61..54fef16 100644
--- a/TODO
+++ b/TODO
@@ -79,11 +79,6 @@ ATT/GATT
   Priority: Medium
   Complexity: C2
 
-- GATT server: fix read by UUID (read by handle works)
-
-  Priority: Medium
-  Complexity: C2
-
 - gatttool: add an interactive command prompt mode. Many LE devices
   expect the connection to stay up a long time and disable advertising
   after a disconnection so it's inconvenient to use gatttool in the
-- 
1.7.3.2


^ permalink raw reply related

* Re: [RFC v2 3/9] Bluetooth: Start SMP procedure
From: Vinicius Costa Gomes @ 2010-12-07 22:08 UTC (permalink / raw)
  To: Gustavo F. Padovan; +Cc: linux-bluetooth, Anderson Briglia
In-Reply-To: <20101207161109.GD2944@vigoh>

Hi Gustavo,

On 14:11 Tue 07 Dec, Gustavo F. Padovan wrote:
> Hi Vinicius,
> 
> * Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2010-12-06 18:43:46 -0300]:
> 
> > From: Anderson Briglia <anderson.briglia@openbossa.org>
> > 
> > Start SMP procedure for LE connections. This modification intercepts l2cap
> > received frames and call proper SMP functions to start the SMP procedure. By
> > now, no keys are being used.
> > 
> > Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> > Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
> > ---
> >  net/bluetooth/l2cap_core.c |    7 +++++++
> >  net/bluetooth/smp.c        |    2 +-
> >  2 files changed, 8 insertions(+), 1 deletions(-)
> > 
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 69e5f80..674799c 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -54,6 +54,7 @@
> >  #include <net/bluetooth/bluetooth.h>
> >  #include <net/bluetooth/hci_core.h>
> >  #include <net/bluetooth/l2cap.h>
> > +#include <net/bluetooth/smp.h>
> >  
> >  #define VERSION "2.15"
> >  
> > @@ -642,6 +643,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
> >  			l2cap_sock_clear_timer(sk);
> >  			sk->sk_state = BT_CONNECTED;
> >  			sk->sk_state_change(sk);
> > +			if (smp_conn_security(conn, l2cap_pi(sk)->sec_level))
> > +				BT_DBG("Insufficient security");
> >  		}
> >  
> >  		if (sk->sk_type != SOCK_SEQPACKET &&
> > @@ -4626,6 +4629,10 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
> >  		l2cap_conless_channel(conn, psm, skb);
> >  		break;
> >  
> > +	case L2CAP_CID_SMP:
> > +		smp_sig_channel(conn, skb);
> > +		break;
> > +
> >  	default:
> >  		l2cap_data_channel(conn, cid, skb);
> >  		break;
> > diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> > index e427d11..e9dde5f 100644
> > --- a/net/bluetooth/smp.c
> > +++ b/net/bluetooth/smp.c
> > @@ -86,7 +86,7 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
> >  		return 1;
> >  	}
> >  
> > -	if (conn->hcon->link_mode & HCI_LM_MASTER) {
> > +	if (conn->hcon->out) {
> 
> This change should not belong to this patch.
> 

My bad. Will fix.

> -- 
> Gustavo F. Padovan
> http://profusion.mobi

Cheers,
-- 
Vinicius

^ permalink raw reply

* Re: [RFC v2 2/9] Bluetooth: Implement the first SMP commands
From: Vinicius Costa Gomes @ 2010-12-07 22:06 UTC (permalink / raw)
  To: Gustavo F. Padovan; +Cc: linux-bluetooth, Anderson Briglia
In-Reply-To: <20101207161003.GC2944@vigoh>

Hi Gustavo,

On 14:10 Tue 07 Dec, Gustavo F. Padovan wrote:
> Hi Vinicius,
> 
> * Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2010-12-06 18:43:45 -0300]:
> 
> > These simple commands will allow the SMP procedure to be started
> > and terminated with a not supported error. This is the first step
> > toward something useful.
> > 
> > Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> > Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
> > ---
> >  include/net/bluetooth/smp.h             |    4 +
> >  net/bluetooth/Makefile                  |    1 +
> >  net/bluetooth/{l2cap.c => l2cap_core.c} |    0
> >  net/bluetooth/smp.c                     |  144 +++++++++++++++++++++++++++++++
> >  4 files changed, 149 insertions(+), 0 deletions(-)
> >  rename net/bluetooth/{l2cap.c => l2cap_core.c} (100%)
> >  create mode 100644 net/bluetooth/smp.c
> > 
> > diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
> > index 8f2edbf..b9603cc 100644
> > --- a/include/net/bluetooth/smp.h
> > +++ b/include/net/bluetooth/smp.h
> > @@ -73,4 +73,8 @@ struct smp_cmd_security_req {
> >  #define SMP_UNSPECIFIED		0x08
> >  #define SMP_REPEATED_ATTEMPTS		0x09
> >  
> > +/* SMP Commands */
> > +int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
> > +int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
> > +
> >  #endif /* __SMP_H */
> > diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
> > index d1e433f..d138b23 100644
> > --- a/net/bluetooth/Makefile
> > +++ b/net/bluetooth/Makefile
> > @@ -11,3 +11,4 @@ obj-$(CONFIG_BT_CMTP)	+= cmtp/
> >  obj-$(CONFIG_BT_HIDP)	+= hidp/
> >  
> >  bluetooth-objs := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
> > +l2cap-objs := l2cap_core.o smp.o
> > diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap_core.c
> > similarity index 100%
> > rename from net/bluetooth/l2cap.c
> > rename to net/bluetooth/l2cap_core.c
> > diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> > new file mode 100644
> > index 0000000..e427d11
> > --- /dev/null
> > +++ b/net/bluetooth/smp.c
> > @@ -0,0 +1,144 @@
> > +/*
> > +   BlueZ - Bluetooth protocol stack for Linux
> > +   Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
> > +
> > +   This program is free software; you can redistribute it and/or modify
> > +   it under the terms of the GNU General Public License version 2 as
> > +   published by the Free Software Foundation;
> > +
> > +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
> > +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> > +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
> > +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
> > +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
> > +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> > +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> > +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> > +
> > +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
> > +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
> > +   SOFTWARE IS DISCLAIMED.
> > +*/
> > +
> > +#include <net/bluetooth/bluetooth.h>
> > +#include <net/bluetooth/hci_core.h>
> > +#include <net/bluetooth/l2cap.h>
> > +#include <net/bluetooth/smp.h>
> > +
> > +static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
> > +		u16 dlen, void *data)
> > +{
> > +	struct sk_buff *skb;
> > +	struct l2cap_hdr *lh;
> > +	int len;
> > +
> > +	len = L2CAP_HDR_SIZE + 1 + dlen;
> > +
> > +	if (len > conn->mtu)
> > +		return NULL;
> > +
> > +	skb = bt_skb_alloc(len, GFP_ATOMIC);
> > +	if (!skb)
> > +		return NULL;
> > +
> > +	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
> > +	lh->len = cpu_to_le16(1 + dlen);
> > +	lh->cid = cpu_to_le16(L2CAP_CID_SMP);
> > +
> > +	memcpy(skb_put(skb, 1), &code, 1);
> > +
> > +	memcpy(skb_put(skb, dlen), data, dlen);
> > +
> > +	return skb;
> > +}
> > +
> > +static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
> > +{
> > +	struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
> > +
> > +	BT_DBG("code 0x%2.2x", code);
> > +
> > +	if (!skb)
> > +		return;
> > +
> > +	hci_send_acl(conn->hcon, skb, 0);
> > +}
> > +
> > +int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
> > +{
> > +	__u8 authreq;
> > +
> > +	BT_DBG("conn %p hcon %p level 0x%2.2x", conn, conn->hcon, sec_level);
> > +
> > +	switch (sec_level) {
> > +	case BT_SECURITY_MEDIUM:
> > +		/* Encrypted, no MITM protection */
> > +		authreq = 0x01;
> > +		break;
> > +
> > +	case BT_SECURITY_HIGH:
> > +		/* Bonding, MITM protection */
> > +		authreq = 0x05;
> 
> It would be good have some defines for the authreq values.

Makes sense.

> 
> -- 
> Gustavo F. Padovan
> http://profusion.mobi

Cheers,
-- 
Vinicius

^ permalink raw reply

* Re: [RFC v2 2/9] Bluetooth: Implement the first SMP commands
From: Vinicius Costa Gomes @ 2010-12-07 22:05 UTC (permalink / raw)
  To: Gustavo F. Padovan; +Cc: linux-bluetooth, Anderson Briglia
In-Reply-To: <20101207160307.GB2944@vigoh>

Hi Gustavo,

On 14:03 Tue 07 Dec, Gustavo F. Padovan wrote:
> Hi Vinicius,
> 
> * Vinicius Costa Gomes <vinicius.gomes@openbossa.org> [2010-12-06 18:43:45 -0300]:
> 
> > These simple commands will allow the SMP procedure to be started
> > and terminated with a not supported error. This is the first step
> > toward something useful.
> > 
> > Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
> > Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
> > ---
> >  include/net/bluetooth/smp.h             |    4 +
> >  net/bluetooth/Makefile                  |    1 +
> >  net/bluetooth/{l2cap.c => l2cap_core.c} |    0
> 
> I want a separated patch for the l2cap.c rename.
>

Sure. Will do.

> >  net/bluetooth/smp.c                     |  144 +++++++++++++++++++++++++++++++
> >  4 files changed, 149 insertions(+), 0 deletions(-)
> >  rename net/bluetooth/{l2cap.c => l2cap_core.c} (100%)
> >  create mode 100644 net/bluetooth/smp.c
> > 
> > diff --git a/include/net/bluetooth/smp.h b/include/net/bluetooth/smp.h
> > index 8f2edbf..b9603cc 100644
> > --- a/include/net/bluetooth/smp.h
> > +++ b/include/net/bluetooth/smp.h
> > @@ -73,4 +73,8 @@ struct smp_cmd_security_req {
> >  #define SMP_UNSPECIFIED		0x08
> >  #define SMP_REPEATED_ATTEMPTS		0x09
> >  
> > +/* SMP Commands */
> > +int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
> > +int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
> > +
> >  #endif /* __SMP_H */
> > diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
> > index d1e433f..d138b23 100644
> > --- a/net/bluetooth/Makefile
> > +++ b/net/bluetooth/Makefile
> > @@ -11,3 +11,4 @@ obj-$(CONFIG_BT_CMTP)	+= cmtp/
> >  obj-$(CONFIG_BT_HIDP)	+= hidp/
> >  
> >  bluetooth-objs := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
> > +l2cap-objs := l2cap_core.o smp.o
> > diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap_core.c
> > similarity index 100%
> > rename from net/bluetooth/l2cap.c
> > rename to net/bluetooth/l2cap_core.c
> > diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
> > new file mode 100644
> > index 0000000..e427d11
> > --- /dev/null
> > +++ b/net/bluetooth/smp.c
> > @@ -0,0 +1,144 @@
> > +/*
> > +   BlueZ - Bluetooth protocol stack for Linux
> > +   Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
> > +
> > +   This program is free software; you can redistribute it and/or modify
> > +   it under the terms of the GNU General Public License version 2 as
> > +   published by the Free Software Foundation;
> > +
> > +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
> > +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> > +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
> > +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
> > +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
> > +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
> > +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
> > +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
> > +
> > +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
> > +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
> > +   SOFTWARE IS DISCLAIMED.
> > +*/
> > +
> > +#include <net/bluetooth/bluetooth.h>
> > +#include <net/bluetooth/hci_core.h>
> > +#include <net/bluetooth/l2cap.h>
> > +#include <net/bluetooth/smp.h>
> > +
> > +static struct sk_buff *smp_build_cmd(struct l2cap_conn *conn, u8 code,
> > +		u16 dlen, void *data)
> > +{
> > +	struct sk_buff *skb;
> > +	struct l2cap_hdr *lh;
> > +	int len;
> > +
> > +	len = L2CAP_HDR_SIZE + 1 + dlen;
> > +
> > +	if (len > conn->mtu)
> > +		return NULL;
> > +
> > +	skb = bt_skb_alloc(len, GFP_ATOMIC);
> > +	if (!skb)
> > +		return NULL;
> > +
> > +	lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
> > +	lh->len = cpu_to_le16(1 + dlen);
> > +	lh->cid = cpu_to_le16(L2CAP_CID_SMP);
> > +
> > +	memcpy(skb_put(skb, 1), &code, 1);
> > +
> > +	memcpy(skb_put(skb, dlen), data, dlen);
> > +
> > +	return skb;
> > +}
> > +
> > +static void smp_send_cmd(struct l2cap_conn *conn, u8 code, u16 len, void *data)
> > +{
> > +	struct sk_buff *skb = smp_build_cmd(conn, code, len, data);
> > +
> > +	BT_DBG("code 0x%2.2x", code);
> > +
> > +	if (!skb)
> > +		return;
> > +
> > +	hci_send_acl(conn->hcon, skb, 0);
> > +}
> > +
> > +int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
> > +{
> > +	__u8 authreq;
> > +
> > +	BT_DBG("conn %p hcon %p level 0x%2.2x", conn, conn->hcon, sec_level);
> > +
> > +	switch (sec_level) {
> > +	case BT_SECURITY_MEDIUM:
> > +		/* Encrypted, no MITM protection */
> > +		authreq = 0x01;
> > +		break;
> > +
> > +	case BT_SECURITY_HIGH:
> > +		/* Bonding, MITM protection */
> > +		authreq = 0x05;
> > +		break;
> > +
> > +	case BT_SECURITY_LOW:
> > +	default:
> > +		return 1;
> > +	}
> > +
> > +	if (conn->hcon->link_mode & HCI_LM_MASTER) {
> > +		struct smp_cmd_pairing cp;
> > +		cp.io_capability = 0x00;
> > +		cp.oob_flag = 0x00;
> > +		cp.max_key_size = 16;
> > +		cp.init_key_dist = 0x00;
> > +		cp.resp_key_dist = 0x00;
> > +		cp.auth_req = authreq;
> > +		smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
> > +	} else {
> > +		struct smp_cmd_security_req cp;
> > +		cp.auth_req = authreq;
> > +		smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
> > +	}
> > +
> > +	return 0;
> > +}
> > +
> > +int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
> > +{
> > +	__u8 code = skb->data[0];
> > +	__u8 reason;
> > +	int err = 0;
> > +
> > +	skb_pull(skb, 1);
> > +
> > +	switch (code) {
> > +	case SMP_CMD_PAIRING_REQ:
> > +		reason = SMP_PAIRING_NOTSUPP;
> > +		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, 1, &reason);
> > +		err = -1;
> 
> Don't use -1, use a proper error macro here.

Sure.

> 
> > +		break;
> > +
> > +	case SMP_CMD_PAIRING_FAIL:
> > +		break;
> > +
> > +	case SMP_CMD_PAIRING_RSP:
> > +	case SMP_CMD_PAIRING_CONFIRM:
> > +	case SMP_CMD_PAIRING_RANDOM:
> > +	case SMP_CMD_ENCRYPT_INFO:
> > +	case SMP_CMD_MASTER_IDENT:
> > +	case SMP_CMD_IDENT_INFO:
> > +	case SMP_CMD_IDENT_ADDR_INFO:
> > +	case SMP_CMD_SIGN_INFO:
> > +	case SMP_CMD_SECURITY_REQ:
> > +	default:
> > +		BT_DBG("Unknown command code 0x%2.2x", code);
> > +
> > +		reason = SMP_CMD_NOTSUPP;
> > +		smp_send_cmd(conn, SMP_CMD_PAIRING_FAIL, 1, &reason);
> > +		err = -1;
> 
> Same here.

Ok.

> 
> -- 
> Gustavo F. Padovan
> http://profusion.mobi


Cheers,
-- 
Vinicius

^ permalink raw reply

* Re: [PATCH v2 1/5] Add device type to identify LE, BR/EDR or dual mode devices
From: Johan Hedberg @ 2010-12-07 22:04 UTC (permalink / raw)
  To: Claudio Takahasi; +Cc: linux-bluetooth
In-Reply-To: <1291757440-15217-1-git-send-email-claudio.takahasi@openbossa.org>

Hi Claudio,

On Tue, Dec 07, 2010, Claudio Takahasi wrote:
> If EIR Flags field is sent in the advertising data, it can be used
> to detect the operation mode. If the remote device is dual mode,
> GAP operation mode defines that it shall follow the connectable
> mode for BR/EDR and non-connectable mode for LE. This patch forces
> service discovery protocol prior to Discover All Primary Services.
> ---
>  src/adapter.c |   55 +++++++++++++++++++++++++++++++++++++++----------------
>  src/adapter.h |    3 ---
>  src/device.c  |   12 ++++++------
>  src/device.h  |   11 +++++++++--
>  4 files changed, 54 insertions(+), 27 deletions(-)

Thanks for these updates. I've now pushed all five patches (v2 of 1-3)
upstream.

Johan

^ permalink raw reply

* Re: [PATCH v2] Remove automatic battery state change on attribute example
From: Johan Hedberg @ 2010-12-07 21:53 UTC (permalink / raw)
  To: Claudio Takahasi; +Cc: linux-bluetooth
In-Reply-To: <1291758098-31350-1-git-send-email-claudio.takahasi@openbossa.org>

Hi Claudio,

On Tue, Dec 07, 2010, Claudio Takahasi wrote:
> Legacy code implemented to test Indication and Notification
> ---
>  attrib/example.c |   19 -------------------
>  1 files changed, 0 insertions(+), 19 deletions(-)

Pushed upstream. Thanks.

Johan

^ permalink raw reply

* [PATCH v2] Remove automatic battery state change on attribute example
From: Claudio Takahasi @ 2010-12-07 21:41 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Claudio Takahasi
In-Reply-To: <20101207213537.GA30415@jh-x301>

Legacy code implemented to test Indication and Notification
---
 attrib/example.c |   19 -------------------
 1 files changed, 0 insertions(+), 19 deletions(-)

diff --git a/attrib/example.c b/attrib/example.c
index 4307804..6987fac 100644
--- a/attrib/example.c
+++ b/attrib/example.c
@@ -59,22 +59,6 @@
 #define FMT_KILOGRAM_UUID		0xA010
 #define FMT_HANGING_UUID		0xA011
 
-static guint timeout_id = 0;
-
-static gboolean change_battery_state(gpointer user_data)
-{
-	static uint8_t state =  0x05;
-	uuid_t uuid;
-	uint8_t atval[1];
-
-	/* Battery state is being increased every 10 seconds. */
-	atval[0] = state++;
-	sdp_uuid16_create(&uuid, BATTERY_STATE_UUID);
-	attrib_db_update(0x0110, &uuid, atval, 1);
-
-	return TRUE;
-}
-
 static int register_attributes(void)
 {
 	const char *devname = "Example Device";
@@ -170,8 +154,6 @@ static int register_attributes(void)
 	atval[1] = 0x00;
 	attrib_db_add(0x0111, &uuid, ATT_NONE, ATT_AUTHENTICATION, atval, 2);
 
-	timeout_id = g_timeout_add_seconds(10, change_battery_state, NULL);
-
 	/* Thermometer: primary service definition */
 	sdp_uuid16_create(&uuid, GATT_PRIM_SVC_UUID);
 	u16 = htons(THERM_HUMIDITY_SVC_UUID);
@@ -436,5 +418,4 @@ int server_example_init(void)
 
 void server_example_exit(void)
 {
-	g_source_remove(timeout_id);
 }
-- 
1.7.3.2


^ permalink raw reply related

* Re: [PATCH] Remove automatic battery state change on attribute example
From: Johan Hedberg @ 2010-12-07 21:35 UTC (permalink / raw)
  To: Claudio Takahasi; +Cc: linux-bluetooth
In-Reply-To: <1291386290-2521-1-git-send-email-claudio.takahasi@openbossa.org>

Hi Claudio,

On Fri, Dec 03, 2010, Claudio Takahasi wrote:
> Legacy code implemented to test Indication and Notification
> ---
>  attrib/example.c |   19 -------------------
>  1 files changed, 0 insertions(+), 19 deletions(-)

Sorry, but you'll need to rebase this one since it doesn't apply anymore
cleanly (due to the "Initial attribute permission implementation"
patch).

Johan

^ permalink raw reply

* [PATCH v2 3/5] Make EIR type an optional argument for bt_extract_eir_name
From: Claudio Takahasi @ 2010-12-07 21:33 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Claudio Takahasi
In-Reply-To: <1291386532-4985-3-git-send-email-claudio.takahasi@openbossa.org>

---
 src/adapter.c     |    3 +--
 src/glib-helper.c |    5 +++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/adapter.c b/src/adapter.c
index 102aad7..b581674 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -3142,8 +3142,7 @@ void adapter_update_device_from_info(struct btd_adapter *adapter,
 						(GCompareFunc) dev_rssi_cmp);
 
 	if (info->length) {
-		uint8_t type;
-		char *tmp_name = bt_extract_eir_name(info->data, &type);
+		char *tmp_name = bt_extract_eir_name(info->data, NULL);
 		if (tmp_name) {
 			g_free(dev->name);
 			dev->name = tmp_name;
diff --git a/src/glib-helper.c b/src/glib-helper.c
index 927fb7c..e71841b 100644
--- a/src/glib-helper.c
+++ b/src/glib-helper.c
@@ -744,9 +744,10 @@ char *bt_extract_eir_name(uint8_t *data, uint8_t *type)
 	if (data[0] == 0)
 		return NULL;
 
-	*type = data[1];
+	if (type)
+		*type = data[1];
 
-	switch (*type) {
+	switch (data[1]) {
 	case EIR_NAME_SHORT:
 	case EIR_NAME_COMPLETE:
 		if (!g_utf8_validate((char *) (data + 2), data[0] - 1, NULL))
-- 
1.7.3.2


^ permalink raw reply related

* [PATCH v2 2/5] Check if the remote LE is connectable when creating a device
From: Claudio Takahasi @ 2010-12-07 21:31 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Claudio Takahasi
In-Reply-To: <1291386532-4985-2-git-send-email-claudio.takahasi@openbossa.org>

Before issue Discover All Primary Service the advertising event type
needs to be evaluated to avoid connection attempts to non-connectable
devices. For non-connectable devices, CreateDevice creates the device
instance however no Services/UUIDs will be exposed.
---
 src/adapter.c |   28 ++++++++++++++++++++++++++++
 1 files changed, 28 insertions(+), 0 deletions(-)

diff --git a/src/adapter.c b/src/adapter.c
index b3270ce..102aad7 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -56,6 +56,9 @@
 #include "agent.h"
 #include "storage.h"
 
+#define ADV_TYPE_IND		0x00
+#define ADV_TYPE_DIRECT_IND	0x01
+
 #define IO_CAPABILITY_DISPLAYONLY	0x00
 #define IO_CAPABILITY_DISPLAYYESNO	0x01
 #define IO_CAPABILITY_KEYBOARDONLY	0x02
@@ -1706,6 +1709,17 @@ static device_type_t flags2type(uint8_t flags)
 		return DEVICE_TYPE_DUALMODE;
 }
 
+static gboolean event_is_connectable(uint8_t type)
+{
+	switch (type) {
+	case ADV_TYPE_IND:
+	case ADV_TYPE_DIRECT_IND:
+		return TRUE;
+	default:
+		return FALSE;
+	}
+}
+
 static DBusMessage *create_device(DBusConnection *conn,
 					DBusMessage *msg, void *data)
 {
@@ -1741,6 +1755,20 @@ static DBusMessage *create_device(DBusConnection *conn,
 	if (!device)
 		return NULL;
 
+	if (type == DEVICE_TYPE_LE && !event_is_connectable(dev->evt_type)) {
+		/* Device is not connectable */
+		const char *path = device_get_path(device);
+		DBusMessage *reply;
+
+		reply = dbus_message_new_method_return(msg);
+
+		dbus_message_append_args(reply,
+					DBUS_TYPE_OBJECT_PATH, &path,
+					DBUS_TYPE_INVALID);
+
+		return reply;
+	}
+
 	err = device_browse(device, conn, msg, NULL, FALSE);
 	if (err < 0)
 		return failed_strerror(msg, -err);
-- 
1.7.3.2


^ permalink raw reply related

* [PATCH v2 1/5] Add device type to identify LE, BR/EDR or dual mode devices
From: Claudio Takahasi @ 2010-12-07 21:30 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: Claudio Takahasi
In-Reply-To: <AANLkTinFBtVhu0j6xcHsH6XQZM8J-UeHSG2fOJJ-otcJ@mail.gmail.com>

If EIR Flags field is sent in the advertising data, it can be used
to detect the operation mode. If the remote device is dual mode,
GAP operation mode defines that it shall follow the connectable
mode for BR/EDR and non-connectable mode for LE. This patch forces
service discovery protocol prior to Discover All Primary Services.
---
 src/adapter.c |   55 +++++++++++++++++++++++++++++++++++++++----------------
 src/adapter.h |    3 ---
 src/device.c  |   12 ++++++------
 src/device.h  |   11 +++++++++--
 4 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/src/adapter.c b/src/adapter.c
index 62afc0c..b3270ce 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -1196,16 +1196,17 @@ sdp_list_t *adapter_get_services(struct btd_adapter *adapter)
 	return adapter->services;
 }
 
-struct btd_device *adapter_create_device(DBusConnection *conn,
-					struct btd_adapter *adapter,
-					const char *address, gboolean le)
+static struct btd_device *adapter_create_device(DBusConnection *conn,
+						struct btd_adapter *adapter,
+						const char *address,
+						device_type_t type)
 {
 	struct btd_device *device;
 	const char *path;
 
 	DBG("%s", address);
 
-	device = device_create(conn, adapter, address, le);
+	device = device_create(conn, adapter, address, type);
 	if (!device)
 		return NULL;
 
@@ -1264,7 +1265,8 @@ struct btd_device *adapter_get_device(DBusConnection *conn,
 	if (device)
 		return device;
 
-	return adapter_create_device(conn, adapter, address, FALSE);
+	return adapter_create_device(conn, adapter, address,
+						DEVICE_TYPE_BREDR);
 }
 
 static gboolean stop_scanning(gpointer user_data)
@@ -1686,6 +1688,24 @@ static DBusMessage *cancel_device_creation(DBusConnection *conn,
 	return dbus_message_new_method_return(msg);
 }
 
+static device_type_t flags2type(uint8_t flags)
+{
+	/* Inferring the remote type based on the EIR Flags field */
+
+	/* For LE only and dual mode the following flags must be zero */
+	if (flags & (EIR_SIM_CONTROLLER | EIR_SIM_HOST))
+		return DEVICE_TYPE_UNKNOWN;
+
+	/* Limited or General discoverable mode bit must be enabled */
+	if (!(flags & (EIR_LIM_DISC | EIR_GEN_DISC)))
+		return DEVICE_TYPE_UNKNOWN;
+
+	if (flags & EIR_BREDR_UNSUP)
+		return DEVICE_TYPE_LE;
+	else
+		return DEVICE_TYPE_DUALMODE;
+}
+
 static DBusMessage *create_device(DBusConnection *conn,
 					DBusMessage *msg, void *data)
 {
@@ -1693,8 +1713,8 @@ static DBusMessage *create_device(DBusConnection *conn,
 	struct btd_device *device;
 	struct remote_dev_info *dev, match;
 	const gchar *address;
-	gboolean le;
 	int err;
+	device_type_t type;
 
 	if (dbus_message_get_args(msg, NULL, DBUS_TYPE_STRING, &address,
 						DBUS_TYPE_INVALID) == FALSE)
@@ -1715,9 +1735,9 @@ static DBusMessage *create_device(DBusConnection *conn,
 	match.name_status = NAME_ANY;
 
 	dev = adapter_search_found_devices(adapter, &match);
-	le  = dev ? dev->le : FALSE;
+	type = dev && dev->flags ? flags2type(dev->flags) : DEVICE_TYPE_BREDR;
 
-	device = adapter_create_device(conn, adapter, address, le);
+	device = adapter_create_device(conn, adapter, address, type);
 	if (!device)
 		return NULL;
 
@@ -2013,7 +2033,7 @@ static void create_stored_device_from_profiles(char *key, char *value,
 				key, (GCompareFunc) device_address_cmp))
 		return;
 
-	device = device_create(connection, adapter, key, FALSE);
+	device = device_create(connection, adapter, key, DEVICE_TYPE_BREDR);
 	if (!device)
 		return;
 
@@ -2036,7 +2056,7 @@ static void create_stored_device_from_linkkeys(char *key, char *value,
 					(GCompareFunc) device_address_cmp))
 		return;
 
-	device = device_create(connection, adapter, key, FALSE);
+	device = device_create(connection, adapter, key, DEVICE_TYPE_BREDR);
 	if (device) {
 		device_set_temporary(device, FALSE);
 		adapter->devices = g_slist_append(adapter->devices, device);
@@ -2053,7 +2073,7 @@ static void create_stored_device_from_blocked(char *key, char *value,
 				key, (GCompareFunc) device_address_cmp))
 		return;
 
-	device = device_create(connection, adapter, key, FALSE);
+	device = device_create(connection, adapter, key, DEVICE_TYPE_BREDR);
 	if (device) {
 		device_set_temporary(device, FALSE);
 		adapter->devices = g_slist_append(adapter->devices, device);
@@ -3054,16 +3074,19 @@ static struct remote_dev_info *get_found_dev(struct btd_adapter *adapter,
 	return dev;
 }
 
-static uint8_t extract_eir_flags(uint8_t *eir_data)
+static gboolean extract_eir_flags(uint8_t *flags, uint8_t *eir_data)
 {
 	if (eir_data[0] == 0)
-		return 0;
+		return FALSE;
 
 	if (eir_data[1] != EIR_FLAGS)
-		return 0;
+		return FALSE;
 
 	/* For now, only one octet is used for flags */
-	return eir_data[2];
+	if (flags)
+		*flags = eir_data[2];
+
+	return TRUE;
 }
 
 void adapter_update_device_from_info(struct btd_adapter *adapter,
@@ -3098,7 +3121,7 @@ void adapter_update_device_from_info(struct btd_adapter *adapter,
 			dev->name = tmp_name;
 		}
 
-		dev->flags = extract_eir_flags(info->data);
+		extract_eir_flags(info->data, &dev->flags);
 	}
 
 	/* FIXME: check if other information was changed before emitting the
diff --git a/src/adapter.h b/src/adapter.h
index b189b27..3a2cf9c 100644
--- a/src/adapter.h
+++ b/src/adapter.h
@@ -108,9 +108,6 @@ struct btd_device *adapter_find_connection(struct btd_adapter *adapter, uint16_t
 void adapter_remove_device(DBusConnection *conn, struct btd_adapter *adapter,
 						struct btd_device *device,
 						gboolean remove_storage);
-struct btd_device *adapter_create_device(DBusConnection *conn,
-					struct btd_adapter *adapter,
-					const char *address, gboolean le);
 
 int adapter_resolve_names(struct btd_adapter *adapter);
 
diff --git a/src/device.c b/src/device.c
index 5326e3f..50fb83c 100644
--- a/src/device.c
+++ b/src/device.c
@@ -107,7 +107,7 @@ struct browse_req {
 
 struct btd_device {
 	bdaddr_t	bdaddr;
-	gboolean	le;
+	device_type_t	type;
 	gchar		*path;
 	char		name[MAX_NAME_LENGTH + 1];
 	char		*alias;
@@ -212,7 +212,7 @@ static void browse_request_cancel(struct browse_req *req)
 
 	adapter_get_address(adapter, &src);
 
-	if (device->le == FALSE)
+	if (device->type != DEVICE_TYPE_LE)
 		bt_cancel_discovery(&src, &device->bdaddr);
 
 	device->browse = NULL;
@@ -964,8 +964,8 @@ void device_set_secmode3_conn(struct btd_device *device, gboolean enable)
 }
 
 struct btd_device *device_create(DBusConnection *conn,
-					struct btd_adapter *adapter,
-					const gchar *address, gboolean le)
+				struct btd_adapter *adapter,
+				const gchar *address, device_type_t type)
 {
 	gchar *address_up;
 	struct btd_device *device;
@@ -993,7 +993,7 @@ struct btd_device *device_create(DBusConnection *conn,
 
 	str2ba(address, &device->bdaddr);
 	device->adapter = adapter;
-	device->le = le;
+	device->type = type;
 	adapter_get_address(adapter, &src);
 	ba2str(&src, srcaddr);
 	read_device_name(srcaddr, address, device->name);
@@ -1656,7 +1656,7 @@ int device_browse(struct btd_device *device, DBusConnection *conn,
 	if (device->browse)
 		return -EBUSY;
 
-	if (device->le)
+	if (device->type == DEVICE_TYPE_LE)
 		req = browse_primary(device, &err);
 	else
 		req = browse_sdp(device, search, reverse, &err);
diff --git a/src/device.h b/src/device.h
index a5b6273..784e931 100644
--- a/src/device.h
+++ b/src/device.h
@@ -34,9 +34,16 @@ typedef enum {
 	AUTH_TYPE_AUTO,
 } auth_type_t;
 
+typedef enum {
+	DEVICE_TYPE_UNKNOWN,
+	DEVICE_TYPE_BREDR,
+	DEVICE_TYPE_LE,
+	DEVICE_TYPE_DUALMODE
+} device_type_t;
+
 struct btd_device *device_create(DBusConnection *conn,
-					struct btd_adapter *adapter,
-					const gchar *address, gboolean le);
+				struct btd_adapter *adapter,
+				const gchar *address, device_type_t type);
 void device_set_name(struct btd_device *device, const char *name);
 void device_get_name(struct btd_device *device, char *name, size_t len);
 void device_remove(struct btd_device *device, gboolean remove_stored);
-- 
1.7.3.2


^ permalink raw reply related

* Re: [PATCH 1/3] Fix possible crash when processing session callback
From: Johan Hedberg @ 2010-12-07 21:17 UTC (permalink / raw)
  To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
In-Reply-To: <1291734061-24408-1-git-send-email-luiz.dentz@gmail.com>

Hi Luiz,

On Tue, Dec 07, 2010, Luiz Augusto von Dentz wrote:
> If the callback removes the pending data it cause this:
> 
> ==20639== Invalid read of size 4
> ==20639==    at 0x80553E9: free_pending (session.c:112)
> ==20639==    by 0x8056C83: session_request_reply (session.c:837)
> ==20639==    by 0x412F7E0: ??? (in /lib/libdbus-1.so.3.5.2)
> ==20639==    by 0x411D975: ??? (in /lib/libdbus-1.so.3.5.2)
> ==20639==    by 0x4120B81: dbus_connection_dispatch (in /lib/libdbus-1.so.3.5.2)
> ==20639==    by 0x804C27F: message_dispatch (mainloop.c:80)
> ==20639==    by 0x407EFCB: ??? (in /lib/libglib-2.0.so.0.2600.1)
> ==20639==    by 0x407E854: g_main_context_dispatch (in /lib/libglib-2.0.so.0.2600.1)
> ==20639==    by 0x4082667: ??? (in /lib/libglib-2.0.so.0.2600.1)
> ==20639==    by 0x4082BA6: g_main_loop_run (in /lib/libglib-2.0.so.0.2600.1)
> ==20639==    by 0x8055171: main (main.c:625)
> ==20639==  Address 0x4363c88 is 0 bytes inside a block of size 12 free'd
> ==20639==    at 0x40257ED: free (vg_replace_malloc.c:366)
> ==20639==    by 0x4087485: g_free (in /lib/libglib-2.0.so.0.2600.1)
> ==20639==    by 0x80553FE: free_pending (session.c:115)
> ==20639==    by 0x805543C: agent_free (session.c:127)
> ==20639==    by 0x80566A6: session_free (session.c:149)
> ==20639==    by 0x8056BCA: session_terminate_transfer (session.c:914)
> ==20639==    by 0x8056F61: session_prepare_put (session.c:1397)
> ==20639==    by 0x8056C74: session_request_reply (session.c:835)
> ==20639==    by 0x412F7E0: ??? (in /lib/libdbus-1.so.3.5.2)
> ==20639==    by 0x411D975: ??? (in /lib/libdbus-1.so.3.5.2)
> ==20639==    by 0x4120B81: dbus_connection_dispatch (in /lib/libdbus-1.so.3.5.2)
> ==20639==    by 0x804C27F: message_dispatch (mainloop.c:80)
> 
> To fix this agent->pending is now reset to NULL before calling the
> callback, so even if the session is terminated it won't cause a free to
> pending data, which is fine since it is latter freed on callback return.
> ---
>  client/session.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)

Patches 1 and 2 have been pushed. For the third one (as we discussed
offline) I'm still waiting for an update to fix the format string
specifier for off_t.

Johan

^ permalink raw reply

* Re: [PATCH 1/9] Create btd_error_invalid_args()
From: Johan Hedberg @ 2010-12-07 21:16 UTC (permalink / raw)
  To: Gustavo F. Padovan, linux-bluetooth
In-Reply-To: <20101207210511.GB25558@jh-x301>

Hi,

On Tue, Dec 07, 2010, Johan Hedberg wrote:
> This as well as the second patch (ERROR_NOT_SUPPORTED) have been pushed
> upstream.

Actually I messed up with which patch is which and also pushed the one I
didn't really like (the NOT_SUPPORTED one). So all nine patches are now
upstream. However, as I pointed out in the other mail, please consider
the drawback of making completely generic functions for all errors. In
some cases it might make sense to att least be able to provide a context
specific custom message (and I'd be glad to accept patches that do
that).

Johan

^ permalink raw reply

* Re: [PATCH 1/9] Create btd_error_invalid_args()
From: Johan Hedberg @ 2010-12-07 21:05 UTC (permalink / raw)
  To: Gustavo F. Padovan; +Cc: linux-bluetooth
In-Reply-To: <1291662648-10651-1-git-send-email-padovan@profusion.mobi>

Hi Gustavo,

On Mon, Dec 06, 2010, Gustavo F. Padovan wrote:
> DBus error handling in BlueZ is a mess. This is the first patch to unify
> all DBus error handling like in ConnMan and oFono. This unifies all
> .InvalidArguments errors.
> ---
>  attrib/client.c          |   20 ++++++-----------
>  audio/gateway.c          |    8 +-----
>  audio/headset.c          |   18 +++++----------
>  audio/media.c            |    9 ++-----
>  audio/telephony-dummy.c  |   25 ++++++++------------
>  audio/telephony-maemo5.c |   11 ++------
>  audio/telephony-maemo6.c |   11 ++------
>  audio/transport.c        |   14 +++--------
>  health/hdp.c             |   54 ++++++++++++----------------------------------
>  network/server.c         |    7 ------
>  plugins/service.c        |    8 +------
>  serial/port.c            |    8 ------
>  serial/proxy.c           |   19 +++++-----------
>  src/adapter.c            |   52 +++++++++++++++++++------------------------
>  src/device.c             |   22 ++++++------------
>  src/error.c              |    7 ++++++
>  src/error.h              |    2 +
>  src/manager.c            |    7 ------
>  18 files changed, 99 insertions(+), 203 deletions(-)

This as well as the second patch (ERROR_NOT_SUPPORTED) have been pushed
upstream.

Johan

^ permalink raw reply


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox