2 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI Management interface */
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/l2cap.h>
33 #include <net/bluetooth/mgmt.h>
37 #define MGMT_VERSION 1
38 #define MGMT_REVISION 8
40 static const u16 mgmt_commands[] = {
41 MGMT_OP_READ_INDEX_LIST,
44 MGMT_OP_SET_DISCOVERABLE,
45 MGMT_OP_SET_CONNECTABLE,
46 MGMT_OP_SET_FAST_CONNECTABLE,
48 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_DEV_CLASS,
53 MGMT_OP_SET_LOCAL_NAME,
56 MGMT_OP_LOAD_LINK_KEYS,
57 MGMT_OP_LOAD_LONG_TERM_KEYS,
59 MGMT_OP_GET_CONNECTIONS,
60 MGMT_OP_PIN_CODE_REPLY,
61 MGMT_OP_PIN_CODE_NEG_REPLY,
62 MGMT_OP_SET_IO_CAPABILITY,
64 MGMT_OP_CANCEL_PAIR_DEVICE,
65 MGMT_OP_UNPAIR_DEVICE,
66 MGMT_OP_USER_CONFIRM_REPLY,
67 MGMT_OP_USER_CONFIRM_NEG_REPLY,
68 MGMT_OP_USER_PASSKEY_REPLY,
69 MGMT_OP_USER_PASSKEY_NEG_REPLY,
70 MGMT_OP_READ_LOCAL_OOB_DATA,
71 MGMT_OP_ADD_REMOTE_OOB_DATA,
72 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
73 MGMT_OP_START_DISCOVERY,
74 MGMT_OP_STOP_DISCOVERY,
77 MGMT_OP_UNBLOCK_DEVICE,
78 MGMT_OP_SET_DEVICE_ID,
79 MGMT_OP_SET_ADVERTISING,
81 MGMT_OP_SET_STATIC_ADDRESS,
82 MGMT_OP_SET_SCAN_PARAMS,
83 MGMT_OP_SET_SECURE_CONN,
84 MGMT_OP_SET_DEBUG_KEYS,
87 MGMT_OP_GET_CONN_INFO,
88 MGMT_OP_GET_CLOCK_INFO,
90 MGMT_OP_REMOVE_DEVICE,
91 MGMT_OP_LOAD_CONN_PARAM,
92 MGMT_OP_READ_UNCONF_INDEX_LIST,
93 MGMT_OP_READ_CONFIG_INFO,
94 MGMT_OP_SET_EXTERNAL_CONFIG,
95 MGMT_OP_SET_PUBLIC_ADDRESS,
96 MGMT_OP_START_SERVICE_DISCOVERY,
99 static const u16 mgmt_events[] = {
100 MGMT_EV_CONTROLLER_ERROR,
102 MGMT_EV_INDEX_REMOVED,
103 MGMT_EV_NEW_SETTINGS,
104 MGMT_EV_CLASS_OF_DEV_CHANGED,
105 MGMT_EV_LOCAL_NAME_CHANGED,
106 MGMT_EV_NEW_LINK_KEY,
107 MGMT_EV_NEW_LONG_TERM_KEY,
108 MGMT_EV_DEVICE_CONNECTED,
109 MGMT_EV_DEVICE_DISCONNECTED,
110 MGMT_EV_CONNECT_FAILED,
111 MGMT_EV_PIN_CODE_REQUEST,
112 MGMT_EV_USER_CONFIRM_REQUEST,
113 MGMT_EV_USER_PASSKEY_REQUEST,
115 MGMT_EV_DEVICE_FOUND,
117 MGMT_EV_DEVICE_BLOCKED,
118 MGMT_EV_DEVICE_UNBLOCKED,
119 MGMT_EV_DEVICE_UNPAIRED,
120 MGMT_EV_PASSKEY_NOTIFY,
123 MGMT_EV_DEVICE_ADDED,
124 MGMT_EV_DEVICE_REMOVED,
125 MGMT_EV_NEW_CONN_PARAM,
126 MGMT_EV_UNCONF_INDEX_ADDED,
127 MGMT_EV_UNCONF_INDEX_REMOVED,
128 MGMT_EV_NEW_CONFIG_OPTIONS,
131 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
134 struct list_head list;
141 void (*cmd_complete)(struct pending_cmd *cmd, u8 status);
144 /* HCI to MGMT error code conversion table */
145 static u8 mgmt_status_table[] = {
147 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
148 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
149 MGMT_STATUS_FAILED, /* Hardware Failure */
150 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
151 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
152 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
153 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
154 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
155 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
156 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
157 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
158 MGMT_STATUS_BUSY, /* Command Disallowed */
159 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
160 MGMT_STATUS_REJECTED, /* Rejected Security */
161 MGMT_STATUS_REJECTED, /* Rejected Personal */
162 MGMT_STATUS_TIMEOUT, /* Host Timeout */
163 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
164 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
165 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
166 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
167 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
168 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
169 MGMT_STATUS_BUSY, /* Repeated Attempts */
170 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
171 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
172 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
173 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
174 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
175 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
176 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
177 MGMT_STATUS_FAILED, /* Unspecified Error */
178 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
179 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
180 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
181 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
182 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
183 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
184 MGMT_STATUS_FAILED, /* Unit Link Key Used */
185 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
186 MGMT_STATUS_TIMEOUT, /* Instant Passed */
187 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
188 MGMT_STATUS_FAILED, /* Transaction Collision */
189 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
190 MGMT_STATUS_REJECTED, /* QoS Rejected */
191 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
192 MGMT_STATUS_REJECTED, /* Insufficient Security */
193 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
194 MGMT_STATUS_BUSY, /* Role Switch Pending */
195 MGMT_STATUS_FAILED, /* Slot Violation */
196 MGMT_STATUS_FAILED, /* Role Switch Failed */
197 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
198 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
199 MGMT_STATUS_BUSY, /* Host Busy Pairing */
200 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
201 MGMT_STATUS_BUSY, /* Controller Busy */
202 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
203 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
204 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
205 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
206 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
209 static u8 mgmt_status(u8 hci_status)
211 if (hci_status < ARRAY_SIZE(mgmt_status_table))
212 return mgmt_status_table[hci_status];
214 return MGMT_STATUS_FAILED;
217 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
218 struct sock *skip_sk)
221 struct mgmt_hdr *hdr;
223 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
227 hdr = (void *) skb_put(skb, sizeof(*hdr));
228 hdr->opcode = cpu_to_le16(event);
230 hdr->index = cpu_to_le16(hdev->id);
232 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
233 hdr->len = cpu_to_le16(data_len);
236 memcpy(skb_put(skb, data_len), data, data_len);
239 __net_timestamp(skb);
241 hci_send_to_control(skb, skip_sk);
247 static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
250 struct mgmt_hdr *hdr;
251 struct mgmt_ev_cmd_status *ev;
254 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
256 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
260 hdr = (void *) skb_put(skb, sizeof(*hdr));
262 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
263 hdr->index = cpu_to_le16(index);
264 hdr->len = cpu_to_le16(sizeof(*ev));
266 ev = (void *) skb_put(skb, sizeof(*ev));
268 ev->opcode = cpu_to_le16(cmd);
270 err = sock_queue_rcv_skb(sk, skb);
277 static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
278 void *rp, size_t rp_len)
281 struct mgmt_hdr *hdr;
282 struct mgmt_ev_cmd_complete *ev;
285 BT_DBG("sock %p", sk);
287 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
291 hdr = (void *) skb_put(skb, sizeof(*hdr));
293 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
294 hdr->index = cpu_to_le16(index);
295 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
297 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
298 ev->opcode = cpu_to_le16(cmd);
302 memcpy(ev->data, rp, rp_len);
304 err = sock_queue_rcv_skb(sk, skb);
311 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
314 struct mgmt_rp_read_version rp;
316 BT_DBG("sock %p", sk);
318 rp.version = MGMT_VERSION;
319 rp.revision = cpu_to_le16(MGMT_REVISION);
321 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
325 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
328 struct mgmt_rp_read_commands *rp;
329 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
330 const u16 num_events = ARRAY_SIZE(mgmt_events);
335 BT_DBG("sock %p", sk);
337 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
339 rp = kmalloc(rp_size, GFP_KERNEL);
343 rp->num_commands = cpu_to_le16(num_commands);
344 rp->num_events = cpu_to_le16(num_events);
346 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
347 put_unaligned_le16(mgmt_commands[i], opcode);
349 for (i = 0; i < num_events; i++, opcode++)
350 put_unaligned_le16(mgmt_events[i], opcode);
352 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
359 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
362 struct mgmt_rp_read_index_list *rp;
368 BT_DBG("sock %p", sk);
370 read_lock(&hci_dev_list_lock);
373 list_for_each_entry(d, &hci_dev_list, list) {
374 if (d->dev_type == HCI_BREDR &&
375 !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
379 rp_len = sizeof(*rp) + (2 * count);
380 rp = kmalloc(rp_len, GFP_ATOMIC);
382 read_unlock(&hci_dev_list_lock);
387 list_for_each_entry(d, &hci_dev_list, list) {
388 if (test_bit(HCI_SETUP, &d->dev_flags) ||
389 test_bit(HCI_CONFIG, &d->dev_flags) ||
390 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
393 /* Devices marked as raw-only are neither configured
394 * nor unconfigured controllers.
396 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
399 if (d->dev_type == HCI_BREDR &&
400 !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
401 rp->index[count++] = cpu_to_le16(d->id);
402 BT_DBG("Added hci%u", d->id);
406 rp->num_controllers = cpu_to_le16(count);
407 rp_len = sizeof(*rp) + (2 * count);
409 read_unlock(&hci_dev_list_lock);
411 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
419 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
420 void *data, u16 data_len)
422 struct mgmt_rp_read_unconf_index_list *rp;
428 BT_DBG("sock %p", sk);
430 read_lock(&hci_dev_list_lock);
433 list_for_each_entry(d, &hci_dev_list, list) {
434 if (d->dev_type == HCI_BREDR &&
435 test_bit(HCI_UNCONFIGURED, &d->dev_flags))
439 rp_len = sizeof(*rp) + (2 * count);
440 rp = kmalloc(rp_len, GFP_ATOMIC);
442 read_unlock(&hci_dev_list_lock);
447 list_for_each_entry(d, &hci_dev_list, list) {
448 if (test_bit(HCI_SETUP, &d->dev_flags) ||
449 test_bit(HCI_CONFIG, &d->dev_flags) ||
450 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
453 /* Devices marked as raw-only are neither configured
454 * nor unconfigured controllers.
456 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
459 if (d->dev_type == HCI_BREDR &&
460 test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
461 rp->index[count++] = cpu_to_le16(d->id);
462 BT_DBG("Added hci%u", d->id);
466 rp->num_controllers = cpu_to_le16(count);
467 rp_len = sizeof(*rp) + (2 * count);
469 read_unlock(&hci_dev_list_lock);
471 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
479 static bool is_configured(struct hci_dev *hdev)
481 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
482 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
485 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
486 !bacmp(&hdev->public_addr, BDADDR_ANY))
492 static __le32 get_missing_options(struct hci_dev *hdev)
496 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
497 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
498 options |= MGMT_OPTION_EXTERNAL_CONFIG;
500 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
501 !bacmp(&hdev->public_addr, BDADDR_ANY))
502 options |= MGMT_OPTION_PUBLIC_ADDRESS;
504 return cpu_to_le32(options);
507 static int new_options(struct hci_dev *hdev, struct sock *skip)
509 __le32 options = get_missing_options(hdev);
511 return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
512 sizeof(options), skip);
515 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
517 __le32 options = get_missing_options(hdev);
519 return cmd_complete(sk, hdev->id, opcode, 0, &options,
523 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
524 void *data, u16 data_len)
526 struct mgmt_rp_read_config_info rp;
529 BT_DBG("sock %p %s", sk, hdev->name);
533 memset(&rp, 0, sizeof(rp));
534 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
536 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
537 options |= MGMT_OPTION_EXTERNAL_CONFIG;
539 if (hdev->set_bdaddr)
540 options |= MGMT_OPTION_PUBLIC_ADDRESS;
542 rp.supported_options = cpu_to_le32(options);
543 rp.missing_options = get_missing_options(hdev);
545 hci_dev_unlock(hdev);
547 return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
551 static u32 get_supported_settings(struct hci_dev *hdev)
555 settings |= MGMT_SETTING_POWERED;
556 settings |= MGMT_SETTING_BONDABLE;
557 settings |= MGMT_SETTING_DEBUG_KEYS;
558 settings |= MGMT_SETTING_CONNECTABLE;
559 settings |= MGMT_SETTING_DISCOVERABLE;
561 if (lmp_bredr_capable(hdev)) {
562 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
563 settings |= MGMT_SETTING_FAST_CONNECTABLE;
564 settings |= MGMT_SETTING_BREDR;
565 settings |= MGMT_SETTING_LINK_SECURITY;
567 if (lmp_ssp_capable(hdev)) {
568 settings |= MGMT_SETTING_SSP;
569 settings |= MGMT_SETTING_HS;
572 if (lmp_sc_capable(hdev) ||
573 test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
574 settings |= MGMT_SETTING_SECURE_CONN;
577 if (lmp_le_capable(hdev)) {
578 settings |= MGMT_SETTING_LE;
579 settings |= MGMT_SETTING_ADVERTISING;
580 settings |= MGMT_SETTING_SECURE_CONN;
581 settings |= MGMT_SETTING_PRIVACY;
584 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
586 settings |= MGMT_SETTING_CONFIGURATION;
591 static u32 get_current_settings(struct hci_dev *hdev)
595 if (hdev_is_powered(hdev))
596 settings |= MGMT_SETTING_POWERED;
598 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
599 settings |= MGMT_SETTING_CONNECTABLE;
601 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
602 settings |= MGMT_SETTING_FAST_CONNECTABLE;
604 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
605 settings |= MGMT_SETTING_DISCOVERABLE;
607 if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
608 settings |= MGMT_SETTING_BONDABLE;
610 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
611 settings |= MGMT_SETTING_BREDR;
613 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
614 settings |= MGMT_SETTING_LE;
616 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
617 settings |= MGMT_SETTING_LINK_SECURITY;
619 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
620 settings |= MGMT_SETTING_SSP;
622 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
623 settings |= MGMT_SETTING_HS;
625 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
626 settings |= MGMT_SETTING_ADVERTISING;
628 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
629 settings |= MGMT_SETTING_SECURE_CONN;
631 if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
632 settings |= MGMT_SETTING_DEBUG_KEYS;
634 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
635 settings |= MGMT_SETTING_PRIVACY;
640 #define PNP_INFO_SVCLASS_ID 0x1200
642 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
644 u8 *ptr = data, *uuids_start = NULL;
645 struct bt_uuid *uuid;
650 list_for_each_entry(uuid, &hdev->uuids, list) {
653 if (uuid->size != 16)
656 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
660 if (uuid16 == PNP_INFO_SVCLASS_ID)
666 uuids_start[1] = EIR_UUID16_ALL;
670 /* Stop if not enough space to put next UUID */
671 if ((ptr - data) + sizeof(u16) > len) {
672 uuids_start[1] = EIR_UUID16_SOME;
676 *ptr++ = (uuid16 & 0x00ff);
677 *ptr++ = (uuid16 & 0xff00) >> 8;
678 uuids_start[0] += sizeof(uuid16);
684 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
686 u8 *ptr = data, *uuids_start = NULL;
687 struct bt_uuid *uuid;
692 list_for_each_entry(uuid, &hdev->uuids, list) {
693 if (uuid->size != 32)
699 uuids_start[1] = EIR_UUID32_ALL;
703 /* Stop if not enough space to put next UUID */
704 if ((ptr - data) + sizeof(u32) > len) {
705 uuids_start[1] = EIR_UUID32_SOME;
709 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
711 uuids_start[0] += sizeof(u32);
717 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
719 u8 *ptr = data, *uuids_start = NULL;
720 struct bt_uuid *uuid;
725 list_for_each_entry(uuid, &hdev->uuids, list) {
726 if (uuid->size != 128)
732 uuids_start[1] = EIR_UUID128_ALL;
736 /* Stop if not enough space to put next UUID */
737 if ((ptr - data) + 16 > len) {
738 uuids_start[1] = EIR_UUID128_SOME;
742 memcpy(ptr, uuid->uuid, 16);
744 uuids_start[0] += 16;
750 static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
752 struct pending_cmd *cmd;
754 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
755 if (cmd->opcode == opcode)
762 static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
763 struct hci_dev *hdev,
766 struct pending_cmd *cmd;
768 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
769 if (cmd->user_data != data)
771 if (cmd->opcode == opcode)
778 static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
783 name_len = strlen(hdev->dev_name);
785 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
787 if (name_len > max_len) {
789 ptr[1] = EIR_NAME_SHORT;
791 ptr[1] = EIR_NAME_COMPLETE;
793 ptr[0] = name_len + 1;
795 memcpy(ptr + 2, hdev->dev_name, name_len);
797 ad_len += (name_len + 2);
798 ptr += (name_len + 2);
804 static void update_scan_rsp_data(struct hci_request *req)
806 struct hci_dev *hdev = req->hdev;
807 struct hci_cp_le_set_scan_rsp_data cp;
810 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
813 memset(&cp, 0, sizeof(cp));
815 len = create_scan_rsp_data(hdev, cp.data);
817 if (hdev->scan_rsp_data_len == len &&
818 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
821 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
822 hdev->scan_rsp_data_len = len;
826 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
829 static u8 get_adv_discov_flags(struct hci_dev *hdev)
831 struct pending_cmd *cmd;
833 /* If there's a pending mgmt command the flags will not yet have
834 * their final values, so check for this first.
836 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
838 struct mgmt_mode *cp = cmd->param;
840 return LE_AD_GENERAL;
841 else if (cp->val == 0x02)
842 return LE_AD_LIMITED;
844 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
845 return LE_AD_LIMITED;
846 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
847 return LE_AD_GENERAL;
853 static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
855 u8 ad_len = 0, flags = 0;
857 flags |= get_adv_discov_flags(hdev);
859 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
860 flags |= LE_AD_NO_BREDR;
863 BT_DBG("adv flags 0x%02x", flags);
873 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
875 ptr[1] = EIR_TX_POWER;
876 ptr[2] = (u8) hdev->adv_tx_power;
885 static void update_adv_data(struct hci_request *req)
887 struct hci_dev *hdev = req->hdev;
888 struct hci_cp_le_set_adv_data cp;
891 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
894 memset(&cp, 0, sizeof(cp));
896 len = create_adv_data(hdev, cp.data);
898 if (hdev->adv_data_len == len &&
899 memcmp(cp.data, hdev->adv_data, len) == 0)
902 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
903 hdev->adv_data_len = len;
907 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
910 int mgmt_update_adv_data(struct hci_dev *hdev)
912 struct hci_request req;
914 hci_req_init(&req, hdev);
915 update_adv_data(&req);
917 return hci_req_run(&req, NULL);
920 static void create_eir(struct hci_dev *hdev, u8 *data)
925 name_len = strlen(hdev->dev_name);
931 ptr[1] = EIR_NAME_SHORT;
933 ptr[1] = EIR_NAME_COMPLETE;
935 /* EIR Data length */
936 ptr[0] = name_len + 1;
938 memcpy(ptr + 2, hdev->dev_name, name_len);
940 ptr += (name_len + 2);
943 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
945 ptr[1] = EIR_TX_POWER;
946 ptr[2] = (u8) hdev->inq_tx_power;
951 if (hdev->devid_source > 0) {
953 ptr[1] = EIR_DEVICE_ID;
955 put_unaligned_le16(hdev->devid_source, ptr + 2);
956 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
957 put_unaligned_le16(hdev->devid_product, ptr + 6);
958 put_unaligned_le16(hdev->devid_version, ptr + 8);
963 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
964 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
965 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
968 static void update_eir(struct hci_request *req)
970 struct hci_dev *hdev = req->hdev;
971 struct hci_cp_write_eir cp;
973 if (!hdev_is_powered(hdev))
976 if (!lmp_ext_inq_capable(hdev))
979 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
982 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
985 memset(&cp, 0, sizeof(cp));
987 create_eir(hdev, cp.data);
989 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
992 memcpy(hdev->eir, cp.data, sizeof(cp.data));
994 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
997 static u8 get_service_classes(struct hci_dev *hdev)
999 struct bt_uuid *uuid;
1002 list_for_each_entry(uuid, &hdev->uuids, list)
1003 val |= uuid->svc_hint;
1008 static void update_class(struct hci_request *req)
1010 struct hci_dev *hdev = req->hdev;
1013 BT_DBG("%s", hdev->name);
1015 if (!hdev_is_powered(hdev))
1018 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1021 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1024 cod[0] = hdev->minor_class;
1025 cod[1] = hdev->major_class;
1026 cod[2] = get_service_classes(hdev);
1028 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1031 if (memcmp(cod, hdev->dev_class, 3) == 0)
1034 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1037 static bool get_connectable(struct hci_dev *hdev)
1039 struct pending_cmd *cmd;
1041 /* If there's a pending mgmt command the flag will not yet have
1042 * it's final value, so check for this first.
1044 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1046 struct mgmt_mode *cp = cmd->param;
1050 return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1053 static void disable_advertising(struct hci_request *req)
1057 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1060 static void enable_advertising(struct hci_request *req)
1062 struct hci_dev *hdev = req->hdev;
1063 struct hci_cp_le_set_adv_param cp;
1064 u8 own_addr_type, enable = 0x01;
1067 if (hci_conn_num(hdev, LE_LINK) > 0)
1070 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1071 disable_advertising(req);
1073 /* Clear the HCI_LE_ADV bit temporarily so that the
1074 * hci_update_random_address knows that it's safe to go ahead
1075 * and write a new random address. The flag will be set back on
1076 * as soon as the SET_ADV_ENABLE HCI command completes.
1078 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1080 connectable = get_connectable(hdev);
1082 /* Set require_privacy to true only when non-connectable
1083 * advertising is used. In that case it is fine to use a
1084 * non-resolvable private address.
1086 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
1089 memset(&cp, 0, sizeof(cp));
1090 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1091 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
1092 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
1093 cp.own_address_type = own_addr_type;
1094 cp.channel_map = hdev->le_adv_channel_map;
1096 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1098 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1101 static void service_cache_off(struct work_struct *work)
1103 struct hci_dev *hdev = container_of(work, struct hci_dev,
1104 service_cache.work);
1105 struct hci_request req;
1107 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1110 hci_req_init(&req, hdev);
1117 hci_dev_unlock(hdev);
1119 hci_req_run(&req, NULL);
1122 static void rpa_expired(struct work_struct *work)
1124 struct hci_dev *hdev = container_of(work, struct hci_dev,
1126 struct hci_request req;
1130 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1132 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1135 /* The generation of a new RPA and programming it into the
1136 * controller happens in the enable_advertising() function.
1138 hci_req_init(&req, hdev);
1139 enable_advertising(&req);
1140 hci_req_run(&req, NULL);
1143 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
1145 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
1148 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
1149 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
1151 /* Non-mgmt controlled devices get this bit set
1152 * implicitly so that pairing works for them, however
1153 * for mgmt we require user-space to explicitly enable
1156 clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
1160 void *data, u16 data_len)
1162 struct mgmt_rp_read_info rp;
1164 BT_DBG("sock %p %s", sk, hdev->name);
1168 memset(&rp, 0, sizeof(rp));
1170 bacpy(&rp.bdaddr, &hdev->bdaddr);
1172 rp.version = hdev->hci_ver;
1173 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
1175 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1176 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
1178 memcpy(rp.dev_class, hdev->dev_class, 3);
1180 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
1181 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
1183 hci_dev_unlock(hdev);
1185 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1189 static void mgmt_pending_free(struct pending_cmd *cmd)
1196 static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
1197 struct hci_dev *hdev, void *data,
1200 struct pending_cmd *cmd;
1202 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
1206 cmd->opcode = opcode;
1207 cmd->index = hdev->id;
1209 cmd->param = kmemdup(data, len, GFP_KERNEL);
1215 cmd->param_len = len;
1220 list_add(&cmd->list, &hdev->mgmt_pending);
1225 static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
1226 void (*cb)(struct pending_cmd *cmd,
1230 struct pending_cmd *cmd, *tmp;
1232 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
1233 if (opcode > 0 && cmd->opcode != opcode)
1240 static void mgmt_pending_remove(struct pending_cmd *cmd)
1242 list_del(&cmd->list);
1243 mgmt_pending_free(cmd);
1246 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
1248 __le32 settings = cpu_to_le32(get_current_settings(hdev));
1250 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
1254 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status)
1256 BT_DBG("%s status 0x%02x", hdev->name, status);
1258 if (hci_conn_count(hdev) == 0) {
1259 cancel_delayed_work(&hdev->power_off);
1260 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1264 static bool hci_stop_discovery(struct hci_request *req)
1266 struct hci_dev *hdev = req->hdev;
1267 struct hci_cp_remote_name_req_cancel cp;
1268 struct inquiry_entry *e;
1270 switch (hdev->discovery.state) {
1271 case DISCOVERY_FINDING:
1272 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1273 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1275 cancel_delayed_work(&hdev->le_scan_disable);
1276 hci_req_add_le_scan_disable(req);
1281 case DISCOVERY_RESOLVING:
1282 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1287 bacpy(&cp.bdaddr, &e->data.bdaddr);
1288 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1294 /* Passive scanning */
1295 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
1296 hci_req_add_le_scan_disable(req);
1306 static int clean_up_hci_state(struct hci_dev *hdev)
1308 struct hci_request req;
1309 struct hci_conn *conn;
1310 bool discov_stopped;
1313 hci_req_init(&req, hdev);
1315 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1316 test_bit(HCI_PSCAN, &hdev->flags)) {
1318 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1321 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1322 disable_advertising(&req);
1324 discov_stopped = hci_stop_discovery(&req);
1326 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1327 struct hci_cp_disconnect dc;
1328 struct hci_cp_reject_conn_req rej;
1330 switch (conn->state) {
1333 dc.handle = cpu_to_le16(conn->handle);
1334 dc.reason = 0x15; /* Terminated due to Power Off */
1335 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1338 if (conn->type == LE_LINK)
1339 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1341 else if (conn->type == ACL_LINK)
1342 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1346 bacpy(&rej.bdaddr, &conn->dst);
1347 rej.reason = 0x15; /* Terminated due to Power Off */
1348 if (conn->type == ACL_LINK)
1349 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1351 else if (conn->type == SCO_LINK)
1352 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1358 err = hci_req_run(&req, clean_up_hci_complete);
1359 if (!err && discov_stopped)
1360 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1365 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
1368 struct mgmt_mode *cp = data;
1369 struct pending_cmd *cmd;
1372 BT_DBG("request for %s", hdev->name);
1374 if (cp->val != 0x00 && cp->val != 0x01)
1375 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1376 MGMT_STATUS_INVALID_PARAMS);
1380 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1381 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1386 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1387 cancel_delayed_work(&hdev->power_off);
1390 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1392 err = mgmt_powered(hdev, 1);
1397 if (!!cp->val == hdev_is_powered(hdev)) {
1398 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
1402 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
1409 queue_work(hdev->req_workqueue, &hdev->power_on);
1412 /* Disconnect connections, stop scans, etc */
1413 err = clean_up_hci_state(hdev);
1415 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1416 HCI_POWER_OFF_TIMEOUT);
1418 /* ENODATA means there were no HCI commands queued */
1419 if (err == -ENODATA) {
1420 cancel_delayed_work(&hdev->power_off);
1421 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1427 hci_dev_unlock(hdev);
1431 static int new_settings(struct hci_dev *hdev, struct sock *skip)
1435 ev = cpu_to_le32(get_current_settings(hdev));
1437 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1440 int mgmt_new_settings(struct hci_dev *hdev)
1442 return new_settings(hdev, NULL);
1447 struct hci_dev *hdev;
1451 static void settings_rsp(struct pending_cmd *cmd, void *data)
1453 struct cmd_lookup *match = data;
1455 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1457 list_del(&cmd->list);
1459 if (match->sk == NULL) {
1460 match->sk = cmd->sk;
1461 sock_hold(match->sk);
1464 mgmt_pending_free(cmd);
1467 static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1471 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1472 mgmt_pending_remove(cmd);
1475 static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1477 if (cmd->cmd_complete) {
1480 cmd->cmd_complete(cmd, *status);
1481 mgmt_pending_remove(cmd);
1486 cmd_status_rsp(cmd, data);
1489 static void generic_cmd_complete(struct pending_cmd *cmd, u8 status)
1491 cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1495 static void addr_cmd_complete(struct pending_cmd *cmd, u8 status)
1497 cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1498 sizeof(struct mgmt_addr_info));
1501 static u8 mgmt_bredr_support(struct hci_dev *hdev)
1503 if (!lmp_bredr_capable(hdev))
1504 return MGMT_STATUS_NOT_SUPPORTED;
1505 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1506 return MGMT_STATUS_REJECTED;
1508 return MGMT_STATUS_SUCCESS;
1511 static u8 mgmt_le_support(struct hci_dev *hdev)
1513 if (!lmp_le_capable(hdev))
1514 return MGMT_STATUS_NOT_SUPPORTED;
1515 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1516 return MGMT_STATUS_REJECTED;
1518 return MGMT_STATUS_SUCCESS;
1521 static void set_discoverable_complete(struct hci_dev *hdev, u8 status)
1523 struct pending_cmd *cmd;
1524 struct mgmt_mode *cp;
1525 struct hci_request req;
1528 BT_DBG("status 0x%02x", status);
1532 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1537 u8 mgmt_err = mgmt_status(status);
1538 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1539 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1545 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1548 if (hdev->discov_timeout > 0) {
1549 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1550 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1554 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1558 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1561 new_settings(hdev, cmd->sk);
1563 /* When the discoverable mode gets changed, make sure
1564 * that class of device has the limited discoverable
1565 * bit correctly set. Also update page scan based on whitelist
1568 hci_req_init(&req, hdev);
1569 hci_update_page_scan(hdev, &req);
1571 hci_req_run(&req, NULL);
1574 mgmt_pending_remove(cmd);
1577 hci_dev_unlock(hdev);
1580 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
1583 struct mgmt_cp_set_discoverable *cp = data;
1584 struct pending_cmd *cmd;
1585 struct hci_request req;
1590 BT_DBG("request for %s", hdev->name);
1592 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1593 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1594 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1595 MGMT_STATUS_REJECTED);
1597 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
1598 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1599 MGMT_STATUS_INVALID_PARAMS);
1601 timeout = __le16_to_cpu(cp->timeout);
1603 /* Disabling discoverable requires that no timeout is set,
1604 * and enabling limited discoverable requires a timeout.
1606 if ((cp->val == 0x00 && timeout > 0) ||
1607 (cp->val == 0x02 && timeout == 0))
1608 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1609 MGMT_STATUS_INVALID_PARAMS);
1613 if (!hdev_is_powered(hdev) && timeout > 0) {
1614 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1615 MGMT_STATUS_NOT_POWERED);
1619 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1620 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1621 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1626 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
1627 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1628 MGMT_STATUS_REJECTED);
1632 if (!hdev_is_powered(hdev)) {
1633 bool changed = false;
1635 /* Setting limited discoverable when powered off is
1636 * not a valid operation since it requires a timeout
1637 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1639 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1640 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1644 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1649 err = new_settings(hdev, sk);
1654 /* If the current mode is the same, then just update the timeout
1655 * value with the new value. And if only the timeout gets updated,
1656 * then no need for any HCI transactions.
1658 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1659 (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1660 &hdev->dev_flags)) {
1661 cancel_delayed_work(&hdev->discov_off);
1662 hdev->discov_timeout = timeout;
1664 if (cp->val && hdev->discov_timeout > 0) {
1665 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1666 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1670 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1674 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
1680 /* Cancel any potential discoverable timeout that might be
1681 * still active and store new timeout value. The arming of
1682 * the timeout happens in the complete handler.
1684 cancel_delayed_work(&hdev->discov_off);
1685 hdev->discov_timeout = timeout;
1687 /* Limited discoverable mode */
1688 if (cp->val == 0x02)
1689 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1691 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1693 hci_req_init(&req, hdev);
1695 /* The procedure for LE-only controllers is much simpler - just
1696 * update the advertising data.
1698 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1704 struct hci_cp_write_current_iac_lap hci_cp;
1706 if (cp->val == 0x02) {
1707 /* Limited discoverable mode */
1708 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
1709 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1710 hci_cp.iac_lap[1] = 0x8b;
1711 hci_cp.iac_lap[2] = 0x9e;
1712 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1713 hci_cp.iac_lap[4] = 0x8b;
1714 hci_cp.iac_lap[5] = 0x9e;
1716 /* General discoverable mode */
1718 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1719 hci_cp.iac_lap[1] = 0x8b;
1720 hci_cp.iac_lap[2] = 0x9e;
1723 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1724 (hci_cp.num_iac * 3) + 1, &hci_cp);
1726 scan |= SCAN_INQUIRY;
1728 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1731 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1734 update_adv_data(&req);
1736 err = hci_req_run(&req, set_discoverable_complete);
1738 mgmt_pending_remove(cmd);
1741 hci_dev_unlock(hdev);
1745 static void write_fast_connectable(struct hci_request *req, bool enable)
1747 struct hci_dev *hdev = req->hdev;
1748 struct hci_cp_write_page_scan_activity acp;
1751 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1754 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1758 type = PAGE_SCAN_TYPE_INTERLACED;
1760 /* 160 msec page scan interval */
1761 acp.interval = cpu_to_le16(0x0100);
1763 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1765 /* default 1.28 sec page scan */
1766 acp.interval = cpu_to_le16(0x0800);
1769 acp.window = cpu_to_le16(0x0012);
1771 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1772 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1773 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1776 if (hdev->page_scan_type != type)
1777 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
1780 static void set_connectable_complete(struct hci_dev *hdev, u8 status)
1782 struct pending_cmd *cmd;
1783 struct mgmt_mode *cp;
1784 bool conn_changed, discov_changed;
1786 BT_DBG("status 0x%02x", status);
1790 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1795 u8 mgmt_err = mgmt_status(status);
1796 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1802 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1804 discov_changed = false;
1806 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1808 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1812 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1814 if (conn_changed || discov_changed) {
1815 new_settings(hdev, cmd->sk);
1816 hci_update_page_scan(hdev, NULL);
1818 mgmt_update_adv_data(hdev);
1819 hci_update_background_scan(hdev);
1823 mgmt_pending_remove(cmd);
1826 hci_dev_unlock(hdev);
1829 static int set_connectable_update_settings(struct hci_dev *hdev,
1830 struct sock *sk, u8 val)
1832 bool changed = false;
1835 if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1839 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1841 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1842 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1845 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1850 hci_update_page_scan(hdev, NULL);
1851 hci_update_background_scan(hdev);
1852 return new_settings(hdev, sk);
1858 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
1861 struct mgmt_mode *cp = data;
1862 struct pending_cmd *cmd;
1863 struct hci_request req;
1867 BT_DBG("request for %s", hdev->name);
1869 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1870 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1871 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1872 MGMT_STATUS_REJECTED);
1874 if (cp->val != 0x00 && cp->val != 0x01)
1875 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1876 MGMT_STATUS_INVALID_PARAMS);
1880 if (!hdev_is_powered(hdev)) {
1881 err = set_connectable_update_settings(hdev, sk, cp->val);
1885 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1886 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
1887 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1892 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
1898 hci_req_init(&req, hdev);
1900 /* If BR/EDR is not enabled and we disable advertising as a
1901 * by-product of disabling connectable, we need to update the
1902 * advertising flags.
1904 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1906 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1907 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1909 update_adv_data(&req);
1910 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
1914 /* If we don't have any whitelist entries just
1915 * disable all scanning. If there are entries
1916 * and we had both page and inquiry scanning
1917 * enabled then fall back to only page scanning.
1918 * Otherwise no changes are needed.
1920 if (list_empty(&hdev->whitelist))
1921 scan = SCAN_DISABLED;
1922 else if (test_bit(HCI_ISCAN, &hdev->flags))
1925 goto no_scan_update;
1927 if (test_bit(HCI_ISCAN, &hdev->flags) &&
1928 hdev->discov_timeout > 0)
1929 cancel_delayed_work(&hdev->discov_off);
1932 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1936 /* If we're going from non-connectable to connectable or
1937 * vice-versa when fast connectable is enabled ensure that fast
1938 * connectable gets disabled. write_fast_connectable won't do
1939 * anything if the page scan parameters are already what they
1942 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
1943 write_fast_connectable(&req, false);
1945 /* Update the advertising parameters if necessary */
1946 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1947 enable_advertising(&req);
1949 err = hci_req_run(&req, set_connectable_complete);
1951 mgmt_pending_remove(cmd);
1952 if (err == -ENODATA)
1953 err = set_connectable_update_settings(hdev, sk,
1959 hci_dev_unlock(hdev);
1963 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
1966 struct mgmt_mode *cp = data;
1970 BT_DBG("request for %s", hdev->name);
1972 if (cp->val != 0x00 && cp->val != 0x01)
1973 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1974 MGMT_STATUS_INVALID_PARAMS);
1979 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
1981 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
1983 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
1988 err = new_settings(hdev, sk);
1991 hci_dev_unlock(hdev);
1995 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1998 struct mgmt_mode *cp = data;
1999 struct pending_cmd *cmd;
2003 BT_DBG("request for %s", hdev->name);
2005 status = mgmt_bredr_support(hdev);
2007 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2010 if (cp->val != 0x00 && cp->val != 0x01)
2011 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2012 MGMT_STATUS_INVALID_PARAMS);
2016 if (!hdev_is_powered(hdev)) {
2017 bool changed = false;
2019 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
2020 &hdev->dev_flags)) {
2021 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2025 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2030 err = new_settings(hdev, sk);
2035 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
2036 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2043 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2044 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2048 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2054 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2056 mgmt_pending_remove(cmd);
2061 hci_dev_unlock(hdev);
2065 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2067 struct mgmt_mode *cp = data;
2068 struct pending_cmd *cmd;
2072 BT_DBG("request for %s", hdev->name);
2074 status = mgmt_bredr_support(hdev);
2076 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2078 if (!lmp_ssp_capable(hdev))
2079 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2080 MGMT_STATUS_NOT_SUPPORTED);
2082 if (cp->val != 0x00 && cp->val != 0x01)
2083 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2084 MGMT_STATUS_INVALID_PARAMS);
2088 if (!hdev_is_powered(hdev)) {
2092 changed = !test_and_set_bit(HCI_SSP_ENABLED,
2095 changed = test_and_clear_bit(HCI_SSP_ENABLED,
2098 changed = test_and_clear_bit(HCI_HS_ENABLED,
2101 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2104 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2109 err = new_settings(hdev, sk);
2114 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
2115 mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
2116 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2121 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
2122 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2126 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2132 if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2133 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2134 sizeof(cp->val), &cp->val);
2136 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
2138 mgmt_pending_remove(cmd);
2143 hci_dev_unlock(hdev);
2147 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2149 struct mgmt_mode *cp = data;
2154 BT_DBG("request for %s", hdev->name);
2156 status = mgmt_bredr_support(hdev);
2158 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
2160 if (!lmp_ssp_capable(hdev))
2161 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2162 MGMT_STATUS_NOT_SUPPORTED);
2164 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2165 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2166 MGMT_STATUS_REJECTED);
2168 if (cp->val != 0x00 && cp->val != 0x01)
2169 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2170 MGMT_STATUS_INVALID_PARAMS);
2175 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2177 if (hdev_is_powered(hdev)) {
2178 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2179 MGMT_STATUS_REJECTED);
2183 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
2186 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2191 err = new_settings(hdev, sk);
2194 hci_dev_unlock(hdev);
2198 static void le_enable_complete(struct hci_dev *hdev, u8 status)
2200 struct cmd_lookup match = { NULL, hdev };
2203 u8 mgmt_err = mgmt_status(status);
2205 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2210 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2212 new_settings(hdev, match.sk);
2217 /* Make sure the controller has a good default for
2218 * advertising data. Restrict the update to when LE
2219 * has actually been enabled. During power on, the
2220 * update in powered_update_hci will take care of it.
2222 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2223 struct hci_request req;
2227 hci_req_init(&req, hdev);
2228 update_adv_data(&req);
2229 update_scan_rsp_data(&req);
2230 hci_req_run(&req, NULL);
2232 hci_update_background_scan(hdev);
2234 hci_dev_unlock(hdev);
2238 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2240 struct mgmt_mode *cp = data;
2241 struct hci_cp_write_le_host_supported hci_cp;
2242 struct pending_cmd *cmd;
2243 struct hci_request req;
2247 BT_DBG("request for %s", hdev->name);
2249 if (!lmp_le_capable(hdev))
2250 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2251 MGMT_STATUS_NOT_SUPPORTED);
2253 if (cp->val != 0x00 && cp->val != 0x01)
2254 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2255 MGMT_STATUS_INVALID_PARAMS);
2257 /* LE-only devices do not allow toggling LE on/off */
2258 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
2259 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2260 MGMT_STATUS_REJECTED);
2265 enabled = lmp_host_le_capable(hdev);
2267 if (!hdev_is_powered(hdev) || val == enabled) {
2268 bool changed = false;
2270 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2271 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2275 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2276 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
2280 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2285 err = new_settings(hdev, sk);
2290 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2291 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
2292 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2297 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2303 hci_req_init(&req, hdev);
2305 memset(&hci_cp, 0, sizeof(hci_cp));
2309 hci_cp.simul = 0x00;
2311 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
2312 disable_advertising(&req);
2315 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2318 err = hci_req_run(&req, le_enable_complete);
2320 mgmt_pending_remove(cmd);
2323 hci_dev_unlock(hdev);
2327 /* This is a helper function to test for pending mgmt commands that can
2328 * cause CoD or EIR HCI commands. We can only allow one such pending
2329 * mgmt command at a time since otherwise we cannot easily track what
2330 * the current values are, will be, and based on that calculate if a new
2331 * HCI command needs to be sent and if yes with what value.
2333 static bool pending_eir_or_class(struct hci_dev *hdev)
2335 struct pending_cmd *cmd;
2337 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2338 switch (cmd->opcode) {
2339 case MGMT_OP_ADD_UUID:
2340 case MGMT_OP_REMOVE_UUID:
2341 case MGMT_OP_SET_DEV_CLASS:
2342 case MGMT_OP_SET_POWERED:
2350 static const u8 bluetooth_base_uuid[] = {
2351 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2352 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2355 static u8 get_uuid_size(const u8 *uuid)
2359 if (memcmp(uuid, bluetooth_base_uuid, 12))
2362 val = get_unaligned_le32(&uuid[12]);
2369 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2371 struct pending_cmd *cmd;
2375 cmd = mgmt_pending_find(mgmt_op, hdev);
2379 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2380 hdev->dev_class, 3);
2382 mgmt_pending_remove(cmd);
2385 hci_dev_unlock(hdev);
2388 static void add_uuid_complete(struct hci_dev *hdev, u8 status)
2390 BT_DBG("status 0x%02x", status);
2392 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2395 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2397 struct mgmt_cp_add_uuid *cp = data;
2398 struct pending_cmd *cmd;
2399 struct hci_request req;
2400 struct bt_uuid *uuid;
2403 BT_DBG("request for %s", hdev->name);
2407 if (pending_eir_or_class(hdev)) {
2408 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2413 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2419 memcpy(uuid->uuid, cp->uuid, 16);
2420 uuid->svc_hint = cp->svc_hint;
2421 uuid->size = get_uuid_size(cp->uuid);
2423 list_add_tail(&uuid->list, &hdev->uuids);
2425 hci_req_init(&req, hdev);
2430 err = hci_req_run(&req, add_uuid_complete);
2432 if (err != -ENODATA)
2435 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2436 hdev->dev_class, 3);
2440 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
2449 hci_dev_unlock(hdev);
2453 static bool enable_service_cache(struct hci_dev *hdev)
2455 if (!hdev_is_powered(hdev))
2458 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2459 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2467 static void remove_uuid_complete(struct hci_dev *hdev, u8 status)
2469 BT_DBG("status 0x%02x", status);
2471 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2474 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
2477 struct mgmt_cp_remove_uuid *cp = data;
2478 struct pending_cmd *cmd;
2479 struct bt_uuid *match, *tmp;
2480 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
2481 struct hci_request req;
2484 BT_DBG("request for %s", hdev->name);
2488 if (pending_eir_or_class(hdev)) {
2489 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2494 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
2495 hci_uuids_clear(hdev);
2497 if (enable_service_cache(hdev)) {
2498 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2499 0, hdev->dev_class, 3);
2508 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2509 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2512 list_del(&match->list);
2518 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2519 MGMT_STATUS_INVALID_PARAMS);
2524 hci_req_init(&req, hdev);
2529 err = hci_req_run(&req, remove_uuid_complete);
2531 if (err != -ENODATA)
2534 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2535 hdev->dev_class, 3);
2539 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
2548 hci_dev_unlock(hdev);
2552 static void set_class_complete(struct hci_dev *hdev, u8 status)
2554 BT_DBG("status 0x%02x", status);
2556 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2559 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
2562 struct mgmt_cp_set_dev_class *cp = data;
2563 struct pending_cmd *cmd;
2564 struct hci_request req;
2567 BT_DBG("request for %s", hdev->name);
2569 if (!lmp_bredr_capable(hdev))
2570 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2571 MGMT_STATUS_NOT_SUPPORTED);
2575 if (pending_eir_or_class(hdev)) {
2576 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2581 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2582 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2583 MGMT_STATUS_INVALID_PARAMS);
2587 hdev->major_class = cp->major;
2588 hdev->minor_class = cp->minor;
2590 if (!hdev_is_powered(hdev)) {
2591 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2592 hdev->dev_class, 3);
2596 hci_req_init(&req, hdev);
2598 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
2599 hci_dev_unlock(hdev);
2600 cancel_delayed_work_sync(&hdev->service_cache);
2607 err = hci_req_run(&req, set_class_complete);
2609 if (err != -ENODATA)
2612 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2613 hdev->dev_class, 3);
2617 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
2626 hci_dev_unlock(hdev);
2630 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
2633 struct mgmt_cp_load_link_keys *cp = data;
2634 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2635 sizeof(struct mgmt_link_key_info));
2636 u16 key_count, expected_len;
2640 BT_DBG("request for %s", hdev->name);
2642 if (!lmp_bredr_capable(hdev))
2643 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2644 MGMT_STATUS_NOT_SUPPORTED);
2646 key_count = __le16_to_cpu(cp->key_count);
2647 if (key_count > max_key_count) {
2648 BT_ERR("load_link_keys: too big key_count value %u",
2650 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2651 MGMT_STATUS_INVALID_PARAMS);
2654 expected_len = sizeof(*cp) + key_count *
2655 sizeof(struct mgmt_link_key_info);
2656 if (expected_len != len) {
2657 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2659 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2660 MGMT_STATUS_INVALID_PARAMS);
2663 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2664 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2665 MGMT_STATUS_INVALID_PARAMS);
2667 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
2670 for (i = 0; i < key_count; i++) {
2671 struct mgmt_link_key_info *key = &cp->keys[i];
2673 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
2674 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2675 MGMT_STATUS_INVALID_PARAMS);
2680 hci_link_keys_clear(hdev);
2683 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2686 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2690 new_settings(hdev, NULL);
2692 for (i = 0; i < key_count; i++) {
2693 struct mgmt_link_key_info *key = &cp->keys[i];
2695 /* Always ignore debug keys and require a new pairing if
2696 * the user wants to use them.
2698 if (key->type == HCI_LK_DEBUG_COMBINATION)
2701 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2702 key->type, key->pin_len, NULL);
2705 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
2707 hci_dev_unlock(hdev);
2712 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
2713 u8 addr_type, struct sock *skip_sk)
2715 struct mgmt_ev_device_unpaired ev;
2717 bacpy(&ev.addr.bdaddr, bdaddr);
2718 ev.addr.type = addr_type;
2720 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
2724 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
2727 struct mgmt_cp_unpair_device *cp = data;
2728 struct mgmt_rp_unpair_device rp;
2729 struct hci_cp_disconnect dc;
2730 struct pending_cmd *cmd;
2731 struct hci_conn *conn;
2734 memset(&rp, 0, sizeof(rp));
2735 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2736 rp.addr.type = cp->addr.type;
2738 if (!bdaddr_type_is_valid(cp->addr.type))
2739 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2740 MGMT_STATUS_INVALID_PARAMS,
2743 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2744 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2745 MGMT_STATUS_INVALID_PARAMS,
2750 if (!hdev_is_powered(hdev)) {
2751 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2752 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2756 if (cp->addr.type == BDADDR_BREDR) {
2757 /* If disconnection is requested, then look up the
2758 * connection. If the remote device is connected, it
2759 * will be later used to terminate the link.
2761 * Setting it to NULL explicitly will cause no
2762 * termination of the link.
2765 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2770 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
2774 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2777 /* Defer clearing up the connection parameters
2778 * until closing to give a chance of keeping
2779 * them if a repairing happens.
2781 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2783 /* If disconnection is not requested, then
2784 * clear the connection variable so that the
2785 * link is not terminated.
2787 if (!cp->disconnect)
2791 if (cp->addr.type == BDADDR_LE_PUBLIC)
2792 addr_type = ADDR_LE_DEV_PUBLIC;
2794 addr_type = ADDR_LE_DEV_RANDOM;
2796 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2798 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2802 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2803 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
2807 /* If the connection variable is set, then termination of the
2808 * link is requested.
2811 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2813 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
2817 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
2824 cmd->cmd_complete = addr_cmd_complete;
2826 dc.handle = cpu_to_le16(conn->handle);
2827 dc.reason = 0x13; /* Remote User Terminated Connection */
2828 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2830 mgmt_pending_remove(cmd);
2833 hci_dev_unlock(hdev);
2837 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
2840 struct mgmt_cp_disconnect *cp = data;
2841 struct mgmt_rp_disconnect rp;
2842 struct pending_cmd *cmd;
2843 struct hci_conn *conn;
2848 memset(&rp, 0, sizeof(rp));
2849 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2850 rp.addr.type = cp->addr.type;
2852 if (!bdaddr_type_is_valid(cp->addr.type))
2853 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2854 MGMT_STATUS_INVALID_PARAMS,
2859 if (!test_bit(HCI_UP, &hdev->flags)) {
2860 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2861 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
2865 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
2866 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2867 MGMT_STATUS_BUSY, &rp, sizeof(rp));
2871 if (cp->addr.type == BDADDR_BREDR)
2872 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2875 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
2877 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2878 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2879 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
2883 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
2889 cmd->cmd_complete = generic_cmd_complete;
2891 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
2893 mgmt_pending_remove(cmd);
2896 hci_dev_unlock(hdev);
2900 static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
2902 switch (link_type) {
2904 switch (addr_type) {
2905 case ADDR_LE_DEV_PUBLIC:
2906 return BDADDR_LE_PUBLIC;
2909 /* Fallback to LE Random address type */
2910 return BDADDR_LE_RANDOM;
2914 /* Fallback to BR/EDR type */
2915 return BDADDR_BREDR;
2919 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2922 struct mgmt_rp_get_connections *rp;
2932 if (!hdev_is_powered(hdev)) {
2933 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2934 MGMT_STATUS_NOT_POWERED);
2939 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2940 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2944 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2945 rp = kmalloc(rp_len, GFP_KERNEL);
2952 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2953 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2955 bacpy(&rp->addr[i].bdaddr, &c->dst);
2956 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
2957 if (c->type == SCO_LINK || c->type == ESCO_LINK)
2962 rp->conn_count = cpu_to_le16(i);
2964 /* Recalculate length in case of filtered SCO connections, etc */
2965 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2967 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2973 hci_dev_unlock(hdev);
2977 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
2978 struct mgmt_cp_pin_code_neg_reply *cp)
2980 struct pending_cmd *cmd;
2983 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
2988 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2989 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
2991 mgmt_pending_remove(cmd);
2996 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
2999 struct hci_conn *conn;
3000 struct mgmt_cp_pin_code_reply *cp = data;
3001 struct hci_cp_pin_code_reply reply;
3002 struct pending_cmd *cmd;
3009 if (!hdev_is_powered(hdev)) {
3010 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3011 MGMT_STATUS_NOT_POWERED);
3015 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
3017 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3018 MGMT_STATUS_NOT_CONNECTED);
3022 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
3023 struct mgmt_cp_pin_code_neg_reply ncp;
3025 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
3027 BT_ERR("PIN code is not 16 bytes long");
3029 err = send_pin_code_neg_reply(sk, hdev, &ncp);
3031 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3032 MGMT_STATUS_INVALID_PARAMS);
3037 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
3043 cmd->cmd_complete = addr_cmd_complete;
3045 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
3046 reply.pin_len = cp->pin_len;
3047 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
3049 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3051 mgmt_pending_remove(cmd);
3054 hci_dev_unlock(hdev);
3058 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3061 struct mgmt_cp_set_io_capability *cp = data;
3065 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3066 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3067 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3071 hdev->io_capability = cp->io_capability;
3073 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
3074 hdev->io_capability);
3076 hci_dev_unlock(hdev);
3078 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3082 static struct pending_cmd *find_pairing(struct hci_conn *conn)
3084 struct hci_dev *hdev = conn->hdev;
3085 struct pending_cmd *cmd;
3087 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
3088 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3091 if (cmd->user_data != conn)
3100 static void pairing_complete(struct pending_cmd *cmd, u8 status)
3102 struct mgmt_rp_pair_device rp;
3103 struct hci_conn *conn = cmd->user_data;
3105 bacpy(&rp.addr.bdaddr, &conn->dst);
3106 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
3108 cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3111 /* So we don't get further callbacks for this connection */
3112 conn->connect_cfm_cb = NULL;
3113 conn->security_cfm_cb = NULL;
3114 conn->disconn_cfm_cb = NULL;
3116 hci_conn_drop(conn);
3119 mgmt_pending_remove(cmd);
3121 /* The device is paired so there is no need to remove
3122 * its connection parameters anymore.
3124 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3127 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3129 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3130 struct pending_cmd *cmd;
3132 cmd = find_pairing(conn);
3134 cmd->cmd_complete(cmd, status);
3137 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3139 struct pending_cmd *cmd;
3141 BT_DBG("status %u", status);
3143 cmd = find_pairing(conn);
3145 BT_DBG("Unable to find a pending command");
3147 cmd->cmd_complete(cmd, mgmt_status(status));
3150 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
3152 struct pending_cmd *cmd;
3154 BT_DBG("status %u", status);
3159 cmd = find_pairing(conn);
3161 BT_DBG("Unable to find a pending command");
3163 cmd->cmd_complete(cmd, mgmt_status(status));
3166 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3169 struct mgmt_cp_pair_device *cp = data;
3170 struct mgmt_rp_pair_device rp;
3171 struct pending_cmd *cmd;
3172 u8 sec_level, auth_type;
3173 struct hci_conn *conn;
3178 memset(&rp, 0, sizeof(rp));
3179 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3180 rp.addr.type = cp->addr.type;
3182 if (!bdaddr_type_is_valid(cp->addr.type))
3183 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3184 MGMT_STATUS_INVALID_PARAMS,
3187 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3188 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3189 MGMT_STATUS_INVALID_PARAMS,
3194 if (!hdev_is_powered(hdev)) {
3195 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3196 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
3200 sec_level = BT_SECURITY_MEDIUM;
3201 auth_type = HCI_AT_DEDICATED_BONDING;
3203 if (cp->addr.type == BDADDR_BREDR) {
3204 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3209 /* Convert from L2CAP channel address type to HCI address type
3211 if (cp->addr.type == BDADDR_LE_PUBLIC)
3212 addr_type = ADDR_LE_DEV_PUBLIC;
3214 addr_type = ADDR_LE_DEV_RANDOM;
3216 /* When pairing a new device, it is expected to remember
3217 * this device for future connections. Adding the connection
3218 * parameter information ahead of time allows tracking
3219 * of the slave preferred values and will speed up any
3220 * further connection establishment.
3222 * If connection parameters already exist, then they
3223 * will be kept and this function does nothing.
3225 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3227 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
3228 sec_level, HCI_LE_CONN_TIMEOUT,
3235 if (PTR_ERR(conn) == -EBUSY)
3236 status = MGMT_STATUS_BUSY;
3238 status = MGMT_STATUS_CONNECT_FAILED;
3240 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3246 if (conn->connect_cfm_cb) {
3247 hci_conn_drop(conn);
3248 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3249 MGMT_STATUS_BUSY, &rp, sizeof(rp));
3253 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
3256 hci_conn_drop(conn);
3260 cmd->cmd_complete = pairing_complete;
3262 /* For LE, just connecting isn't a proof that the pairing finished */
3263 if (cp->addr.type == BDADDR_BREDR) {
3264 conn->connect_cfm_cb = pairing_complete_cb;
3265 conn->security_cfm_cb = pairing_complete_cb;
3266 conn->disconn_cfm_cb = pairing_complete_cb;
3268 conn->connect_cfm_cb = le_pairing_complete_cb;
3269 conn->security_cfm_cb = le_pairing_complete_cb;
3270 conn->disconn_cfm_cb = le_pairing_complete_cb;
3273 conn->io_capability = cp->io_cap;
3274 cmd->user_data = hci_conn_get(conn);
3276 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
3277 hci_conn_security(conn, sec_level, auth_type, true))
3278 pairing_complete(cmd, 0);
3283 hci_dev_unlock(hdev);
3287 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3290 struct mgmt_addr_info *addr = data;
3291 struct pending_cmd *cmd;
3292 struct hci_conn *conn;
3299 if (!hdev_is_powered(hdev)) {
3300 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3301 MGMT_STATUS_NOT_POWERED);
3305 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3307 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3308 MGMT_STATUS_INVALID_PARAMS);
3312 conn = cmd->user_data;
3314 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
3315 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3316 MGMT_STATUS_INVALID_PARAMS);
3320 pairing_complete(cmd, MGMT_STATUS_CANCELLED);
3322 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3323 addr, sizeof(*addr));
3325 hci_dev_unlock(hdev);
3329 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
3330 struct mgmt_addr_info *addr, u16 mgmt_op,
3331 u16 hci_op, __le32 passkey)
3333 struct pending_cmd *cmd;
3334 struct hci_conn *conn;
3339 if (!hdev_is_powered(hdev)) {
3340 err = cmd_complete(sk, hdev->id, mgmt_op,
3341 MGMT_STATUS_NOT_POWERED, addr,
3346 if (addr->type == BDADDR_BREDR)
3347 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
3349 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
3352 err = cmd_complete(sk, hdev->id, mgmt_op,
3353 MGMT_STATUS_NOT_CONNECTED, addr,
3358 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
3359 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
3361 err = cmd_complete(sk, hdev->id, mgmt_op,
3362 MGMT_STATUS_SUCCESS, addr,
3365 err = cmd_complete(sk, hdev->id, mgmt_op,
3366 MGMT_STATUS_FAILED, addr,
3372 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
3378 cmd->cmd_complete = addr_cmd_complete;
3380 /* Continue with pairing via HCI */
3381 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3382 struct hci_cp_user_passkey_reply cp;
3384 bacpy(&cp.bdaddr, &addr->bdaddr);
3385 cp.passkey = passkey;
3386 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3388 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3392 mgmt_pending_remove(cmd);
3395 hci_dev_unlock(hdev);
3399 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3400 void *data, u16 len)
3402 struct mgmt_cp_pin_code_neg_reply *cp = data;
3406 return user_pairing_resp(sk, hdev, &cp->addr,
3407 MGMT_OP_PIN_CODE_NEG_REPLY,
3408 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3411 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3414 struct mgmt_cp_user_confirm_reply *cp = data;
3418 if (len != sizeof(*cp))
3419 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3420 MGMT_STATUS_INVALID_PARAMS);
3422 return user_pairing_resp(sk, hdev, &cp->addr,
3423 MGMT_OP_USER_CONFIRM_REPLY,
3424 HCI_OP_USER_CONFIRM_REPLY, 0);
3427 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
3428 void *data, u16 len)
3430 struct mgmt_cp_user_confirm_neg_reply *cp = data;
3434 return user_pairing_resp(sk, hdev, &cp->addr,
3435 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3436 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
3439 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3442 struct mgmt_cp_user_passkey_reply *cp = data;
3446 return user_pairing_resp(sk, hdev, &cp->addr,
3447 MGMT_OP_USER_PASSKEY_REPLY,
3448 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
3451 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
3452 void *data, u16 len)
3454 struct mgmt_cp_user_passkey_neg_reply *cp = data;
3458 return user_pairing_resp(sk, hdev, &cp->addr,
3459 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3460 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
3463 static void update_name(struct hci_request *req)
3465 struct hci_dev *hdev = req->hdev;
3466 struct hci_cp_write_local_name cp;
3468 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3470 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
3473 static void set_name_complete(struct hci_dev *hdev, u8 status)
3475 struct mgmt_cp_set_local_name *cp;
3476 struct pending_cmd *cmd;
3478 BT_DBG("status 0x%02x", status);
3482 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3489 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3490 mgmt_status(status));
3492 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3495 mgmt_pending_remove(cmd);
3498 hci_dev_unlock(hdev);
3501 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
3504 struct mgmt_cp_set_local_name *cp = data;
3505 struct pending_cmd *cmd;
3506 struct hci_request req;
3513 /* If the old values are the same as the new ones just return a
3514 * direct command complete event.
3516 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3517 !memcmp(hdev->short_name, cp->short_name,
3518 sizeof(hdev->short_name))) {
3519 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3524 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
3526 if (!hdev_is_powered(hdev)) {
3527 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3529 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3534 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
3540 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
3546 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3548 hci_req_init(&req, hdev);
3550 if (lmp_bredr_capable(hdev)) {
3555 /* The name is stored in the scan response data and so
3556 * no need to udpate the advertising data here.
3558 if (lmp_le_capable(hdev))
3559 update_scan_rsp_data(&req);
3561 err = hci_req_run(&req, set_name_complete);
3563 mgmt_pending_remove(cmd);
3566 hci_dev_unlock(hdev);
3570 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
3571 void *data, u16 data_len)
3573 struct pending_cmd *cmd;
3576 BT_DBG("%s", hdev->name);
3580 if (!hdev_is_powered(hdev)) {
3581 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3582 MGMT_STATUS_NOT_POWERED);
3586 if (!lmp_ssp_capable(hdev)) {
3587 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3588 MGMT_STATUS_NOT_SUPPORTED);
3592 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
3593 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3598 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
3604 if (bredr_sc_enabled(hdev))
3605 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3608 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3611 mgmt_pending_remove(cmd);
3614 hci_dev_unlock(hdev);
3618 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3619 void *data, u16 len)
3623 BT_DBG("%s ", hdev->name);
3627 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3628 struct mgmt_cp_add_remote_oob_data *cp = data;
3631 if (cp->addr.type != BDADDR_BREDR) {
3632 err = cmd_complete(sk, hdev->id,
3633 MGMT_OP_ADD_REMOTE_OOB_DATA,
3634 MGMT_STATUS_INVALID_PARAMS,
3635 &cp->addr, sizeof(cp->addr));
3639 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3640 cp->addr.type, cp->hash,
3641 cp->rand, NULL, NULL);
3643 status = MGMT_STATUS_FAILED;
3645 status = MGMT_STATUS_SUCCESS;
3647 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3648 status, &cp->addr, sizeof(cp->addr));
3649 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3650 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
3651 u8 *rand192, *hash192;
3654 if (cp->addr.type != BDADDR_BREDR) {
3655 err = cmd_complete(sk, hdev->id,
3656 MGMT_OP_ADD_REMOTE_OOB_DATA,
3657 MGMT_STATUS_INVALID_PARAMS,
3658 &cp->addr, sizeof(cp->addr));
3662 if (bdaddr_type_is_le(cp->addr.type)) {
3666 rand192 = cp->rand192;
3667 hash192 = cp->hash192;
3670 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
3671 cp->addr.type, hash192, rand192,
3672 cp->hash256, cp->rand256);
3674 status = MGMT_STATUS_FAILED;
3676 status = MGMT_STATUS_SUCCESS;
3678 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3679 status, &cp->addr, sizeof(cp->addr));
3681 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3682 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3683 MGMT_STATUS_INVALID_PARAMS);
3687 hci_dev_unlock(hdev);
3691 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
3692 void *data, u16 len)
3694 struct mgmt_cp_remove_remote_oob_data *cp = data;
3698 BT_DBG("%s", hdev->name);
3700 if (cp->addr.type != BDADDR_BREDR)
3701 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3702 MGMT_STATUS_INVALID_PARAMS,
3703 &cp->addr, sizeof(cp->addr));
3707 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3708 hci_remote_oob_data_clear(hdev);
3709 status = MGMT_STATUS_SUCCESS;
3713 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
3715 status = MGMT_STATUS_INVALID_PARAMS;
3717 status = MGMT_STATUS_SUCCESS;
3720 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3721 status, &cp->addr, sizeof(cp->addr));
3723 hci_dev_unlock(hdev);
3727 static bool trigger_discovery(struct hci_request *req, u8 *status)
3729 struct hci_dev *hdev = req->hdev;
3730 struct hci_cp_le_set_scan_param param_cp;
3731 struct hci_cp_le_set_scan_enable enable_cp;
3732 struct hci_cp_inquiry inq_cp;
3733 /* General inquiry access code (GIAC) */
3734 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3738 switch (hdev->discovery.type) {
3739 case DISCOV_TYPE_BREDR:
3740 *status = mgmt_bredr_support(hdev);
3744 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3745 *status = MGMT_STATUS_BUSY;
3749 hci_inquiry_cache_flush(hdev);
3751 memset(&inq_cp, 0, sizeof(inq_cp));
3752 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3753 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3754 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3757 case DISCOV_TYPE_LE:
3758 case DISCOV_TYPE_INTERLEAVED:
3759 *status = mgmt_le_support(hdev);
3763 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3764 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3765 *status = MGMT_STATUS_NOT_SUPPORTED;
3769 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3770 /* Don't let discovery abort an outgoing
3771 * connection attempt that's using directed
3774 if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3776 *status = MGMT_STATUS_REJECTED;
3780 disable_advertising(req);
3783 /* If controller is scanning, it means the background scanning
3784 * is running. Thus, we should temporarily stop it in order to
3785 * set the discovery scanning parameters.
3787 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3788 hci_req_add_le_scan_disable(req);
3790 memset(¶m_cp, 0, sizeof(param_cp));
3792 /* All active scans will be done with either a resolvable
3793 * private address (when privacy feature has been enabled)
3794 * or unresolvable private address.
3796 err = hci_update_random_address(req, true, &own_addr_type);
3798 *status = MGMT_STATUS_FAILED;
3802 param_cp.type = LE_SCAN_ACTIVE;
3803 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3804 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3805 param_cp.own_address_type = own_addr_type;
3806 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3809 memset(&enable_cp, 0, sizeof(enable_cp));
3810 enable_cp.enable = LE_SCAN_ENABLE;
3811 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3812 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3817 *status = MGMT_STATUS_INVALID_PARAMS;
3824 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
3826 struct pending_cmd *cmd;
3827 unsigned long timeout;
3829 BT_DBG("status %d", status);
3833 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
3835 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3838 cmd->cmd_complete(cmd, mgmt_status(status));
3839 mgmt_pending_remove(cmd);
3843 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3847 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3849 switch (hdev->discovery.type) {
3850 case DISCOV_TYPE_LE:
3851 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3853 case DISCOV_TYPE_INTERLEAVED:
3854 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3856 case DISCOV_TYPE_BREDR:
3860 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
3866 queue_delayed_work(hdev->workqueue,
3867 &hdev->le_scan_disable, timeout);
3870 hci_dev_unlock(hdev);
3873 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
3874 void *data, u16 len)
3876 struct mgmt_cp_start_discovery *cp = data;
3877 struct pending_cmd *cmd;
3878 struct hci_request req;
3882 BT_DBG("%s", hdev->name);
3886 if (!hdev_is_powered(hdev)) {
3887 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3888 MGMT_STATUS_NOT_POWERED,
3889 &cp->type, sizeof(cp->type));
3893 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3894 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3895 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3896 MGMT_STATUS_BUSY, &cp->type,
3901 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
3907 cmd->cmd_complete = generic_cmd_complete;
3909 /* Clear the discovery filter first to free any previously
3910 * allocated memory for the UUID list.
3912 hci_discovery_filter_clear(hdev);
3914 hdev->discovery.type = cp->type;
3916 hci_req_init(&req, hdev);
3918 if (!trigger_discovery(&req, &status)) {
3919 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3920 status, &cp->type, sizeof(cp->type));
3921 mgmt_pending_remove(cmd);
3925 err = hci_req_run(&req, start_discovery_complete);
3927 mgmt_pending_remove(cmd);
3931 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
3934 hci_dev_unlock(hdev);
3938 static void service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
3940 cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param, 1);
3943 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
3944 void *data, u16 len)
3946 struct mgmt_cp_start_service_discovery *cp = data;
3947 struct pending_cmd *cmd;
3948 struct hci_request req;
3949 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
3950 u16 uuid_count, expected_len;
3954 BT_DBG("%s", hdev->name);
3958 if (!hdev_is_powered(hdev)) {
3959 err = cmd_complete(sk, hdev->id,
3960 MGMT_OP_START_SERVICE_DISCOVERY,
3961 MGMT_STATUS_NOT_POWERED,
3962 &cp->type, sizeof(cp->type));
3966 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3967 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
3968 err = cmd_complete(sk, hdev->id,
3969 MGMT_OP_START_SERVICE_DISCOVERY,
3970 MGMT_STATUS_BUSY, &cp->type,
3975 uuid_count = __le16_to_cpu(cp->uuid_count);
3976 if (uuid_count > max_uuid_count) {
3977 BT_ERR("service_discovery: too big uuid_count value %u",
3979 err = cmd_complete(sk, hdev->id,
3980 MGMT_OP_START_SERVICE_DISCOVERY,
3981 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3986 expected_len = sizeof(*cp) + uuid_count * 16;
3987 if (expected_len != len) {
3988 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
3990 err = cmd_complete(sk, hdev->id,
3991 MGMT_OP_START_SERVICE_DISCOVERY,
3992 MGMT_STATUS_INVALID_PARAMS, &cp->type,
3997 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
4004 cmd->cmd_complete = service_discovery_cmd_complete;
4006 /* Clear the discovery filter first to free any previously
4007 * allocated memory for the UUID list.
4009 hci_discovery_filter_clear(hdev);
4011 hdev->discovery.type = cp->type;
4012 hdev->discovery.rssi = cp->rssi;
4013 hdev->discovery.uuid_count = uuid_count;
4015 if (uuid_count > 0) {
4016 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4018 if (!hdev->discovery.uuids) {
4019 err = cmd_complete(sk, hdev->id,
4020 MGMT_OP_START_SERVICE_DISCOVERY,
4022 &cp->type, sizeof(cp->type));
4023 mgmt_pending_remove(cmd);
4028 hci_req_init(&req, hdev);
4030 if (!trigger_discovery(&req, &status)) {
4031 err = cmd_complete(sk, hdev->id,
4032 MGMT_OP_START_SERVICE_DISCOVERY,
4033 status, &cp->type, sizeof(cp->type));
4034 mgmt_pending_remove(cmd);
4038 err = hci_req_run(&req, start_discovery_complete);
4040 mgmt_pending_remove(cmd);
4044 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
4047 hci_dev_unlock(hdev);
4051 static void stop_discovery_complete(struct hci_dev *hdev, u8 status)
4053 struct pending_cmd *cmd;
4055 BT_DBG("status %d", status);
4059 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4061 cmd->cmd_complete(cmd, mgmt_status(status));
4062 mgmt_pending_remove(cmd);
4066 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4068 hci_dev_unlock(hdev);
4071 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
4074 struct mgmt_cp_stop_discovery *mgmt_cp = data;
4075 struct pending_cmd *cmd;
4076 struct hci_request req;
4079 BT_DBG("%s", hdev->name);
4083 if (!hci_discovery_active(hdev)) {
4084 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4085 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4086 sizeof(mgmt_cp->type));
4090 if (hdev->discovery.type != mgmt_cp->type) {
4091 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4092 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4093 sizeof(mgmt_cp->type));
4097 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
4103 cmd->cmd_complete = generic_cmd_complete;
4105 hci_req_init(&req, hdev);
4107 hci_stop_discovery(&req);
4109 err = hci_req_run(&req, stop_discovery_complete);
4111 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
4115 mgmt_pending_remove(cmd);
4117 /* If no HCI commands were sent we're done */
4118 if (err == -ENODATA) {
4119 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4120 &mgmt_cp->type, sizeof(mgmt_cp->type));
4121 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4125 hci_dev_unlock(hdev);
4129 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
4132 struct mgmt_cp_confirm_name *cp = data;
4133 struct inquiry_entry *e;
4136 BT_DBG("%s", hdev->name);
4140 if (!hci_discovery_active(hdev)) {
4141 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4142 MGMT_STATUS_FAILED, &cp->addr,
4147 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
4149 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4150 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4155 if (cp->name_known) {
4156 e->name_state = NAME_KNOWN;
4159 e->name_state = NAME_NEEDED;
4160 hci_inquiry_cache_update_resolve(hdev, e);
4163 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4167 hci_dev_unlock(hdev);
4171 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
4174 struct mgmt_cp_block_device *cp = data;
4178 BT_DBG("%s", hdev->name);
4180 if (!bdaddr_type_is_valid(cp->addr.type))
4181 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4182 MGMT_STATUS_INVALID_PARAMS,
4183 &cp->addr, sizeof(cp->addr));
4187 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4190 status = MGMT_STATUS_FAILED;
4194 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4196 status = MGMT_STATUS_SUCCESS;
4199 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4200 &cp->addr, sizeof(cp->addr));
4202 hci_dev_unlock(hdev);
4207 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
4210 struct mgmt_cp_unblock_device *cp = data;
4214 BT_DBG("%s", hdev->name);
4216 if (!bdaddr_type_is_valid(cp->addr.type))
4217 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4218 MGMT_STATUS_INVALID_PARAMS,
4219 &cp->addr, sizeof(cp->addr));
4223 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4226 status = MGMT_STATUS_INVALID_PARAMS;
4230 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4232 status = MGMT_STATUS_SUCCESS;
4235 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4236 &cp->addr, sizeof(cp->addr));
4238 hci_dev_unlock(hdev);
4243 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4246 struct mgmt_cp_set_device_id *cp = data;
4247 struct hci_request req;
4251 BT_DBG("%s", hdev->name);
4253 source = __le16_to_cpu(cp->source);
4255 if (source > 0x0002)
4256 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4257 MGMT_STATUS_INVALID_PARAMS);
4261 hdev->devid_source = source;
4262 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4263 hdev->devid_product = __le16_to_cpu(cp->product);
4264 hdev->devid_version = __le16_to_cpu(cp->version);
4266 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4268 hci_req_init(&req, hdev);
4270 hci_req_run(&req, NULL);
4272 hci_dev_unlock(hdev);
4277 static void set_advertising_complete(struct hci_dev *hdev, u8 status)
4279 struct cmd_lookup match = { NULL, hdev };
4282 u8 mgmt_err = mgmt_status(status);
4284 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4285 cmd_status_rsp, &mgmt_err);
4289 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4290 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4292 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4294 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4297 new_settings(hdev, match.sk);
4303 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4306 struct mgmt_mode *cp = data;
4307 struct pending_cmd *cmd;
4308 struct hci_request req;
4309 u8 val, enabled, status;
4312 BT_DBG("request for %s", hdev->name);
4314 status = mgmt_le_support(hdev);
4316 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4319 if (cp->val != 0x00 && cp->val != 0x01)
4320 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4321 MGMT_STATUS_INVALID_PARAMS);
4326 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4328 /* The following conditions are ones which mean that we should
4329 * not do any HCI communication but directly send a mgmt
4330 * response to user space (after toggling the flag if
4333 if (!hdev_is_powered(hdev) || val == enabled ||
4334 hci_conn_num(hdev, LE_LINK) > 0 ||
4335 (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4336 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4337 bool changed = false;
4339 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4340 change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4344 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4349 err = new_settings(hdev, sk);
4354 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4355 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4356 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4361 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4367 hci_req_init(&req, hdev);
4370 enable_advertising(&req);
4372 disable_advertising(&req);
4374 err = hci_req_run(&req, set_advertising_complete);
4376 mgmt_pending_remove(cmd);
4379 hci_dev_unlock(hdev);
4383 static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4384 void *data, u16 len)
4386 struct mgmt_cp_set_static_address *cp = data;
4389 BT_DBG("%s", hdev->name);
4391 if (!lmp_le_capable(hdev))
4392 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4393 MGMT_STATUS_NOT_SUPPORTED);
4395 if (hdev_is_powered(hdev))
4396 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4397 MGMT_STATUS_REJECTED);
4399 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4400 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4401 return cmd_status(sk, hdev->id,
4402 MGMT_OP_SET_STATIC_ADDRESS,
4403 MGMT_STATUS_INVALID_PARAMS);
4405 /* Two most significant bits shall be set */
4406 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4407 return cmd_status(sk, hdev->id,
4408 MGMT_OP_SET_STATIC_ADDRESS,
4409 MGMT_STATUS_INVALID_PARAMS);
4414 bacpy(&hdev->static_addr, &cp->bdaddr);
4416 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4418 hci_dev_unlock(hdev);
4423 static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4424 void *data, u16 len)
4426 struct mgmt_cp_set_scan_params *cp = data;
4427 __u16 interval, window;
4430 BT_DBG("%s", hdev->name);
4432 if (!lmp_le_capable(hdev))
4433 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4434 MGMT_STATUS_NOT_SUPPORTED);
4436 interval = __le16_to_cpu(cp->interval);
4438 if (interval < 0x0004 || interval > 0x4000)
4439 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4440 MGMT_STATUS_INVALID_PARAMS);
4442 window = __le16_to_cpu(cp->window);
4444 if (window < 0x0004 || window > 0x4000)
4445 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4446 MGMT_STATUS_INVALID_PARAMS);
4448 if (window > interval)
4449 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4450 MGMT_STATUS_INVALID_PARAMS);
4454 hdev->le_scan_interval = interval;
4455 hdev->le_scan_window = window;
4457 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4459 /* If background scan is running, restart it so new parameters are
4462 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4463 hdev->discovery.state == DISCOVERY_STOPPED) {
4464 struct hci_request req;
4466 hci_req_init(&req, hdev);
4468 hci_req_add_le_scan_disable(&req);
4469 hci_req_add_le_passive_scan(&req);
4471 hci_req_run(&req, NULL);
4474 hci_dev_unlock(hdev);
4479 static void fast_connectable_complete(struct hci_dev *hdev, u8 status)
4481 struct pending_cmd *cmd;
4483 BT_DBG("status 0x%02x", status);
4487 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4492 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4493 mgmt_status(status));
4495 struct mgmt_mode *cp = cmd->param;
4498 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4500 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4502 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4503 new_settings(hdev, cmd->sk);
4506 mgmt_pending_remove(cmd);
4509 hci_dev_unlock(hdev);
4512 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
4513 void *data, u16 len)
4515 struct mgmt_mode *cp = data;
4516 struct pending_cmd *cmd;
4517 struct hci_request req;
4520 BT_DBG("%s", hdev->name);
4522 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4523 hdev->hci_ver < BLUETOOTH_VER_1_2)
4524 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4525 MGMT_STATUS_NOT_SUPPORTED);
4527 if (cp->val != 0x00 && cp->val != 0x01)
4528 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4529 MGMT_STATUS_INVALID_PARAMS);
4531 if (!hdev_is_powered(hdev))
4532 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4533 MGMT_STATUS_NOT_POWERED);
4535 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
4536 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4537 MGMT_STATUS_REJECTED);
4541 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4542 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4547 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4548 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4553 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4560 hci_req_init(&req, hdev);
4562 write_fast_connectable(&req, cp->val);
4564 err = hci_req_run(&req, fast_connectable_complete);
4566 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4567 MGMT_STATUS_FAILED);
4568 mgmt_pending_remove(cmd);
4572 hci_dev_unlock(hdev);
4577 static void set_bredr_complete(struct hci_dev *hdev, u8 status)
4579 struct pending_cmd *cmd;
4581 BT_DBG("status 0x%02x", status);
4585 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4590 u8 mgmt_err = mgmt_status(status);
4592 /* We need to restore the flag if related HCI commands
4595 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4597 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4599 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4600 new_settings(hdev, cmd->sk);
4603 mgmt_pending_remove(cmd);
4606 hci_dev_unlock(hdev);
4609 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4611 struct mgmt_mode *cp = data;
4612 struct pending_cmd *cmd;
4613 struct hci_request req;
4616 BT_DBG("request for %s", hdev->name);
4618 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4619 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4620 MGMT_STATUS_NOT_SUPPORTED);
4622 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4623 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4624 MGMT_STATUS_REJECTED);
4626 if (cp->val != 0x00 && cp->val != 0x01)
4627 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4628 MGMT_STATUS_INVALID_PARAMS);
4632 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4633 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4637 if (!hdev_is_powered(hdev)) {
4639 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4640 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4641 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4642 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4643 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4646 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4648 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4652 err = new_settings(hdev, sk);
4656 /* Reject disabling when powered on */
4658 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4659 MGMT_STATUS_REJECTED);
4663 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4664 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4669 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4675 /* We need to flip the bit already here so that update_adv_data
4676 * generates the correct flags.
4678 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4680 hci_req_init(&req, hdev);
4682 write_fast_connectable(&req, false);
4683 hci_update_page_scan(hdev, &req);
4685 /* Since only the advertising data flags will change, there
4686 * is no need to update the scan response data.
4688 update_adv_data(&req);
4690 err = hci_req_run(&req, set_bredr_complete);
4692 mgmt_pending_remove(cmd);
4695 hci_dev_unlock(hdev);
4699 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4700 void *data, u16 len)
4702 struct mgmt_mode *cp = data;
4703 struct pending_cmd *cmd;
4707 BT_DBG("request for %s", hdev->name);
4709 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
4710 !lmp_sc_capable(hdev) && !test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
4711 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4712 MGMT_STATUS_NOT_SUPPORTED);
4714 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4715 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4716 MGMT_STATUS_INVALID_PARAMS);
4720 if (!hdev_is_powered(hdev) ||
4721 (!lmp_sc_capable(hdev) &&
4722 !test_bit(HCI_FORCE_SC, &hdev->dbg_flags)) ||
4723 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4727 changed = !test_and_set_bit(HCI_SC_ENABLED,
4729 if (cp->val == 0x02)
4730 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4732 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4734 changed = test_and_clear_bit(HCI_SC_ENABLED,
4736 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4739 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4744 err = new_settings(hdev, sk);
4749 if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4750 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4757 if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4758 (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4759 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4763 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4769 err = hci_send_cmd(hdev, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4771 mgmt_pending_remove(cmd);
4775 if (cp->val == 0x02)
4776 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4778 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4781 hci_dev_unlock(hdev);
4785 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4786 void *data, u16 len)
4788 struct mgmt_mode *cp = data;
4789 bool changed, use_changed;
4792 BT_DBG("request for %s", hdev->name);
4794 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4795 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4796 MGMT_STATUS_INVALID_PARAMS);
4801 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4804 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4807 if (cp->val == 0x02)
4808 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4811 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4814 if (hdev_is_powered(hdev) && use_changed &&
4815 test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4816 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4817 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4818 sizeof(mode), &mode);
4821 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4826 err = new_settings(hdev, sk);
4829 hci_dev_unlock(hdev);
4833 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4836 struct mgmt_cp_set_privacy *cp = cp_data;
4840 BT_DBG("request for %s", hdev->name);
4842 if (!lmp_le_capable(hdev))
4843 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4844 MGMT_STATUS_NOT_SUPPORTED);
4846 if (cp->privacy != 0x00 && cp->privacy != 0x01)
4847 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4848 MGMT_STATUS_INVALID_PARAMS);
4850 if (hdev_is_powered(hdev))
4851 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4852 MGMT_STATUS_REJECTED);
4856 /* If user space supports this command it is also expected to
4857 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4859 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4862 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
4863 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
4864 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4866 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
4867 memset(hdev->irk, 0, sizeof(hdev->irk));
4868 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
4871 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
4876 err = new_settings(hdev, sk);
4879 hci_dev_unlock(hdev);
4883 static bool irk_is_valid(struct mgmt_irk_info *irk)
4885 switch (irk->addr.type) {
4886 case BDADDR_LE_PUBLIC:
4889 case BDADDR_LE_RANDOM:
4890 /* Two most significant bits shall be set */
4891 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4899 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4902 struct mgmt_cp_load_irks *cp = cp_data;
4903 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
4904 sizeof(struct mgmt_irk_info));
4905 u16 irk_count, expected_len;
4908 BT_DBG("request for %s", hdev->name);
4910 if (!lmp_le_capable(hdev))
4911 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4912 MGMT_STATUS_NOT_SUPPORTED);
4914 irk_count = __le16_to_cpu(cp->irk_count);
4915 if (irk_count > max_irk_count) {
4916 BT_ERR("load_irks: too big irk_count value %u", irk_count);
4917 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4918 MGMT_STATUS_INVALID_PARAMS);
4921 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
4922 if (expected_len != len) {
4923 BT_ERR("load_irks: expected %u bytes, got %u bytes",
4925 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
4926 MGMT_STATUS_INVALID_PARAMS);
4929 BT_DBG("%s irk_count %u", hdev->name, irk_count);
4931 for (i = 0; i < irk_count; i++) {
4932 struct mgmt_irk_info *key = &cp->irks[i];
4934 if (!irk_is_valid(key))
4935 return cmd_status(sk, hdev->id,
4937 MGMT_STATUS_INVALID_PARAMS);
4942 hci_smp_irks_clear(hdev);
4944 for (i = 0; i < irk_count; i++) {
4945 struct mgmt_irk_info *irk = &cp->irks[i];
4948 if (irk->addr.type == BDADDR_LE_PUBLIC)
4949 addr_type = ADDR_LE_DEV_PUBLIC;
4951 addr_type = ADDR_LE_DEV_RANDOM;
4953 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
4957 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
4959 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
4961 hci_dev_unlock(hdev);
4966 static bool ltk_is_valid(struct mgmt_ltk_info *key)
4968 if (key->master != 0x00 && key->master != 0x01)
4971 switch (key->addr.type) {
4972 case BDADDR_LE_PUBLIC:
4975 case BDADDR_LE_RANDOM:
4976 /* Two most significant bits shall be set */
4977 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
4985 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
4986 void *cp_data, u16 len)
4988 struct mgmt_cp_load_long_term_keys *cp = cp_data;
4989 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
4990 sizeof(struct mgmt_ltk_info));
4991 u16 key_count, expected_len;
4994 BT_DBG("request for %s", hdev->name);
4996 if (!lmp_le_capable(hdev))
4997 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
4998 MGMT_STATUS_NOT_SUPPORTED);
5000 key_count = __le16_to_cpu(cp->key_count);
5001 if (key_count > max_key_count) {
5002 BT_ERR("load_ltks: too big key_count value %u", key_count);
5003 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5004 MGMT_STATUS_INVALID_PARAMS);
5007 expected_len = sizeof(*cp) + key_count *
5008 sizeof(struct mgmt_ltk_info);
5009 if (expected_len != len) {
5010 BT_ERR("load_keys: expected %u bytes, got %u bytes",
5012 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5013 MGMT_STATUS_INVALID_PARAMS);
5016 BT_DBG("%s key_count %u", hdev->name, key_count);
5018 for (i = 0; i < key_count; i++) {
5019 struct mgmt_ltk_info *key = &cp->keys[i];
5021 if (!ltk_is_valid(key))
5022 return cmd_status(sk, hdev->id,
5023 MGMT_OP_LOAD_LONG_TERM_KEYS,
5024 MGMT_STATUS_INVALID_PARAMS);
5029 hci_smp_ltks_clear(hdev);
5031 for (i = 0; i < key_count; i++) {
5032 struct mgmt_ltk_info *key = &cp->keys[i];
5033 u8 type, addr_type, authenticated;
5035 if (key->addr.type == BDADDR_LE_PUBLIC)
5036 addr_type = ADDR_LE_DEV_PUBLIC;
5038 addr_type = ADDR_LE_DEV_RANDOM;
5040 switch (key->type) {
5041 case MGMT_LTK_UNAUTHENTICATED:
5042 authenticated = 0x00;
5043 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5045 case MGMT_LTK_AUTHENTICATED:
5046 authenticated = 0x01;
5047 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5049 case MGMT_LTK_P256_UNAUTH:
5050 authenticated = 0x00;
5051 type = SMP_LTK_P256;
5053 case MGMT_LTK_P256_AUTH:
5054 authenticated = 0x01;
5055 type = SMP_LTK_P256;
5057 case MGMT_LTK_P256_DEBUG:
5058 authenticated = 0x00;
5059 type = SMP_LTK_P256_DEBUG;
5064 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
5065 authenticated, key->val, key->enc_size, key->ediv,
5069 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5072 hci_dev_unlock(hdev);
5077 struct cmd_conn_lookup {
5078 struct hci_conn *conn;
5079 bool valid_tx_power;
5083 static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
5085 struct cmd_conn_lookup *match = data;
5086 struct mgmt_cp_get_conn_info *cp;
5087 struct mgmt_rp_get_conn_info rp;
5088 struct hci_conn *conn = cmd->user_data;
5090 if (conn != match->conn)
5093 cp = (struct mgmt_cp_get_conn_info *) cmd->param;
5095 memset(&rp, 0, sizeof(rp));
5096 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5097 rp.addr.type = cp->addr.type;
5099 if (!match->mgmt_status) {
5100 rp.rssi = conn->rssi;
5102 if (match->valid_tx_power) {
5103 rp.tx_power = conn->tx_power;
5104 rp.max_tx_power = conn->max_tx_power;
5106 rp.tx_power = HCI_TX_POWER_INVALID;
5107 rp.max_tx_power = HCI_TX_POWER_INVALID;
5111 cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5112 match->mgmt_status, &rp, sizeof(rp));
5114 hci_conn_drop(conn);
5117 mgmt_pending_remove(cmd);
5120 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
5122 struct hci_cp_read_rssi *cp;
5123 struct hci_conn *conn;
5124 struct cmd_conn_lookup match;
5127 BT_DBG("status 0x%02x", status);
5131 /* TX power data is valid in case request completed successfully,
5132 * otherwise we assume it's not valid. At the moment we assume that
5133 * either both or none of current and max values are valid to keep code
5136 match.valid_tx_power = !status;
5138 /* Commands sent in request are either Read RSSI or Read Transmit Power
5139 * Level so we check which one was last sent to retrieve connection
5140 * handle. Both commands have handle as first parameter so it's safe to
5141 * cast data on the same command struct.
5143 * First command sent is always Read RSSI and we fail only if it fails.
5144 * In other case we simply override error to indicate success as we
5145 * already remembered if TX power value is actually valid.
5147 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5149 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
5154 BT_ERR("invalid sent_cmd in response");
5158 handle = __le16_to_cpu(cp->handle);
5159 conn = hci_conn_hash_lookup_handle(hdev, handle);
5161 BT_ERR("unknown handle (%d) in response", handle);
5166 match.mgmt_status = mgmt_status(status);
5168 /* Cache refresh is complete, now reply for mgmt request for given
5171 mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
5172 get_conn_info_complete, &match);
5175 hci_dev_unlock(hdev);
5178 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5181 struct mgmt_cp_get_conn_info *cp = data;
5182 struct mgmt_rp_get_conn_info rp;
5183 struct hci_conn *conn;
5184 unsigned long conn_info_age;
5187 BT_DBG("%s", hdev->name);
5189 memset(&rp, 0, sizeof(rp));
5190 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5191 rp.addr.type = cp->addr.type;
5193 if (!bdaddr_type_is_valid(cp->addr.type))
5194 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5195 MGMT_STATUS_INVALID_PARAMS,
5200 if (!hdev_is_powered(hdev)) {
5201 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5202 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5206 if (cp->addr.type == BDADDR_BREDR)
5207 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5210 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5212 if (!conn || conn->state != BT_CONNECTED) {
5213 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5214 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5218 /* To avoid client trying to guess when to poll again for information we
5219 * calculate conn info age as random value between min/max set in hdev.
5221 conn_info_age = hdev->conn_info_min_age +
5222 prandom_u32_max(hdev->conn_info_max_age -
5223 hdev->conn_info_min_age);
5225 /* Query controller to refresh cached values if they are too old or were
5228 if (time_after(jiffies, conn->conn_info_timestamp +
5229 msecs_to_jiffies(conn_info_age)) ||
5230 !conn->conn_info_timestamp) {
5231 struct hci_request req;
5232 struct hci_cp_read_tx_power req_txp_cp;
5233 struct hci_cp_read_rssi req_rssi_cp;
5234 struct pending_cmd *cmd;
5236 hci_req_init(&req, hdev);
5237 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5238 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5241 /* For LE links TX power does not change thus we don't need to
5242 * query for it once value is known.
5244 if (!bdaddr_type_is_le(cp->addr.type) ||
5245 conn->tx_power == HCI_TX_POWER_INVALID) {
5246 req_txp_cp.handle = cpu_to_le16(conn->handle);
5247 req_txp_cp.type = 0x00;
5248 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5249 sizeof(req_txp_cp), &req_txp_cp);
5252 /* Max TX power needs to be read only once per connection */
5253 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5254 req_txp_cp.handle = cpu_to_le16(conn->handle);
5255 req_txp_cp.type = 0x01;
5256 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5257 sizeof(req_txp_cp), &req_txp_cp);
5260 err = hci_req_run(&req, conn_info_refresh_complete);
5264 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5271 hci_conn_hold(conn);
5272 cmd->user_data = hci_conn_get(conn);
5274 conn->conn_info_timestamp = jiffies;
5276 /* Cache is valid, just reply with values cached in hci_conn */
5277 rp.rssi = conn->rssi;
5278 rp.tx_power = conn->tx_power;
5279 rp.max_tx_power = conn->max_tx_power;
5281 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5282 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5286 hci_dev_unlock(hdev);
5290 static void get_clock_info_complete(struct hci_dev *hdev, u8 status)
5292 struct mgmt_cp_get_clock_info *cp;
5293 struct mgmt_rp_get_clock_info rp;
5294 struct hci_cp_read_clock *hci_cp;
5295 struct pending_cmd *cmd;
5296 struct hci_conn *conn;
5298 BT_DBG("%s status %u", hdev->name, status);
5302 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5306 if (hci_cp->which) {
5307 u16 handle = __le16_to_cpu(hci_cp->handle);
5308 conn = hci_conn_hash_lookup_handle(hdev, handle);
5313 cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5319 memset(&rp, 0, sizeof(rp));
5320 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr));
5325 rp.local_clock = cpu_to_le32(hdev->clock);
5328 rp.piconet_clock = cpu_to_le32(conn->clock);
5329 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5333 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
5335 mgmt_pending_remove(cmd);
5337 hci_conn_drop(conn);
5342 hci_dev_unlock(hdev);
5345 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5348 struct mgmt_cp_get_clock_info *cp = data;
5349 struct mgmt_rp_get_clock_info rp;
5350 struct hci_cp_read_clock hci_cp;
5351 struct pending_cmd *cmd;
5352 struct hci_request req;
5353 struct hci_conn *conn;
5356 BT_DBG("%s", hdev->name);
5358 memset(&rp, 0, sizeof(rp));
5359 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5360 rp.addr.type = cp->addr.type;
5362 if (cp->addr.type != BDADDR_BREDR)
5363 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5364 MGMT_STATUS_INVALID_PARAMS,
5369 if (!hdev_is_powered(hdev)) {
5370 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5371 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5375 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5376 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5378 if (!conn || conn->state != BT_CONNECTED) {
5379 err = cmd_complete(sk, hdev->id,
5380 MGMT_OP_GET_CLOCK_INFO,
5381 MGMT_STATUS_NOT_CONNECTED,
5389 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5395 hci_req_init(&req, hdev);
5397 memset(&hci_cp, 0, sizeof(hci_cp));
5398 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5401 hci_conn_hold(conn);
5402 cmd->user_data = hci_conn_get(conn);
5404 hci_cp.handle = cpu_to_le16(conn->handle);
5405 hci_cp.which = 0x01; /* Piconet clock */
5406 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5409 err = hci_req_run(&req, get_clock_info_complete);
5411 mgmt_pending_remove(cmd);
5414 hci_dev_unlock(hdev);
5418 static void device_added(struct sock *sk, struct hci_dev *hdev,
5419 bdaddr_t *bdaddr, u8 type, u8 action)
5421 struct mgmt_ev_device_added ev;
5423 bacpy(&ev.addr.bdaddr, bdaddr);
5424 ev.addr.type = type;
5427 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5430 static int add_device(struct sock *sk, struct hci_dev *hdev,
5431 void *data, u16 len)
5433 struct mgmt_cp_add_device *cp = data;
5434 u8 auto_conn, addr_type;
5437 BT_DBG("%s", hdev->name);
5439 if (!bdaddr_type_is_valid(cp->addr.type) ||
5440 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5441 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5442 MGMT_STATUS_INVALID_PARAMS,
5443 &cp->addr, sizeof(cp->addr));
5445 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
5446 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5447 MGMT_STATUS_INVALID_PARAMS,
5448 &cp->addr, sizeof(cp->addr));
5452 if (cp->addr.type == BDADDR_BREDR) {
5453 /* Only incoming connections action is supported for now */
5454 if (cp->action != 0x01) {
5455 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5456 MGMT_STATUS_INVALID_PARAMS,
5457 &cp->addr, sizeof(cp->addr));
5461 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5466 hci_update_page_scan(hdev, NULL);
5471 if (cp->addr.type == BDADDR_LE_PUBLIC)
5472 addr_type = ADDR_LE_DEV_PUBLIC;
5474 addr_type = ADDR_LE_DEV_RANDOM;
5476 if (cp->action == 0x02)
5477 auto_conn = HCI_AUTO_CONN_ALWAYS;
5478 else if (cp->action == 0x01)
5479 auto_conn = HCI_AUTO_CONN_DIRECT;
5481 auto_conn = HCI_AUTO_CONN_REPORT;
5483 /* If the connection parameters don't exist for this device,
5484 * they will be created and configured with defaults.
5486 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type,
5488 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5490 &cp->addr, sizeof(cp->addr));
5495 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5497 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5498 MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5501 hci_dev_unlock(hdev);
5505 static void device_removed(struct sock *sk, struct hci_dev *hdev,
5506 bdaddr_t *bdaddr, u8 type)
5508 struct mgmt_ev_device_removed ev;
5510 bacpy(&ev.addr.bdaddr, bdaddr);
5511 ev.addr.type = type;
5513 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5516 static int remove_device(struct sock *sk, struct hci_dev *hdev,
5517 void *data, u16 len)
5519 struct mgmt_cp_remove_device *cp = data;
5522 BT_DBG("%s", hdev->name);
5526 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5527 struct hci_conn_params *params;
5530 if (!bdaddr_type_is_valid(cp->addr.type)) {
5531 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5532 MGMT_STATUS_INVALID_PARAMS,
5533 &cp->addr, sizeof(cp->addr));
5537 if (cp->addr.type == BDADDR_BREDR) {
5538 err = hci_bdaddr_list_del(&hdev->whitelist,
5542 err = cmd_complete(sk, hdev->id,
5543 MGMT_OP_REMOVE_DEVICE,
5544 MGMT_STATUS_INVALID_PARAMS,
5545 &cp->addr, sizeof(cp->addr));
5549 hci_update_page_scan(hdev, NULL);
5551 device_removed(sk, hdev, &cp->addr.bdaddr,
5556 if (cp->addr.type == BDADDR_LE_PUBLIC)
5557 addr_type = ADDR_LE_DEV_PUBLIC;
5559 addr_type = ADDR_LE_DEV_RANDOM;
5561 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5564 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5565 MGMT_STATUS_INVALID_PARAMS,
5566 &cp->addr, sizeof(cp->addr));
5570 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
5571 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5572 MGMT_STATUS_INVALID_PARAMS,
5573 &cp->addr, sizeof(cp->addr));
5577 list_del(¶ms->action);
5578 list_del(¶ms->list);
5580 hci_update_background_scan(hdev);
5582 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
5584 struct hci_conn_params *p, *tmp;
5585 struct bdaddr_list *b, *btmp;
5587 if (cp->addr.type) {
5588 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5589 MGMT_STATUS_INVALID_PARAMS,
5590 &cp->addr, sizeof(cp->addr));
5594 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5595 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5600 hci_update_page_scan(hdev, NULL);
5602 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5603 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5605 device_removed(sk, hdev, &p->addr, p->addr_type);
5606 list_del(&p->action);
5611 BT_DBG("All LE connection parameters were removed");
5613 hci_update_background_scan(hdev);
5617 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE,
5618 MGMT_STATUS_SUCCESS, &cp->addr, sizeof(cp->addr));
5621 hci_dev_unlock(hdev);
5625 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5628 struct mgmt_cp_load_conn_param *cp = data;
5629 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5630 sizeof(struct mgmt_conn_param));
5631 u16 param_count, expected_len;
5634 if (!lmp_le_capable(hdev))
5635 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5636 MGMT_STATUS_NOT_SUPPORTED);
5638 param_count = __le16_to_cpu(cp->param_count);
5639 if (param_count > max_param_count) {
5640 BT_ERR("load_conn_param: too big param_count value %u",
5642 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5643 MGMT_STATUS_INVALID_PARAMS);
5646 expected_len = sizeof(*cp) + param_count *
5647 sizeof(struct mgmt_conn_param);
5648 if (expected_len != len) {
5649 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5651 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5652 MGMT_STATUS_INVALID_PARAMS);
5655 BT_DBG("%s param_count %u", hdev->name, param_count);
5659 hci_conn_params_clear_disabled(hdev);
5661 for (i = 0; i < param_count; i++) {
5662 struct mgmt_conn_param *param = &cp->params[i];
5663 struct hci_conn_params *hci_param;
5664 u16 min, max, latency, timeout;
5667 BT_DBG("Adding %pMR (type %u)", ¶m->addr.bdaddr,
5670 if (param->addr.type == BDADDR_LE_PUBLIC) {
5671 addr_type = ADDR_LE_DEV_PUBLIC;
5672 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5673 addr_type = ADDR_LE_DEV_RANDOM;
5675 BT_ERR("Ignoring invalid connection parameters");
5679 min = le16_to_cpu(param->min_interval);
5680 max = le16_to_cpu(param->max_interval);
5681 latency = le16_to_cpu(param->latency);
5682 timeout = le16_to_cpu(param->timeout);
5684 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5685 min, max, latency, timeout);
5687 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5688 BT_ERR("Ignoring invalid connection parameters");
5692 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr,
5695 BT_ERR("Failed to add connection parameters");
5699 hci_param->conn_min_interval = min;
5700 hci_param->conn_max_interval = max;
5701 hci_param->conn_latency = latency;
5702 hci_param->supervision_timeout = timeout;
5705 hci_dev_unlock(hdev);
5707 return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5710 static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5711 void *data, u16 len)
5713 struct mgmt_cp_set_external_config *cp = data;
5717 BT_DBG("%s", hdev->name);
5719 if (hdev_is_powered(hdev))
5720 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5721 MGMT_STATUS_REJECTED);
5723 if (cp->config != 0x00 && cp->config != 0x01)
5724 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5725 MGMT_STATUS_INVALID_PARAMS);
5727 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
5728 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
5729 MGMT_STATUS_NOT_SUPPORTED);
5734 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
5737 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
5740 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
5747 err = new_options(hdev, sk);
5749 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
5750 mgmt_index_removed(hdev);
5752 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5753 set_bit(HCI_CONFIG, &hdev->dev_flags);
5754 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5756 queue_work(hdev->req_workqueue, &hdev->power_on);
5758 set_bit(HCI_RAW, &hdev->flags);
5759 mgmt_index_added(hdev);
5764 hci_dev_unlock(hdev);
5768 static int set_public_address(struct sock *sk, struct hci_dev *hdev,
5769 void *data, u16 len)
5771 struct mgmt_cp_set_public_address *cp = data;
5775 BT_DBG("%s", hdev->name);
5777 if (hdev_is_powered(hdev))
5778 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5779 MGMT_STATUS_REJECTED);
5781 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
5782 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5783 MGMT_STATUS_INVALID_PARAMS);
5785 if (!hdev->set_bdaddr)
5786 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
5787 MGMT_STATUS_NOT_SUPPORTED);
5791 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
5792 bacpy(&hdev->public_addr, &cp->bdaddr);
5794 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
5801 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
5802 err = new_options(hdev, sk);
5804 if (is_configured(hdev)) {
5805 mgmt_index_removed(hdev);
5807 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
5809 set_bit(HCI_CONFIG, &hdev->dev_flags);
5810 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
5812 queue_work(hdev->req_workqueue, &hdev->power_on);
5816 hci_dev_unlock(hdev);
5820 static const struct mgmt_handler {
5821 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
5825 } mgmt_handlers[] = {
5826 { NULL }, /* 0x0000 (no command) */
5827 { read_version, false, MGMT_READ_VERSION_SIZE },
5828 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
5829 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
5830 { read_controller_info, false, MGMT_READ_INFO_SIZE },
5831 { set_powered, false, MGMT_SETTING_SIZE },
5832 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
5833 { set_connectable, false, MGMT_SETTING_SIZE },
5834 { set_fast_connectable, false, MGMT_SETTING_SIZE },
5835 { set_bondable, false, MGMT_SETTING_SIZE },
5836 { set_link_security, false, MGMT_SETTING_SIZE },
5837 { set_ssp, false, MGMT_SETTING_SIZE },
5838 { set_hs, false, MGMT_SETTING_SIZE },
5839 { set_le, false, MGMT_SETTING_SIZE },
5840 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
5841 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
5842 { add_uuid, false, MGMT_ADD_UUID_SIZE },
5843 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
5844 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
5845 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
5846 { disconnect, false, MGMT_DISCONNECT_SIZE },
5847 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
5848 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
5849 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
5850 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
5851 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
5852 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
5853 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
5854 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
5855 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
5856 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
5857 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
5858 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
5859 { add_remote_oob_data, true, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
5860 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
5861 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
5862 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
5863 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
5864 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
5865 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
5866 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
5867 { set_advertising, false, MGMT_SETTING_SIZE },
5868 { set_bredr, false, MGMT_SETTING_SIZE },
5869 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE },
5870 { set_scan_params, false, MGMT_SET_SCAN_PARAMS_SIZE },
5871 { set_secure_conn, false, MGMT_SETTING_SIZE },
5872 { set_debug_keys, false, MGMT_SETTING_SIZE },
5873 { set_privacy, false, MGMT_SET_PRIVACY_SIZE },
5874 { load_irks, true, MGMT_LOAD_IRKS_SIZE },
5875 { get_conn_info, false, MGMT_GET_CONN_INFO_SIZE },
5876 { get_clock_info, false, MGMT_GET_CLOCK_INFO_SIZE },
5877 { add_device, false, MGMT_ADD_DEVICE_SIZE },
5878 { remove_device, false, MGMT_REMOVE_DEVICE_SIZE },
5879 { load_conn_param, true, MGMT_LOAD_CONN_PARAM_SIZE },
5880 { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
5881 { read_config_info, false, MGMT_READ_CONFIG_INFO_SIZE },
5882 { set_external_config, false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
5883 { set_public_address, false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
5884 { start_service_discovery,true, MGMT_START_SERVICE_DISCOVERY_SIZE },
5887 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
5891 struct mgmt_hdr *hdr;
5892 u16 opcode, index, len;
5893 struct hci_dev *hdev = NULL;
5894 const struct mgmt_handler *handler;
5897 BT_DBG("got %zu bytes", msglen);
5899 if (msglen < sizeof(*hdr))
5902 buf = kmalloc(msglen, GFP_KERNEL);
5906 if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
5912 opcode = __le16_to_cpu(hdr->opcode);
5913 index = __le16_to_cpu(hdr->index);
5914 len = __le16_to_cpu(hdr->len);
5916 if (len != msglen - sizeof(*hdr)) {
5921 if (index != MGMT_INDEX_NONE) {
5922 hdev = hci_dev_get(index);
5924 err = cmd_status(sk, index, opcode,
5925 MGMT_STATUS_INVALID_INDEX);
5929 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
5930 test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5931 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5932 err = cmd_status(sk, index, opcode,
5933 MGMT_STATUS_INVALID_INDEX);
5937 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
5938 opcode != MGMT_OP_READ_CONFIG_INFO &&
5939 opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
5940 opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
5941 err = cmd_status(sk, index, opcode,
5942 MGMT_STATUS_INVALID_INDEX);
5947 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
5948 mgmt_handlers[opcode].func == NULL) {
5949 BT_DBG("Unknown op %u", opcode);
5950 err = cmd_status(sk, index, opcode,
5951 MGMT_STATUS_UNKNOWN_COMMAND);
5955 if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
5956 opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5957 err = cmd_status(sk, index, opcode,
5958 MGMT_STATUS_INVALID_INDEX);
5962 if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
5963 opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
5964 err = cmd_status(sk, index, opcode,
5965 MGMT_STATUS_INVALID_INDEX);
5969 handler = &mgmt_handlers[opcode];
5971 if ((handler->var_len && len < handler->data_len) ||
5972 (!handler->var_len && len != handler->data_len)) {
5973 err = cmd_status(sk, index, opcode,
5974 MGMT_STATUS_INVALID_PARAMS);
5979 mgmt_init_hdev(sk, hdev);
5981 cp = buf + sizeof(*hdr);
5983 err = handler->func(sk, hdev, cp, len);
5997 void mgmt_index_added(struct hci_dev *hdev)
5999 if (hdev->dev_type != HCI_BREDR)
6002 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6005 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6006 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6008 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
6011 void mgmt_index_removed(struct hci_dev *hdev)
6013 u8 status = MGMT_STATUS_INVALID_INDEX;
6015 if (hdev->dev_type != HCI_BREDR)
6018 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6021 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
6023 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6024 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6026 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
6029 /* This function requires the caller holds hdev->lock */
6030 static void restart_le_actions(struct hci_dev *hdev)
6032 struct hci_conn_params *p;
6034 list_for_each_entry(p, &hdev->le_conn_params, list) {
6035 /* Needed for AUTO_OFF case where might not "really"
6036 * have been powered off.
6038 list_del_init(&p->action);
6040 switch (p->auto_connect) {
6041 case HCI_AUTO_CONN_DIRECT:
6042 case HCI_AUTO_CONN_ALWAYS:
6043 list_add(&p->action, &hdev->pend_le_conns);
6045 case HCI_AUTO_CONN_REPORT:
6046 list_add(&p->action, &hdev->pend_le_reports);
6053 hci_update_background_scan(hdev);
6056 static void powered_complete(struct hci_dev *hdev, u8 status)
6058 struct cmd_lookup match = { NULL, hdev };
6060 BT_DBG("status 0x%02x", status);
6064 restart_le_actions(hdev);
6066 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6068 new_settings(hdev, match.sk);
6070 hci_dev_unlock(hdev);
6076 static int powered_update_hci(struct hci_dev *hdev)
6078 struct hci_request req;
6081 hci_req_init(&req, hdev);
6083 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6084 !lmp_host_ssp_capable(hdev)) {
6087 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
6090 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6091 lmp_bredr_capable(hdev)) {
6092 struct hci_cp_write_le_host_supported cp;
6097 /* Check first if we already have the right
6098 * host state (host features set)
6100 if (cp.le != lmp_host_le_capable(hdev) ||
6101 cp.simul != lmp_host_le_br_capable(hdev))
6102 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6106 if (lmp_le_capable(hdev)) {
6107 /* Make sure the controller has a good default for
6108 * advertising data. This also applies to the case
6109 * where BR/EDR was toggled during the AUTO_OFF phase.
6111 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6112 update_adv_data(&req);
6113 update_scan_rsp_data(&req);
6116 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6117 enable_advertising(&req);
6120 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6121 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
6122 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6123 sizeof(link_sec), &link_sec);
6125 if (lmp_bredr_capable(hdev)) {
6126 write_fast_connectable(&req, false);
6127 hci_update_page_scan(hdev, &req);
6133 return hci_req_run(&req, powered_complete);
6136 int mgmt_powered(struct hci_dev *hdev, u8 powered)
6138 struct cmd_lookup match = { NULL, hdev };
6139 u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
6140 u8 zero_cod[] = { 0, 0, 0 };
6143 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6147 if (powered_update_hci(hdev) == 0)
6150 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6155 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6156 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status_not_powered);
6158 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6159 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6160 zero_cod, sizeof(zero_cod), NULL);
6163 err = new_settings(hdev, match.sk);
6171 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
6173 struct pending_cmd *cmd;
6176 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6180 if (err == -ERFKILL)
6181 status = MGMT_STATUS_RFKILLED;
6183 status = MGMT_STATUS_FAILED;
6185 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
6187 mgmt_pending_remove(cmd);
6190 void mgmt_discoverable_timeout(struct hci_dev *hdev)
6192 struct hci_request req;
6196 /* When discoverable timeout triggers, then just make sure
6197 * the limited discoverable flag is cleared. Even in the case
6198 * of a timeout triggered from general discoverable, it is
6199 * safe to unconditionally clear the flag.
6201 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
6202 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
6204 hci_req_init(&req, hdev);
6205 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6206 u8 scan = SCAN_PAGE;
6207 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6208 sizeof(scan), &scan);
6211 update_adv_data(&req);
6212 hci_req_run(&req, NULL);
6214 hdev->discov_timeout = 0;
6216 new_settings(hdev, NULL);
6218 hci_dev_unlock(hdev);
6221 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6224 struct mgmt_ev_new_link_key ev;
6226 memset(&ev, 0, sizeof(ev));
6228 ev.store_hint = persistent;
6229 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6230 ev.key.addr.type = BDADDR_BREDR;
6231 ev.key.type = key->type;
6232 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
6233 ev.key.pin_len = key->pin_len;
6235 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
6238 static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6240 switch (ltk->type) {
6243 if (ltk->authenticated)
6244 return MGMT_LTK_AUTHENTICATED;
6245 return MGMT_LTK_UNAUTHENTICATED;
6247 if (ltk->authenticated)
6248 return MGMT_LTK_P256_AUTH;
6249 return MGMT_LTK_P256_UNAUTH;
6250 case SMP_LTK_P256_DEBUG:
6251 return MGMT_LTK_P256_DEBUG;
6254 return MGMT_LTK_UNAUTHENTICATED;
6257 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
6259 struct mgmt_ev_new_long_term_key ev;
6261 memset(&ev, 0, sizeof(ev));
6263 /* Devices using resolvable or non-resolvable random addresses
6264 * without providing an indentity resolving key don't require
6265 * to store long term keys. Their addresses will change the
6268 * Only when a remote device provides an identity address
6269 * make sure the long term key is stored. If the remote
6270 * identity is known, the long term keys are internally
6271 * mapped to the identity address. So allow static random
6272 * and public addresses here.
6274 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6275 (key->bdaddr.b[5] & 0xc0) != 0xc0)
6276 ev.store_hint = 0x00;
6278 ev.store_hint = persistent;
6280 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
6281 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
6282 ev.key.type = mgmt_ltk_type(key);
6283 ev.key.enc_size = key->enc_size;
6284 ev.key.ediv = key->ediv;
6285 ev.key.rand = key->rand;
6287 if (key->type == SMP_LTK)
6290 memcpy(ev.key.val, key->val, sizeof(key->val));
6292 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
6295 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6297 struct mgmt_ev_new_irk ev;
6299 memset(&ev, 0, sizeof(ev));
6301 /* For identity resolving keys from devices that are already
6302 * using a public address or static random address, do not
6303 * ask for storing this key. The identity resolving key really
6304 * is only mandatory for devices using resovlable random
6307 * Storing all identity resolving keys has the downside that
6308 * they will be also loaded on next boot of they system. More
6309 * identity resolving keys, means more time during scanning is
6310 * needed to actually resolve these addresses.
6312 if (bacmp(&irk->rpa, BDADDR_ANY))
6313 ev.store_hint = 0x01;
6315 ev.store_hint = 0x00;
6317 bacpy(&ev.rpa, &irk->rpa);
6318 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6319 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6320 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6322 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6325 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6328 struct mgmt_ev_new_csrk ev;
6330 memset(&ev, 0, sizeof(ev));
6332 /* Devices using resolvable or non-resolvable random addresses
6333 * without providing an indentity resolving key don't require
6334 * to store signature resolving keys. Their addresses will change
6335 * the next time around.
6337 * Only when a remote device provides an identity address
6338 * make sure the signature resolving key is stored. So allow
6339 * static random and public addresses here.
6341 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6342 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6343 ev.store_hint = 0x00;
6345 ev.store_hint = persistent;
6347 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6348 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6349 ev.key.master = csrk->master;
6350 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6352 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6355 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
6356 u8 bdaddr_type, u8 store_hint, u16 min_interval,
6357 u16 max_interval, u16 latency, u16 timeout)
6359 struct mgmt_ev_new_conn_param ev;
6361 if (!hci_is_identity_address(bdaddr, bdaddr_type))
6364 memset(&ev, 0, sizeof(ev));
6365 bacpy(&ev.addr.bdaddr, bdaddr);
6366 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
6367 ev.store_hint = store_hint;
6368 ev.min_interval = cpu_to_le16(min_interval);
6369 ev.max_interval = cpu_to_le16(max_interval);
6370 ev.latency = cpu_to_le16(latency);
6371 ev.timeout = cpu_to_le16(timeout);
6373 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6376 static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6379 eir[eir_len++] = sizeof(type) + data_len;
6380 eir[eir_len++] = type;
6381 memcpy(&eir[eir_len], data, data_len);
6382 eir_len += data_len;
6387 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6388 u32 flags, u8 *name, u8 name_len)
6391 struct mgmt_ev_device_connected *ev = (void *) buf;
6394 bacpy(&ev->addr.bdaddr, &conn->dst);
6395 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6397 ev->flags = __cpu_to_le32(flags);
6399 /* We must ensure that the EIR Data fields are ordered and
6400 * unique. Keep it simple for now and avoid the problem by not
6401 * adding any BR/EDR data to the LE adv.
6403 if (conn->le_adv_data_len > 0) {
6404 memcpy(&ev->eir[eir_len],
6405 conn->le_adv_data, conn->le_adv_data_len);
6406 eir_len = conn->le_adv_data_len;
6409 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6412 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
6413 eir_len = eir_append_data(ev->eir, eir_len,
6415 conn->dev_class, 3);
6418 ev->eir_len = cpu_to_le16(eir_len);
6420 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6421 sizeof(*ev) + eir_len, NULL);
6424 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6426 struct sock **sk = data;
6428 cmd->cmd_complete(cmd, 0);
6433 mgmt_pending_remove(cmd);
6436 static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
6438 struct hci_dev *hdev = data;
6439 struct mgmt_cp_unpair_device *cp = cmd->param;
6441 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6443 cmd->cmd_complete(cmd, 0);
6444 mgmt_pending_remove(cmd);
6447 bool mgmt_powering_down(struct hci_dev *hdev)
6449 struct pending_cmd *cmd;
6450 struct mgmt_mode *cp;
6452 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6463 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
6464 u8 link_type, u8 addr_type, u8 reason,
6465 bool mgmt_connected)
6467 struct mgmt_ev_device_disconnected ev;
6468 struct sock *sk = NULL;
6470 /* The connection is still in hci_conn_hash so test for 1
6471 * instead of 0 to know if this is the last one.
6473 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6474 cancel_delayed_work(&hdev->power_off);
6475 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6478 if (!mgmt_connected)
6481 if (link_type != ACL_LINK && link_type != LE_LINK)
6484 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
6486 bacpy(&ev.addr.bdaddr, bdaddr);
6487 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6490 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
6495 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6499 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6500 u8 link_type, u8 addr_type, u8 status)
6502 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6503 struct mgmt_cp_disconnect *cp;
6504 struct pending_cmd *cmd;
6506 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6509 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
6515 if (bacmp(bdaddr, &cp->addr.bdaddr))
6518 if (cp->addr.type != bdaddr_type)
6521 cmd->cmd_complete(cmd, mgmt_status(status));
6522 mgmt_pending_remove(cmd);
6525 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6526 u8 addr_type, u8 status)
6528 struct mgmt_ev_connect_failed ev;
6530 /* The connection is still in hci_conn_hash so test for 1
6531 * instead of 0 to know if this is the last one.
6533 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6534 cancel_delayed_work(&hdev->power_off);
6535 queue_work(hdev->req_workqueue, &hdev->power_off.work);
6538 bacpy(&ev.addr.bdaddr, bdaddr);
6539 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6540 ev.status = mgmt_status(status);
6542 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
6545 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
6547 struct mgmt_ev_pin_code_request ev;
6549 bacpy(&ev.addr.bdaddr, bdaddr);
6550 ev.addr.type = BDADDR_BREDR;
6553 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
6556 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6559 struct pending_cmd *cmd;
6561 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
6565 cmd->cmd_complete(cmd, mgmt_status(status));
6566 mgmt_pending_remove(cmd);
6569 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6572 struct pending_cmd *cmd;
6574 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
6578 cmd->cmd_complete(cmd, mgmt_status(status));
6579 mgmt_pending_remove(cmd);
6582 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6583 u8 link_type, u8 addr_type, u32 value,
6586 struct mgmt_ev_user_confirm_request ev;
6588 BT_DBG("%s", hdev->name);
6590 bacpy(&ev.addr.bdaddr, bdaddr);
6591 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6592 ev.confirm_hint = confirm_hint;
6593 ev.value = cpu_to_le32(value);
6595 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
6599 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
6600 u8 link_type, u8 addr_type)
6602 struct mgmt_ev_user_passkey_request ev;
6604 BT_DBG("%s", hdev->name);
6606 bacpy(&ev.addr.bdaddr, bdaddr);
6607 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6609 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
6613 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6614 u8 link_type, u8 addr_type, u8 status,
6617 struct pending_cmd *cmd;
6619 cmd = mgmt_pending_find(opcode, hdev);
6623 cmd->cmd_complete(cmd, mgmt_status(status));
6624 mgmt_pending_remove(cmd);
6629 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6630 u8 link_type, u8 addr_type, u8 status)
6632 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6633 status, MGMT_OP_USER_CONFIRM_REPLY);
6636 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6637 u8 link_type, u8 addr_type, u8 status)
6639 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6641 MGMT_OP_USER_CONFIRM_NEG_REPLY);
6644 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6645 u8 link_type, u8 addr_type, u8 status)
6647 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6648 status, MGMT_OP_USER_PASSKEY_REPLY);
6651 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6652 u8 link_type, u8 addr_type, u8 status)
6654 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
6656 MGMT_OP_USER_PASSKEY_NEG_REPLY);
6659 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6660 u8 link_type, u8 addr_type, u32 passkey,
6663 struct mgmt_ev_passkey_notify ev;
6665 BT_DBG("%s", hdev->name);
6667 bacpy(&ev.addr.bdaddr, bdaddr);
6668 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6669 ev.passkey = __cpu_to_le32(passkey);
6670 ev.entered = entered;
6672 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6675 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
6677 struct mgmt_ev_auth_failed ev;
6678 struct pending_cmd *cmd;
6679 u8 status = mgmt_status(hci_status);
6681 bacpy(&ev.addr.bdaddr, &conn->dst);
6682 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
6685 cmd = find_pairing(conn);
6687 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
6688 cmd ? cmd->sk : NULL);
6691 pairing_complete(cmd, status);
6694 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
6696 struct cmd_lookup match = { NULL, hdev };
6700 u8 mgmt_err = mgmt_status(status);
6701 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
6702 cmd_status_rsp, &mgmt_err);
6706 if (test_bit(HCI_AUTH, &hdev->flags))
6707 changed = !test_and_set_bit(HCI_LINK_SECURITY,
6710 changed = test_and_clear_bit(HCI_LINK_SECURITY,
6713 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
6717 new_settings(hdev, match.sk);
6723 static void clear_eir(struct hci_request *req)
6725 struct hci_dev *hdev = req->hdev;
6726 struct hci_cp_write_eir cp;
6728 if (!lmp_ext_inq_capable(hdev))
6731 memset(hdev->eir, 0, sizeof(hdev->eir));
6733 memset(&cp, 0, sizeof(cp));
6735 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6738 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6740 struct cmd_lookup match = { NULL, hdev };
6741 struct hci_request req;
6742 bool changed = false;
6745 u8 mgmt_err = mgmt_status(status);
6747 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
6748 &hdev->dev_flags)) {
6749 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6750 new_settings(hdev, NULL);
6753 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
6759 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6761 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
6763 changed = test_and_clear_bit(HCI_HS_ENABLED,
6766 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
6769 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
6772 new_settings(hdev, match.sk);
6777 hci_req_init(&req, hdev);
6779 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6780 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
6781 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
6782 sizeof(enable), &enable);
6788 hci_req_run(&req, NULL);
6791 void mgmt_sc_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
6793 struct cmd_lookup match = { NULL, hdev };
6794 bool changed = false;
6797 u8 mgmt_err = mgmt_status(status);
6800 if (test_and_clear_bit(HCI_SC_ENABLED,
6802 new_settings(hdev, NULL);
6803 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6806 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6807 cmd_status_rsp, &mgmt_err);
6812 changed = !test_and_set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6814 changed = test_and_clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
6815 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
6818 mgmt_pending_foreach(MGMT_OP_SET_SECURE_CONN, hdev,
6819 settings_rsp, &match);
6822 new_settings(hdev, match.sk);
6828 static void sk_lookup(struct pending_cmd *cmd, void *data)
6830 struct cmd_lookup *match = data;
6832 if (match->sk == NULL) {
6833 match->sk = cmd->sk;
6834 sock_hold(match->sk);
6838 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
6841 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
6843 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
6844 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
6845 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
6848 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
6855 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
6857 struct mgmt_cp_set_local_name ev;
6858 struct pending_cmd *cmd;
6863 memset(&ev, 0, sizeof(ev));
6864 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
6865 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
6867 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
6869 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
6871 /* If this is a HCI command related to powering on the
6872 * HCI dev don't send any mgmt signals.
6874 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
6878 mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
6879 cmd ? cmd->sk : NULL);
6882 void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
6883 u8 *rand192, u8 *hash256, u8 *rand256,
6886 struct pending_cmd *cmd;
6888 BT_DBG("%s status %u", hdev->name, status);
6890 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
6895 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
6896 mgmt_status(status));
6898 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
6899 struct mgmt_rp_read_local_oob_ext_data rp;
6901 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
6902 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
6904 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
6905 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
6907 cmd_complete(cmd->sk, hdev->id,
6908 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6911 struct mgmt_rp_read_local_oob_data rp;
6913 memcpy(rp.hash, hash192, sizeof(rp.hash));
6914 memcpy(rp.rand, rand192, sizeof(rp.rand));
6916 cmd_complete(cmd->sk, hdev->id,
6917 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
6922 mgmt_pending_remove(cmd);
6925 /* this is reversed hex representation of bluetooth base uuid. We need it for
6926 * service uuid parsing in eir.
6928 static const u8 reverse_base_uuid[] = {
6929 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
6930 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
6933 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
6937 for (i = 0; i < uuid_count; i++) {
6938 if (!memcmp(uuid, uuids[i], 16))
6945 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
6949 while (parsed < eir_len) {
6950 u8 field_len = eir[0];
6957 if (eir_len - parsed < field_len + 1)
6961 case EIR_UUID16_ALL:
6962 case EIR_UUID16_SOME:
6963 for (i = 0; i + 3 <= field_len; i += 2) {
6964 memcpy(uuid, reverse_base_uuid, 16);
6965 uuid[13] = eir[i + 3];
6966 uuid[12] = eir[i + 2];
6967 if (has_uuid(uuid, uuid_count, uuids))
6971 case EIR_UUID32_ALL:
6972 case EIR_UUID32_SOME:
6973 for (i = 0; i + 5 <= field_len; i += 4) {
6974 memcpy(uuid, reverse_base_uuid, 16);
6975 uuid[15] = eir[i + 5];
6976 uuid[14] = eir[i + 4];
6977 uuid[13] = eir[i + 3];
6978 uuid[12] = eir[i + 2];
6979 if (has_uuid(uuid, uuid_count, uuids))
6983 case EIR_UUID128_ALL:
6984 case EIR_UUID128_SOME:
6985 for (i = 0; i + 17 <= field_len; i += 16) {
6986 memcpy(uuid, eir + i + 2, 16);
6987 if (has_uuid(uuid, uuid_count, uuids))
6993 parsed += field_len + 1;
6994 eir += field_len + 1;
7000 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7001 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7002 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7005 struct mgmt_ev_device_found *ev = (void *) buf;
7009 /* Don't send events for a non-kernel initiated discovery. With
7010 * LE one exception is if we have pend_le_reports > 0 in which
7011 * case we're doing passive scanning and want these events.
7013 if (!hci_discovery_active(hdev)) {
7014 if (link_type == ACL_LINK)
7016 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7020 /* When using service discovery with a RSSI threshold, then check
7021 * if such a RSSI threshold is specified. If a RSSI threshold has
7022 * been specified, then all results with a RSSI smaller than the
7023 * RSSI threshold will be dropped.
7025 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7026 rssi < hdev->discovery.rssi)
7029 /* Make sure that the buffer is big enough. The 5 extra bytes
7030 * are for the potential CoD field.
7032 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
7035 memset(buf, 0, sizeof(buf));
7037 bacpy(&ev->addr.bdaddr, bdaddr);
7038 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7040 ev->flags = cpu_to_le32(flags);
7043 /* When using service discovery and a list of UUID is
7044 * provided, results with no matching UUID should be
7045 * dropped. In case there is a match the result is
7046 * kept and checking possible scan response data
7049 if (hdev->discovery.uuid_count > 0) {
7050 match = eir_has_uuids(eir, eir_len,
7051 hdev->discovery.uuid_count,
7052 hdev->discovery.uuids);
7057 /* Copy EIR or advertising data into event */
7058 memcpy(ev->eir, eir, eir_len);
7060 /* When using service discovery and a list of UUID is
7061 * provided, results with empty EIR or advertising data
7062 * should be dropped since they do not match any UUID.
7064 if (hdev->discovery.uuid_count > 0)
7068 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7069 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7072 if (scan_rsp_len > 0) {
7073 /* When using service discovery and a list of UUID is
7074 * provided, results with no matching UUID should be
7075 * dropped if there is no previous match from the
7078 if (hdev->discovery.uuid_count > 0) {
7079 if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7080 hdev->discovery.uuid_count,
7081 hdev->discovery.uuids))
7085 /* Append scan response data to event */
7086 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7088 /* When using service discovery and a list of UUID is
7089 * provided, results with empty scan response and no
7090 * previous matched advertising data should be dropped.
7092 if (hdev->discovery.uuid_count > 0 && !match)
7096 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7097 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
7099 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
7102 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7103 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
7105 struct mgmt_ev_device_found *ev;
7106 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7109 ev = (struct mgmt_ev_device_found *) buf;
7111 memset(buf, 0, sizeof(buf));
7113 bacpy(&ev->addr.bdaddr, bdaddr);
7114 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7117 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
7120 ev->eir_len = cpu_to_le16(eir_len);
7122 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
7125 void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
7127 struct mgmt_ev_discovering ev;
7129 BT_DBG("%s discovering %u", hdev->name, discovering);
7131 memset(&ev, 0, sizeof(ev));
7132 ev.type = hdev->discovery.type;
7133 ev.discovering = discovering;
7135 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
7138 static void adv_enable_complete(struct hci_dev *hdev, u8 status)
7140 BT_DBG("%s status %u", hdev->name, status);
7143 void mgmt_reenable_advertising(struct hci_dev *hdev)
7145 struct hci_request req;
7147 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7150 hci_req_init(&req, hdev);
7151 enable_advertising(&req);
7152 hci_req_run(&req, adv_enable_complete);