2 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2010 Nokia Corporation
5 Copyright (C) 2011-2012 Intel Corporation
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI Management interface */
27 #include <linux/module.h>
28 #include <asm/unaligned.h>
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_sock.h>
33 #include <net/bluetooth/l2cap.h>
34 #include <net/bluetooth/mgmt.h>
36 #include "hci_request.h"
38 #include "mgmt_util.h"
40 #define MGMT_VERSION 1
41 #define MGMT_REVISION 14
43 static const u16 mgmt_commands
[] = {
44 MGMT_OP_READ_INDEX_LIST
,
47 MGMT_OP_SET_DISCOVERABLE
,
48 MGMT_OP_SET_CONNECTABLE
,
49 MGMT_OP_SET_FAST_CONNECTABLE
,
51 MGMT_OP_SET_LINK_SECURITY
,
55 MGMT_OP_SET_DEV_CLASS
,
56 MGMT_OP_SET_LOCAL_NAME
,
59 MGMT_OP_LOAD_LINK_KEYS
,
60 MGMT_OP_LOAD_LONG_TERM_KEYS
,
62 MGMT_OP_GET_CONNECTIONS
,
63 MGMT_OP_PIN_CODE_REPLY
,
64 MGMT_OP_PIN_CODE_NEG_REPLY
,
65 MGMT_OP_SET_IO_CAPABILITY
,
67 MGMT_OP_CANCEL_PAIR_DEVICE
,
68 MGMT_OP_UNPAIR_DEVICE
,
69 MGMT_OP_USER_CONFIRM_REPLY
,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY
,
71 MGMT_OP_USER_PASSKEY_REPLY
,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY
,
73 MGMT_OP_READ_LOCAL_OOB_DATA
,
74 MGMT_OP_ADD_REMOTE_OOB_DATA
,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA
,
76 MGMT_OP_START_DISCOVERY
,
77 MGMT_OP_STOP_DISCOVERY
,
80 MGMT_OP_UNBLOCK_DEVICE
,
81 MGMT_OP_SET_DEVICE_ID
,
82 MGMT_OP_SET_ADVERTISING
,
84 MGMT_OP_SET_STATIC_ADDRESS
,
85 MGMT_OP_SET_SCAN_PARAMS
,
86 MGMT_OP_SET_SECURE_CONN
,
87 MGMT_OP_SET_DEBUG_KEYS
,
90 MGMT_OP_GET_CONN_INFO
,
91 MGMT_OP_GET_CLOCK_INFO
,
93 MGMT_OP_REMOVE_DEVICE
,
94 MGMT_OP_LOAD_CONN_PARAM
,
95 MGMT_OP_READ_UNCONF_INDEX_LIST
,
96 MGMT_OP_READ_CONFIG_INFO
,
97 MGMT_OP_SET_EXTERNAL_CONFIG
,
98 MGMT_OP_SET_PUBLIC_ADDRESS
,
99 MGMT_OP_START_SERVICE_DISCOVERY
,
100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA
,
101 MGMT_OP_READ_EXT_INDEX_LIST
,
102 MGMT_OP_READ_ADV_FEATURES
,
103 MGMT_OP_ADD_ADVERTISING
,
104 MGMT_OP_REMOVE_ADVERTISING
,
105 MGMT_OP_GET_ADV_SIZE_INFO
,
106 MGMT_OP_START_LIMITED_DISCOVERY
,
107 MGMT_OP_READ_EXT_INFO
,
108 MGMT_OP_SET_APPEARANCE
,
111 static const u16 mgmt_events
[] = {
112 MGMT_EV_CONTROLLER_ERROR
,
114 MGMT_EV_INDEX_REMOVED
,
115 MGMT_EV_NEW_SETTINGS
,
116 MGMT_EV_CLASS_OF_DEV_CHANGED
,
117 MGMT_EV_LOCAL_NAME_CHANGED
,
118 MGMT_EV_NEW_LINK_KEY
,
119 MGMT_EV_NEW_LONG_TERM_KEY
,
120 MGMT_EV_DEVICE_CONNECTED
,
121 MGMT_EV_DEVICE_DISCONNECTED
,
122 MGMT_EV_CONNECT_FAILED
,
123 MGMT_EV_PIN_CODE_REQUEST
,
124 MGMT_EV_USER_CONFIRM_REQUEST
,
125 MGMT_EV_USER_PASSKEY_REQUEST
,
127 MGMT_EV_DEVICE_FOUND
,
129 MGMT_EV_DEVICE_BLOCKED
,
130 MGMT_EV_DEVICE_UNBLOCKED
,
131 MGMT_EV_DEVICE_UNPAIRED
,
132 MGMT_EV_PASSKEY_NOTIFY
,
135 MGMT_EV_DEVICE_ADDED
,
136 MGMT_EV_DEVICE_REMOVED
,
137 MGMT_EV_NEW_CONN_PARAM
,
138 MGMT_EV_UNCONF_INDEX_ADDED
,
139 MGMT_EV_UNCONF_INDEX_REMOVED
,
140 MGMT_EV_NEW_CONFIG_OPTIONS
,
141 MGMT_EV_EXT_INDEX_ADDED
,
142 MGMT_EV_EXT_INDEX_REMOVED
,
143 MGMT_EV_LOCAL_OOB_DATA_UPDATED
,
144 MGMT_EV_ADVERTISING_ADDED
,
145 MGMT_EV_ADVERTISING_REMOVED
,
146 MGMT_EV_EXT_INFO_CHANGED
,
149 static const u16 mgmt_untrusted_commands
[] = {
150 MGMT_OP_READ_INDEX_LIST
,
152 MGMT_OP_READ_UNCONF_INDEX_LIST
,
153 MGMT_OP_READ_CONFIG_INFO
,
154 MGMT_OP_READ_EXT_INDEX_LIST
,
155 MGMT_OP_READ_EXT_INFO
,
158 static const u16 mgmt_untrusted_events
[] = {
160 MGMT_EV_INDEX_REMOVED
,
161 MGMT_EV_NEW_SETTINGS
,
162 MGMT_EV_CLASS_OF_DEV_CHANGED
,
163 MGMT_EV_LOCAL_NAME_CHANGED
,
164 MGMT_EV_UNCONF_INDEX_ADDED
,
165 MGMT_EV_UNCONF_INDEX_REMOVED
,
166 MGMT_EV_NEW_CONFIG_OPTIONS
,
167 MGMT_EV_EXT_INDEX_ADDED
,
168 MGMT_EV_EXT_INDEX_REMOVED
,
169 MGMT_EV_EXT_INFO_CHANGED
,
172 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
174 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
175 "\x00\x00\x00\x00\x00\x00\x00\x00"
177 /* HCI to MGMT error code conversion table */
178 static u8 mgmt_status_table
[] = {
180 MGMT_STATUS_UNKNOWN_COMMAND
, /* Unknown Command */
181 MGMT_STATUS_NOT_CONNECTED
, /* No Connection */
182 MGMT_STATUS_FAILED
, /* Hardware Failure */
183 MGMT_STATUS_CONNECT_FAILED
, /* Page Timeout */
184 MGMT_STATUS_AUTH_FAILED
, /* Authentication Failed */
185 MGMT_STATUS_AUTH_FAILED
, /* PIN or Key Missing */
186 MGMT_STATUS_NO_RESOURCES
, /* Memory Full */
187 MGMT_STATUS_TIMEOUT
, /* Connection Timeout */
188 MGMT_STATUS_NO_RESOURCES
, /* Max Number of Connections */
189 MGMT_STATUS_NO_RESOURCES
, /* Max Number of SCO Connections */
190 MGMT_STATUS_ALREADY_CONNECTED
, /* ACL Connection Exists */
191 MGMT_STATUS_BUSY
, /* Command Disallowed */
192 MGMT_STATUS_NO_RESOURCES
, /* Rejected Limited Resources */
193 MGMT_STATUS_REJECTED
, /* Rejected Security */
194 MGMT_STATUS_REJECTED
, /* Rejected Personal */
195 MGMT_STATUS_TIMEOUT
, /* Host Timeout */
196 MGMT_STATUS_NOT_SUPPORTED
, /* Unsupported Feature */
197 MGMT_STATUS_INVALID_PARAMS
, /* Invalid Parameters */
198 MGMT_STATUS_DISCONNECTED
, /* OE User Ended Connection */
199 MGMT_STATUS_NO_RESOURCES
, /* OE Low Resources */
200 MGMT_STATUS_DISCONNECTED
, /* OE Power Off */
201 MGMT_STATUS_DISCONNECTED
, /* Connection Terminated */
202 MGMT_STATUS_BUSY
, /* Repeated Attempts */
203 MGMT_STATUS_REJECTED
, /* Pairing Not Allowed */
204 MGMT_STATUS_FAILED
, /* Unknown LMP PDU */
205 MGMT_STATUS_NOT_SUPPORTED
, /* Unsupported Remote Feature */
206 MGMT_STATUS_REJECTED
, /* SCO Offset Rejected */
207 MGMT_STATUS_REJECTED
, /* SCO Interval Rejected */
208 MGMT_STATUS_REJECTED
, /* Air Mode Rejected */
209 MGMT_STATUS_INVALID_PARAMS
, /* Invalid LMP Parameters */
210 MGMT_STATUS_FAILED
, /* Unspecified Error */
211 MGMT_STATUS_NOT_SUPPORTED
, /* Unsupported LMP Parameter Value */
212 MGMT_STATUS_FAILED
, /* Role Change Not Allowed */
213 MGMT_STATUS_TIMEOUT
, /* LMP Response Timeout */
214 MGMT_STATUS_FAILED
, /* LMP Error Transaction Collision */
215 MGMT_STATUS_FAILED
, /* LMP PDU Not Allowed */
216 MGMT_STATUS_REJECTED
, /* Encryption Mode Not Accepted */
217 MGMT_STATUS_FAILED
, /* Unit Link Key Used */
218 MGMT_STATUS_NOT_SUPPORTED
, /* QoS Not Supported */
219 MGMT_STATUS_TIMEOUT
, /* Instant Passed */
220 MGMT_STATUS_NOT_SUPPORTED
, /* Pairing Not Supported */
221 MGMT_STATUS_FAILED
, /* Transaction Collision */
222 MGMT_STATUS_INVALID_PARAMS
, /* Unacceptable Parameter */
223 MGMT_STATUS_REJECTED
, /* QoS Rejected */
224 MGMT_STATUS_NOT_SUPPORTED
, /* Classification Not Supported */
225 MGMT_STATUS_REJECTED
, /* Insufficient Security */
226 MGMT_STATUS_INVALID_PARAMS
, /* Parameter Out Of Range */
227 MGMT_STATUS_BUSY
, /* Role Switch Pending */
228 MGMT_STATUS_FAILED
, /* Slot Violation */
229 MGMT_STATUS_FAILED
, /* Role Switch Failed */
230 MGMT_STATUS_INVALID_PARAMS
, /* EIR Too Large */
231 MGMT_STATUS_NOT_SUPPORTED
, /* Simple Pairing Not Supported */
232 MGMT_STATUS_BUSY
, /* Host Busy Pairing */
233 MGMT_STATUS_REJECTED
, /* Rejected, No Suitable Channel */
234 MGMT_STATUS_BUSY
, /* Controller Busy */
235 MGMT_STATUS_INVALID_PARAMS
, /* Unsuitable Connection Interval */
236 MGMT_STATUS_TIMEOUT
, /* Directed Advertising Timeout */
237 MGMT_STATUS_AUTH_FAILED
, /* Terminated Due to MIC Failure */
238 MGMT_STATUS_CONNECT_FAILED
, /* Connection Establishment Failed */
239 MGMT_STATUS_CONNECT_FAILED
, /* MAC Connection Failed */
242 static u8
mgmt_status(u8 hci_status
)
244 if (hci_status
< ARRAY_SIZE(mgmt_status_table
))
245 return mgmt_status_table
[hci_status
];
247 return MGMT_STATUS_FAILED
;
250 static int mgmt_index_event(u16 event
, struct hci_dev
*hdev
, void *data
,
253 return mgmt_send_event(event
, hdev
, HCI_CHANNEL_CONTROL
, data
, len
,
257 static int mgmt_limited_event(u16 event
, struct hci_dev
*hdev
, void *data
,
258 u16 len
, int flag
, struct sock
*skip_sk
)
260 return mgmt_send_event(event
, hdev
, HCI_CHANNEL_CONTROL
, data
, len
,
264 static int mgmt_event(u16 event
, struct hci_dev
*hdev
, void *data
, u16 len
,
265 struct sock
*skip_sk
)
267 return mgmt_send_event(event
, hdev
, HCI_CHANNEL_CONTROL
, data
, len
,
268 HCI_SOCK_TRUSTED
, skip_sk
);
271 static u8
le_addr_type(u8 mgmt_addr_type
)
273 if (mgmt_addr_type
== BDADDR_LE_PUBLIC
)
274 return ADDR_LE_DEV_PUBLIC
;
276 return ADDR_LE_DEV_RANDOM
;
279 void mgmt_fill_version_info(void *ver
)
281 struct mgmt_rp_read_version
*rp
= ver
;
283 rp
->version
= MGMT_VERSION
;
284 rp
->revision
= cpu_to_le16(MGMT_REVISION
);
287 static int read_version(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
290 struct mgmt_rp_read_version rp
;
292 BT_DBG("sock %p", sk
);
294 mgmt_fill_version_info(&rp
);
296 return mgmt_cmd_complete(sk
, MGMT_INDEX_NONE
, MGMT_OP_READ_VERSION
, 0,
300 static int read_commands(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
303 struct mgmt_rp_read_commands
*rp
;
304 u16 num_commands
, num_events
;
308 BT_DBG("sock %p", sk
);
310 if (hci_sock_test_flag(sk
, HCI_SOCK_TRUSTED
)) {
311 num_commands
= ARRAY_SIZE(mgmt_commands
);
312 num_events
= ARRAY_SIZE(mgmt_events
);
314 num_commands
= ARRAY_SIZE(mgmt_untrusted_commands
);
315 num_events
= ARRAY_SIZE(mgmt_untrusted_events
);
318 rp_size
= sizeof(*rp
) + ((num_commands
+ num_events
) * sizeof(u16
));
320 rp
= kmalloc(rp_size
, GFP_KERNEL
);
324 rp
->num_commands
= cpu_to_le16(num_commands
);
325 rp
->num_events
= cpu_to_le16(num_events
);
327 if (hci_sock_test_flag(sk
, HCI_SOCK_TRUSTED
)) {
328 __le16
*opcode
= rp
->opcodes
;
330 for (i
= 0; i
< num_commands
; i
++, opcode
++)
331 put_unaligned_le16(mgmt_commands
[i
], opcode
);
333 for (i
= 0; i
< num_events
; i
++, opcode
++)
334 put_unaligned_le16(mgmt_events
[i
], opcode
);
336 __le16
*opcode
= rp
->opcodes
;
338 for (i
= 0; i
< num_commands
; i
++, opcode
++)
339 put_unaligned_le16(mgmt_untrusted_commands
[i
], opcode
);
341 for (i
= 0; i
< num_events
; i
++, opcode
++)
342 put_unaligned_le16(mgmt_untrusted_events
[i
], opcode
);
345 err
= mgmt_cmd_complete(sk
, MGMT_INDEX_NONE
, MGMT_OP_READ_COMMANDS
, 0,
352 static int read_index_list(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
355 struct mgmt_rp_read_index_list
*rp
;
361 BT_DBG("sock %p", sk
);
363 read_lock(&hci_dev_list_lock
);
366 list_for_each_entry(d
, &hci_dev_list
, list
) {
367 if (d
->dev_type
== HCI_PRIMARY
&&
368 !hci_dev_test_flag(d
, HCI_UNCONFIGURED
))
372 rp_len
= sizeof(*rp
) + (2 * count
);
373 rp
= kmalloc(rp_len
, GFP_ATOMIC
);
375 read_unlock(&hci_dev_list_lock
);
380 list_for_each_entry(d
, &hci_dev_list
, list
) {
381 if (hci_dev_test_flag(d
, HCI_SETUP
) ||
382 hci_dev_test_flag(d
, HCI_CONFIG
) ||
383 hci_dev_test_flag(d
, HCI_USER_CHANNEL
))
386 /* Devices marked as raw-only are neither configured
387 * nor unconfigured controllers.
389 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &d
->quirks
))
392 if (d
->dev_type
== HCI_PRIMARY
&&
393 !hci_dev_test_flag(d
, HCI_UNCONFIGURED
)) {
394 rp
->index
[count
++] = cpu_to_le16(d
->id
);
395 BT_DBG("Added hci%u", d
->id
);
399 rp
->num_controllers
= cpu_to_le16(count
);
400 rp_len
= sizeof(*rp
) + (2 * count
);
402 read_unlock(&hci_dev_list_lock
);
404 err
= mgmt_cmd_complete(sk
, MGMT_INDEX_NONE
, MGMT_OP_READ_INDEX_LIST
,
412 static int read_unconf_index_list(struct sock
*sk
, struct hci_dev
*hdev
,
413 void *data
, u16 data_len
)
415 struct mgmt_rp_read_unconf_index_list
*rp
;
421 BT_DBG("sock %p", sk
);
423 read_lock(&hci_dev_list_lock
);
426 list_for_each_entry(d
, &hci_dev_list
, list
) {
427 if (d
->dev_type
== HCI_PRIMARY
&&
428 hci_dev_test_flag(d
, HCI_UNCONFIGURED
))
432 rp_len
= sizeof(*rp
) + (2 * count
);
433 rp
= kmalloc(rp_len
, GFP_ATOMIC
);
435 read_unlock(&hci_dev_list_lock
);
440 list_for_each_entry(d
, &hci_dev_list
, list
) {
441 if (hci_dev_test_flag(d
, HCI_SETUP
) ||
442 hci_dev_test_flag(d
, HCI_CONFIG
) ||
443 hci_dev_test_flag(d
, HCI_USER_CHANNEL
))
446 /* Devices marked as raw-only are neither configured
447 * nor unconfigured controllers.
449 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &d
->quirks
))
452 if (d
->dev_type
== HCI_PRIMARY
&&
453 hci_dev_test_flag(d
, HCI_UNCONFIGURED
)) {
454 rp
->index
[count
++] = cpu_to_le16(d
->id
);
455 BT_DBG("Added hci%u", d
->id
);
459 rp
->num_controllers
= cpu_to_le16(count
);
460 rp_len
= sizeof(*rp
) + (2 * count
);
462 read_unlock(&hci_dev_list_lock
);
464 err
= mgmt_cmd_complete(sk
, MGMT_INDEX_NONE
,
465 MGMT_OP_READ_UNCONF_INDEX_LIST
, 0, rp
, rp_len
);
472 static int read_ext_index_list(struct sock
*sk
, struct hci_dev
*hdev
,
473 void *data
, u16 data_len
)
475 struct mgmt_rp_read_ext_index_list
*rp
;
481 BT_DBG("sock %p", sk
);
483 read_lock(&hci_dev_list_lock
);
486 list_for_each_entry(d
, &hci_dev_list
, list
) {
487 if (d
->dev_type
== HCI_PRIMARY
|| d
->dev_type
== HCI_AMP
)
491 rp_len
= sizeof(*rp
) + (sizeof(rp
->entry
[0]) * count
);
492 rp
= kmalloc(rp_len
, GFP_ATOMIC
);
494 read_unlock(&hci_dev_list_lock
);
499 list_for_each_entry(d
, &hci_dev_list
, list
) {
500 if (hci_dev_test_flag(d
, HCI_SETUP
) ||
501 hci_dev_test_flag(d
, HCI_CONFIG
) ||
502 hci_dev_test_flag(d
, HCI_USER_CHANNEL
))
505 /* Devices marked as raw-only are neither configured
506 * nor unconfigured controllers.
508 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &d
->quirks
))
511 if (d
->dev_type
== HCI_PRIMARY
) {
512 if (hci_dev_test_flag(d
, HCI_UNCONFIGURED
))
513 rp
->entry
[count
].type
= 0x01;
515 rp
->entry
[count
].type
= 0x00;
516 } else if (d
->dev_type
== HCI_AMP
) {
517 rp
->entry
[count
].type
= 0x02;
522 rp
->entry
[count
].bus
= d
->bus
;
523 rp
->entry
[count
++].index
= cpu_to_le16(d
->id
);
524 BT_DBG("Added hci%u", d
->id
);
527 rp
->num_controllers
= cpu_to_le16(count
);
528 rp_len
= sizeof(*rp
) + (sizeof(rp
->entry
[0]) * count
);
530 read_unlock(&hci_dev_list_lock
);
532 /* If this command is called at least once, then all the
533 * default index and unconfigured index events are disabled
534 * and from now on only extended index events are used.
536 hci_sock_set_flag(sk
, HCI_MGMT_EXT_INDEX_EVENTS
);
537 hci_sock_clear_flag(sk
, HCI_MGMT_INDEX_EVENTS
);
538 hci_sock_clear_flag(sk
, HCI_MGMT_UNCONF_INDEX_EVENTS
);
540 err
= mgmt_cmd_complete(sk
, MGMT_INDEX_NONE
,
541 MGMT_OP_READ_EXT_INDEX_LIST
, 0, rp
, rp_len
);
548 static bool is_configured(struct hci_dev
*hdev
)
550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG
, &hdev
->quirks
) &&
551 !hci_dev_test_flag(hdev
, HCI_EXT_CONFIGURED
))
554 if (test_bit(HCI_QUIRK_INVALID_BDADDR
, &hdev
->quirks
) &&
555 !bacmp(&hdev
->public_addr
, BDADDR_ANY
))
561 static __le32
get_missing_options(struct hci_dev
*hdev
)
565 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG
, &hdev
->quirks
) &&
566 !hci_dev_test_flag(hdev
, HCI_EXT_CONFIGURED
))
567 options
|= MGMT_OPTION_EXTERNAL_CONFIG
;
569 if (test_bit(HCI_QUIRK_INVALID_BDADDR
, &hdev
->quirks
) &&
570 !bacmp(&hdev
->public_addr
, BDADDR_ANY
))
571 options
|= MGMT_OPTION_PUBLIC_ADDRESS
;
573 return cpu_to_le32(options
);
576 static int new_options(struct hci_dev
*hdev
, struct sock
*skip
)
578 __le32 options
= get_missing_options(hdev
);
580 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS
, hdev
, &options
,
581 sizeof(options
), HCI_MGMT_OPTION_EVENTS
, skip
);
584 static int send_options_rsp(struct sock
*sk
, u16 opcode
, struct hci_dev
*hdev
)
586 __le32 options
= get_missing_options(hdev
);
588 return mgmt_cmd_complete(sk
, hdev
->id
, opcode
, 0, &options
,
592 static int read_config_info(struct sock
*sk
, struct hci_dev
*hdev
,
593 void *data
, u16 data_len
)
595 struct mgmt_rp_read_config_info rp
;
598 BT_DBG("sock %p %s", sk
, hdev
->name
);
602 memset(&rp
, 0, sizeof(rp
));
603 rp
.manufacturer
= cpu_to_le16(hdev
->manufacturer
);
605 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG
, &hdev
->quirks
))
606 options
|= MGMT_OPTION_EXTERNAL_CONFIG
;
608 if (hdev
->set_bdaddr
)
609 options
|= MGMT_OPTION_PUBLIC_ADDRESS
;
611 rp
.supported_options
= cpu_to_le32(options
);
612 rp
.missing_options
= get_missing_options(hdev
);
614 hci_dev_unlock(hdev
);
616 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_READ_CONFIG_INFO
, 0,
620 static u32
get_supported_settings(struct hci_dev
*hdev
)
624 settings
|= MGMT_SETTING_POWERED
;
625 settings
|= MGMT_SETTING_BONDABLE
;
626 settings
|= MGMT_SETTING_DEBUG_KEYS
;
627 settings
|= MGMT_SETTING_CONNECTABLE
;
628 settings
|= MGMT_SETTING_DISCOVERABLE
;
630 if (lmp_bredr_capable(hdev
)) {
631 if (hdev
->hci_ver
>= BLUETOOTH_VER_1_2
)
632 settings
|= MGMT_SETTING_FAST_CONNECTABLE
;
633 settings
|= MGMT_SETTING_BREDR
;
634 settings
|= MGMT_SETTING_LINK_SECURITY
;
636 if (lmp_ssp_capable(hdev
)) {
637 settings
|= MGMT_SETTING_SSP
;
638 settings
|= MGMT_SETTING_HS
;
641 if (lmp_sc_capable(hdev
))
642 settings
|= MGMT_SETTING_SECURE_CONN
;
645 if (lmp_le_capable(hdev
)) {
646 settings
|= MGMT_SETTING_LE
;
647 settings
|= MGMT_SETTING_ADVERTISING
;
648 settings
|= MGMT_SETTING_SECURE_CONN
;
649 settings
|= MGMT_SETTING_PRIVACY
;
650 settings
|= MGMT_SETTING_STATIC_ADDRESS
;
653 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG
, &hdev
->quirks
) ||
655 settings
|= MGMT_SETTING_CONFIGURATION
;
660 static u32
get_current_settings(struct hci_dev
*hdev
)
664 if (hdev_is_powered(hdev
))
665 settings
|= MGMT_SETTING_POWERED
;
667 if (hci_dev_test_flag(hdev
, HCI_CONNECTABLE
))
668 settings
|= MGMT_SETTING_CONNECTABLE
;
670 if (hci_dev_test_flag(hdev
, HCI_FAST_CONNECTABLE
))
671 settings
|= MGMT_SETTING_FAST_CONNECTABLE
;
673 if (hci_dev_test_flag(hdev
, HCI_DISCOVERABLE
))
674 settings
|= MGMT_SETTING_DISCOVERABLE
;
676 if (hci_dev_test_flag(hdev
, HCI_BONDABLE
))
677 settings
|= MGMT_SETTING_BONDABLE
;
679 if (hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
))
680 settings
|= MGMT_SETTING_BREDR
;
682 if (hci_dev_test_flag(hdev
, HCI_LE_ENABLED
))
683 settings
|= MGMT_SETTING_LE
;
685 if (hci_dev_test_flag(hdev
, HCI_LINK_SECURITY
))
686 settings
|= MGMT_SETTING_LINK_SECURITY
;
688 if (hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
))
689 settings
|= MGMT_SETTING_SSP
;
691 if (hci_dev_test_flag(hdev
, HCI_HS_ENABLED
))
692 settings
|= MGMT_SETTING_HS
;
694 if (hci_dev_test_flag(hdev
, HCI_ADVERTISING
))
695 settings
|= MGMT_SETTING_ADVERTISING
;
697 if (hci_dev_test_flag(hdev
, HCI_SC_ENABLED
))
698 settings
|= MGMT_SETTING_SECURE_CONN
;
700 if (hci_dev_test_flag(hdev
, HCI_KEEP_DEBUG_KEYS
))
701 settings
|= MGMT_SETTING_DEBUG_KEYS
;
703 if (hci_dev_test_flag(hdev
, HCI_PRIVACY
))
704 settings
|= MGMT_SETTING_PRIVACY
;
706 /* The current setting for static address has two purposes. The
707 * first is to indicate if the static address will be used and
708 * the second is to indicate if it is actually set.
710 * This means if the static address is not configured, this flag
711 * will never be set. If the address is configured, then if the
712 * address is actually used decides if the flag is set or not.
714 * For single mode LE only controllers and dual-mode controllers
715 * with BR/EDR disabled, the existence of the static address will
718 if (hci_dev_test_flag(hdev
, HCI_FORCE_STATIC_ADDR
) ||
719 !hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
) ||
720 !bacmp(&hdev
->bdaddr
, BDADDR_ANY
)) {
721 if (bacmp(&hdev
->static_addr
, BDADDR_ANY
))
722 settings
|= MGMT_SETTING_STATIC_ADDRESS
;
728 static struct mgmt_pending_cmd
*pending_find(u16 opcode
, struct hci_dev
*hdev
)
730 return mgmt_pending_find(HCI_CHANNEL_CONTROL
, opcode
, hdev
);
733 static struct mgmt_pending_cmd
*pending_find_data(u16 opcode
,
734 struct hci_dev
*hdev
,
737 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL
, opcode
, hdev
, data
);
740 u8
mgmt_get_adv_discov_flags(struct hci_dev
*hdev
)
742 struct mgmt_pending_cmd
*cmd
;
744 /* If there's a pending mgmt command the flags will not yet have
745 * their final values, so check for this first.
747 cmd
= pending_find(MGMT_OP_SET_DISCOVERABLE
, hdev
);
749 struct mgmt_mode
*cp
= cmd
->param
;
751 return LE_AD_GENERAL
;
752 else if (cp
->val
== 0x02)
753 return LE_AD_LIMITED
;
755 if (hci_dev_test_flag(hdev
, HCI_LIMITED_DISCOVERABLE
))
756 return LE_AD_LIMITED
;
757 else if (hci_dev_test_flag(hdev
, HCI_DISCOVERABLE
))
758 return LE_AD_GENERAL
;
764 bool mgmt_get_connectable(struct hci_dev
*hdev
)
766 struct mgmt_pending_cmd
*cmd
;
768 /* If there's a pending mgmt command the flag will not yet have
769 * it's final value, so check for this first.
771 cmd
= pending_find(MGMT_OP_SET_CONNECTABLE
, hdev
);
773 struct mgmt_mode
*cp
= cmd
->param
;
778 return hci_dev_test_flag(hdev
, HCI_CONNECTABLE
);
781 static void service_cache_off(struct work_struct
*work
)
783 struct hci_dev
*hdev
= container_of(work
, struct hci_dev
,
785 struct hci_request req
;
787 if (!hci_dev_test_and_clear_flag(hdev
, HCI_SERVICE_CACHE
))
790 hci_req_init(&req
, hdev
);
794 __hci_req_update_eir(&req
);
795 __hci_req_update_class(&req
);
797 hci_dev_unlock(hdev
);
799 hci_req_run(&req
, NULL
);
802 static void rpa_expired(struct work_struct
*work
)
804 struct hci_dev
*hdev
= container_of(work
, struct hci_dev
,
806 struct hci_request req
;
810 hci_dev_set_flag(hdev
, HCI_RPA_EXPIRED
);
812 if (!hci_dev_test_flag(hdev
, HCI_ADVERTISING
))
815 /* The generation of a new RPA and programming it into the
816 * controller happens in the hci_req_enable_advertising()
819 hci_req_init(&req
, hdev
);
820 __hci_req_enable_advertising(&req
);
821 hci_req_run(&req
, NULL
);
824 static void mgmt_init_hdev(struct sock
*sk
, struct hci_dev
*hdev
)
826 if (hci_dev_test_and_set_flag(hdev
, HCI_MGMT
))
829 INIT_DELAYED_WORK(&hdev
->service_cache
, service_cache_off
);
830 INIT_DELAYED_WORK(&hdev
->rpa_expired
, rpa_expired
);
832 /* Non-mgmt controlled devices get this bit set
833 * implicitly so that pairing works for them, however
834 * for mgmt we require user-space to explicitly enable
837 hci_dev_clear_flag(hdev
, HCI_BONDABLE
);
840 static int read_controller_info(struct sock
*sk
, struct hci_dev
*hdev
,
841 void *data
, u16 data_len
)
843 struct mgmt_rp_read_info rp
;
845 BT_DBG("sock %p %s", sk
, hdev
->name
);
849 memset(&rp
, 0, sizeof(rp
));
851 bacpy(&rp
.bdaddr
, &hdev
->bdaddr
);
853 rp
.version
= hdev
->hci_ver
;
854 rp
.manufacturer
= cpu_to_le16(hdev
->manufacturer
);
856 rp
.supported_settings
= cpu_to_le32(get_supported_settings(hdev
));
857 rp
.current_settings
= cpu_to_le32(get_current_settings(hdev
));
859 memcpy(rp
.dev_class
, hdev
->dev_class
, 3);
861 memcpy(rp
.name
, hdev
->dev_name
, sizeof(hdev
->dev_name
));
862 memcpy(rp
.short_name
, hdev
->short_name
, sizeof(hdev
->short_name
));
864 hci_dev_unlock(hdev
);
866 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_READ_INFO
, 0, &rp
,
870 static u16
append_eir_data_to_buf(struct hci_dev
*hdev
, u8
*eir
)
875 if (hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
))
876 eir_len
= eir_append_data(eir
, eir_len
, EIR_CLASS_OF_DEV
,
879 if (hci_dev_test_flag(hdev
, HCI_LE_ENABLED
))
880 eir_len
= eir_append_le16(eir
, eir_len
, EIR_APPEARANCE
,
883 name_len
= strlen(hdev
->dev_name
);
884 eir_len
= eir_append_data(eir
, eir_len
, EIR_NAME_COMPLETE
,
885 hdev
->dev_name
, name_len
);
887 name_len
= strlen(hdev
->short_name
);
888 eir_len
= eir_append_data(eir
, eir_len
, EIR_NAME_SHORT
,
889 hdev
->short_name
, name_len
);
894 static int read_ext_controller_info(struct sock
*sk
, struct hci_dev
*hdev
,
895 void *data
, u16 data_len
)
898 struct mgmt_rp_read_ext_info
*rp
= (void *)buf
;
901 BT_DBG("sock %p %s", sk
, hdev
->name
);
903 memset(&buf
, 0, sizeof(buf
));
907 bacpy(&rp
->bdaddr
, &hdev
->bdaddr
);
909 rp
->version
= hdev
->hci_ver
;
910 rp
->manufacturer
= cpu_to_le16(hdev
->manufacturer
);
912 rp
->supported_settings
= cpu_to_le32(get_supported_settings(hdev
));
913 rp
->current_settings
= cpu_to_le32(get_current_settings(hdev
));
916 eir_len
= append_eir_data_to_buf(hdev
, rp
->eir
);
917 rp
->eir_len
= cpu_to_le16(eir_len
);
919 hci_dev_unlock(hdev
);
921 /* If this command is called at least once, then the events
922 * for class of device and local name changes are disabled
923 * and only the new extended controller information event
926 hci_sock_set_flag(sk
, HCI_MGMT_EXT_INFO_EVENTS
);
927 hci_sock_clear_flag(sk
, HCI_MGMT_DEV_CLASS_EVENTS
);
928 hci_sock_clear_flag(sk
, HCI_MGMT_LOCAL_NAME_EVENTS
);
930 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_READ_EXT_INFO
, 0, rp
,
931 sizeof(*rp
) + eir_len
);
934 static int ext_info_changed(struct hci_dev
*hdev
, struct sock
*skip
)
937 struct mgmt_ev_ext_info_changed
*ev
= (void *)buf
;
940 memset(buf
, 0, sizeof(buf
));
942 eir_len
= append_eir_data_to_buf(hdev
, ev
->eir
);
943 ev
->eir_len
= cpu_to_le16(eir_len
);
945 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED
, hdev
, ev
,
946 sizeof(*ev
) + eir_len
,
947 HCI_MGMT_EXT_INFO_EVENTS
, skip
);
950 static int send_settings_rsp(struct sock
*sk
, u16 opcode
, struct hci_dev
*hdev
)
952 __le32 settings
= cpu_to_le32(get_current_settings(hdev
));
954 return mgmt_cmd_complete(sk
, hdev
->id
, opcode
, 0, &settings
,
958 static void clean_up_hci_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
960 BT_DBG("%s status 0x%02x", hdev
->name
, status
);
962 if (hci_conn_count(hdev
) == 0) {
963 cancel_delayed_work(&hdev
->power_off
);
964 queue_work(hdev
->req_workqueue
, &hdev
->power_off
.work
);
968 void mgmt_advertising_added(struct sock
*sk
, struct hci_dev
*hdev
, u8 instance
)
970 struct mgmt_ev_advertising_added ev
;
972 ev
.instance
= instance
;
974 mgmt_event(MGMT_EV_ADVERTISING_ADDED
, hdev
, &ev
, sizeof(ev
), sk
);
977 void mgmt_advertising_removed(struct sock
*sk
, struct hci_dev
*hdev
,
980 struct mgmt_ev_advertising_removed ev
;
982 ev
.instance
= instance
;
984 mgmt_event(MGMT_EV_ADVERTISING_REMOVED
, hdev
, &ev
, sizeof(ev
), sk
);
987 static void cancel_adv_timeout(struct hci_dev
*hdev
)
989 if (hdev
->adv_instance_timeout
) {
990 hdev
->adv_instance_timeout
= 0;
991 cancel_delayed_work(&hdev
->adv_instance_expire
);
995 static int clean_up_hci_state(struct hci_dev
*hdev
)
997 struct hci_request req
;
998 struct hci_conn
*conn
;
1002 hci_req_init(&req
, hdev
);
1004 if (test_bit(HCI_ISCAN
, &hdev
->flags
) ||
1005 test_bit(HCI_PSCAN
, &hdev
->flags
)) {
1007 hci_req_add(&req
, HCI_OP_WRITE_SCAN_ENABLE
, 1, &scan
);
1010 hci_req_clear_adv_instance(hdev
, NULL
, NULL
, 0x00, false);
1012 if (hci_dev_test_flag(hdev
, HCI_LE_ADV
))
1013 __hci_req_disable_advertising(&req
);
1015 discov_stopped
= hci_req_stop_discovery(&req
);
1017 list_for_each_entry(conn
, &hdev
->conn_hash
.list
, list
) {
1018 /* 0x15 == Terminated due to Power Off */
1019 __hci_abort_conn(&req
, conn
, 0x15);
1022 err
= hci_req_run(&req
, clean_up_hci_complete
);
1023 if (!err
&& discov_stopped
)
1024 hci_discovery_set_state(hdev
, DISCOVERY_STOPPING
);
1029 static int set_powered(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
1032 struct mgmt_mode
*cp
= data
;
1033 struct mgmt_pending_cmd
*cmd
;
1036 BT_DBG("request for %s", hdev
->name
);
1038 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1039 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_POWERED
,
1040 MGMT_STATUS_INVALID_PARAMS
);
1044 if (pending_find(MGMT_OP_SET_POWERED
, hdev
)) {
1045 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_POWERED
,
1050 if (!!cp
->val
== hdev_is_powered(hdev
)) {
1051 err
= send_settings_rsp(sk
, MGMT_OP_SET_POWERED
, hdev
);
1055 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_POWERED
, hdev
, data
, len
);
1062 queue_work(hdev
->req_workqueue
, &hdev
->power_on
);
1065 /* Disconnect connections, stop scans, etc */
1066 err
= clean_up_hci_state(hdev
);
1068 queue_delayed_work(hdev
->req_workqueue
, &hdev
->power_off
,
1069 HCI_POWER_OFF_TIMEOUT
);
1071 /* ENODATA means there were no HCI commands queued */
1072 if (err
== -ENODATA
) {
1073 cancel_delayed_work(&hdev
->power_off
);
1074 queue_work(hdev
->req_workqueue
, &hdev
->power_off
.work
);
1080 hci_dev_unlock(hdev
);
1084 static int new_settings(struct hci_dev
*hdev
, struct sock
*skip
)
1086 __le32 ev
= cpu_to_le32(get_current_settings(hdev
));
1088 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS
, hdev
, &ev
,
1089 sizeof(ev
), HCI_MGMT_SETTING_EVENTS
, skip
);
1092 int mgmt_new_settings(struct hci_dev
*hdev
)
1094 return new_settings(hdev
, NULL
);
1099 struct hci_dev
*hdev
;
1103 static void settings_rsp(struct mgmt_pending_cmd
*cmd
, void *data
)
1105 struct cmd_lookup
*match
= data
;
1107 send_settings_rsp(cmd
->sk
, cmd
->opcode
, match
->hdev
);
1109 list_del(&cmd
->list
);
1111 if (match
->sk
== NULL
) {
1112 match
->sk
= cmd
->sk
;
1113 sock_hold(match
->sk
);
1116 mgmt_pending_free(cmd
);
1119 static void cmd_status_rsp(struct mgmt_pending_cmd
*cmd
, void *data
)
1123 mgmt_cmd_status(cmd
->sk
, cmd
->index
, cmd
->opcode
, *status
);
1124 mgmt_pending_remove(cmd
);
1127 static void cmd_complete_rsp(struct mgmt_pending_cmd
*cmd
, void *data
)
1129 if (cmd
->cmd_complete
) {
1132 cmd
->cmd_complete(cmd
, *status
);
1133 mgmt_pending_remove(cmd
);
1138 cmd_status_rsp(cmd
, data
);
1141 static int generic_cmd_complete(struct mgmt_pending_cmd
*cmd
, u8 status
)
1143 return mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
, status
,
1144 cmd
->param
, cmd
->param_len
);
1147 static int addr_cmd_complete(struct mgmt_pending_cmd
*cmd
, u8 status
)
1149 return mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
, status
,
1150 cmd
->param
, sizeof(struct mgmt_addr_info
));
1153 static u8
mgmt_bredr_support(struct hci_dev
*hdev
)
1155 if (!lmp_bredr_capable(hdev
))
1156 return MGMT_STATUS_NOT_SUPPORTED
;
1157 else if (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
))
1158 return MGMT_STATUS_REJECTED
;
1160 return MGMT_STATUS_SUCCESS
;
1163 static u8
mgmt_le_support(struct hci_dev
*hdev
)
1165 if (!lmp_le_capable(hdev
))
1166 return MGMT_STATUS_NOT_SUPPORTED
;
1167 else if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
))
1168 return MGMT_STATUS_REJECTED
;
1170 return MGMT_STATUS_SUCCESS
;
1173 void mgmt_set_discoverable_complete(struct hci_dev
*hdev
, u8 status
)
1175 struct mgmt_pending_cmd
*cmd
;
1177 BT_DBG("status 0x%02x", status
);
1181 cmd
= pending_find(MGMT_OP_SET_DISCOVERABLE
, hdev
);
1186 u8 mgmt_err
= mgmt_status(status
);
1187 mgmt_cmd_status(cmd
->sk
, cmd
->index
, cmd
->opcode
, mgmt_err
);
1188 hci_dev_clear_flag(hdev
, HCI_LIMITED_DISCOVERABLE
);
1192 if (hci_dev_test_flag(hdev
, HCI_DISCOVERABLE
) &&
1193 hdev
->discov_timeout
> 0) {
1194 int to
= msecs_to_jiffies(hdev
->discov_timeout
* 1000);
1195 queue_delayed_work(hdev
->req_workqueue
, &hdev
->discov_off
, to
);
1198 send_settings_rsp(cmd
->sk
, MGMT_OP_SET_DISCOVERABLE
, hdev
);
1199 new_settings(hdev
, cmd
->sk
);
1202 mgmt_pending_remove(cmd
);
1205 hci_dev_unlock(hdev
);
1208 static int set_discoverable(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
1211 struct mgmt_cp_set_discoverable
*cp
= data
;
1212 struct mgmt_pending_cmd
*cmd
;
1216 BT_DBG("request for %s", hdev
->name
);
1218 if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
) &&
1219 !hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
))
1220 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DISCOVERABLE
,
1221 MGMT_STATUS_REJECTED
);
1223 if (cp
->val
!= 0x00 && cp
->val
!= 0x01 && cp
->val
!= 0x02)
1224 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DISCOVERABLE
,
1225 MGMT_STATUS_INVALID_PARAMS
);
1227 timeout
= __le16_to_cpu(cp
->timeout
);
1229 /* Disabling discoverable requires that no timeout is set,
1230 * and enabling limited discoverable requires a timeout.
1232 if ((cp
->val
== 0x00 && timeout
> 0) ||
1233 (cp
->val
== 0x02 && timeout
== 0))
1234 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DISCOVERABLE
,
1235 MGMT_STATUS_INVALID_PARAMS
);
1239 if (!hdev_is_powered(hdev
) && timeout
> 0) {
1240 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DISCOVERABLE
,
1241 MGMT_STATUS_NOT_POWERED
);
1245 if (pending_find(MGMT_OP_SET_DISCOVERABLE
, hdev
) ||
1246 pending_find(MGMT_OP_SET_CONNECTABLE
, hdev
)) {
1247 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DISCOVERABLE
,
1252 if (!hci_dev_test_flag(hdev
, HCI_CONNECTABLE
)) {
1253 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DISCOVERABLE
,
1254 MGMT_STATUS_REJECTED
);
1258 if (!hdev_is_powered(hdev
)) {
1259 bool changed
= false;
1261 /* Setting limited discoverable when powered off is
1262 * not a valid operation since it requires a timeout
1263 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1265 if (!!cp
->val
!= hci_dev_test_flag(hdev
, HCI_DISCOVERABLE
)) {
1266 hci_dev_change_flag(hdev
, HCI_DISCOVERABLE
);
1270 err
= send_settings_rsp(sk
, MGMT_OP_SET_DISCOVERABLE
, hdev
);
1275 err
= new_settings(hdev
, sk
);
1280 /* If the current mode is the same, then just update the timeout
1281 * value with the new value. And if only the timeout gets updated,
1282 * then no need for any HCI transactions.
1284 if (!!cp
->val
== hci_dev_test_flag(hdev
, HCI_DISCOVERABLE
) &&
1285 (cp
->val
== 0x02) == hci_dev_test_flag(hdev
,
1286 HCI_LIMITED_DISCOVERABLE
)) {
1287 cancel_delayed_work(&hdev
->discov_off
);
1288 hdev
->discov_timeout
= timeout
;
1290 if (cp
->val
&& hdev
->discov_timeout
> 0) {
1291 int to
= msecs_to_jiffies(hdev
->discov_timeout
* 1000);
1292 queue_delayed_work(hdev
->req_workqueue
,
1293 &hdev
->discov_off
, to
);
1296 err
= send_settings_rsp(sk
, MGMT_OP_SET_DISCOVERABLE
, hdev
);
1300 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_DISCOVERABLE
, hdev
, data
, len
);
1306 /* Cancel any potential discoverable timeout that might be
1307 * still active and store new timeout value. The arming of
1308 * the timeout happens in the complete handler.
1310 cancel_delayed_work(&hdev
->discov_off
);
1311 hdev
->discov_timeout
= timeout
;
1314 hci_dev_set_flag(hdev
, HCI_DISCOVERABLE
);
1316 hci_dev_clear_flag(hdev
, HCI_DISCOVERABLE
);
1318 /* Limited discoverable mode */
1319 if (cp
->val
== 0x02)
1320 hci_dev_set_flag(hdev
, HCI_LIMITED_DISCOVERABLE
);
1322 hci_dev_clear_flag(hdev
, HCI_LIMITED_DISCOVERABLE
);
1324 queue_work(hdev
->req_workqueue
, &hdev
->discoverable_update
);
1328 hci_dev_unlock(hdev
);
1332 void mgmt_set_connectable_complete(struct hci_dev
*hdev
, u8 status
)
1334 struct mgmt_pending_cmd
*cmd
;
1336 BT_DBG("status 0x%02x", status
);
1340 cmd
= pending_find(MGMT_OP_SET_CONNECTABLE
, hdev
);
1345 u8 mgmt_err
= mgmt_status(status
);
1346 mgmt_cmd_status(cmd
->sk
, cmd
->index
, cmd
->opcode
, mgmt_err
);
1350 send_settings_rsp(cmd
->sk
, MGMT_OP_SET_CONNECTABLE
, hdev
);
1351 new_settings(hdev
, cmd
->sk
);
1354 mgmt_pending_remove(cmd
);
1357 hci_dev_unlock(hdev
);
1360 static int set_connectable_update_settings(struct hci_dev
*hdev
,
1361 struct sock
*sk
, u8 val
)
1363 bool changed
= false;
1366 if (!!val
!= hci_dev_test_flag(hdev
, HCI_CONNECTABLE
))
1370 hci_dev_set_flag(hdev
, HCI_CONNECTABLE
);
1372 hci_dev_clear_flag(hdev
, HCI_CONNECTABLE
);
1373 hci_dev_clear_flag(hdev
, HCI_DISCOVERABLE
);
1376 err
= send_settings_rsp(sk
, MGMT_OP_SET_CONNECTABLE
, hdev
);
1381 hci_req_update_scan(hdev
);
1382 hci_update_background_scan(hdev
);
1383 return new_settings(hdev
, sk
);
1389 static int set_connectable(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
1392 struct mgmt_mode
*cp
= data
;
1393 struct mgmt_pending_cmd
*cmd
;
1396 BT_DBG("request for %s", hdev
->name
);
1398 if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
) &&
1399 !hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
))
1400 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_CONNECTABLE
,
1401 MGMT_STATUS_REJECTED
);
1403 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1404 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_CONNECTABLE
,
1405 MGMT_STATUS_INVALID_PARAMS
);
1409 if (!hdev_is_powered(hdev
)) {
1410 err
= set_connectable_update_settings(hdev
, sk
, cp
->val
);
1414 if (pending_find(MGMT_OP_SET_DISCOVERABLE
, hdev
) ||
1415 pending_find(MGMT_OP_SET_CONNECTABLE
, hdev
)) {
1416 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_CONNECTABLE
,
1421 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_CONNECTABLE
, hdev
, data
, len
);
1428 hci_dev_set_flag(hdev
, HCI_CONNECTABLE
);
1430 if (hdev
->discov_timeout
> 0)
1431 cancel_delayed_work(&hdev
->discov_off
);
1433 hci_dev_clear_flag(hdev
, HCI_LIMITED_DISCOVERABLE
);
1434 hci_dev_clear_flag(hdev
, HCI_DISCOVERABLE
);
1435 hci_dev_clear_flag(hdev
, HCI_CONNECTABLE
);
1438 queue_work(hdev
->req_workqueue
, &hdev
->connectable_update
);
1442 hci_dev_unlock(hdev
);
1446 static int set_bondable(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
1449 struct mgmt_mode
*cp
= data
;
1453 BT_DBG("request for %s", hdev
->name
);
1455 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1456 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BONDABLE
,
1457 MGMT_STATUS_INVALID_PARAMS
);
1462 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_BONDABLE
);
1464 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_BONDABLE
);
1466 err
= send_settings_rsp(sk
, MGMT_OP_SET_BONDABLE
, hdev
);
1471 /* In limited privacy mode the change of bondable mode
1472 * may affect the local advertising address.
1474 if (hdev_is_powered(hdev
) &&
1475 hci_dev_test_flag(hdev
, HCI_ADVERTISING
) &&
1476 hci_dev_test_flag(hdev
, HCI_DISCOVERABLE
) &&
1477 hci_dev_test_flag(hdev
, HCI_LIMITED_PRIVACY
))
1478 queue_work(hdev
->req_workqueue
,
1479 &hdev
->discoverable_update
);
1481 err
= new_settings(hdev
, sk
);
1485 hci_dev_unlock(hdev
);
1489 static int set_link_security(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
1492 struct mgmt_mode
*cp
= data
;
1493 struct mgmt_pending_cmd
*cmd
;
1497 BT_DBG("request for %s", hdev
->name
);
1499 status
= mgmt_bredr_support(hdev
);
1501 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LINK_SECURITY
,
1504 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1505 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LINK_SECURITY
,
1506 MGMT_STATUS_INVALID_PARAMS
);
1510 if (!hdev_is_powered(hdev
)) {
1511 bool changed
= false;
1513 if (!!cp
->val
!= hci_dev_test_flag(hdev
, HCI_LINK_SECURITY
)) {
1514 hci_dev_change_flag(hdev
, HCI_LINK_SECURITY
);
1518 err
= send_settings_rsp(sk
, MGMT_OP_SET_LINK_SECURITY
, hdev
);
1523 err
= new_settings(hdev
, sk
);
1528 if (pending_find(MGMT_OP_SET_LINK_SECURITY
, hdev
)) {
1529 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LINK_SECURITY
,
1536 if (test_bit(HCI_AUTH
, &hdev
->flags
) == val
) {
1537 err
= send_settings_rsp(sk
, MGMT_OP_SET_LINK_SECURITY
, hdev
);
1541 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_LINK_SECURITY
, hdev
, data
, len
);
1547 err
= hci_send_cmd(hdev
, HCI_OP_WRITE_AUTH_ENABLE
, sizeof(val
), &val
);
1549 mgmt_pending_remove(cmd
);
1554 hci_dev_unlock(hdev
);
1558 static int set_ssp(struct sock
*sk
, struct hci_dev
*hdev
, void *data
, u16 len
)
1560 struct mgmt_mode
*cp
= data
;
1561 struct mgmt_pending_cmd
*cmd
;
1565 BT_DBG("request for %s", hdev
->name
);
1567 status
= mgmt_bredr_support(hdev
);
1569 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SSP
, status
);
1571 if (!lmp_ssp_capable(hdev
))
1572 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SSP
,
1573 MGMT_STATUS_NOT_SUPPORTED
);
1575 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1576 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SSP
,
1577 MGMT_STATUS_INVALID_PARAMS
);
1581 if (!hdev_is_powered(hdev
)) {
1585 changed
= !hci_dev_test_and_set_flag(hdev
,
1588 changed
= hci_dev_test_and_clear_flag(hdev
,
1591 changed
= hci_dev_test_and_clear_flag(hdev
,
1594 hci_dev_clear_flag(hdev
, HCI_HS_ENABLED
);
1597 err
= send_settings_rsp(sk
, MGMT_OP_SET_SSP
, hdev
);
1602 err
= new_settings(hdev
, sk
);
1607 if (pending_find(MGMT_OP_SET_SSP
, hdev
)) {
1608 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SSP
,
1613 if (!!cp
->val
== hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
)) {
1614 err
= send_settings_rsp(sk
, MGMT_OP_SET_SSP
, hdev
);
1618 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_SSP
, hdev
, data
, len
);
1624 if (!cp
->val
&& hci_dev_test_flag(hdev
, HCI_USE_DEBUG_KEYS
))
1625 hci_send_cmd(hdev
, HCI_OP_WRITE_SSP_DEBUG_MODE
,
1626 sizeof(cp
->val
), &cp
->val
);
1628 err
= hci_send_cmd(hdev
, HCI_OP_WRITE_SSP_MODE
, 1, &cp
->val
);
1630 mgmt_pending_remove(cmd
);
1635 hci_dev_unlock(hdev
);
1639 static int set_hs(struct sock
*sk
, struct hci_dev
*hdev
, void *data
, u16 len
)
1641 struct mgmt_mode
*cp
= data
;
1646 BT_DBG("request for %s", hdev
->name
);
1648 status
= mgmt_bredr_support(hdev
);
1650 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_HS
, status
);
1652 if (!lmp_ssp_capable(hdev
))
1653 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_HS
,
1654 MGMT_STATUS_NOT_SUPPORTED
);
1656 if (!hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
))
1657 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_HS
,
1658 MGMT_STATUS_REJECTED
);
1660 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1661 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_HS
,
1662 MGMT_STATUS_INVALID_PARAMS
);
1666 if (pending_find(MGMT_OP_SET_SSP
, hdev
)) {
1667 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_HS
,
1673 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_HS_ENABLED
);
1675 if (hdev_is_powered(hdev
)) {
1676 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_HS
,
1677 MGMT_STATUS_REJECTED
);
1681 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_HS_ENABLED
);
1684 err
= send_settings_rsp(sk
, MGMT_OP_SET_HS
, hdev
);
1689 err
= new_settings(hdev
, sk
);
1692 hci_dev_unlock(hdev
);
1696 static void le_enable_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
1698 struct cmd_lookup match
= { NULL
, hdev
};
1703 u8 mgmt_err
= mgmt_status(status
);
1705 mgmt_pending_foreach(MGMT_OP_SET_LE
, hdev
, cmd_status_rsp
,
1710 mgmt_pending_foreach(MGMT_OP_SET_LE
, hdev
, settings_rsp
, &match
);
1712 new_settings(hdev
, match
.sk
);
1717 /* Make sure the controller has a good default for
1718 * advertising data. Restrict the update to when LE
1719 * has actually been enabled. During power on, the
1720 * update in powered_update_hci will take care of it.
1722 if (hci_dev_test_flag(hdev
, HCI_LE_ENABLED
)) {
1723 struct hci_request req
;
1725 hci_req_init(&req
, hdev
);
1726 __hci_req_update_adv_data(&req
, 0x00);
1727 __hci_req_update_scan_rsp_data(&req
, 0x00);
1728 hci_req_run(&req
, NULL
);
1729 hci_update_background_scan(hdev
);
1733 hci_dev_unlock(hdev
);
1736 static int set_le(struct sock
*sk
, struct hci_dev
*hdev
, void *data
, u16 len
)
1738 struct mgmt_mode
*cp
= data
;
1739 struct hci_cp_write_le_host_supported hci_cp
;
1740 struct mgmt_pending_cmd
*cmd
;
1741 struct hci_request req
;
1745 BT_DBG("request for %s", hdev
->name
);
1747 if (!lmp_le_capable(hdev
))
1748 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LE
,
1749 MGMT_STATUS_NOT_SUPPORTED
);
1751 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
1752 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LE
,
1753 MGMT_STATUS_INVALID_PARAMS
);
1755 /* Bluetooth single mode LE only controllers or dual-mode
1756 * controllers configured as LE only devices, do not allow
1757 * switching LE off. These have either LE enabled explicitly
1758 * or BR/EDR has been previously switched off.
1760 * When trying to enable an already enabled LE, then gracefully
1761 * send a positive response. Trying to disable it however will
1762 * result into rejection.
1764 if (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
)) {
1765 if (cp
->val
== 0x01)
1766 return send_settings_rsp(sk
, MGMT_OP_SET_LE
, hdev
);
1768 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LE
,
1769 MGMT_STATUS_REJECTED
);
1775 enabled
= lmp_host_le_capable(hdev
);
1778 hci_req_clear_adv_instance(hdev
, NULL
, NULL
, 0x00, true);
1780 if (!hdev_is_powered(hdev
) || val
== enabled
) {
1781 bool changed
= false;
1783 if (val
!= hci_dev_test_flag(hdev
, HCI_LE_ENABLED
)) {
1784 hci_dev_change_flag(hdev
, HCI_LE_ENABLED
);
1788 if (!val
&& hci_dev_test_flag(hdev
, HCI_ADVERTISING
)) {
1789 hci_dev_clear_flag(hdev
, HCI_ADVERTISING
);
1793 err
= send_settings_rsp(sk
, MGMT_OP_SET_LE
, hdev
);
1798 err
= new_settings(hdev
, sk
);
1803 if (pending_find(MGMT_OP_SET_LE
, hdev
) ||
1804 pending_find(MGMT_OP_SET_ADVERTISING
, hdev
)) {
1805 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_LE
,
1810 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_LE
, hdev
, data
, len
);
1816 hci_req_init(&req
, hdev
);
1818 memset(&hci_cp
, 0, sizeof(hci_cp
));
1822 hci_cp
.simul
= 0x00;
1824 if (hci_dev_test_flag(hdev
, HCI_LE_ADV
))
1825 __hci_req_disable_advertising(&req
);
1828 hci_req_add(&req
, HCI_OP_WRITE_LE_HOST_SUPPORTED
, sizeof(hci_cp
),
1831 err
= hci_req_run(&req
, le_enable_complete
);
1833 mgmt_pending_remove(cmd
);
1836 hci_dev_unlock(hdev
);
1840 /* This is a helper function to test for pending mgmt commands that can
1841 * cause CoD or EIR HCI commands. We can only allow one such pending
1842 * mgmt command at a time since otherwise we cannot easily track what
1843 * the current values are, will be, and based on that calculate if a new
1844 * HCI command needs to be sent and if yes with what value.
1846 static bool pending_eir_or_class(struct hci_dev
*hdev
)
1848 struct mgmt_pending_cmd
*cmd
;
1850 list_for_each_entry(cmd
, &hdev
->mgmt_pending
, list
) {
1851 switch (cmd
->opcode
) {
1852 case MGMT_OP_ADD_UUID
:
1853 case MGMT_OP_REMOVE_UUID
:
1854 case MGMT_OP_SET_DEV_CLASS
:
1855 case MGMT_OP_SET_POWERED
:
1863 static const u8 bluetooth_base_uuid
[] = {
1864 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
1865 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1868 static u8
get_uuid_size(const u8
*uuid
)
1872 if (memcmp(uuid
, bluetooth_base_uuid
, 12))
1875 val
= get_unaligned_le32(&uuid
[12]);
1882 static void mgmt_class_complete(struct hci_dev
*hdev
, u16 mgmt_op
, u8 status
)
1884 struct mgmt_pending_cmd
*cmd
;
1888 cmd
= pending_find(mgmt_op
, hdev
);
1892 mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
,
1893 mgmt_status(status
), hdev
->dev_class
, 3);
1895 mgmt_pending_remove(cmd
);
1898 hci_dev_unlock(hdev
);
1901 static void add_uuid_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
1903 BT_DBG("status 0x%02x", status
);
1905 mgmt_class_complete(hdev
, MGMT_OP_ADD_UUID
, status
);
1908 static int add_uuid(struct sock
*sk
, struct hci_dev
*hdev
, void *data
, u16 len
)
1910 struct mgmt_cp_add_uuid
*cp
= data
;
1911 struct mgmt_pending_cmd
*cmd
;
1912 struct hci_request req
;
1913 struct bt_uuid
*uuid
;
1916 BT_DBG("request for %s", hdev
->name
);
1920 if (pending_eir_or_class(hdev
)) {
1921 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_UUID
,
1926 uuid
= kmalloc(sizeof(*uuid
), GFP_KERNEL
);
1932 memcpy(uuid
->uuid
, cp
->uuid
, 16);
1933 uuid
->svc_hint
= cp
->svc_hint
;
1934 uuid
->size
= get_uuid_size(cp
->uuid
);
1936 list_add_tail(&uuid
->list
, &hdev
->uuids
);
1938 hci_req_init(&req
, hdev
);
1940 __hci_req_update_class(&req
);
1941 __hci_req_update_eir(&req
);
1943 err
= hci_req_run(&req
, add_uuid_complete
);
1945 if (err
!= -ENODATA
)
1948 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_UUID
, 0,
1949 hdev
->dev_class
, 3);
1953 cmd
= mgmt_pending_add(sk
, MGMT_OP_ADD_UUID
, hdev
, data
, len
);
1962 hci_dev_unlock(hdev
);
1966 static bool enable_service_cache(struct hci_dev
*hdev
)
1968 if (!hdev_is_powered(hdev
))
1971 if (!hci_dev_test_and_set_flag(hdev
, HCI_SERVICE_CACHE
)) {
1972 queue_delayed_work(hdev
->workqueue
, &hdev
->service_cache
,
1980 static void remove_uuid_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
1982 BT_DBG("status 0x%02x", status
);
1984 mgmt_class_complete(hdev
, MGMT_OP_REMOVE_UUID
, status
);
1987 static int remove_uuid(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
1990 struct mgmt_cp_remove_uuid
*cp
= data
;
1991 struct mgmt_pending_cmd
*cmd
;
1992 struct bt_uuid
*match
, *tmp
;
1993 u8 bt_uuid_any
[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
1994 struct hci_request req
;
1997 BT_DBG("request for %s", hdev
->name
);
2001 if (pending_eir_or_class(hdev
)) {
2002 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_REMOVE_UUID
,
2007 if (memcmp(cp
->uuid
, bt_uuid_any
, 16) == 0) {
2008 hci_uuids_clear(hdev
);
2010 if (enable_service_cache(hdev
)) {
2011 err
= mgmt_cmd_complete(sk
, hdev
->id
,
2012 MGMT_OP_REMOVE_UUID
,
2013 0, hdev
->dev_class
, 3);
2022 list_for_each_entry_safe(match
, tmp
, &hdev
->uuids
, list
) {
2023 if (memcmp(match
->uuid
, cp
->uuid
, 16) != 0)
2026 list_del(&match
->list
);
2032 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_REMOVE_UUID
,
2033 MGMT_STATUS_INVALID_PARAMS
);
2038 hci_req_init(&req
, hdev
);
2040 __hci_req_update_class(&req
);
2041 __hci_req_update_eir(&req
);
2043 err
= hci_req_run(&req
, remove_uuid_complete
);
2045 if (err
!= -ENODATA
)
2048 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_REMOVE_UUID
, 0,
2049 hdev
->dev_class
, 3);
2053 cmd
= mgmt_pending_add(sk
, MGMT_OP_REMOVE_UUID
, hdev
, data
, len
);
2062 hci_dev_unlock(hdev
);
2066 static void set_class_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
2068 BT_DBG("status 0x%02x", status
);
2070 mgmt_class_complete(hdev
, MGMT_OP_SET_DEV_CLASS
, status
);
2073 static int set_dev_class(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2076 struct mgmt_cp_set_dev_class
*cp
= data
;
2077 struct mgmt_pending_cmd
*cmd
;
2078 struct hci_request req
;
2081 BT_DBG("request for %s", hdev
->name
);
2083 if (!lmp_bredr_capable(hdev
))
2084 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DEV_CLASS
,
2085 MGMT_STATUS_NOT_SUPPORTED
);
2089 if (pending_eir_or_class(hdev
)) {
2090 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DEV_CLASS
,
2095 if ((cp
->minor
& 0x03) != 0 || (cp
->major
& 0xe0) != 0) {
2096 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DEV_CLASS
,
2097 MGMT_STATUS_INVALID_PARAMS
);
2101 hdev
->major_class
= cp
->major
;
2102 hdev
->minor_class
= cp
->minor
;
2104 if (!hdev_is_powered(hdev
)) {
2105 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_DEV_CLASS
, 0,
2106 hdev
->dev_class
, 3);
2110 hci_req_init(&req
, hdev
);
2112 if (hci_dev_test_and_clear_flag(hdev
, HCI_SERVICE_CACHE
)) {
2113 hci_dev_unlock(hdev
);
2114 cancel_delayed_work_sync(&hdev
->service_cache
);
2116 __hci_req_update_eir(&req
);
2119 __hci_req_update_class(&req
);
2121 err
= hci_req_run(&req
, set_class_complete
);
2123 if (err
!= -ENODATA
)
2126 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_DEV_CLASS
, 0,
2127 hdev
->dev_class
, 3);
2131 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_DEV_CLASS
, hdev
, data
, len
);
2140 hci_dev_unlock(hdev
);
2144 static int load_link_keys(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2147 struct mgmt_cp_load_link_keys
*cp
= data
;
2148 const u16 max_key_count
= ((U16_MAX
- sizeof(*cp
)) /
2149 sizeof(struct mgmt_link_key_info
));
2150 u16 key_count
, expected_len
;
2154 BT_DBG("request for %s", hdev
->name
);
2156 if (!lmp_bredr_capable(hdev
))
2157 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LINK_KEYS
,
2158 MGMT_STATUS_NOT_SUPPORTED
);
2160 key_count
= __le16_to_cpu(cp
->key_count
);
2161 if (key_count
> max_key_count
) {
2162 bt_dev_err(hdev
, "load_link_keys: too big key_count value %u",
2164 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LINK_KEYS
,
2165 MGMT_STATUS_INVALID_PARAMS
);
2168 expected_len
= sizeof(*cp
) + key_count
*
2169 sizeof(struct mgmt_link_key_info
);
2170 if (expected_len
!= len
) {
2171 bt_dev_err(hdev
, "load_link_keys: expected %u bytes, got %u bytes",
2173 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LINK_KEYS
,
2174 MGMT_STATUS_INVALID_PARAMS
);
2177 if (cp
->debug_keys
!= 0x00 && cp
->debug_keys
!= 0x01)
2178 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LINK_KEYS
,
2179 MGMT_STATUS_INVALID_PARAMS
);
2181 BT_DBG("%s debug_keys %u key_count %u", hdev
->name
, cp
->debug_keys
,
2184 for (i
= 0; i
< key_count
; i
++) {
2185 struct mgmt_link_key_info
*key
= &cp
->keys
[i
];
2187 if (key
->addr
.type
!= BDADDR_BREDR
|| key
->type
> 0x08)
2188 return mgmt_cmd_status(sk
, hdev
->id
,
2189 MGMT_OP_LOAD_LINK_KEYS
,
2190 MGMT_STATUS_INVALID_PARAMS
);
2195 hci_link_keys_clear(hdev
);
2198 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_KEEP_DEBUG_KEYS
);
2200 changed
= hci_dev_test_and_clear_flag(hdev
,
2201 HCI_KEEP_DEBUG_KEYS
);
2204 new_settings(hdev
, NULL
);
2206 for (i
= 0; i
< key_count
; i
++) {
2207 struct mgmt_link_key_info
*key
= &cp
->keys
[i
];
2209 /* Always ignore debug keys and require a new pairing if
2210 * the user wants to use them.
2212 if (key
->type
== HCI_LK_DEBUG_COMBINATION
)
2215 hci_add_link_key(hdev
, NULL
, &key
->addr
.bdaddr
, key
->val
,
2216 key
->type
, key
->pin_len
, NULL
);
2219 mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_LOAD_LINK_KEYS
, 0, NULL
, 0);
2221 hci_dev_unlock(hdev
);
2226 static int device_unpaired(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
2227 u8 addr_type
, struct sock
*skip_sk
)
2229 struct mgmt_ev_device_unpaired ev
;
2231 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
2232 ev
.addr
.type
= addr_type
;
2234 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED
, hdev
, &ev
, sizeof(ev
),
2238 static int unpair_device(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2241 struct mgmt_cp_unpair_device
*cp
= data
;
2242 struct mgmt_rp_unpair_device rp
;
2243 struct hci_conn_params
*params
;
2244 struct mgmt_pending_cmd
*cmd
;
2245 struct hci_conn
*conn
;
2249 memset(&rp
, 0, sizeof(rp
));
2250 bacpy(&rp
.addr
.bdaddr
, &cp
->addr
.bdaddr
);
2251 rp
.addr
.type
= cp
->addr
.type
;
2253 if (!bdaddr_type_is_valid(cp
->addr
.type
))
2254 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNPAIR_DEVICE
,
2255 MGMT_STATUS_INVALID_PARAMS
,
2258 if (cp
->disconnect
!= 0x00 && cp
->disconnect
!= 0x01)
2259 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNPAIR_DEVICE
,
2260 MGMT_STATUS_INVALID_PARAMS
,
2265 if (!hdev_is_powered(hdev
)) {
2266 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNPAIR_DEVICE
,
2267 MGMT_STATUS_NOT_POWERED
, &rp
,
2272 if (cp
->addr
.type
== BDADDR_BREDR
) {
2273 /* If disconnection is requested, then look up the
2274 * connection. If the remote device is connected, it
2275 * will be later used to terminate the link.
2277 * Setting it to NULL explicitly will cause no
2278 * termination of the link.
2281 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
,
2286 err
= hci_remove_link_key(hdev
, &cp
->addr
.bdaddr
);
2288 err
= mgmt_cmd_complete(sk
, hdev
->id
,
2289 MGMT_OP_UNPAIR_DEVICE
,
2290 MGMT_STATUS_NOT_PAIRED
, &rp
,
2298 /* LE address type */
2299 addr_type
= le_addr_type(cp
->addr
.type
);
2301 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
2302 err
= smp_cancel_and_remove_pairing(hdev
, &cp
->addr
.bdaddr
, addr_type
);
2304 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNPAIR_DEVICE
,
2305 MGMT_STATUS_NOT_PAIRED
, &rp
,
2310 conn
= hci_conn_hash_lookup_le(hdev
, &cp
->addr
.bdaddr
, addr_type
);
2312 hci_conn_params_del(hdev
, &cp
->addr
.bdaddr
, addr_type
);
2317 /* Defer clearing up the connection parameters until closing to
2318 * give a chance of keeping them if a repairing happens.
2320 set_bit(HCI_CONN_PARAM_REMOVAL_PEND
, &conn
->flags
);
2322 /* Disable auto-connection parameters if present */
2323 params
= hci_conn_params_lookup(hdev
, &cp
->addr
.bdaddr
, addr_type
);
2325 if (params
->explicit_connect
)
2326 params
->auto_connect
= HCI_AUTO_CONN_EXPLICIT
;
2328 params
->auto_connect
= HCI_AUTO_CONN_DISABLED
;
2331 /* If disconnection is not requested, then clear the connection
2332 * variable so that the link is not terminated.
2334 if (!cp
->disconnect
)
2338 /* If the connection variable is set, then termination of the
2339 * link is requested.
2342 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNPAIR_DEVICE
, 0,
2344 device_unpaired(hdev
, &cp
->addr
.bdaddr
, cp
->addr
.type
, sk
);
2348 cmd
= mgmt_pending_add(sk
, MGMT_OP_UNPAIR_DEVICE
, hdev
, cp
,
2355 cmd
->cmd_complete
= addr_cmd_complete
;
2357 err
= hci_abort_conn(conn
, HCI_ERROR_REMOTE_USER_TERM
);
2359 mgmt_pending_remove(cmd
);
2362 hci_dev_unlock(hdev
);
2366 static int disconnect(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2369 struct mgmt_cp_disconnect
*cp
= data
;
2370 struct mgmt_rp_disconnect rp
;
2371 struct mgmt_pending_cmd
*cmd
;
2372 struct hci_conn
*conn
;
2377 memset(&rp
, 0, sizeof(rp
));
2378 bacpy(&rp
.addr
.bdaddr
, &cp
->addr
.bdaddr
);
2379 rp
.addr
.type
= cp
->addr
.type
;
2381 if (!bdaddr_type_is_valid(cp
->addr
.type
))
2382 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_DISCONNECT
,
2383 MGMT_STATUS_INVALID_PARAMS
,
2388 if (!test_bit(HCI_UP
, &hdev
->flags
)) {
2389 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_DISCONNECT
,
2390 MGMT_STATUS_NOT_POWERED
, &rp
,
2395 if (pending_find(MGMT_OP_DISCONNECT
, hdev
)) {
2396 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_DISCONNECT
,
2397 MGMT_STATUS_BUSY
, &rp
, sizeof(rp
));
2401 if (cp
->addr
.type
== BDADDR_BREDR
)
2402 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
,
2405 conn
= hci_conn_hash_lookup_le(hdev
, &cp
->addr
.bdaddr
,
2406 le_addr_type(cp
->addr
.type
));
2408 if (!conn
|| conn
->state
== BT_OPEN
|| conn
->state
== BT_CLOSED
) {
2409 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_DISCONNECT
,
2410 MGMT_STATUS_NOT_CONNECTED
, &rp
,
2415 cmd
= mgmt_pending_add(sk
, MGMT_OP_DISCONNECT
, hdev
, data
, len
);
2421 cmd
->cmd_complete
= generic_cmd_complete
;
2423 err
= hci_disconnect(conn
, HCI_ERROR_REMOTE_USER_TERM
);
2425 mgmt_pending_remove(cmd
);
2428 hci_dev_unlock(hdev
);
2432 static u8
link_to_bdaddr(u8 link_type
, u8 addr_type
)
2434 switch (link_type
) {
2436 switch (addr_type
) {
2437 case ADDR_LE_DEV_PUBLIC
:
2438 return BDADDR_LE_PUBLIC
;
2441 /* Fallback to LE Random address type */
2442 return BDADDR_LE_RANDOM
;
2446 /* Fallback to BR/EDR type */
2447 return BDADDR_BREDR
;
2451 static int get_connections(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2454 struct mgmt_rp_get_connections
*rp
;
2464 if (!hdev_is_powered(hdev
)) {
2465 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_GET_CONNECTIONS
,
2466 MGMT_STATUS_NOT_POWERED
);
2471 list_for_each_entry(c
, &hdev
->conn_hash
.list
, list
) {
2472 if (test_bit(HCI_CONN_MGMT_CONNECTED
, &c
->flags
))
2476 rp_len
= sizeof(*rp
) + (i
* sizeof(struct mgmt_addr_info
));
2477 rp
= kmalloc(rp_len
, GFP_KERNEL
);
2484 list_for_each_entry(c
, &hdev
->conn_hash
.list
, list
) {
2485 if (!test_bit(HCI_CONN_MGMT_CONNECTED
, &c
->flags
))
2487 bacpy(&rp
->addr
[i
].bdaddr
, &c
->dst
);
2488 rp
->addr
[i
].type
= link_to_bdaddr(c
->type
, c
->dst_type
);
2489 if (c
->type
== SCO_LINK
|| c
->type
== ESCO_LINK
)
2494 rp
->conn_count
= cpu_to_le16(i
);
2496 /* Recalculate length in case of filtered SCO connections, etc */
2497 rp_len
= sizeof(*rp
) + (i
* sizeof(struct mgmt_addr_info
));
2499 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CONNECTIONS
, 0, rp
,
2505 hci_dev_unlock(hdev
);
2509 static int send_pin_code_neg_reply(struct sock
*sk
, struct hci_dev
*hdev
,
2510 struct mgmt_cp_pin_code_neg_reply
*cp
)
2512 struct mgmt_pending_cmd
*cmd
;
2515 cmd
= mgmt_pending_add(sk
, MGMT_OP_PIN_CODE_NEG_REPLY
, hdev
, cp
,
2520 cmd
->cmd_complete
= addr_cmd_complete
;
2522 err
= hci_send_cmd(hdev
, HCI_OP_PIN_CODE_NEG_REPLY
,
2523 sizeof(cp
->addr
.bdaddr
), &cp
->addr
.bdaddr
);
2525 mgmt_pending_remove(cmd
);
2530 static int pin_code_reply(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2533 struct hci_conn
*conn
;
2534 struct mgmt_cp_pin_code_reply
*cp
= data
;
2535 struct hci_cp_pin_code_reply reply
;
2536 struct mgmt_pending_cmd
*cmd
;
2543 if (!hdev_is_powered(hdev
)) {
2544 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_PIN_CODE_REPLY
,
2545 MGMT_STATUS_NOT_POWERED
);
2549 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
, &cp
->addr
.bdaddr
);
2551 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_PIN_CODE_REPLY
,
2552 MGMT_STATUS_NOT_CONNECTED
);
2556 if (conn
->pending_sec_level
== BT_SECURITY_HIGH
&& cp
->pin_len
!= 16) {
2557 struct mgmt_cp_pin_code_neg_reply ncp
;
2559 memcpy(&ncp
.addr
, &cp
->addr
, sizeof(ncp
.addr
));
2561 bt_dev_err(hdev
, "PIN code is not 16 bytes long");
2563 err
= send_pin_code_neg_reply(sk
, hdev
, &ncp
);
2565 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_PIN_CODE_REPLY
,
2566 MGMT_STATUS_INVALID_PARAMS
);
2571 cmd
= mgmt_pending_add(sk
, MGMT_OP_PIN_CODE_REPLY
, hdev
, data
, len
);
2577 cmd
->cmd_complete
= addr_cmd_complete
;
2579 bacpy(&reply
.bdaddr
, &cp
->addr
.bdaddr
);
2580 reply
.pin_len
= cp
->pin_len
;
2581 memcpy(reply
.pin_code
, cp
->pin_code
, sizeof(reply
.pin_code
));
2583 err
= hci_send_cmd(hdev
, HCI_OP_PIN_CODE_REPLY
, sizeof(reply
), &reply
);
2585 mgmt_pending_remove(cmd
);
2588 hci_dev_unlock(hdev
);
2592 static int set_io_capability(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2595 struct mgmt_cp_set_io_capability
*cp
= data
;
2599 if (cp
->io_capability
> SMP_IO_KEYBOARD_DISPLAY
)
2600 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_IO_CAPABILITY
,
2601 MGMT_STATUS_INVALID_PARAMS
);
2605 hdev
->io_capability
= cp
->io_capability
;
2607 BT_DBG("%s IO capability set to 0x%02x", hdev
->name
,
2608 hdev
->io_capability
);
2610 hci_dev_unlock(hdev
);
2612 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_IO_CAPABILITY
, 0,
2616 static struct mgmt_pending_cmd
*find_pairing(struct hci_conn
*conn
)
2618 struct hci_dev
*hdev
= conn
->hdev
;
2619 struct mgmt_pending_cmd
*cmd
;
2621 list_for_each_entry(cmd
, &hdev
->mgmt_pending
, list
) {
2622 if (cmd
->opcode
!= MGMT_OP_PAIR_DEVICE
)
2625 if (cmd
->user_data
!= conn
)
2634 static int pairing_complete(struct mgmt_pending_cmd
*cmd
, u8 status
)
2636 struct mgmt_rp_pair_device rp
;
2637 struct hci_conn
*conn
= cmd
->user_data
;
2640 bacpy(&rp
.addr
.bdaddr
, &conn
->dst
);
2641 rp
.addr
.type
= link_to_bdaddr(conn
->type
, conn
->dst_type
);
2643 err
= mgmt_cmd_complete(cmd
->sk
, cmd
->index
, MGMT_OP_PAIR_DEVICE
,
2644 status
, &rp
, sizeof(rp
));
2646 /* So we don't get further callbacks for this connection */
2647 conn
->connect_cfm_cb
= NULL
;
2648 conn
->security_cfm_cb
= NULL
;
2649 conn
->disconn_cfm_cb
= NULL
;
2651 hci_conn_drop(conn
);
2653 /* The device is paired so there is no need to remove
2654 * its connection parameters anymore.
2656 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND
, &conn
->flags
);
2663 void mgmt_smp_complete(struct hci_conn
*conn
, bool complete
)
2665 u8 status
= complete
? MGMT_STATUS_SUCCESS
: MGMT_STATUS_FAILED
;
2666 struct mgmt_pending_cmd
*cmd
;
2668 cmd
= find_pairing(conn
);
2670 cmd
->cmd_complete(cmd
, status
);
2671 mgmt_pending_remove(cmd
);
2675 static void pairing_complete_cb(struct hci_conn
*conn
, u8 status
)
2677 struct mgmt_pending_cmd
*cmd
;
2679 BT_DBG("status %u", status
);
2681 cmd
= find_pairing(conn
);
2683 BT_DBG("Unable to find a pending command");
2687 cmd
->cmd_complete(cmd
, mgmt_status(status
));
2688 mgmt_pending_remove(cmd
);
2691 static void le_pairing_complete_cb(struct hci_conn
*conn
, u8 status
)
2693 struct mgmt_pending_cmd
*cmd
;
2695 BT_DBG("status %u", status
);
2700 cmd
= find_pairing(conn
);
2702 BT_DBG("Unable to find a pending command");
2706 cmd
->cmd_complete(cmd
, mgmt_status(status
));
2707 mgmt_pending_remove(cmd
);
2710 static int pair_device(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2713 struct mgmt_cp_pair_device
*cp
= data
;
2714 struct mgmt_rp_pair_device rp
;
2715 struct mgmt_pending_cmd
*cmd
;
2716 u8 sec_level
, auth_type
;
2717 struct hci_conn
*conn
;
2722 memset(&rp
, 0, sizeof(rp
));
2723 bacpy(&rp
.addr
.bdaddr
, &cp
->addr
.bdaddr
);
2724 rp
.addr
.type
= cp
->addr
.type
;
2726 if (!bdaddr_type_is_valid(cp
->addr
.type
))
2727 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_PAIR_DEVICE
,
2728 MGMT_STATUS_INVALID_PARAMS
,
2731 if (cp
->io_cap
> SMP_IO_KEYBOARD_DISPLAY
)
2732 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_PAIR_DEVICE
,
2733 MGMT_STATUS_INVALID_PARAMS
,
2738 if (!hdev_is_powered(hdev
)) {
2739 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_PAIR_DEVICE
,
2740 MGMT_STATUS_NOT_POWERED
, &rp
,
2745 if (hci_bdaddr_is_paired(hdev
, &cp
->addr
.bdaddr
, cp
->addr
.type
)) {
2746 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_PAIR_DEVICE
,
2747 MGMT_STATUS_ALREADY_PAIRED
, &rp
,
2752 sec_level
= BT_SECURITY_MEDIUM
;
2753 auth_type
= HCI_AT_DEDICATED_BONDING
;
2755 if (cp
->addr
.type
== BDADDR_BREDR
) {
2756 conn
= hci_connect_acl(hdev
, &cp
->addr
.bdaddr
, sec_level
,
2759 u8 addr_type
= le_addr_type(cp
->addr
.type
);
2760 struct hci_conn_params
*p
;
2762 /* When pairing a new device, it is expected to remember
2763 * this device for future connections. Adding the connection
2764 * parameter information ahead of time allows tracking
2765 * of the slave preferred values and will speed up any
2766 * further connection establishment.
2768 * If connection parameters already exist, then they
2769 * will be kept and this function does nothing.
2771 p
= hci_conn_params_add(hdev
, &cp
->addr
.bdaddr
, addr_type
);
2773 if (p
->auto_connect
== HCI_AUTO_CONN_EXPLICIT
)
2774 p
->auto_connect
= HCI_AUTO_CONN_DISABLED
;
2776 conn
= hci_connect_le_scan(hdev
, &cp
->addr
.bdaddr
,
2777 addr_type
, sec_level
,
2778 HCI_LE_CONN_TIMEOUT
);
2784 if (PTR_ERR(conn
) == -EBUSY
)
2785 status
= MGMT_STATUS_BUSY
;
2786 else if (PTR_ERR(conn
) == -EOPNOTSUPP
)
2787 status
= MGMT_STATUS_NOT_SUPPORTED
;
2788 else if (PTR_ERR(conn
) == -ECONNREFUSED
)
2789 status
= MGMT_STATUS_REJECTED
;
2791 status
= MGMT_STATUS_CONNECT_FAILED
;
2793 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_PAIR_DEVICE
,
2794 status
, &rp
, sizeof(rp
));
2798 if (conn
->connect_cfm_cb
) {
2799 hci_conn_drop(conn
);
2800 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_PAIR_DEVICE
,
2801 MGMT_STATUS_BUSY
, &rp
, sizeof(rp
));
2805 cmd
= mgmt_pending_add(sk
, MGMT_OP_PAIR_DEVICE
, hdev
, data
, len
);
2808 hci_conn_drop(conn
);
2812 cmd
->cmd_complete
= pairing_complete
;
2814 /* For LE, just connecting isn't a proof that the pairing finished */
2815 if (cp
->addr
.type
== BDADDR_BREDR
) {
2816 conn
->connect_cfm_cb
= pairing_complete_cb
;
2817 conn
->security_cfm_cb
= pairing_complete_cb
;
2818 conn
->disconn_cfm_cb
= pairing_complete_cb
;
2820 conn
->connect_cfm_cb
= le_pairing_complete_cb
;
2821 conn
->security_cfm_cb
= le_pairing_complete_cb
;
2822 conn
->disconn_cfm_cb
= le_pairing_complete_cb
;
2825 conn
->io_capability
= cp
->io_cap
;
2826 cmd
->user_data
= hci_conn_get(conn
);
2828 if ((conn
->state
== BT_CONNECTED
|| conn
->state
== BT_CONFIG
) &&
2829 hci_conn_security(conn
, sec_level
, auth_type
, true)) {
2830 cmd
->cmd_complete(cmd
, 0);
2831 mgmt_pending_remove(cmd
);
2837 hci_dev_unlock(hdev
);
2841 static int cancel_pair_device(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2844 struct mgmt_addr_info
*addr
= data
;
2845 struct mgmt_pending_cmd
*cmd
;
2846 struct hci_conn
*conn
;
2853 if (!hdev_is_powered(hdev
)) {
2854 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_CANCEL_PAIR_DEVICE
,
2855 MGMT_STATUS_NOT_POWERED
);
2859 cmd
= pending_find(MGMT_OP_PAIR_DEVICE
, hdev
);
2861 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_CANCEL_PAIR_DEVICE
,
2862 MGMT_STATUS_INVALID_PARAMS
);
2866 conn
= cmd
->user_data
;
2868 if (bacmp(&addr
->bdaddr
, &conn
->dst
) != 0) {
2869 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_CANCEL_PAIR_DEVICE
,
2870 MGMT_STATUS_INVALID_PARAMS
);
2874 cmd
->cmd_complete(cmd
, MGMT_STATUS_CANCELLED
);
2875 mgmt_pending_remove(cmd
);
2877 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_CANCEL_PAIR_DEVICE
, 0,
2878 addr
, sizeof(*addr
));
2880 hci_dev_unlock(hdev
);
2884 static int user_pairing_resp(struct sock
*sk
, struct hci_dev
*hdev
,
2885 struct mgmt_addr_info
*addr
, u16 mgmt_op
,
2886 u16 hci_op
, __le32 passkey
)
2888 struct mgmt_pending_cmd
*cmd
;
2889 struct hci_conn
*conn
;
2894 if (!hdev_is_powered(hdev
)) {
2895 err
= mgmt_cmd_complete(sk
, hdev
->id
, mgmt_op
,
2896 MGMT_STATUS_NOT_POWERED
, addr
,
2901 if (addr
->type
== BDADDR_BREDR
)
2902 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
, &addr
->bdaddr
);
2904 conn
= hci_conn_hash_lookup_le(hdev
, &addr
->bdaddr
,
2905 le_addr_type(addr
->type
));
2908 err
= mgmt_cmd_complete(sk
, hdev
->id
, mgmt_op
,
2909 MGMT_STATUS_NOT_CONNECTED
, addr
,
2914 if (addr
->type
== BDADDR_LE_PUBLIC
|| addr
->type
== BDADDR_LE_RANDOM
) {
2915 err
= smp_user_confirm_reply(conn
, mgmt_op
, passkey
);
2917 err
= mgmt_cmd_complete(sk
, hdev
->id
, mgmt_op
,
2918 MGMT_STATUS_SUCCESS
, addr
,
2921 err
= mgmt_cmd_complete(sk
, hdev
->id
, mgmt_op
,
2922 MGMT_STATUS_FAILED
, addr
,
2928 cmd
= mgmt_pending_add(sk
, mgmt_op
, hdev
, addr
, sizeof(*addr
));
2934 cmd
->cmd_complete
= addr_cmd_complete
;
2936 /* Continue with pairing via HCI */
2937 if (hci_op
== HCI_OP_USER_PASSKEY_REPLY
) {
2938 struct hci_cp_user_passkey_reply cp
;
2940 bacpy(&cp
.bdaddr
, &addr
->bdaddr
);
2941 cp
.passkey
= passkey
;
2942 err
= hci_send_cmd(hdev
, hci_op
, sizeof(cp
), &cp
);
2944 err
= hci_send_cmd(hdev
, hci_op
, sizeof(addr
->bdaddr
),
2948 mgmt_pending_remove(cmd
);
2951 hci_dev_unlock(hdev
);
2955 static int pin_code_neg_reply(struct sock
*sk
, struct hci_dev
*hdev
,
2956 void *data
, u16 len
)
2958 struct mgmt_cp_pin_code_neg_reply
*cp
= data
;
2962 return user_pairing_resp(sk
, hdev
, &cp
->addr
,
2963 MGMT_OP_PIN_CODE_NEG_REPLY
,
2964 HCI_OP_PIN_CODE_NEG_REPLY
, 0);
2967 static int user_confirm_reply(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2970 struct mgmt_cp_user_confirm_reply
*cp
= data
;
2974 if (len
!= sizeof(*cp
))
2975 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_USER_CONFIRM_REPLY
,
2976 MGMT_STATUS_INVALID_PARAMS
);
2978 return user_pairing_resp(sk
, hdev
, &cp
->addr
,
2979 MGMT_OP_USER_CONFIRM_REPLY
,
2980 HCI_OP_USER_CONFIRM_REPLY
, 0);
2983 static int user_confirm_neg_reply(struct sock
*sk
, struct hci_dev
*hdev
,
2984 void *data
, u16 len
)
2986 struct mgmt_cp_user_confirm_neg_reply
*cp
= data
;
2990 return user_pairing_resp(sk
, hdev
, &cp
->addr
,
2991 MGMT_OP_USER_CONFIRM_NEG_REPLY
,
2992 HCI_OP_USER_CONFIRM_NEG_REPLY
, 0);
2995 static int user_passkey_reply(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
2998 struct mgmt_cp_user_passkey_reply
*cp
= data
;
3002 return user_pairing_resp(sk
, hdev
, &cp
->addr
,
3003 MGMT_OP_USER_PASSKEY_REPLY
,
3004 HCI_OP_USER_PASSKEY_REPLY
, cp
->passkey
);
3007 static int user_passkey_neg_reply(struct sock
*sk
, struct hci_dev
*hdev
,
3008 void *data
, u16 len
)
3010 struct mgmt_cp_user_passkey_neg_reply
*cp
= data
;
3014 return user_pairing_resp(sk
, hdev
, &cp
->addr
,
3015 MGMT_OP_USER_PASSKEY_NEG_REPLY
,
3016 HCI_OP_USER_PASSKEY_NEG_REPLY
, 0);
3019 static void adv_expire(struct hci_dev
*hdev
, u32 flags
)
3021 struct adv_info
*adv_instance
;
3022 struct hci_request req
;
3025 adv_instance
= hci_find_adv_instance(hdev
, hdev
->cur_adv_instance
);
3029 /* stop if current instance doesn't need to be changed */
3030 if (!(adv_instance
->flags
& flags
))
3033 cancel_adv_timeout(hdev
);
3035 adv_instance
= hci_get_next_instance(hdev
, adv_instance
->instance
);
3039 hci_req_init(&req
, hdev
);
3040 err
= __hci_req_schedule_adv_instance(&req
, adv_instance
->instance
,
3045 hci_req_run(&req
, NULL
);
3048 static void set_name_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
3050 struct mgmt_cp_set_local_name
*cp
;
3051 struct mgmt_pending_cmd
*cmd
;
3053 BT_DBG("status 0x%02x", status
);
3057 cmd
= pending_find(MGMT_OP_SET_LOCAL_NAME
, hdev
);
3064 mgmt_cmd_status(cmd
->sk
, hdev
->id
, MGMT_OP_SET_LOCAL_NAME
,
3065 mgmt_status(status
));
3067 mgmt_cmd_complete(cmd
->sk
, hdev
->id
, MGMT_OP_SET_LOCAL_NAME
, 0,
3070 if (hci_dev_test_flag(hdev
, HCI_LE_ADV
))
3071 adv_expire(hdev
, MGMT_ADV_FLAG_LOCAL_NAME
);
3074 mgmt_pending_remove(cmd
);
3077 hci_dev_unlock(hdev
);
3080 static int set_local_name(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3083 struct mgmt_cp_set_local_name
*cp
= data
;
3084 struct mgmt_pending_cmd
*cmd
;
3085 struct hci_request req
;
3092 /* If the old values are the same as the new ones just return a
3093 * direct command complete event.
3095 if (!memcmp(hdev
->dev_name
, cp
->name
, sizeof(hdev
->dev_name
)) &&
3096 !memcmp(hdev
->short_name
, cp
->short_name
,
3097 sizeof(hdev
->short_name
))) {
3098 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_LOCAL_NAME
, 0,
3103 memcpy(hdev
->short_name
, cp
->short_name
, sizeof(hdev
->short_name
));
3105 if (!hdev_is_powered(hdev
)) {
3106 memcpy(hdev
->dev_name
, cp
->name
, sizeof(hdev
->dev_name
));
3108 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_LOCAL_NAME
, 0,
3113 err
= mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED
, hdev
, data
,
3114 len
, HCI_MGMT_LOCAL_NAME_EVENTS
, sk
);
3115 ext_info_changed(hdev
, sk
);
3120 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_LOCAL_NAME
, hdev
, data
, len
);
3126 memcpy(hdev
->dev_name
, cp
->name
, sizeof(hdev
->dev_name
));
3128 hci_req_init(&req
, hdev
);
3130 if (lmp_bredr_capable(hdev
)) {
3131 __hci_req_update_name(&req
);
3132 __hci_req_update_eir(&req
);
3135 /* The name is stored in the scan response data and so
3136 * no need to udpate the advertising data here.
3138 if (lmp_le_capable(hdev
) && hci_dev_test_flag(hdev
, HCI_ADVERTISING
))
3139 __hci_req_update_scan_rsp_data(&req
, hdev
->cur_adv_instance
);
3141 err
= hci_req_run(&req
, set_name_complete
);
3143 mgmt_pending_remove(cmd
);
3146 hci_dev_unlock(hdev
);
3150 static int set_appearance(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3153 struct mgmt_cp_set_appearance
*cp
= data
;
3159 if (!lmp_le_capable(hdev
))
3160 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_APPEARANCE
,
3161 MGMT_STATUS_NOT_SUPPORTED
);
3163 apperance
= le16_to_cpu(cp
->appearance
);
3167 if (hdev
->appearance
!= apperance
) {
3168 hdev
->appearance
= apperance
;
3170 if (hci_dev_test_flag(hdev
, HCI_LE_ADV
))
3171 adv_expire(hdev
, MGMT_ADV_FLAG_APPEARANCE
);
3173 ext_info_changed(hdev
, sk
);
3176 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_APPEARANCE
, 0, NULL
,
3179 hci_dev_unlock(hdev
);
3184 static void read_local_oob_data_complete(struct hci_dev
*hdev
, u8 status
,
3185 u16 opcode
, struct sk_buff
*skb
)
3187 struct mgmt_rp_read_local_oob_data mgmt_rp
;
3188 size_t rp_size
= sizeof(mgmt_rp
);
3189 struct mgmt_pending_cmd
*cmd
;
3191 BT_DBG("%s status %u", hdev
->name
, status
);
3193 cmd
= pending_find(MGMT_OP_READ_LOCAL_OOB_DATA
, hdev
);
3197 if (status
|| !skb
) {
3198 mgmt_cmd_status(cmd
->sk
, hdev
->id
, MGMT_OP_READ_LOCAL_OOB_DATA
,
3199 status
? mgmt_status(status
) : MGMT_STATUS_FAILED
);
3203 memset(&mgmt_rp
, 0, sizeof(mgmt_rp
));
3205 if (opcode
== HCI_OP_READ_LOCAL_OOB_DATA
) {
3206 struct hci_rp_read_local_oob_data
*rp
= (void *) skb
->data
;
3208 if (skb
->len
< sizeof(*rp
)) {
3209 mgmt_cmd_status(cmd
->sk
, hdev
->id
,
3210 MGMT_OP_READ_LOCAL_OOB_DATA
,
3211 MGMT_STATUS_FAILED
);
3215 memcpy(mgmt_rp
.hash192
, rp
->hash
, sizeof(rp
->hash
));
3216 memcpy(mgmt_rp
.rand192
, rp
->rand
, sizeof(rp
->rand
));
3218 rp_size
-= sizeof(mgmt_rp
.hash256
) + sizeof(mgmt_rp
.rand256
);
3220 struct hci_rp_read_local_oob_ext_data
*rp
= (void *) skb
->data
;
3222 if (skb
->len
< sizeof(*rp
)) {
3223 mgmt_cmd_status(cmd
->sk
, hdev
->id
,
3224 MGMT_OP_READ_LOCAL_OOB_DATA
,
3225 MGMT_STATUS_FAILED
);
3229 memcpy(mgmt_rp
.hash192
, rp
->hash192
, sizeof(rp
->hash192
));
3230 memcpy(mgmt_rp
.rand192
, rp
->rand192
, sizeof(rp
->rand192
));
3232 memcpy(mgmt_rp
.hash256
, rp
->hash256
, sizeof(rp
->hash256
));
3233 memcpy(mgmt_rp
.rand256
, rp
->rand256
, sizeof(rp
->rand256
));
3236 mgmt_cmd_complete(cmd
->sk
, hdev
->id
, MGMT_OP_READ_LOCAL_OOB_DATA
,
3237 MGMT_STATUS_SUCCESS
, &mgmt_rp
, rp_size
);
3240 mgmt_pending_remove(cmd
);
3243 static int read_local_oob_data(struct sock
*sk
, struct hci_dev
*hdev
,
3244 void *data
, u16 data_len
)
3246 struct mgmt_pending_cmd
*cmd
;
3247 struct hci_request req
;
3250 BT_DBG("%s", hdev
->name
);
3254 if (!hdev_is_powered(hdev
)) {
3255 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_READ_LOCAL_OOB_DATA
,
3256 MGMT_STATUS_NOT_POWERED
);
3260 if (!lmp_ssp_capable(hdev
)) {
3261 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_READ_LOCAL_OOB_DATA
,
3262 MGMT_STATUS_NOT_SUPPORTED
);
3266 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA
, hdev
)) {
3267 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_READ_LOCAL_OOB_DATA
,
3272 cmd
= mgmt_pending_add(sk
, MGMT_OP_READ_LOCAL_OOB_DATA
, hdev
, NULL
, 0);
3278 hci_req_init(&req
, hdev
);
3280 if (bredr_sc_enabled(hdev
))
3281 hci_req_add(&req
, HCI_OP_READ_LOCAL_OOB_EXT_DATA
, 0, NULL
);
3283 hci_req_add(&req
, HCI_OP_READ_LOCAL_OOB_DATA
, 0, NULL
);
3285 err
= hci_req_run_skb(&req
, read_local_oob_data_complete
);
3287 mgmt_pending_remove(cmd
);
3290 hci_dev_unlock(hdev
);
3294 static int add_remote_oob_data(struct sock
*sk
, struct hci_dev
*hdev
,
3295 void *data
, u16 len
)
3297 struct mgmt_addr_info
*addr
= data
;
3300 BT_DBG("%s ", hdev
->name
);
3302 if (!bdaddr_type_is_valid(addr
->type
))
3303 return mgmt_cmd_complete(sk
, hdev
->id
,
3304 MGMT_OP_ADD_REMOTE_OOB_DATA
,
3305 MGMT_STATUS_INVALID_PARAMS
,
3306 addr
, sizeof(*addr
));
3310 if (len
== MGMT_ADD_REMOTE_OOB_DATA_SIZE
) {
3311 struct mgmt_cp_add_remote_oob_data
*cp
= data
;
3314 if (cp
->addr
.type
!= BDADDR_BREDR
) {
3315 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3316 MGMT_OP_ADD_REMOTE_OOB_DATA
,
3317 MGMT_STATUS_INVALID_PARAMS
,
3318 &cp
->addr
, sizeof(cp
->addr
));
3322 err
= hci_add_remote_oob_data(hdev
, &cp
->addr
.bdaddr
,
3323 cp
->addr
.type
, cp
->hash
,
3324 cp
->rand
, NULL
, NULL
);
3326 status
= MGMT_STATUS_FAILED
;
3328 status
= MGMT_STATUS_SUCCESS
;
3330 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3331 MGMT_OP_ADD_REMOTE_OOB_DATA
, status
,
3332 &cp
->addr
, sizeof(cp
->addr
));
3333 } else if (len
== MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE
) {
3334 struct mgmt_cp_add_remote_oob_ext_data
*cp
= data
;
3335 u8
*rand192
, *hash192
, *rand256
, *hash256
;
3338 if (bdaddr_type_is_le(cp
->addr
.type
)) {
3339 /* Enforce zero-valued 192-bit parameters as
3340 * long as legacy SMP OOB isn't implemented.
3342 if (memcmp(cp
->rand192
, ZERO_KEY
, 16) ||
3343 memcmp(cp
->hash192
, ZERO_KEY
, 16)) {
3344 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3345 MGMT_OP_ADD_REMOTE_OOB_DATA
,
3346 MGMT_STATUS_INVALID_PARAMS
,
3347 addr
, sizeof(*addr
));
3354 /* In case one of the P-192 values is set to zero,
3355 * then just disable OOB data for P-192.
3357 if (!memcmp(cp
->rand192
, ZERO_KEY
, 16) ||
3358 !memcmp(cp
->hash192
, ZERO_KEY
, 16)) {
3362 rand192
= cp
->rand192
;
3363 hash192
= cp
->hash192
;
3367 /* In case one of the P-256 values is set to zero, then just
3368 * disable OOB data for P-256.
3370 if (!memcmp(cp
->rand256
, ZERO_KEY
, 16) ||
3371 !memcmp(cp
->hash256
, ZERO_KEY
, 16)) {
3375 rand256
= cp
->rand256
;
3376 hash256
= cp
->hash256
;
3379 err
= hci_add_remote_oob_data(hdev
, &cp
->addr
.bdaddr
,
3380 cp
->addr
.type
, hash192
, rand192
,
3383 status
= MGMT_STATUS_FAILED
;
3385 status
= MGMT_STATUS_SUCCESS
;
3387 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3388 MGMT_OP_ADD_REMOTE_OOB_DATA
,
3389 status
, &cp
->addr
, sizeof(cp
->addr
));
3391 bt_dev_err(hdev
, "add_remote_oob_data: invalid len of %u bytes",
3393 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_REMOTE_OOB_DATA
,
3394 MGMT_STATUS_INVALID_PARAMS
);
3398 hci_dev_unlock(hdev
);
3402 static int remove_remote_oob_data(struct sock
*sk
, struct hci_dev
*hdev
,
3403 void *data
, u16 len
)
3405 struct mgmt_cp_remove_remote_oob_data
*cp
= data
;
3409 BT_DBG("%s", hdev
->name
);
3411 if (cp
->addr
.type
!= BDADDR_BREDR
)
3412 return mgmt_cmd_complete(sk
, hdev
->id
,
3413 MGMT_OP_REMOVE_REMOTE_OOB_DATA
,
3414 MGMT_STATUS_INVALID_PARAMS
,
3415 &cp
->addr
, sizeof(cp
->addr
));
3419 if (!bacmp(&cp
->addr
.bdaddr
, BDADDR_ANY
)) {
3420 hci_remote_oob_data_clear(hdev
);
3421 status
= MGMT_STATUS_SUCCESS
;
3425 err
= hci_remove_remote_oob_data(hdev
, &cp
->addr
.bdaddr
, cp
->addr
.type
);
3427 status
= MGMT_STATUS_INVALID_PARAMS
;
3429 status
= MGMT_STATUS_SUCCESS
;
3432 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_REMOVE_REMOTE_OOB_DATA
,
3433 status
, &cp
->addr
, sizeof(cp
->addr
));
3435 hci_dev_unlock(hdev
);
3439 void mgmt_start_discovery_complete(struct hci_dev
*hdev
, u8 status
)
3441 struct mgmt_pending_cmd
*cmd
;
3443 BT_DBG("status %d", status
);
3447 cmd
= pending_find(MGMT_OP_START_DISCOVERY
, hdev
);
3449 cmd
= pending_find(MGMT_OP_START_SERVICE_DISCOVERY
, hdev
);
3452 cmd
= pending_find(MGMT_OP_START_LIMITED_DISCOVERY
, hdev
);
3455 cmd
->cmd_complete(cmd
, mgmt_status(status
));
3456 mgmt_pending_remove(cmd
);
3459 hci_dev_unlock(hdev
);
3462 static bool discovery_type_is_valid(struct hci_dev
*hdev
, uint8_t type
,
3463 uint8_t *mgmt_status
)
3466 case DISCOV_TYPE_LE
:
3467 *mgmt_status
= mgmt_le_support(hdev
);
3471 case DISCOV_TYPE_INTERLEAVED
:
3472 *mgmt_status
= mgmt_le_support(hdev
);
3475 /* Intentional fall-through */
3476 case DISCOV_TYPE_BREDR
:
3477 *mgmt_status
= mgmt_bredr_support(hdev
);
3482 *mgmt_status
= MGMT_STATUS_INVALID_PARAMS
;
3489 static int start_discovery_internal(struct sock
*sk
, struct hci_dev
*hdev
,
3490 u16 op
, void *data
, u16 len
)
3492 struct mgmt_cp_start_discovery
*cp
= data
;
3493 struct mgmt_pending_cmd
*cmd
;
3497 BT_DBG("%s", hdev
->name
);
3501 if (!hdev_is_powered(hdev
)) {
3502 err
= mgmt_cmd_complete(sk
, hdev
->id
, op
,
3503 MGMT_STATUS_NOT_POWERED
,
3504 &cp
->type
, sizeof(cp
->type
));
3508 if (hdev
->discovery
.state
!= DISCOVERY_STOPPED
||
3509 hci_dev_test_flag(hdev
, HCI_PERIODIC_INQ
)) {
3510 err
= mgmt_cmd_complete(sk
, hdev
->id
, op
, MGMT_STATUS_BUSY
,
3511 &cp
->type
, sizeof(cp
->type
));
3515 if (!discovery_type_is_valid(hdev
, cp
->type
, &status
)) {
3516 err
= mgmt_cmd_complete(sk
, hdev
->id
, op
, status
,
3517 &cp
->type
, sizeof(cp
->type
));
3521 /* Clear the discovery filter first to free any previously
3522 * allocated memory for the UUID list.
3524 hci_discovery_filter_clear(hdev
);
3526 hdev
->discovery
.type
= cp
->type
;
3527 hdev
->discovery
.report_invalid_rssi
= false;
3528 if (op
== MGMT_OP_START_LIMITED_DISCOVERY
)
3529 hdev
->discovery
.limited
= true;
3531 hdev
->discovery
.limited
= false;
3533 cmd
= mgmt_pending_add(sk
, op
, hdev
, data
, len
);
3539 cmd
->cmd_complete
= generic_cmd_complete
;
3541 hci_discovery_set_state(hdev
, DISCOVERY_STARTING
);
3542 queue_work(hdev
->req_workqueue
, &hdev
->discov_update
);
3546 hci_dev_unlock(hdev
);
3550 static int start_discovery(struct sock
*sk
, struct hci_dev
*hdev
,
3551 void *data
, u16 len
)
3553 return start_discovery_internal(sk
, hdev
, MGMT_OP_START_DISCOVERY
,
3557 static int start_limited_discovery(struct sock
*sk
, struct hci_dev
*hdev
,
3558 void *data
, u16 len
)
3560 return start_discovery_internal(sk
, hdev
,
3561 MGMT_OP_START_LIMITED_DISCOVERY
,
3565 static int service_discovery_cmd_complete(struct mgmt_pending_cmd
*cmd
,
3568 return mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
, status
,
3572 static int start_service_discovery(struct sock
*sk
, struct hci_dev
*hdev
,
3573 void *data
, u16 len
)
3575 struct mgmt_cp_start_service_discovery
*cp
= data
;
3576 struct mgmt_pending_cmd
*cmd
;
3577 const u16 max_uuid_count
= ((U16_MAX
- sizeof(*cp
)) / 16);
3578 u16 uuid_count
, expected_len
;
3582 BT_DBG("%s", hdev
->name
);
3586 if (!hdev_is_powered(hdev
)) {
3587 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3588 MGMT_OP_START_SERVICE_DISCOVERY
,
3589 MGMT_STATUS_NOT_POWERED
,
3590 &cp
->type
, sizeof(cp
->type
));
3594 if (hdev
->discovery
.state
!= DISCOVERY_STOPPED
||
3595 hci_dev_test_flag(hdev
, HCI_PERIODIC_INQ
)) {
3596 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3597 MGMT_OP_START_SERVICE_DISCOVERY
,
3598 MGMT_STATUS_BUSY
, &cp
->type
,
3603 uuid_count
= __le16_to_cpu(cp
->uuid_count
);
3604 if (uuid_count
> max_uuid_count
) {
3605 bt_dev_err(hdev
, "service_discovery: too big uuid_count value %u",
3607 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3608 MGMT_OP_START_SERVICE_DISCOVERY
,
3609 MGMT_STATUS_INVALID_PARAMS
, &cp
->type
,
3614 expected_len
= sizeof(*cp
) + uuid_count
* 16;
3615 if (expected_len
!= len
) {
3616 bt_dev_err(hdev
, "service_discovery: expected %u bytes, got %u bytes",
3618 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3619 MGMT_OP_START_SERVICE_DISCOVERY
,
3620 MGMT_STATUS_INVALID_PARAMS
, &cp
->type
,
3625 if (!discovery_type_is_valid(hdev
, cp
->type
, &status
)) {
3626 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3627 MGMT_OP_START_SERVICE_DISCOVERY
,
3628 status
, &cp
->type
, sizeof(cp
->type
));
3632 cmd
= mgmt_pending_add(sk
, MGMT_OP_START_SERVICE_DISCOVERY
,
3639 cmd
->cmd_complete
= service_discovery_cmd_complete
;
3641 /* Clear the discovery filter first to free any previously
3642 * allocated memory for the UUID list.
3644 hci_discovery_filter_clear(hdev
);
3646 hdev
->discovery
.result_filtering
= true;
3647 hdev
->discovery
.type
= cp
->type
;
3648 hdev
->discovery
.rssi
= cp
->rssi
;
3649 hdev
->discovery
.uuid_count
= uuid_count
;
3651 if (uuid_count
> 0) {
3652 hdev
->discovery
.uuids
= kmemdup(cp
->uuids
, uuid_count
* 16,
3654 if (!hdev
->discovery
.uuids
) {
3655 err
= mgmt_cmd_complete(sk
, hdev
->id
,
3656 MGMT_OP_START_SERVICE_DISCOVERY
,
3658 &cp
->type
, sizeof(cp
->type
));
3659 mgmt_pending_remove(cmd
);
3664 hci_discovery_set_state(hdev
, DISCOVERY_STARTING
);
3665 queue_work(hdev
->req_workqueue
, &hdev
->discov_update
);
3669 hci_dev_unlock(hdev
);
3673 void mgmt_stop_discovery_complete(struct hci_dev
*hdev
, u8 status
)
3675 struct mgmt_pending_cmd
*cmd
;
3677 BT_DBG("status %d", status
);
3681 cmd
= pending_find(MGMT_OP_STOP_DISCOVERY
, hdev
);
3683 cmd
->cmd_complete(cmd
, mgmt_status(status
));
3684 mgmt_pending_remove(cmd
);
3687 hci_dev_unlock(hdev
);
3690 static int stop_discovery(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3693 struct mgmt_cp_stop_discovery
*mgmt_cp
= data
;
3694 struct mgmt_pending_cmd
*cmd
;
3697 BT_DBG("%s", hdev
->name
);
3701 if (!hci_discovery_active(hdev
)) {
3702 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_STOP_DISCOVERY
,
3703 MGMT_STATUS_REJECTED
, &mgmt_cp
->type
,
3704 sizeof(mgmt_cp
->type
));
3708 if (hdev
->discovery
.type
!= mgmt_cp
->type
) {
3709 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_STOP_DISCOVERY
,
3710 MGMT_STATUS_INVALID_PARAMS
,
3711 &mgmt_cp
->type
, sizeof(mgmt_cp
->type
));
3715 cmd
= mgmt_pending_add(sk
, MGMT_OP_STOP_DISCOVERY
, hdev
, data
, len
);
3721 cmd
->cmd_complete
= generic_cmd_complete
;
3723 hci_discovery_set_state(hdev
, DISCOVERY_STOPPING
);
3724 queue_work(hdev
->req_workqueue
, &hdev
->discov_update
);
3728 hci_dev_unlock(hdev
);
3732 static int confirm_name(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3735 struct mgmt_cp_confirm_name
*cp
= data
;
3736 struct inquiry_entry
*e
;
3739 BT_DBG("%s", hdev
->name
);
3743 if (!hci_discovery_active(hdev
)) {
3744 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_CONFIRM_NAME
,
3745 MGMT_STATUS_FAILED
, &cp
->addr
,
3750 e
= hci_inquiry_cache_lookup_unknown(hdev
, &cp
->addr
.bdaddr
);
3752 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_CONFIRM_NAME
,
3753 MGMT_STATUS_INVALID_PARAMS
, &cp
->addr
,
3758 if (cp
->name_known
) {
3759 e
->name_state
= NAME_KNOWN
;
3762 e
->name_state
= NAME_NEEDED
;
3763 hci_inquiry_cache_update_resolve(hdev
, e
);
3766 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_CONFIRM_NAME
, 0,
3767 &cp
->addr
, sizeof(cp
->addr
));
3770 hci_dev_unlock(hdev
);
3774 static int block_device(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3777 struct mgmt_cp_block_device
*cp
= data
;
3781 BT_DBG("%s", hdev
->name
);
3783 if (!bdaddr_type_is_valid(cp
->addr
.type
))
3784 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_BLOCK_DEVICE
,
3785 MGMT_STATUS_INVALID_PARAMS
,
3786 &cp
->addr
, sizeof(cp
->addr
));
3790 err
= hci_bdaddr_list_add(&hdev
->blacklist
, &cp
->addr
.bdaddr
,
3793 status
= MGMT_STATUS_FAILED
;
3797 mgmt_event(MGMT_EV_DEVICE_BLOCKED
, hdev
, &cp
->addr
, sizeof(cp
->addr
),
3799 status
= MGMT_STATUS_SUCCESS
;
3802 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_BLOCK_DEVICE
, status
,
3803 &cp
->addr
, sizeof(cp
->addr
));
3805 hci_dev_unlock(hdev
);
3810 static int unblock_device(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3813 struct mgmt_cp_unblock_device
*cp
= data
;
3817 BT_DBG("%s", hdev
->name
);
3819 if (!bdaddr_type_is_valid(cp
->addr
.type
))
3820 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNBLOCK_DEVICE
,
3821 MGMT_STATUS_INVALID_PARAMS
,
3822 &cp
->addr
, sizeof(cp
->addr
));
3826 err
= hci_bdaddr_list_del(&hdev
->blacklist
, &cp
->addr
.bdaddr
,
3829 status
= MGMT_STATUS_INVALID_PARAMS
;
3833 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED
, hdev
, &cp
->addr
, sizeof(cp
->addr
),
3835 status
= MGMT_STATUS_SUCCESS
;
3838 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_UNBLOCK_DEVICE
, status
,
3839 &cp
->addr
, sizeof(cp
->addr
));
3841 hci_dev_unlock(hdev
);
3846 static int set_device_id(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3849 struct mgmt_cp_set_device_id
*cp
= data
;
3850 struct hci_request req
;
3854 BT_DBG("%s", hdev
->name
);
3856 source
= __le16_to_cpu(cp
->source
);
3858 if (source
> 0x0002)
3859 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DEVICE_ID
,
3860 MGMT_STATUS_INVALID_PARAMS
);
3864 hdev
->devid_source
= source
;
3865 hdev
->devid_vendor
= __le16_to_cpu(cp
->vendor
);
3866 hdev
->devid_product
= __le16_to_cpu(cp
->product
);
3867 hdev
->devid_version
= __le16_to_cpu(cp
->version
);
3869 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_DEVICE_ID
, 0,
3872 hci_req_init(&req
, hdev
);
3873 __hci_req_update_eir(&req
);
3874 hci_req_run(&req
, NULL
);
3876 hci_dev_unlock(hdev
);
3881 static void enable_advertising_instance(struct hci_dev
*hdev
, u8 status
,
3884 BT_DBG("status %d", status
);
3887 static void set_advertising_complete(struct hci_dev
*hdev
, u8 status
,
3890 struct cmd_lookup match
= { NULL
, hdev
};
3891 struct hci_request req
;
3893 struct adv_info
*adv_instance
;
3899 u8 mgmt_err
= mgmt_status(status
);
3901 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING
, hdev
,
3902 cmd_status_rsp
, &mgmt_err
);
3906 if (hci_dev_test_flag(hdev
, HCI_LE_ADV
))
3907 hci_dev_set_flag(hdev
, HCI_ADVERTISING
);
3909 hci_dev_clear_flag(hdev
, HCI_ADVERTISING
);
3911 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING
, hdev
, settings_rsp
,
3914 new_settings(hdev
, match
.sk
);
3919 /* If "Set Advertising" was just disabled and instance advertising was
3920 * set up earlier, then re-enable multi-instance advertising.
3922 if (hci_dev_test_flag(hdev
, HCI_ADVERTISING
) ||
3923 list_empty(&hdev
->adv_instances
))
3926 instance
= hdev
->cur_adv_instance
;
3928 adv_instance
= list_first_entry_or_null(&hdev
->adv_instances
,
3929 struct adv_info
, list
);
3933 instance
= adv_instance
->instance
;
3936 hci_req_init(&req
, hdev
);
3938 err
= __hci_req_schedule_adv_instance(&req
, instance
, true);
3941 err
= hci_req_run(&req
, enable_advertising_instance
);
3944 bt_dev_err(hdev
, "failed to re-configure advertising");
3947 hci_dev_unlock(hdev
);
3950 static int set_advertising(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
3953 struct mgmt_mode
*cp
= data
;
3954 struct mgmt_pending_cmd
*cmd
;
3955 struct hci_request req
;
3959 BT_DBG("request for %s", hdev
->name
);
3961 status
= mgmt_le_support(hdev
);
3963 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_ADVERTISING
,
3966 if (cp
->val
!= 0x00 && cp
->val
!= 0x01 && cp
->val
!= 0x02)
3967 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_ADVERTISING
,
3968 MGMT_STATUS_INVALID_PARAMS
);
3974 /* The following conditions are ones which mean that we should
3975 * not do any HCI communication but directly send a mgmt
3976 * response to user space (after toggling the flag if
3979 if (!hdev_is_powered(hdev
) ||
3980 (val
== hci_dev_test_flag(hdev
, HCI_ADVERTISING
) &&
3981 (cp
->val
== 0x02) == hci_dev_test_flag(hdev
, HCI_ADVERTISING_CONNECTABLE
)) ||
3982 hci_conn_num(hdev
, LE_LINK
) > 0 ||
3983 (hci_dev_test_flag(hdev
, HCI_LE_SCAN
) &&
3984 hdev
->le_scan_type
== LE_SCAN_ACTIVE
)) {
3988 hdev
->cur_adv_instance
= 0x00;
3989 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_ADVERTISING
);
3990 if (cp
->val
== 0x02)
3991 hci_dev_set_flag(hdev
, HCI_ADVERTISING_CONNECTABLE
);
3993 hci_dev_clear_flag(hdev
, HCI_ADVERTISING_CONNECTABLE
);
3995 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_ADVERTISING
);
3996 hci_dev_clear_flag(hdev
, HCI_ADVERTISING_CONNECTABLE
);
3999 err
= send_settings_rsp(sk
, MGMT_OP_SET_ADVERTISING
, hdev
);
4004 err
= new_settings(hdev
, sk
);
4009 if (pending_find(MGMT_OP_SET_ADVERTISING
, hdev
) ||
4010 pending_find(MGMT_OP_SET_LE
, hdev
)) {
4011 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_ADVERTISING
,
4016 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_ADVERTISING
, hdev
, data
, len
);
4022 hci_req_init(&req
, hdev
);
4024 if (cp
->val
== 0x02)
4025 hci_dev_set_flag(hdev
, HCI_ADVERTISING_CONNECTABLE
);
4027 hci_dev_clear_flag(hdev
, HCI_ADVERTISING_CONNECTABLE
);
4029 cancel_adv_timeout(hdev
);
4032 /* Switch to instance "0" for the Set Advertising setting.
4033 * We cannot use update_[adv|scan_rsp]_data() here as the
4034 * HCI_ADVERTISING flag is not yet set.
4036 hdev
->cur_adv_instance
= 0x00;
4037 __hci_req_update_adv_data(&req
, 0x00);
4038 __hci_req_update_scan_rsp_data(&req
, 0x00);
4039 __hci_req_enable_advertising(&req
);
4041 __hci_req_disable_advertising(&req
);
4044 err
= hci_req_run(&req
, set_advertising_complete
);
4046 mgmt_pending_remove(cmd
);
4049 hci_dev_unlock(hdev
);
4053 static int set_static_address(struct sock
*sk
, struct hci_dev
*hdev
,
4054 void *data
, u16 len
)
4056 struct mgmt_cp_set_static_address
*cp
= data
;
4059 BT_DBG("%s", hdev
->name
);
4061 if (!lmp_le_capable(hdev
))
4062 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_STATIC_ADDRESS
,
4063 MGMT_STATUS_NOT_SUPPORTED
);
4065 if (hdev_is_powered(hdev
))
4066 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_STATIC_ADDRESS
,
4067 MGMT_STATUS_REJECTED
);
4069 if (bacmp(&cp
->bdaddr
, BDADDR_ANY
)) {
4070 if (!bacmp(&cp
->bdaddr
, BDADDR_NONE
))
4071 return mgmt_cmd_status(sk
, hdev
->id
,
4072 MGMT_OP_SET_STATIC_ADDRESS
,
4073 MGMT_STATUS_INVALID_PARAMS
);
4075 /* Two most significant bits shall be set */
4076 if ((cp
->bdaddr
.b
[5] & 0xc0) != 0xc0)
4077 return mgmt_cmd_status(sk
, hdev
->id
,
4078 MGMT_OP_SET_STATIC_ADDRESS
,
4079 MGMT_STATUS_INVALID_PARAMS
);
4084 bacpy(&hdev
->static_addr
, &cp
->bdaddr
);
4086 err
= send_settings_rsp(sk
, MGMT_OP_SET_STATIC_ADDRESS
, hdev
);
4090 err
= new_settings(hdev
, sk
);
4093 hci_dev_unlock(hdev
);
4097 static int set_scan_params(struct sock
*sk
, struct hci_dev
*hdev
,
4098 void *data
, u16 len
)
4100 struct mgmt_cp_set_scan_params
*cp
= data
;
4101 __u16 interval
, window
;
4104 BT_DBG("%s", hdev
->name
);
4106 if (!lmp_le_capable(hdev
))
4107 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SCAN_PARAMS
,
4108 MGMT_STATUS_NOT_SUPPORTED
);
4110 interval
= __le16_to_cpu(cp
->interval
);
4112 if (interval
< 0x0004 || interval
> 0x4000)
4113 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SCAN_PARAMS
,
4114 MGMT_STATUS_INVALID_PARAMS
);
4116 window
= __le16_to_cpu(cp
->window
);
4118 if (window
< 0x0004 || window
> 0x4000)
4119 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SCAN_PARAMS
,
4120 MGMT_STATUS_INVALID_PARAMS
);
4122 if (window
> interval
)
4123 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SCAN_PARAMS
,
4124 MGMT_STATUS_INVALID_PARAMS
);
4128 hdev
->le_scan_interval
= interval
;
4129 hdev
->le_scan_window
= window
;
4131 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_SET_SCAN_PARAMS
, 0,
4134 /* If background scan is running, restart it so new parameters are
4137 if (hci_dev_test_flag(hdev
, HCI_LE_SCAN
) &&
4138 hdev
->discovery
.state
== DISCOVERY_STOPPED
) {
4139 struct hci_request req
;
4141 hci_req_init(&req
, hdev
);
4143 hci_req_add_le_scan_disable(&req
);
4144 hci_req_add_le_passive_scan(&req
);
4146 hci_req_run(&req
, NULL
);
4149 hci_dev_unlock(hdev
);
4154 static void fast_connectable_complete(struct hci_dev
*hdev
, u8 status
,
4157 struct mgmt_pending_cmd
*cmd
;
4159 BT_DBG("status 0x%02x", status
);
4163 cmd
= pending_find(MGMT_OP_SET_FAST_CONNECTABLE
, hdev
);
4168 mgmt_cmd_status(cmd
->sk
, hdev
->id
, MGMT_OP_SET_FAST_CONNECTABLE
,
4169 mgmt_status(status
));
4171 struct mgmt_mode
*cp
= cmd
->param
;
4174 hci_dev_set_flag(hdev
, HCI_FAST_CONNECTABLE
);
4176 hci_dev_clear_flag(hdev
, HCI_FAST_CONNECTABLE
);
4178 send_settings_rsp(cmd
->sk
, MGMT_OP_SET_FAST_CONNECTABLE
, hdev
);
4179 new_settings(hdev
, cmd
->sk
);
4182 mgmt_pending_remove(cmd
);
4185 hci_dev_unlock(hdev
);
4188 static int set_fast_connectable(struct sock
*sk
, struct hci_dev
*hdev
,
4189 void *data
, u16 len
)
4191 struct mgmt_mode
*cp
= data
;
4192 struct mgmt_pending_cmd
*cmd
;
4193 struct hci_request req
;
4196 BT_DBG("%s", hdev
->name
);
4198 if (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
) ||
4199 hdev
->hci_ver
< BLUETOOTH_VER_1_2
)
4200 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_FAST_CONNECTABLE
,
4201 MGMT_STATUS_NOT_SUPPORTED
);
4203 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
4204 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_FAST_CONNECTABLE
,
4205 MGMT_STATUS_INVALID_PARAMS
);
4209 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE
, hdev
)) {
4210 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_FAST_CONNECTABLE
,
4215 if (!!cp
->val
== hci_dev_test_flag(hdev
, HCI_FAST_CONNECTABLE
)) {
4216 err
= send_settings_rsp(sk
, MGMT_OP_SET_FAST_CONNECTABLE
,
4221 if (!hdev_is_powered(hdev
)) {
4222 hci_dev_change_flag(hdev
, HCI_FAST_CONNECTABLE
);
4223 err
= send_settings_rsp(sk
, MGMT_OP_SET_FAST_CONNECTABLE
,
4225 new_settings(hdev
, sk
);
4229 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_FAST_CONNECTABLE
, hdev
,
4236 hci_req_init(&req
, hdev
);
4238 __hci_req_write_fast_connectable(&req
, cp
->val
);
4240 err
= hci_req_run(&req
, fast_connectable_complete
);
4242 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_FAST_CONNECTABLE
,
4243 MGMT_STATUS_FAILED
);
4244 mgmt_pending_remove(cmd
);
4248 hci_dev_unlock(hdev
);
4253 static void set_bredr_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
4255 struct mgmt_pending_cmd
*cmd
;
4257 BT_DBG("status 0x%02x", status
);
4261 cmd
= pending_find(MGMT_OP_SET_BREDR
, hdev
);
4266 u8 mgmt_err
= mgmt_status(status
);
4268 /* We need to restore the flag if related HCI commands
4271 hci_dev_clear_flag(hdev
, HCI_BREDR_ENABLED
);
4273 mgmt_cmd_status(cmd
->sk
, cmd
->index
, cmd
->opcode
, mgmt_err
);
4275 send_settings_rsp(cmd
->sk
, MGMT_OP_SET_BREDR
, hdev
);
4276 new_settings(hdev
, cmd
->sk
);
4279 mgmt_pending_remove(cmd
);
4282 hci_dev_unlock(hdev
);
4285 static int set_bredr(struct sock
*sk
, struct hci_dev
*hdev
, void *data
, u16 len
)
4287 struct mgmt_mode
*cp
= data
;
4288 struct mgmt_pending_cmd
*cmd
;
4289 struct hci_request req
;
4292 BT_DBG("request for %s", hdev
->name
);
4294 if (!lmp_bredr_capable(hdev
) || !lmp_le_capable(hdev
))
4295 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BREDR
,
4296 MGMT_STATUS_NOT_SUPPORTED
);
4298 if (!hci_dev_test_flag(hdev
, HCI_LE_ENABLED
))
4299 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BREDR
,
4300 MGMT_STATUS_REJECTED
);
4302 if (cp
->val
!= 0x00 && cp
->val
!= 0x01)
4303 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BREDR
,
4304 MGMT_STATUS_INVALID_PARAMS
);
4308 if (cp
->val
== hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
)) {
4309 err
= send_settings_rsp(sk
, MGMT_OP_SET_BREDR
, hdev
);
4313 if (!hdev_is_powered(hdev
)) {
4315 hci_dev_clear_flag(hdev
, HCI_DISCOVERABLE
);
4316 hci_dev_clear_flag(hdev
, HCI_SSP_ENABLED
);
4317 hci_dev_clear_flag(hdev
, HCI_LINK_SECURITY
);
4318 hci_dev_clear_flag(hdev
, HCI_FAST_CONNECTABLE
);
4319 hci_dev_clear_flag(hdev
, HCI_HS_ENABLED
);
4322 hci_dev_change_flag(hdev
, HCI_BREDR_ENABLED
);
4324 err
= send_settings_rsp(sk
, MGMT_OP_SET_BREDR
, hdev
);
4328 err
= new_settings(hdev
, sk
);
4332 /* Reject disabling when powered on */
4334 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BREDR
,
4335 MGMT_STATUS_REJECTED
);
4338 /* When configuring a dual-mode controller to operate
4339 * with LE only and using a static address, then switching
4340 * BR/EDR back on is not allowed.
4342 * Dual-mode controllers shall operate with the public
4343 * address as its identity address for BR/EDR and LE. So
4344 * reject the attempt to create an invalid configuration.
4346 * The same restrictions applies when secure connections
4347 * has been enabled. For BR/EDR this is a controller feature
4348 * while for LE it is a host stack feature. This means that
4349 * switching BR/EDR back on when secure connections has been
4350 * enabled is not a supported transaction.
4352 if (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
) &&
4353 (bacmp(&hdev
->static_addr
, BDADDR_ANY
) ||
4354 hci_dev_test_flag(hdev
, HCI_SC_ENABLED
))) {
4355 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BREDR
,
4356 MGMT_STATUS_REJECTED
);
4361 if (pending_find(MGMT_OP_SET_BREDR
, hdev
)) {
4362 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_BREDR
,
4367 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_BREDR
, hdev
, data
, len
);
4373 /* We need to flip the bit already here so that
4374 * hci_req_update_adv_data generates the correct flags.
4376 hci_dev_set_flag(hdev
, HCI_BREDR_ENABLED
);
4378 hci_req_init(&req
, hdev
);
4380 __hci_req_write_fast_connectable(&req
, false);
4381 __hci_req_update_scan(&req
);
4383 /* Since only the advertising data flags will change, there
4384 * is no need to update the scan response data.
4386 __hci_req_update_adv_data(&req
, hdev
->cur_adv_instance
);
4388 err
= hci_req_run(&req
, set_bredr_complete
);
4390 mgmt_pending_remove(cmd
);
4393 hci_dev_unlock(hdev
);
4397 static void sc_enable_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
4399 struct mgmt_pending_cmd
*cmd
;
4400 struct mgmt_mode
*cp
;
4402 BT_DBG("%s status %u", hdev
->name
, status
);
4406 cmd
= pending_find(MGMT_OP_SET_SECURE_CONN
, hdev
);
4411 mgmt_cmd_status(cmd
->sk
, cmd
->index
, cmd
->opcode
,
4412 mgmt_status(status
));
4420 hci_dev_clear_flag(hdev
, HCI_SC_ENABLED
);
4421 hci_dev_clear_flag(hdev
, HCI_SC_ONLY
);
4424 hci_dev_set_flag(hdev
, HCI_SC_ENABLED
);
4425 hci_dev_clear_flag(hdev
, HCI_SC_ONLY
);
4428 hci_dev_set_flag(hdev
, HCI_SC_ENABLED
);
4429 hci_dev_set_flag(hdev
, HCI_SC_ONLY
);
4433 send_settings_rsp(cmd
->sk
, MGMT_OP_SET_SECURE_CONN
, hdev
);
4434 new_settings(hdev
, cmd
->sk
);
4437 mgmt_pending_remove(cmd
);
4439 hci_dev_unlock(hdev
);
4442 static int set_secure_conn(struct sock
*sk
, struct hci_dev
*hdev
,
4443 void *data
, u16 len
)
4445 struct mgmt_mode
*cp
= data
;
4446 struct mgmt_pending_cmd
*cmd
;
4447 struct hci_request req
;
4451 BT_DBG("request for %s", hdev
->name
);
4453 if (!lmp_sc_capable(hdev
) &&
4454 !hci_dev_test_flag(hdev
, HCI_LE_ENABLED
))
4455 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SECURE_CONN
,
4456 MGMT_STATUS_NOT_SUPPORTED
);
4458 if (hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
) &&
4459 lmp_sc_capable(hdev
) &&
4460 !hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
))
4461 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SECURE_CONN
,
4462 MGMT_STATUS_REJECTED
);
4464 if (cp
->val
!= 0x00 && cp
->val
!= 0x01 && cp
->val
!= 0x02)
4465 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SECURE_CONN
,
4466 MGMT_STATUS_INVALID_PARAMS
);
4470 if (!hdev_is_powered(hdev
) || !lmp_sc_capable(hdev
) ||
4471 !hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
)) {
4475 changed
= !hci_dev_test_and_set_flag(hdev
,
4477 if (cp
->val
== 0x02)
4478 hci_dev_set_flag(hdev
, HCI_SC_ONLY
);
4480 hci_dev_clear_flag(hdev
, HCI_SC_ONLY
);
4482 changed
= hci_dev_test_and_clear_flag(hdev
,
4484 hci_dev_clear_flag(hdev
, HCI_SC_ONLY
);
4487 err
= send_settings_rsp(sk
, MGMT_OP_SET_SECURE_CONN
, hdev
);
4492 err
= new_settings(hdev
, sk
);
4497 if (pending_find(MGMT_OP_SET_SECURE_CONN
, hdev
)) {
4498 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_SECURE_CONN
,
4505 if (val
== hci_dev_test_flag(hdev
, HCI_SC_ENABLED
) &&
4506 (cp
->val
== 0x02) == hci_dev_test_flag(hdev
, HCI_SC_ONLY
)) {
4507 err
= send_settings_rsp(sk
, MGMT_OP_SET_SECURE_CONN
, hdev
);
4511 cmd
= mgmt_pending_add(sk
, MGMT_OP_SET_SECURE_CONN
, hdev
, data
, len
);
4517 hci_req_init(&req
, hdev
);
4518 hci_req_add(&req
, HCI_OP_WRITE_SC_SUPPORT
, 1, &val
);
4519 err
= hci_req_run(&req
, sc_enable_complete
);
4521 mgmt_pending_remove(cmd
);
4526 hci_dev_unlock(hdev
);
4530 static int set_debug_keys(struct sock
*sk
, struct hci_dev
*hdev
,
4531 void *data
, u16 len
)
4533 struct mgmt_mode
*cp
= data
;
4534 bool changed
, use_changed
;
4537 BT_DBG("request for %s", hdev
->name
);
4539 if (cp
->val
!= 0x00 && cp
->val
!= 0x01 && cp
->val
!= 0x02)
4540 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_DEBUG_KEYS
,
4541 MGMT_STATUS_INVALID_PARAMS
);
4546 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_KEEP_DEBUG_KEYS
);
4548 changed
= hci_dev_test_and_clear_flag(hdev
,
4549 HCI_KEEP_DEBUG_KEYS
);
4551 if (cp
->val
== 0x02)
4552 use_changed
= !hci_dev_test_and_set_flag(hdev
,
4553 HCI_USE_DEBUG_KEYS
);
4555 use_changed
= hci_dev_test_and_clear_flag(hdev
,
4556 HCI_USE_DEBUG_KEYS
);
4558 if (hdev_is_powered(hdev
) && use_changed
&&
4559 hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
)) {
4560 u8 mode
= (cp
->val
== 0x02) ? 0x01 : 0x00;
4561 hci_send_cmd(hdev
, HCI_OP_WRITE_SSP_DEBUG_MODE
,
4562 sizeof(mode
), &mode
);
4565 err
= send_settings_rsp(sk
, MGMT_OP_SET_DEBUG_KEYS
, hdev
);
4570 err
= new_settings(hdev
, sk
);
4573 hci_dev_unlock(hdev
);
4577 static int set_privacy(struct sock
*sk
, struct hci_dev
*hdev
, void *cp_data
,
4580 struct mgmt_cp_set_privacy
*cp
= cp_data
;
4584 BT_DBG("request for %s", hdev
->name
);
4586 if (!lmp_le_capable(hdev
))
4587 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_PRIVACY
,
4588 MGMT_STATUS_NOT_SUPPORTED
);
4590 if (cp
->privacy
!= 0x00 && cp
->privacy
!= 0x01 && cp
->privacy
!= 0x02)
4591 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_PRIVACY
,
4592 MGMT_STATUS_INVALID_PARAMS
);
4594 if (hdev_is_powered(hdev
))
4595 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_PRIVACY
,
4596 MGMT_STATUS_REJECTED
);
4600 /* If user space supports this command it is also expected to
4601 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
4603 hci_dev_set_flag(hdev
, HCI_RPA_RESOLVING
);
4606 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_PRIVACY
);
4607 memcpy(hdev
->irk
, cp
->irk
, sizeof(hdev
->irk
));
4608 hci_dev_set_flag(hdev
, HCI_RPA_EXPIRED
);
4609 if (cp
->privacy
== 0x02)
4610 hci_dev_set_flag(hdev
, HCI_LIMITED_PRIVACY
);
4612 hci_dev_clear_flag(hdev
, HCI_LIMITED_PRIVACY
);
4614 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_PRIVACY
);
4615 memset(hdev
->irk
, 0, sizeof(hdev
->irk
));
4616 hci_dev_clear_flag(hdev
, HCI_RPA_EXPIRED
);
4617 hci_dev_clear_flag(hdev
, HCI_LIMITED_PRIVACY
);
4620 err
= send_settings_rsp(sk
, MGMT_OP_SET_PRIVACY
, hdev
);
4625 err
= new_settings(hdev
, sk
);
4628 hci_dev_unlock(hdev
);
4632 static bool irk_is_valid(struct mgmt_irk_info
*irk
)
4634 switch (irk
->addr
.type
) {
4635 case BDADDR_LE_PUBLIC
:
4638 case BDADDR_LE_RANDOM
:
4639 /* Two most significant bits shall be set */
4640 if ((irk
->addr
.bdaddr
.b
[5] & 0xc0) != 0xc0)
4648 static int load_irks(struct sock
*sk
, struct hci_dev
*hdev
, void *cp_data
,
4651 struct mgmt_cp_load_irks
*cp
= cp_data
;
4652 const u16 max_irk_count
= ((U16_MAX
- sizeof(*cp
)) /
4653 sizeof(struct mgmt_irk_info
));
4654 u16 irk_count
, expected_len
;
4657 BT_DBG("request for %s", hdev
->name
);
4659 if (!lmp_le_capable(hdev
))
4660 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_IRKS
,
4661 MGMT_STATUS_NOT_SUPPORTED
);
4663 irk_count
= __le16_to_cpu(cp
->irk_count
);
4664 if (irk_count
> max_irk_count
) {
4665 bt_dev_err(hdev
, "load_irks: too big irk_count value %u",
4667 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_IRKS
,
4668 MGMT_STATUS_INVALID_PARAMS
);
4671 expected_len
= sizeof(*cp
) + irk_count
* sizeof(struct mgmt_irk_info
);
4672 if (expected_len
!= len
) {
4673 bt_dev_err(hdev
, "load_irks: expected %u bytes, got %u bytes",
4675 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_IRKS
,
4676 MGMT_STATUS_INVALID_PARAMS
);
4679 BT_DBG("%s irk_count %u", hdev
->name
, irk_count
);
4681 for (i
= 0; i
< irk_count
; i
++) {
4682 struct mgmt_irk_info
*key
= &cp
->irks
[i
];
4684 if (!irk_is_valid(key
))
4685 return mgmt_cmd_status(sk
, hdev
->id
,
4687 MGMT_STATUS_INVALID_PARAMS
);
4692 hci_smp_irks_clear(hdev
);
4694 for (i
= 0; i
< irk_count
; i
++) {
4695 struct mgmt_irk_info
*irk
= &cp
->irks
[i
];
4697 hci_add_irk(hdev
, &irk
->addr
.bdaddr
,
4698 le_addr_type(irk
->addr
.type
), irk
->val
,
4702 hci_dev_set_flag(hdev
, HCI_RPA_RESOLVING
);
4704 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_LOAD_IRKS
, 0, NULL
, 0);
4706 hci_dev_unlock(hdev
);
4711 static bool ltk_is_valid(struct mgmt_ltk_info
*key
)
4713 if (key
->master
!= 0x00 && key
->master
!= 0x01)
4716 switch (key
->addr
.type
) {
4717 case BDADDR_LE_PUBLIC
:
4720 case BDADDR_LE_RANDOM
:
4721 /* Two most significant bits shall be set */
4722 if ((key
->addr
.bdaddr
.b
[5] & 0xc0) != 0xc0)
4730 static int load_long_term_keys(struct sock
*sk
, struct hci_dev
*hdev
,
4731 void *cp_data
, u16 len
)
4733 struct mgmt_cp_load_long_term_keys
*cp
= cp_data
;
4734 const u16 max_key_count
= ((U16_MAX
- sizeof(*cp
)) /
4735 sizeof(struct mgmt_ltk_info
));
4736 u16 key_count
, expected_len
;
4739 BT_DBG("request for %s", hdev
->name
);
4741 if (!lmp_le_capable(hdev
))
4742 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LONG_TERM_KEYS
,
4743 MGMT_STATUS_NOT_SUPPORTED
);
4745 key_count
= __le16_to_cpu(cp
->key_count
);
4746 if (key_count
> max_key_count
) {
4747 bt_dev_err(hdev
, "load_ltks: too big key_count value %u",
4749 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LONG_TERM_KEYS
,
4750 MGMT_STATUS_INVALID_PARAMS
);
4753 expected_len
= sizeof(*cp
) + key_count
*
4754 sizeof(struct mgmt_ltk_info
);
4755 if (expected_len
!= len
) {
4756 bt_dev_err(hdev
, "load_keys: expected %u bytes, got %u bytes",
4758 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_LONG_TERM_KEYS
,
4759 MGMT_STATUS_INVALID_PARAMS
);
4762 BT_DBG("%s key_count %u", hdev
->name
, key_count
);
4764 for (i
= 0; i
< key_count
; i
++) {
4765 struct mgmt_ltk_info
*key
= &cp
->keys
[i
];
4767 if (!ltk_is_valid(key
))
4768 return mgmt_cmd_status(sk
, hdev
->id
,
4769 MGMT_OP_LOAD_LONG_TERM_KEYS
,
4770 MGMT_STATUS_INVALID_PARAMS
);
4775 hci_smp_ltks_clear(hdev
);
4777 for (i
= 0; i
< key_count
; i
++) {
4778 struct mgmt_ltk_info
*key
= &cp
->keys
[i
];
4779 u8 type
, authenticated
;
4781 switch (key
->type
) {
4782 case MGMT_LTK_UNAUTHENTICATED
:
4783 authenticated
= 0x00;
4784 type
= key
->master
? SMP_LTK
: SMP_LTK_SLAVE
;
4786 case MGMT_LTK_AUTHENTICATED
:
4787 authenticated
= 0x01;
4788 type
= key
->master
? SMP_LTK
: SMP_LTK_SLAVE
;
4790 case MGMT_LTK_P256_UNAUTH
:
4791 authenticated
= 0x00;
4792 type
= SMP_LTK_P256
;
4794 case MGMT_LTK_P256_AUTH
:
4795 authenticated
= 0x01;
4796 type
= SMP_LTK_P256
;
4798 case MGMT_LTK_P256_DEBUG
:
4799 authenticated
= 0x00;
4800 type
= SMP_LTK_P256_DEBUG
;
4805 hci_add_ltk(hdev
, &key
->addr
.bdaddr
,
4806 le_addr_type(key
->addr
.type
), type
, authenticated
,
4807 key
->val
, key
->enc_size
, key
->ediv
, key
->rand
);
4810 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_LOAD_LONG_TERM_KEYS
, 0,
4813 hci_dev_unlock(hdev
);
4818 static int conn_info_cmd_complete(struct mgmt_pending_cmd
*cmd
, u8 status
)
4820 struct hci_conn
*conn
= cmd
->user_data
;
4821 struct mgmt_rp_get_conn_info rp
;
4824 memcpy(&rp
.addr
, cmd
->param
, sizeof(rp
.addr
));
4826 if (status
== MGMT_STATUS_SUCCESS
) {
4827 rp
.rssi
= conn
->rssi
;
4828 rp
.tx_power
= conn
->tx_power
;
4829 rp
.max_tx_power
= conn
->max_tx_power
;
4831 rp
.rssi
= HCI_RSSI_INVALID
;
4832 rp
.tx_power
= HCI_TX_POWER_INVALID
;
4833 rp
.max_tx_power
= HCI_TX_POWER_INVALID
;
4836 err
= mgmt_cmd_complete(cmd
->sk
, cmd
->index
, MGMT_OP_GET_CONN_INFO
,
4837 status
, &rp
, sizeof(rp
));
4839 hci_conn_drop(conn
);
4845 static void conn_info_refresh_complete(struct hci_dev
*hdev
, u8 hci_status
,
4848 struct hci_cp_read_rssi
*cp
;
4849 struct mgmt_pending_cmd
*cmd
;
4850 struct hci_conn
*conn
;
4854 BT_DBG("status 0x%02x", hci_status
);
4858 /* Commands sent in request are either Read RSSI or Read Transmit Power
4859 * Level so we check which one was last sent to retrieve connection
4860 * handle. Both commands have handle as first parameter so it's safe to
4861 * cast data on the same command struct.
4863 * First command sent is always Read RSSI and we fail only if it fails.
4864 * In other case we simply override error to indicate success as we
4865 * already remembered if TX power value is actually valid.
4867 cp
= hci_sent_cmd_data(hdev
, HCI_OP_READ_RSSI
);
4869 cp
= hci_sent_cmd_data(hdev
, HCI_OP_READ_TX_POWER
);
4870 status
= MGMT_STATUS_SUCCESS
;
4872 status
= mgmt_status(hci_status
);
4876 bt_dev_err(hdev
, "invalid sent_cmd in conn_info response");
4880 handle
= __le16_to_cpu(cp
->handle
);
4881 conn
= hci_conn_hash_lookup_handle(hdev
, handle
);
4883 bt_dev_err(hdev
, "unknown handle (%d) in conn_info response",
4888 cmd
= pending_find_data(MGMT_OP_GET_CONN_INFO
, hdev
, conn
);
4892 cmd
->cmd_complete(cmd
, status
);
4893 mgmt_pending_remove(cmd
);
4896 hci_dev_unlock(hdev
);
4899 static int get_conn_info(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
4902 struct mgmt_cp_get_conn_info
*cp
= data
;
4903 struct mgmt_rp_get_conn_info rp
;
4904 struct hci_conn
*conn
;
4905 unsigned long conn_info_age
;
4908 BT_DBG("%s", hdev
->name
);
4910 memset(&rp
, 0, sizeof(rp
));
4911 bacpy(&rp
.addr
.bdaddr
, &cp
->addr
.bdaddr
);
4912 rp
.addr
.type
= cp
->addr
.type
;
4914 if (!bdaddr_type_is_valid(cp
->addr
.type
))
4915 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CONN_INFO
,
4916 MGMT_STATUS_INVALID_PARAMS
,
4921 if (!hdev_is_powered(hdev
)) {
4922 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CONN_INFO
,
4923 MGMT_STATUS_NOT_POWERED
, &rp
,
4928 if (cp
->addr
.type
== BDADDR_BREDR
)
4929 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
,
4932 conn
= hci_conn_hash_lookup_ba(hdev
, LE_LINK
, &cp
->addr
.bdaddr
);
4934 if (!conn
|| conn
->state
!= BT_CONNECTED
) {
4935 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CONN_INFO
,
4936 MGMT_STATUS_NOT_CONNECTED
, &rp
,
4941 if (pending_find_data(MGMT_OP_GET_CONN_INFO
, hdev
, conn
)) {
4942 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CONN_INFO
,
4943 MGMT_STATUS_BUSY
, &rp
, sizeof(rp
));
4947 /* To avoid client trying to guess when to poll again for information we
4948 * calculate conn info age as random value between min/max set in hdev.
4950 conn_info_age
= hdev
->conn_info_min_age
+
4951 prandom_u32_max(hdev
->conn_info_max_age
-
4952 hdev
->conn_info_min_age
);
4954 /* Query controller to refresh cached values if they are too old or were
4957 if (time_after(jiffies
, conn
->conn_info_timestamp
+
4958 msecs_to_jiffies(conn_info_age
)) ||
4959 !conn
->conn_info_timestamp
) {
4960 struct hci_request req
;
4961 struct hci_cp_read_tx_power req_txp_cp
;
4962 struct hci_cp_read_rssi req_rssi_cp
;
4963 struct mgmt_pending_cmd
*cmd
;
4965 hci_req_init(&req
, hdev
);
4966 req_rssi_cp
.handle
= cpu_to_le16(conn
->handle
);
4967 hci_req_add(&req
, HCI_OP_READ_RSSI
, sizeof(req_rssi_cp
),
4970 /* For LE links TX power does not change thus we don't need to
4971 * query for it once value is known.
4973 if (!bdaddr_type_is_le(cp
->addr
.type
) ||
4974 conn
->tx_power
== HCI_TX_POWER_INVALID
) {
4975 req_txp_cp
.handle
= cpu_to_le16(conn
->handle
);
4976 req_txp_cp
.type
= 0x00;
4977 hci_req_add(&req
, HCI_OP_READ_TX_POWER
,
4978 sizeof(req_txp_cp
), &req_txp_cp
);
4981 /* Max TX power needs to be read only once per connection */
4982 if (conn
->max_tx_power
== HCI_TX_POWER_INVALID
) {
4983 req_txp_cp
.handle
= cpu_to_le16(conn
->handle
);
4984 req_txp_cp
.type
= 0x01;
4985 hci_req_add(&req
, HCI_OP_READ_TX_POWER
,
4986 sizeof(req_txp_cp
), &req_txp_cp
);
4989 err
= hci_req_run(&req
, conn_info_refresh_complete
);
4993 cmd
= mgmt_pending_add(sk
, MGMT_OP_GET_CONN_INFO
, hdev
,
5000 hci_conn_hold(conn
);
5001 cmd
->user_data
= hci_conn_get(conn
);
5002 cmd
->cmd_complete
= conn_info_cmd_complete
;
5004 conn
->conn_info_timestamp
= jiffies
;
5006 /* Cache is valid, just reply with values cached in hci_conn */
5007 rp
.rssi
= conn
->rssi
;
5008 rp
.tx_power
= conn
->tx_power
;
5009 rp
.max_tx_power
= conn
->max_tx_power
;
5011 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CONN_INFO
,
5012 MGMT_STATUS_SUCCESS
, &rp
, sizeof(rp
));
5016 hci_dev_unlock(hdev
);
5020 static int clock_info_cmd_complete(struct mgmt_pending_cmd
*cmd
, u8 status
)
5022 struct hci_conn
*conn
= cmd
->user_data
;
5023 struct mgmt_rp_get_clock_info rp
;
5024 struct hci_dev
*hdev
;
5027 memset(&rp
, 0, sizeof(rp
));
5028 memcpy(&rp
.addr
, cmd
->param
, sizeof(rp
.addr
));
5033 hdev
= hci_dev_get(cmd
->index
);
5035 rp
.local_clock
= cpu_to_le32(hdev
->clock
);
5040 rp
.piconet_clock
= cpu_to_le32(conn
->clock
);
5041 rp
.accuracy
= cpu_to_le16(conn
->clock_accuracy
);
5045 err
= mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
, status
, &rp
,
5049 hci_conn_drop(conn
);
5056 static void get_clock_info_complete(struct hci_dev
*hdev
, u8 status
, u16 opcode
)
5058 struct hci_cp_read_clock
*hci_cp
;
5059 struct mgmt_pending_cmd
*cmd
;
5060 struct hci_conn
*conn
;
5062 BT_DBG("%s status %u", hdev
->name
, status
);
5066 hci_cp
= hci_sent_cmd_data(hdev
, HCI_OP_READ_CLOCK
);
5070 if (hci_cp
->which
) {
5071 u16 handle
= __le16_to_cpu(hci_cp
->handle
);
5072 conn
= hci_conn_hash_lookup_handle(hdev
, handle
);
5077 cmd
= pending_find_data(MGMT_OP_GET_CLOCK_INFO
, hdev
, conn
);
5081 cmd
->cmd_complete(cmd
, mgmt_status(status
));
5082 mgmt_pending_remove(cmd
);
5085 hci_dev_unlock(hdev
);
5088 static int get_clock_info(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
5091 struct mgmt_cp_get_clock_info
*cp
= data
;
5092 struct mgmt_rp_get_clock_info rp
;
5093 struct hci_cp_read_clock hci_cp
;
5094 struct mgmt_pending_cmd
*cmd
;
5095 struct hci_request req
;
5096 struct hci_conn
*conn
;
5099 BT_DBG("%s", hdev
->name
);
5101 memset(&rp
, 0, sizeof(rp
));
5102 bacpy(&rp
.addr
.bdaddr
, &cp
->addr
.bdaddr
);
5103 rp
.addr
.type
= cp
->addr
.type
;
5105 if (cp
->addr
.type
!= BDADDR_BREDR
)
5106 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CLOCK_INFO
,
5107 MGMT_STATUS_INVALID_PARAMS
,
5112 if (!hdev_is_powered(hdev
)) {
5113 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_CLOCK_INFO
,
5114 MGMT_STATUS_NOT_POWERED
, &rp
,
5119 if (bacmp(&cp
->addr
.bdaddr
, BDADDR_ANY
)) {
5120 conn
= hci_conn_hash_lookup_ba(hdev
, ACL_LINK
,
5122 if (!conn
|| conn
->state
!= BT_CONNECTED
) {
5123 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5124 MGMT_OP_GET_CLOCK_INFO
,
5125 MGMT_STATUS_NOT_CONNECTED
,
5133 cmd
= mgmt_pending_add(sk
, MGMT_OP_GET_CLOCK_INFO
, hdev
, data
, len
);
5139 cmd
->cmd_complete
= clock_info_cmd_complete
;
5141 hci_req_init(&req
, hdev
);
5143 memset(&hci_cp
, 0, sizeof(hci_cp
));
5144 hci_req_add(&req
, HCI_OP_READ_CLOCK
, sizeof(hci_cp
), &hci_cp
);
5147 hci_conn_hold(conn
);
5148 cmd
->user_data
= hci_conn_get(conn
);
5150 hci_cp
.handle
= cpu_to_le16(conn
->handle
);
5151 hci_cp
.which
= 0x01; /* Piconet clock */
5152 hci_req_add(&req
, HCI_OP_READ_CLOCK
, sizeof(hci_cp
), &hci_cp
);
5155 err
= hci_req_run(&req
, get_clock_info_complete
);
5157 mgmt_pending_remove(cmd
);
5160 hci_dev_unlock(hdev
);
5164 static bool is_connected(struct hci_dev
*hdev
, bdaddr_t
*addr
, u8 type
)
5166 struct hci_conn
*conn
;
5168 conn
= hci_conn_hash_lookup_ba(hdev
, LE_LINK
, addr
);
5172 if (conn
->dst_type
!= type
)
5175 if (conn
->state
!= BT_CONNECTED
)
5181 /* This function requires the caller holds hdev->lock */
5182 static int hci_conn_params_set(struct hci_dev
*hdev
, bdaddr_t
*addr
,
5183 u8 addr_type
, u8 auto_connect
)
5185 struct hci_conn_params
*params
;
5187 params
= hci_conn_params_add(hdev
, addr
, addr_type
);
5191 if (params
->auto_connect
== auto_connect
)
5194 list_del_init(¶ms
->action
);
5196 switch (auto_connect
) {
5197 case HCI_AUTO_CONN_DISABLED
:
5198 case HCI_AUTO_CONN_LINK_LOSS
:
5199 /* If auto connect is being disabled when we're trying to
5200 * connect to device, keep connecting.
5202 if (params
->explicit_connect
)
5203 list_add(¶ms
->action
, &hdev
->pend_le_conns
);
5205 case HCI_AUTO_CONN_REPORT
:
5206 if (params
->explicit_connect
)
5207 list_add(¶ms
->action
, &hdev
->pend_le_conns
);
5209 list_add(¶ms
->action
, &hdev
->pend_le_reports
);
5211 case HCI_AUTO_CONN_DIRECT
:
5212 case HCI_AUTO_CONN_ALWAYS
:
5213 if (!is_connected(hdev
, addr
, addr_type
))
5214 list_add(¶ms
->action
, &hdev
->pend_le_conns
);
5218 params
->auto_connect
= auto_connect
;
5220 BT_DBG("addr %pMR (type %u) auto_connect %u", addr
, addr_type
,
5226 static void device_added(struct sock
*sk
, struct hci_dev
*hdev
,
5227 bdaddr_t
*bdaddr
, u8 type
, u8 action
)
5229 struct mgmt_ev_device_added ev
;
5231 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
5232 ev
.addr
.type
= type
;
5235 mgmt_event(MGMT_EV_DEVICE_ADDED
, hdev
, &ev
, sizeof(ev
), sk
);
5238 static int add_device(struct sock
*sk
, struct hci_dev
*hdev
,
5239 void *data
, u16 len
)
5241 struct mgmt_cp_add_device
*cp
= data
;
5242 u8 auto_conn
, addr_type
;
5245 BT_DBG("%s", hdev
->name
);
5247 if (!bdaddr_type_is_valid(cp
->addr
.type
) ||
5248 !bacmp(&cp
->addr
.bdaddr
, BDADDR_ANY
))
5249 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_DEVICE
,
5250 MGMT_STATUS_INVALID_PARAMS
,
5251 &cp
->addr
, sizeof(cp
->addr
));
5253 if (cp
->action
!= 0x00 && cp
->action
!= 0x01 && cp
->action
!= 0x02)
5254 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_DEVICE
,
5255 MGMT_STATUS_INVALID_PARAMS
,
5256 &cp
->addr
, sizeof(cp
->addr
));
5260 if (cp
->addr
.type
== BDADDR_BREDR
) {
5261 /* Only incoming connections action is supported for now */
5262 if (cp
->action
!= 0x01) {
5263 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5265 MGMT_STATUS_INVALID_PARAMS
,
5266 &cp
->addr
, sizeof(cp
->addr
));
5270 err
= hci_bdaddr_list_add(&hdev
->whitelist
, &cp
->addr
.bdaddr
,
5275 hci_req_update_scan(hdev
);
5280 addr_type
= le_addr_type(cp
->addr
.type
);
5282 if (cp
->action
== 0x02)
5283 auto_conn
= HCI_AUTO_CONN_ALWAYS
;
5284 else if (cp
->action
== 0x01)
5285 auto_conn
= HCI_AUTO_CONN_DIRECT
;
5287 auto_conn
= HCI_AUTO_CONN_REPORT
;
5289 /* Kernel internally uses conn_params with resolvable private
5290 * address, but Add Device allows only identity addresses.
5291 * Make sure it is enforced before calling
5292 * hci_conn_params_lookup.
5294 if (!hci_is_identity_address(&cp
->addr
.bdaddr
, addr_type
)) {
5295 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_DEVICE
,
5296 MGMT_STATUS_INVALID_PARAMS
,
5297 &cp
->addr
, sizeof(cp
->addr
));
5301 /* If the connection parameters don't exist for this device,
5302 * they will be created and configured with defaults.
5304 if (hci_conn_params_set(hdev
, &cp
->addr
.bdaddr
, addr_type
,
5306 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_DEVICE
,
5307 MGMT_STATUS_FAILED
, &cp
->addr
,
5312 hci_update_background_scan(hdev
);
5315 device_added(sk
, hdev
, &cp
->addr
.bdaddr
, cp
->addr
.type
, cp
->action
);
5317 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_DEVICE
,
5318 MGMT_STATUS_SUCCESS
, &cp
->addr
,
5322 hci_dev_unlock(hdev
);
5326 static void device_removed(struct sock
*sk
, struct hci_dev
*hdev
,
5327 bdaddr_t
*bdaddr
, u8 type
)
5329 struct mgmt_ev_device_removed ev
;
5331 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
5332 ev
.addr
.type
= type
;
5334 mgmt_event(MGMT_EV_DEVICE_REMOVED
, hdev
, &ev
, sizeof(ev
), sk
);
5337 static int remove_device(struct sock
*sk
, struct hci_dev
*hdev
,
5338 void *data
, u16 len
)
5340 struct mgmt_cp_remove_device
*cp
= data
;
5343 BT_DBG("%s", hdev
->name
);
5347 if (bacmp(&cp
->addr
.bdaddr
, BDADDR_ANY
)) {
5348 struct hci_conn_params
*params
;
5351 if (!bdaddr_type_is_valid(cp
->addr
.type
)) {
5352 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5353 MGMT_OP_REMOVE_DEVICE
,
5354 MGMT_STATUS_INVALID_PARAMS
,
5355 &cp
->addr
, sizeof(cp
->addr
));
5359 if (cp
->addr
.type
== BDADDR_BREDR
) {
5360 err
= hci_bdaddr_list_del(&hdev
->whitelist
,
5364 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5365 MGMT_OP_REMOVE_DEVICE
,
5366 MGMT_STATUS_INVALID_PARAMS
,
5372 hci_req_update_scan(hdev
);
5374 device_removed(sk
, hdev
, &cp
->addr
.bdaddr
,
5379 addr_type
= le_addr_type(cp
->addr
.type
);
5381 /* Kernel internally uses conn_params with resolvable private
5382 * address, but Remove Device allows only identity addresses.
5383 * Make sure it is enforced before calling
5384 * hci_conn_params_lookup.
5386 if (!hci_is_identity_address(&cp
->addr
.bdaddr
, addr_type
)) {
5387 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5388 MGMT_OP_REMOVE_DEVICE
,
5389 MGMT_STATUS_INVALID_PARAMS
,
5390 &cp
->addr
, sizeof(cp
->addr
));
5394 params
= hci_conn_params_lookup(hdev
, &cp
->addr
.bdaddr
,
5397 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5398 MGMT_OP_REMOVE_DEVICE
,
5399 MGMT_STATUS_INVALID_PARAMS
,
5400 &cp
->addr
, sizeof(cp
->addr
));
5404 if (params
->auto_connect
== HCI_AUTO_CONN_DISABLED
||
5405 params
->auto_connect
== HCI_AUTO_CONN_EXPLICIT
) {
5406 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5407 MGMT_OP_REMOVE_DEVICE
,
5408 MGMT_STATUS_INVALID_PARAMS
,
5409 &cp
->addr
, sizeof(cp
->addr
));
5413 list_del(¶ms
->action
);
5414 list_del(¶ms
->list
);
5416 hci_update_background_scan(hdev
);
5418 device_removed(sk
, hdev
, &cp
->addr
.bdaddr
, cp
->addr
.type
);
5420 struct hci_conn_params
*p
, *tmp
;
5421 struct bdaddr_list
*b
, *btmp
;
5423 if (cp
->addr
.type
) {
5424 err
= mgmt_cmd_complete(sk
, hdev
->id
,
5425 MGMT_OP_REMOVE_DEVICE
,
5426 MGMT_STATUS_INVALID_PARAMS
,
5427 &cp
->addr
, sizeof(cp
->addr
));
5431 list_for_each_entry_safe(b
, btmp
, &hdev
->whitelist
, list
) {
5432 device_removed(sk
, hdev
, &b
->bdaddr
, b
->bdaddr_type
);
5437 hci_req_update_scan(hdev
);
5439 list_for_each_entry_safe(p
, tmp
, &hdev
->le_conn_params
, list
) {
5440 if (p
->auto_connect
== HCI_AUTO_CONN_DISABLED
)
5442 device_removed(sk
, hdev
, &p
->addr
, p
->addr_type
);
5443 if (p
->explicit_connect
) {
5444 p
->auto_connect
= HCI_AUTO_CONN_EXPLICIT
;
5447 list_del(&p
->action
);
5452 BT_DBG("All LE connection parameters were removed");
5454 hci_update_background_scan(hdev
);
5458 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_REMOVE_DEVICE
,
5459 MGMT_STATUS_SUCCESS
, &cp
->addr
,
5462 hci_dev_unlock(hdev
);
5466 static int load_conn_param(struct sock
*sk
, struct hci_dev
*hdev
, void *data
,
5469 struct mgmt_cp_load_conn_param
*cp
= data
;
5470 const u16 max_param_count
= ((U16_MAX
- sizeof(*cp
)) /
5471 sizeof(struct mgmt_conn_param
));
5472 u16 param_count
, expected_len
;
5475 if (!lmp_le_capable(hdev
))
5476 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_CONN_PARAM
,
5477 MGMT_STATUS_NOT_SUPPORTED
);
5479 param_count
= __le16_to_cpu(cp
->param_count
);
5480 if (param_count
> max_param_count
) {
5481 bt_dev_err(hdev
, "load_conn_param: too big param_count value %u",
5483 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_CONN_PARAM
,
5484 MGMT_STATUS_INVALID_PARAMS
);
5487 expected_len
= sizeof(*cp
) + param_count
*
5488 sizeof(struct mgmt_conn_param
);
5489 if (expected_len
!= len
) {
5490 bt_dev_err(hdev
, "load_conn_param: expected %u bytes, got %u bytes",
5492 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_LOAD_CONN_PARAM
,
5493 MGMT_STATUS_INVALID_PARAMS
);
5496 BT_DBG("%s param_count %u", hdev
->name
, param_count
);
5500 hci_conn_params_clear_disabled(hdev
);
5502 for (i
= 0; i
< param_count
; i
++) {
5503 struct mgmt_conn_param
*param
= &cp
->params
[i
];
5504 struct hci_conn_params
*hci_param
;
5505 u16 min
, max
, latency
, timeout
;
5508 BT_DBG("Adding %pMR (type %u)", ¶m
->addr
.bdaddr
,
5511 if (param
->addr
.type
== BDADDR_LE_PUBLIC
) {
5512 addr_type
= ADDR_LE_DEV_PUBLIC
;
5513 } else if (param
->addr
.type
== BDADDR_LE_RANDOM
) {
5514 addr_type
= ADDR_LE_DEV_RANDOM
;
5516 bt_dev_err(hdev
, "ignoring invalid connection parameters");
5520 min
= le16_to_cpu(param
->min_interval
);
5521 max
= le16_to_cpu(param
->max_interval
);
5522 latency
= le16_to_cpu(param
->latency
);
5523 timeout
= le16_to_cpu(param
->timeout
);
5525 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5526 min
, max
, latency
, timeout
);
5528 if (hci_check_conn_params(min
, max
, latency
, timeout
) < 0) {
5529 bt_dev_err(hdev
, "ignoring invalid connection parameters");
5533 hci_param
= hci_conn_params_add(hdev
, ¶m
->addr
.bdaddr
,
5536 bt_dev_err(hdev
, "failed to add connection parameters");
5540 hci_param
->conn_min_interval
= min
;
5541 hci_param
->conn_max_interval
= max
;
5542 hci_param
->conn_latency
= latency
;
5543 hci_param
->supervision_timeout
= timeout
;
5546 hci_dev_unlock(hdev
);
5548 return mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_LOAD_CONN_PARAM
, 0,
5552 static int set_external_config(struct sock
*sk
, struct hci_dev
*hdev
,
5553 void *data
, u16 len
)
5555 struct mgmt_cp_set_external_config
*cp
= data
;
5559 BT_DBG("%s", hdev
->name
);
5561 if (hdev_is_powered(hdev
))
5562 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_EXTERNAL_CONFIG
,
5563 MGMT_STATUS_REJECTED
);
5565 if (cp
->config
!= 0x00 && cp
->config
!= 0x01)
5566 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_EXTERNAL_CONFIG
,
5567 MGMT_STATUS_INVALID_PARAMS
);
5569 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG
, &hdev
->quirks
))
5570 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_EXTERNAL_CONFIG
,
5571 MGMT_STATUS_NOT_SUPPORTED
);
5576 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_EXT_CONFIGURED
);
5578 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_EXT_CONFIGURED
);
5580 err
= send_options_rsp(sk
, MGMT_OP_SET_EXTERNAL_CONFIG
, hdev
);
5587 err
= new_options(hdev
, sk
);
5589 if (hci_dev_test_flag(hdev
, HCI_UNCONFIGURED
) == is_configured(hdev
)) {
5590 mgmt_index_removed(hdev
);
5592 if (hci_dev_test_and_change_flag(hdev
, HCI_UNCONFIGURED
)) {
5593 hci_dev_set_flag(hdev
, HCI_CONFIG
);
5594 hci_dev_set_flag(hdev
, HCI_AUTO_OFF
);
5596 queue_work(hdev
->req_workqueue
, &hdev
->power_on
);
5598 set_bit(HCI_RAW
, &hdev
->flags
);
5599 mgmt_index_added(hdev
);
5604 hci_dev_unlock(hdev
);
5608 static int set_public_address(struct sock
*sk
, struct hci_dev
*hdev
,
5609 void *data
, u16 len
)
5611 struct mgmt_cp_set_public_address
*cp
= data
;
5615 BT_DBG("%s", hdev
->name
);
5617 if (hdev_is_powered(hdev
))
5618 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_PUBLIC_ADDRESS
,
5619 MGMT_STATUS_REJECTED
);
5621 if (!bacmp(&cp
->bdaddr
, BDADDR_ANY
))
5622 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_PUBLIC_ADDRESS
,
5623 MGMT_STATUS_INVALID_PARAMS
);
5625 if (!hdev
->set_bdaddr
)
5626 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_SET_PUBLIC_ADDRESS
,
5627 MGMT_STATUS_NOT_SUPPORTED
);
5631 changed
= !!bacmp(&hdev
->public_addr
, &cp
->bdaddr
);
5632 bacpy(&hdev
->public_addr
, &cp
->bdaddr
);
5634 err
= send_options_rsp(sk
, MGMT_OP_SET_PUBLIC_ADDRESS
, hdev
);
5641 if (hci_dev_test_flag(hdev
, HCI_UNCONFIGURED
))
5642 err
= new_options(hdev
, sk
);
5644 if (is_configured(hdev
)) {
5645 mgmt_index_removed(hdev
);
5647 hci_dev_clear_flag(hdev
, HCI_UNCONFIGURED
);
5649 hci_dev_set_flag(hdev
, HCI_CONFIG
);
5650 hci_dev_set_flag(hdev
, HCI_AUTO_OFF
);
5652 queue_work(hdev
->req_workqueue
, &hdev
->power_on
);
5656 hci_dev_unlock(hdev
);
5660 static void read_local_oob_ext_data_complete(struct hci_dev
*hdev
, u8 status
,
5661 u16 opcode
, struct sk_buff
*skb
)
5663 const struct mgmt_cp_read_local_oob_ext_data
*mgmt_cp
;
5664 struct mgmt_rp_read_local_oob_ext_data
*mgmt_rp
;
5665 u8
*h192
, *r192
, *h256
, *r256
;
5666 struct mgmt_pending_cmd
*cmd
;
5670 BT_DBG("%s status %u", hdev
->name
, status
);
5672 cmd
= pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA
, hdev
);
5676 mgmt_cp
= cmd
->param
;
5679 status
= mgmt_status(status
);
5686 } else if (opcode
== HCI_OP_READ_LOCAL_OOB_DATA
) {
5687 struct hci_rp_read_local_oob_data
*rp
;
5689 if (skb
->len
!= sizeof(*rp
)) {
5690 status
= MGMT_STATUS_FAILED
;
5693 status
= MGMT_STATUS_SUCCESS
;
5694 rp
= (void *)skb
->data
;
5696 eir_len
= 5 + 18 + 18;
5703 struct hci_rp_read_local_oob_ext_data
*rp
;
5705 if (skb
->len
!= sizeof(*rp
)) {
5706 status
= MGMT_STATUS_FAILED
;
5709 status
= MGMT_STATUS_SUCCESS
;
5710 rp
= (void *)skb
->data
;
5712 if (hci_dev_test_flag(hdev
, HCI_SC_ONLY
)) {
5713 eir_len
= 5 + 18 + 18;
5717 eir_len
= 5 + 18 + 18 + 18 + 18;
5727 mgmt_rp
= kmalloc(sizeof(*mgmt_rp
) + eir_len
, GFP_KERNEL
);
5734 eir_len
= eir_append_data(mgmt_rp
->eir
, 0, EIR_CLASS_OF_DEV
,
5735 hdev
->dev_class
, 3);
5738 eir_len
= eir_append_data(mgmt_rp
->eir
, eir_len
,
5739 EIR_SSP_HASH_C192
, h192
, 16);
5740 eir_len
= eir_append_data(mgmt_rp
->eir
, eir_len
,
5741 EIR_SSP_RAND_R192
, r192
, 16);
5745 eir_len
= eir_append_data(mgmt_rp
->eir
, eir_len
,
5746 EIR_SSP_HASH_C256
, h256
, 16);
5747 eir_len
= eir_append_data(mgmt_rp
->eir
, eir_len
,
5748 EIR_SSP_RAND_R256
, r256
, 16);
5752 mgmt_rp
->type
= mgmt_cp
->type
;
5753 mgmt_rp
->eir_len
= cpu_to_le16(eir_len
);
5755 err
= mgmt_cmd_complete(cmd
->sk
, hdev
->id
,
5756 MGMT_OP_READ_LOCAL_OOB_EXT_DATA
, status
,
5757 mgmt_rp
, sizeof(*mgmt_rp
) + eir_len
);
5758 if (err
< 0 || status
)
5761 hci_sock_set_flag(cmd
->sk
, HCI_MGMT_OOB_DATA_EVENTS
);
5763 err
= mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED
, hdev
,
5764 mgmt_rp
, sizeof(*mgmt_rp
) + eir_len
,
5765 HCI_MGMT_OOB_DATA_EVENTS
, cmd
->sk
);
5768 mgmt_pending_remove(cmd
);
5771 static int read_local_ssp_oob_req(struct hci_dev
*hdev
, struct sock
*sk
,
5772 struct mgmt_cp_read_local_oob_ext_data
*cp
)
5774 struct mgmt_pending_cmd
*cmd
;
5775 struct hci_request req
;
5778 cmd
= mgmt_pending_add(sk
, MGMT_OP_READ_LOCAL_OOB_EXT_DATA
, hdev
,
5783 hci_req_init(&req
, hdev
);
5785 if (bredr_sc_enabled(hdev
))
5786 hci_req_add(&req
, HCI_OP_READ_LOCAL_OOB_EXT_DATA
, 0, NULL
);
5788 hci_req_add(&req
, HCI_OP_READ_LOCAL_OOB_DATA
, 0, NULL
);
5790 err
= hci_req_run_skb(&req
, read_local_oob_ext_data_complete
);
5792 mgmt_pending_remove(cmd
);
5799 static int read_local_oob_ext_data(struct sock
*sk
, struct hci_dev
*hdev
,
5800 void *data
, u16 data_len
)
5802 struct mgmt_cp_read_local_oob_ext_data
*cp
= data
;
5803 struct mgmt_rp_read_local_oob_ext_data
*rp
;
5806 u8 status
, flags
, role
, addr
[7], hash
[16], rand
[16];
5809 BT_DBG("%s", hdev
->name
);
5811 if (hdev_is_powered(hdev
)) {
5813 case BIT(BDADDR_BREDR
):
5814 status
= mgmt_bredr_support(hdev
);
5820 case (BIT(BDADDR_LE_PUBLIC
) | BIT(BDADDR_LE_RANDOM
)):
5821 status
= mgmt_le_support(hdev
);
5825 eir_len
= 9 + 3 + 18 + 18 + 3;
5828 status
= MGMT_STATUS_INVALID_PARAMS
;
5833 status
= MGMT_STATUS_NOT_POWERED
;
5837 rp_len
= sizeof(*rp
) + eir_len
;
5838 rp
= kmalloc(rp_len
, GFP_ATOMIC
);
5849 case BIT(BDADDR_BREDR
):
5850 if (hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
)) {
5851 err
= read_local_ssp_oob_req(hdev
, sk
, cp
);
5852 hci_dev_unlock(hdev
);
5856 status
= MGMT_STATUS_FAILED
;
5859 eir_len
= eir_append_data(rp
->eir
, eir_len
,
5861 hdev
->dev_class
, 3);
5864 case (BIT(BDADDR_LE_PUBLIC
) | BIT(BDADDR_LE_RANDOM
)):
5865 if (hci_dev_test_flag(hdev
, HCI_SC_ENABLED
) &&
5866 smp_generate_oob(hdev
, hash
, rand
) < 0) {
5867 hci_dev_unlock(hdev
);
5868 status
= MGMT_STATUS_FAILED
;
5872 /* This should return the active RPA, but since the RPA
5873 * is only programmed on demand, it is really hard to fill
5874 * this in at the moment. For now disallow retrieving
5875 * local out-of-band data when privacy is in use.
5877 * Returning the identity address will not help here since
5878 * pairing happens before the identity resolving key is
5879 * known and thus the connection establishment happens
5880 * based on the RPA and not the identity address.
5882 if (hci_dev_test_flag(hdev
, HCI_PRIVACY
)) {
5883 hci_dev_unlock(hdev
);
5884 status
= MGMT_STATUS_REJECTED
;
5888 if (hci_dev_test_flag(hdev
, HCI_FORCE_STATIC_ADDR
) ||
5889 !bacmp(&hdev
->bdaddr
, BDADDR_ANY
) ||
5890 (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
) &&
5891 bacmp(&hdev
->static_addr
, BDADDR_ANY
))) {
5892 memcpy(addr
, &hdev
->static_addr
, 6);
5895 memcpy(addr
, &hdev
->bdaddr
, 6);
5899 eir_len
= eir_append_data(rp
->eir
, eir_len
, EIR_LE_BDADDR
,
5900 addr
, sizeof(addr
));
5902 if (hci_dev_test_flag(hdev
, HCI_ADVERTISING
))
5907 eir_len
= eir_append_data(rp
->eir
, eir_len
, EIR_LE_ROLE
,
5908 &role
, sizeof(role
));
5910 if (hci_dev_test_flag(hdev
, HCI_SC_ENABLED
)) {
5911 eir_len
= eir_append_data(rp
->eir
, eir_len
,
5913 hash
, sizeof(hash
));
5915 eir_len
= eir_append_data(rp
->eir
, eir_len
,
5917 rand
, sizeof(rand
));
5920 flags
= mgmt_get_adv_discov_flags(hdev
);
5922 if (!hci_dev_test_flag(hdev
, HCI_BREDR_ENABLED
))
5923 flags
|= LE_AD_NO_BREDR
;
5925 eir_len
= eir_append_data(rp
->eir
, eir_len
, EIR_FLAGS
,
5926 &flags
, sizeof(flags
));
5930 hci_dev_unlock(hdev
);
5932 hci_sock_set_flag(sk
, HCI_MGMT_OOB_DATA_EVENTS
);
5934 status
= MGMT_STATUS_SUCCESS
;
5937 rp
->type
= cp
->type
;
5938 rp
->eir_len
= cpu_to_le16(eir_len
);
5940 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_READ_LOCAL_OOB_EXT_DATA
,
5941 status
, rp
, sizeof(*rp
) + eir_len
);
5942 if (err
< 0 || status
)
5945 err
= mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED
, hdev
,
5946 rp
, sizeof(*rp
) + eir_len
,
5947 HCI_MGMT_OOB_DATA_EVENTS
, sk
);
5955 static u32
get_supported_adv_flags(struct hci_dev
*hdev
)
5959 flags
|= MGMT_ADV_FLAG_CONNECTABLE
;
5960 flags
|= MGMT_ADV_FLAG_DISCOV
;
5961 flags
|= MGMT_ADV_FLAG_LIMITED_DISCOV
;
5962 flags
|= MGMT_ADV_FLAG_MANAGED_FLAGS
;
5963 flags
|= MGMT_ADV_FLAG_APPEARANCE
;
5964 flags
|= MGMT_ADV_FLAG_LOCAL_NAME
;
5966 if (hdev
->adv_tx_power
!= HCI_TX_POWER_INVALID
)
5967 flags
|= MGMT_ADV_FLAG_TX_POWER
;
5972 static int read_adv_features(struct sock
*sk
, struct hci_dev
*hdev
,
5973 void *data
, u16 data_len
)
5975 struct mgmt_rp_read_adv_features
*rp
;
5978 struct adv_info
*adv_instance
;
5979 u32 supported_flags
;
5982 BT_DBG("%s", hdev
->name
);
5984 if (!lmp_le_capable(hdev
))
5985 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_READ_ADV_FEATURES
,
5986 MGMT_STATUS_REJECTED
);
5990 rp_len
= sizeof(*rp
) + hdev
->adv_instance_cnt
;
5991 rp
= kmalloc(rp_len
, GFP_ATOMIC
);
5993 hci_dev_unlock(hdev
);
5997 supported_flags
= get_supported_adv_flags(hdev
);
5999 rp
->supported_flags
= cpu_to_le32(supported_flags
);
6000 rp
->max_adv_data_len
= HCI_MAX_AD_LENGTH
;
6001 rp
->max_scan_rsp_len
= HCI_MAX_AD_LENGTH
;
6002 rp
->max_instances
= HCI_MAX_ADV_INSTANCES
;
6003 rp
->num_instances
= hdev
->adv_instance_cnt
;
6005 instance
= rp
->instance
;
6006 list_for_each_entry(adv_instance
, &hdev
->adv_instances
, list
) {
6007 *instance
= adv_instance
->instance
;
6011 hci_dev_unlock(hdev
);
6013 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_READ_ADV_FEATURES
,
6014 MGMT_STATUS_SUCCESS
, rp
, rp_len
);
6021 static u8
calculate_name_len(struct hci_dev
*hdev
)
6023 u8 buf
[HCI_MAX_SHORT_NAME_LENGTH
+ 3];
6025 return append_local_name(hdev
, buf
, 0);
6028 static u8
tlv_data_max_len(struct hci_dev
*hdev
, u32 adv_flags
,
6031 u8 max_len
= HCI_MAX_AD_LENGTH
;
6034 if (adv_flags
& (MGMT_ADV_FLAG_DISCOV
|
6035 MGMT_ADV_FLAG_LIMITED_DISCOV
|
6036 MGMT_ADV_FLAG_MANAGED_FLAGS
))
6039 if (adv_flags
& MGMT_ADV_FLAG_TX_POWER
)
6042 if (adv_flags
& MGMT_ADV_FLAG_LOCAL_NAME
)
6043 max_len
-= calculate_name_len(hdev
);
6045 if (adv_flags
& (MGMT_ADV_FLAG_APPEARANCE
))
6052 static bool flags_managed(u32 adv_flags
)
6054 return adv_flags
& (MGMT_ADV_FLAG_DISCOV
|
6055 MGMT_ADV_FLAG_LIMITED_DISCOV
|
6056 MGMT_ADV_FLAG_MANAGED_FLAGS
);
6059 static bool tx_power_managed(u32 adv_flags
)
6061 return adv_flags
& MGMT_ADV_FLAG_TX_POWER
;
6064 static bool name_managed(u32 adv_flags
)
6066 return adv_flags
& MGMT_ADV_FLAG_LOCAL_NAME
;
6069 static bool appearance_managed(u32 adv_flags
)
6071 return adv_flags
& MGMT_ADV_FLAG_APPEARANCE
;
6074 static bool tlv_data_is_valid(struct hci_dev
*hdev
, u32 adv_flags
, u8
*data
,
6075 u8 len
, bool is_adv_data
)
6080 max_len
= tlv_data_max_len(hdev
, adv_flags
, is_adv_data
);
6085 /* Make sure that the data is correctly formatted. */
6086 for (i
= 0, cur_len
= 0; i
< len
; i
+= (cur_len
+ 1)) {
6089 if (data
[i
+ 1] == EIR_FLAGS
&&
6090 (!is_adv_data
|| flags_managed(adv_flags
)))
6093 if (data
[i
+ 1] == EIR_TX_POWER
&& tx_power_managed(adv_flags
))
6096 if (data
[i
+ 1] == EIR_NAME_COMPLETE
&& name_managed(adv_flags
))
6099 if (data
[i
+ 1] == EIR_NAME_SHORT
&& name_managed(adv_flags
))
6102 if (data
[i
+ 1] == EIR_APPEARANCE
&&
6103 appearance_managed(adv_flags
))
6106 /* If the current field length would exceed the total data
6107 * length, then it's invalid.
6109 if (i
+ cur_len
>= len
)
6116 static void add_advertising_complete(struct hci_dev
*hdev
, u8 status
,
6119 struct mgmt_pending_cmd
*cmd
;
6120 struct mgmt_cp_add_advertising
*cp
;
6121 struct mgmt_rp_add_advertising rp
;
6122 struct adv_info
*adv_instance
, *n
;
6125 BT_DBG("status %d", status
);
6129 cmd
= pending_find(MGMT_OP_ADD_ADVERTISING
, hdev
);
6131 list_for_each_entry_safe(adv_instance
, n
, &hdev
->adv_instances
, list
) {
6132 if (!adv_instance
->pending
)
6136 adv_instance
->pending
= false;
6140 instance
= adv_instance
->instance
;
6142 if (hdev
->cur_adv_instance
== instance
)
6143 cancel_adv_timeout(hdev
);
6145 hci_remove_adv_instance(hdev
, instance
);
6146 mgmt_advertising_removed(cmd
? cmd
->sk
: NULL
, hdev
, instance
);
6153 rp
.instance
= cp
->instance
;
6156 mgmt_cmd_status(cmd
->sk
, cmd
->index
, cmd
->opcode
,
6157 mgmt_status(status
));
6159 mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
,
6160 mgmt_status(status
), &rp
, sizeof(rp
));
6162 mgmt_pending_remove(cmd
);
6165 hci_dev_unlock(hdev
);
6168 static int add_advertising(struct sock
*sk
, struct hci_dev
*hdev
,
6169 void *data
, u16 data_len
)
6171 struct mgmt_cp_add_advertising
*cp
= data
;
6172 struct mgmt_rp_add_advertising rp
;
6174 u32 supported_flags
;
6176 u16 timeout
, duration
;
6177 unsigned int prev_instance_cnt
= hdev
->adv_instance_cnt
;
6178 u8 schedule_instance
= 0;
6179 struct adv_info
*next_instance
;
6181 struct mgmt_pending_cmd
*cmd
;
6182 struct hci_request req
;
6184 BT_DBG("%s", hdev
->name
);
6186 status
= mgmt_le_support(hdev
);
6188 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6191 if (cp
->instance
< 1 || cp
->instance
> HCI_MAX_ADV_INSTANCES
)
6192 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6193 MGMT_STATUS_INVALID_PARAMS
);
6195 if (data_len
!= sizeof(*cp
) + cp
->adv_data_len
+ cp
->scan_rsp_len
)
6196 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6197 MGMT_STATUS_INVALID_PARAMS
);
6199 flags
= __le32_to_cpu(cp
->flags
);
6200 timeout
= __le16_to_cpu(cp
->timeout
);
6201 duration
= __le16_to_cpu(cp
->duration
);
6203 /* The current implementation only supports a subset of the specified
6206 supported_flags
= get_supported_adv_flags(hdev
);
6207 if (flags
& ~supported_flags
)
6208 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6209 MGMT_STATUS_INVALID_PARAMS
);
6213 if (timeout
&& !hdev_is_powered(hdev
)) {
6214 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6215 MGMT_STATUS_REJECTED
);
6219 if (pending_find(MGMT_OP_ADD_ADVERTISING
, hdev
) ||
6220 pending_find(MGMT_OP_REMOVE_ADVERTISING
, hdev
) ||
6221 pending_find(MGMT_OP_SET_LE
, hdev
)) {
6222 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6227 if (!tlv_data_is_valid(hdev
, flags
, cp
->data
, cp
->adv_data_len
, true) ||
6228 !tlv_data_is_valid(hdev
, flags
, cp
->data
+ cp
->adv_data_len
,
6229 cp
->scan_rsp_len
, false)) {
6230 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6231 MGMT_STATUS_INVALID_PARAMS
);
6235 err
= hci_add_adv_instance(hdev
, cp
->instance
, flags
,
6236 cp
->adv_data_len
, cp
->data
,
6238 cp
->data
+ cp
->adv_data_len
,
6241 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6242 MGMT_STATUS_FAILED
);
6246 /* Only trigger an advertising added event if a new instance was
6249 if (hdev
->adv_instance_cnt
> prev_instance_cnt
)
6250 mgmt_advertising_added(sk
, hdev
, cp
->instance
);
6252 if (hdev
->cur_adv_instance
== cp
->instance
) {
6253 /* If the currently advertised instance is being changed then
6254 * cancel the current advertising and schedule the next
6255 * instance. If there is only one instance then the overridden
6256 * advertising data will be visible right away.
6258 cancel_adv_timeout(hdev
);
6260 next_instance
= hci_get_next_instance(hdev
, cp
->instance
);
6262 schedule_instance
= next_instance
->instance
;
6263 } else if (!hdev
->adv_instance_timeout
) {
6264 /* Immediately advertise the new instance if no other
6265 * instance is currently being advertised.
6267 schedule_instance
= cp
->instance
;
6270 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
6271 * there is no instance to be advertised then we have no HCI
6272 * communication to make. Simply return.
6274 if (!hdev_is_powered(hdev
) ||
6275 hci_dev_test_flag(hdev
, HCI_ADVERTISING
) ||
6276 !schedule_instance
) {
6277 rp
.instance
= cp
->instance
;
6278 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_ADD_ADVERTISING
,
6279 MGMT_STATUS_SUCCESS
, &rp
, sizeof(rp
));
6283 /* We're good to go, update advertising data, parameters, and start
6286 cmd
= mgmt_pending_add(sk
, MGMT_OP_ADD_ADVERTISING
, hdev
, data
,
6293 hci_req_init(&req
, hdev
);
6295 err
= __hci_req_schedule_adv_instance(&req
, schedule_instance
, true);
6298 err
= hci_req_run(&req
, add_advertising_complete
);
6301 mgmt_pending_remove(cmd
);
6304 hci_dev_unlock(hdev
);
6309 static void remove_advertising_complete(struct hci_dev
*hdev
, u8 status
,
6312 struct mgmt_pending_cmd
*cmd
;
6313 struct mgmt_cp_remove_advertising
*cp
;
6314 struct mgmt_rp_remove_advertising rp
;
6316 BT_DBG("status %d", status
);
6320 /* A failure status here only means that we failed to disable
6321 * advertising. Otherwise, the advertising instance has been removed,
6322 * so report success.
6324 cmd
= pending_find(MGMT_OP_REMOVE_ADVERTISING
, hdev
);
6329 rp
.instance
= cp
->instance
;
6331 mgmt_cmd_complete(cmd
->sk
, cmd
->index
, cmd
->opcode
, MGMT_STATUS_SUCCESS
,
6333 mgmt_pending_remove(cmd
);
6336 hci_dev_unlock(hdev
);
6339 static int remove_advertising(struct sock
*sk
, struct hci_dev
*hdev
,
6340 void *data
, u16 data_len
)
6342 struct mgmt_cp_remove_advertising
*cp
= data
;
6343 struct mgmt_rp_remove_advertising rp
;
6344 struct mgmt_pending_cmd
*cmd
;
6345 struct hci_request req
;
6348 BT_DBG("%s", hdev
->name
);
6352 if (cp
->instance
&& !hci_find_adv_instance(hdev
, cp
->instance
)) {
6353 err
= mgmt_cmd_status(sk
, hdev
->id
,
6354 MGMT_OP_REMOVE_ADVERTISING
,
6355 MGMT_STATUS_INVALID_PARAMS
);
6359 if (pending_find(MGMT_OP_ADD_ADVERTISING
, hdev
) ||
6360 pending_find(MGMT_OP_REMOVE_ADVERTISING
, hdev
) ||
6361 pending_find(MGMT_OP_SET_LE
, hdev
)) {
6362 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_REMOVE_ADVERTISING
,
6367 if (list_empty(&hdev
->adv_instances
)) {
6368 err
= mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_REMOVE_ADVERTISING
,
6369 MGMT_STATUS_INVALID_PARAMS
);
6373 hci_req_init(&req
, hdev
);
6375 hci_req_clear_adv_instance(hdev
, sk
, &req
, cp
->instance
, true);
6377 if (list_empty(&hdev
->adv_instances
))
6378 __hci_req_disable_advertising(&req
);
6380 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
6381 * flag is set or the device isn't powered then we have no HCI
6382 * communication to make. Simply return.
6384 if (skb_queue_empty(&req
.cmd_q
) ||
6385 !hdev_is_powered(hdev
) ||
6386 hci_dev_test_flag(hdev
, HCI_ADVERTISING
)) {
6387 hci_req_purge(&req
);
6388 rp
.instance
= cp
->instance
;
6389 err
= mgmt_cmd_complete(sk
, hdev
->id
,
6390 MGMT_OP_REMOVE_ADVERTISING
,
6391 MGMT_STATUS_SUCCESS
, &rp
, sizeof(rp
));
6395 cmd
= mgmt_pending_add(sk
, MGMT_OP_REMOVE_ADVERTISING
, hdev
, data
,
6402 err
= hci_req_run(&req
, remove_advertising_complete
);
6404 mgmt_pending_remove(cmd
);
6407 hci_dev_unlock(hdev
);
6412 static int get_adv_size_info(struct sock
*sk
, struct hci_dev
*hdev
,
6413 void *data
, u16 data_len
)
6415 struct mgmt_cp_get_adv_size_info
*cp
= data
;
6416 struct mgmt_rp_get_adv_size_info rp
;
6417 u32 flags
, supported_flags
;
6420 BT_DBG("%s", hdev
->name
);
6422 if (!lmp_le_capable(hdev
))
6423 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_GET_ADV_SIZE_INFO
,
6424 MGMT_STATUS_REJECTED
);
6426 if (cp
->instance
< 1 || cp
->instance
> HCI_MAX_ADV_INSTANCES
)
6427 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_GET_ADV_SIZE_INFO
,
6428 MGMT_STATUS_INVALID_PARAMS
);
6430 flags
= __le32_to_cpu(cp
->flags
);
6432 /* The current implementation only supports a subset of the specified
6435 supported_flags
= get_supported_adv_flags(hdev
);
6436 if (flags
& ~supported_flags
)
6437 return mgmt_cmd_status(sk
, hdev
->id
, MGMT_OP_GET_ADV_SIZE_INFO
,
6438 MGMT_STATUS_INVALID_PARAMS
);
6440 rp
.instance
= cp
->instance
;
6441 rp
.flags
= cp
->flags
;
6442 rp
.max_adv_data_len
= tlv_data_max_len(hdev
, flags
, true);
6443 rp
.max_scan_rsp_len
= tlv_data_max_len(hdev
, flags
, false);
6445 err
= mgmt_cmd_complete(sk
, hdev
->id
, MGMT_OP_GET_ADV_SIZE_INFO
,
6446 MGMT_STATUS_SUCCESS
, &rp
, sizeof(rp
));
6451 static const struct hci_mgmt_handler mgmt_handlers
[] = {
6452 { NULL
}, /* 0x0000 (no command) */
6453 { read_version
, MGMT_READ_VERSION_SIZE
,
6455 HCI_MGMT_UNTRUSTED
},
6456 { read_commands
, MGMT_READ_COMMANDS_SIZE
,
6458 HCI_MGMT_UNTRUSTED
},
6459 { read_index_list
, MGMT_READ_INDEX_LIST_SIZE
,
6461 HCI_MGMT_UNTRUSTED
},
6462 { read_controller_info
, MGMT_READ_INFO_SIZE
,
6463 HCI_MGMT_UNTRUSTED
},
6464 { set_powered
, MGMT_SETTING_SIZE
},
6465 { set_discoverable
, MGMT_SET_DISCOVERABLE_SIZE
},
6466 { set_connectable
, MGMT_SETTING_SIZE
},
6467 { set_fast_connectable
, MGMT_SETTING_SIZE
},
6468 { set_bondable
, MGMT_SETTING_SIZE
},
6469 { set_link_security
, MGMT_SETTING_SIZE
},
6470 { set_ssp
, MGMT_SETTING_SIZE
},
6471 { set_hs
, MGMT_SETTING_SIZE
},
6472 { set_le
, MGMT_SETTING_SIZE
},
6473 { set_dev_class
, MGMT_SET_DEV_CLASS_SIZE
},
6474 { set_local_name
, MGMT_SET_LOCAL_NAME_SIZE
},
6475 { add_uuid
, MGMT_ADD_UUID_SIZE
},
6476 { remove_uuid
, MGMT_REMOVE_UUID_SIZE
},
6477 { load_link_keys
, MGMT_LOAD_LINK_KEYS_SIZE
,
6479 { load_long_term_keys
, MGMT_LOAD_LONG_TERM_KEYS_SIZE
,
6481 { disconnect
, MGMT_DISCONNECT_SIZE
},
6482 { get_connections
, MGMT_GET_CONNECTIONS_SIZE
},
6483 { pin_code_reply
, MGMT_PIN_CODE_REPLY_SIZE
},
6484 { pin_code_neg_reply
, MGMT_PIN_CODE_NEG_REPLY_SIZE
},
6485 { set_io_capability
, MGMT_SET_IO_CAPABILITY_SIZE
},
6486 { pair_device
, MGMT_PAIR_DEVICE_SIZE
},
6487 { cancel_pair_device
, MGMT_CANCEL_PAIR_DEVICE_SIZE
},
6488 { unpair_device
, MGMT_UNPAIR_DEVICE_SIZE
},
6489 { user_confirm_reply
, MGMT_USER_CONFIRM_REPLY_SIZE
},
6490 { user_confirm_neg_reply
, MGMT_USER_CONFIRM_NEG_REPLY_SIZE
},
6491 { user_passkey_reply
, MGMT_USER_PASSKEY_REPLY_SIZE
},
6492 { user_passkey_neg_reply
, MGMT_USER_PASSKEY_NEG_REPLY_SIZE
},
6493 { read_local_oob_data
, MGMT_READ_LOCAL_OOB_DATA_SIZE
},
6494 { add_remote_oob_data
, MGMT_ADD_REMOTE_OOB_DATA_SIZE
,
6496 { remove_remote_oob_data
, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE
},
6497 { start_discovery
, MGMT_START_DISCOVERY_SIZE
},
6498 { stop_discovery
, MGMT_STOP_DISCOVERY_SIZE
},
6499 { confirm_name
, MGMT_CONFIRM_NAME_SIZE
},
6500 { block_device
, MGMT_BLOCK_DEVICE_SIZE
},
6501 { unblock_device
, MGMT_UNBLOCK_DEVICE_SIZE
},
6502 { set_device_id
, MGMT_SET_DEVICE_ID_SIZE
},
6503 { set_advertising
, MGMT_SETTING_SIZE
},
6504 { set_bredr
, MGMT_SETTING_SIZE
},
6505 { set_static_address
, MGMT_SET_STATIC_ADDRESS_SIZE
},
6506 { set_scan_params
, MGMT_SET_SCAN_PARAMS_SIZE
},
6507 { set_secure_conn
, MGMT_SETTING_SIZE
},
6508 { set_debug_keys
, MGMT_SETTING_SIZE
},
6509 { set_privacy
, MGMT_SET_PRIVACY_SIZE
},
6510 { load_irks
, MGMT_LOAD_IRKS_SIZE
,
6512 { get_conn_info
, MGMT_GET_CONN_INFO_SIZE
},
6513 { get_clock_info
, MGMT_GET_CLOCK_INFO_SIZE
},
6514 { add_device
, MGMT_ADD_DEVICE_SIZE
},
6515 { remove_device
, MGMT_REMOVE_DEVICE_SIZE
},
6516 { load_conn_param
, MGMT_LOAD_CONN_PARAM_SIZE
,
6518 { read_unconf_index_list
, MGMT_READ_UNCONF_INDEX_LIST_SIZE
,
6520 HCI_MGMT_UNTRUSTED
},
6521 { read_config_info
, MGMT_READ_CONFIG_INFO_SIZE
,
6522 HCI_MGMT_UNCONFIGURED
|
6523 HCI_MGMT_UNTRUSTED
},
6524 { set_external_config
, MGMT_SET_EXTERNAL_CONFIG_SIZE
,
6525 HCI_MGMT_UNCONFIGURED
},
6526 { set_public_address
, MGMT_SET_PUBLIC_ADDRESS_SIZE
,
6527 HCI_MGMT_UNCONFIGURED
},
6528 { start_service_discovery
, MGMT_START_SERVICE_DISCOVERY_SIZE
,
6530 { read_local_oob_ext_data
, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE
},
6531 { read_ext_index_list
, MGMT_READ_EXT_INDEX_LIST_SIZE
,
6533 HCI_MGMT_UNTRUSTED
},
6534 { read_adv_features
, MGMT_READ_ADV_FEATURES_SIZE
},
6535 { add_advertising
, MGMT_ADD_ADVERTISING_SIZE
,
6537 { remove_advertising
, MGMT_REMOVE_ADVERTISING_SIZE
},
6538 { get_adv_size_info
, MGMT_GET_ADV_SIZE_INFO_SIZE
},
6539 { start_limited_discovery
, MGMT_START_DISCOVERY_SIZE
},
6540 { read_ext_controller_info
,MGMT_READ_EXT_INFO_SIZE
,
6541 HCI_MGMT_UNTRUSTED
},
6542 { set_appearance
, MGMT_SET_APPEARANCE_SIZE
},
6545 void mgmt_index_added(struct hci_dev
*hdev
)
6547 struct mgmt_ev_ext_index ev
;
6549 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &hdev
->quirks
))
6552 switch (hdev
->dev_type
) {
6554 if (hci_dev_test_flag(hdev
, HCI_UNCONFIGURED
)) {
6555 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED
, hdev
,
6556 NULL
, 0, HCI_MGMT_UNCONF_INDEX_EVENTS
);
6559 mgmt_index_event(MGMT_EV_INDEX_ADDED
, hdev
, NULL
, 0,
6560 HCI_MGMT_INDEX_EVENTS
);
6573 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED
, hdev
, &ev
, sizeof(ev
),
6574 HCI_MGMT_EXT_INDEX_EVENTS
);
6577 void mgmt_index_removed(struct hci_dev
*hdev
)
6579 struct mgmt_ev_ext_index ev
;
6580 u8 status
= MGMT_STATUS_INVALID_INDEX
;
6582 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &hdev
->quirks
))
6585 switch (hdev
->dev_type
) {
6587 mgmt_pending_foreach(0, hdev
, cmd_complete_rsp
, &status
);
6589 if (hci_dev_test_flag(hdev
, HCI_UNCONFIGURED
)) {
6590 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED
, hdev
,
6591 NULL
, 0, HCI_MGMT_UNCONF_INDEX_EVENTS
);
6594 mgmt_index_event(MGMT_EV_INDEX_REMOVED
, hdev
, NULL
, 0,
6595 HCI_MGMT_INDEX_EVENTS
);
6608 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED
, hdev
, &ev
, sizeof(ev
),
6609 HCI_MGMT_EXT_INDEX_EVENTS
);
6612 /* This function requires the caller holds hdev->lock */
6613 static void restart_le_actions(struct hci_dev
*hdev
)
6615 struct hci_conn_params
*p
;
6617 list_for_each_entry(p
, &hdev
->le_conn_params
, list
) {
6618 /* Needed for AUTO_OFF case where might not "really"
6619 * have been powered off.
6621 list_del_init(&p
->action
);
6623 switch (p
->auto_connect
) {
6624 case HCI_AUTO_CONN_DIRECT
:
6625 case HCI_AUTO_CONN_ALWAYS
:
6626 list_add(&p
->action
, &hdev
->pend_le_conns
);
6628 case HCI_AUTO_CONN_REPORT
:
6629 list_add(&p
->action
, &hdev
->pend_le_reports
);
6637 void mgmt_power_on(struct hci_dev
*hdev
, int err
)
6639 struct cmd_lookup match
= { NULL
, hdev
};
6641 BT_DBG("err %d", err
);
6646 restart_le_actions(hdev
);
6647 hci_update_background_scan(hdev
);
6650 mgmt_pending_foreach(MGMT_OP_SET_POWERED
, hdev
, settings_rsp
, &match
);
6652 new_settings(hdev
, match
.sk
);
6657 hci_dev_unlock(hdev
);
6660 void __mgmt_power_off(struct hci_dev
*hdev
)
6662 struct cmd_lookup match
= { NULL
, hdev
};
6663 u8 status
, zero_cod
[] = { 0, 0, 0 };
6665 mgmt_pending_foreach(MGMT_OP_SET_POWERED
, hdev
, settings_rsp
, &match
);
6667 /* If the power off is because of hdev unregistration let
6668 * use the appropriate INVALID_INDEX status. Otherwise use
6669 * NOT_POWERED. We cover both scenarios here since later in
6670 * mgmt_index_removed() any hci_conn callbacks will have already
6671 * been triggered, potentially causing misleading DISCONNECTED
6674 if (hci_dev_test_flag(hdev
, HCI_UNREGISTER
))
6675 status
= MGMT_STATUS_INVALID_INDEX
;
6677 status
= MGMT_STATUS_NOT_POWERED
;
6679 mgmt_pending_foreach(0, hdev
, cmd_complete_rsp
, &status
);
6681 if (memcmp(hdev
->dev_class
, zero_cod
, sizeof(zero_cod
)) != 0) {
6682 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED
, hdev
,
6683 zero_cod
, sizeof(zero_cod
),
6684 HCI_MGMT_DEV_CLASS_EVENTS
, NULL
);
6685 ext_info_changed(hdev
, NULL
);
6688 new_settings(hdev
, match
.sk
);
6694 void mgmt_set_powered_failed(struct hci_dev
*hdev
, int err
)
6696 struct mgmt_pending_cmd
*cmd
;
6699 cmd
= pending_find(MGMT_OP_SET_POWERED
, hdev
);
6703 if (err
== -ERFKILL
)
6704 status
= MGMT_STATUS_RFKILLED
;
6706 status
= MGMT_STATUS_FAILED
;
6708 mgmt_cmd_status(cmd
->sk
, hdev
->id
, MGMT_OP_SET_POWERED
, status
);
6710 mgmt_pending_remove(cmd
);
6713 void mgmt_new_link_key(struct hci_dev
*hdev
, struct link_key
*key
,
6716 struct mgmt_ev_new_link_key ev
;
6718 memset(&ev
, 0, sizeof(ev
));
6720 ev
.store_hint
= persistent
;
6721 bacpy(&ev
.key
.addr
.bdaddr
, &key
->bdaddr
);
6722 ev
.key
.addr
.type
= BDADDR_BREDR
;
6723 ev
.key
.type
= key
->type
;
6724 memcpy(ev
.key
.val
, key
->val
, HCI_LINK_KEY_SIZE
);
6725 ev
.key
.pin_len
= key
->pin_len
;
6727 mgmt_event(MGMT_EV_NEW_LINK_KEY
, hdev
, &ev
, sizeof(ev
), NULL
);
6730 static u8
mgmt_ltk_type(struct smp_ltk
*ltk
)
6732 switch (ltk
->type
) {
6735 if (ltk
->authenticated
)
6736 return MGMT_LTK_AUTHENTICATED
;
6737 return MGMT_LTK_UNAUTHENTICATED
;
6739 if (ltk
->authenticated
)
6740 return MGMT_LTK_P256_AUTH
;
6741 return MGMT_LTK_P256_UNAUTH
;
6742 case SMP_LTK_P256_DEBUG
:
6743 return MGMT_LTK_P256_DEBUG
;
6746 return MGMT_LTK_UNAUTHENTICATED
;
6749 void mgmt_new_ltk(struct hci_dev
*hdev
, struct smp_ltk
*key
, bool persistent
)
6751 struct mgmt_ev_new_long_term_key ev
;
6753 memset(&ev
, 0, sizeof(ev
));
6755 /* Devices using resolvable or non-resolvable random addresses
6756 * without providing an identity resolving key don't require
6757 * to store long term keys. Their addresses will change the
6760 * Only when a remote device provides an identity address
6761 * make sure the long term key is stored. If the remote
6762 * identity is known, the long term keys are internally
6763 * mapped to the identity address. So allow static random
6764 * and public addresses here.
6766 if (key
->bdaddr_type
== ADDR_LE_DEV_RANDOM
&&
6767 (key
->bdaddr
.b
[5] & 0xc0) != 0xc0)
6768 ev
.store_hint
= 0x00;
6770 ev
.store_hint
= persistent
;
6772 bacpy(&ev
.key
.addr
.bdaddr
, &key
->bdaddr
);
6773 ev
.key
.addr
.type
= link_to_bdaddr(LE_LINK
, key
->bdaddr_type
);
6774 ev
.key
.type
= mgmt_ltk_type(key
);
6775 ev
.key
.enc_size
= key
->enc_size
;
6776 ev
.key
.ediv
= key
->ediv
;
6777 ev
.key
.rand
= key
->rand
;
6779 if (key
->type
== SMP_LTK
)
6782 /* Make sure we copy only the significant bytes based on the
6783 * encryption key size, and set the rest of the value to zeroes.
6785 memcpy(ev
.key
.val
, key
->val
, key
->enc_size
);
6786 memset(ev
.key
.val
+ key
->enc_size
, 0,
6787 sizeof(ev
.key
.val
) - key
->enc_size
);
6789 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY
, hdev
, &ev
, sizeof(ev
), NULL
);
6792 void mgmt_new_irk(struct hci_dev
*hdev
, struct smp_irk
*irk
, bool persistent
)
6794 struct mgmt_ev_new_irk ev
;
6796 memset(&ev
, 0, sizeof(ev
));
6798 ev
.store_hint
= persistent
;
6800 bacpy(&ev
.rpa
, &irk
->rpa
);
6801 bacpy(&ev
.irk
.addr
.bdaddr
, &irk
->bdaddr
);
6802 ev
.irk
.addr
.type
= link_to_bdaddr(LE_LINK
, irk
->addr_type
);
6803 memcpy(ev
.irk
.val
, irk
->val
, sizeof(irk
->val
));
6805 mgmt_event(MGMT_EV_NEW_IRK
, hdev
, &ev
, sizeof(ev
), NULL
);
6808 void mgmt_new_csrk(struct hci_dev
*hdev
, struct smp_csrk
*csrk
,
6811 struct mgmt_ev_new_csrk ev
;
6813 memset(&ev
, 0, sizeof(ev
));
6815 /* Devices using resolvable or non-resolvable random addresses
6816 * without providing an identity resolving key don't require
6817 * to store signature resolving keys. Their addresses will change
6818 * the next time around.
6820 * Only when a remote device provides an identity address
6821 * make sure the signature resolving key is stored. So allow
6822 * static random and public addresses here.
6824 if (csrk
->bdaddr_type
== ADDR_LE_DEV_RANDOM
&&
6825 (csrk
->bdaddr
.b
[5] & 0xc0) != 0xc0)
6826 ev
.store_hint
= 0x00;
6828 ev
.store_hint
= persistent
;
6830 bacpy(&ev
.key
.addr
.bdaddr
, &csrk
->bdaddr
);
6831 ev
.key
.addr
.type
= link_to_bdaddr(LE_LINK
, csrk
->bdaddr_type
);
6832 ev
.key
.type
= csrk
->type
;
6833 memcpy(ev
.key
.val
, csrk
->val
, sizeof(csrk
->val
));
6835 mgmt_event(MGMT_EV_NEW_CSRK
, hdev
, &ev
, sizeof(ev
), NULL
);
6838 void mgmt_new_conn_param(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
6839 u8 bdaddr_type
, u8 store_hint
, u16 min_interval
,
6840 u16 max_interval
, u16 latency
, u16 timeout
)
6842 struct mgmt_ev_new_conn_param ev
;
6844 if (!hci_is_identity_address(bdaddr
, bdaddr_type
))
6847 memset(&ev
, 0, sizeof(ev
));
6848 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
6849 ev
.addr
.type
= link_to_bdaddr(LE_LINK
, bdaddr_type
);
6850 ev
.store_hint
= store_hint
;
6851 ev
.min_interval
= cpu_to_le16(min_interval
);
6852 ev
.max_interval
= cpu_to_le16(max_interval
);
6853 ev
.latency
= cpu_to_le16(latency
);
6854 ev
.timeout
= cpu_to_le16(timeout
);
6856 mgmt_event(MGMT_EV_NEW_CONN_PARAM
, hdev
, &ev
, sizeof(ev
), NULL
);
6859 void mgmt_device_connected(struct hci_dev
*hdev
, struct hci_conn
*conn
,
6860 u32 flags
, u8
*name
, u8 name_len
)
6863 struct mgmt_ev_device_connected
*ev
= (void *) buf
;
6866 bacpy(&ev
->addr
.bdaddr
, &conn
->dst
);
6867 ev
->addr
.type
= link_to_bdaddr(conn
->type
, conn
->dst_type
);
6869 ev
->flags
= __cpu_to_le32(flags
);
6871 /* We must ensure that the EIR Data fields are ordered and
6872 * unique. Keep it simple for now and avoid the problem by not
6873 * adding any BR/EDR data to the LE adv.
6875 if (conn
->le_adv_data_len
> 0) {
6876 memcpy(&ev
->eir
[eir_len
],
6877 conn
->le_adv_data
, conn
->le_adv_data_len
);
6878 eir_len
= conn
->le_adv_data_len
;
6881 eir_len
= eir_append_data(ev
->eir
, 0, EIR_NAME_COMPLETE
,
6884 if (memcmp(conn
->dev_class
, "\0\0\0", 3) != 0)
6885 eir_len
= eir_append_data(ev
->eir
, eir_len
,
6887 conn
->dev_class
, 3);
6890 ev
->eir_len
= cpu_to_le16(eir_len
);
6892 mgmt_event(MGMT_EV_DEVICE_CONNECTED
, hdev
, buf
,
6893 sizeof(*ev
) + eir_len
, NULL
);
6896 static void disconnect_rsp(struct mgmt_pending_cmd
*cmd
, void *data
)
6898 struct sock
**sk
= data
;
6900 cmd
->cmd_complete(cmd
, 0);
6905 mgmt_pending_remove(cmd
);
6908 static void unpair_device_rsp(struct mgmt_pending_cmd
*cmd
, void *data
)
6910 struct hci_dev
*hdev
= data
;
6911 struct mgmt_cp_unpair_device
*cp
= cmd
->param
;
6913 device_unpaired(hdev
, &cp
->addr
.bdaddr
, cp
->addr
.type
, cmd
->sk
);
6915 cmd
->cmd_complete(cmd
, 0);
6916 mgmt_pending_remove(cmd
);
6919 bool mgmt_powering_down(struct hci_dev
*hdev
)
6921 struct mgmt_pending_cmd
*cmd
;
6922 struct mgmt_mode
*cp
;
6924 cmd
= pending_find(MGMT_OP_SET_POWERED
, hdev
);
6935 void mgmt_device_disconnected(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
6936 u8 link_type
, u8 addr_type
, u8 reason
,
6937 bool mgmt_connected
)
6939 struct mgmt_ev_device_disconnected ev
;
6940 struct sock
*sk
= NULL
;
6942 /* The connection is still in hci_conn_hash so test for 1
6943 * instead of 0 to know if this is the last one.
6945 if (mgmt_powering_down(hdev
) && hci_conn_count(hdev
) == 1) {
6946 cancel_delayed_work(&hdev
->power_off
);
6947 queue_work(hdev
->req_workqueue
, &hdev
->power_off
.work
);
6950 if (!mgmt_connected
)
6953 if (link_type
!= ACL_LINK
&& link_type
!= LE_LINK
)
6956 mgmt_pending_foreach(MGMT_OP_DISCONNECT
, hdev
, disconnect_rsp
, &sk
);
6958 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
6959 ev
.addr
.type
= link_to_bdaddr(link_type
, addr_type
);
6962 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED
, hdev
, &ev
, sizeof(ev
), sk
);
6967 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE
, hdev
, unpair_device_rsp
,
6971 void mgmt_disconnect_failed(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
6972 u8 link_type
, u8 addr_type
, u8 status
)
6974 u8 bdaddr_type
= link_to_bdaddr(link_type
, addr_type
);
6975 struct mgmt_cp_disconnect
*cp
;
6976 struct mgmt_pending_cmd
*cmd
;
6978 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE
, hdev
, unpair_device_rsp
,
6981 cmd
= pending_find(MGMT_OP_DISCONNECT
, hdev
);
6987 if (bacmp(bdaddr
, &cp
->addr
.bdaddr
))
6990 if (cp
->addr
.type
!= bdaddr_type
)
6993 cmd
->cmd_complete(cmd
, mgmt_status(status
));
6994 mgmt_pending_remove(cmd
);
6997 void mgmt_connect_failed(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
, u8 link_type
,
6998 u8 addr_type
, u8 status
)
7000 struct mgmt_ev_connect_failed ev
;
7002 /* The connection is still in hci_conn_hash so test for 1
7003 * instead of 0 to know if this is the last one.
7005 if (mgmt_powering_down(hdev
) && hci_conn_count(hdev
) == 1) {
7006 cancel_delayed_work(&hdev
->power_off
);
7007 queue_work(hdev
->req_workqueue
, &hdev
->power_off
.work
);
7010 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
7011 ev
.addr
.type
= link_to_bdaddr(link_type
, addr_type
);
7012 ev
.status
= mgmt_status(status
);
7014 mgmt_event(MGMT_EV_CONNECT_FAILED
, hdev
, &ev
, sizeof(ev
), NULL
);
7017 void mgmt_pin_code_request(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
, u8 secure
)
7019 struct mgmt_ev_pin_code_request ev
;
7021 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
7022 ev
.addr
.type
= BDADDR_BREDR
;
7025 mgmt_event(MGMT_EV_PIN_CODE_REQUEST
, hdev
, &ev
, sizeof(ev
), NULL
);
7028 void mgmt_pin_code_reply_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7031 struct mgmt_pending_cmd
*cmd
;
7033 cmd
= pending_find(MGMT_OP_PIN_CODE_REPLY
, hdev
);
7037 cmd
->cmd_complete(cmd
, mgmt_status(status
));
7038 mgmt_pending_remove(cmd
);
7041 void mgmt_pin_code_neg_reply_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7044 struct mgmt_pending_cmd
*cmd
;
7046 cmd
= pending_find(MGMT_OP_PIN_CODE_NEG_REPLY
, hdev
);
7050 cmd
->cmd_complete(cmd
, mgmt_status(status
));
7051 mgmt_pending_remove(cmd
);
7054 int mgmt_user_confirm_request(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7055 u8 link_type
, u8 addr_type
, u32 value
,
7058 struct mgmt_ev_user_confirm_request ev
;
7060 BT_DBG("%s", hdev
->name
);
7062 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
7063 ev
.addr
.type
= link_to_bdaddr(link_type
, addr_type
);
7064 ev
.confirm_hint
= confirm_hint
;
7065 ev
.value
= cpu_to_le32(value
);
7067 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST
, hdev
, &ev
, sizeof(ev
),
7071 int mgmt_user_passkey_request(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7072 u8 link_type
, u8 addr_type
)
7074 struct mgmt_ev_user_passkey_request ev
;
7076 BT_DBG("%s", hdev
->name
);
7078 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
7079 ev
.addr
.type
= link_to_bdaddr(link_type
, addr_type
);
7081 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST
, hdev
, &ev
, sizeof(ev
),
7085 static int user_pairing_resp_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7086 u8 link_type
, u8 addr_type
, u8 status
,
7089 struct mgmt_pending_cmd
*cmd
;
7091 cmd
= pending_find(opcode
, hdev
);
7095 cmd
->cmd_complete(cmd
, mgmt_status(status
));
7096 mgmt_pending_remove(cmd
);
7101 int mgmt_user_confirm_reply_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7102 u8 link_type
, u8 addr_type
, u8 status
)
7104 return user_pairing_resp_complete(hdev
, bdaddr
, link_type
, addr_type
,
7105 status
, MGMT_OP_USER_CONFIRM_REPLY
);
7108 int mgmt_user_confirm_neg_reply_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7109 u8 link_type
, u8 addr_type
, u8 status
)
7111 return user_pairing_resp_complete(hdev
, bdaddr
, link_type
, addr_type
,
7113 MGMT_OP_USER_CONFIRM_NEG_REPLY
);
7116 int mgmt_user_passkey_reply_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7117 u8 link_type
, u8 addr_type
, u8 status
)
7119 return user_pairing_resp_complete(hdev
, bdaddr
, link_type
, addr_type
,
7120 status
, MGMT_OP_USER_PASSKEY_REPLY
);
7123 int mgmt_user_passkey_neg_reply_complete(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7124 u8 link_type
, u8 addr_type
, u8 status
)
7126 return user_pairing_resp_complete(hdev
, bdaddr
, link_type
, addr_type
,
7128 MGMT_OP_USER_PASSKEY_NEG_REPLY
);
7131 int mgmt_user_passkey_notify(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
,
7132 u8 link_type
, u8 addr_type
, u32 passkey
,
7135 struct mgmt_ev_passkey_notify ev
;
7137 BT_DBG("%s", hdev
->name
);
7139 bacpy(&ev
.addr
.bdaddr
, bdaddr
);
7140 ev
.addr
.type
= link_to_bdaddr(link_type
, addr_type
);
7141 ev
.passkey
= __cpu_to_le32(passkey
);
7142 ev
.entered
= entered
;
7144 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY
, hdev
, &ev
, sizeof(ev
), NULL
);
7147 void mgmt_auth_failed(struct hci_conn
*conn
, u8 hci_status
)
7149 struct mgmt_ev_auth_failed ev
;
7150 struct mgmt_pending_cmd
*cmd
;
7151 u8 status
= mgmt_status(hci_status
);
7153 bacpy(&ev
.addr
.bdaddr
, &conn
->dst
);
7154 ev
.addr
.type
= link_to_bdaddr(conn
->type
, conn
->dst_type
);
7157 cmd
= find_pairing(conn
);
7159 mgmt_event(MGMT_EV_AUTH_FAILED
, conn
->hdev
, &ev
, sizeof(ev
),
7160 cmd
? cmd
->sk
: NULL
);
7163 cmd
->cmd_complete(cmd
, status
);
7164 mgmt_pending_remove(cmd
);
7168 void mgmt_auth_enable_complete(struct hci_dev
*hdev
, u8 status
)
7170 struct cmd_lookup match
= { NULL
, hdev
};
7174 u8 mgmt_err
= mgmt_status(status
);
7175 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY
, hdev
,
7176 cmd_status_rsp
, &mgmt_err
);
7180 if (test_bit(HCI_AUTH
, &hdev
->flags
))
7181 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_LINK_SECURITY
);
7183 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_LINK_SECURITY
);
7185 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY
, hdev
, settings_rsp
,
7189 new_settings(hdev
, match
.sk
);
7195 static void clear_eir(struct hci_request
*req
)
7197 struct hci_dev
*hdev
= req
->hdev
;
7198 struct hci_cp_write_eir cp
;
7200 if (!lmp_ext_inq_capable(hdev
))
7203 memset(hdev
->eir
, 0, sizeof(hdev
->eir
));
7205 memset(&cp
, 0, sizeof(cp
));
7207 hci_req_add(req
, HCI_OP_WRITE_EIR
, sizeof(cp
), &cp
);
7210 void mgmt_ssp_enable_complete(struct hci_dev
*hdev
, u8 enable
, u8 status
)
7212 struct cmd_lookup match
= { NULL
, hdev
};
7213 struct hci_request req
;
7214 bool changed
= false;
7217 u8 mgmt_err
= mgmt_status(status
);
7219 if (enable
&& hci_dev_test_and_clear_flag(hdev
,
7221 hci_dev_clear_flag(hdev
, HCI_HS_ENABLED
);
7222 new_settings(hdev
, NULL
);
7225 mgmt_pending_foreach(MGMT_OP_SET_SSP
, hdev
, cmd_status_rsp
,
7231 changed
= !hci_dev_test_and_set_flag(hdev
, HCI_SSP_ENABLED
);
7233 changed
= hci_dev_test_and_clear_flag(hdev
, HCI_SSP_ENABLED
);
7235 changed
= hci_dev_test_and_clear_flag(hdev
,
7238 hci_dev_clear_flag(hdev
, HCI_HS_ENABLED
);
7241 mgmt_pending_foreach(MGMT_OP_SET_SSP
, hdev
, settings_rsp
, &match
);
7244 new_settings(hdev
, match
.sk
);
7249 hci_req_init(&req
, hdev
);
7251 if (hci_dev_test_flag(hdev
, HCI_SSP_ENABLED
)) {
7252 if (hci_dev_test_flag(hdev
, HCI_USE_DEBUG_KEYS
))
7253 hci_req_add(&req
, HCI_OP_WRITE_SSP_DEBUG_MODE
,
7254 sizeof(enable
), &enable
);
7255 __hci_req_update_eir(&req
);
7260 hci_req_run(&req
, NULL
);
7263 static void sk_lookup(struct mgmt_pending_cmd
*cmd
, void *data
)
7265 struct cmd_lookup
*match
= data
;
7267 if (match
->sk
== NULL
) {
7268 match
->sk
= cmd
->sk
;
7269 sock_hold(match
->sk
);
7273 void mgmt_set_class_of_dev_complete(struct hci_dev
*hdev
, u8
*dev_class
,
7276 struct cmd_lookup match
= { NULL
, hdev
, mgmt_status(status
) };
7278 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS
, hdev
, sk_lookup
, &match
);
7279 mgmt_pending_foreach(MGMT_OP_ADD_UUID
, hdev
, sk_lookup
, &match
);
7280 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID
, hdev
, sk_lookup
, &match
);
7283 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED
, hdev
, dev_class
,
7284 3, HCI_MGMT_DEV_CLASS_EVENTS
, NULL
);
7285 ext_info_changed(hdev
, NULL
);
7292 void mgmt_set_local_name_complete(struct hci_dev
*hdev
, u8
*name
, u8 status
)
7294 struct mgmt_cp_set_local_name ev
;
7295 struct mgmt_pending_cmd
*cmd
;
7300 memset(&ev
, 0, sizeof(ev
));
7301 memcpy(ev
.name
, name
, HCI_MAX_NAME_LENGTH
);
7302 memcpy(ev
.short_name
, hdev
->short_name
, HCI_MAX_SHORT_NAME_LENGTH
);
7304 cmd
= pending_find(MGMT_OP_SET_LOCAL_NAME
, hdev
);
7306 memcpy(hdev
->dev_name
, name
, sizeof(hdev
->dev_name
));
7308 /* If this is a HCI command related to powering on the
7309 * HCI dev don't send any mgmt signals.
7311 if (pending_find(MGMT_OP_SET_POWERED
, hdev
))
7315 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED
, hdev
, &ev
, sizeof(ev
),
7316 HCI_MGMT_LOCAL_NAME_EVENTS
, cmd
? cmd
->sk
: NULL
);
7317 ext_info_changed(hdev
, cmd
? cmd
->sk
: NULL
);
7320 static inline bool has_uuid(u8
*uuid
, u16 uuid_count
, u8 (*uuids
)[16])
7324 for (i
= 0; i
< uuid_count
; i
++) {
7325 if (!memcmp(uuid
, uuids
[i
], 16))
7332 static bool eir_has_uuids(u8
*eir
, u16 eir_len
, u16 uuid_count
, u8 (*uuids
)[16])
7336 while (parsed
< eir_len
) {
7337 u8 field_len
= eir
[0];
7344 if (eir_len
- parsed
< field_len
+ 1)
7348 case EIR_UUID16_ALL
:
7349 case EIR_UUID16_SOME
:
7350 for (i
= 0; i
+ 3 <= field_len
; i
+= 2) {
7351 memcpy(uuid
, bluetooth_base_uuid
, 16);
7352 uuid
[13] = eir
[i
+ 3];
7353 uuid
[12] = eir
[i
+ 2];
7354 if (has_uuid(uuid
, uuid_count
, uuids
))
7358 case EIR_UUID32_ALL
:
7359 case EIR_UUID32_SOME
:
7360 for (i
= 0; i
+ 5 <= field_len
; i
+= 4) {
7361 memcpy(uuid
, bluetooth_base_uuid
, 16);
7362 uuid
[15] = eir
[i
+ 5];
7363 uuid
[14] = eir
[i
+ 4];
7364 uuid
[13] = eir
[i
+ 3];
7365 uuid
[12] = eir
[i
+ 2];
7366 if (has_uuid(uuid
, uuid_count
, uuids
))
7370 case EIR_UUID128_ALL
:
7371 case EIR_UUID128_SOME
:
7372 for (i
= 0; i
+ 17 <= field_len
; i
+= 16) {
7373 memcpy(uuid
, eir
+ i
+ 2, 16);
7374 if (has_uuid(uuid
, uuid_count
, uuids
))
7380 parsed
+= field_len
+ 1;
7381 eir
+= field_len
+ 1;
7387 static void restart_le_scan(struct hci_dev
*hdev
)
7389 /* If controller is not scanning we are done. */
7390 if (!hci_dev_test_flag(hdev
, HCI_LE_SCAN
))
7393 if (time_after(jiffies
+ DISCOV_LE_RESTART_DELAY
,
7394 hdev
->discovery
.scan_start
+
7395 hdev
->discovery
.scan_duration
))
7398 queue_delayed_work(hdev
->req_workqueue
, &hdev
->le_scan_restart
,
7399 DISCOV_LE_RESTART_DELAY
);
7402 static bool is_filter_match(struct hci_dev
*hdev
, s8 rssi
, u8
*eir
,
7403 u16 eir_len
, u8
*scan_rsp
, u8 scan_rsp_len
)
7405 /* If a RSSI threshold has been specified, and
7406 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7407 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7408 * is set, let it through for further processing, as we might need to
7411 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7412 * the results are also dropped.
7414 if (hdev
->discovery
.rssi
!= HCI_RSSI_INVALID
&&
7415 (rssi
== HCI_RSSI_INVALID
||
7416 (rssi
< hdev
->discovery
.rssi
&&
7417 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER
, &hdev
->quirks
))))
7420 if (hdev
->discovery
.uuid_count
!= 0) {
7421 /* If a list of UUIDs is provided in filter, results with no
7422 * matching UUID should be dropped.
7424 if (!eir_has_uuids(eir
, eir_len
, hdev
->discovery
.uuid_count
,
7425 hdev
->discovery
.uuids
) &&
7426 !eir_has_uuids(scan_rsp
, scan_rsp_len
,
7427 hdev
->discovery
.uuid_count
,
7428 hdev
->discovery
.uuids
))
7432 /* If duplicate filtering does not report RSSI changes, then restart
7433 * scanning to ensure updated result with updated RSSI values.
7435 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER
, &hdev
->quirks
)) {
7436 restart_le_scan(hdev
);
7438 /* Validate RSSI value against the RSSI threshold once more. */
7439 if (hdev
->discovery
.rssi
!= HCI_RSSI_INVALID
&&
7440 rssi
< hdev
->discovery
.rssi
)
7447 void mgmt_device_found(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
, u8 link_type
,
7448 u8 addr_type
, u8
*dev_class
, s8 rssi
, u32 flags
,
7449 u8
*eir
, u16 eir_len
, u8
*scan_rsp
, u8 scan_rsp_len
)
7452 struct mgmt_ev_device_found
*ev
= (void *)buf
;
7455 /* Don't send events for a non-kernel initiated discovery. With
7456 * LE one exception is if we have pend_le_reports > 0 in which
7457 * case we're doing passive scanning and want these events.
7459 if (!hci_discovery_active(hdev
)) {
7460 if (link_type
== ACL_LINK
)
7462 if (link_type
== LE_LINK
&& list_empty(&hdev
->pend_le_reports
))
7466 if (hdev
->discovery
.result_filtering
) {
7467 /* We are using service discovery */
7468 if (!is_filter_match(hdev
, rssi
, eir
, eir_len
, scan_rsp
,
7473 if (hdev
->discovery
.limited
) {
7474 /* Check for limited discoverable bit */
7476 if (!(dev_class
[1] & 0x20))
7479 u8
*flags
= eir_get_data(eir
, eir_len
, EIR_FLAGS
, NULL
);
7480 if (!flags
|| !(flags
[0] & LE_AD_LIMITED
))
7485 /* Make sure that the buffer is big enough. The 5 extra bytes
7486 * are for the potential CoD field.
7488 if (sizeof(*ev
) + eir_len
+ scan_rsp_len
+ 5 > sizeof(buf
))
7491 memset(buf
, 0, sizeof(buf
));
7493 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7494 * RSSI value was reported as 0 when not available. This behavior
7495 * is kept when using device discovery. This is required for full
7496 * backwards compatibility with the API.
7498 * However when using service discovery, the value 127 will be
7499 * returned when the RSSI is not available.
7501 if (rssi
== HCI_RSSI_INVALID
&& !hdev
->discovery
.report_invalid_rssi
&&
7502 link_type
== ACL_LINK
)
7505 bacpy(&ev
->addr
.bdaddr
, bdaddr
);
7506 ev
->addr
.type
= link_to_bdaddr(link_type
, addr_type
);
7508 ev
->flags
= cpu_to_le32(flags
);
7511 /* Copy EIR or advertising data into event */
7512 memcpy(ev
->eir
, eir
, eir_len
);
7514 if (dev_class
&& !eir_get_data(ev
->eir
, eir_len
, EIR_CLASS_OF_DEV
,
7516 eir_len
= eir_append_data(ev
->eir
, eir_len
, EIR_CLASS_OF_DEV
,
7519 if (scan_rsp_len
> 0)
7520 /* Append scan response data to event */
7521 memcpy(ev
->eir
+ eir_len
, scan_rsp
, scan_rsp_len
);
7523 ev
->eir_len
= cpu_to_le16(eir_len
+ scan_rsp_len
);
7524 ev_size
= sizeof(*ev
) + eir_len
+ scan_rsp_len
;
7526 mgmt_event(MGMT_EV_DEVICE_FOUND
, hdev
, ev
, ev_size
, NULL
);
7529 void mgmt_remote_name(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
, u8 link_type
,
7530 u8 addr_type
, s8 rssi
, u8
*name
, u8 name_len
)
7532 struct mgmt_ev_device_found
*ev
;
7533 char buf
[sizeof(*ev
) + HCI_MAX_NAME_LENGTH
+ 2];
7536 ev
= (struct mgmt_ev_device_found
*) buf
;
7538 memset(buf
, 0, sizeof(buf
));
7540 bacpy(&ev
->addr
.bdaddr
, bdaddr
);
7541 ev
->addr
.type
= link_to_bdaddr(link_type
, addr_type
);
7544 eir_len
= eir_append_data(ev
->eir
, 0, EIR_NAME_COMPLETE
, name
,
7547 ev
->eir_len
= cpu_to_le16(eir_len
);
7549 mgmt_event(MGMT_EV_DEVICE_FOUND
, hdev
, ev
, sizeof(*ev
) + eir_len
, NULL
);
7552 void mgmt_discovering(struct hci_dev
*hdev
, u8 discovering
)
7554 struct mgmt_ev_discovering ev
;
7556 BT_DBG("%s discovering %u", hdev
->name
, discovering
);
7558 memset(&ev
, 0, sizeof(ev
));
7559 ev
.type
= hdev
->discovery
.type
;
7560 ev
.discovering
= discovering
;
7562 mgmt_event(MGMT_EV_DISCOVERING
, hdev
, &ev
, sizeof(ev
), NULL
);
7565 static struct hci_mgmt_chan chan
= {
7566 .channel
= HCI_CHANNEL_CONTROL
,
7567 .handler_count
= ARRAY_SIZE(mgmt_handlers
),
7568 .handlers
= mgmt_handlers
,
7569 .hdev_init
= mgmt_init_hdev
,
7574 return hci_mgmt_chan_register(&chan
);
7577 void mgmt_exit(void)
7579 hci_mgmt_chan_unregister(&chan
);