]> Git Repo - linux.git/blame - net/bluetooth/mgmt.c
projects / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Move hci_get_cmd_complete() to hci_event.c
[linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
beb1c21b 41#define MGMT_REVISION 9
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 103 MGMT_OP_ADD_ADVERTISING,
da929335 104 MGMT_OP_REMOVE_ADVERTISING,
e70bb2e8
JH		 105};
106
107static const u16 mgmt_events[] = {
108 MGMT_EV_CONTROLLER_ERROR,
109 MGMT_EV_INDEX_ADDED,
110 MGMT_EV_INDEX_REMOVED,
111 MGMT_EV_NEW_SETTINGS,
112 MGMT_EV_CLASS_OF_DEV_CHANGED,
113 MGMT_EV_LOCAL_NAME_CHANGED,
114 MGMT_EV_NEW_LINK_KEY,
115 MGMT_EV_NEW_LONG_TERM_KEY,
116 MGMT_EV_DEVICE_CONNECTED,
117 MGMT_EV_DEVICE_DISCONNECTED,
118 MGMT_EV_CONNECT_FAILED,
119 MGMT_EV_PIN_CODE_REQUEST,
120 MGMT_EV_USER_CONFIRM_REQUEST,
121 MGMT_EV_USER_PASSKEY_REQUEST,
122 MGMT_EV_AUTH_FAILED,
123 MGMT_EV_DEVICE_FOUND,
124 MGMT_EV_DISCOVERING,
125 MGMT_EV_DEVICE_BLOCKED,
126 MGMT_EV_DEVICE_UNBLOCKED,
127 MGMT_EV_DEVICE_UNPAIRED,
92a25256 128 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 129 MGMT_EV_NEW_IRK,
7ee4ea36 130 MGMT_EV_NEW_CSRK,
8afef092
MH		 131 MGMT_EV_DEVICE_ADDED,
132 MGMT_EV_DEVICE_REMOVED,
ffb5a827 133 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 134 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 135 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 136 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 137 MGMT_EV_EXT_INDEX_ADDED,
138 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 139 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 140 MGMT_EV_ADVERTISING_ADDED,
141 MGMT_EV_ADVERTISING_REMOVED,
e70bb2e8
JH		 142};
143
99c679ac
MH		 144static const u16 mgmt_untrusted_commands[] = {
145 MGMT_OP_READ_INDEX_LIST,
146 MGMT_OP_READ_INFO,
147 MGMT_OP_READ_UNCONF_INDEX_LIST,
148 MGMT_OP_READ_CONFIG_INFO,
149 MGMT_OP_READ_EXT_INDEX_LIST,
150};
151
152static const u16 mgmt_untrusted_events[] = {
153 MGMT_EV_INDEX_ADDED,
154 MGMT_EV_INDEX_REMOVED,
155 MGMT_EV_NEW_SETTINGS,
156 MGMT_EV_CLASS_OF_DEV_CHANGED,
157 MGMT_EV_LOCAL_NAME_CHANGED,
158 MGMT_EV_UNCONF_INDEX_ADDED,
159 MGMT_EV_UNCONF_INDEX_REMOVED,
160 MGMT_EV_NEW_CONFIG_OPTIONS,
161 MGMT_EV_EXT_INDEX_ADDED,
162 MGMT_EV_EXT_INDEX_REMOVED,
163};
164
17b02e62 165#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 166
d25b78e2
JH		 167#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
168 "\x00\x00\x00\x00\x00\x00\x00\x00"
169
ca69b795
JH		 170/* HCI to MGMT error code conversion table */
171static u8 mgmt_status_table[] = {
172 MGMT_STATUS_SUCCESS,
173 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
174 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
175 MGMT_STATUS_FAILED, /* Hardware Failure */
176 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
177 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 178 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 179 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
180 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
181 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
182 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
183 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
184 MGMT_STATUS_BUSY, /* Command Disallowed */
185 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
186 MGMT_STATUS_REJECTED, /* Rejected Security */
187 MGMT_STATUS_REJECTED, /* Rejected Personal */
188 MGMT_STATUS_TIMEOUT, /* Host Timeout */
189 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
190 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
191 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
192 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
193 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
194 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
195 MGMT_STATUS_BUSY, /* Repeated Attempts */
196 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
197 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
199 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
200 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
201 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
202 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
203 MGMT_STATUS_FAILED, /* Unspecified Error */
204 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
205 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
206 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
207 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
208 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
209 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
210 MGMT_STATUS_FAILED, /* Unit Link Key Used */
211 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
212 MGMT_STATUS_TIMEOUT, /* Instant Passed */
213 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
214 MGMT_STATUS_FAILED, /* Transaction Collision */
215 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
216 MGMT_STATUS_REJECTED, /* QoS Rejected */
217 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
218 MGMT_STATUS_REJECTED, /* Insufficient Security */
219 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
220 MGMT_STATUS_BUSY, /* Role Switch Pending */
221 MGMT_STATUS_FAILED, /* Slot Violation */
222 MGMT_STATUS_FAILED, /* Role Switch Failed */
223 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
224 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
225 MGMT_STATUS_BUSY, /* Host Busy Pairing */
226 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
227 MGMT_STATUS_BUSY, /* Controller Busy */
228 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
229 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
230 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
231 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
232 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
233};
234
235static u8 mgmt_status(u8 hci_status)
236{
237 if (hci_status < ARRAY_SIZE(mgmt_status_table))
238 return mgmt_status_table[hci_status];
239
240 return MGMT_STATUS_FAILED;
241}
242
c08b1a1d
MH		 243static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
244 u16 len, int flag)
f9207338 245{
c08b1a1d
MH		 246 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
247 flag, NULL);
f9207338
MH		 248}
249
72000df2
MH		 250static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag, struct sock *skip_sk)
252{
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, skip_sk);
255}
256
f6b7712e
MH		 257static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, struct sock *skip_sk)
259{
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 HCI_MGMT_GENERIC_EVENTS, skip_sk);
262}
263
7a00ff44
JH		 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266{
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 268 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 269}
270
04124681
GP		 271static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
272 u16 data_len)
a38528f1
JH		 273{
274 struct mgmt_rp_read_version rp;
275
276 BT_DBG("sock %p", sk);
277
278 rp.version = MGMT_VERSION;
dcf4adbf 279 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 280
2a1afb5a
JH		 281 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
282 &rp, sizeof(rp));
a38528f1
JH		 283}
284
04124681
GP		 285static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
286 u16 data_len)
e70bb2e8
JH		 287{
288 struct mgmt_rp_read_commands *rp;
99c679ac 289 u16 num_commands, num_events;
e70bb2e8
JH		 290 size_t rp_size;
291 int i, err;
292
293 BT_DBG("sock %p", sk);
294
99c679ac
MH		 295 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
296 num_commands = ARRAY_SIZE(mgmt_commands);
297 num_events = ARRAY_SIZE(mgmt_events);
298 } else {
299 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
300 num_events = ARRAY_SIZE(mgmt_untrusted_events);
301 }
302
e70bb2e8
JH		 303 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
304
305 rp = kmalloc(rp_size, GFP_KERNEL);
306 if (!rp)
307 return -ENOMEM;
308
dcf4adbf
JP		 309 rp->num_commands = cpu_to_le16(num_commands);
310 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 311
99c679ac
MH		 312 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
313 __le16 *opcode = rp->opcodes;
314
315 for (i = 0; i < num_commands; i++, opcode++)
316 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 317
99c679ac
MH		 318 for (i = 0; i < num_events; i++, opcode++)
319 put_unaligned_le16(mgmt_events[i], opcode);
320 } else {
321 __le16 *opcode = rp->opcodes;
322
323 for (i = 0; i < num_commands; i++, opcode++)
324 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
325
326 for (i = 0; i < num_events; i++, opcode++)
327 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
328 }
e70bb2e8 329
2a1afb5a
JH		 330 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
331 rp, rp_size);
e70bb2e8
JH		 332 kfree(rp);
333
334 return err;
335}
336
04124681
GP		 337static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
338 u16 data_len)
faba42eb 339{
faba42eb 340 struct mgmt_rp_read_index_list *rp;
8035ded4 341 struct hci_dev *d;
a38528f1 342 size_t rp_len;
faba42eb 343 u16 count;
476e44cb 344 int err;
faba42eb
JH		 345
346 BT_DBG("sock %p", sk);
347
348 read_lock(&hci_dev_list_lock);
349
350 count = 0;
bb4b2a9a 351 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 352 if (d->dev_type == HCI_BREDR &&
d7a5a11d 353 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 354 count++;
faba42eb
JH		 355 }
356
a38528f1
JH		 357 rp_len = sizeof(*rp) + (2 * count);
358 rp = kmalloc(rp_len, GFP_ATOMIC);
359 if (!rp) {
b2c60d42 360 read_unlock(&hci_dev_list_lock);
faba42eb 361 return -ENOMEM;
b2c60d42 362 }
faba42eb 363
476e44cb 364 count = 0;
8035ded4 365 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 366 if (hci_dev_test_flag(d, HCI_SETUP) ||
367 hci_dev_test_flag(d, HCI_CONFIG) ||
368 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 369 continue;
370
73d1df2a
MH		 371 /* Devices marked as raw-only are neither configured
372 * nor unconfigured controllers.
373 */
374 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 375 continue;
376
73d1df2a 377 if (d->dev_type == HCI_BREDR &&
d7a5a11d 378 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 379 rp->index[count++] = cpu_to_le16(d->id);
380 BT_DBG("Added hci%u", d->id);
381 }
faba42eb
JH		 382 }
383
476e44cb
JH		 384 rp->num_controllers = cpu_to_le16(count);
385 rp_len = sizeof(*rp) + (2 * count);
386
faba42eb
JH		 387 read_unlock(&hci_dev_list_lock);
388
2a1afb5a
JH		 389 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
390 0, rp, rp_len);
faba42eb 391
a38528f1
JH		 392 kfree(rp);
393
394 return err;
faba42eb
JH		 395}
396
73d1df2a
MH		 397static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
398 void *data, u16 data_len)
399{
400 struct mgmt_rp_read_unconf_index_list *rp;
401 struct hci_dev *d;
402 size_t rp_len;
403 u16 count;
404 int err;
405
406 BT_DBG("sock %p", sk);
407
408 read_lock(&hci_dev_list_lock);
409
410 count = 0;
411 list_for_each_entry(d, &hci_dev_list, list) {
412 if (d->dev_type == HCI_BREDR &&
d7a5a11d 413 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 414 count++;
415 }
416
417 rp_len = sizeof(*rp) + (2 * count);
418 rp = kmalloc(rp_len, GFP_ATOMIC);
419 if (!rp) {
420 read_unlock(&hci_dev_list_lock);
421 return -ENOMEM;
422 }
423
424 count = 0;
425 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 426 if (hci_dev_test_flag(d, HCI_SETUP) ||
427 hci_dev_test_flag(d, HCI_CONFIG) ||
428 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 429 continue;
430
431 /* Devices marked as raw-only are neither configured
432 * nor unconfigured controllers.
433 */
434 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
435 continue;
436
437 if (d->dev_type == HCI_BREDR &&
d7a5a11d 438 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 439 rp->index[count++] = cpu_to_le16(d->id);
440 BT_DBG("Added hci%u", d->id);
441 }
442 }
443
444 rp->num_controllers = cpu_to_le16(count);
445 rp_len = sizeof(*rp) + (2 * count);
446
447 read_unlock(&hci_dev_list_lock);
448
2a1afb5a
JH		 449 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
450 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 451
452 kfree(rp);
453
454 return err;
455}
456
96f1474a
MH		 457static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
458 void *data, u16 data_len)
459{
460 struct mgmt_rp_read_ext_index_list *rp;
461 struct hci_dev *d;
462 size_t rp_len;
463 u16 count;
464 int err;
465
466 BT_DBG("sock %p", sk);
467
468 read_lock(&hci_dev_list_lock);
469
470 count = 0;
471 list_for_each_entry(d, &hci_dev_list, list) {
472 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
473 count++;
474 }
475
476 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
477 rp = kmalloc(rp_len, GFP_ATOMIC);
478 if (!rp) {
479 read_unlock(&hci_dev_list_lock);
480 return -ENOMEM;
481 }
482
483 count = 0;
484 list_for_each_entry(d, &hci_dev_list, list) {
485 if (hci_dev_test_flag(d, HCI_SETUP) ||
486 hci_dev_test_flag(d, HCI_CONFIG) ||
487 hci_dev_test_flag(d, HCI_USER_CHANNEL))
488 continue;
489
490 /* Devices marked as raw-only are neither configured
491 * nor unconfigured controllers.
492 */
493 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
494 continue;
495
496 if (d->dev_type == HCI_BREDR) {
497 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
498 rp->entry[count].type = 0x01;
499 else
500 rp->entry[count].type = 0x00;
501 } else if (d->dev_type == HCI_AMP) {
502 rp->entry[count].type = 0x02;
503 } else {
504 continue;
505 }
506
507 rp->entry[count].bus = d->bus;
508 rp->entry[count++].index = cpu_to_le16(d->id);
509 BT_DBG("Added hci%u", d->id);
510 }
511
512 rp->num_controllers = cpu_to_le16(count);
513 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
514
515 read_unlock(&hci_dev_list_lock);
516
517 /* If this command is called at least once, then all the
518 * default index and unconfigured index events are disabled
519 * and from now on only extended index events are used.
520 */
521 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
522 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
523 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
524
525 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
526 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
527
528 kfree(rp);
529
530 return err;
531}
532
dbece37a
MH		 533static bool is_configured(struct hci_dev *hdev)
534{
535 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 536 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 537 return false;
538
539 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
540 !bacmp(&hdev->public_addr, BDADDR_ANY))
541 return false;
542
543 return true;
544}
545
89bc22d2
MH		 546static __le32 get_missing_options(struct hci_dev *hdev)
547{
548 u32 options = 0;
549
dbece37a 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 552 options |= MGMT_OPTION_EXTERNAL_CONFIG;
553
89bc22d2
MH		 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 options |= MGMT_OPTION_PUBLIC_ADDRESS;
557
558 return cpu_to_le32(options);
559}
560
f4537c04
MH		 561static int new_options(struct hci_dev *hdev, struct sock *skip)
562{
563 __le32 options = get_missing_options(hdev);
564
f6b7712e
MH		 565 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
566 sizeof(options), skip);
f4537c04
MH		 567}
568
dbece37a
MH		 569static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
570{
571 __le32 options = get_missing_options(hdev);
572
2a1afb5a
JH		 573 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
574 sizeof(options));
dbece37a
MH		 575}
576
9fc3bfb6
MH		 577static int read_config_info(struct sock *sk, struct hci_dev *hdev,
578 void *data, u16 data_len)
579{
580 struct mgmt_rp_read_config_info rp;
89bc22d2 581 u32 options = 0;
9fc3bfb6
MH		 582
583 BT_DBG("sock %p %s", sk, hdev->name);
584
585 hci_dev_lock(hdev);
586
587 memset(&rp, 0, sizeof(rp));
588 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 589
eb1904f4
MH		 590 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
591 options |= MGMT_OPTION_EXTERNAL_CONFIG;
592
9fc3bfb6 593 if (hdev->set_bdaddr)
89bc22d2
MH		 594 options |= MGMT_OPTION_PUBLIC_ADDRESS;
595
596 rp.supported_options = cpu_to_le32(options);
597 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 598
599 hci_dev_unlock(hdev);
600
2a1afb5a
JH		 601 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
602 &rp, sizeof(rp));
9fc3bfb6
MH		 603}
604
69ab39ea
JH		 605static u32 get_supported_settings(struct hci_dev *hdev)
606{
607 u32 settings = 0;
608
609 settings |= MGMT_SETTING_POWERED;
b2939475 610 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 611 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 612 settings |= MGMT_SETTING_CONNECTABLE;
613 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 614
ed3fa31f 615 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 616 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
617 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 618 settings |= MGMT_SETTING_BREDR;
619 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 620
621 if (lmp_ssp_capable(hdev)) {
622 settings |= MGMT_SETTING_SSP;
623 settings |= MGMT_SETTING_HS;
624 }
e98d2ce2 625
05b3c3e7 626 if (lmp_sc_capable(hdev))
e98d2ce2 627 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 628 }
d7b7e796 629
eeca6f89 630 if (lmp_le_capable(hdev)) {
9d42820f 631 settings |= MGMT_SETTING_LE;
eeca6f89 632 settings |= MGMT_SETTING_ADVERTISING;
a3209694 633 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 634 settings |= MGMT_SETTING_PRIVACY;
93690c22 635 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 636 }
69ab39ea 637
eb1904f4
MH		 638 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
639 hdev->set_bdaddr)
9fc3bfb6
MH		 640 settings |= MGMT_SETTING_CONFIGURATION;
641
69ab39ea
JH		 642 return settings;
643}
644
645static u32 get_current_settings(struct hci_dev *hdev)
646{
647 u32 settings = 0;
648
f1f0eb02 649 if (hdev_is_powered(hdev))
f0d4b78a
MH		 650 settings |= MGMT_SETTING_POWERED;
651
d7a5a11d 652 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 653 settings |= MGMT_SETTING_CONNECTABLE;
654
d7a5a11d 655 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 656 settings |= MGMT_SETTING_FAST_CONNECTABLE;
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 659 settings |= MGMT_SETTING_DISCOVERABLE;
660
d7a5a11d 661 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 662 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 663
d7a5a11d 664 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 665 settings |= MGMT_SETTING_BREDR;
666
d7a5a11d 667 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 668 settings |= MGMT_SETTING_LE;
669
d7a5a11d 670 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 671 settings |= MGMT_SETTING_LINK_SECURITY;
672
d7a5a11d 673 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 674 settings |= MGMT_SETTING_SSP;
675
d7a5a11d 676 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 677 settings |= MGMT_SETTING_HS;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 680 settings |= MGMT_SETTING_ADVERTISING;
681
d7a5a11d 682 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 683 settings |= MGMT_SETTING_SECURE_CONN;
684
d7a5a11d 685 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 686 settings |= MGMT_SETTING_DEBUG_KEYS;
687
d7a5a11d 688 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 689 settings |= MGMT_SETTING_PRIVACY;
690
93690c22
MH		 691 /* The current setting for static address has two purposes. The
692 * first is to indicate if the static address will be used and
693 * the second is to indicate if it is actually set.
694 *
695 * This means if the static address is not configured, this flag
08dc0e98 696 * will never be set. If the address is configured, then if the
93690c22
MH		 697 * address is actually used decides if the flag is set or not.
698 *
699 * For single mode LE only controllers and dual-mode controllers
700 * with BR/EDR disabled, the existence of the static address will
701 * be evaluated.
702 */
b7cb93e5 703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 704 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 705 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
706 if (bacmp(&hdev->static_addr, BDADDR_ANY))
707 settings |= MGMT_SETTING_STATIC_ADDRESS;
708 }
709
69ab39ea
JH		 710 return settings;
711}
712
ef580372
JH		 713#define PNP_INFO_SVCLASS_ID 0x1200
714
213202ed
JH		 715static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
716{
717 u8 *ptr = data, *uuids_start = NULL;
718 struct bt_uuid *uuid;
719
720 if (len < 4)
721 return ptr;
722
723 list_for_each_entry(uuid, &hdev->uuids, list) {
724 u16 uuid16;
725
726 if (uuid->size != 16)
727 continue;
728
729 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
730 if (uuid16 < 0x1100)
731 continue;
732
733 if (uuid16 == PNP_INFO_SVCLASS_ID)
734 continue;
735
736 if (!uuids_start) {
737 uuids_start = ptr;
738 uuids_start[0] = 1;
739 uuids_start[1] = EIR_UUID16_ALL;
740 ptr += 2;
741 }
742
743 /* Stop if not enough space to put next UUID */
744 if ((ptr - data) + sizeof(u16) > len) {
745 uuids_start[1] = EIR_UUID16_SOME;
746 break;
747 }
748
749 *ptr++ = (uuid16 & 0x00ff);
750 *ptr++ = (uuid16 & 0xff00) >> 8;
751 uuids_start[0] += sizeof(uuid16);
752 }
753
754 return ptr;
755}
756
cdf1963f
JH		 757static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
758{
759 u8 *ptr = data, *uuids_start = NULL;
760 struct bt_uuid *uuid;
761
762 if (len < 6)
763 return ptr;
764
765 list_for_each_entry(uuid, &hdev->uuids, list) {
766 if (uuid->size != 32)
767 continue;
768
769 if (!uuids_start) {
770 uuids_start = ptr;
771 uuids_start[0] = 1;
772 uuids_start[1] = EIR_UUID32_ALL;
773 ptr += 2;
774 }
775
776 /* Stop if not enough space to put next UUID */
777 if ((ptr - data) + sizeof(u32) > len) {
778 uuids_start[1] = EIR_UUID32_SOME;
779 break;
780 }
781
782 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
783 ptr += sizeof(u32);
784 uuids_start[0] += sizeof(u32);
785 }
786
787 return ptr;
788}
789
c00d575b
JH		 790static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
791{
792 u8 *ptr = data, *uuids_start = NULL;
793 struct bt_uuid *uuid;
794
795 if (len < 18)
796 return ptr;
797
798 list_for_each_entry(uuid, &hdev->uuids, list) {
799 if (uuid->size != 128)
800 continue;
801
802 if (!uuids_start) {
803 uuids_start = ptr;
804 uuids_start[0] = 1;
805 uuids_start[1] = EIR_UUID128_ALL;
806 ptr += 2;
807 }
808
809 /* Stop if not enough space to put next UUID */
810 if ((ptr - data) + 16 > len) {
811 uuids_start[1] = EIR_UUID128_SOME;
812 break;
813 }
814
815 memcpy(ptr, uuid->uuid, 16);
816 ptr += 16;
817 uuids_start[0] += 16;
818 }
819
820 return ptr;
821}
822
333ae95d
JH		 823static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
824{
825 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
826}
827
333ae95d
JH		 828static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
829 struct hci_dev *hdev,
830 const void *data)
831{
832 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
833}
834
4117ed70 835static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
f14d8f64 836{
7a5f4990
MH		 837 u8 ad_len = 0;
838 size_t name_len;
839
840 name_len = strlen(hdev->dev_name);
841 if (name_len > 0) {
842 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
843
844 if (name_len > max_len) {
845 name_len = max_len;
846 ptr[1] = EIR_NAME_SHORT;
847 } else
848 ptr[1] = EIR_NAME_COMPLETE;
849
850 ptr[0] = name_len + 1;
851
852 memcpy(ptr + 2, hdev->dev_name, name_len);
853
854 ad_len += (name_len + 2);
855 ptr += (name_len + 2);
856 }
857
858 return ad_len;
f14d8f64
MH		 859}
860
4117ed70
AU		 861static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
862{
863 /* TODO: Set the appropriate entries based on advertising instance flags
864 * here once flags other than 0 are supported.
865 */
866 memcpy(ptr, hdev->adv_instance.scan_rsp_data,
867 hdev->adv_instance.scan_rsp_len);
868
869 return hdev->adv_instance.scan_rsp_len;
870}
871
872static void update_scan_rsp_data_for_instance(struct hci_request *req,
873 u8 instance)
f14d8f64
MH		 874{
875 struct hci_dev *hdev = req->hdev;
876 struct hci_cp_le_set_scan_rsp_data cp;
877 u8 len;
878
d7a5a11d 879 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 880 return;
881
882 memset(&cp, 0, sizeof(cp));
883
4117ed70
AU		 884 if (instance)
885 len = create_instance_scan_rsp_data(hdev, cp.data);
886 else
887 len = create_default_scan_rsp_data(hdev, cp.data);
f14d8f64 888
eb438b5f 889 if (hdev->scan_rsp_data_len == len &&
4117ed70 890 !memcmp(cp.data, hdev->scan_rsp_data, len))
f14d8f64
MH		 891 return;
892
eb438b5f
JH		 893 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
894 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 895
896 cp.length = len;
897
898 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
899}
900
4117ed70
AU		 901static void update_scan_rsp_data(struct hci_request *req)
902{
903 struct hci_dev *hdev = req->hdev;
904 u8 instance;
905
906 /* The "Set Advertising" setting supersedes the "Add Advertising"
907 * setting. Here we set the scan response data based on which
908 * setting was set. When neither apply, default to the global settings,
909 * represented by instance "0".
910 */
911 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
912 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
913 instance = 0x01;
914 else
915 instance = 0x00;
916
917 update_scan_rsp_data_for_instance(req, instance);
918}
919
9a43e25f
JH		 920static u8 get_adv_discov_flags(struct hci_dev *hdev)
921{
3b0602cd 922 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 923
924 /* If there's a pending mgmt command the flags will not yet have
925 * their final values, so check for this first.
926 */
333ae95d 927 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 928 if (cmd) {
929 struct mgmt_mode *cp = cmd->param;
930 if (cp->val == 0x01)
931 return LE_AD_GENERAL;
932 else if (cp->val == 0x02)
933 return LE_AD_LIMITED;
934 } else {
d7a5a11d 935 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 936 return LE_AD_LIMITED;
d7a5a11d 937 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 938 return LE_AD_GENERAL;
939 }
940
941 return 0;
942}
943
fdf51784 944static u8 get_current_adv_instance(struct hci_dev *hdev)
441ad2d0 945{
fdf51784
AU		 946 /* The "Set Advertising" setting supersedes the "Add Advertising"
947 * setting. Here we set the advertising data based on which
948 * setting was set. When neither apply, default to the global settings,
949 * represented by instance "0".
950 */
951 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
952 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
953 return 0x01;
441ad2d0 954
fdf51784
AU		 955 return 0x00;
956}
441ad2d0 957
fdf51784
AU		 958static bool get_connectable(struct hci_dev *hdev)
959{
960 struct mgmt_pending_cmd *cmd;
441ad2d0 961
fdf51784
AU		 962 /* If there's a pending mgmt command the flag will not yet have
963 * it's final value, so check for this first.
964 */
965 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
966 if (cmd) {
967 struct mgmt_mode *cp = cmd->param;
441ad2d0 968
fdf51784 969 return cp->val;
441ad2d0
MH		 970 }
971
fdf51784
AU		 972 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
973}
441ad2d0 974
fdf51784
AU		 975static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
976{
977 u32 flags;
441ad2d0 978
fdf51784
AU		 979 if (instance > 0x01)
980 return 0;
981
982 if (instance == 0x01)
983 return hdev->adv_instance.flags;
984
985 /* Instance 0 always manages the "Tx Power" and "Flags" fields */
986 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
987
faccb950
AU		 988 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting corresponds
989 * to the "connectable" instance flag.
990 */
991 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
fdf51784
AU		 992 flags |= MGMT_ADV_FLAG_CONNECTABLE;
993
994 return flags;
441ad2d0
MH		 995}
996
c7d4883b
AU		 997static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance)
998{
999 /* Ignore instance 0 and other unsupported instances */
1000 if (instance != 0x01)
1001 return 0;
1002
1003 /* TODO: Take into account the "appearance" and "local-name" flags here.
1004 * These are currently being ignored as they are not supported.
1005 */
1006 return hdev->adv_instance.scan_rsp_len;
1007}
1008
fdf51784 1009static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
24b4f38f 1010{
b44133ff 1011 u8 ad_len = 0, flags = 0;
fdf51784 1012 u32 instance_flags = get_adv_instance_flags(hdev, instance);
b44133ff 1013
807ec772
AU		 1014 /* The Add Advertising command allows userspace to set both the general
1015 * and limited discoverable flags.
1016 */
fdf51784 1017 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
b44133ff
AU		 1018 flags |= LE_AD_GENERAL;
1019
fdf51784 1020 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
807ec772
AU		 1021 flags |= LE_AD_LIMITED;
1022
fdf51784 1023 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
67e0c0cd
AU		 1024 /* If a discovery flag wasn't provided, simply use the global
1025 * settings.
1026 */
1027 if (!flags)
1028 flags |= get_adv_discov_flags(hdev);
1029
b44133ff
AU		 1030 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1031 flags |= LE_AD_NO_BREDR;
1032
fdf51784
AU		 1033 /* If flags would still be empty, then there is no need to
1034 * include the "Flags" AD field".
1035 */
1036 if (flags) {
1037 ptr[0] = 0x02;
1038 ptr[1] = EIR_FLAGS;
1039 ptr[2] = flags;
b44133ff 1040
fdf51784
AU		 1041 ad_len += 3;
1042 ptr += 3;
1043 }
b44133ff
AU		 1044 }
1045
fdf51784 1046 /* Provide Tx Power only if we can provide a valid value for it */
5507e358 1047 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
fdf51784 1048 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
5507e358
AU		 1049 ptr[0] = 0x02;
1050 ptr[1] = EIR_TX_POWER;
1051 ptr[2] = (u8)hdev->adv_tx_power;
1052
1053 ad_len += 3;
1054 ptr += 3;
1055 }
1056
fdf51784
AU		 1057 if (instance) {
1058 memcpy(ptr, hdev->adv_instance.adv_data,
1059 hdev->adv_instance.adv_data_len);
1060 ad_len += hdev->adv_instance.adv_data_len;
1061 }
24b4f38f 1062
b44133ff 1063 return ad_len;
24b4f38f
AU		 1064}
1065
1066static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
441ad2d0
MH		 1067{
1068 struct hci_dev *hdev = req->hdev;
1069 struct hci_cp_le_set_adv_data cp;
1070 u8 len;
1071
d7a5a11d 1072 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 1073 return;
1074
1075 memset(&cp, 0, sizeof(cp));
1076
fdf51784 1077 len = create_instance_adv_data(hdev, instance, cp.data);
441ad2d0 1078
24b4f38f 1079 /* There's nothing to do if the data hasn't changed */
441ad2d0
MH		 1080 if (hdev->adv_data_len == len &&
1081 memcmp(cp.data, hdev->adv_data, len) == 0)
1082 return;
1083
1084 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1085 hdev->adv_data_len = len;
1086
1087 cp.length = len;
1088
1089 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1090}
1091
e7a685d3
AU		 1092static void update_adv_data(struct hci_request *req)
1093{
1094 struct hci_dev *hdev = req->hdev;
1095 u8 instance = get_current_adv_instance(hdev);
24b4f38f
AU		 1096
1097 update_adv_data_for_instance(req, instance);
1098}
1099
bc6d2d04
JH		 1100int mgmt_update_adv_data(struct hci_dev *hdev)
1101{
1102 struct hci_request req;
1103
1104 hci_req_init(&req, hdev);
1105 update_adv_data(&req);
1106
1107 return hci_req_run(&req, NULL);
1108}
1109
ef580372
JH		 1110static void create_eir(struct hci_dev *hdev, u8 *data)
1111{
1112 u8 *ptr = data;
ef580372
JH		 1113 size_t name_len;
1114
1115 name_len = strlen(hdev->dev_name);
1116
1117 if (name_len > 0) {
1118 /* EIR Data type */
1119 if (name_len > 48) {
1120 name_len = 48;
1121 ptr[1] = EIR_NAME_SHORT;
1122 } else
1123 ptr[1] = EIR_NAME_COMPLETE;
1124
1125 /* EIR Data length */
1126 ptr[0] = name_len + 1;
1127
1128 memcpy(ptr + 2, hdev->dev_name, name_len);
1129
ef580372
JH		 1130 ptr += (name_len + 2);
1131 }
1132
bbaf444a 1133 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 1134 ptr[0] = 2;
1135 ptr[1] = EIR_TX_POWER;
1136 ptr[2] = (u8) hdev->inq_tx_power;
1137
91c4e9b1
MH		 1138 ptr += 3;
1139 }
1140
2b9be137
MH		 1141 if (hdev->devid_source > 0) {
1142 ptr[0] = 9;
1143 ptr[1] = EIR_DEVICE_ID;
1144
1145 put_unaligned_le16(hdev->devid_source, ptr + 2);
1146 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1147 put_unaligned_le16(hdev->devid_product, ptr + 6);
1148 put_unaligned_le16(hdev->devid_version, ptr + 8);
1149
2b9be137
MH		 1150 ptr += 10;
1151 }
1152
213202ed 1153 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 1154 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 1155 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 1156}
1157
890ea898 1158static void update_eir(struct hci_request *req)
ef580372 1159{
890ea898 1160 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1161 struct hci_cp_write_eir cp;
1162
504c8dcd 1163 if (!hdev_is_powered(hdev))
890ea898 1164 return;
7770c4aa 1165
976eb20e 1166 if (!lmp_ext_inq_capable(hdev))
890ea898 1167 return;
ef580372 1168
d7a5a11d 1169 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 1170 return;
ef580372 1171
d7a5a11d 1172 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1173 return;
ef580372
JH		 1174
1175 memset(&cp, 0, sizeof(cp));
1176
1177 create_eir(hdev, cp.data);
1178
1179 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1180 return;
ef580372
JH		 1181
1182 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1183
890ea898 1184 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1185}
1186
1187static u8 get_service_classes(struct hci_dev *hdev)
1188{
1189 struct bt_uuid *uuid;
1190 u8 val = 0;
1191
1192 list_for_each_entry(uuid, &hdev->uuids, list)
1193 val |= uuid->svc_hint;
1194
1195 return val;
1196}
1197
890ea898 1198static void update_class(struct hci_request *req)
ef580372 1199{
890ea898 1200 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1201 u8 cod[3];
1202
1203 BT_DBG("%s", hdev->name);
1204
504c8dcd 1205 if (!hdev_is_powered(hdev))
890ea898 1206 return;
7770c4aa 1207
d7a5a11d 1208 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1209 return;
1210
d7a5a11d 1211 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1212 return;
ef580372
JH		 1213
1214 cod[0] = hdev->minor_class;
1215 cod[1] = hdev->major_class;
1216 cod[2] = get_service_classes(hdev);
1217
d7a5a11d 1218 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1219 cod[1] |= 0x20;
1220
ef580372 1221 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1222 return;
ef580372 1223
890ea898 1224 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1225}
1226
0ec5ae84
JH		 1227static void disable_advertising(struct hci_request *req)
1228{
1229 u8 enable = 0x00;
1230
1231 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1232}
1233
199a2fb1
JH		 1234static void enable_advertising(struct hci_request *req)
1235{
1236 struct hci_dev *hdev = req->hdev;
1237 struct hci_cp_le_set_adv_param cp;
8f2a0601 1238 u8 own_addr_type, enable = 0x01;
a4858cb9 1239 bool connectable;
e7a685d3
AU		 1240 u8 instance;
1241 u32 flags;
199a2fb1 1242
0ec5ae84
JH		 1243 if (hci_conn_num(hdev, LE_LINK) > 0)
1244 return;
1245
d7a5a11d 1246 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1247 disable_advertising(req);
1248
5ce194c4 1249 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1250 * hci_update_random_address knows that it's safe to go ahead
1251 * and write a new random address. The flag will be set back on
1252 * as soon as the SET_ADV_ENABLE HCI command completes.
1253 */
a358dc11 1254 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1255
e7a685d3
AU		 1256 instance = get_current_adv_instance(hdev);
1257 flags = get_adv_instance_flags(hdev, instance);
faccb950
AU		 1258
1259 /* If the "connectable" instance flag was not set, then choose between
1260 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1261 */
1262 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1263 get_connectable(hdev);
8f2a0601 1264
a4858cb9
JH		 1265 /* Set require_privacy to true only when non-connectable
1266 * advertising is used. In that case it is fine to use a
1267 * non-resolvable private address.
1268 */
1269 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1270 return;
1271
41c90c18 1272 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1273 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1274 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
c7d4883b
AU		 1275
1276 if (connectable)
1277 cp.type = LE_ADV_IND;
1278 else if (get_adv_instance_scan_rsp_len(hdev, instance))
1279 cp.type = LE_ADV_SCAN_IND;
1280 else
1281 cp.type = LE_ADV_NONCONN_IND;
1282
8f2a0601 1283 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1284 cp.channel_map = hdev->le_adv_channel_map;
1285
1286 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1287
1288 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1289}
1290
7d78525d
JH		 1291static void service_cache_off(struct work_struct *work)
1292{
1293 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1294 service_cache.work);
890ea898 1295 struct hci_request req;
7d78525d 1296
a69d8927 1297 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1298 return;
1299
890ea898
JH		 1300 hci_req_init(&req, hdev);
1301
7d78525d
JH		 1302 hci_dev_lock(hdev);
1303
890ea898
JH		 1304 update_eir(&req);
1305 update_class(&req);
7d78525d
JH		 1306
1307 hci_dev_unlock(hdev);
890ea898
JH		 1308
1309 hci_req_run(&req, NULL);
7d78525d
JH		 1310}
1311
d6bfd59c
JH		 1312static void rpa_expired(struct work_struct *work)
1313{
1314 struct hci_dev *hdev = container_of(work, struct hci_dev,
1315 rpa_expired.work);
1316 struct hci_request req;
1317
1318 BT_DBG("");
1319
a1536da2 1320 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1321
d7a5a11d 1322 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1323 return;
1324
1325 /* The generation of a new RPA and programming it into the
1326 * controller happens in the enable_advertising() function.
1327 */
d6bfd59c 1328 hci_req_init(&req, hdev);
d6bfd59c 1329 enable_advertising(&req);
d6bfd59c
JH		 1330 hci_req_run(&req, NULL);
1331}
1332
6a919082 1333static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1334{
238be788 1335 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1336 return;
1337
4f87da80 1338 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1339 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1340
4f87da80
JH		 1341 /* Non-mgmt controlled devices get this bit set
1342 * implicitly so that pairing works for them, however
1343 * for mgmt we require user-space to explicitly enable
1344 * it
1345 */
a358dc11 1346 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1347}
1348
0f4e68cf 1349static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1350 void *data, u16 data_len)
0381101f 1351{
a38528f1 1352 struct mgmt_rp_read_info rp;
f7b64e69 1353
bdb6d971 1354 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1355
09fd0de5 1356 hci_dev_lock(hdev);
f7b64e69 1357
dc4fe30b
JH		 1358 memset(&rp, 0, sizeof(rp));
1359
69ab39ea 1360 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1361
69ab39ea 1362 rp.version = hdev->hci_ver;
eb55ef07 1363 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1364
1365 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1366 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1367
a38528f1 1368 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1369
dc4fe30b 1370 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1371 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1372
09fd0de5 1373 hci_dev_unlock(hdev);
0381101f 1374
2a1afb5a
JH		 1375 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1376 sizeof(rp));
0381101f
JH		 1377}
1378
69ab39ea 1379static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1380{
69ab39ea 1381 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1382
2a1afb5a
JH		 1383 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1384 sizeof(settings));
8680570b
JH		 1385}
1386
1904a853 1387static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1388{
1389 BT_DBG("%s status 0x%02x", hdev->name, status);
1390
a3172b7e
JH		 1391 if (hci_conn_count(hdev) == 0) {
1392 cancel_delayed_work(&hdev->power_off);
8b064a3a 1393 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1394 }
8b064a3a
JH		 1395}
1396
23a48093 1397static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1398{
1399 struct hci_dev *hdev = req->hdev;
1400 struct hci_cp_remote_name_req_cancel cp;
1401 struct inquiry_entry *e;
1402
1403 switch (hdev->discovery.state) {
1404 case DISCOVERY_FINDING:
07d2334a 1405 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1406 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1407
1408 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1409 cancel_delayed_work(&hdev->le_scan_disable);
1410 hci_req_add_le_scan_disable(req);
1411 }
1412
23a48093 1413 return true;
21a60d30
JH		 1414
1415 case DISCOVERY_RESOLVING:
1416 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1417 NAME_PENDING);
1418 if (!e)
23a48093 1419 break;
21a60d30
JH		 1420
1421 bacpy(&cp.bdaddr, &e->data.bdaddr);
1422 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1423 &cp);
1424
23a48093 1425 return true;
21a60d30
JH		 1426
1427 default:
1428 /* Passive scanning */
d7a5a11d 1429 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1430 hci_req_add_le_scan_disable(req);
23a48093
JH		 1431 return true;
1432 }
1433
21a60d30
JH		 1434 break;
1435 }
23a48093
JH		 1436
1437 return false;
21a60d30
JH		 1438}
1439
912098a6
AU		 1440static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1441 u8 instance)
1442{
1443 struct mgmt_ev_advertising_added ev;
1444
1445 ev.instance = instance;
1446
1447 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1448}
1449
1450static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1451 u8 instance)
1452{
1453 struct mgmt_ev_advertising_removed ev;
1454
1455 ev.instance = instance;
1456
1457 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1458}
1459
1460static void clear_adv_instance(struct hci_dev *hdev)
1461{
1462 struct hci_request req;
1463
1464 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1465 return;
1466
1467 if (hdev->adv_instance.timeout)
1468 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
1469
1470 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1471 advertising_removed(NULL, hdev, 1);
1472 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1473
1474 if (!hdev_is_powered(hdev) ||
1475 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1476 return;
1477
1478 hci_req_init(&req, hdev);
1479 disable_advertising(&req);
1480 hci_req_run(&req, NULL);
1481}
1482
8b064a3a
JH		 1483static int clean_up_hci_state(struct hci_dev *hdev)
1484{
1485 struct hci_request req;
1486 struct hci_conn *conn;
23a48093
JH		 1487 bool discov_stopped;
1488 int err;
8b064a3a
JH		 1489
1490 hci_req_init(&req, hdev);
1491
1492 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1493 test_bit(HCI_PSCAN, &hdev->flags)) {
1494 u8 scan = 0x00;
1495 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1496 }
1497
912098a6
AU		 1498 if (hdev->adv_instance.timeout)
1499 clear_adv_instance(hdev);
1500
d7a5a11d 1501 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1502 disable_advertising(&req);
1503
23a48093 1504 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1505
1506 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1507 struct hci_cp_disconnect dc;
c9910d0f
JH		 1508 struct hci_cp_reject_conn_req rej;
1509
1510 switch (conn->state) {
1511 case BT_CONNECTED:
1512 case BT_CONFIG:
1513 dc.handle = cpu_to_le16(conn->handle);
1514 dc.reason = 0x15; /* Terminated due to Power Off */
1515 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1516 break;
1517 case BT_CONNECT:
1518 if (conn->type == LE_LINK)
1519 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1520 0, NULL);
1521 else if (conn->type == ACL_LINK)
1522 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1523 6, &conn->dst);
1524 break;
1525 case BT_CONNECT2:
1526 bacpy(&rej.bdaddr, &conn->dst);
1527 rej.reason = 0x15; /* Terminated due to Power Off */
1528 if (conn->type == ACL_LINK)
1529 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1530 sizeof(rej), &rej);
1531 else if (conn->type == SCO_LINK)
1532 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1533 sizeof(rej), &rej);
1534 break;
1535 }
8b064a3a
JH		 1536 }
1537
23a48093
JH		 1538 err = hci_req_run(&req, clean_up_hci_complete);
1539 if (!err && discov_stopped)
1540 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1541
1542 return err;
8b064a3a
JH		 1543}
1544
bdb6d971 1545static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1546 u16 len)
eec8d2bc 1547{
650f726d 1548 struct mgmt_mode *cp = data;
3b0602cd 1549 struct mgmt_pending_cmd *cmd;
4b34ee78 1550 int err;
eec8d2bc 1551
bdb6d971 1552 BT_DBG("request for %s", hdev->name);
eec8d2bc 1553
a7e80f25 1554 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1556 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1557
09fd0de5 1558 hci_dev_lock(hdev);
eec8d2bc 1559
333ae95d 1560 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1561 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1562 MGMT_STATUS_BUSY);
87b95ba6
JH		 1563 goto failed;
1564 }
1565
a69d8927 1566 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1567 cancel_delayed_work(&hdev->power_off);
1568
1569 if (cp->val) {
a1d70450
JH		 1570 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1571 data, len);
1572 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1573 goto failed;
1574 }
1575 }
1576
4b34ee78 1577 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1578 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1579 goto failed;
1580 }
1581
2e58ef3e 1582 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1583 if (!cmd) {
1584 err = -ENOMEM;
eec8d2bc 1585 goto failed;
366a0336 1586 }
eec8d2bc 1587
8b064a3a 1588 if (cp->val) {
19202573 1589 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1590 err = 0;
1591 } else {
1592 /* Disconnect connections, stop scans, etc */
1593 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1594 if (!err)
1595 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1596 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1597
8b064a3a
JH		 1598 /* ENODATA means there were no HCI commands queued */
1599 if (err == -ENODATA) {
a3172b7e 1600 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1601 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1602 err = 0;
1603 }
1604 }
eec8d2bc
JH		 1605
1606failed:
09fd0de5 1607 hci_dev_unlock(hdev);
366a0336 1608 return err;
eec8d2bc
JH		 1609}
1610
beadb2bd
JH		 1611static int new_settings(struct hci_dev *hdev, struct sock *skip)
1612{
f6b7712e 1613 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1614
f6b7712e
MH		 1615 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1616 sizeof(ev), skip);
beadb2bd
JH		 1617}
1618
91a668b0
JH		 1619int mgmt_new_settings(struct hci_dev *hdev)
1620{
1621 return new_settings(hdev, NULL);
1622}
1623
bd99abdd
JH		 1624struct cmd_lookup {
1625 struct sock *sk;
1626 struct hci_dev *hdev;
1627 u8 mgmt_status;
1628};
1629
3b0602cd 1630static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1631{
1632 struct cmd_lookup *match = data;
1633
1634 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1635
1636 list_del(&cmd->list);
1637
1638 if (match->sk == NULL) {
1639 match->sk = cmd->sk;
1640 sock_hold(match->sk);
1641 }
1642
1643 mgmt_pending_free(cmd);
1644}
1645
3b0602cd 1646static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1647{
1648 u8 *status = data;
1649
a69e8375 1650 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1651 mgmt_pending_remove(cmd);
1652}
1653
3b0602cd 1654static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1655{
1656 if (cmd->cmd_complete) {
1657 u8 *status = data;
1658
1659 cmd->cmd_complete(cmd, *status);
1660 mgmt_pending_remove(cmd);
1661
1662 return;
1663 }
1664
1665 cmd_status_rsp(cmd, data);
1666}
1667
3b0602cd 1668static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1669{
2a1afb5a
JH		 1670 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1671 cmd->param, cmd->param_len);
f5818c22
JH		 1672}
1673
3b0602cd 1674static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1675{
2a1afb5a
JH		 1676 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1677 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1678}
1679
e6fe7986
JH		 1680static u8 mgmt_bredr_support(struct hci_dev *hdev)
1681{
1682 if (!lmp_bredr_capable(hdev))
1683 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1684 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1685 return MGMT_STATUS_REJECTED;
1686 else
1687 return MGMT_STATUS_SUCCESS;
1688}
1689
1690static u8 mgmt_le_support(struct hci_dev *hdev)
1691{
1692 if (!lmp_le_capable(hdev))
1693 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1694 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1695 return MGMT_STATUS_REJECTED;
1696 else
1697 return MGMT_STATUS_SUCCESS;
1698}
1699
1904a853
MH		 1700static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1701 u16 opcode)
bfaf8c9f 1702{
3b0602cd 1703 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1704 struct mgmt_mode *cp;
970ba524 1705 struct hci_request req;
bfaf8c9f
JH		 1706 bool changed;
1707
1708 BT_DBG("status 0x%02x", status);
1709
1710 hci_dev_lock(hdev);
1711
333ae95d 1712 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1713 if (!cmd)
1714 goto unlock;
1715
1716 if (status) {
1717 u8 mgmt_err = mgmt_status(status);
a69e8375 1718 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1719 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1720 goto remove_cmd;
1721 }
1722
1723 cp = cmd->param;
d4462a07 1724 if (cp->val) {
238be788 1725 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1726
1727 if (hdev->discov_timeout > 0) {
1728 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1729 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1730 to);
1731 }
1732 } else {
a69d8927 1733 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1734 }
bfaf8c9f
JH		 1735
1736 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1737
1738 if (changed)
1739 new_settings(hdev, cmd->sk);
1740
970ba524
MH		 1741 /* When the discoverable mode gets changed, make sure
1742 * that class of device has the limited discoverable
432df05e
JH		 1743 * bit correctly set. Also update page scan based on whitelist
1744 * entries.
970ba524
MH		 1745 */
1746 hci_req_init(&req, hdev);
1d2dc5b7 1747 __hci_update_page_scan(&req);
970ba524
MH		 1748 update_class(&req);
1749 hci_req_run(&req, NULL);
1750
bfaf8c9f
JH		 1751remove_cmd:
1752 mgmt_pending_remove(cmd);
1753
1754unlock:
1755 hci_dev_unlock(hdev);
1756}
1757
bdb6d971 1758static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1759 u16 len)
73f22f62 1760{
650f726d 1761 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1762 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1763 struct hci_request req;
5e5282bb 1764 u16 timeout;
9a43e25f 1765 u8 scan;
73f22f62
JH		 1766 int err;
1767
bdb6d971 1768 BT_DBG("request for %s", hdev->name);
73f22f62 1769
d7a5a11d
MH		 1770 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1771 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1772 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1773 MGMT_STATUS_REJECTED);
33c525c0 1774
310a3d48 1775 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1776 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1777 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1778
1f350c87 1779 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1780
1781 /* Disabling discoverable requires that no timeout is set,
1782 * and enabling limited discoverable requires a timeout.
1783 */
1784 if ((cp->val == 0x00 && timeout > 0) ||
1785 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1786 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1787 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1788
09fd0de5 1789 hci_dev_lock(hdev);
73f22f62 1790
5e5282bb 1791 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1792 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1793 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1794 goto failed;
1795 }
1796
333ae95d
JH		 1797 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1798 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1800 MGMT_STATUS_BUSY);
73f22f62
JH		 1801 goto failed;
1802 }
1803
d7a5a11d 1804 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1805 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1806 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1807 goto failed;
1808 }
1809
1810 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1811 bool changed = false;
1812
310a3d48
MH		 1813 /* Setting limited discoverable when powered off is
1814 * not a valid operation since it requires a timeout
1815 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1816 */
d7a5a11d 1817 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1818 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1819 changed = true;
1820 }
1821
5e5282bb 1822 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1823 if (err < 0)
1824 goto failed;
1825
1826 if (changed)
1827 err = new_settings(hdev, sk);
1828
5e5282bb
JH		 1829 goto failed;
1830 }
1831
310a3d48
MH		 1832 /* If the current mode is the same, then just update the timeout
1833 * value with the new value. And if only the timeout gets updated,
1834 * then no need for any HCI transactions.
1835 */
d7a5a11d
MH		 1836 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1837 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1838 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1839 cancel_delayed_work(&hdev->discov_off);
1840 hdev->discov_timeout = timeout;
955638ec 1841
36261547
MH		 1842 if (cp->val && hdev->discov_timeout > 0) {
1843 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1844 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1845 to);
955638ec
MH		 1846 }
1847
69ab39ea 1848 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1849 goto failed;
1850 }
1851
2e58ef3e 1852 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1853 if (!cmd) {
1854 err = -ENOMEM;
73f22f62 1855 goto failed;
366a0336 1856 }
73f22f62 1857
310a3d48
MH		 1858 /* Cancel any potential discoverable timeout that might be
1859 * still active and store new timeout value. The arming of
1860 * the timeout happens in the complete handler.
1861 */
1862 cancel_delayed_work(&hdev->discov_off);
1863 hdev->discov_timeout = timeout;
1864
b456f87c
JH		 1865 /* Limited discoverable mode */
1866 if (cp->val == 0x02)
a1536da2 1867 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1868 else
a358dc11 1869 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1870
bfaf8c9f
JH		 1871 hci_req_init(&req, hdev);
1872
9a43e25f
JH		 1873 /* The procedure for LE-only controllers is much simpler - just
1874 * update the advertising data.
1875 */
d7a5a11d 1876 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 1877 goto update_ad;
1878
73f22f62
JH		 1879 scan = SCAN_PAGE;
1880
310a3d48
MH		 1881 if (cp->val) {
1882 struct hci_cp_write_current_iac_lap hci_cp;
1883
1884 if (cp->val == 0x02) {
1885 /* Limited discoverable mode */
33337dcb 1886 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1887 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1888 hci_cp.iac_lap[1] = 0x8b;
1889 hci_cp.iac_lap[2] = 0x9e;
1890 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1891 hci_cp.iac_lap[4] = 0x8b;
1892 hci_cp.iac_lap[5] = 0x9e;
1893 } else {
1894 /* General discoverable mode */
310a3d48
MH		 1895 hci_cp.num_iac = 1;
1896 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1897 hci_cp.iac_lap[1] = 0x8b;
1898 hci_cp.iac_lap[2] = 0x9e;
1899 }
1900
1901 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1902 (hci_cp.num_iac * 3) + 1, &hci_cp);
1903
73f22f62 1904 scan |= SCAN_INQUIRY;
310a3d48 1905 } else {
a358dc11 1906 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 1907 }
73f22f62 1908
310a3d48 1909 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1910
9a43e25f
JH		 1911update_ad:
1912 update_adv_data(&req);
1913
bfaf8c9f 1914 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1915 if (err < 0)
a664b5bc 1916 mgmt_pending_remove(cmd);
73f22f62
JH		 1917
1918failed:
09fd0de5 1919 hci_dev_unlock(hdev);
73f22f62
JH		 1920 return err;
1921}
1922
406d7804
JH		 1923static void write_fast_connectable(struct hci_request *req, bool enable)
1924{
bd98b996 1925 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1926 struct hci_cp_write_page_scan_activity acp;
1927 u8 type;
1928
d7a5a11d 1929 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 1930 return;
1931
4c01f8b8
JH		 1932 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1933 return;
1934
406d7804
JH		 1935 if (enable) {
1936 type = PAGE_SCAN_TYPE_INTERLACED;
1937
1938 /* 160 msec page scan interval */
dcf4adbf 1939 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 1940 } else {
1941 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1942
1943 /* default 1.28 sec page scan */
dcf4adbf 1944 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 1945 }
1946
dcf4adbf 1947 acp.window = cpu_to_le16(0x0012);
406d7804 1948
bd98b996
JH		 1949 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1950 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1951 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1952 sizeof(acp), &acp);
1953
1954 if (hdev->page_scan_type != type)
1955 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1956}
1957
1904a853
MH		 1958static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1959 u16 opcode)
2b76f453 1960{
3b0602cd 1961 struct mgmt_pending_cmd *cmd;
d7b856f9 1962 struct mgmt_mode *cp;
bc6d2d04 1963 bool conn_changed, discov_changed;
2b76f453
JH		 1964
1965 BT_DBG("status 0x%02x", status);
1966
1967 hci_dev_lock(hdev);
1968
333ae95d 1969 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 1970 if (!cmd)
1971 goto unlock;
1972
37438c1f
JH		 1973 if (status) {
1974 u8 mgmt_err = mgmt_status(status);
a69e8375 1975 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 1976 goto remove_cmd;
1977 }
1978
d7b856f9 1979 cp = cmd->param;
bc6d2d04 1980 if (cp->val) {
238be788
MH		 1981 conn_changed = !hci_dev_test_and_set_flag(hdev,
1982 HCI_CONNECTABLE);
bc6d2d04
JH		 1983 discov_changed = false;
1984 } else {
a69d8927
MH		 1985 conn_changed = hci_dev_test_and_clear_flag(hdev,
1986 HCI_CONNECTABLE);
1987 discov_changed = hci_dev_test_and_clear_flag(hdev,
1988 HCI_DISCOVERABLE);
bc6d2d04 1989 }
d7b856f9 1990
2b76f453
JH		 1991 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1992
bc6d2d04 1993 if (conn_changed || discov_changed) {
d7b856f9 1994 new_settings(hdev, cmd->sk);
1d2dc5b7 1995 hci_update_page_scan(hdev);
bc6d2d04
JH		 1996 if (discov_changed)
1997 mgmt_update_adv_data(hdev);
2b7be33e
JH		 1998 hci_update_background_scan(hdev);
1999 }
d7b856f9 2000
37438c1f 2001remove_cmd:
2b76f453
JH		 2002 mgmt_pending_remove(cmd);
2003
2004unlock:
2005 hci_dev_unlock(hdev);
2006}
2007
e8ba3a1f
JH		 2008static int set_connectable_update_settings(struct hci_dev *hdev,
2009 struct sock *sk, u8 val)
2010{
2011 bool changed = false;
2012 int err;
2013
d7a5a11d 2014 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 2015 changed = true;
2016
2017 if (val) {
a1536da2 2018 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 2019 } else {
a358dc11
MH		 2020 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2021 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 2022 }
2023
2024 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2025 if (err < 0)
2026 return err;
2027
562064e6 2028 if (changed) {
1d2dc5b7 2029 hci_update_page_scan(hdev);
562064e6 2030 hci_update_background_scan(hdev);
e8ba3a1f 2031 return new_settings(hdev, sk);
562064e6 2032 }
e8ba3a1f
JH		 2033
2034 return 0;
2035}
2036
bdb6d971 2037static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2038 u16 len)
9fbcbb45 2039{
650f726d 2040 struct mgmt_mode *cp = data;
3b0602cd 2041 struct mgmt_pending_cmd *cmd;
2b76f453 2042 struct hci_request req;
1987fdc7 2043 u8 scan;
9fbcbb45
JH		 2044 int err;
2045
bdb6d971 2046 BT_DBG("request for %s", hdev->name);
9fbcbb45 2047
d7a5a11d
MH		 2048 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2049 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2050 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2051 MGMT_STATUS_REJECTED);
33c525c0 2052
a7e80f25 2053 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2054 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2055 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2056
09fd0de5 2057 hci_dev_lock(hdev);
9fbcbb45 2058
4b34ee78 2059 if (!hdev_is_powered(hdev)) {
e8ba3a1f 2060 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 2061 goto failed;
2062 }
2063
333ae95d
JH		 2064 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2065 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 2066 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2067 MGMT_STATUS_BUSY);
9fbcbb45
JH		 2068 goto failed;
2069 }
2070
2e58ef3e 2071 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 2072 if (!cmd) {
2073 err = -ENOMEM;
9fbcbb45 2074 goto failed;
366a0336 2075 }
9fbcbb45 2076
9b74246f 2077 hci_req_init(&req, hdev);
9fbcbb45 2078
9a43e25f
JH		 2079 /* If BR/EDR is not enabled and we disable advertising as a
2080 * by-product of disabling connectable, we need to update the
2081 * advertising flags.
2082 */
d7a5a11d 2083 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 2084 if (!cp->val) {
a358dc11
MH		 2085 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2086 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 2087 }
2088 update_adv_data(&req);
2089 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 2090 if (cp->val) {
2091 scan = SCAN_PAGE;
2092 } else {
3bd27240
JH		 2093 /* If we don't have any whitelist entries just
2094 * disable all scanning. If there are entries
2095 * and we had both page and inquiry scanning
2096 * enabled then fall back to only page scanning.
2097 * Otherwise no changes are needed.
2098 */
2099 if (list_empty(&hdev->whitelist))
2100 scan = SCAN_DISABLED;
2101 else if (test_bit(HCI_ISCAN, &hdev->flags))
2102 scan = SCAN_PAGE;
2103 else
2104 goto no_scan_update;
9b74246f
JH		 2105
2106 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 2107 hdev->discov_timeout > 0)
9b74246f
JH		 2108 cancel_delayed_work(&hdev->discov_off);
2109 }
2b76f453 2110
9b74246f
JH		 2111 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2112 }
2b76f453 2113
3bd27240 2114no_scan_update:
e8b1202c 2115 /* Update the advertising parameters if necessary */
880897d4
AU		 2116 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2117 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1987fdc7 2118 enable_advertising(&req);
1987fdc7 2119
2b76f453 2120 err = hci_req_run(&req, set_connectable_complete);
9b74246f 2121 if (err < 0) {
a664b5bc 2122 mgmt_pending_remove(cmd);
9b74246f 2123 if (err == -ENODATA)
a81070ba
JH		 2124 err = set_connectable_update_settings(hdev, sk,
2125 cp->val);
9b74246f
JH		 2126 goto failed;
2127 }
9fbcbb45
JH		 2128
2129failed:
09fd0de5 2130 hci_dev_unlock(hdev);
9fbcbb45
JH		 2131 return err;
2132}
2133
b2939475 2134static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2135 u16 len)
c542a06c 2136{
650f726d 2137 struct mgmt_mode *cp = data;
55594356 2138 bool changed;
c542a06c
JH		 2139 int err;
2140
bdb6d971 2141 BT_DBG("request for %s", hdev->name);
c542a06c 2142
a7e80f25 2143 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2144 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2145 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2146
09fd0de5 2147 hci_dev_lock(hdev);
c542a06c
JH		 2148
2149 if (cp->val)
238be788 2150 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 2151 else
a69d8927 2152 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 2153
b2939475 2154 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2155 if (err < 0)
55594356 2156 goto unlock;
c542a06c 2157
55594356
MH		 2158 if (changed)
2159 err = new_settings(hdev, sk);
c542a06c 2160
55594356 2161unlock:
09fd0de5 2162 hci_dev_unlock(hdev);
c542a06c
JH		 2163 return err;
2164}
2165
04124681
GP		 2166static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2167 u16 len)
33ef95ed
JH		 2168{
2169 struct mgmt_mode *cp = data;
3b0602cd 2170 struct mgmt_pending_cmd *cmd;
e6fe7986 2171 u8 val, status;
33ef95ed
JH		 2172 int err;
2173
bdb6d971 2174 BT_DBG("request for %s", hdev->name);
33ef95ed 2175
e6fe7986
JH		 2176 status = mgmt_bredr_support(hdev);
2177 if (status)
a69e8375
JH		 2178 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2179 status);
33c525c0 2180
a7e80f25 2181 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2182 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2183 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2184
33ef95ed
JH		 2185 hci_dev_lock(hdev);
2186
4b34ee78 2187 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2188 bool changed = false;
2189
d7a5a11d 2190 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 2191 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 2192 changed = true;
2193 }
2194
2195 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2196 if (err < 0)
2197 goto failed;
2198
2199 if (changed)
2200 err = new_settings(hdev, sk);
2201
33ef95ed
JH		 2202 goto failed;
2203 }
2204
333ae95d 2205 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 2206 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2207 MGMT_STATUS_BUSY);
33ef95ed
JH		 2208 goto failed;
2209 }
2210
2211 val = !!cp->val;
2212
2213 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2214 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2215 goto failed;
2216 }
2217
2218 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2219 if (!cmd) {
2220 err = -ENOMEM;
2221 goto failed;
2222 }
2223
2224 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2225 if (err < 0) {
2226 mgmt_pending_remove(cmd);
2227 goto failed;
2228 }
2229
2230failed:
2231 hci_dev_unlock(hdev);
33ef95ed
JH		 2232 return err;
2233}
2234
bdb6d971 2235static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2236{
2237 struct mgmt_mode *cp = data;
3b0602cd 2238 struct mgmt_pending_cmd *cmd;
72ef0c1a 2239 u8 status;
ed2c4ee3
JH		 2240 int err;
2241
bdb6d971 2242 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2243
cdba5281
MH		 2244 status = mgmt_bredr_support(hdev);
2245 if (status)
a69e8375 2246 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2247
13ecd8b6 2248 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2249 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2250 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2251
a7e80f25 2252 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2253 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2254 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2255
13ecd8b6 2256 hci_dev_lock(hdev);
6c8f12c1 2257
4b34ee78 2258 if (!hdev_is_powered(hdev)) {
9ecb3e24 2259 bool changed;
c0ecddc2 2260
9ecb3e24 2261 if (cp->val) {
238be788
MH		 2262 changed = !hci_dev_test_and_set_flag(hdev,
2263 HCI_SSP_ENABLED);
9ecb3e24 2264 } else {
a69d8927
MH		 2265 changed = hci_dev_test_and_clear_flag(hdev,
2266 HCI_SSP_ENABLED);
9ecb3e24 2267 if (!changed)
a69d8927
MH		 2268 changed = hci_dev_test_and_clear_flag(hdev,
2269 HCI_HS_ENABLED);
9ecb3e24 2270 else
a358dc11 2271 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2272 }
2273
2274 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2275 if (err < 0)
2276 goto failed;
2277
2278 if (changed)
2279 err = new_settings(hdev, sk);
2280
ed2c4ee3
JH		 2281 goto failed;
2282 }
2283
333ae95d 2284 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2285 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2286 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2287 goto failed;
2288 }
2289
d7a5a11d 2290 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2291 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2292 goto failed;
2293 }
2294
2295 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2296 if (!cmd) {
2297 err = -ENOMEM;
2298 goto failed;
2299 }
2300
d7a5a11d 2301 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2302 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2303 sizeof(cp->val), &cp->val);
2304
72ef0c1a 2305 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2306 if (err < 0) {
2307 mgmt_pending_remove(cmd);
2308 goto failed;
2309 }
2310
2311failed:
2312 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2313 return err;
2314}
2315
bdb6d971 2316static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2317{
2318 struct mgmt_mode *cp = data;
ee392693 2319 bool changed;
e6fe7986 2320 u8 status;
ee392693 2321 int err;
6d80dfd0 2322
bdb6d971 2323 BT_DBG("request for %s", hdev->name);
6d80dfd0 2324
e6fe7986
JH		 2325 status = mgmt_bredr_support(hdev);
2326 if (status)
a69e8375 2327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2328
9ecb3e24 2329 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2330 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2331 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2332
d7a5a11d 2333 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2334 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2335 MGMT_STATUS_REJECTED);
9ecb3e24 2336
a7e80f25 2337 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2339 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2340
ee392693
MH		 2341 hci_dev_lock(hdev);
2342
333ae95d 2343 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2344 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2345 MGMT_STATUS_BUSY);
a2cb01de
JH		 2346 goto unlock;
2347 }
2348
a0cdf960 2349 if (cp->val) {
238be788 2350 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2351 } else {
2352 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2353 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2354 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2355 goto unlock;
2356 }
2357
a69d8927 2358 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2359 }
ee392693
MH		 2360
2361 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2362 if (err < 0)
2363 goto unlock;
2364
2365 if (changed)
2366 err = new_settings(hdev, sk);
6d80dfd0 2367
ee392693
MH		 2368unlock:
2369 hci_dev_unlock(hdev);
2370 return err;
6d80dfd0
JH		 2371}
2372
1904a853 2373static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2374{
2375 struct cmd_lookup match = { NULL, hdev };
2376
3ad67582
JK		 2377 hci_dev_lock(hdev);
2378
416a4ae5
JH		 2379 if (status) {
2380 u8 mgmt_err = mgmt_status(status);
2381
2382 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2383 &mgmt_err);
3ad67582 2384 goto unlock;
416a4ae5
JH		 2385 }
2386
2387 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2388
2389 new_settings(hdev, match.sk);
2390
2391 if (match.sk)
2392 sock_put(match.sk);
441ad2d0
MH		 2393
2394 /* Make sure the controller has a good default for
2395 * advertising data. Restrict the update to when LE
2396 * has actually been enabled. During power on, the
2397 * update in powered_update_hci will take care of it.
2398 */
d7a5a11d 2399 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2400 struct hci_request req;
2401
441ad2d0 2402 hci_req_init(&req, hdev);
5947f4bc 2403 update_adv_data(&req);
f14d8f64 2404 update_scan_rsp_data(&req);
2cf22218 2405 __hci_update_background_scan(&req);
441ad2d0 2406 hci_req_run(&req, NULL);
441ad2d0 2407 }
3ad67582
JK		 2408
2409unlock:
2410 hci_dev_unlock(hdev);
416a4ae5
JH		 2411}
2412
bdb6d971 2413static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2414{
2415 struct mgmt_mode *cp = data;
2416 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2417 struct mgmt_pending_cmd *cmd;
416a4ae5 2418 struct hci_request req;
06199cf8 2419 int err;
0b60eba1 2420 u8 val, enabled;
06199cf8 2421
bdb6d971 2422 BT_DBG("request for %s", hdev->name);
06199cf8 2423
13ecd8b6 2424 if (!lmp_le_capable(hdev))
a69e8375
JH		 2425 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2426 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2427
a7e80f25 2428 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2429 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2430 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2431
e7844ee5
MH		 2432 /* Bluetooth single mode LE only controllers or dual-mode
2433 * controllers configured as LE only devices, do not allow
2434 * switching LE off. These have either LE enabled explicitly
2435 * or BR/EDR has been previously switched off.
2436 *
2437 * When trying to enable an already enabled LE, then gracefully
2438 * send a positive response. Trying to disable it however will
2439 * result into rejection.
2440 */
2441 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2442 if (cp->val == 0x01)
2443 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2444
a69e8375
JH		 2445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2446 MGMT_STATUS_REJECTED);
e7844ee5 2447 }
c73eee91 2448
13ecd8b6 2449 hci_dev_lock(hdev);
06199cf8
JH		 2450
2451 val = !!cp->val;
ffa88e02 2452 enabled = lmp_host_le_capable(hdev);
06199cf8 2453
0b60eba1 2454 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2455 bool changed = false;
2456
d7a5a11d 2457 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2458 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2459 changed = true;
2460 }
2461
d7a5a11d 2462 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2463 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2464 changed = true;
2465 }
2466
06199cf8
JH		 2467 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2468 if (err < 0)
1de028ce 2469 goto unlock;
06199cf8
JH		 2470
2471 if (changed)
2472 err = new_settings(hdev, sk);
2473
1de028ce 2474 goto unlock;
06199cf8
JH		 2475 }
2476
333ae95d
JH		 2477 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2478 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2479 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2480 MGMT_STATUS_BUSY);
1de028ce 2481 goto unlock;
06199cf8
JH		 2482 }
2483
2484 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2485 if (!cmd) {
2486 err = -ENOMEM;
1de028ce 2487 goto unlock;
06199cf8
JH		 2488 }
2489
441ad2d0
MH		 2490 hci_req_init(&req, hdev);
2491
06199cf8
JH		 2492 memset(&hci_cp, 0, sizeof(hci_cp));
2493
2494 if (val) {
2495 hci_cp.le = val;
32226e4f 2496 hci_cp.simul = 0x00;
441ad2d0 2497 } else {
d7a5a11d 2498 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2499 disable_advertising(&req);
06199cf8
JH		 2500 }
2501
416a4ae5
JH		 2502 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2503 &hci_cp);
2504
2505 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2506 if (err < 0)
06199cf8 2507 mgmt_pending_remove(cmd);
06199cf8 2508
1de028ce
JH		 2509unlock:
2510 hci_dev_unlock(hdev);
06199cf8
JH		 2511 return err;
2512}
2513
0cab9c80
JH		 2514/* This is a helper function to test for pending mgmt commands that can
2515 * cause CoD or EIR HCI commands. We can only allow one such pending
2516 * mgmt command at a time since otherwise we cannot easily track what
2517 * the current values are, will be, and based on that calculate if a new
2518 * HCI command needs to be sent and if yes with what value.
2519 */
2520static bool pending_eir_or_class(struct hci_dev *hdev)
2521{
3b0602cd 2522 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2523
2524 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2525 switch (cmd->opcode) {
2526 case MGMT_OP_ADD_UUID:
2527 case MGMT_OP_REMOVE_UUID:
2528 case MGMT_OP_SET_DEV_CLASS:
2529 case MGMT_OP_SET_POWERED:
2530 return true;
2531 }
2532 }
2533
2534 return false;
2535}
2536
83be8eca
JH		 2537static const u8 bluetooth_base_uuid[] = {
2538 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2539 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2540};
2541
2542static u8 get_uuid_size(const u8 *uuid)
2543{
2544 u32 val;
2545
2546 if (memcmp(uuid, bluetooth_base_uuid, 12))
2547 return 128;
2548
2549 val = get_unaligned_le32(&uuid[12]);
2550 if (val > 0xffff)
2551 return 32;
2552
2553 return 16;
2554}
2555
92da6097
JH		 2556static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2557{
3b0602cd 2558 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2559
2560 hci_dev_lock(hdev);
2561
333ae95d 2562 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2563 if (!cmd)
2564 goto unlock;
2565
2a1afb5a
JH		 2566 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2567 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2568
2569 mgmt_pending_remove(cmd);
2570
2571unlock:
2572 hci_dev_unlock(hdev);
2573}
2574
1904a853 2575static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2576{
2577 BT_DBG("status 0x%02x", status);
2578
2579 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2580}
2581
bdb6d971 2582static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2583{
650f726d 2584 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2585 struct mgmt_pending_cmd *cmd;
890ea898 2586 struct hci_request req;
2aeb9a1a 2587 struct bt_uuid *uuid;
2aeb9a1a
JH		 2588 int err;
2589
bdb6d971 2590 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2591
09fd0de5 2592 hci_dev_lock(hdev);
2aeb9a1a 2593
0cab9c80 2594 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2595 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2596 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2597 goto failed;
2598 }
2599
92c4c204 2600 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2601 if (!uuid) {
2602 err = -ENOMEM;
2603 goto failed;
2604 }
2605
2606 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2607 uuid->svc_hint = cp->svc_hint;
83be8eca 2608 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2609
de66aa63 2610 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2611
890ea898 2612 hci_req_init(&req, hdev);
1aff6f09 2613
890ea898
JH		 2614 update_class(&req);
2615 update_eir(&req);
2616
92da6097
JH		 2617 err = hci_req_run(&req, add_uuid_complete);
2618 if (err < 0) {
2619 if (err != -ENODATA)
2620 goto failed;
80a1e1db 2621
2a1afb5a
JH		 2622 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2623 hdev->dev_class, 3);
90e70454
JH		 2624 goto failed;
2625 }
2626
2627 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2628 if (!cmd) {
90e70454 2629 err = -ENOMEM;
890ea898
JH		 2630 goto failed;
2631 }
2632
2633 err = 0;
2aeb9a1a
JH		 2634
2635failed:
09fd0de5 2636 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2637 return err;
2638}
2639
24b78d0f
JH		 2640static bool enable_service_cache(struct hci_dev *hdev)
2641{
2642 if (!hdev_is_powered(hdev))
2643 return false;
2644
238be788 2645 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2646 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2647 CACHE_TIMEOUT);
24b78d0f
JH		 2648 return true;
2649 }
2650
2651 return false;
2652}
2653
1904a853 2654static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2655{
2656 BT_DBG("status 0x%02x", status);
2657
2658 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2659}
2660
bdb6d971 2661static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2662 u16 len)
2aeb9a1a 2663{
650f726d 2664 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2665 struct mgmt_pending_cmd *cmd;
056341c8 2666 struct bt_uuid *match, *tmp;
2aeb9a1a 2667 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2668 struct hci_request req;
2aeb9a1a
JH		 2669 int err, found;
2670
bdb6d971 2671 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2672
09fd0de5 2673 hci_dev_lock(hdev);
2aeb9a1a 2674
0cab9c80 2675 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2677 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2678 goto unlock;
2679 }
2680
2aeb9a1a 2681 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2682 hci_uuids_clear(hdev);
4004b6d9 2683
24b78d0f 2684 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2685 err = mgmt_cmd_complete(sk, hdev->id,
2686 MGMT_OP_REMOVE_UUID,
2687 0, hdev->dev_class, 3);
24b78d0f
JH		 2688 goto unlock;
2689 }
4004b6d9 2690
9246a869 2691 goto update_class;
2aeb9a1a
JH		 2692 }
2693
2694 found = 0;
2695
056341c8 2696 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2697 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2698 continue;
2699
2700 list_del(&match->list);
482049f7 2701 kfree(match);
2aeb9a1a
JH		 2702 found++;
2703 }
2704
2705 if (found == 0) {
a69e8375
JH		 2706 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2707 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2708 goto unlock;
2709 }
2710
9246a869 2711update_class:
890ea898 2712 hci_req_init(&req, hdev);
1aff6f09 2713
890ea898
JH		 2714 update_class(&req);
2715 update_eir(&req);
2716
92da6097
JH		 2717 err = hci_req_run(&req, remove_uuid_complete);
2718 if (err < 0) {
2719 if (err != -ENODATA)
2720 goto unlock;
80a1e1db 2721
2a1afb5a
JH		 2722 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2723 hdev->dev_class, 3);
90e70454
JH		 2724 goto unlock;
2725 }
2726
2727 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2728 if (!cmd) {
90e70454 2729 err = -ENOMEM;
890ea898
JH		 2730 goto unlock;
2731 }
2732
2733 err = 0;
2aeb9a1a
JH		 2734
2735unlock:
09fd0de5 2736 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2737 return err;
2738}
2739
1904a853 2740static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2741{
2742 BT_DBG("status 0x%02x", status);
2743
2744 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2745}
2746
bdb6d971 2747static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2748 u16 len)
1aff6f09 2749{
650f726d 2750 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2751 struct mgmt_pending_cmd *cmd;
890ea898 2752 struct hci_request req;
1aff6f09
JH		 2753 int err;
2754
bdb6d971 2755 BT_DBG("request for %s", hdev->name);
1aff6f09 2756
6203fc98 2757 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2758 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2759 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2760
0cab9c80 2761 hci_dev_lock(hdev);
ee98f473 2762
0cab9c80 2763 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2764 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2765 MGMT_STATUS_BUSY);
0cab9c80
JH		 2766 goto unlock;
2767 }
c95f0ba7 2768
0cab9c80 2769 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2770 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2771 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2772 goto unlock;
2773 }
575b3a02 2774
932f5ff5
JH		 2775 hdev->major_class = cp->major;
2776 hdev->minor_class = cp->minor;
2777
b5235a65 2778 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2779 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2780 hdev->dev_class, 3);
b5235a65
JH		 2781 goto unlock;
2782 }
2783
890ea898
JH		 2784 hci_req_init(&req, hdev);
2785
a69d8927 2786 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2787 hci_dev_unlock(hdev);
2788 cancel_delayed_work_sync(&hdev->service_cache);
2789 hci_dev_lock(hdev);
890ea898 2790 update_eir(&req);
7d78525d 2791 }
14c0b608 2792
890ea898
JH		 2793 update_class(&req);
2794
92da6097
JH		 2795 err = hci_req_run(&req, set_class_complete);
2796 if (err < 0) {
2797 if (err != -ENODATA)
2798 goto unlock;
1aff6f09 2799
2a1afb5a
JH		 2800 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2801 hdev->dev_class, 3);
90e70454
JH		 2802 goto unlock;
2803 }
2804
2805 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2806 if (!cmd) {
90e70454 2807 err = -ENOMEM;
890ea898
JH		 2808 goto unlock;
2809 }
2810
2811 err = 0;
1aff6f09 2812
b5235a65 2813unlock:
09fd0de5 2814 hci_dev_unlock(hdev);
1aff6f09
JH		 2815 return err;
2816}
2817
bdb6d971 2818static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2819 u16 len)
55ed8ca1 2820{
650f726d 2821 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2822 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2823 sizeof(struct mgmt_link_key_info));
4e51eae9 2824 u16 key_count, expected_len;
b1de97d8 2825 bool changed;
a492cd52 2826 int i;
55ed8ca1 2827
9060d5cf
MH		 2828 BT_DBG("request for %s", hdev->name);
2829
2830 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2831 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2832 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2833
1f350c87 2834 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2835 if (key_count > max_key_count) {
2836 BT_ERR("load_link_keys: too big key_count value %u",
2837 key_count);
a69e8375
JH		 2838 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2839 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2840 }
55ed8ca1 2841
86742e1e
JH		 2842 expected_len = sizeof(*cp) + key_count *
2843 sizeof(struct mgmt_link_key_info);
a492cd52 2844 if (expected_len != len) {
86742e1e 2845 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2846 expected_len, len);
a69e8375
JH		 2847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2848 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2849 }
2850
4ae14301 2851 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2852 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2853 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2854
bdb6d971 2855 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2856 key_count);
55ed8ca1 2857
4ee71b20
JH		 2858 for (i = 0; i < key_count; i++) {
2859 struct mgmt_link_key_info *key = &cp->keys[i];
2860
8e991132 2861 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 2862 return mgmt_cmd_status(sk, hdev->id,
2863 MGMT_OP_LOAD_LINK_KEYS,
2864 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2865 }
2866
09fd0de5 2867 hci_dev_lock(hdev);
55ed8ca1
JH		 2868
2869 hci_link_keys_clear(hdev);
2870
55ed8ca1 2871 if (cp->debug_keys)
238be788 2872 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 2873 else
a69d8927
MH		 2874 changed = hci_dev_test_and_clear_flag(hdev,
2875 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 2876
2877 if (changed)
2878 new_settings(hdev, NULL);
55ed8ca1 2879
a492cd52 2880 for (i = 0; i < key_count; i++) {
86742e1e 2881 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2882
58e9293c
JH		 2883 /* Always ignore debug keys and require a new pairing if
2884 * the user wants to use them.
2885 */
2886 if (key->type == HCI_LK_DEBUG_COMBINATION)
2887 continue;
2888
7652ff6a
JH		 2889 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2890 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2891 }
2892
2a1afb5a 2893 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2894
09fd0de5 2895 hci_dev_unlock(hdev);
55ed8ca1 2896
a492cd52 2897 return 0;
55ed8ca1
JH		 2898}
2899
b1078ad0 2900static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2901 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2902{
2903 struct mgmt_ev_device_unpaired ev;
2904
2905 bacpy(&ev.addr.bdaddr, bdaddr);
2906 ev.addr.type = addr_type;
2907
2908 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2909 skip_sk);
b1078ad0
JH		 2910}
2911
bdb6d971 2912static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2913 u16 len)
55ed8ca1 2914{
124f6e35
JH		 2915 struct mgmt_cp_unpair_device *cp = data;
2916 struct mgmt_rp_unpair_device rp;
a8a1d19e 2917 struct hci_cp_disconnect dc;
3b0602cd 2918 struct mgmt_pending_cmd *cmd;
55ed8ca1 2919 struct hci_conn *conn;
55ed8ca1
JH		 2920 int err;
2921
a8a1d19e 2922 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2923 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2924 rp.addr.type = cp->addr.type;
a8a1d19e 2925
4ee71b20 2926 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 2927 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2928 MGMT_STATUS_INVALID_PARAMS,
2929 &rp, sizeof(rp));
4ee71b20 2930
118da70b 2931 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 2932 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2933 MGMT_STATUS_INVALID_PARAMS,
2934 &rp, sizeof(rp));
118da70b 2935
4ee71b20
JH		 2936 hci_dev_lock(hdev);
2937
86a8cfc6 2938 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2939 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2940 MGMT_STATUS_NOT_POWERED, &rp,
2941 sizeof(rp));
86a8cfc6
JH		 2942 goto unlock;
2943 }
2944
e0b2b27e 2945 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2946 /* If disconnection is requested, then look up the
2947 * connection. If the remote device is connected, it
2948 * will be later used to terminate the link.
2949 *
2950 * Setting it to NULL explicitly will cause no
2951 * termination of the link.
2952 */
2953 if (cp->disconnect)
2954 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2955 &cp->addr.bdaddr);
2956 else
2957 conn = NULL;
2958
124f6e35 2959 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2960 } else {
2961 u8 addr_type;
2962
89cbb063
AA		 2963 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2964 &cp->addr.bdaddr);
2965 if (conn) {
2966 /* Defer clearing up the connection parameters
2967 * until closing to give a chance of keeping
2968 * them if a repairing happens.
2969 */
2970 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2971
2972 /* If disconnection is not requested, then
2973 * clear the connection variable so that the
2974 * link is not terminated.
2975 */
2976 if (!cp->disconnect)
2977 conn = NULL;
2978 }
2979
e0b2b27e
JH		 2980 if (cp->addr.type == BDADDR_LE_PUBLIC)
2981 addr_type = ADDR_LE_DEV_PUBLIC;
2982 else
2983 addr_type = ADDR_LE_DEV_RANDOM;
2984
a7ec7338
JH		 2985 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2986
e0b2b27e
JH		 2987 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2988 }
b0dbfb46 2989
55ed8ca1 2990 if (err < 0) {
2a1afb5a
JH		 2991 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2992 MGMT_STATUS_NOT_PAIRED, &rp,
2993 sizeof(rp));
55ed8ca1
JH		 2994 goto unlock;
2995 }
2996
89cbb063
AA		 2997 /* If the connection variable is set, then termination of the
2998 * link is requested.
2999 */
a8a1d19e 3000 if (!conn) {
2a1afb5a
JH		 3001 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3002 &rp, sizeof(rp));
b1078ad0 3003 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3004 goto unlock;
3005 }
55ed8ca1 3006
124f6e35 3007 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3008 sizeof(*cp));
a8a1d19e
JH		 3009 if (!cmd) {
3010 err = -ENOMEM;
3011 goto unlock;
55ed8ca1
JH		 3012 }
3013
d8b7b1e4
JH		 3014 cmd->cmd_complete = addr_cmd_complete;
3015
eb55ef07 3016 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 3017 dc.reason = 0x13; /* Remote User Terminated Connection */
3018 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3019 if (err < 0)
3020 mgmt_pending_remove(cmd);
3021
55ed8ca1 3022unlock:
09fd0de5 3023 hci_dev_unlock(hdev);
55ed8ca1
JH		 3024 return err;
3025}
3026
bdb6d971 3027static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3028 u16 len)
8962ee74 3029{
650f726d 3030 struct mgmt_cp_disconnect *cp = data;
06a63b19 3031 struct mgmt_rp_disconnect rp;
3b0602cd 3032 struct mgmt_pending_cmd *cmd;
8962ee74 3033 struct hci_conn *conn;
8962ee74
JH		 3034 int err;
3035
3036 BT_DBG("");
3037
06a63b19
JH		 3038 memset(&rp, 0, sizeof(rp));
3039 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3040 rp.addr.type = cp->addr.type;
3041
4ee71b20 3042 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3043 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3044 MGMT_STATUS_INVALID_PARAMS,
3045 &rp, sizeof(rp));
4ee71b20 3046
09fd0de5 3047 hci_dev_lock(hdev);
8962ee74
JH		 3048
3049 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3050 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3051 MGMT_STATUS_NOT_POWERED, &rp,
3052 sizeof(rp));
8962ee74
JH		 3053 goto failed;
3054 }
3055
333ae95d 3056 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3057 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3058 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3059 goto failed;
3060 }
3061
591f47f3 3062 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3063 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3064 &cp->addr.bdaddr);
88c3df13
JH		 3065 else
3066 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 3067
f960727e 3068 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3069 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3070 MGMT_STATUS_NOT_CONNECTED, &rp,
3071 sizeof(rp));
8962ee74
JH		 3072 goto failed;
3073 }
3074
2e58ef3e 3075 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3076 if (!cmd) {
3077 err = -ENOMEM;
8962ee74 3078 goto failed;
366a0336 3079 }
8962ee74 3080
f5818c22
JH		 3081 cmd->cmd_complete = generic_cmd_complete;
3082
e3f2f92a 3083 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3084 if (err < 0)
a664b5bc 3085 mgmt_pending_remove(cmd);
8962ee74
JH		 3086
3087failed:
09fd0de5 3088 hci_dev_unlock(hdev);
8962ee74
JH		 3089 return err;
3090}
3091
57c1477c 3092static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3093{
3094 switch (link_type) {
3095 case LE_LINK:
48264f06
JH		 3096 switch (addr_type) {
3097 case ADDR_LE_DEV_PUBLIC:
591f47f3 3098 return BDADDR_LE_PUBLIC;
0ed09148 3099
48264f06 3100 default:
0ed09148 3101 /* Fallback to LE Random address type */
591f47f3 3102 return BDADDR_LE_RANDOM;
48264f06 3103 }
0ed09148 3104
4c659c39 3105 default:
0ed09148 3106 /* Fallback to BR/EDR type */
591f47f3 3107 return BDADDR_BREDR;
4c659c39
JH		 3108 }
3109}
3110
04124681
GP		 3111static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3112 u16 data_len)
2784eb41 3113{
2784eb41 3114 struct mgmt_rp_get_connections *rp;
8035ded4 3115 struct hci_conn *c;
a38528f1 3116 size_t rp_len;
60fc5fb6
JH		 3117 int err;
3118 u16 i;
2784eb41
JH		 3119
3120 BT_DBG("");
3121
09fd0de5 3122 hci_dev_lock(hdev);
2784eb41 3123
5f97c1df 3124 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3125 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3126 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3127 goto unlock;
3128 }
3129
60fc5fb6 3130 i = 0;
b644ba33
JH		 3131 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3132 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3133 i++;
2784eb41
JH		 3134 }
3135
60fc5fb6 3136 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 3137 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 3138 if (!rp) {
2784eb41
JH		 3139 err = -ENOMEM;
3140 goto unlock;
3141 }
3142
2784eb41 3143 i = 0;
4c659c39 3144 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3145 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3146 continue;
4c659c39 3147 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3148 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3149 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3150 continue;
3151 i++;
3152 }
3153
eb55ef07 3154 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3155
4c659c39
JH		 3156 /* Recalculate length in case of filtered SCO connections, etc */
3157 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 3158
2a1afb5a
JH		 3159 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3160 rp_len);
2784eb41 3161
a38528f1 3162 kfree(rp);
5f97c1df
JH		 3163
3164unlock:
09fd0de5 3165 hci_dev_unlock(hdev);
2784eb41
JH		 3166 return err;
3167}
3168
bdb6d971 3169static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3170 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3171{
3b0602cd 3172 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3173 int err;
3174
2e58ef3e 3175 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3176 sizeof(*cp));
96d97a67
WR		 3177 if (!cmd)
3178 return -ENOMEM;
3179
d8457698 3180 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3181 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3182 if (err < 0)
3183 mgmt_pending_remove(cmd);
3184
3185 return err;
3186}
3187
bdb6d971 3188static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3189 u16 len)
980e1a53 3190{
96d97a67 3191 struct hci_conn *conn;
650f726d 3192 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3193 struct hci_cp_pin_code_reply reply;
3b0602cd 3194 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3195 int err;
3196
3197 BT_DBG("");
3198
09fd0de5 3199 hci_dev_lock(hdev);
980e1a53 3200
4b34ee78 3201 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3202 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3203 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3204 goto failed;
3205 }
3206
d8457698 3207 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3208 if (!conn) {
a69e8375
JH		 3209 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3210 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3211 goto failed;
3212 }
3213
3214 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3215 struct mgmt_cp_pin_code_neg_reply ncp;
3216
3217 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3218
3219 BT_ERR("PIN code is not 16 bytes long");
3220
bdb6d971 3221 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3222 if (err >= 0)
a69e8375
JH		 3223 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3224 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3225
3226 goto failed;
3227 }
3228
00abfe44 3229 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3230 if (!cmd) {
3231 err = -ENOMEM;
980e1a53 3232 goto failed;
366a0336 3233 }
980e1a53 3234
7776d1d8
JH		 3235 cmd->cmd_complete = addr_cmd_complete;
3236
d8457698 3237 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3238 reply.pin_len = cp->pin_len;
24718ca5 3239 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3240
3241 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3242 if (err < 0)
a664b5bc 3243 mgmt_pending_remove(cmd);
980e1a53
JH		 3244
3245failed:
09fd0de5 3246 hci_dev_unlock(hdev);
980e1a53
JH		 3247 return err;
3248}
3249
04124681
GP		 3250static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3251 u16 len)
17fa4b9d 3252{
650f726d 3253 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3254
3255 BT_DBG("");
3256
4ec86d4c 3257 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3258 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3259 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3260
09fd0de5 3261 hci_dev_lock(hdev);
17fa4b9d
JH		 3262
3263 hdev->io_capability = cp->io_capability;
3264
3265 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3266 hdev->io_capability);
17fa4b9d 3267
09fd0de5 3268 hci_dev_unlock(hdev);
17fa4b9d 3269
2a1afb5a
JH		 3270 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3271 NULL, 0);
17fa4b9d
JH		 3272}
3273
3b0602cd 3274static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3275{
3276 struct hci_dev *hdev = conn->hdev;
3b0602cd 3277 struct mgmt_pending_cmd *cmd;
e9a416b5 3278
2e58ef3e 3279 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3280 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3281 continue;
3282
e9a416b5
JH		 3283 if (cmd->user_data != conn)
3284 continue;
3285
3286 return cmd;
3287 }
3288
3289 return NULL;
3290}
3291
3b0602cd 3292static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3293{
3294 struct mgmt_rp_pair_device rp;
3295 struct hci_conn *conn = cmd->user_data;
9df74653 3296 int err;
e9a416b5 3297
61b1a7fb
JH		 3298 bacpy(&rp.addr.bdaddr, &conn->dst);
3299 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3300
2a1afb5a
JH		 3301 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3302 status, &rp, sizeof(rp));
e9a416b5
JH		 3303
3304 /* So we don't get further callbacks for this connection */
3305 conn->connect_cfm_cb = NULL;
3306 conn->security_cfm_cb = NULL;
3307 conn->disconn_cfm_cb = NULL;
3308
76a68ba0 3309 hci_conn_drop(conn);
89cbb063
AA		 3310
3311 /* The device is paired so there is no need to remove
3312 * its connection parameters anymore.
3313 */
3314 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3315
3316 hci_conn_put(conn);
9df74653
JH		 3317
3318 return err;
e9a416b5
JH		 3319}
3320
f4a407be
JH		 3321void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3322{
3323 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3324 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3325
3326 cmd = find_pairing(conn);
a511b35b 3327 if (cmd) {
04ab2749 3328 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3329 mgmt_pending_remove(cmd);
3330 }
f4a407be
JH		 3331}
3332
e9a416b5
JH		 3333static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3334{
3b0602cd 3335 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3336
3337 BT_DBG("status %u", status);
3338
3339 cmd = find_pairing(conn);
a511b35b 3340 if (!cmd) {
e9a416b5 3341 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3342 return;
3343 }
3344
3345 cmd->cmd_complete(cmd, mgmt_status(status));
3346 mgmt_pending_remove(cmd);
e9a416b5
JH		 3347}
3348
f4a407be 3349static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3350{
3b0602cd 3351 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3352
3353 BT_DBG("status %u", status);
3354
3355 if (!status)
3356 return;
3357
3358 cmd = find_pairing(conn);
a511b35b 3359 if (!cmd) {
4c47d739 3360 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3361 return;
3362 }
3363
3364 cmd->cmd_complete(cmd, mgmt_status(status));
3365 mgmt_pending_remove(cmd);
4c47d739
VA		 3366}
3367
bdb6d971 3368static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3369 u16 len)
e9a416b5 3370{
650f726d 3371 struct mgmt_cp_pair_device *cp = data;
1425acb7 3372 struct mgmt_rp_pair_device rp;
3b0602cd 3373 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3374 u8 sec_level, auth_type;
3375 struct hci_conn *conn;
e9a416b5
JH		 3376 int err;
3377
3378 BT_DBG("");
3379
f950a30e
SJ		 3380 memset(&rp, 0, sizeof(rp));
3381 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3382 rp.addr.type = cp->addr.type;
3383
4ee71b20 3384 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3385 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3386 MGMT_STATUS_INVALID_PARAMS,
3387 &rp, sizeof(rp));
4ee71b20 3388
4ec86d4c 3389 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3390 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3391 MGMT_STATUS_INVALID_PARAMS,
3392 &rp, sizeof(rp));
4ec86d4c 3393
09fd0de5 3394 hci_dev_lock(hdev);
e9a416b5 3395
5f97c1df 3396 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3397 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3398 MGMT_STATUS_NOT_POWERED, &rp,
3399 sizeof(rp));
5f97c1df
JH		 3400 goto unlock;
3401 }
3402
55e76b38
JH		 3403 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3404 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3405 MGMT_STATUS_ALREADY_PAIRED, &rp,
3406 sizeof(rp));
3407 goto unlock;
3408 }
3409
c908df36 3410 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3411 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3412
6f77d8c7 3413 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3414 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3415 auth_type);
6f77d8c7
AG		 3416 } else {
3417 u8 addr_type;
3418
3419 /* Convert from L2CAP channel address type to HCI address type
3420 */
3421 if (cp->addr.type == BDADDR_LE_PUBLIC)
3422 addr_type = ADDR_LE_DEV_PUBLIC;
3423 else
3424 addr_type = ADDR_LE_DEV_RANDOM;
3425
7c264b10
MH		 3426 /* When pairing a new device, it is expected to remember
3427 * this device for future connections. Adding the connection
3428 * parameter information ahead of time allows tracking
3429 * of the slave preferred values and will speed up any
3430 * further connection establishment.
3431 *
3432 * If connection parameters already exist, then they
3433 * will be kept and this function does nothing.
3434 */
3435 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3436
6f77d8c7 3437 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3438 sec_level, HCI_LE_CONN_TIMEOUT,
3439 HCI_ROLE_MASTER);
6f77d8c7 3440 }
7a512d01 3441
30e76272 3442 if (IS_ERR(conn)) {
489dc48e
AK		 3443 int status;
3444
3445 if (PTR_ERR(conn) == -EBUSY)
3446 status = MGMT_STATUS_BUSY;
faa81030
LR		 3447 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3448 status = MGMT_STATUS_NOT_SUPPORTED;
3449 else if (PTR_ERR(conn) == -ECONNREFUSED)
3450 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3451 else
3452 status = MGMT_STATUS_CONNECT_FAILED;
3453
2a1afb5a
JH		 3454 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3455 status, &rp, sizeof(rp));
e9a416b5
JH		 3456 goto unlock;
3457 }
3458
3459 if (conn->connect_cfm_cb) {
76a68ba0 3460 hci_conn_drop(conn);
2a1afb5a
JH		 3461 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3462 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3463 goto unlock;
3464 }
3465
2e58ef3e 3466 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3467 if (!cmd) {
3468 err = -ENOMEM;
76a68ba0 3469 hci_conn_drop(conn);
e9a416b5
JH		 3470 goto unlock;
3471 }
3472
04ab2749
JH		 3473 cmd->cmd_complete = pairing_complete;
3474
7a512d01 3475 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3476 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3477 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3478 conn->security_cfm_cb = pairing_complete_cb;
3479 conn->disconn_cfm_cb = pairing_complete_cb;
3480 } else {
3481 conn->connect_cfm_cb = le_pairing_complete_cb;
3482 conn->security_cfm_cb = le_pairing_complete_cb;
3483 conn->disconn_cfm_cb = le_pairing_complete_cb;
3484 }
7a512d01 3485
e9a416b5 3486 conn->io_capability = cp->io_cap;
f8aaf9b6 3487 cmd->user_data = hci_conn_get(conn);
e9a416b5 3488
6f78fd4b 3489 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3490 hci_conn_security(conn, sec_level, auth_type, true)) {
3491 cmd->cmd_complete(cmd, 0);
3492 mgmt_pending_remove(cmd);
3493 }
e9a416b5
JH		 3494
3495 err = 0;
3496
3497unlock:
09fd0de5 3498 hci_dev_unlock(hdev);
e9a416b5
JH		 3499 return err;
3500}
3501
04124681
GP		 3502static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3503 u16 len)
28424707 3504{
0f4e68cf 3505 struct mgmt_addr_info *addr = data;
3b0602cd 3506 struct mgmt_pending_cmd *cmd;
28424707
JH		 3507 struct hci_conn *conn;
3508 int err;
3509
3510 BT_DBG("");
3511
28424707
JH		 3512 hci_dev_lock(hdev);
3513
5f97c1df 3514 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3515 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3516 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3517 goto unlock;
3518 }
3519
333ae95d 3520 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3521 if (!cmd) {
a69e8375
JH		 3522 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3523 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3524 goto unlock;
3525 }
3526
3527 conn = cmd->user_data;
3528
3529 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3530 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3531 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3532 goto unlock;
3533 }
3534
a511b35b
JH		 3535 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3536 mgmt_pending_remove(cmd);
28424707 3537
2a1afb5a
JH		 3538 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3539 addr, sizeof(*addr));
28424707
JH		 3540unlock:
3541 hci_dev_unlock(hdev);
28424707
JH		 3542 return err;
3543}
3544
bdb6d971 3545static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3546 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3547 u16 hci_op, __le32 passkey)
a5c29683 3548{
3b0602cd 3549 struct mgmt_pending_cmd *cmd;
0df4c185 3550 struct hci_conn *conn;
a5c29683
JH		 3551 int err;
3552
09fd0de5 3553 hci_dev_lock(hdev);
08ba5382 3554
4b34ee78 3555 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3556 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3557 MGMT_STATUS_NOT_POWERED, addr,
3558 sizeof(*addr));
0df4c185 3559 goto done;
a5c29683
JH		 3560 }
3561
1707c60e
JH		 3562 if (addr->type == BDADDR_BREDR)
3563 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3564 else
1707c60e 3565 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3566
3567 if (!conn) {
2a1afb5a
JH		 3568 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3569 MGMT_STATUS_NOT_CONNECTED, addr,
3570 sizeof(*addr));
272d90df
JH		 3571 goto done;
3572 }
47c15e2b 3573
1707c60e 3574 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3575 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3576 if (!err)
2a1afb5a
JH		 3577 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3578 MGMT_STATUS_SUCCESS, addr,
3579 sizeof(*addr));
5fe57d9e 3580 else
2a1afb5a
JH		 3581 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3582 MGMT_STATUS_FAILED, addr,
3583 sizeof(*addr));
47c15e2b 3584
47c15e2b
BG		 3585 goto done;
3586 }
3587
1707c60e 3588 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3589 if (!cmd) {
3590 err = -ENOMEM;
0df4c185 3591 goto done;
a5c29683
JH		 3592 }
3593
7776d1d8
JH		 3594 cmd->cmd_complete = addr_cmd_complete;
3595
0df4c185 3596 /* Continue with pairing via HCI */
604086b7
BG		 3597 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3598 struct hci_cp_user_passkey_reply cp;
3599
1707c60e 3600 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3601 cp.passkey = passkey;
3602 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3603 } else
1707c60e
JH		 3604 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3605 &addr->bdaddr);
604086b7 3606
a664b5bc
JH		 3607 if (err < 0)
3608 mgmt_pending_remove(cmd);
a5c29683 3609
0df4c185 3610done:
09fd0de5 3611 hci_dev_unlock(hdev);
a5c29683
JH		 3612 return err;
3613}
3614
afeb019d
JK		 3615static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3616 void *data, u16 len)
3617{
3618 struct mgmt_cp_pin_code_neg_reply *cp = data;
3619
3620 BT_DBG("");
3621
1707c60e 3622 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3623 MGMT_OP_PIN_CODE_NEG_REPLY,
3624 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3625}
3626
04124681
GP		 3627static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3628 u16 len)
0df4c185 3629{
650f726d 3630 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3631
3632 BT_DBG("");
3633
3634 if (len != sizeof(*cp))
a69e8375
JH		 3635 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3636 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3637
1707c60e 3638 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3639 MGMT_OP_USER_CONFIRM_REPLY,
3640 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3641}
3642
bdb6d971 3643static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3644 void *data, u16 len)
0df4c185 3645{
c9c2659f 3646 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3647
3648 BT_DBG("");
3649
1707c60e 3650 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3651 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3652 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3653}
3654
04124681
GP		 3655static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3656 u16 len)
604086b7 3657{
650f726d 3658 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3659
3660 BT_DBG("");
3661
1707c60e 3662 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3663 MGMT_OP_USER_PASSKEY_REPLY,
3664 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3665}
3666
bdb6d971 3667static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3668 void *data, u16 len)
604086b7 3669{
650f726d 3670 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3671
3672 BT_DBG("");
3673
1707c60e 3674 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3675 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3676 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3677}
3678
13928971 3679static void update_name(struct hci_request *req)
2b4bf397 3680{
13928971 3681 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3682 struct hci_cp_write_local_name cp;
3683
13928971 3684 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3685
890ea898 3686 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3687}
3688
1904a853 3689static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3690{
3691 struct mgmt_cp_set_local_name *cp;
3b0602cd 3692 struct mgmt_pending_cmd *cmd;
13928971
JH		 3693
3694 BT_DBG("status 0x%02x", status);
3695
3696 hci_dev_lock(hdev);
3697
333ae95d 3698 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3699 if (!cmd)
3700 goto unlock;
3701
3702 cp = cmd->param;
3703
3704 if (status)
a69e8375
JH		 3705 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3706 mgmt_status(status));
13928971 3707 else
2a1afb5a
JH		 3708 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3709 cp, sizeof(*cp));
13928971
JH		 3710
3711 mgmt_pending_remove(cmd);
3712
3713unlock:
3714 hci_dev_unlock(hdev);
3715}
3716
bdb6d971 3717static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3718 u16 len)
b312b161 3719{
2b4bf397 3720 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3721 struct mgmt_pending_cmd *cmd;
890ea898 3722 struct hci_request req;
b312b161
JH		 3723 int err;
3724
3725 BT_DBG("");
3726
09fd0de5 3727 hci_dev_lock(hdev);
b312b161 3728
b3f2ca94
JH		 3729 /* If the old values are the same as the new ones just return a
3730 * direct command complete event.
3731 */
3732 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3733 !memcmp(hdev->short_name, cp->short_name,
3734 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3735 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3736 data, len);
b3f2ca94
JH		 3737 goto failed;
3738 }
3739
2b4bf397 3740 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3741
b5235a65 3742 if (!hdev_is_powered(hdev)) {
2b4bf397 3743 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3744
2a1afb5a
JH		 3745 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3746 data, len);
28cc7bde
JH		 3747 if (err < 0)
3748 goto failed;
3749
f6b7712e
MH		 3750 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3751 data, len, sk);
28cc7bde 3752
b5235a65
JH		 3753 goto failed;
3754 }
3755
28cc7bde 3756 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3757 if (!cmd) {
3758 err = -ENOMEM;
3759 goto failed;
3760 }
3761
13928971
JH		 3762 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3763
890ea898 3764 hci_req_init(&req, hdev);
3f985050
JH		 3765
3766 if (lmp_bredr_capable(hdev)) {
3767 update_name(&req);
3768 update_eir(&req);
3769 }
3770
7a5f4990
MH		 3771 /* The name is stored in the scan response data and so
3772 * no need to udpate the advertising data here.
3773 */
3f985050 3774 if (lmp_le_capable(hdev))
7a5f4990 3775 update_scan_rsp_data(&req);
3f985050 3776
13928971 3777 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3778 if (err < 0)
3779 mgmt_pending_remove(cmd);
3780
3781failed:
09fd0de5 3782 hci_dev_unlock(hdev);
b312b161
JH		 3783 return err;
3784}
3785
0f4e68cf 3786static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3787 void *data, u16 data_len)
c35938b2 3788{
3b0602cd 3789 struct mgmt_pending_cmd *cmd;
c35938b2
SJ		 3790 int err;
3791
bdb6d971 3792 BT_DBG("%s", hdev->name);
c35938b2 3793
09fd0de5 3794 hci_dev_lock(hdev);
c35938b2 3795
4b34ee78 3796 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3797 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3798 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3799 goto unlock;
3800 }
3801
9a1a1996 3802 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3803 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3804 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3805 goto unlock;
3806 }
3807
333ae95d 3808 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 3809 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3810 MGMT_STATUS_BUSY);
c35938b2
SJ		 3811 goto unlock;
3812 }
3813
2e58ef3e 3814 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3815 if (!cmd) {
3816 err = -ENOMEM;
3817 goto unlock;
3818 }
3819
710f11c0 3820 if (bredr_sc_enabled(hdev))
4d2d2796
MH		 3821 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3822 0, NULL);
3823 else
3824 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3825
c35938b2
SJ		 3826 if (err < 0)
3827 mgmt_pending_remove(cmd);
3828
3829unlock:
09fd0de5 3830 hci_dev_unlock(hdev);
c35938b2
SJ		 3831 return err;
3832}
3833
bdb6d971 3834static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3835 void *data, u16 len)
2763eda6 3836{
5d57e796 3837 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3838 int err;
3839
bdb6d971 3840 BT_DBG("%s ", hdev->name);
2763eda6 3841
5d57e796 3842 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 3843 return mgmt_cmd_complete(sk, hdev->id,
3844 MGMT_OP_ADD_REMOTE_OOB_DATA,
3845 MGMT_STATUS_INVALID_PARAMS,
3846 addr, sizeof(*addr));
5d57e796 3847
09fd0de5 3848 hci_dev_lock(hdev);
2763eda6 3849
ec109113
MH		 3850 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3851 struct mgmt_cp_add_remote_oob_data *cp = data;
3852 u8 status;
bf1e3541 3853
c19a495c 3854 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 3855 err = mgmt_cmd_complete(sk, hdev->id,
3856 MGMT_OP_ADD_REMOTE_OOB_DATA,
3857 MGMT_STATUS_INVALID_PARAMS,
3858 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 3859 goto unlock;
3860 }
3861
ec109113 3862 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 3863 cp->addr.type, cp->hash,
3864 cp->rand, NULL, NULL);
ec109113
MH		 3865 if (err < 0)
3866 status = MGMT_STATUS_FAILED;
3867 else
3868 status = MGMT_STATUS_SUCCESS;
3869
2a1afb5a
JH		 3870 err = mgmt_cmd_complete(sk, hdev->id,
3871 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3872 &cp->addr, sizeof(cp->addr));
ec109113
MH		 3873 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3874 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 3875 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 3876 u8 status;
3877
86df9200 3878 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 3879 /* Enforce zero-valued 192-bit parameters as
3880 * long as legacy SMP OOB isn't implemented.
3881 */
3882 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3883 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 3884 err = mgmt_cmd_complete(sk, hdev->id,
3885 MGMT_OP_ADD_REMOTE_OOB_DATA,
3886 MGMT_STATUS_INVALID_PARAMS,
3887 addr, sizeof(*addr));
d25b78e2
JH		 3888 goto unlock;
3889 }
3890
86df9200
JH		 3891 rand192 = NULL;
3892 hash192 = NULL;
3893 } else {
41bcfd50
MH		 3894 /* In case one of the P-192 values is set to zero,
3895 * then just disable OOB data for P-192.
3896 */
3897 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3898 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3899 rand192 = NULL;
3900 hash192 = NULL;
3901 } else {
3902 rand192 = cp->rand192;
3903 hash192 = cp->hash192;
3904 }
3905 }
3906
3907 /* In case one of the P-256 values is set to zero, then just
3908 * disable OOB data for P-256.
3909 */
3910 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3911 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3912 rand256 = NULL;
3913 hash256 = NULL;
3914 } else {
3915 rand256 = cp->rand256;
3916 hash256 = cp->hash256;
86df9200
JH		 3917 }
3918
81328d5c 3919 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 3920 cp->addr.type, hash192, rand192,
41bcfd50 3921 hash256, rand256);
ec109113
MH		 3922 if (err < 0)
3923 status = MGMT_STATUS_FAILED;
3924 else
3925 status = MGMT_STATUS_SUCCESS;
3926
2a1afb5a
JH		 3927 err = mgmt_cmd_complete(sk, hdev->id,
3928 MGMT_OP_ADD_REMOTE_OOB_DATA,
3929 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 3930 } else {
3931 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 3932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3933 MGMT_STATUS_INVALID_PARAMS);
ec109113 3934 }
2763eda6 3935
c19a495c 3936unlock:
09fd0de5 3937 hci_dev_unlock(hdev);
2763eda6
SJ		 3938 return err;
3939}
3940
bdb6d971 3941static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3942 void *data, u16 len)
2763eda6 3943{
650f726d 3944 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3945 u8 status;
2763eda6
SJ		 3946 int err;
3947
bdb6d971 3948 BT_DBG("%s", hdev->name);
2763eda6 3949
c19a495c 3950 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 3951 return mgmt_cmd_complete(sk, hdev->id,
3952 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3953 MGMT_STATUS_INVALID_PARAMS,
3954 &cp->addr, sizeof(cp->addr));
c19a495c 3955
09fd0de5 3956 hci_dev_lock(hdev);
2763eda6 3957
eedbd581
JH		 3958 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3959 hci_remote_oob_data_clear(hdev);
3960 status = MGMT_STATUS_SUCCESS;
3961 goto done;
3962 }
3963
6928a924 3964 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 3965 if (err < 0)
bf1e3541 3966 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3967 else
a6785be2 3968 status = MGMT_STATUS_SUCCESS;
bf1e3541 3969
eedbd581 3970done:
2a1afb5a
JH		 3971 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3972 status, &cp->addr, sizeof(cp->addr));
2763eda6 3973
09fd0de5 3974 hci_dev_unlock(hdev);
2763eda6
SJ		 3975 return err;
3976}
3977
812abb13 3978static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 3979{
8019044d 3980 struct hci_dev *hdev = req->hdev;
812abb13 3981 struct hci_cp_inquiry cp;
8019044d
MH		 3982 /* General inquiry access code (GIAC) */
3983 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 3984
3985 *status = mgmt_bredr_support(hdev);
3986 if (*status)
3987 return false;
3988
3989 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3990 *status = MGMT_STATUS_BUSY;
3991 return false;
3992 }
3993
3994 hci_inquiry_cache_flush(hdev);
3995
3996 memset(&cp, 0, sizeof(cp));
3997 memcpy(&cp.lap, lap, sizeof(cp.lap));
3998 cp.length = DISCOV_BREDR_INQUIRY_LEN;
3999
4000 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4001
4002 return true;
4003}
4004
4005static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4006{
4007 struct hci_dev *hdev = req->hdev;
4008 struct hci_cp_le_set_scan_param param_cp;
4009 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 4010 u8 own_addr_type;
41dc2bd6
AG		 4011 int err;
4012
812abb13
JP		 4013 *status = mgmt_le_support(hdev);
4014 if (*status)
4015 return false;
41dc2bd6 4016
812abb13
JP		 4017 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4018 /* Don't let discovery abort an outgoing connection attempt
4019 * that's using directed advertising.
4020 */
4021 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4022 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 4023 return false;
4024 }
41dc2bd6 4025
812abb13
JP		 4026 disable_advertising(req);
4027 }
41dc2bd6 4028
812abb13
JP		 4029 /* If controller is scanning, it means the background scanning is
4030 * running. Thus, we should temporarily stop it in order to set the
4031 * discovery scanning parameters.
4032 */
4033 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4034 hci_req_add_le_scan_disable(req);
41dc2bd6 4035
812abb13
JP		 4036 /* All active scans will be done with either a resolvable private
4037 * address (when privacy feature has been enabled) or non-resolvable
4038 * private address.
4039 */
4040 err = hci_update_random_address(req, true, &own_addr_type);
4041 if (err < 0) {
4042 *status = MGMT_STATUS_FAILED;
4043 return false;
4044 }
8019044d 4045
812abb13
JP		 4046 memset(&param_cp, 0, sizeof(param_cp));
4047 param_cp.type = LE_SCAN_ACTIVE;
4048 param_cp.interval = cpu_to_le16(interval);
4049 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4050 param_cp.own_address_type = own_addr_type;
8019044d 4051
812abb13
JP		 4052 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4053 &param_cp);
8019044d 4054
812abb13
JP		 4055 memset(&enable_cp, 0, sizeof(enable_cp));
4056 enable_cp.enable = LE_SCAN_ENABLE;
4057 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 4058
812abb13
JP		 4059 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4060 &enable_cp);
4061
4062 return true;
4063}
8019044d 4064
812abb13
JP		 4065static bool trigger_discovery(struct hci_request *req, u8 *status)
4066{
4067 struct hci_dev *hdev = req->hdev;
8019044d 4068
812abb13
JP		 4069 switch (hdev->discovery.type) {
4070 case DISCOV_TYPE_BREDR:
4071 if (!trigger_bredr_inquiry(req, status))
4072 return false;
4073 break;
4074
4075 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4076 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4077 &hdev->quirks)) {
4078 /* During simultaneous discovery, we double LE scan
4079 * interval. We must leave some time for the controller
4080 * to do BR/EDR inquiry.
4081 */
4082 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4083 status))
4084 return false;
4085
4086 if (!trigger_bredr_inquiry(req, status))
4087 return false;
4088
4089 return true;
4090 }
4091
812abb13
JP		 4092 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4093 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 4094 return false;
4095 }
812abb13 4096 /* fall through */
8019044d 4097
812abb13
JP		 4098 case DISCOV_TYPE_LE:
4099 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4100 return false;
8019044d
MH		 4101 break;
4102
4103 default:
4104 *status = MGMT_STATUS_INVALID_PARAMS;
4105 return false;
4106 }
4107
4108 return true;
41dc2bd6
AG		 4109}
4110
1904a853
MH		 4111static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4112 u16 opcode)
7c307720 4113{
3b0602cd 4114 struct mgmt_pending_cmd *cmd;
11e6e25d 4115 unsigned long timeout;
ae55f598 4116
7c307720
AG		 4117 BT_DBG("status %d", status);
4118
11e6e25d 4119 hci_dev_lock(hdev);
41dc2bd6 4120
333ae95d 4121 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 4122 if (!cmd)
333ae95d 4123 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 4124
11e6e25d 4125 if (cmd) {
2922a94f 4126 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 4127 mgmt_pending_remove(cmd);
4128 }
7c307720
AG		 4129
4130 if (status) {
11e6e25d
MH		 4131 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4132 goto unlock;
7c307720
AG		 4133 }
4134
7c307720 4135 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 4136
2d28cfe7
JP		 4137 /* If the scan involves LE scan, pick proper timeout to schedule
4138 * hdev->le_scan_disable that will stop it.
4139 */
7c307720
AG		 4140 switch (hdev->discovery.type) {
4141 case DISCOV_TYPE_LE:
3d5a76f0 4142 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 4143 break;
7c307720 4144 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4145 /* When running simultaneous discovery, the LE scanning time
4146 * should occupy the whole discovery time sine BR/EDR inquiry
4147 * and LE scanning are scheduled by the controller.
4148 *
4149 * For interleaving discovery in comparison, BR/EDR inquiry
4150 * and LE scanning are done sequentially with separate
4151 * timeouts.
4152 */
4153 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4154 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4155 else
4156 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 4157 break;
7c307720 4158 case DISCOV_TYPE_BREDR:
11e6e25d 4159 timeout = 0;
7c307720 4160 break;
7c307720
AG		 4161 default:
4162 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 4163 timeout = 0;
4164 break;
7c307720 4165 }
ae55f598 4166
2d28cfe7
JP		 4167 if (timeout) {
4168 /* When service discovery is used and the controller has
4169 * a strict duplicate filter, it is important to remember
4170 * the start and duration of the scan. This is required
4171 * for restarting scanning during the discovery phase.
4172 */
4173 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4174 &hdev->quirks) &&
82f8b651 4175 hdev->discovery.result_filtering) {
2d28cfe7
JP		 4176 hdev->discovery.scan_start = jiffies;
4177 hdev->discovery.scan_duration = timeout;
4178 }
4179
11e6e25d
MH		 4180 queue_delayed_work(hdev->workqueue,
4181 &hdev->le_scan_disable, timeout);
2d28cfe7 4182 }
ae55f598 4183
11e6e25d
MH		 4184unlock:
4185 hci_dev_unlock(hdev);
7c307720
AG		 4186}
4187
bdb6d971 4188static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 4189 void *data, u16 len)
14a53664 4190{
650f726d 4191 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 4192 struct mgmt_pending_cmd *cmd;
7c307720 4193 struct hci_request req;
8019044d 4194 u8 status;
14a53664
JH		 4195 int err;
4196
bdb6d971 4197 BT_DBG("%s", hdev->name);
14a53664 4198
09fd0de5 4199 hci_dev_lock(hdev);
14a53664 4200
4b34ee78 4201 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4202 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4203 MGMT_STATUS_NOT_POWERED,
4204 &cp->type, sizeof(cp->type));
bd2d1334
JH		 4205 goto failed;
4206 }
4207
f5a969f2 4208 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4209 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4210 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4211 MGMT_STATUS_BUSY, &cp->type,
4212 sizeof(cp->type));
642be6c7
AG		 4213 goto failed;
4214 }
4215
2922a94f 4216 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 4217 if (!cmd) {
4218 err = -ENOMEM;
4219 goto failed;
4220 }
4221
2922a94f
JH		 4222 cmd->cmd_complete = generic_cmd_complete;
4223
22078800
MH		 4224 /* Clear the discovery filter first to free any previously
4225 * allocated memory for the UUID list.
4226 */
4227 hci_discovery_filter_clear(hdev);
4228
4aab14e5 4229 hdev->discovery.type = cp->type;
da25cf6a 4230 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4231
7c307720
AG		 4232 hci_req_init(&req, hdev);
4233
8019044d 4234 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4235 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4236 status, &cp->type, sizeof(cp->type));
04106755
JH		 4237 mgmt_pending_remove(cmd);
4238 goto failed;
f39799f5 4239 }
04106755 4240
7c307720 4241 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4242 if (err < 0) {
14a53664 4243 mgmt_pending_remove(cmd);
f5a969f2
MH		 4244 goto failed;
4245 }
7c307720 4246
f5a969f2 4247 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4248
14a53664 4249failed:
09fd0de5 4250 hci_dev_unlock(hdev);
14a53664
JH		 4251 return err;
4252}
f39799f5 4253
3b0602cd
JH		 4254static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4255 u8 status)
2922a94f 4256{
2a1afb5a
JH		 4257 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4258 cmd->param, 1);
2922a94f 4259}
04106755 4260
66ea9427
JP		 4261static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4262 void *data, u16 len)
4263{
4264 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4265 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4266 struct hci_request req;
4267 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4268 u16 uuid_count, expected_len;
4269 u8 status;
4270 int err;
04106755 4271
66ea9427 4272 BT_DBG("%s", hdev->name);
e8bb6b97 4273
66ea9427 4274 hci_dev_lock(hdev);
7c307720 4275
66ea9427 4276 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4277 err = mgmt_cmd_complete(sk, hdev->id,
4278 MGMT_OP_START_SERVICE_DISCOVERY,
4279 MGMT_STATUS_NOT_POWERED,
4280 &cp->type, sizeof(cp->type));
66ea9427
JP		 4281 goto failed;
4282 }
7c307720 4283
66ea9427 4284 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4285 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4286 err = mgmt_cmd_complete(sk, hdev->id,
4287 MGMT_OP_START_SERVICE_DISCOVERY,
4288 MGMT_STATUS_BUSY, &cp->type,
4289 sizeof(cp->type));
66ea9427
JP		 4290 goto failed;
4291 }
d9483943 4292
66ea9427
JP		 4293 uuid_count = __le16_to_cpu(cp->uuid_count);
4294 if (uuid_count > max_uuid_count) {
4295 BT_ERR("service_discovery: too big uuid_count value %u",
4296 uuid_count);
2a1afb5a
JH		 4297 err = mgmt_cmd_complete(sk, hdev->id,
4298 MGMT_OP_START_SERVICE_DISCOVERY,
4299 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4300 sizeof(cp->type));
66ea9427
JP		 4301 goto failed;
4302 }
4303
4304 expected_len = sizeof(*cp) + uuid_count * 16;
4305 if (expected_len != len) {
4306 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4307 expected_len, len);
2a1afb5a
JH		 4308 err = mgmt_cmd_complete(sk, hdev->id,
4309 MGMT_OP_START_SERVICE_DISCOVERY,
4310 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4311 sizeof(cp->type));
66ea9427
JP		 4312 goto failed;
4313 }
4314
4315 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4316 hdev, data, len);
66ea9427
JP		 4317 if (!cmd) {
4318 err = -ENOMEM;
4319 goto failed;
4320 }
4321
2922a94f
JH		 4322 cmd->cmd_complete = service_discovery_cmd_complete;
4323
22078800
MH		 4324 /* Clear the discovery filter first to free any previously
4325 * allocated memory for the UUID list.
4326 */
4327 hci_discovery_filter_clear(hdev);
4328
82f8b651 4329 hdev->discovery.result_filtering = true;
66ea9427
JP		 4330 hdev->discovery.type = cp->type;
4331 hdev->discovery.rssi = cp->rssi;
4332 hdev->discovery.uuid_count = uuid_count;
4333
4334 if (uuid_count > 0) {
4335 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4336 GFP_KERNEL);
4337 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4338 err = mgmt_cmd_complete(sk, hdev->id,
4339 MGMT_OP_START_SERVICE_DISCOVERY,
4340 MGMT_STATUS_FAILED,
4341 &cp->type, sizeof(cp->type));
d9483943
JH		 4342 mgmt_pending_remove(cmd);
4343 goto failed;
4344 }
66ea9427 4345 }
d9483943 4346
66ea9427 4347 hci_req_init(&req, hdev);
5e0452c0 4348
66ea9427 4349 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4350 err = mgmt_cmd_complete(sk, hdev->id,
4351 MGMT_OP_START_SERVICE_DISCOVERY,
4352 status, &cp->type, sizeof(cp->type));
04106755
JH		 4353 mgmt_pending_remove(cmd);
4354 goto failed;
f39799f5 4355 }
3fd24153 4356
7c307720 4357 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4358 if (err < 0) {
14a53664 4359 mgmt_pending_remove(cmd);
66ea9427
JP		 4360 goto failed;
4361 }
4362
4363 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4364
4365failed:
09fd0de5 4366 hci_dev_unlock(hdev);
14a53664
JH		 4367 return err;
4368}
4369
1904a853 4370static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4371{
3b0602cd 4372 struct mgmt_pending_cmd *cmd;
1183fdca 4373
0e05bba6
AG		 4374 BT_DBG("status %d", status);
4375
4376 hci_dev_lock(hdev);
4377
333ae95d 4378 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4379 if (cmd) {
2922a94f 4380 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4381 mgmt_pending_remove(cmd);
0e05bba6
AG		 4382 }
4383
11e6e25d
MH		 4384 if (!status)
4385 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4386
0e05bba6
AG		 4387 hci_dev_unlock(hdev);
4388}
4389
bdb6d971 4390static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4391 u16 len)
14a53664 4392{
d930650b 4393 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4394 struct mgmt_pending_cmd *cmd;
0e05bba6 4395 struct hci_request req;
14a53664
JH		 4396 int err;
4397
bdb6d971 4398 BT_DBG("%s", hdev->name);
14a53664 4399
09fd0de5 4400 hci_dev_lock(hdev);
14a53664 4401
30dc78e1 4402 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4403 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4404 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4405 sizeof(mgmt_cp->type));
d930650b
JH		 4406 goto unlock;
4407 }
4408
4409 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4410 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4411 MGMT_STATUS_INVALID_PARAMS,
4412 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4413 goto unlock;
ff9ef578
JH		 4414 }
4415
2922a94f 4416 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4417 if (!cmd) {
4418 err = -ENOMEM;
30dc78e1
JH		 4419 goto unlock;
4420 }
4421
2922a94f
JH		 4422 cmd->cmd_complete = generic_cmd_complete;
4423
0e05bba6
AG		 4424 hci_req_init(&req, hdev);
4425
21a60d30 4426 hci_stop_discovery(&req);
e0d9727e 4427
21a60d30
JH		 4428 err = hci_req_run(&req, stop_discovery_complete);
4429 if (!err) {
4430 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4431 goto unlock;
14a53664
JH		 4432 }
4433
21a60d30
JH		 4434 mgmt_pending_remove(cmd);
4435
4436 /* If no HCI commands were sent we're done */
4437 if (err == -ENODATA) {
2a1afb5a
JH		 4438 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4439 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4440 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4441 }
14a53664 4442
30dc78e1 4443unlock:
09fd0de5 4444 hci_dev_unlock(hdev);
14a53664
JH		 4445 return err;
4446}
4447
bdb6d971 4448static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4449 u16 len)
561aafbc 4450{
650f726d 4451 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4452 struct inquiry_entry *e;
561aafbc
JH		 4453 int err;
4454
bdb6d971 4455 BT_DBG("%s", hdev->name);
561aafbc 4456
561aafbc
JH		 4457 hci_dev_lock(hdev);
4458
30dc78e1 4459 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4460 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4461 MGMT_STATUS_FAILED, &cp->addr,
4462 sizeof(cp->addr));
30dc78e1
JH		 4463 goto failed;
4464 }
4465
a198e7b1 4466 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4467 if (!e) {
2a1afb5a
JH		 4468 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4469 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4470 sizeof(cp->addr));
561aafbc
JH		 4471 goto failed;
4472 }
4473
4474 if (cp->name_known) {
4475 e->name_state = NAME_KNOWN;
4476 list_del(&e->list);
4477 } else {
4478 e->name_state = NAME_NEEDED;
a3d4e20a 4479 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4480 }
4481
2a1afb5a
JH		 4482 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4483 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4484
4485failed:
4486 hci_dev_unlock(hdev);
561aafbc
JH		 4487 return err;
4488}
4489
bdb6d971 4490static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4491 u16 len)
7fbec224 4492{
650f726d 4493 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4494 u8 status;
7fbec224
AJ		 4495 int err;
4496
bdb6d971 4497 BT_DBG("%s", hdev->name);
7fbec224 4498
4ee71b20 4499 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4500 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4501 MGMT_STATUS_INVALID_PARAMS,
4502 &cp->addr, sizeof(cp->addr));
4ee71b20 4503
09fd0de5 4504 hci_dev_lock(hdev);
5e762444 4505
dcc36c16
JH		 4506 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4507 cp->addr.type);
2a8357f2 4508 if (err < 0) {
f0eeea8b 4509 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4510 goto done;
4511 }
4512
4513 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4514 sk);
4515 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4516
2a8357f2 4517done:
2a1afb5a
JH		 4518 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4519 &cp->addr, sizeof(cp->addr));
5e762444 4520
09fd0de5 4521 hci_dev_unlock(hdev);
7fbec224
AJ		 4522
4523 return err;
4524}
4525
bdb6d971 4526static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4527 u16 len)
7fbec224 4528{
650f726d 4529 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4530 u8 status;
7fbec224
AJ		 4531 int err;
4532
bdb6d971 4533 BT_DBG("%s", hdev->name);
7fbec224 4534
4ee71b20 4535 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4536 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4537 MGMT_STATUS_INVALID_PARAMS,
4538 &cp->addr, sizeof(cp->addr));
4ee71b20 4539
09fd0de5 4540 hci_dev_lock(hdev);
5e762444 4541
dcc36c16
JH		 4542 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4543 cp->addr.type);
2a8357f2 4544 if (err < 0) {
f0eeea8b 4545 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4546 goto done;
4547 }
4548
4549 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4550 sk);
4551 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4552
2a8357f2 4553done:
2a1afb5a
JH		 4554 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4555 &cp->addr, sizeof(cp->addr));
5e762444 4556
09fd0de5 4557 hci_dev_unlock(hdev);
7fbec224
AJ		 4558
4559 return err;
4560}
4561
cdbaccca
MH		 4562static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4563 u16 len)
4564{
4565 struct mgmt_cp_set_device_id *cp = data;
890ea898 4566 struct hci_request req;
cdbaccca 4567 int err;
c72d4b8a 4568 __u16 source;
cdbaccca
MH		 4569
4570 BT_DBG("%s", hdev->name);
4571
c72d4b8a
SJ		 4572 source = __le16_to_cpu(cp->source);
4573
4574 if (source > 0x0002)
a69e8375
JH		 4575 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4576 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4577
cdbaccca
MH		 4578 hci_dev_lock(hdev);
4579
c72d4b8a 4580 hdev->devid_source = source;
cdbaccca
MH		 4581 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4582 hdev->devid_product = __le16_to_cpu(cp->product);
4583 hdev->devid_version = __le16_to_cpu(cp->version);
4584
2a1afb5a
JH		 4585 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4586 NULL, 0);
cdbaccca 4587
890ea898
JH		 4588 hci_req_init(&req, hdev);
4589 update_eir(&req);
4590 hci_req_run(&req, NULL);
cdbaccca
MH		 4591
4592 hci_dev_unlock(hdev);
4593
4594 return err;
4595}
4596
24b4f38f
AU		 4597static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4598 u16 opcode)
4599{
4600 BT_DBG("status %d", status);
4601}
4602
1904a853
MH		 4603static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4604 u16 opcode)
4375f103
JH		 4605{
4606 struct cmd_lookup match = { NULL, hdev };
24b4f38f 4607 struct hci_request req;
4375f103 4608
3ad67582
JK		 4609 hci_dev_lock(hdev);
4610
4375f103
JH		 4611 if (status) {
4612 u8 mgmt_err = mgmt_status(status);
4613
4614 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4615 cmd_status_rsp, &mgmt_err);
3ad67582 4616 goto unlock;
4375f103
JH		 4617 }
4618
d7a5a11d 4619 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4620 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4621 else
a358dc11 4622 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4623
4375f103
JH		 4624 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4625 &match);
4626
4627 new_settings(hdev, match.sk);
4628
4629 if (match.sk)
4630 sock_put(match.sk);
3ad67582 4631
24b4f38f
AU		 4632 /* If "Set Advertising" was just disabled and instance advertising was
4633 * set up earlier, then enable the advertising instance.
4634 */
4635 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4636 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4637 goto unlock;
4638
4639 hci_req_init(&req, hdev);
4640
4641 update_adv_data(&req);
4642 enable_advertising(&req);
4643
4644 if (hci_req_run(&req, enable_advertising_instance) < 0)
4645 BT_ERR("Failed to re-configure advertising");
4646
3ad67582
JK		 4647unlock:
4648 hci_dev_unlock(hdev);
4375f103
JH		 4649}
4650
21b5187f
MH		 4651static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4652 u16 len)
4375f103
JH		 4653{
4654 struct mgmt_mode *cp = data;
3b0602cd 4655 struct mgmt_pending_cmd *cmd;
4375f103 4656 struct hci_request req;
cc91cb04 4657 u8 val, status;
4375f103
JH		 4658 int err;
4659
4660 BT_DBG("request for %s", hdev->name);
4661
e6fe7986
JH		 4662 status = mgmt_le_support(hdev);
4663 if (status)
a69e8375
JH		 4664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4665 status);
4375f103 4666
cc91cb04 4667 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4669 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4670
4671 hci_dev_lock(hdev);
4672
4673 val = !!cp->val;
4375f103 4674
f74ca9b8
JH		 4675 /* The following conditions are ones which mean that we should
4676 * not do any HCI communication but directly send a mgmt
4677 * response to user space (after toggling the flag if
4678 * necessary).
4679 */
cc91cb04 4680 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4681 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4682 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4683 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4684 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4685 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4686 bool changed;
4375f103 4687
cc91cb04 4688 if (cp->val) {
238be788 4689 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4690 if (cp->val == 0x02)
a1536da2 4691 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4692 else
a358dc11 4693 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4694 } else {
a69d8927 4695 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4696 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4697 }
4698
4699 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4700 if (err < 0)
4701 goto unlock;
4702
4703 if (changed)
4704 err = new_settings(hdev, sk);
4705
4706 goto unlock;
4707 }
4708
333ae95d
JH		 4709 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4710 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4711 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4712 MGMT_STATUS_BUSY);
4375f103
JH		 4713 goto unlock;
4714 }
4715
4716 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4717 if (!cmd) {
4718 err = -ENOMEM;
4719 goto unlock;
4720 }
4721
4722 hci_req_init(&req, hdev);
4723
cc91cb04 4724 if (cp->val == 0x02)
a1536da2 4725 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4726 else
a358dc11 4727 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4728
24b4f38f
AU		 4729 if (val) {
4730 /* Switch to instance "0" for the Set Advertising setting. */
4731 update_adv_data_for_instance(&req, 0);
4117ed70 4732 update_scan_rsp_data_for_instance(&req, 0);
bba3aa55 4733 enable_advertising(&req);
24b4f38f 4734 } else {
bba3aa55 4735 disable_advertising(&req);
24b4f38f 4736 }
4375f103
JH		 4737
4738 err = hci_req_run(&req, set_advertising_complete);
4739 if (err < 0)
4740 mgmt_pending_remove(cmd);
4741
4742unlock:
4743 hci_dev_unlock(hdev);
4744 return err;
4745}
4746
d13eafce
MH		 4747static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4748 void *data, u16 len)
4749{
4750 struct mgmt_cp_set_static_address *cp = data;
4751 int err;
4752
4753 BT_DBG("%s", hdev->name);
4754
62af4443 4755 if (!lmp_le_capable(hdev))
a69e8375
JH		 4756 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4757 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4758
4759 if (hdev_is_powered(hdev))
a69e8375
JH		 4760 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4761 MGMT_STATUS_REJECTED);
d13eafce
MH		 4762
4763 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4764 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4765 return mgmt_cmd_status(sk, hdev->id,
4766 MGMT_OP_SET_STATIC_ADDRESS,
4767 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4768
4769 /* Two most significant bits shall be set */
4770 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4771 return mgmt_cmd_status(sk, hdev->id,
4772 MGMT_OP_SET_STATIC_ADDRESS,
4773 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4774 }
4775
4776 hci_dev_lock(hdev);
4777
4778 bacpy(&hdev->static_addr, &cp->bdaddr);
4779
93690c22
MH		 4780 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4781 if (err < 0)
4782 goto unlock;
4783
4784 err = new_settings(hdev, sk);
d13eafce 4785
93690c22 4786unlock:
d13eafce 4787 hci_dev_unlock(hdev);
d13eafce
MH		 4788 return err;
4789}
4790
14b49b9a
MH		 4791static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4792 void *data, u16 len)
4793{
4794 struct mgmt_cp_set_scan_params *cp = data;
4795 __u16 interval, window;
4796 int err;
4797
4798 BT_DBG("%s", hdev->name);
4799
4800 if (!lmp_le_capable(hdev))
a69e8375
JH		 4801 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4802 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 4803
4804 interval = __le16_to_cpu(cp->interval);
4805
4806 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 4807 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4808 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 4809
4810 window = __le16_to_cpu(cp->window);
4811
4812 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 4813 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4814 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 4815
899e1075 4816 if (window > interval)
a69e8375
JH		 4817 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4818 MGMT_STATUS_INVALID_PARAMS);
899e1075 4819
14b49b9a
MH		 4820 hci_dev_lock(hdev);
4821
4822 hdev->le_scan_interval = interval;
4823 hdev->le_scan_window = window;
4824
2a1afb5a
JH		 4825 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4826 NULL, 0);
14b49b9a 4827
dd2ef8e2
AG		 4828 /* If background scan is running, restart it so new parameters are
4829 * loaded.
4830 */
d7a5a11d 4831 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 4832 hdev->discovery.state == DISCOVERY_STOPPED) {
4833 struct hci_request req;
4834
4835 hci_req_init(&req, hdev);
4836
4837 hci_req_add_le_scan_disable(&req);
4838 hci_req_add_le_passive_scan(&req);
4839
4840 hci_req_run(&req, NULL);
4841 }
4842
14b49b9a
MH		 4843 hci_dev_unlock(hdev);
4844
4845 return err;
4846}
4847
1904a853
MH		 4848static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4849 u16 opcode)
33e38b3e 4850{
3b0602cd 4851 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 4852
4853 BT_DBG("status 0x%02x", status);
4854
4855 hci_dev_lock(hdev);
4856
333ae95d 4857 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 4858 if (!cmd)
4859 goto unlock;
4860
4861 if (status) {
a69e8375
JH		 4862 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4863 mgmt_status(status));
33e38b3e 4864 } else {
1a4d3c4b
JH		 4865 struct mgmt_mode *cp = cmd->param;
4866
4867 if (cp->val)
a1536da2 4868 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 4869 else
a358dc11 4870 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 4871
33e38b3e
JH		 4872 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4873 new_settings(hdev, cmd->sk);
4874 }
4875
4876 mgmt_pending_remove(cmd);
4877
4878unlock:
4879 hci_dev_unlock(hdev);
4880}
4881
bdb6d971 4882static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 4883 void *data, u16 len)
f6422ec6 4884{
650f726d 4885 struct mgmt_mode *cp = data;
3b0602cd 4886 struct mgmt_pending_cmd *cmd;
33e38b3e 4887 struct hci_request req;
f6422ec6
AJ		 4888 int err;
4889
bdb6d971 4890 BT_DBG("%s", hdev->name);
f6422ec6 4891
d7a5a11d 4892 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 4893 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 4894 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4895 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 4896
a7e80f25 4897 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 4898 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4899 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 4900
f6422ec6
AJ		 4901 hci_dev_lock(hdev);
4902
333ae95d 4903 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 4904 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4905 MGMT_STATUS_BUSY);
05cbf29f
JH		 4906 goto unlock;
4907 }
4908
d7a5a11d 4909 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 4910 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4911 hdev);
4912 goto unlock;
4913 }
4914
406ef2a6 4915 if (!hdev_is_powered(hdev)) {
ce05d603 4916 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 4917 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4918 hdev);
4919 new_settings(hdev, sk);
4920 goto unlock;
4921 }
4922
33e38b3e
JH		 4923 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4924 data, len);
4925 if (!cmd) {
4926 err = -ENOMEM;
4927 goto unlock;
f6422ec6
AJ		 4928 }
4929
33e38b3e
JH		 4930 hci_req_init(&req, hdev);
4931
406d7804 4932 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 4933
4934 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 4935 if (err < 0) {
a69e8375
JH		 4936 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4937 MGMT_STATUS_FAILED);
33e38b3e 4938 mgmt_pending_remove(cmd);
f6422ec6
AJ		 4939 }
4940
33e38b3e 4941unlock:
f6422ec6 4942 hci_dev_unlock(hdev);
33e38b3e 4943
f6422ec6
AJ		 4944 return err;
4945}
4946
1904a853 4947static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 4948{
3b0602cd 4949 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 4950
4951 BT_DBG("status 0x%02x", status);
4952
4953 hci_dev_lock(hdev);
4954
333ae95d 4955 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 4956 if (!cmd)
4957 goto unlock;
4958
4959 if (status) {
4960 u8 mgmt_err = mgmt_status(status);
4961
4962 /* We need to restore the flag if related HCI commands
4963 * failed.
4964 */
a358dc11 4965 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 4966
a69e8375 4967 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 4968 } else {
4969 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4970 new_settings(hdev, cmd->sk);
4971 }
4972
4973 mgmt_pending_remove(cmd);
4974
4975unlock:
4976 hci_dev_unlock(hdev);
4977}
4978
4979static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4980{
4981 struct mgmt_mode *cp = data;
3b0602cd 4982 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 4983 struct hci_request req;
4984 int err;
4985
4986 BT_DBG("request for %s", hdev->name);
4987
4988 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 4989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4990 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 4991
d7a5a11d 4992 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 4993 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4994 MGMT_STATUS_REJECTED);
0663ca2a
JH		 4995
4996 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 4997 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4998 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 4999
5000 hci_dev_lock(hdev);
5001
d7a5a11d 5002 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 5003 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5004 goto unlock;
5005 }
5006
5007 if (!hdev_is_powered(hdev)) {
5008 if (!cp->val) {
a358dc11
MH		 5009 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5010 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5011 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5012 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5013 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 5014 }
5015
ce05d603 5016 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5017
5018 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5019 if (err < 0)
5020 goto unlock;
5021
5022 err = new_settings(hdev, sk);
5023 goto unlock;
5024 }
5025
5026 /* Reject disabling when powered on */
5027 if (!cp->val) {
a69e8375
JH		 5028 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5029 MGMT_STATUS_REJECTED);
0663ca2a 5030 goto unlock;
111e4bcc
MH		 5031 } else {
5032 /* When configuring a dual-mode controller to operate
5033 * with LE only and using a static address, then switching
5034 * BR/EDR back on is not allowed.
5035 *
5036 * Dual-mode controllers shall operate with the public
5037 * address as its identity address for BR/EDR and LE. So
5038 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 5039 *
5040 * The same restrictions applies when secure connections
5041 * has been enabled. For BR/EDR this is a controller feature
5042 * while for LE it is a host stack feature. This means that
5043 * switching BR/EDR back on when secure connections has been
5044 * enabled is not a supported transaction.
111e4bcc 5045 */
d7a5a11d 5046 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 5047 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 5048 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 5049 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5050 MGMT_STATUS_REJECTED);
111e4bcc
MH		 5051 goto unlock;
5052 }
0663ca2a
JH		 5053 }
5054
333ae95d 5055 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 5056 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5057 MGMT_STATUS_BUSY);
0663ca2a
JH		 5058 goto unlock;
5059 }
5060
5061 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5062 if (!cmd) {
5063 err = -ENOMEM;
5064 goto unlock;
5065 }
5066
5947f4bc 5067 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 5068 * generates the correct flags.
5069 */
a1536da2 5070 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5071
5072 hci_req_init(&req, hdev);
aa8af46e 5073
432df05e 5074 write_fast_connectable(&req, false);
1d2dc5b7 5075 __hci_update_page_scan(&req);
aa8af46e 5076
f14d8f64
MH		 5077 /* Since only the advertising data flags will change, there
5078 * is no need to update the scan response data.
5079 */
5947f4bc 5080 update_adv_data(&req);
aa8af46e 5081
0663ca2a
JH		 5082 err = hci_req_run(&req, set_bredr_complete);
5083 if (err < 0)
5084 mgmt_pending_remove(cmd);
5085
5086unlock:
5087 hci_dev_unlock(hdev);
5088 return err;
5089}
5090
a1443f5a
JH		 5091static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5092{
3b0602cd 5093 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 5094 struct mgmt_mode *cp;
5095
5096 BT_DBG("%s status %u", hdev->name, status);
5097
5098 hci_dev_lock(hdev);
5099
333ae95d 5100 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 5101 if (!cmd)
5102 goto unlock;
5103
5104 if (status) {
a69e8375
JH		 5105 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5106 mgmt_status(status));
a1443f5a
JH		 5107 goto remove;
5108 }
5109
5110 cp = cmd->param;
5111
5112 switch (cp->val) {
5113 case 0x00:
a358dc11
MH		 5114 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5115 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5116 break;
5117 case 0x01:
a1536da2 5118 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 5119 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5120 break;
5121 case 0x02:
a1536da2
MH		 5122 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5123 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5124 break;
5125 }
5126
5127 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5128 new_settings(hdev, cmd->sk);
5129
5130remove:
5131 mgmt_pending_remove(cmd);
5132unlock:
5133 hci_dev_unlock(hdev);
5134}
5135
eac83dc6
MH		 5136static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5137 void *data, u16 len)
5138{
5139 struct mgmt_mode *cp = data;
3b0602cd 5140 struct mgmt_pending_cmd *cmd;
a1443f5a 5141 struct hci_request req;
a3209694 5142 u8 val;
eac83dc6
MH		 5143 int err;
5144
5145 BT_DBG("request for %s", hdev->name);
5146
05b3c3e7 5147 if (!lmp_sc_capable(hdev) &&
d7a5a11d 5148 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5149 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5150 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 5151
d7a5a11d 5152 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 5153 lmp_sc_capable(hdev) &&
d7a5a11d 5154 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 5155 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5156 MGMT_STATUS_REJECTED);
ed93ec69 5157
0ab04a9c 5158 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 5159 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 5160 MGMT_STATUS_INVALID_PARAMS);
5161
5162 hci_dev_lock(hdev);
5163
05b3c3e7 5164 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 5165 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 5166 bool changed;
5167
0ab04a9c 5168 if (cp->val) {
238be788
MH		 5169 changed = !hci_dev_test_and_set_flag(hdev,
5170 HCI_SC_ENABLED);
0ab04a9c 5171 if (cp->val == 0x02)
a1536da2 5172 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5173 else
a358dc11 5174 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5175 } else {
a69d8927
MH		 5176 changed = hci_dev_test_and_clear_flag(hdev,
5177 HCI_SC_ENABLED);
a358dc11 5178 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5179 }
eac83dc6
MH		 5180
5181 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5182 if (err < 0)
5183 goto failed;
5184
5185 if (changed)
5186 err = new_settings(hdev, sk);
5187
5188 goto failed;
5189 }
5190
333ae95d 5191 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 5192 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5193 MGMT_STATUS_BUSY);
eac83dc6
MH		 5194 goto failed;
5195 }
5196
0ab04a9c
MH		 5197 val = !!cp->val;
5198
d7a5a11d
MH		 5199 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5200 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 5201 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5202 goto failed;
5203 }
5204
5205 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5206 if (!cmd) {
5207 err = -ENOMEM;
5208 goto failed;
5209 }
5210
a1443f5a
JH		 5211 hci_req_init(&req, hdev);
5212 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5213 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 5214 if (err < 0) {
5215 mgmt_pending_remove(cmd);
5216 goto failed;
5217 }
5218
5219failed:
5220 hci_dev_unlock(hdev);
5221 return err;
5222}
5223
4e39ac81
MH		 5224static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5225 void *data, u16 len)
5226{
5227 struct mgmt_mode *cp = data;
b9710979 5228 bool changed, use_changed;
4e39ac81
MH		 5229 int err;
5230
5231 BT_DBG("request for %s", hdev->name);
5232
b9710979 5233 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 5234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5235 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 5236
5237 hci_dev_lock(hdev);
5238
5239 if (cp->val)
238be788 5240 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 5241 else
a69d8927
MH		 5242 changed = hci_dev_test_and_clear_flag(hdev,
5243 HCI_KEEP_DEBUG_KEYS);
4e39ac81 5244
b9710979 5245 if (cp->val == 0x02)
238be788
MH		 5246 use_changed = !hci_dev_test_and_set_flag(hdev,
5247 HCI_USE_DEBUG_KEYS);
b9710979 5248 else
a69d8927
MH		 5249 use_changed = hci_dev_test_and_clear_flag(hdev,
5250 HCI_USE_DEBUG_KEYS);
b9710979
JH		 5251
5252 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 5253 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 5254 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5255 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5256 sizeof(mode), &mode);
5257 }
5258
4e39ac81
MH		 5259 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5260 if (err < 0)
5261 goto unlock;
5262
5263 if (changed)
5264 err = new_settings(hdev, sk);
5265
5266unlock:
5267 hci_dev_unlock(hdev);
5268 return err;
5269}
5270
62b04cd1
JH		 5271static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5272 u16 len)
5273{
5274 struct mgmt_cp_set_privacy *cp = cp_data;
5275 bool changed;
5276 int err;
5277
5278 BT_DBG("request for %s", hdev->name);
5279
5280 if (!lmp_le_capable(hdev))
a69e8375
JH		 5281 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5282 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5283
5284 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5285 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5286 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5287
5288 if (hdev_is_powered(hdev))
a69e8375
JH		 5289 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5290 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5291
5292 hci_dev_lock(hdev);
5293
c21c0ea0
JH		 5294 /* If user space supports this command it is also expected to
5295 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5296 */
a1536da2 5297 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5298
62b04cd1 5299 if (cp->privacy) {
238be788 5300 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5301 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5302 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5303 } else {
a69d8927 5304 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5305 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5306 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5307 }
5308
5309 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5310 if (err < 0)
5311 goto unlock;
5312
5313 if (changed)
5314 err = new_settings(hdev, sk);
5315
5316unlock:
5317 hci_dev_unlock(hdev);
5318 return err;
5319}
5320
41edf160
JH		 5321static bool irk_is_valid(struct mgmt_irk_info *irk)
5322{
5323 switch (irk->addr.type) {
5324 case BDADDR_LE_PUBLIC:
5325 return true;
5326
5327 case BDADDR_LE_RANDOM:
5328 /* Two most significant bits shall be set */
5329 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5330 return false;
5331 return true;
5332 }
5333
5334 return false;
5335}
5336
5337static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5338 u16 len)
5339{
5340 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5341 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5342 sizeof(struct mgmt_irk_info));
41edf160
JH		 5343 u16 irk_count, expected_len;
5344 int i, err;
5345
5346 BT_DBG("request for %s", hdev->name);
5347
5348 if (!lmp_le_capable(hdev))
a69e8375
JH		 5349 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5350 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5351
5352 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5353 if (irk_count > max_irk_count) {
5354 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5355 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5356 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5357 }
41edf160
JH		 5358
5359 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5360 if (expected_len != len) {
5361 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5362 expected_len, len);
a69e8375
JH		 5363 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5364 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5365 }
5366
5367 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5368
5369 for (i = 0; i < irk_count; i++) {
5370 struct mgmt_irk_info *key = &cp->irks[i];
5371
5372 if (!irk_is_valid(key))
a69e8375
JH		 5373 return mgmt_cmd_status(sk, hdev->id,
5374 MGMT_OP_LOAD_IRKS,
5375 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5376 }
5377
5378 hci_dev_lock(hdev);
5379
5380 hci_smp_irks_clear(hdev);
5381
5382 for (i = 0; i < irk_count; i++) {
5383 struct mgmt_irk_info *irk = &cp->irks[i];
5384 u8 addr_type;
5385
5386 if (irk->addr.type == BDADDR_LE_PUBLIC)
5387 addr_type = ADDR_LE_DEV_PUBLIC;
5388 else
5389 addr_type = ADDR_LE_DEV_RANDOM;
5390
5391 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5392 BDADDR_ANY);
5393 }
5394
a1536da2 5395 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5396
2a1afb5a 5397 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5398
5399 hci_dev_unlock(hdev);
5400
5401 return err;
5402}
5403
3f706b72
JH		 5404static bool ltk_is_valid(struct mgmt_ltk_info *key)
5405{
5406 if (key->master != 0x00 && key->master != 0x01)
5407 return false;
490cb0b3
MH		 5408
5409 switch (key->addr.type) {
5410 case BDADDR_LE_PUBLIC:
5411 return true;
5412
5413 case BDADDR_LE_RANDOM:
5414 /* Two most significant bits shall be set */
5415 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5416 return false;
5417 return true;
5418 }
5419
5420 return false;
3f706b72
JH		 5421}
5422
bdb6d971 5423static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5424 void *cp_data, u16 len)
346af67b 5425{
346af67b 5426 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5427 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5428 sizeof(struct mgmt_ltk_info));
346af67b 5429 u16 key_count, expected_len;
715a5bf2 5430 int i, err;
346af67b 5431
cf99ba13
MH		 5432 BT_DBG("request for %s", hdev->name);
5433
5434 if (!lmp_le_capable(hdev))
a69e8375
JH		 5435 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5436 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5437
1f350c87 5438 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5439 if (key_count > max_key_count) {
5440 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5441 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5442 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5443 }
346af67b
VCG		 5444
5445 expected_len = sizeof(*cp) + key_count *
5446 sizeof(struct mgmt_ltk_info);
5447 if (expected_len != len) {
5448 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5449 expected_len, len);
a69e8375
JH		 5450 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5451 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5452 }
5453
bdb6d971 5454 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5455
54ad6d8a
JH		 5456 for (i = 0; i < key_count; i++) {
5457 struct mgmt_ltk_info *key = &cp->keys[i];
5458
3f706b72 5459 if (!ltk_is_valid(key))
a69e8375
JH		 5460 return mgmt_cmd_status(sk, hdev->id,
5461 MGMT_OP_LOAD_LONG_TERM_KEYS,
5462 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5463 }
5464
346af67b
VCG		 5465 hci_dev_lock(hdev);
5466
5467 hci_smp_ltks_clear(hdev);
5468
5469 for (i = 0; i < key_count; i++) {
5470 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5471 u8 type, addr_type, authenticated;
79d95a19
MH		 5472
5473 if (key->addr.type == BDADDR_LE_PUBLIC)
5474 addr_type = ADDR_LE_DEV_PUBLIC;
5475 else
5476 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5477
61b43357
JH		 5478 switch (key->type) {
5479 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5480 authenticated = 0x00;
23fb8de3 5481 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5482 break;
5483 case MGMT_LTK_AUTHENTICATED:
d7b25450 5484 authenticated = 0x01;
23fb8de3
JH		 5485 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5486 break;
5487 case MGMT_LTK_P256_UNAUTH:
5488 authenticated = 0x00;
5489 type = SMP_LTK_P256;
61b43357 5490 break;
23fb8de3
JH		 5491 case MGMT_LTK_P256_AUTH:
5492 authenticated = 0x01;
5493 type = SMP_LTK_P256;
61b43357 5494 break;
23fb8de3
JH		 5495 case MGMT_LTK_P256_DEBUG:
5496 authenticated = 0x00;
5497 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5498 default:
5499 continue;
5500 }
d7b25450 5501
35d70271 5502 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5503 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5504 key->rand);
346af67b
VCG		 5505 }
5506
2a1afb5a 5507 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5508 NULL, 0);
5509
346af67b 5510 hci_dev_unlock(hdev);
346af67b 5511
715a5bf2 5512 return err;
346af67b
VCG		 5513}
5514
3b0602cd 5515static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5516{
dd983808 5517 struct hci_conn *conn = cmd->user_data;
9981bdb0 5518 struct mgmt_rp_get_conn_info rp;
9df74653 5519 int err;
dd983808 5520
9981bdb0 5521 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5522
9981bdb0 5523 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5524 rp.rssi = conn->rssi;
9981bdb0
JH		 5525 rp.tx_power = conn->tx_power;
5526 rp.max_tx_power = conn->max_tx_power;
5527 } else {
5528 rp.rssi = HCI_RSSI_INVALID;
5529 rp.tx_power = HCI_TX_POWER_INVALID;
5530 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5531 }
5532
2a1afb5a
JH		 5533 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5534 status, &rp, sizeof(rp));
dd983808
AK		 5535
5536 hci_conn_drop(conn);
f8aaf9b6 5537 hci_conn_put(conn);
9df74653
JH		 5538
5539 return err;
dd983808
AK		 5540}
5541
1904a853
MH		 5542static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5543 u16 opcode)
dd983808
AK		 5544{
5545 struct hci_cp_read_rssi *cp;
3b0602cd 5546 struct mgmt_pending_cmd *cmd;
dd983808 5547 struct hci_conn *conn;
dd983808 5548 u16 handle;
9981bdb0 5549 u8 status;
dd983808 5550
9981bdb0 5551 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5552
5553 hci_dev_lock(hdev);
5554
dd983808
AK		 5555 /* Commands sent in request are either Read RSSI or Read Transmit Power
5556 * Level so we check which one was last sent to retrieve connection
5557 * handle. Both commands have handle as first parameter so it's safe to
5558 * cast data on the same command struct.
5559 *
5560 * First command sent is always Read RSSI and we fail only if it fails.
5561 * In other case we simply override error to indicate success as we
5562 * already remembered if TX power value is actually valid.
5563 */
5564 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5565 if (!cp) {
5566 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5567 status = MGMT_STATUS_SUCCESS;
5568 } else {
5569 status = mgmt_status(hci_status);
dd983808
AK		 5570 }
5571
5572 if (!cp) {
9981bdb0 5573 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5574 goto unlock;
5575 }
5576
5577 handle = __le16_to_cpu(cp->handle);
5578 conn = hci_conn_hash_lookup_handle(hdev, handle);
5579 if (!conn) {
9981bdb0 5580 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5581 goto unlock;
5582 }
5583
333ae95d 5584 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5585 if (!cmd)
5586 goto unlock;
dd983808 5587
9981bdb0
JH		 5588 cmd->cmd_complete(cmd, status);
5589 mgmt_pending_remove(cmd);
dd983808
AK		 5590
5591unlock:
5592 hci_dev_unlock(hdev);
5593}
5594
5595static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5596 u16 len)
5597{
5598 struct mgmt_cp_get_conn_info *cp = data;
5599 struct mgmt_rp_get_conn_info rp;
5600 struct hci_conn *conn;
5601 unsigned long conn_info_age;
5602 int err = 0;
5603
5604 BT_DBG("%s", hdev->name);
5605
5606 memset(&rp, 0, sizeof(rp));
5607 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5608 rp.addr.type = cp->addr.type;
5609
5610 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5611 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5612 MGMT_STATUS_INVALID_PARAMS,
5613 &rp, sizeof(rp));
dd983808
AK		 5614
5615 hci_dev_lock(hdev);
5616
5617 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5618 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5619 MGMT_STATUS_NOT_POWERED, &rp,
5620 sizeof(rp));
dd983808
AK		 5621 goto unlock;
5622 }
5623
5624 if (cp->addr.type == BDADDR_BREDR)
5625 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5626 &cp->addr.bdaddr);
5627 else
5628 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5629
5630 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5632 MGMT_STATUS_NOT_CONNECTED, &rp,
5633 sizeof(rp));
dd983808
AK		 5634 goto unlock;
5635 }
5636
333ae95d 5637 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5638 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5639 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5640 goto unlock;
5641 }
5642
dd983808
AK		 5643 /* To avoid client trying to guess when to poll again for information we
5644 * calculate conn info age as random value between min/max set in hdev.
5645 */
5646 conn_info_age = hdev->conn_info_min_age +
5647 prandom_u32_max(hdev->conn_info_max_age -
5648 hdev->conn_info_min_age);
5649
5650 /* Query controller to refresh cached values if they are too old or were
5651 * never read.
5652 */
f4e2dd53
AK		 5653 if (time_after(jiffies, conn->conn_info_timestamp +
5654 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5655 !conn->conn_info_timestamp) {
5656 struct hci_request req;
5657 struct hci_cp_read_tx_power req_txp_cp;
5658 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5659 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5660
5661 hci_req_init(&req, hdev);
5662 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5663 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5664 &req_rssi_cp);
5665
f7faab0c
AK		 5666 /* For LE links TX power does not change thus we don't need to
5667 * query for it once value is known.
5668 */
5669 if (!bdaddr_type_is_le(cp->addr.type) ||
5670 conn->tx_power == HCI_TX_POWER_INVALID) {
5671 req_txp_cp.handle = cpu_to_le16(conn->handle);
5672 req_txp_cp.type = 0x00;
5673 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5674 sizeof(req_txp_cp), &req_txp_cp);
5675 }
dd983808 5676
eed5daf3
AK		 5677 /* Max TX power needs to be read only once per connection */
5678 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5679 req_txp_cp.handle = cpu_to_le16(conn->handle);
5680 req_txp_cp.type = 0x01;
5681 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5682 sizeof(req_txp_cp), &req_txp_cp);
5683 }
5684
dd983808
AK		 5685 err = hci_req_run(&req, conn_info_refresh_complete);
5686 if (err < 0)
5687 goto unlock;
5688
5689 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5690 data, len);
5691 if (!cmd) {
5692 err = -ENOMEM;
5693 goto unlock;
5694 }
5695
5696 hci_conn_hold(conn);
f8aaf9b6 5697 cmd->user_data = hci_conn_get(conn);
9981bdb0 5698 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5699
5700 conn->conn_info_timestamp = jiffies;
5701 } else {
5702 /* Cache is valid, just reply with values cached in hci_conn */
5703 rp.rssi = conn->rssi;
5704 rp.tx_power = conn->tx_power;
eed5daf3 5705 rp.max_tx_power = conn->max_tx_power;
dd983808 5706
2a1afb5a
JH		 5707 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5708 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5709 }
5710
5711unlock:
5712 hci_dev_unlock(hdev);
5713 return err;
5714}
5715
3b0602cd 5716static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5717{
69487371 5718 struct hci_conn *conn = cmd->user_data;
95868426 5719 struct mgmt_rp_get_clock_info rp;
69487371 5720 struct hci_dev *hdev;
9df74653 5721 int err;
69487371
JH		 5722
5723 memset(&rp, 0, sizeof(rp));
5724 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5725
5726 if (status)
5727 goto complete;
5728
5729 hdev = hci_dev_get(cmd->index);
5730 if (hdev) {
5731 rp.local_clock = cpu_to_le32(hdev->clock);
5732 hci_dev_put(hdev);
5733 }
5734
5735 if (conn) {
5736 rp.piconet_clock = cpu_to_le32(conn->clock);
5737 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5738 }
5739
5740complete:
2a1afb5a
JH		 5741 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5742 sizeof(rp));
69487371
JH		 5743
5744 if (conn) {
5745 hci_conn_drop(conn);
5746 hci_conn_put(conn);
5747 }
9df74653
JH		 5748
5749 return err;
69487371
JH		 5750}
5751
1904a853 5752static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5753{
95868426 5754 struct hci_cp_read_clock *hci_cp;
3b0602cd 5755 struct mgmt_pending_cmd *cmd;
95868426
JH		 5756 struct hci_conn *conn;
5757
5758 BT_DBG("%s status %u", hdev->name, status);
5759
5760 hci_dev_lock(hdev);
5761
5762 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5763 if (!hci_cp)
5764 goto unlock;
5765
5766 if (hci_cp->which) {
5767 u16 handle = __le16_to_cpu(hci_cp->handle);
5768 conn = hci_conn_hash_lookup_handle(hdev, handle);
5769 } else {
5770 conn = NULL;
5771 }
5772
333ae95d 5773 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5774 if (!cmd)
5775 goto unlock;
5776
69487371 5777 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5778 mgmt_pending_remove(cmd);
95868426
JH		 5779
5780unlock:
5781 hci_dev_unlock(hdev);
5782}
5783
5784static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5785 u16 len)
5786{
5787 struct mgmt_cp_get_clock_info *cp = data;
5788 struct mgmt_rp_get_clock_info rp;
5789 struct hci_cp_read_clock hci_cp;
3b0602cd 5790 struct mgmt_pending_cmd *cmd;
95868426
JH		 5791 struct hci_request req;
5792 struct hci_conn *conn;
5793 int err;
5794
5795 BT_DBG("%s", hdev->name);
5796
5797 memset(&rp, 0, sizeof(rp));
5798 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5799 rp.addr.type = cp->addr.type;
5800
5801 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 5802 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5803 MGMT_STATUS_INVALID_PARAMS,
5804 &rp, sizeof(rp));
95868426
JH		 5805
5806 hci_dev_lock(hdev);
5807
5808 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5809 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5810 MGMT_STATUS_NOT_POWERED, &rp,
5811 sizeof(rp));
95868426
JH		 5812 goto unlock;
5813 }
5814
5815 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5816 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5817 &cp->addr.bdaddr);
5818 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5819 err = mgmt_cmd_complete(sk, hdev->id,
5820 MGMT_OP_GET_CLOCK_INFO,
5821 MGMT_STATUS_NOT_CONNECTED,
5822 &rp, sizeof(rp));
95868426
JH		 5823 goto unlock;
5824 }
5825 } else {
5826 conn = NULL;
5827 }
5828
5829 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5830 if (!cmd) {
5831 err = -ENOMEM;
5832 goto unlock;
5833 }
5834
69487371
JH		 5835 cmd->cmd_complete = clock_info_cmd_complete;
5836
95868426
JH		 5837 hci_req_init(&req, hdev);
5838
5839 memset(&hci_cp, 0, sizeof(hci_cp));
5840 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5841
5842 if (conn) {
5843 hci_conn_hold(conn);
f8aaf9b6 5844 cmd->user_data = hci_conn_get(conn);
95868426
JH		 5845
5846 hci_cp.handle = cpu_to_le16(conn->handle);
5847 hci_cp.which = 0x01; /* Piconet clock */
5848 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5849 }
5850
5851 err = hci_req_run(&req, get_clock_info_complete);
5852 if (err < 0)
5853 mgmt_pending_remove(cmd);
5854
5855unlock:
5856 hci_dev_unlock(hdev);
5857 return err;
5858}
5859
5a154e6f
JH		 5860static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5861{
5862 struct hci_conn *conn;
5863
5864 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5865 if (!conn)
5866 return false;
5867
5868 if (conn->dst_type != type)
5869 return false;
5870
5871 if (conn->state != BT_CONNECTED)
5872 return false;
5873
5874 return true;
5875}
5876
5877/* This function requires the caller holds hdev->lock */
5878static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5879 u8 addr_type, u8 auto_connect)
5880{
5881 struct hci_dev *hdev = req->hdev;
5882 struct hci_conn_params *params;
5883
5884 params = hci_conn_params_add(hdev, addr, addr_type);
5885 if (!params)
5886 return -EIO;
5887
5888 if (params->auto_connect == auto_connect)
5889 return 0;
5890
5891 list_del_init(&params->action);
5892
5893 switch (auto_connect) {
5894 case HCI_AUTO_CONN_DISABLED:
5895 case HCI_AUTO_CONN_LINK_LOSS:
5896 __hci_update_background_scan(req);
5897 break;
5898 case HCI_AUTO_CONN_REPORT:
5899 list_add(&params->action, &hdev->pend_le_reports);
5900 __hci_update_background_scan(req);
5901 break;
5902 case HCI_AUTO_CONN_DIRECT:
5903 case HCI_AUTO_CONN_ALWAYS:
5904 if (!is_connected(hdev, addr, addr_type)) {
5905 list_add(&params->action, &hdev->pend_le_conns);
5906 __hci_update_background_scan(req);
5907 }
5908 break;
5909 }
5910
5911 params->auto_connect = auto_connect;
5912
5913 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5914 auto_connect);
5915
5916 return 0;
5917}
5918
8afef092
MH		 5919static void device_added(struct sock *sk, struct hci_dev *hdev,
5920 bdaddr_t *bdaddr, u8 type, u8 action)
5921{
5922 struct mgmt_ev_device_added ev;
5923
5924 bacpy(&ev.addr.bdaddr, bdaddr);
5925 ev.addr.type = type;
5926 ev.action = action;
5927
5928 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5929}
5930
1904a853 5931static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 5932{
3b0602cd 5933 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 5934
5935 BT_DBG("status 0x%02x", status);
5936
5937 hci_dev_lock(hdev);
5938
333ae95d 5939 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 5940 if (!cmd)
5941 goto unlock;
5942
5943 cmd->cmd_complete(cmd, mgmt_status(status));
5944 mgmt_pending_remove(cmd);
5945
5946unlock:
5947 hci_dev_unlock(hdev);
5948}
5949
2faade53
MH		 5950static int add_device(struct sock *sk, struct hci_dev *hdev,
5951 void *data, u16 len)
5952{
5953 struct mgmt_cp_add_device *cp = data;
3b0602cd 5954 struct mgmt_pending_cmd *cmd;
5a154e6f 5955 struct hci_request req;
2faade53
MH		 5956 u8 auto_conn, addr_type;
5957 int err;
5958
5959 BT_DBG("%s", hdev->name);
5960
6659358e 5961 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 5962 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 5963 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5964 MGMT_STATUS_INVALID_PARAMS,
5965 &cp->addr, sizeof(cp->addr));
2faade53 5966
4b9e7e75 5967 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 5968 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5969 MGMT_STATUS_INVALID_PARAMS,
5970 &cp->addr, sizeof(cp->addr));
2faade53 5971
5a154e6f
JH		 5972 hci_req_init(&req, hdev);
5973
2faade53
MH		 5974 hci_dev_lock(hdev);
5975
5a154e6f
JH		 5976 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5977 if (!cmd) {
5978 err = -ENOMEM;
5979 goto unlock;
5980 }
5981
5982 cmd->cmd_complete = addr_cmd_complete;
5983
6659358e 5984 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 5985 /* Only incoming connections action is supported for now */
6659358e 5986 if (cp->action != 0x01) {
9df74653
JH		 5987 err = cmd->cmd_complete(cmd,
5988 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 5989 mgmt_pending_remove(cmd);
6659358e
JH		 5990 goto unlock;
5991 }
5992
5993 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5994 cp->addr.type);
5995 if (err)
5996 goto unlock;
a397407f 5997
5a154e6f 5998 __hci_update_page_scan(&req);
a397407f 5999
6659358e
JH		 6000 goto added;
6001 }
6002
2faade53
MH		 6003 if (cp->addr.type == BDADDR_LE_PUBLIC)
6004 addr_type = ADDR_LE_DEV_PUBLIC;
6005 else
6006 addr_type = ADDR_LE_DEV_RANDOM;
6007
4b9e7e75 6008 if (cp->action == 0x02)
2faade53 6009 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 6010 else if (cp->action == 0x01)
6011 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 6012 else
a3451d27 6013 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 6014
bf5b3c8b
MH		 6015 /* If the connection parameters don't exist for this device,
6016 * they will be created and configured with defaults.
6017 */
5a154e6f 6018 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 6019 auto_conn) < 0) {
9df74653 6020 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 6021 mgmt_pending_remove(cmd);
2faade53
MH		 6022 goto unlock;
6023 }
6024
6659358e 6025added:
8afef092
MH		 6026 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6027
5a154e6f
JH		 6028 err = hci_req_run(&req, add_device_complete);
6029 if (err < 0) {
6030 /* ENODATA means no HCI commands were needed (e.g. if
6031 * the adapter is powered off).
6032 */
9df74653
JH		 6033 if (err == -ENODATA)
6034 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 6035 mgmt_pending_remove(cmd);
6036 }
2faade53
MH		 6037
6038unlock:
6039 hci_dev_unlock(hdev);
6040 return err;
6041}
6042
8afef092
MH		 6043static void device_removed(struct sock *sk, struct hci_dev *hdev,
6044 bdaddr_t *bdaddr, u8 type)
6045{
6046 struct mgmt_ev_device_removed ev;
6047
6048 bacpy(&ev.addr.bdaddr, bdaddr);
6049 ev.addr.type = type;
6050
6051 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6052}
6053
1904a853 6054static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 6055{
3b0602cd 6056 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 6057
6058 BT_DBG("status 0x%02x", status);
6059
6060 hci_dev_lock(hdev);
6061
333ae95d 6062 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 6063 if (!cmd)
6064 goto unlock;
6065
6066 cmd->cmd_complete(cmd, mgmt_status(status));
6067 mgmt_pending_remove(cmd);
6068
6069unlock:
6070 hci_dev_unlock(hdev);
6071}
6072
2faade53
MH		 6073static int remove_device(struct sock *sk, struct hci_dev *hdev,
6074 void *data, u16 len)
6075{
6076 struct mgmt_cp_remove_device *cp = data;
3b0602cd 6077 struct mgmt_pending_cmd *cmd;
51ef3ebe 6078 struct hci_request req;
2faade53
MH		 6079 int err;
6080
6081 BT_DBG("%s", hdev->name);
6082
51ef3ebe
JH		 6083 hci_req_init(&req, hdev);
6084
2faade53
MH		 6085 hci_dev_lock(hdev);
6086
51ef3ebe
JH		 6087 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6088 if (!cmd) {
6089 err = -ENOMEM;
6090 goto unlock;
6091 }
6092
6093 cmd->cmd_complete = addr_cmd_complete;
6094
2faade53 6095 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 6096 struct hci_conn_params *params;
2faade53
MH		 6097 u8 addr_type;
6098
6659358e 6099 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 6100 err = cmd->cmd_complete(cmd,
6101 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6102 mgmt_pending_remove(cmd);
2faade53
MH		 6103 goto unlock;
6104 }
6105
6659358e
JH		 6106 if (cp->addr.type == BDADDR_BREDR) {
6107 err = hci_bdaddr_list_del(&hdev->whitelist,
6108 &cp->addr.bdaddr,
6109 cp->addr.type);
6110 if (err) {
9df74653
JH		 6111 err = cmd->cmd_complete(cmd,
6112 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6113 mgmt_pending_remove(cmd);
6659358e
JH		 6114 goto unlock;
6115 }
6116
51ef3ebe 6117 __hci_update_page_scan(&req);
a397407f 6118
6659358e
JH		 6119 device_removed(sk, hdev, &cp->addr.bdaddr,
6120 cp->addr.type);
6121 goto complete;
6122 }
6123
2faade53
MH		 6124 if (cp->addr.type == BDADDR_LE_PUBLIC)
6125 addr_type = ADDR_LE_DEV_PUBLIC;
6126 else
6127 addr_type = ADDR_LE_DEV_RANDOM;
6128
c71593dd
JH		 6129 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6130 addr_type);
6131 if (!params) {
9df74653
JH		 6132 err = cmd->cmd_complete(cmd,
6133 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6134 mgmt_pending_remove(cmd);
c71593dd
JH		 6135 goto unlock;
6136 }
6137
6138 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 6139 err = cmd->cmd_complete(cmd,
6140 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6141 mgmt_pending_remove(cmd);
c71593dd
JH		 6142 goto unlock;
6143 }
6144
d1dbf12e 6145 list_del(&params->action);
c71593dd
JH		 6146 list_del(&params->list);
6147 kfree(params);
51ef3ebe 6148 __hci_update_background_scan(&req);
8afef092
MH		 6149
6150 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 6151 } else {
19de0825 6152 struct hci_conn_params *p, *tmp;
6659358e 6153 struct bdaddr_list *b, *btmp;
19de0825 6154
2faade53 6155 if (cp->addr.type) {
9df74653
JH		 6156 err = cmd->cmd_complete(cmd,
6157 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6158 mgmt_pending_remove(cmd);
2faade53
MH		 6159 goto unlock;
6160 }
6161
6659358e
JH		 6162 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6163 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6164 list_del(&b->list);
6165 kfree(b);
6166 }
6167
51ef3ebe 6168 __hci_update_page_scan(&req);
a397407f 6169
19de0825
JH		 6170 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6171 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6172 continue;
6173 device_removed(sk, hdev, &p->addr, p->addr_type);
6174 list_del(&p->action);
6175 list_del(&p->list);
6176 kfree(p);
6177 }
6178
6179 BT_DBG("All LE connection parameters were removed");
6180
51ef3ebe 6181 __hci_update_background_scan(&req);
2faade53
MH		 6182 }
6183
6659358e 6184complete:
51ef3ebe
JH		 6185 err = hci_req_run(&req, remove_device_complete);
6186 if (err < 0) {
6187 /* ENODATA means no HCI commands were needed (e.g. if
6188 * the adapter is powered off).
6189 */
9df74653
JH		 6190 if (err == -ENODATA)
6191 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 6192 mgmt_pending_remove(cmd);
6193 }
2faade53
MH		 6194
6195unlock:
6196 hci_dev_unlock(hdev);
6197 return err;
6198}
6199
a26f3dcf
JH		 6200static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6201 u16 len)
6202{
6203 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 6204 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6205 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 6206 u16 param_count, expected_len;
6207 int i;
6208
6209 if (!lmp_le_capable(hdev))
a69e8375
JH		 6210 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6211 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 6212
6213 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 6214 if (param_count > max_param_count) {
6215 BT_ERR("load_conn_param: too big param_count value %u",
6216 param_count);
a69e8375
JH		 6217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6218 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 6219 }
a26f3dcf
JH		 6220
6221 expected_len = sizeof(*cp) + param_count *
6222 sizeof(struct mgmt_conn_param);
6223 if (expected_len != len) {
6224 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6225 expected_len, len);
a69e8375
JH		 6226 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6227 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 6228 }
6229
6230 BT_DBG("%s param_count %u", hdev->name, param_count);
6231
6232 hci_dev_lock(hdev);
6233
6234 hci_conn_params_clear_disabled(hdev);
6235
6236 for (i = 0; i < param_count; i++) {
6237 struct mgmt_conn_param *param = &cp->params[i];
6238 struct hci_conn_params *hci_param;
6239 u16 min, max, latency, timeout;
6240 u8 addr_type;
6241
6242 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6243 param->addr.type);
6244
6245 if (param->addr.type == BDADDR_LE_PUBLIC) {
6246 addr_type = ADDR_LE_DEV_PUBLIC;
6247 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6248 addr_type = ADDR_LE_DEV_RANDOM;
6249 } else {
6250 BT_ERR("Ignoring invalid connection parameters");
6251 continue;
6252 }
6253
6254 min = le16_to_cpu(param->min_interval);
6255 max = le16_to_cpu(param->max_interval);
6256 latency = le16_to_cpu(param->latency);
6257 timeout = le16_to_cpu(param->timeout);
6258
6259 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6260 min, max, latency, timeout);
6261
6262 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6263 BT_ERR("Ignoring invalid connection parameters");
6264 continue;
6265 }
6266
6267 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6268 addr_type);
6269 if (!hci_param) {
6270 BT_ERR("Failed to add connection parameters");
6271 continue;
6272 }
6273
6274 hci_param->conn_min_interval = min;
6275 hci_param->conn_max_interval = max;
6276 hci_param->conn_latency = latency;
6277 hci_param->supervision_timeout = timeout;
6278 }
6279
6280 hci_dev_unlock(hdev);
6281
2a1afb5a
JH		 6282 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6283 NULL, 0);
a26f3dcf
JH		 6284}
6285
dbece37a
MH		 6286static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6287 void *data, u16 len)
6288{
6289 struct mgmt_cp_set_external_config *cp = data;
6290 bool changed;
6291 int err;
6292
6293 BT_DBG("%s", hdev->name);
6294
6295 if (hdev_is_powered(hdev))
a69e8375
JH		 6296 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6297 MGMT_STATUS_REJECTED);
dbece37a
MH		 6298
6299 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6300 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6301 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6302
6303 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6304 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6305 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6306
6307 hci_dev_lock(hdev);
6308
6309 if (cp->config)
238be788 6310 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6311 else
a69d8927 6312 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6313
6314 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6315 if (err < 0)
6316 goto unlock;
6317
6318 if (!changed)
6319 goto unlock;
6320
f4537c04
MH		 6321 err = new_options(hdev, sk);
6322
d7a5a11d 6323 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6324 mgmt_index_removed(hdev);
d603b76b 6325
516018a9 6326 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6327 hci_dev_set_flag(hdev, HCI_CONFIG);
6328 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6329
6330 queue_work(hdev->req_workqueue, &hdev->power_on);
6331 } else {
5ea234d3 6332 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6333 mgmt_index_added(hdev);
6334 }
dbece37a
MH		 6335 }
6336
6337unlock:
6338 hci_dev_unlock(hdev);
6339 return err;
6340}
6341
9713c17b
MH		 6342static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6343 void *data, u16 len)
6344{
6345 struct mgmt_cp_set_public_address *cp = data;
6346 bool changed;
6347 int err;
6348
6349 BT_DBG("%s", hdev->name);
6350
6351 if (hdev_is_powered(hdev))
a69e8375
JH		 6352 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6353 MGMT_STATUS_REJECTED);
9713c17b
MH		 6354
6355 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6356 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6357 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6358
6359 if (!hdev->set_bdaddr)
a69e8375
JH		 6360 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6361 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6362
6363 hci_dev_lock(hdev);
6364
6365 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6366 bacpy(&hdev->public_addr, &cp->bdaddr);
6367
6368 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6369 if (err < 0)
6370 goto unlock;
6371
6372 if (!changed)
6373 goto unlock;
6374
d7a5a11d 6375 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6376 err = new_options(hdev, sk);
6377
6378 if (is_configured(hdev)) {
6379 mgmt_index_removed(hdev);
6380
a358dc11 6381 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6382
a1536da2
MH		 6383 hci_dev_set_flag(hdev, HCI_CONFIG);
6384 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6385
6386 queue_work(hdev->req_workqueue, &hdev->power_on);
6387 }
6388
6389unlock:
6390 hci_dev_unlock(hdev);
6391 return err;
6392}
6393
bea41609
MH		 6394static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6395 u8 data_len)
6396{
6397 eir[eir_len++] = sizeof(type) + data_len;
6398 eir[eir_len++] = type;
6399 memcpy(&eir[eir_len], data, data_len);
6400 eir_len += data_len;
6401
6402 return eir_len;
6403}
6404
4f0f155c
MH		 6405static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6406 void *data, u16 data_len)
6407{
6408 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6409 struct mgmt_rp_read_local_oob_ext_data *rp;
6410 size_t rp_len;
6411 u16 eir_len;
0821a2c5 6412 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6413 int err;
6414
6415 BT_DBG("%s", hdev->name);
6416
57b0d3e8
MH		 6417 if (hdev_is_powered(hdev)) {
6418 switch (cp->type) {
6419 case BIT(BDADDR_BREDR):
6420 status = mgmt_bredr_support(hdev);
6421 if (status)
6422 eir_len = 0;
6423 else
6424 eir_len = 5;
6425 break;
6426 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6427 status = mgmt_le_support(hdev);
6428 if (status)
6429 eir_len = 0;
6430 else
6431 eir_len = 9 + 3 + 18 + 18 + 3;
6432 break;
6433 default:
6434 status = MGMT_STATUS_INVALID_PARAMS;
6435 eir_len = 0;
6436 break;
6437 }
6438 } else {
6439 status = MGMT_STATUS_NOT_POWERED;
6440 eir_len = 0;
4f0f155c
MH		 6441 }
6442
4f0f155c
MH		 6443 rp_len = sizeof(*rp) + eir_len;
6444 rp = kmalloc(rp_len, GFP_ATOMIC);
efcd8c98 6445 if (!rp)
4f0f155c 6446 return -ENOMEM;
efcd8c98 6447
57b0d3e8
MH		 6448 if (status)
6449 goto complete;
6450
efcd8c98 6451 hci_dev_lock(hdev);
4f0f155c
MH		 6452
6453 eir_len = 0;
6454 switch (cp->type) {
6455 case BIT(BDADDR_BREDR):
6456 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6457 hdev->dev_class, 3);
6458 break;
6459 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6460 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6461 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5 6462 hci_dev_unlock(hdev);
57b0d3e8
MH		 6463 status = MGMT_STATUS_FAILED;
6464 goto complete;
0821a2c5
MH		 6465 }
6466
4f0f155c
MH		 6467 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6468 memcpy(addr, &hdev->rpa, 6);
6469 addr[6] = 0x01;
6470 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6471 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6472 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6473 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6474 memcpy(addr, &hdev->static_addr, 6);
6475 addr[6] = 0x01;
6476 } else {
6477 memcpy(addr, &hdev->bdaddr, 6);
6478 addr[6] = 0x00;
6479 }
6480
6481 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6482 addr, sizeof(addr));
6483
6484 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6485 role = 0x02;
6486 else
6487 role = 0x01;
6488
6489 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6490 &role, sizeof(role));
6491
5082a599
MH		 6492 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6493 eir_len = eir_append_data(rp->eir, eir_len,
6494 EIR_LE_SC_CONFIRM,
6495 hash, sizeof(hash));
0821a2c5 6496
5082a599
MH		 6497 eir_len = eir_append_data(rp->eir, eir_len,
6498 EIR_LE_SC_RANDOM,
6499 rand, sizeof(rand));
6500 }
0821a2c5 6501
4f0f155c
MH		 6502 flags = get_adv_discov_flags(hdev);
6503
6504 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6505 flags |= LE_AD_NO_BREDR;
6506
6507 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6508 &flags, sizeof(flags));
6509 break;
6510 }
6511
4f0f155c
MH		 6512 hci_dev_unlock(hdev);
6513
72000df2
MH		 6514 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6515
57b0d3e8
MH		 6516 status = MGMT_STATUS_SUCCESS;
6517
6518complete:
efcd8c98
MH		 6519 rp->type = cp->type;
6520 rp->eir_len = cpu_to_le16(eir_len);
6521
4f0f155c 6522 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
57b0d3e8
MH		 6523 status, rp, sizeof(*rp) + eir_len);
6524 if (err < 0 || status)
72000df2
MH		 6525 goto done;
6526
6527 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6528 rp, sizeof(*rp) + eir_len,
6529 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6530
0821a2c5 6531done:
4f0f155c
MH		 6532 kfree(rp);
6533
6534 return err;
6535}
6536
089fa8c0
AU		 6537static u32 get_supported_adv_flags(struct hci_dev *hdev)
6538{
6539 u32 flags = 0;
6540
6541 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6542 flags |= MGMT_ADV_FLAG_DISCOV;
6543 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6544 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6545
6546 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6547 flags |= MGMT_ADV_FLAG_TX_POWER;
6548
6549 return flags;
6550}
6551
d3d5305b
MH		 6552static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6553 void *data, u16 data_len)
6554{
6555 struct mgmt_rp_read_adv_features *rp;
6556 size_t rp_len;
6557 int err;
24b4f38f 6558 bool instance;
089fa8c0 6559 u32 supported_flags;
d3d5305b
MH		 6560
6561 BT_DBG("%s", hdev->name);
6562
089fa8c0
AU		 6563 if (!lmp_le_capable(hdev))
6564 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6565 MGMT_STATUS_REJECTED);
6566
d3d5305b
MH		 6567 hci_dev_lock(hdev);
6568
6569 rp_len = sizeof(*rp);
24b4f38f
AU		 6570
6571 /* Currently only one instance is supported, so just add 1 to the
6572 * response length.
6573 */
6574 instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6575 if (instance)
6576 rp_len++;
6577
d3d5305b
MH		 6578 rp = kmalloc(rp_len, GFP_ATOMIC);
6579 if (!rp) {
6580 hci_dev_unlock(hdev);
6581 return -ENOMEM;
6582 }
6583
089fa8c0
AU		 6584 supported_flags = get_supported_adv_flags(hdev);
6585
6586 rp->supported_flags = cpu_to_le32(supported_flags);
dc5d82a9
MH		 6587 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6588 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
24b4f38f
AU		 6589 rp->max_instances = 1;
6590
6591 /* Currently only one instance is supported, so simply return the
6592 * current instance number.
6593 */
6594 if (instance) {
6595 rp->num_instances = 1;
6596 rp->instance[0] = 1;
6597 } else {
6598 rp->num_instances = 0;
6599 }
d3d5305b
MH		 6600
6601 hci_dev_unlock(hdev);
6602
6603 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6604 MGMT_STATUS_SUCCESS, rp, rp_len);
6605
6606 kfree(rp);
6607
6608 return err;
6609}
6610
4117ed70 6611static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
b44133ff 6612 u8 len, bool is_adv_data)
24b4f38f 6613{
4117ed70 6614 u8 max_len = HCI_MAX_AD_LENGTH;
24b4f38f 6615 int i, cur_len;
b44133ff 6616 bool flags_managed = false;
5507e358 6617 bool tx_power_managed = false;
67e0c0cd
AU		 6618 u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6619 MGMT_ADV_FLAG_MANAGED_FLAGS;
24b4f38f 6620
807ec772 6621 if (is_adv_data && (adv_flags & flags_params)) {
b44133ff
AU		 6622 flags_managed = true;
6623 max_len -= 3;
6624 }
24b4f38f 6625
5507e358
AU		 6626 if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
6627 tx_power_managed = true;
6628 max_len -= 3;
6629 }
6630
4117ed70 6631 if (len > max_len)
24b4f38f
AU		 6632 return false;
6633
4117ed70
AU		 6634 /* Make sure that the data is correctly formatted. */
6635 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6636 cur_len = data[i];
24b4f38f 6637
b44133ff
AU		 6638 if (flags_managed && data[i + 1] == EIR_FLAGS)
6639 return false;
6640
5507e358
AU		 6641 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
6642 return false;
6643
24b4f38f
AU		 6644 /* If the current field length would exceed the total data
6645 * length, then it's invalid.
6646 */
4117ed70 6647 if (i + cur_len >= len)
24b4f38f
AU		 6648 return false;
6649 }
6650
6651 return true;
6652}
6653
24b4f38f
AU		 6654static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6655 u16 opcode)
6656{
6657 struct mgmt_pending_cmd *cmd;
6658 struct mgmt_rp_add_advertising rp;
6659
6660 BT_DBG("status %d", status);
6661
6662 hci_dev_lock(hdev);
6663
6664 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6665
6666 if (status) {
6667 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6668 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6669 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6670 }
6671
6672 if (!cmd)
6673 goto unlock;
6674
6675 rp.instance = 0x01;
6676
6677 if (status)
6678 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6679 mgmt_status(status));
6680 else
6681 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6682 mgmt_status(status), &rp, sizeof(rp));
6683
6684 mgmt_pending_remove(cmd);
6685
6686unlock:
6687 hci_dev_unlock(hdev);
6688}
6689
912098a6
AU		 6690static void adv_timeout_expired(struct work_struct *work)
6691{
6692 struct hci_dev *hdev = container_of(work, struct hci_dev,
6693 adv_instance.timeout_exp.work);
6694
6695 hdev->adv_instance.timeout = 0;
6696
6697 hci_dev_lock(hdev);
6698 clear_adv_instance(hdev);
6699 hci_dev_unlock(hdev);
6700}
6701
24b4f38f
AU		 6702static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6703 void *data, u16 data_len)
6704{
6705 struct mgmt_cp_add_advertising *cp = data;
6706 struct mgmt_rp_add_advertising rp;
6707 u32 flags;
089fa8c0 6708 u32 supported_flags;
24b4f38f 6709 u8 status;
912098a6 6710 u16 timeout;
24b4f38f
AU		 6711 int err;
6712 struct mgmt_pending_cmd *cmd;
6713 struct hci_request req;
6714
6715 BT_DBG("%s", hdev->name);
6716
6717 status = mgmt_le_support(hdev);
6718 if (status)
6719 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6720 status);
6721
6722 flags = __le32_to_cpu(cp->flags);
912098a6 6723 timeout = __le16_to_cpu(cp->timeout);
24b4f38f 6724
089fa8c0
AU		 6725 /* The current implementation only supports adding one instance and only
6726 * a subset of the specified flags.
6727 */
6728 supported_flags = get_supported_adv_flags(hdev);
6729 if (cp->instance != 0x01 || (flags & ~supported_flags))
24b4f38f
AU		 6730 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6731 MGMT_STATUS_INVALID_PARAMS);
6732
6733 hci_dev_lock(hdev);
6734
912098a6
AU		 6735 if (timeout && !hdev_is_powered(hdev)) {
6736 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6737 MGMT_STATUS_REJECTED);
6738 goto unlock;
6739 }
6740
24b4f38f 6741 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
da929335 6742 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
24b4f38f
AU		 6743 pending_find(MGMT_OP_SET_LE, hdev)) {
6744 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6745 MGMT_STATUS_BUSY);
6746 goto unlock;
6747 }
6748
b44133ff 6749 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
4117ed70 6750 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 6751 cp->scan_rsp_len, false)) {
24b4f38f
AU		 6752 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6753 MGMT_STATUS_INVALID_PARAMS);
6754 goto unlock;
6755 }
6756
912098a6
AU		 6757 INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
6758
24b4f38f
AU		 6759 hdev->adv_instance.flags = flags;
6760 hdev->adv_instance.adv_data_len = cp->adv_data_len;
6761 hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6762
6763 if (cp->adv_data_len)
6764 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6765
6766 if (cp->scan_rsp_len)
6767 memcpy(hdev->adv_instance.scan_rsp_data,
6768 cp->data + cp->adv_data_len, cp->scan_rsp_len);
6769
912098a6
AU		 6770 if (hdev->adv_instance.timeout)
6771 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6772
6773 hdev->adv_instance.timeout = timeout;
6774
6775 if (timeout)
6776 queue_delayed_work(hdev->workqueue,
6777 &hdev->adv_instance.timeout_exp,
6778 msecs_to_jiffies(timeout * 1000));
6779
24b4f38f
AU		 6780 if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6781 advertising_added(sk, hdev, 1);
6782
6783 /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6784 * we have no HCI communication to make. Simply return.
6785 */
6786 if (!hdev_is_powered(hdev) ||
6787 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6788 rp.instance = 0x01;
6789 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6790 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6791 goto unlock;
6792 }
6793
6794 /* We're good to go, update advertising data, parameters, and start
6795 * advertising.
6796 */
6797 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6798 data_len);
6799 if (!cmd) {
6800 err = -ENOMEM;
6801 goto unlock;
6802 }
6803
6804 hci_req_init(&req, hdev);
6805
6806 update_adv_data(&req);
4117ed70 6807 update_scan_rsp_data(&req);
24b4f38f
AU		 6808 enable_advertising(&req);
6809
6810 err = hci_req_run(&req, add_advertising_complete);
6811 if (err < 0)
6812 mgmt_pending_remove(cmd);
6813
6814unlock:
6815 hci_dev_unlock(hdev);
6816
6817 return err;
6818}
6819
da929335
AU		 6820static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6821 u16 opcode)
6822{
6823 struct mgmt_pending_cmd *cmd;
6824 struct mgmt_rp_remove_advertising rp;
6825
6826 BT_DBG("status %d", status);
6827
6828 hci_dev_lock(hdev);
6829
6830 /* A failure status here only means that we failed to disable
6831 * advertising. Otherwise, the advertising instance has been removed,
6832 * so report success.
6833 */
6834 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6835 if (!cmd)
6836 goto unlock;
6837
6838 rp.instance = 1;
6839
6840 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6841 &rp, sizeof(rp));
6842 mgmt_pending_remove(cmd);
6843
6844unlock:
6845 hci_dev_unlock(hdev);
6846}
6847
6848static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6849 void *data, u16 data_len)
6850{
6851 struct mgmt_cp_remove_advertising *cp = data;
6852 struct mgmt_rp_remove_advertising rp;
6853 int err;
6854 struct mgmt_pending_cmd *cmd;
6855 struct hci_request req;
6856
6857 BT_DBG("%s", hdev->name);
6858
6859 /* The current implementation only allows modifying instance no 1. A
6860 * value of 0 indicates that all instances should be cleared.
6861 */
6862 if (cp->instance > 1)
6863 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6864 MGMT_STATUS_INVALID_PARAMS);
6865
6866 hci_dev_lock(hdev);
6867
6868 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6869 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6870 pending_find(MGMT_OP_SET_LE, hdev)) {
6871 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6872 MGMT_STATUS_BUSY);
6873 goto unlock;
6874 }
6875
6876 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
6877 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6878 MGMT_STATUS_INVALID_PARAMS);
6879 goto unlock;
6880 }
6881
912098a6
AU		 6882 if (hdev->adv_instance.timeout)
6883 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6884
da929335
AU		 6885 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6886
6887 advertising_removed(sk, hdev, 1);
6888
6889 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6890
6891 /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6892 * we have no HCI communication to make. Simply return.
6893 */
6894 if (!hdev_is_powered(hdev) ||
6895 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6896 rp.instance = 1;
6897 err = mgmt_cmd_complete(sk, hdev->id,
6898 MGMT_OP_REMOVE_ADVERTISING,
6899 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6900 goto unlock;
6901 }
6902
6903 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6904 data_len);
6905 if (!cmd) {
6906 err = -ENOMEM;
6907 goto unlock;
6908 }
6909
6910 hci_req_init(&req, hdev);
6911 disable_advertising(&req);
6912
6913 err = hci_req_run(&req, remove_advertising_complete);
6914 if (err < 0)
6915 mgmt_pending_remove(cmd);
6916
6917unlock:
6918 hci_dev_unlock(hdev);
6919
6920 return err;
6921}
6922
6d785aa3 6923static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 6924 { NULL }, /* 0x0000 (no command) */
b9a245fb 6925 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 6926 HCI_MGMT_NO_HDEV |
6927 HCI_MGMT_UNTRUSTED },
b9a245fb 6928 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 6929 HCI_MGMT_NO_HDEV |
6930 HCI_MGMT_UNTRUSTED },
b9a245fb 6931 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 6932 HCI_MGMT_NO_HDEV |
6933 HCI_MGMT_UNTRUSTED },
6934 { read_controller_info, MGMT_READ_INFO_SIZE,
6935 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 6936 { set_powered, MGMT_SETTING_SIZE },
6937 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6938 { set_connectable, MGMT_SETTING_SIZE },
6939 { set_fast_connectable, MGMT_SETTING_SIZE },
6940 { set_bondable, MGMT_SETTING_SIZE },
6941 { set_link_security, MGMT_SETTING_SIZE },
6942 { set_ssp, MGMT_SETTING_SIZE },
6943 { set_hs, MGMT_SETTING_SIZE },
6944 { set_le, MGMT_SETTING_SIZE },
6945 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6946 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6947 { add_uuid, MGMT_ADD_UUID_SIZE },
6948 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 6949 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6950 HCI_MGMT_VAR_LEN },
6951 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6952 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6953 { disconnect, MGMT_DISCONNECT_SIZE },
6954 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6955 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6956 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6957 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6958 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6959 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6960 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6961 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6962 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6963 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6964 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 6965 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6966 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6967 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6968 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6969 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6970 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6971 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6972 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6973 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6974 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6975 { set_advertising, MGMT_SETTING_SIZE },
6976 { set_bredr, MGMT_SETTING_SIZE },
6977 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6978 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6979 { set_secure_conn, MGMT_SETTING_SIZE },
6980 { set_debug_keys, MGMT_SETTING_SIZE },
6981 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 6982 { load_irks, MGMT_LOAD_IRKS_SIZE,
6983 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6984 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6985 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6986 { add_device, MGMT_ADD_DEVICE_SIZE },
6987 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 6988 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6989 HCI_MGMT_VAR_LEN },
6990 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 6991 HCI_MGMT_NO_HDEV |
6992 HCI_MGMT_UNTRUSTED },
b9a245fb 6993 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 6994 HCI_MGMT_UNCONFIGURED |
6995 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 6996 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6997 HCI_MGMT_UNCONFIGURED },
6998 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6999 HCI_MGMT_UNCONFIGURED },
7000 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7001 HCI_MGMT_VAR_LEN },
4f0f155c 7002 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 7003 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 7004 HCI_MGMT_NO_HDEV |
7005 HCI_MGMT_UNTRUSTED },
d3d5305b 7006 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 7007 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7008 HCI_MGMT_VAR_LEN },
da929335 7009 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
0f4e68cf
JH		 7010};
7011
bf6b56db 7012void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 7013{
ced85549 7014 struct mgmt_ev_ext_index ev;
bb4b2a9a 7015
0602a8ad
MH		 7016 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7017 return;
7018
f9207338
MH		 7019 switch (hdev->dev_type) {
7020 case HCI_BREDR:
7021 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7022 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7023 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7024 ev.type = 0x01;
f9207338
MH		 7025 } else {
7026 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7027 HCI_MGMT_INDEX_EVENTS);
ced85549 7028 ev.type = 0x00;
f9207338
MH		 7029 }
7030 break;
ced85549
MH		 7031 case HCI_AMP:
7032 ev.type = 0x02;
7033 break;
7034 default:
7035 return;
f9207338 7036 }
ced85549
MH		 7037
7038 ev.bus = hdev->bus;
7039
7040 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7041 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 7042}
7043
bf6b56db 7044void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 7045{
ced85549 7046 struct mgmt_ev_ext_index ev;
5f159032 7047 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 7048
0602a8ad
MH		 7049 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7050 return;
7051
f9207338
MH		 7052 switch (hdev->dev_type) {
7053 case HCI_BREDR:
7054 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 7055
f9207338
MH		 7056 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7057 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7058 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7059 ev.type = 0x01;
f9207338
MH		 7060 } else {
7061 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7062 HCI_MGMT_INDEX_EVENTS);
ced85549 7063 ev.type = 0x00;
f9207338
MH		 7064 }
7065 break;
ced85549
MH		 7066 case HCI_AMP:
7067 ev.type = 0x02;
7068 break;
7069 default:
7070 return;
f9207338 7071 }
ced85549
MH		 7072
7073 ev.bus = hdev->bus;
7074
7075 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7076 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 7077}
7078
6046dc3e 7079/* This function requires the caller holds hdev->lock */
2cf22218 7080static void restart_le_actions(struct hci_request *req)
6046dc3e 7081{
2cf22218 7082 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 7083 struct hci_conn_params *p;
7084
7085 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 7086 /* Needed for AUTO_OFF case where might not "really"
7087 * have been powered off.
7088 */
7089 list_del_init(&p->action);
7090
7091 switch (p->auto_connect) {
4b9e7e75 7092 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 7093 case HCI_AUTO_CONN_ALWAYS:
7094 list_add(&p->action, &hdev->pend_le_conns);
7095 break;
7096 case HCI_AUTO_CONN_REPORT:
7097 list_add(&p->action, &hdev->pend_le_reports);
7098 break;
7099 default:
7100 break;
c83ed19d 7101 }
6046dc3e 7102 }
c83ed19d 7103
2cf22218 7104 __hci_update_background_scan(req);
6046dc3e
AG		 7105}
7106
1904a853 7107static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 7108{
7109 struct cmd_lookup match = { NULL, hdev };
7110
7111 BT_DBG("status 0x%02x", status);
7112
162a3bac
MH		 7113 if (!status) {
7114 /* Register the available SMP channels (BR/EDR and LE) only
7115 * when successfully powering on the controller. This late
7116 * registration is required so that LE SMP can clearly
7117 * decide if the public address or static address is used.
7118 */
7119 smp_register(hdev);
7120 }
7121
229ab39c
JH		 7122 hci_dev_lock(hdev);
7123
7124 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7125
7126 new_settings(hdev, match.sk);
7127
7128 hci_dev_unlock(hdev);
7129
7130 if (match.sk)
7131 sock_put(match.sk);
7132}
7133
70da6243 7134static int powered_update_hci(struct hci_dev *hdev)
5add6af8 7135{
890ea898 7136 struct hci_request req;
70da6243 7137 u8 link_sec;
5add6af8 7138
890ea898
JH		 7139 hci_req_init(&req, hdev);
7140
d7a5a11d 7141 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 7142 !lmp_host_ssp_capable(hdev)) {
574ea3c7 7143 u8 mode = 0x01;
5e5282bb 7144
574ea3c7
MH		 7145 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7146
7147 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7148 u8 support = 0x01;
5add6af8 7149
574ea3c7
MH		 7150 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7151 sizeof(support), &support);
7152 }
ec6f99b8
JH		 7153 }
7154
d7a5a11d 7155 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 7156 lmp_bredr_capable(hdev)) {
70da6243 7157 struct hci_cp_write_le_host_supported cp;
f0ff92fb 7158
32226e4f
MH		 7159 cp.le = 0x01;
7160 cp.simul = 0x00;
3d1cbdd6 7161
70da6243
JH		 7162 /* Check first if we already have the right
7163 * host state (host features set)
7164 */
7165 if (cp.le != lmp_host_le_capable(hdev) ||
7166 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 7167 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7168 sizeof(cp), &cp);
70da6243 7169 }
3d1cbdd6 7170
d13eafce 7171 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 7172 /* Make sure the controller has a good default for
7173 * advertising data. This also applies to the case
7174 * where BR/EDR was toggled during the AUTO_OFF phase.
7175 */
d7a5a11d 7176 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
5947f4bc 7177 update_adv_data(&req);
f14d8f64
MH		 7178 update_scan_rsp_data(&req);
7179 }
441ad2d0 7180
24b4f38f
AU		 7181 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7182 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
bba3aa55 7183 enable_advertising(&req);
2cf22218
JH		 7184
7185 restart_le_actions(&req);
eeca6f89
JH		 7186 }
7187
d7a5a11d 7188 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 7189 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 7190 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7191 sizeof(link_sec), &link_sec);
562fcc24 7192
70da6243 7193 if (lmp_bredr_capable(hdev)) {
d7a5a11d 7194 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 7195 write_fast_connectable(&req, true);
7196 else
7197 write_fast_connectable(&req, false);
1d2dc5b7 7198 __hci_update_page_scan(&req);
890ea898 7199 update_class(&req);
13928971 7200 update_name(&req);
890ea898 7201 update_eir(&req);
70da6243 7202 }
562fcc24 7203
229ab39c 7204 return hci_req_run(&req, powered_complete);
70da6243 7205}
562fcc24 7206
70da6243
JH		 7207int mgmt_powered(struct hci_dev *hdev, u8 powered)
7208{
7209 struct cmd_lookup match = { NULL, hdev };
9845904f 7210 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 7211 int err;
f0ff92fb 7212
d7a5a11d 7213 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 7214 return 0;
7215
70da6243 7216 if (powered) {
229ab39c
JH		 7217 if (powered_update_hci(hdev) == 0)
7218 return 0;
fe038884 7219
229ab39c
JH		 7220 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7221 &match);
7222 goto new_settings;
b24752fe
JH		 7223 }
7224
229ab39c 7225 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 7226
7227 /* If the power off is because of hdev unregistration let
7228 * use the appropriate INVALID_INDEX status. Otherwise use
7229 * NOT_POWERED. We cover both scenarios here since later in
7230 * mgmt_index_removed() any hci_conn callbacks will have already
7231 * been triggered, potentially causing misleading DISCONNECTED
7232 * status responses.
7233 */
d7a5a11d 7234 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 7235 status = MGMT_STATUS_INVALID_INDEX;
7236 else
7237 status = MGMT_STATUS_NOT_POWERED;
7238
7239 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 7240
7241 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 7242 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7243 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 7244
7245new_settings:
beadb2bd 7246 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 7247
7248 if (match.sk)
7249 sock_put(match.sk);
7250
7bb895d6 7251 return err;
5add6af8 7252}
73f22f62 7253
3eec705e 7254void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 7255{
3b0602cd 7256 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 7257 u8 status;
7258
333ae95d 7259 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 7260 if (!cmd)
3eec705e 7261 return;
96570ffc
JH		 7262
7263 if (err == -ERFKILL)
7264 status = MGMT_STATUS_RFKILLED;
7265 else
7266 status = MGMT_STATUS_FAILED;
7267
a69e8375 7268 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 7269
7270 mgmt_pending_remove(cmd);
96570ffc
JH		 7271}
7272
d1967ff8
MH		 7273void mgmt_discoverable_timeout(struct hci_dev *hdev)
7274{
7275 struct hci_request req;
d1967ff8
MH		 7276
7277 hci_dev_lock(hdev);
7278
7279 /* When discoverable timeout triggers, then just make sure
7280 * the limited discoverable flag is cleared. Even in the case
7281 * of a timeout triggered from general discoverable, it is
7282 * safe to unconditionally clear the flag.
7283 */
a358dc11
MH		 7284 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7285 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 7286
7287 hci_req_init(&req, hdev);
d7a5a11d 7288 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 7289 u8 scan = SCAN_PAGE;
7290 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7291 sizeof(scan), &scan);
7292 }
d1967ff8 7293 update_class(&req);
24b4f38f
AU		 7294
7295 /* Advertising instances don't use the global discoverable setting, so
7296 * only update AD if advertising was enabled using Set Advertising.
7297 */
7298 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7299 update_adv_data(&req);
7300
d1967ff8
MH		 7301 hci_req_run(&req, NULL);
7302
7303 hdev->discov_timeout = 0;
7304
9a43e25f
JH		 7305 new_settings(hdev, NULL);
7306
d1967ff8
MH		 7307 hci_dev_unlock(hdev);
7308}
7309
dc4a5ee2
MH		 7310void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7311 bool persistent)
55ed8ca1 7312{
86742e1e 7313 struct mgmt_ev_new_link_key ev;
55ed8ca1 7314
a492cd52 7315 memset(&ev, 0, sizeof(ev));
55ed8ca1 7316
a492cd52 7317 ev.store_hint = persistent;
d753fdc4 7318 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 7319 ev.key.addr.type = BDADDR_BREDR;
a492cd52 7320 ev.key.type = key->type;
9b3b4460 7321 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 7322 ev.key.pin_len = key->pin_len;
55ed8ca1 7323
dc4a5ee2 7324 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 7325}
f7520543 7326
d7b25450
JH		 7327static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7328{
23fb8de3
JH		 7329 switch (ltk->type) {
7330 case SMP_LTK:
7331 case SMP_LTK_SLAVE:
7332 if (ltk->authenticated)
7333 return MGMT_LTK_AUTHENTICATED;
7334 return MGMT_LTK_UNAUTHENTICATED;
7335 case SMP_LTK_P256:
7336 if (ltk->authenticated)
7337 return MGMT_LTK_P256_AUTH;
7338 return MGMT_LTK_P256_UNAUTH;
7339 case SMP_LTK_P256_DEBUG:
7340 return MGMT_LTK_P256_DEBUG;
7341 }
d7b25450
JH		 7342
7343 return MGMT_LTK_UNAUTHENTICATED;
7344}
7345
53ac6ab6 7346void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 7347{
7348 struct mgmt_ev_new_long_term_key ev;
7349
7350 memset(&ev, 0, sizeof(ev));
7351
5192d301
MH		 7352 /* Devices using resolvable or non-resolvable random addresses
7353 * without providing an indentity resolving key don't require
7354 * to store long term keys. Their addresses will change the
7355 * next time around.
7356 *
7357 * Only when a remote device provides an identity address
7358 * make sure the long term key is stored. If the remote
7359 * identity is known, the long term keys are internally
7360 * mapped to the identity address. So allow static random
7361 * and public addresses here.
7362 */
ba74b666
JH		 7363 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7364 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7365 ev.store_hint = 0x00;
7366 else
53ac6ab6 7367 ev.store_hint = persistent;
ba74b666 7368
346af67b 7369 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 7370 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 7371 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 7372 ev.key.enc_size = key->enc_size;
7373 ev.key.ediv = key->ediv;
fe39c7b2 7374 ev.key.rand = key->rand;
346af67b 7375
2ceba539 7376 if (key->type == SMP_LTK)
346af67b
VCG		 7377 ev.key.master = 1;
7378
346af67b
VCG		 7379 memcpy(ev.key.val, key->val, sizeof(key->val));
7380
083368f7 7381 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 7382}
7383
95fbac8a
JH		 7384void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7385{
7386 struct mgmt_ev_new_irk ev;
7387
7388 memset(&ev, 0, sizeof(ev));
7389
bab6d1e5
MH		 7390 /* For identity resolving keys from devices that are already
7391 * using a public address or static random address, do not
7392 * ask for storing this key. The identity resolving key really
7393 * is only mandatory for devices using resovlable random
7394 * addresses.
7395 *
7396 * Storing all identity resolving keys has the downside that
7397 * they will be also loaded on next boot of they system. More
7398 * identity resolving keys, means more time during scanning is
7399 * needed to actually resolve these addresses.
7400 */
7401 if (bacmp(&irk->rpa, BDADDR_ANY))
7402 ev.store_hint = 0x01;
7403 else
7404 ev.store_hint = 0x00;
7405
95fbac8a
JH		 7406 bacpy(&ev.rpa, &irk->rpa);
7407 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7408 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7409 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7410
7411 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7412}
7413
53ac6ab6
MH		 7414void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7415 bool persistent)
7ee4ea36
MH		 7416{
7417 struct mgmt_ev_new_csrk ev;
7418
7419 memset(&ev, 0, sizeof(ev));
7420
7421 /* Devices using resolvable or non-resolvable random addresses
7422 * without providing an indentity resolving key don't require
7423 * to store signature resolving keys. Their addresses will change
7424 * the next time around.
7425 *
7426 * Only when a remote device provides an identity address
7427 * make sure the signature resolving key is stored. So allow
7428 * static random and public addresses here.
7429 */
7430 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7431 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7432 ev.store_hint = 0x00;
7433 else
53ac6ab6 7434 ev.store_hint = persistent;
7ee4ea36
MH		 7435
7436 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7437 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 7438 ev.key.type = csrk->type;
7ee4ea36
MH		 7439 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7440
7441 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7442}
7443
ffb5a827 7444void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 7445 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7446 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 7447{
7448 struct mgmt_ev_new_conn_param ev;
7449
c103aea6
JH		 7450 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7451 return;
7452
ffb5a827
AG		 7453 memset(&ev, 0, sizeof(ev));
7454 bacpy(&ev.addr.bdaddr, bdaddr);
7455 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 7456 ev.store_hint = store_hint;
ffb5a827
AG		 7457 ev.min_interval = cpu_to_le16(min_interval);
7458 ev.max_interval = cpu_to_le16(max_interval);
7459 ev.latency = cpu_to_le16(latency);
7460 ev.timeout = cpu_to_le16(timeout);
7461
7462 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7463}
7464
48ec92fa
AA		 7465void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7466 u32 flags, u8 *name, u8 name_len)
f7520543 7467{
b644ba33
JH		 7468 char buf[512];
7469 struct mgmt_ev_device_connected *ev = (void *) buf;
7470 u16 eir_len = 0;
f7520543 7471
48ec92fa
AA		 7472 bacpy(&ev->addr.bdaddr, &conn->dst);
7473 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 7474
c95f0ba7 7475 ev->flags = __cpu_to_le32(flags);
08c79b61 7476
fd45ada9
AA		 7477 /* We must ensure that the EIR Data fields are ordered and
7478 * unique. Keep it simple for now and avoid the problem by not
7479 * adding any BR/EDR data to the LE adv.
7480 */
7481 if (conn->le_adv_data_len > 0) {
7482 memcpy(&ev->eir[eir_len],
7483 conn->le_adv_data, conn->le_adv_data_len);
7484 eir_len = conn->le_adv_data_len;
7485 } else {
7486 if (name_len > 0)
7487 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7488 name, name_len);
b644ba33 7489
ddbea5cf 7490 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 7491 eir_len = eir_append_data(ev->eir, eir_len,
7492 EIR_CLASS_OF_DEV,
7493 conn->dev_class, 3);
7494 }
b644ba33 7495
eb55ef07 7496 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 7497
ecd90ae7
MH		 7498 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7499 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 7500}
7501
3b0602cd 7502static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 7503{
8962ee74 7504 struct sock **sk = data;
8962ee74 7505
f5818c22 7506 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7507
7508 *sk = cmd->sk;
7509 sock_hold(*sk);
7510
a664b5bc 7511 mgmt_pending_remove(cmd);
8962ee74
JH		 7512}
7513
3b0602cd 7514static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7515{
b1078ad0 7516 struct hci_dev *hdev = data;
124f6e35 7517 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7518
b1078ad0
JH		 7519 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7520
d8b7b1e4 7521 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7522 mgmt_pending_remove(cmd);
7523}
7524
84c61d92
JH		 7525bool mgmt_powering_down(struct hci_dev *hdev)
7526{
3b0602cd 7527 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 7528 struct mgmt_mode *cp;
7529
333ae95d 7530 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 7531 if (!cmd)
7532 return false;
7533
7534 cp = cmd->param;
7535 if (!cp->val)
7536 return true;
7537
7538 return false;
7539}
7540
9b80ec5e 7541void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 7542 u8 link_type, u8 addr_type, u8 reason,
7543 bool mgmt_connected)
f7520543 7544{
f0d6a0ea 7545 struct mgmt_ev_device_disconnected ev;
8962ee74 7546 struct sock *sk = NULL;
8962ee74 7547
84c61d92
JH		 7548 /* The connection is still in hci_conn_hash so test for 1
7549 * instead of 0 to know if this is the last one.
7550 */
7551 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7552 cancel_delayed_work(&hdev->power_off);
7553 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 7554 }
7555
12d4a3b2
JH		 7556 if (!mgmt_connected)
7557 return;
7558
57eb776f
AG		 7559 if (link_type != ACL_LINK && link_type != LE_LINK)
7560 return;
7561
744cf19e 7562 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 7563
f0d6a0ea
MA		 7564 bacpy(&ev.addr.bdaddr, bdaddr);
7565 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7566 ev.reason = reason;
f7520543 7567
9b80ec5e 7568 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 7569
7570 if (sk)
d97dcb66 7571 sock_put(sk);
8962ee74 7572
124f6e35 7573 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 7574 hdev);
8962ee74
JH		 7575}
7576
7892924c
MH		 7577void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7578 u8 link_type, u8 addr_type, u8 status)
8962ee74 7579{
3655bba8
AG		 7580 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7581 struct mgmt_cp_disconnect *cp;
3b0602cd 7582 struct mgmt_pending_cmd *cmd;
8962ee74 7583
36a75f1b
JD		 7584 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7585 hdev);
7586
333ae95d 7587 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 7588 if (!cmd)
7892924c 7589 return;
8962ee74 7590
3655bba8
AG		 7591 cp = cmd->param;
7592
7593 if (bacmp(bdaddr, &cp->addr.bdaddr))
7594 return;
7595
7596 if (cp->addr.type != bdaddr_type)
7597 return;
7598
f5818c22 7599 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7600 mgmt_pending_remove(cmd);
f7520543 7601}
17d5c04c 7602
445608d0
MH		 7603void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7604 u8 addr_type, u8 status)
17d5c04c
JH		 7605{
7606 struct mgmt_ev_connect_failed ev;
c9910d0f 7607
84c61d92
JH		 7608 /* The connection is still in hci_conn_hash so test for 1
7609 * instead of 0 to know if this is the last one.
7610 */
7611 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7612 cancel_delayed_work(&hdev->power_off);
7613 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 7614 }
17d5c04c 7615
4c659c39 7616 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7617 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 7618 ev.status = mgmt_status(status);
17d5c04c 7619
445608d0 7620 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 7621}
980e1a53 7622
ce0e4a0d 7623void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 7624{
7625 struct mgmt_ev_pin_code_request ev;
7626
d8457698 7627 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 7628 ev.addr.type = BDADDR_BREDR;
a770bb5a 7629 ev.secure = secure;
980e1a53 7630
ce0e4a0d 7631 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 7632}
7633
e669cf80
MH		 7634void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7635 u8 status)
980e1a53 7636{
3b0602cd 7637 struct mgmt_pending_cmd *cmd;
980e1a53 7638
333ae95d 7639 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 7640 if (!cmd)
e669cf80 7641 return;
980e1a53 7642
7776d1d8 7643 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7644 mgmt_pending_remove(cmd);
980e1a53
JH		 7645}
7646
3eb38528
MH		 7647void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7648 u8 status)
980e1a53 7649{
3b0602cd 7650 struct mgmt_pending_cmd *cmd;
980e1a53 7651
333ae95d 7652 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 7653 if (!cmd)
3eb38528 7654 return;
980e1a53 7655
7776d1d8 7656 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7657 mgmt_pending_remove(cmd);
980e1a53 7658}
a5c29683 7659
744cf19e 7660int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 7661 u8 link_type, u8 addr_type, u32 value,
04124681 7662 u8 confirm_hint)
a5c29683
JH		 7663{
7664 struct mgmt_ev_user_confirm_request ev;
7665
744cf19e 7666 BT_DBG("%s", hdev->name);
a5c29683 7667
272d90df 7668 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7669 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 7670 ev.confirm_hint = confirm_hint;
39adbffe 7671 ev.value = cpu_to_le32(value);
a5c29683 7672
744cf19e 7673 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 7674 NULL);
a5c29683
JH		 7675}
7676
272d90df 7677int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 7678 u8 link_type, u8 addr_type)
604086b7
BG		 7679{
7680 struct mgmt_ev_user_passkey_request ev;
7681
7682 BT_DBG("%s", hdev->name);
7683
272d90df 7684 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7685 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 7686
7687 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 7688 NULL);
604086b7
BG		 7689}
7690
0df4c185 7691static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 7692 u8 link_type, u8 addr_type, u8 status,
7693 u8 opcode)
a5c29683 7694{
3b0602cd 7695 struct mgmt_pending_cmd *cmd;
a5c29683 7696
333ae95d 7697 cmd = pending_find(opcode, hdev);
a5c29683
JH		 7698 if (!cmd)
7699 return -ENOENT;
7700
7776d1d8 7701 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7702 mgmt_pending_remove(cmd);
a5c29683 7703
7776d1d8 7704 return 0;
a5c29683
JH		 7705}
7706
744cf19e 7707int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7708 u8 link_type, u8 addr_type, u8 status)
a5c29683 7709{
272d90df 7710 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 7711 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 7712}
7713
272d90df 7714int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7715 u8 link_type, u8 addr_type, u8 status)
a5c29683 7716{
272d90df 7717 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 7718 status,
7719 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 7720}
2a611692 7721
604086b7 7722int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7723 u8 link_type, u8 addr_type, u8 status)
604086b7 7724{
272d90df 7725 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 7726 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 7727}
7728
272d90df 7729int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7730 u8 link_type, u8 addr_type, u8 status)
604086b7 7731{
272d90df 7732 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 7733 status,
7734 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 7735}
7736
92a25256
JH		 7737int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7738 u8 link_type, u8 addr_type, u32 passkey,
7739 u8 entered)
7740{
7741 struct mgmt_ev_passkey_notify ev;
7742
7743 BT_DBG("%s", hdev->name);
7744
7745 bacpy(&ev.addr.bdaddr, bdaddr);
7746 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7747 ev.passkey = __cpu_to_le32(passkey);
7748 ev.entered = entered;
7749
7750 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7751}
7752
e1e930f5 7753void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 7754{
7755 struct mgmt_ev_auth_failed ev;
3b0602cd 7756 struct mgmt_pending_cmd *cmd;
e1e930f5 7757 u8 status = mgmt_status(hci_status);
2a611692 7758
e1e930f5
JH		 7759 bacpy(&ev.addr.bdaddr, &conn->dst);
7760 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7761 ev.status = status;
2a611692 7762
e1e930f5
JH		 7763 cmd = find_pairing(conn);
7764
7765 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7766 cmd ? cmd->sk : NULL);
7767
a511b35b
JH		 7768 if (cmd) {
7769 cmd->cmd_complete(cmd, status);
7770 mgmt_pending_remove(cmd);
7771 }
2a611692 7772}
b312b161 7773
464996ae 7774void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 7775{
7776 struct cmd_lookup match = { NULL, hdev };
464996ae 7777 bool changed;
33ef95ed
JH		 7778
7779 if (status) {
7780 u8 mgmt_err = mgmt_status(status);
7781 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 7782 cmd_status_rsp, &mgmt_err);
464996ae 7783 return;
33ef95ed
JH		 7784 }
7785
464996ae 7786 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 7787 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 7788 else
a69d8927 7789 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 7790
33ef95ed 7791 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 7792 &match);
33ef95ed 7793
47990ea0 7794 if (changed)
464996ae 7795 new_settings(hdev, match.sk);
33ef95ed
JH		 7796
7797 if (match.sk)
7798 sock_put(match.sk);
33ef95ed
JH		 7799}
7800
890ea898 7801static void clear_eir(struct hci_request *req)
cacaf52f 7802{
890ea898 7803 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 7804 struct hci_cp_write_eir cp;
7805
976eb20e 7806 if (!lmp_ext_inq_capable(hdev))
890ea898 7807 return;
cacaf52f 7808
c80da27e
JH		 7809 memset(hdev->eir, 0, sizeof(hdev->eir));
7810
cacaf52f
JH		 7811 memset(&cp, 0, sizeof(cp));
7812
890ea898 7813 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 7814}
7815
3e248560 7816void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 7817{
7818 struct cmd_lookup match = { NULL, hdev };
890ea898 7819 struct hci_request req;
c0ecddc2 7820 bool changed = false;
ed2c4ee3
JH		 7821
7822 if (status) {
7823 u8 mgmt_err = mgmt_status(status);
c0ecddc2 7824
a69d8927
MH		 7825 if (enable && hci_dev_test_and_clear_flag(hdev,
7826 HCI_SSP_ENABLED)) {
a358dc11 7827 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 7828 new_settings(hdev, NULL);
9ecb3e24 7829 }
c0ecddc2 7830
04124681
GP		 7831 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7832 &mgmt_err);
3e248560 7833 return;
c0ecddc2
JH		 7834 }
7835
7836 if (enable) {
238be788 7837 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 7838 } else {
a69d8927 7839 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 7840 if (!changed)
a69d8927
MH		 7841 changed = hci_dev_test_and_clear_flag(hdev,
7842 HCI_HS_ENABLED);
9ecb3e24 7843 else
a358dc11 7844 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 7845 }
7846
7847 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7848
c0ecddc2 7849 if (changed)
3e248560 7850 new_settings(hdev, match.sk);
ed2c4ee3 7851
5fc6ebb1 7852 if (match.sk)
ed2c4ee3
JH		 7853 sock_put(match.sk);
7854
890ea898
JH		 7855 hci_req_init(&req, hdev);
7856
d7a5a11d
MH		 7857 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7858 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 7859 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7860 sizeof(enable), &enable);
890ea898 7861 update_eir(&req);
3769972b 7862 } else {
890ea898 7863 clear_eir(&req);
3769972b 7864 }
890ea898
JH		 7865
7866 hci_req_run(&req, NULL);
ed2c4ee3
JH		 7867}
7868
3b0602cd 7869static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 7870{
7871 struct cmd_lookup *match = data;
7872
90e70454
JH		 7873 if (match->sk == NULL) {
7874 match->sk = cmd->sk;
7875 sock_hold(match->sk);
7876 }
90e70454
JH		 7877}
7878
4e1b0245
MH		 7879void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7880 u8 status)
7f9a903c 7881{
90e70454 7882 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 7883
92da6097
JH		 7884 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7885 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7886 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 7887
7888 if (!status)
f6b7712e
MH		 7889 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7890 dev_class, 3, NULL);
90e70454
JH		 7891
7892 if (match.sk)
7893 sock_put(match.sk);
7f9a903c
MH		 7894}
7895
7667da34 7896void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 7897{
b312b161 7898 struct mgmt_cp_set_local_name ev;
3b0602cd 7899 struct mgmt_pending_cmd *cmd;
28cc7bde 7900
13928971 7901 if (status)
7667da34 7902 return;
b312b161
JH		 7903
7904 memset(&ev, 0, sizeof(ev));
7905 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 7906 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 7907
333ae95d 7908 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 7909 if (!cmd) {
7910 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 7911
13928971
JH		 7912 /* If this is a HCI command related to powering on the
7913 * HCI dev don't send any mgmt signals.
7914 */
333ae95d 7915 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 7916 return;
890ea898 7917 }
b312b161 7918
f6b7712e
MH		 7919 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7920 cmd ? cmd->sk : NULL);
b312b161 7921}
c35938b2 7922
4d2d2796 7923void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
38da1703
JH		 7924 u8 *rand192, u8 *hash256, u8 *rand256,
7925 u8 status)
c35938b2 7926{
3b0602cd 7927 struct mgmt_pending_cmd *cmd;
c35938b2 7928
744cf19e 7929 BT_DBG("%s status %u", hdev->name, status);
c35938b2 7930
333ae95d 7931 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 7932 if (!cmd)
3edaf092 7933 return;
c35938b2
SJ		 7934
7935 if (status) {
a69e8375
JH		 7936 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7937 mgmt_status(status));
c35938b2 7938 } else {
66f096f7
JH		 7939 struct mgmt_rp_read_local_oob_data rp;
7940 size_t rp_size = sizeof(rp);
4d2d2796 7941
66f096f7
JH		 7942 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7943 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
c35938b2 7944
66f096f7 7945 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
4d2d2796 7946 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
38da1703 7947 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
4d2d2796 7948 } else {
66f096f7 7949 rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
4d2d2796 7950 }
66f096f7 7951
2a1afb5a
JH		 7952 mgmt_cmd_complete(cmd->sk, hdev->id,
7953 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7954 &rp, rp_size);
c35938b2
SJ		 7955 }
7956
7957 mgmt_pending_remove(cmd);
c35938b2 7958}
e17acd40 7959
799ce93d
JP		 7960static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7961{
7962 int i;
7963
7964 for (i = 0; i < uuid_count; i++) {
7965 if (!memcmp(uuid, uuids[i], 16))
7966 return true;
7967 }
7968
7969 return false;
7970}
7971
b487b9ce
MH		 7972static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7973{
799ce93d
JP		 7974 u16 parsed = 0;
7975
7976 while (parsed < eir_len) {
7977 u8 field_len = eir[0];
7978 u8 uuid[16];
7979 int i;
7980
7981 if (field_len == 0)
7982 break;
7983
7984 if (eir_len - parsed < field_len + 1)
7985 break;
7986
7987 switch (eir[1]) {
7988 case EIR_UUID16_ALL:
7989 case EIR_UUID16_SOME:
7990 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 7991 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7992 uuid[13] = eir[i + 3];
7993 uuid[12] = eir[i + 2];
7994 if (has_uuid(uuid, uuid_count, uuids))
7995 return true;
7996 }
7997 break;
7998 case EIR_UUID32_ALL:
7999 case EIR_UUID32_SOME:
8000 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 8001 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8002 uuid[15] = eir[i + 5];
8003 uuid[14] = eir[i + 4];
8004 uuid[13] = eir[i + 3];
8005 uuid[12] = eir[i + 2];
8006 if (has_uuid(uuid, uuid_count, uuids))
8007 return true;
8008 }
8009 break;
8010 case EIR_UUID128_ALL:
8011 case EIR_UUID128_SOME:
8012 for (i = 0; i + 17 <= field_len; i += 16) {
8013 memcpy(uuid, eir + i + 2, 16);
8014 if (has_uuid(uuid, uuid_count, uuids))
8015 return true;
8016 }
8017 break;
8018 }
8019
8020 parsed += field_len + 1;
8021 eir += field_len + 1;
8022 }
8023
b487b9ce
MH		 8024 return false;
8025}
8026
4b0e0ced
JP		 8027static void restart_le_scan(struct hci_dev *hdev)
8028{
8029 /* If controller is not scanning we are done. */
d7a5a11d 8030 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 8031 return;
8032
8033 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8034 hdev->discovery.scan_start +
8035 hdev->discovery.scan_duration))
8036 return;
8037
8038 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8039 DISCOV_LE_RESTART_DELAY);
8040}
8041
48f86b7f
JP		 8042static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8043 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 8044{
48f86b7f
JP		 8045 /* If a RSSI threshold has been specified, and
8046 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8047 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8048 * is set, let it through for further processing, as we might need to
8049 * restart the scan.
efb2513f
MH		 8050 *
8051 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8052 * the results are also dropped.
bda157a4
MH		 8053 */
8054 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 8055 (rssi == HCI_RSSI_INVALID ||
8056 (rssi < hdev->discovery.rssi &&
8057 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 8058 return false;
efb2513f 8059
2976cdeb
JP		 8060 if (hdev->discovery.uuid_count != 0) {
8061 /* If a list of UUIDs is provided in filter, results with no
8062 * matching UUID should be dropped.
b487b9ce 8063 */
2976cdeb
JP		 8064 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8065 hdev->discovery.uuids) &&
8066 !eir_has_uuids(scan_rsp, scan_rsp_len,
8067 hdev->discovery.uuid_count,
8068 hdev->discovery.uuids))
8069 return false;
b487b9ce 8070 }
5d2e9fad 8071
2976cdeb
JP		 8072 /* If duplicate filtering does not report RSSI changes, then restart
8073 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 8074 */
2976cdeb
JP		 8075 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8076 restart_le_scan(hdev);
8077
8078 /* Validate RSSI value against the RSSI threshold once more. */
8079 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8080 rssi < hdev->discovery.rssi)
8081 return false;
8082 }
48f86b7f
JP		 8083
8084 return true;
8085}
8086
8087void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8088 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8089 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8090{
8091 char buf[512];
8092 struct mgmt_ev_device_found *ev = (void *)buf;
8093 size_t ev_size;
8094
8095 /* Don't send events for a non-kernel initiated discovery. With
8096 * LE one exception is if we have pend_le_reports > 0 in which
8097 * case we're doing passive scanning and want these events.
8098 */
8099 if (!hci_discovery_active(hdev)) {
8100 if (link_type == ACL_LINK)
8101 return;
8102 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8103 return;
8104 }
8105
82f8b651 8106 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 8107 /* We are using service discovery */
8108 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8109 scan_rsp_len))
8110 return;
8111 }
8112
8113 /* Make sure that the buffer is big enough. The 5 extra bytes
8114 * are for the potential CoD field.
8115 */
8116 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 8117 return;
8118
48f86b7f
JP		 8119 memset(buf, 0, sizeof(buf));
8120
8121 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8122 * RSSI value was reported as 0 when not available. This behavior
8123 * is kept when using device discovery. This is required for full
8124 * backwards compatibility with the API.
8125 *
8126 * However when using service discovery, the value 127 will be
8127 * returned when the RSSI is not available.
8128 */
8129 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8130 link_type == ACL_LINK)
8131 rssi = 0;
8132
8133 bacpy(&ev->addr.bdaddr, bdaddr);
8134 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8135 ev->rssi = rssi;
8136 ev->flags = cpu_to_le32(flags);
8137
8138 if (eir_len > 0)
8139 /* Copy EIR or advertising data into event */
8140 memcpy(ev->eir, eir, eir_len);
8141
8142 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8143 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8144 dev_class, 3);
8145
8146 if (scan_rsp_len > 0)
8147 /* Append scan response data to event */
8148 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8149
5d2e9fad
JH		 8150 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8151 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 8152
901801b9 8153 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 8154}
a88a9652 8155
9cf12aee
MH		 8156void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8157 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 8158{
b644ba33
JH		 8159 struct mgmt_ev_device_found *ev;
8160 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8161 u16 eir_len;
a88a9652 8162
b644ba33 8163 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 8164
b644ba33
JH		 8165 memset(buf, 0, sizeof(buf));
8166
8167 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 8168 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 8169 ev->rssi = rssi;
8170
8171 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 8172 name_len);
b644ba33 8173
eb55ef07 8174 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 8175
9cf12aee 8176 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 8177}
314b2381 8178
2f1e063b 8179void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 8180{
f963e8e9 8181 struct mgmt_ev_discovering ev;
164a6e78 8182
343fb145
AG		 8183 BT_DBG("%s discovering %u", hdev->name, discovering);
8184
f963e8e9
JH		 8185 memset(&ev, 0, sizeof(ev));
8186 ev.type = hdev->discovery.type;
8187 ev.discovering = discovering;
8188
2f1e063b 8189 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 8190}
5e762444 8191
1904a853 8192static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 8193{
8194 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 8195}
8196
8197void mgmt_reenable_advertising(struct hci_dev *hdev)
8198{
8199 struct hci_request req;
8200
24b4f38f
AU		 8201 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8202 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
5976e608
MH		 8203 return;
8204
8205 hci_req_init(&req, hdev);
8206 enable_advertising(&req);
0ec5ae84 8207 hci_req_run(&req, adv_enable_complete);
5976e608 8208}
6d785aa3
JH		 8209
8210static struct hci_mgmt_chan chan = {
8211 .channel = HCI_CHANNEL_CONTROL,
8212 .handler_count = ARRAY_SIZE(mgmt_handlers),
8213 .handlers = mgmt_handlers,
88b94ce9 8214 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 8215};
8216
8217int mgmt_init(void)
8218{
8219 return hci_mgmt_chan_register(&chan);
8220}
8221
8222void mgmt_exit(void)
8223{
8224 hci_mgmt_chan_unregister(&chan);
8225}
Empty description
This page took 1.927942 seconds and 4 git commands to generate.