projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove unnecessary queue_monitor_skb() function
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
0381101f 38
2da9c55c 39#define MGMT_VERSION 1
854bda19 40#define MGMT_REVISION 8
02d98129 41
e70bb2e8
JH		 42static const u16 mgmt_commands[] = {
43 MGMT_OP_READ_INDEX_LIST,
44 MGMT_OP_READ_INFO,
45 MGMT_OP_SET_POWERED,
46 MGMT_OP_SET_DISCOVERABLE,
47 MGMT_OP_SET_CONNECTABLE,
48 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 49 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 50 MGMT_OP_SET_LINK_SECURITY,
51 MGMT_OP_SET_SSP,
52 MGMT_OP_SET_HS,
53 MGMT_OP_SET_LE,
54 MGMT_OP_SET_DEV_CLASS,
55 MGMT_OP_SET_LOCAL_NAME,
56 MGMT_OP_ADD_UUID,
57 MGMT_OP_REMOVE_UUID,
58 MGMT_OP_LOAD_LINK_KEYS,
59 MGMT_OP_LOAD_LONG_TERM_KEYS,
60 MGMT_OP_DISCONNECT,
61 MGMT_OP_GET_CONNECTIONS,
62 MGMT_OP_PIN_CODE_REPLY,
63 MGMT_OP_PIN_CODE_NEG_REPLY,
64 MGMT_OP_SET_IO_CAPABILITY,
65 MGMT_OP_PAIR_DEVICE,
66 MGMT_OP_CANCEL_PAIR_DEVICE,
67 MGMT_OP_UNPAIR_DEVICE,
68 MGMT_OP_USER_CONFIRM_REPLY,
69 MGMT_OP_USER_CONFIRM_NEG_REPLY,
70 MGMT_OP_USER_PASSKEY_REPLY,
71 MGMT_OP_USER_PASSKEY_NEG_REPLY,
72 MGMT_OP_READ_LOCAL_OOB_DATA,
73 MGMT_OP_ADD_REMOTE_OOB_DATA,
74 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
75 MGMT_OP_START_DISCOVERY,
76 MGMT_OP_STOP_DISCOVERY,
77 MGMT_OP_CONFIRM_NAME,
78 MGMT_OP_BLOCK_DEVICE,
79 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 80 MGMT_OP_SET_DEVICE_ID,
4375f103 81 MGMT_OP_SET_ADVERTISING,
0663ca2a 82 MGMT_OP_SET_BREDR,
d13eafce 83 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 84 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 85 MGMT_OP_SET_SECURE_CONN,
4e39ac81 86 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 87 MGMT_OP_SET_PRIVACY,
41edf160 88 MGMT_OP_LOAD_IRKS,
dd983808 89 MGMT_OP_GET_CONN_INFO,
95868426 90 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 91 MGMT_OP_ADD_DEVICE,
92 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 93 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 94 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 95 MGMT_OP_READ_CONFIG_INFO,
dbece37a 96 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 97 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 98 MGMT_OP_START_SERVICE_DISCOVERY,
e70bb2e8
JH		 99};
100
101static const u16 mgmt_events[] = {
102 MGMT_EV_CONTROLLER_ERROR,
103 MGMT_EV_INDEX_ADDED,
104 MGMT_EV_INDEX_REMOVED,
105 MGMT_EV_NEW_SETTINGS,
106 MGMT_EV_CLASS_OF_DEV_CHANGED,
107 MGMT_EV_LOCAL_NAME_CHANGED,
108 MGMT_EV_NEW_LINK_KEY,
109 MGMT_EV_NEW_LONG_TERM_KEY,
110 MGMT_EV_DEVICE_CONNECTED,
111 MGMT_EV_DEVICE_DISCONNECTED,
112 MGMT_EV_CONNECT_FAILED,
113 MGMT_EV_PIN_CODE_REQUEST,
114 MGMT_EV_USER_CONFIRM_REQUEST,
115 MGMT_EV_USER_PASSKEY_REQUEST,
116 MGMT_EV_AUTH_FAILED,
117 MGMT_EV_DEVICE_FOUND,
118 MGMT_EV_DISCOVERING,
119 MGMT_EV_DEVICE_BLOCKED,
120 MGMT_EV_DEVICE_UNBLOCKED,
121 MGMT_EV_DEVICE_UNPAIRED,
92a25256 122 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 123 MGMT_EV_NEW_IRK,
7ee4ea36 124 MGMT_EV_NEW_CSRK,
8afef092
MH		 125 MGMT_EV_DEVICE_ADDED,
126 MGMT_EV_DEVICE_REMOVED,
ffb5a827 127 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 128 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 129 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 130 MGMT_EV_NEW_CONFIG_OPTIONS,
e70bb2e8
JH		 131};
132
17b02e62 133#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 134
d25b78e2
JH		 135#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
136 "\x00\x00\x00\x00\x00\x00\x00\x00"
137
eec8d2bc
JH		 138struct pending_cmd {
139 struct list_head list;
fc2f4b13 140 u16 opcode;
eec8d2bc 141 int index;
c68fb7ff 142 void *param;
323b0b88 143 size_t param_len;
eec8d2bc 144 struct sock *sk;
e9a416b5 145 void *user_data;
9df74653 146 int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
eec8d2bc
JH		 147};
148
ca69b795
JH		 149/* HCI to MGMT error code conversion table */
150static u8 mgmt_status_table[] = {
151 MGMT_STATUS_SUCCESS,
152 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
153 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
154 MGMT_STATUS_FAILED, /* Hardware Failure */
155 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
156 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 157 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 158 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
159 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
160 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
161 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
162 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
163 MGMT_STATUS_BUSY, /* Command Disallowed */
164 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
165 MGMT_STATUS_REJECTED, /* Rejected Security */
166 MGMT_STATUS_REJECTED, /* Rejected Personal */
167 MGMT_STATUS_TIMEOUT, /* Host Timeout */
168 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
169 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
170 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
171 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
172 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
173 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
174 MGMT_STATUS_BUSY, /* Repeated Attempts */
175 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
176 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
177 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
178 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
179 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
180 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
181 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
182 MGMT_STATUS_FAILED, /* Unspecified Error */
183 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
184 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
185 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
186 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
187 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
188 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
189 MGMT_STATUS_FAILED, /* Unit Link Key Used */
190 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
191 MGMT_STATUS_TIMEOUT, /* Instant Passed */
192 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
193 MGMT_STATUS_FAILED, /* Transaction Collision */
194 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
195 MGMT_STATUS_REJECTED, /* QoS Rejected */
196 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
197 MGMT_STATUS_REJECTED, /* Insufficient Security */
198 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
199 MGMT_STATUS_BUSY, /* Role Switch Pending */
200 MGMT_STATUS_FAILED, /* Slot Violation */
201 MGMT_STATUS_FAILED, /* Role Switch Failed */
202 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
203 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
204 MGMT_STATUS_BUSY, /* Host Busy Pairing */
205 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
206 MGMT_STATUS_BUSY, /* Controller Busy */
207 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
208 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
209 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
210 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
211 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
212};
213
214static u8 mgmt_status(u8 hci_status)
215{
216 if (hci_status < ARRAY_SIZE(mgmt_status_table))
217 return mgmt_status_table[hci_status];
218
219 return MGMT_STATUS_FAILED;
220}
221
04c60f05
MH		 222static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
223 struct sock *skip_sk)
224{
225 struct sk_buff *skb;
226 struct mgmt_hdr *hdr;
227
228 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
229 if (!skb)
230 return -ENOMEM;
231
232 hdr = (void *) skb_put(skb, sizeof(*hdr));
233 hdr->opcode = cpu_to_le16(event);
234 if (hdev)
235 hdr->index = cpu_to_le16(hdev->id);
236 else
237 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
238 hdr->len = cpu_to_le16(data_len);
239
240 if (data)
241 memcpy(skb_put(skb, data_len), data, data_len);
242
243 /* Time stamp */
244 __net_timestamp(skb);
245
7129069e 246 hci_send_to_channel(HCI_CHANNEL_CONTROL, skb, skip_sk);
04c60f05
MH		 247 kfree_skb(skb);
248
249 return 0;
250}
251
4e51eae9 252static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
f7b64e69
JH		 253{
254 struct sk_buff *skb;
255 struct mgmt_hdr *hdr;
256 struct mgmt_ev_cmd_status *ev;
56b7d137 257 int err;
f7b64e69 258
34eb525c 259 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
f7b64e69 260
790eff44 261 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
f7b64e69
JH		 262 if (!skb)
263 return -ENOMEM;
264
265 hdr = (void *) skb_put(skb, sizeof(*hdr));
266
dcf4adbf 267 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
4e51eae9 268 hdr->index = cpu_to_le16(index);
f7b64e69
JH		 269 hdr->len = cpu_to_le16(sizeof(*ev));
270
271 ev = (void *) skb_put(skb, sizeof(*ev));
272 ev->status = status;
eb55ef07 273 ev->opcode = cpu_to_le16(cmd);
f7b64e69 274
56b7d137
GP		 275 err = sock_queue_rcv_skb(sk, skb);
276 if (err < 0)
f7b64e69
JH		 277 kfree_skb(skb);
278
56b7d137 279 return err;
f7b64e69
JH		 280}
281
aee9b218 282static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
04124681 283 void *rp, size_t rp_len)
02d98129
JH		 284{
285 struct sk_buff *skb;
286 struct mgmt_hdr *hdr;
287 struct mgmt_ev_cmd_complete *ev;
56b7d137 288 int err;
02d98129
JH		 289
290 BT_DBG("sock %p", sk);
291
790eff44 292 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
02d98129
JH		 293 if (!skb)
294 return -ENOMEM;
295
296 hdr = (void *) skb_put(skb, sizeof(*hdr));
02d98129 297
dcf4adbf 298 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
4e51eae9 299 hdr->index = cpu_to_le16(index);
a38528f1 300 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
02d98129 301
a38528f1 302 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
eb55ef07 303 ev->opcode = cpu_to_le16(cmd);
aee9b218 304 ev->status = status;
8020c16a
SJ		 305
306 if (rp)
307 memcpy(ev->data, rp, rp_len);
02d98129 308
56b7d137
GP		 309 err = sock_queue_rcv_skb(sk, skb);
310 if (err < 0)
02d98129
JH		 311 kfree_skb(skb);
312
e5f0e151 313 return err;
02d98129
JH		 314}
315
04124681
GP		 316static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
317 u16 data_len)
a38528f1
JH		 318{
319 struct mgmt_rp_read_version rp;
320
321 BT_DBG("sock %p", sk);
322
323 rp.version = MGMT_VERSION;
dcf4adbf 324 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 325
aee9b218 326 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
04124681 327 sizeof(rp));
a38528f1
JH		 328}
329
04124681
GP		 330static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
331 u16 data_len)
e70bb2e8
JH		 332{
333 struct mgmt_rp_read_commands *rp;
eb55ef07
MH		 334 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
335 const u16 num_events = ARRAY_SIZE(mgmt_events);
2e3c35ea 336 __le16 *opcode;
e70bb2e8
JH		 337 size_t rp_size;
338 int i, err;
339
340 BT_DBG("sock %p", sk);
341
342 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
343
344 rp = kmalloc(rp_size, GFP_KERNEL);
345 if (!rp)
346 return -ENOMEM;
347
dcf4adbf
JP		 348 rp->num_commands = cpu_to_le16(num_commands);
349 rp->num_events = cpu_to_le16(num_events);
e70bb2e8
JH		 350
351 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
352 put_unaligned_le16(mgmt_commands[i], opcode);
353
354 for (i = 0; i < num_events; i++, opcode++)
355 put_unaligned_le16(mgmt_events[i], opcode);
356
aee9b218 357 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
04124681 358 rp_size);
e70bb2e8
JH		 359 kfree(rp);
360
361 return err;
362}
363
04124681
GP		 364static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
365 u16 data_len)
faba42eb 366{
faba42eb 367 struct mgmt_rp_read_index_list *rp;
8035ded4 368 struct hci_dev *d;
a38528f1 369 size_t rp_len;
faba42eb 370 u16 count;
476e44cb 371 int err;
faba42eb
JH		 372
373 BT_DBG("sock %p", sk);
374
375 read_lock(&hci_dev_list_lock);
376
377 count = 0;
bb4b2a9a 378 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a
MH		 379 if (d->dev_type == HCI_BREDR &&
380 !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
1514b892 381 count++;
faba42eb
JH		 382 }
383
a38528f1
JH		 384 rp_len = sizeof(*rp) + (2 * count);
385 rp = kmalloc(rp_len, GFP_ATOMIC);
386 if (!rp) {
b2c60d42 387 read_unlock(&hci_dev_list_lock);
faba42eb 388 return -ENOMEM;
b2c60d42 389 }
faba42eb 390
476e44cb 391 count = 0;
8035ded4 392 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 393 if (test_bit(HCI_SETUP, &d->dev_flags) ||
d603b76b 394 test_bit(HCI_CONFIG, &d->dev_flags) ||
73d1df2a 395 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
ab81cbf9
JH		 396 continue;
397
73d1df2a
MH		 398 /* Devices marked as raw-only are neither configured
399 * nor unconfigured controllers.
400 */
401 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 402 continue;
403
73d1df2a
MH		 404 if (d->dev_type == HCI_BREDR &&
405 !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
1514b892
MH		 406 rp->index[count++] = cpu_to_le16(d->id);
407 BT_DBG("Added hci%u", d->id);
408 }
faba42eb
JH		 409 }
410
476e44cb
JH		 411 rp->num_controllers = cpu_to_le16(count);
412 rp_len = sizeof(*rp) + (2 * count);
413
faba42eb
JH		 414 read_unlock(&hci_dev_list_lock);
415
aee9b218 416 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
04124681 417 rp_len);
faba42eb 418
a38528f1
JH		 419 kfree(rp);
420
421 return err;
faba42eb
JH		 422}
423
73d1df2a
MH		 424static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
425 void *data, u16 data_len)
426{
427 struct mgmt_rp_read_unconf_index_list *rp;
428 struct hci_dev *d;
429 size_t rp_len;
430 u16 count;
431 int err;
432
433 BT_DBG("sock %p", sk);
434
435 read_lock(&hci_dev_list_lock);
436
437 count = 0;
438 list_for_each_entry(d, &hci_dev_list, list) {
439 if (d->dev_type == HCI_BREDR &&
440 test_bit(HCI_UNCONFIGURED, &d->dev_flags))
441 count++;
442 }
443
444 rp_len = sizeof(*rp) + (2 * count);
445 rp = kmalloc(rp_len, GFP_ATOMIC);
446 if (!rp) {
447 read_unlock(&hci_dev_list_lock);
448 return -ENOMEM;
449 }
450
451 count = 0;
452 list_for_each_entry(d, &hci_dev_list, list) {
453 if (test_bit(HCI_SETUP, &d->dev_flags) ||
d603b76b 454 test_bit(HCI_CONFIG, &d->dev_flags) ||
73d1df2a
MH		 455 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
456 continue;
457
458 /* Devices marked as raw-only are neither configured
459 * nor unconfigured controllers.
460 */
461 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
462 continue;
463
464 if (d->dev_type == HCI_BREDR &&
465 test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
466 rp->index[count++] = cpu_to_le16(d->id);
467 BT_DBG("Added hci%u", d->id);
468 }
469 }
470
471 rp->num_controllers = cpu_to_le16(count);
472 rp_len = sizeof(*rp) + (2 * count);
473
474 read_unlock(&hci_dev_list_lock);
475
476 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
477 0, rp, rp_len);
478
479 kfree(rp);
480
481 return err;
482}
483
dbece37a
MH		 484static bool is_configured(struct hci_dev *hdev)
485{
486 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
487 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
488 return false;
489
490 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
491 !bacmp(&hdev->public_addr, BDADDR_ANY))
492 return false;
493
494 return true;
495}
496
89bc22d2
MH		 497static __le32 get_missing_options(struct hci_dev *hdev)
498{
499 u32 options = 0;
500
dbece37a
MH		 501 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
502 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
eb1904f4
MH		 503 options |= MGMT_OPTION_EXTERNAL_CONFIG;
504
89bc22d2
MH		 505 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
506 !bacmp(&hdev->public_addr, BDADDR_ANY))
507 options |= MGMT_OPTION_PUBLIC_ADDRESS;
508
509 return cpu_to_le32(options);
510}
511
f4537c04
MH		 512static int new_options(struct hci_dev *hdev, struct sock *skip)
513{
514 __le32 options = get_missing_options(hdev);
515
516 return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
517 sizeof(options), skip);
518}
519
dbece37a
MH		 520static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
521{
522 __le32 options = get_missing_options(hdev);
523
524 return cmd_complete(sk, hdev->id, opcode, 0, &options,
525 sizeof(options));
526}
527
9fc3bfb6
MH		 528static int read_config_info(struct sock *sk, struct hci_dev *hdev,
529 void *data, u16 data_len)
530{
531 struct mgmt_rp_read_config_info rp;
89bc22d2 532 u32 options = 0;
9fc3bfb6
MH		 533
534 BT_DBG("sock %p %s", sk, hdev->name);
535
536 hci_dev_lock(hdev);
537
538 memset(&rp, 0, sizeof(rp));
539 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 540
eb1904f4
MH		 541 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
542 options |= MGMT_OPTION_EXTERNAL_CONFIG;
543
9fc3bfb6 544 if (hdev->set_bdaddr)
89bc22d2
MH		 545 options |= MGMT_OPTION_PUBLIC_ADDRESS;
546
547 rp.supported_options = cpu_to_le32(options);
548 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 549
550 hci_dev_unlock(hdev);
551
552 return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
553 sizeof(rp));
554}
555
69ab39ea
JH		 556static u32 get_supported_settings(struct hci_dev *hdev)
557{
558 u32 settings = 0;
559
560 settings |= MGMT_SETTING_POWERED;
b2939475 561 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 562 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 563 settings |= MGMT_SETTING_CONNECTABLE;
564 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 565
ed3fa31f 566 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 567 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
568 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 569 settings |= MGMT_SETTING_BREDR;
570 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 571
572 if (lmp_ssp_capable(hdev)) {
573 settings |= MGMT_SETTING_SSP;
574 settings |= MGMT_SETTING_HS;
575 }
e98d2ce2 576
05b3c3e7 577 if (lmp_sc_capable(hdev))
e98d2ce2 578 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 579 }
d7b7e796 580
eeca6f89 581 if (lmp_le_capable(hdev)) {
9d42820f 582 settings |= MGMT_SETTING_LE;
eeca6f89 583 settings |= MGMT_SETTING_ADVERTISING;
a3209694 584 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 585 settings |= MGMT_SETTING_PRIVACY;
eeca6f89 586 }
69ab39ea 587
eb1904f4
MH		 588 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
589 hdev->set_bdaddr)
9fc3bfb6
MH		 590 settings |= MGMT_SETTING_CONFIGURATION;
591
69ab39ea
JH		 592 return settings;
593}
594
595static u32 get_current_settings(struct hci_dev *hdev)
596{
597 u32 settings = 0;
598
f1f0eb02 599 if (hdev_is_powered(hdev))
f0d4b78a
MH		 600 settings |= MGMT_SETTING_POWERED;
601
5e5282bb 602 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
69ab39ea
JH		 603 settings |= MGMT_SETTING_CONNECTABLE;
604
1a4d3c4b
JH		 605 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
606 settings |= MGMT_SETTING_FAST_CONNECTABLE;
607
5e5282bb 608 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
69ab39ea
JH		 609 settings |= MGMT_SETTING_DISCOVERABLE;
610
b6ae8457 611 if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
b2939475 612 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 613
56f87901 614 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 615 settings |= MGMT_SETTING_BREDR;
616
06199cf8 617 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 618 settings |= MGMT_SETTING_LE;
619
47990ea0 620 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
69ab39ea
JH		 621 settings |= MGMT_SETTING_LINK_SECURITY;
622
84bde9d6 623 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 624 settings |= MGMT_SETTING_SSP;
625
6d80dfd0
JH		 626 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
627 settings |= MGMT_SETTING_HS;
628
f3d3444a 629 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
eeca6f89
JH		 630 settings |= MGMT_SETTING_ADVERTISING;
631
e98d2ce2
MH		 632 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
633 settings |= MGMT_SETTING_SECURE_CONN;
634
0663b297 635 if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
b1de97d8
MH		 636 settings |= MGMT_SETTING_DEBUG_KEYS;
637
0f4bd942
JH		 638 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
639 settings |= MGMT_SETTING_PRIVACY;
640
69ab39ea
JH		 641 return settings;
642}
643
ef580372
JH		 644#define PNP_INFO_SVCLASS_ID 0x1200
645
213202ed
JH		 646static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
647{
648 u8 *ptr = data, *uuids_start = NULL;
649 struct bt_uuid *uuid;
650
651 if (len < 4)
652 return ptr;
653
654 list_for_each_entry(uuid, &hdev->uuids, list) {
655 u16 uuid16;
656
657 if (uuid->size != 16)
658 continue;
659
660 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
661 if (uuid16 < 0x1100)
662 continue;
663
664 if (uuid16 == PNP_INFO_SVCLASS_ID)
665 continue;
666
667 if (!uuids_start) {
668 uuids_start = ptr;
669 uuids_start[0] = 1;
670 uuids_start[1] = EIR_UUID16_ALL;
671 ptr += 2;
672 }
673
674 /* Stop if not enough space to put next UUID */
675 if ((ptr - data) + sizeof(u16) > len) {
676 uuids_start[1] = EIR_UUID16_SOME;
677 break;
678 }
679
680 *ptr++ = (uuid16 & 0x00ff);
681 *ptr++ = (uuid16 & 0xff00) >> 8;
682 uuids_start[0] += sizeof(uuid16);
683 }
684
685 return ptr;
686}
687
cdf1963f
JH		 688static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
689{
690 u8 *ptr = data, *uuids_start = NULL;
691 struct bt_uuid *uuid;
692
693 if (len < 6)
694 return ptr;
695
696 list_for_each_entry(uuid, &hdev->uuids, list) {
697 if (uuid->size != 32)
698 continue;
699
700 if (!uuids_start) {
701 uuids_start = ptr;
702 uuids_start[0] = 1;
703 uuids_start[1] = EIR_UUID32_ALL;
704 ptr += 2;
705 }
706
707 /* Stop if not enough space to put next UUID */
708 if ((ptr - data) + sizeof(u32) > len) {
709 uuids_start[1] = EIR_UUID32_SOME;
710 break;
711 }
712
713 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
714 ptr += sizeof(u32);
715 uuids_start[0] += sizeof(u32);
716 }
717
718 return ptr;
719}
720
c00d575b
JH		 721static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
722{
723 u8 *ptr = data, *uuids_start = NULL;
724 struct bt_uuid *uuid;
725
726 if (len < 18)
727 return ptr;
728
729 list_for_each_entry(uuid, &hdev->uuids, list) {
730 if (uuid->size != 128)
731 continue;
732
733 if (!uuids_start) {
734 uuids_start = ptr;
735 uuids_start[0] = 1;
736 uuids_start[1] = EIR_UUID128_ALL;
737 ptr += 2;
738 }
739
740 /* Stop if not enough space to put next UUID */
741 if ((ptr - data) + 16 > len) {
742 uuids_start[1] = EIR_UUID128_SOME;
743 break;
744 }
745
746 memcpy(ptr, uuid->uuid, 16);
747 ptr += 16;
748 uuids_start[0] += 16;
749 }
750
751 return ptr;
752}
753
eb2a8d20
JH		 754static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
755{
756 struct pending_cmd *cmd;
757
758 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
759 if (cmd->opcode == opcode)
760 return cmd;
761 }
762
763 return NULL;
764}
765
95868426
JH		 766static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
767 struct hci_dev *hdev,
768 const void *data)
769{
770 struct pending_cmd *cmd;
771
772 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
773 if (cmd->user_data != data)
774 continue;
775 if (cmd->opcode == opcode)
776 return cmd;
777 }
778
779 return NULL;
780}
781
f14d8f64
MH		 782static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
783{
7a5f4990
MH		 784 u8 ad_len = 0;
785 size_t name_len;
786
787 name_len = strlen(hdev->dev_name);
788 if (name_len > 0) {
789 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
790
791 if (name_len > max_len) {
792 name_len = max_len;
793 ptr[1] = EIR_NAME_SHORT;
794 } else
795 ptr[1] = EIR_NAME_COMPLETE;
796
797 ptr[0] = name_len + 1;
798
799 memcpy(ptr + 2, hdev->dev_name, name_len);
800
801 ad_len += (name_len + 2);
802 ptr += (name_len + 2);
803 }
804
805 return ad_len;
f14d8f64
MH		 806}
807
808static void update_scan_rsp_data(struct hci_request *req)
809{
810 struct hci_dev *hdev = req->hdev;
811 struct hci_cp_le_set_scan_rsp_data cp;
812 u8 len;
813
7751ef1b 814 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
f14d8f64
MH		 815 return;
816
817 memset(&cp, 0, sizeof(cp));
818
819 len = create_scan_rsp_data(hdev, cp.data);
820
eb438b5f
JH		 821 if (hdev->scan_rsp_data_len == len &&
822 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
f14d8f64
MH		 823 return;
824
eb438b5f
JH		 825 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
826 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 827
828 cp.length = len;
829
830 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
831}
832
9a43e25f
JH		 833static u8 get_adv_discov_flags(struct hci_dev *hdev)
834{
835 struct pending_cmd *cmd;
836
837 /* If there's a pending mgmt command the flags will not yet have
838 * their final values, so check for this first.
839 */
840 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
841 if (cmd) {
842 struct mgmt_mode *cp = cmd->param;
843 if (cp->val == 0x01)
844 return LE_AD_GENERAL;
845 else if (cp->val == 0x02)
846 return LE_AD_LIMITED;
847 } else {
848 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
849 return LE_AD_LIMITED;
850 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
851 return LE_AD_GENERAL;
852 }
853
854 return 0;
855}
856
46cad2ed 857static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
441ad2d0
MH		 858{
859 u8 ad_len = 0, flags = 0;
441ad2d0 860
9a43e25f 861 flags |= get_adv_discov_flags(hdev);
441ad2d0 862
e834004b 863 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
441ad2d0 864 flags |= LE_AD_NO_BREDR;
441ad2d0
MH		 865
866 if (flags) {
867 BT_DBG("adv flags 0x%02x", flags);
868
869 ptr[0] = 2;
870 ptr[1] = EIR_FLAGS;
871 ptr[2] = flags;
872
873 ad_len += 3;
874 ptr += 3;
875 }
876
877 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
878 ptr[0] = 2;
879 ptr[1] = EIR_TX_POWER;
880 ptr[2] = (u8) hdev->adv_tx_power;
881
882 ad_len += 3;
883 ptr += 3;
884 }
885
441ad2d0
MH		 886 return ad_len;
887}
888
5947f4bc 889static void update_adv_data(struct hci_request *req)
441ad2d0
MH		 890{
891 struct hci_dev *hdev = req->hdev;
892 struct hci_cp_le_set_adv_data cp;
893 u8 len;
894
10994ce6 895 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
441ad2d0
MH		 896 return;
897
898 memset(&cp, 0, sizeof(cp));
899
46cad2ed 900 len = create_adv_data(hdev, cp.data);
441ad2d0
MH		 901
902 if (hdev->adv_data_len == len &&
903 memcmp(cp.data, hdev->adv_data, len) == 0)
904 return;
905
906 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
907 hdev->adv_data_len = len;
908
909 cp.length = len;
910
911 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
912}
913
bc6d2d04
JH		 914int mgmt_update_adv_data(struct hci_dev *hdev)
915{
916 struct hci_request req;
917
918 hci_req_init(&req, hdev);
919 update_adv_data(&req);
920
921 return hci_req_run(&req, NULL);
922}
923
ef580372
JH		 924static void create_eir(struct hci_dev *hdev, u8 *data)
925{
926 u8 *ptr = data;
ef580372
JH		 927 size_t name_len;
928
929 name_len = strlen(hdev->dev_name);
930
931 if (name_len > 0) {
932 /* EIR Data type */
933 if (name_len > 48) {
934 name_len = 48;
935 ptr[1] = EIR_NAME_SHORT;
936 } else
937 ptr[1] = EIR_NAME_COMPLETE;
938
939 /* EIR Data length */
940 ptr[0] = name_len + 1;
941
942 memcpy(ptr + 2, hdev->dev_name, name_len);
943
ef580372
JH		 944 ptr += (name_len + 2);
945 }
946
bbaf444a 947 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 948 ptr[0] = 2;
949 ptr[1] = EIR_TX_POWER;
950 ptr[2] = (u8) hdev->inq_tx_power;
951
91c4e9b1
MH		 952 ptr += 3;
953 }
954
2b9be137
MH		 955 if (hdev->devid_source > 0) {
956 ptr[0] = 9;
957 ptr[1] = EIR_DEVICE_ID;
958
959 put_unaligned_le16(hdev->devid_source, ptr + 2);
960 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
961 put_unaligned_le16(hdev->devid_product, ptr + 6);
962 put_unaligned_le16(hdev->devid_version, ptr + 8);
963
2b9be137
MH		 964 ptr += 10;
965 }
966
213202ed 967 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 968 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 969 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 970}
971
890ea898 972static void update_eir(struct hci_request *req)
ef580372 973{
890ea898 974 struct hci_dev *hdev = req->hdev;
ef580372
JH		 975 struct hci_cp_write_eir cp;
976
504c8dcd 977 if (!hdev_is_powered(hdev))
890ea898 978 return;
7770c4aa 979
976eb20e 980 if (!lmp_ext_inq_capable(hdev))
890ea898 981 return;
ef580372 982
84bde9d6 983 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
890ea898 984 return;
ef580372 985
a8b2d5c2 986 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 987 return;
ef580372
JH		 988
989 memset(&cp, 0, sizeof(cp));
990
991 create_eir(hdev, cp.data);
992
993 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 994 return;
ef580372
JH		 995
996 memcpy(hdev->eir, cp.data, sizeof(cp.data));
997
890ea898 998 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 999}
1000
1001static u8 get_service_classes(struct hci_dev *hdev)
1002{
1003 struct bt_uuid *uuid;
1004 u8 val = 0;
1005
1006 list_for_each_entry(uuid, &hdev->uuids, list)
1007 val |= uuid->svc_hint;
1008
1009 return val;
1010}
1011
890ea898 1012static void update_class(struct hci_request *req)
ef580372 1013{
890ea898 1014 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1015 u8 cod[3];
1016
1017 BT_DBG("%s", hdev->name);
1018
504c8dcd 1019 if (!hdev_is_powered(hdev))
890ea898 1020 return;
7770c4aa 1021
f87ea1da
JH		 1022 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1023 return;
1024
a8b2d5c2 1025 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 1026 return;
ef580372
JH		 1027
1028 cod[0] = hdev->minor_class;
1029 cod[1] = hdev->major_class;
1030 cod[2] = get_service_classes(hdev);
1031
6acd7db4
MH		 1032 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1033 cod[1] |= 0x20;
1034
ef580372 1035 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1036 return;
ef580372 1037
890ea898 1038 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1039}
1040
a4858cb9 1041static bool get_connectable(struct hci_dev *hdev)
199a2fb1
JH		 1042{
1043 struct pending_cmd *cmd;
199a2fb1
JH		 1044
1045 /* If there's a pending mgmt command the flag will not yet have
1046 * it's final value, so check for this first.
1047 */
1048 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1049 if (cmd) {
1050 struct mgmt_mode *cp = cmd->param;
a4858cb9 1051 return cp->val;
199a2fb1
JH		 1052 }
1053
a4858cb9 1054 return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
199a2fb1
JH		 1055}
1056
0ec5ae84
JH		 1057static void disable_advertising(struct hci_request *req)
1058{
1059 u8 enable = 0x00;
1060
1061 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1062}
1063
199a2fb1
JH		 1064static void enable_advertising(struct hci_request *req)
1065{
1066 struct hci_dev *hdev = req->hdev;
1067 struct hci_cp_le_set_adv_param cp;
8f2a0601 1068 u8 own_addr_type, enable = 0x01;
a4858cb9 1069 bool connectable;
199a2fb1 1070
0ec5ae84
JH		 1071 if (hci_conn_num(hdev, LE_LINK) > 0)
1072 return;
1073
1074 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1075 disable_advertising(req);
1076
5ce194c4 1077 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1078 * hci_update_random_address knows that it's safe to go ahead
1079 * and write a new random address. The flag will be set back on
1080 * as soon as the SET_ADV_ENABLE HCI command completes.
1081 */
5ce194c4 1082 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
8d97250e 1083
a4858cb9 1084 connectable = get_connectable(hdev);
8f2a0601 1085
a4858cb9
JH		 1086 /* Set require_privacy to true only when non-connectable
1087 * advertising is used. In that case it is fine to use a
1088 * non-resolvable private address.
1089 */
1090 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1091 return;
1092
41c90c18 1093 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1094 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1095 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
a4858cb9 1096 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
8f2a0601 1097 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1098 cp.channel_map = hdev->le_adv_channel_map;
1099
1100 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1101
1102 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1103}
1104
7d78525d
JH		 1105static void service_cache_off(struct work_struct *work)
1106{
1107 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1108 service_cache.work);
890ea898 1109 struct hci_request req;
7d78525d 1110
a8b2d5c2 1111 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1112 return;
1113
890ea898
JH		 1114 hci_req_init(&req, hdev);
1115
7d78525d
JH		 1116 hci_dev_lock(hdev);
1117
890ea898
JH		 1118 update_eir(&req);
1119 update_class(&req);
7d78525d
JH		 1120
1121 hci_dev_unlock(hdev);
890ea898
JH		 1122
1123 hci_req_run(&req, NULL);
7d78525d
JH		 1124}
1125
d6bfd59c
JH		 1126static void rpa_expired(struct work_struct *work)
1127{
1128 struct hci_dev *hdev = container_of(work, struct hci_dev,
1129 rpa_expired.work);
1130 struct hci_request req;
1131
1132 BT_DBG("");
1133
1134 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1135
0ec5ae84 1136 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
d6bfd59c
JH		 1137 return;
1138
1139 /* The generation of a new RPA and programming it into the
1140 * controller happens in the enable_advertising() function.
1141 */
d6bfd59c 1142 hci_req_init(&req, hdev);
d6bfd59c 1143 enable_advertising(&req);
d6bfd59c
JH		 1144 hci_req_run(&req, NULL);
1145}
1146
6a919082 1147static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1148{
4f87da80 1149 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
6a919082
JH		 1150 return;
1151
4f87da80 1152 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1153 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1154
4f87da80
JH		 1155 /* Non-mgmt controlled devices get this bit set
1156 * implicitly so that pairing works for them, however
1157 * for mgmt we require user-space to explicitly enable
1158 * it
1159 */
b6ae8457 1160 clear_bit(HCI_BONDABLE, &hdev->dev_flags);
7d78525d
JH		 1161}
1162
0f4e68cf 1163static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1164 void *data, u16 data_len)
0381101f 1165{
a38528f1 1166 struct mgmt_rp_read_info rp;
f7b64e69 1167
bdb6d971 1168 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1169
09fd0de5 1170 hci_dev_lock(hdev);
f7b64e69 1171
dc4fe30b
JH		 1172 memset(&rp, 0, sizeof(rp));
1173
69ab39ea 1174 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1175
69ab39ea 1176 rp.version = hdev->hci_ver;
eb55ef07 1177 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1178
1179 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1180 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1181
a38528f1 1182 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1183
dc4fe30b 1184 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1185 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1186
09fd0de5 1187 hci_dev_unlock(hdev);
0381101f 1188
bdb6d971 1189 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
04124681 1190 sizeof(rp));
0381101f
JH		 1191}
1192
eec8d2bc
JH		 1193static void mgmt_pending_free(struct pending_cmd *cmd)
1194{
1195 sock_put(cmd->sk);
c68fb7ff 1196 kfree(cmd->param);
eec8d2bc
JH		 1197 kfree(cmd);
1198}
1199
366a0336 1200static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
04124681
GP		 1201 struct hci_dev *hdev, void *data,
1202 u16 len)
eec8d2bc
JH		 1203{
1204 struct pending_cmd *cmd;
1205
fca20018 1206 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
eec8d2bc 1207 if (!cmd)
366a0336 1208 return NULL;
eec8d2bc
JH		 1209
1210 cmd->opcode = opcode;
2e58ef3e 1211 cmd->index = hdev->id;
eec8d2bc 1212
323b0b88 1213 cmd->param = kmemdup(data, len, GFP_KERNEL);
c68fb7ff 1214 if (!cmd->param) {
eec8d2bc 1215 kfree(cmd);
366a0336 1216 return NULL;
eec8d2bc
JH		 1217 }
1218
323b0b88 1219 cmd->param_len = len;
eec8d2bc
JH		 1220
1221 cmd->sk = sk;
1222 sock_hold(sk);
1223
2e58ef3e 1224 list_add(&cmd->list, &hdev->mgmt_pending);
eec8d2bc 1225
366a0336 1226 return cmd;
eec8d2bc
JH		 1227}
1228
744cf19e 1229static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
8fc9ced3
GP		 1230 void (*cb)(struct pending_cmd *cmd,
1231 void *data),
04124681 1232 void *data)
eec8d2bc 1233{
a3d09356 1234 struct pending_cmd *cmd, *tmp;
eec8d2bc 1235
a3d09356 1236 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
b24752fe 1237 if (opcode > 0 && cmd->opcode != opcode)
eec8d2bc
JH		 1238 continue;
1239
eec8d2bc
JH		 1240 cb(cmd, data);
1241 }
1242}
1243
a664b5bc 1244static void mgmt_pending_remove(struct pending_cmd *cmd)
73f22f62 1245{
73f22f62
JH		 1246 list_del(&cmd->list);
1247 mgmt_pending_free(cmd);
1248}
1249
69ab39ea 1250static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1251{
69ab39ea 1252 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1253
aee9b218 1254 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
04124681 1255 sizeof(settings));
8680570b
JH		 1256}
1257
1904a853 1258static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1259{
1260 BT_DBG("%s status 0x%02x", hdev->name, status);
1261
a3172b7e
JH		 1262 if (hci_conn_count(hdev) == 0) {
1263 cancel_delayed_work(&hdev->power_off);
8b064a3a 1264 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1265 }
8b064a3a
JH		 1266}
1267
23a48093 1268static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1269{
1270 struct hci_dev *hdev = req->hdev;
1271 struct hci_cp_remote_name_req_cancel cp;
1272 struct inquiry_entry *e;
1273
1274 switch (hdev->discovery.state) {
1275 case DISCOVERY_FINDING:
1276 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1277 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1278 } else {
1279 cancel_delayed_work(&hdev->le_scan_disable);
1280 hci_req_add_le_scan_disable(req);
1281 }
1282
23a48093 1283 return true;
21a60d30
JH		 1284
1285 case DISCOVERY_RESOLVING:
1286 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1287 NAME_PENDING);
1288 if (!e)
23a48093 1289 break;
21a60d30
JH		 1290
1291 bacpy(&cp.bdaddr, &e->data.bdaddr);
1292 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1293 &cp);
1294
23a48093 1295 return true;
21a60d30
JH		 1296
1297 default:
1298 /* Passive scanning */
23a48093 1299 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
21a60d30 1300 hci_req_add_le_scan_disable(req);
23a48093
JH		 1301 return true;
1302 }
1303
21a60d30
JH		 1304 break;
1305 }
23a48093
JH		 1306
1307 return false;
21a60d30
JH		 1308}
1309
8b064a3a
JH		 1310static int clean_up_hci_state(struct hci_dev *hdev)
1311{
1312 struct hci_request req;
1313 struct hci_conn *conn;
23a48093
JH		 1314 bool discov_stopped;
1315 int err;
8b064a3a
JH		 1316
1317 hci_req_init(&req, hdev);
1318
1319 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1320 test_bit(HCI_PSCAN, &hdev->flags)) {
1321 u8 scan = 0x00;
1322 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1323 }
1324
73e082f8 1325 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
8b064a3a
JH		 1326 disable_advertising(&req);
1327
23a48093 1328 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1329
1330 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1331 struct hci_cp_disconnect dc;
c9910d0f
JH		 1332 struct hci_cp_reject_conn_req rej;
1333
1334 switch (conn->state) {
1335 case BT_CONNECTED:
1336 case BT_CONFIG:
1337 dc.handle = cpu_to_le16(conn->handle);
1338 dc.reason = 0x15; /* Terminated due to Power Off */
1339 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1340 break;
1341 case BT_CONNECT:
1342 if (conn->type == LE_LINK)
1343 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1344 0, NULL);
1345 else if (conn->type == ACL_LINK)
1346 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1347 6, &conn->dst);
1348 break;
1349 case BT_CONNECT2:
1350 bacpy(&rej.bdaddr, &conn->dst);
1351 rej.reason = 0x15; /* Terminated due to Power Off */
1352 if (conn->type == ACL_LINK)
1353 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1354 sizeof(rej), &rej);
1355 else if (conn->type == SCO_LINK)
1356 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1357 sizeof(rej), &rej);
1358 break;
1359 }
8b064a3a
JH		 1360 }
1361
23a48093
JH		 1362 err = hci_req_run(&req, clean_up_hci_complete);
1363 if (!err && discov_stopped)
1364 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1365
1366 return err;
8b064a3a
JH		 1367}
1368
bdb6d971 1369static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1370 u16 len)
eec8d2bc 1371{
650f726d 1372 struct mgmt_mode *cp = data;
366a0336 1373 struct pending_cmd *cmd;
4b34ee78 1374 int err;
eec8d2bc 1375
bdb6d971 1376 BT_DBG("request for %s", hdev->name);
eec8d2bc 1377
a7e80f25
JH		 1378 if (cp->val != 0x00 && cp->val != 0x01)
1379 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1380 MGMT_STATUS_INVALID_PARAMS);
1381
09fd0de5 1382 hci_dev_lock(hdev);
eec8d2bc 1383
87b95ba6
JH		 1384 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1385 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1386 MGMT_STATUS_BUSY);
1387 goto failed;
1388 }
1389
f0d4b78a
MH		 1390 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1391 cancel_delayed_work(&hdev->power_off);
1392
1393 if (cp->val) {
a1d70450
JH		 1394 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1395 data, len);
1396 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1397 goto failed;
1398 }
1399 }
1400
4b34ee78 1401 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1402 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1403 goto failed;
1404 }
1405
2e58ef3e 1406 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1407 if (!cmd) {
1408 err = -ENOMEM;
eec8d2bc 1409 goto failed;
366a0336 1410 }
eec8d2bc 1411
8b064a3a 1412 if (cp->val) {
19202573 1413 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1414 err = 0;
1415 } else {
1416 /* Disconnect connections, stop scans, etc */
1417 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1418 if (!err)
1419 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1420 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1421
8b064a3a
JH		 1422 /* ENODATA means there were no HCI commands queued */
1423 if (err == -ENODATA) {
a3172b7e 1424 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1425 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1426 err = 0;
1427 }
1428 }
eec8d2bc
JH		 1429
1430failed:
09fd0de5 1431 hci_dev_unlock(hdev);
366a0336 1432 return err;
eec8d2bc
JH		 1433}
1434
beadb2bd
JH		 1435static int new_settings(struct hci_dev *hdev, struct sock *skip)
1436{
1437 __le32 ev;
1438
1439 ev = cpu_to_le32(get_current_settings(hdev));
1440
1441 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1442}
1443
91a668b0
JH		 1444int mgmt_new_settings(struct hci_dev *hdev)
1445{
1446 return new_settings(hdev, NULL);
1447}
1448
bd99abdd
JH		 1449struct cmd_lookup {
1450 struct sock *sk;
1451 struct hci_dev *hdev;
1452 u8 mgmt_status;
1453};
1454
1455static void settings_rsp(struct pending_cmd *cmd, void *data)
1456{
1457 struct cmd_lookup *match = data;
1458
1459 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1460
1461 list_del(&cmd->list);
1462
1463 if (match->sk == NULL) {
1464 match->sk = cmd->sk;
1465 sock_hold(match->sk);
1466 }
1467
1468 mgmt_pending_free(cmd);
1469}
1470
1471static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1472{
1473 u8 *status = data;
1474
1475 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1476 mgmt_pending_remove(cmd);
1477}
1478
1b9b5ee5
JH		 1479static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1480{
1481 if (cmd->cmd_complete) {
1482 u8 *status = data;
1483
1484 cmd->cmd_complete(cmd, *status);
1485 mgmt_pending_remove(cmd);
1486
1487 return;
1488 }
1489
1490 cmd_status_rsp(cmd, data);
1491}
1492
9df74653 1493static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
f5818c22 1494{
9df74653
JH		 1495 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1496 cmd->param, cmd->param_len);
f5818c22
JH		 1497}
1498
9df74653 1499static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
7776d1d8 1500{
9df74653
JH		 1501 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1502 sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1503}
1504
e6fe7986
JH		 1505static u8 mgmt_bredr_support(struct hci_dev *hdev)
1506{
1507 if (!lmp_bredr_capable(hdev))
1508 return MGMT_STATUS_NOT_SUPPORTED;
1509 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1510 return MGMT_STATUS_REJECTED;
1511 else
1512 return MGMT_STATUS_SUCCESS;
1513}
1514
1515static u8 mgmt_le_support(struct hci_dev *hdev)
1516{
1517 if (!lmp_le_capable(hdev))
1518 return MGMT_STATUS_NOT_SUPPORTED;
1519 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1520 return MGMT_STATUS_REJECTED;
1521 else
1522 return MGMT_STATUS_SUCCESS;
1523}
1524
1904a853
MH		 1525static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1526 u16 opcode)
bfaf8c9f
JH		 1527{
1528 struct pending_cmd *cmd;
1529 struct mgmt_mode *cp;
970ba524 1530 struct hci_request req;
bfaf8c9f
JH		 1531 bool changed;
1532
1533 BT_DBG("status 0x%02x", status);
1534
1535 hci_dev_lock(hdev);
1536
1537 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1538 if (!cmd)
1539 goto unlock;
1540
1541 if (status) {
1542 u8 mgmt_err = mgmt_status(status);
1543 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
310a3d48 1544 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
bfaf8c9f
JH		 1545 goto remove_cmd;
1546 }
1547
1548 cp = cmd->param;
d4462a07 1549 if (cp->val) {
bfaf8c9f
JH		 1550 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1551 &hdev->dev_flags);
d4462a07
MH		 1552
1553 if (hdev->discov_timeout > 0) {
1554 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1555 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1556 to);
1557 }
1558 } else {
bfaf8c9f
JH		 1559 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1560 &hdev->dev_flags);
d4462a07 1561 }
bfaf8c9f
JH		 1562
1563 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1564
1565 if (changed)
1566 new_settings(hdev, cmd->sk);
1567
970ba524
MH		 1568 /* When the discoverable mode gets changed, make sure
1569 * that class of device has the limited discoverable
432df05e
JH		 1570 * bit correctly set. Also update page scan based on whitelist
1571 * entries.
970ba524
MH		 1572 */
1573 hci_req_init(&req, hdev);
1d2dc5b7 1574 __hci_update_page_scan(&req);
970ba524
MH		 1575 update_class(&req);
1576 hci_req_run(&req, NULL);
1577
bfaf8c9f
JH		 1578remove_cmd:
1579 mgmt_pending_remove(cmd);
1580
1581unlock:
1582 hci_dev_unlock(hdev);
1583}
1584
bdb6d971 1585static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1586 u16 len)
73f22f62 1587{
650f726d 1588 struct mgmt_cp_set_discoverable *cp = data;
366a0336 1589 struct pending_cmd *cmd;
bfaf8c9f 1590 struct hci_request req;
5e5282bb 1591 u16 timeout;
9a43e25f 1592 u8 scan;
73f22f62
JH		 1593 int err;
1594
bdb6d971 1595 BT_DBG("request for %s", hdev->name);
73f22f62 1596
9a43e25f
JH		 1597 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1598 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1599 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
9a43e25f 1600 MGMT_STATUS_REJECTED);
33c525c0 1601
310a3d48 1602 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a7e80f25
JH		 1603 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1604 MGMT_STATUS_INVALID_PARAMS);
1605
1f350c87 1606 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1607
1608 /* Disabling discoverable requires that no timeout is set,
1609 * and enabling limited discoverable requires a timeout.
1610 */
1611 if ((cp->val == 0x00 && timeout > 0) ||
1612 (cp->val == 0x02 && timeout == 0))
bdb6d971 1613 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1614 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1615
09fd0de5 1616 hci_dev_lock(hdev);
73f22f62 1617
5e5282bb 1618 if (!hdev_is_powered(hdev) && timeout > 0) {
bdb6d971 1619 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1620 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1621 goto failed;
1622 }
1623
2e58ef3e 1624 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1625 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1626 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1627 MGMT_STATUS_BUSY);
73f22f62
JH		 1628 goto failed;
1629 }
1630
5e5282bb 1631 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
bdb6d971 1632 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1633 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1634 goto failed;
1635 }
1636
1637 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1638 bool changed = false;
1639
310a3d48
MH		 1640 /* Setting limited discoverable when powered off is
1641 * not a valid operation since it requires a timeout
1642 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1643 */
0224d2fa
JH		 1644 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1645 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1646 changed = true;
1647 }
1648
5e5282bb 1649 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1650 if (err < 0)
1651 goto failed;
1652
1653 if (changed)
1654 err = new_settings(hdev, sk);
1655
5e5282bb
JH		 1656 goto failed;
1657 }
1658
310a3d48
MH		 1659 /* If the current mode is the same, then just update the timeout
1660 * value with the new value. And if only the timeout gets updated,
1661 * then no need for any HCI transactions.
1662 */
1663 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1664 (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1665 &hdev->dev_flags)) {
36261547
MH		 1666 cancel_delayed_work(&hdev->discov_off);
1667 hdev->discov_timeout = timeout;
955638ec 1668
36261547
MH		 1669 if (cp->val && hdev->discov_timeout > 0) {
1670 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1671 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1672 to);
955638ec
MH		 1673 }
1674
69ab39ea 1675 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1676 goto failed;
1677 }
1678
2e58ef3e 1679 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1680 if (!cmd) {
1681 err = -ENOMEM;
73f22f62 1682 goto failed;
366a0336 1683 }
73f22f62 1684
310a3d48
MH		 1685 /* Cancel any potential discoverable timeout that might be
1686 * still active and store new timeout value. The arming of
1687 * the timeout happens in the complete handler.
1688 */
1689 cancel_delayed_work(&hdev->discov_off);
1690 hdev->discov_timeout = timeout;
1691
b456f87c
JH		 1692 /* Limited discoverable mode */
1693 if (cp->val == 0x02)
1694 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1695 else
1696 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1697
bfaf8c9f
JH		 1698 hci_req_init(&req, hdev);
1699
9a43e25f
JH		 1700 /* The procedure for LE-only controllers is much simpler - just
1701 * update the advertising data.
1702 */
1703 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1704 goto update_ad;
1705
73f22f62
JH		 1706 scan = SCAN_PAGE;
1707
310a3d48
MH		 1708 if (cp->val) {
1709 struct hci_cp_write_current_iac_lap hci_cp;
1710
1711 if (cp->val == 0x02) {
1712 /* Limited discoverable mode */
33337dcb 1713 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1714 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1715 hci_cp.iac_lap[1] = 0x8b;
1716 hci_cp.iac_lap[2] = 0x9e;
1717 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1718 hci_cp.iac_lap[4] = 0x8b;
1719 hci_cp.iac_lap[5] = 0x9e;
1720 } else {
1721 /* General discoverable mode */
310a3d48
MH		 1722 hci_cp.num_iac = 1;
1723 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1724 hci_cp.iac_lap[1] = 0x8b;
1725 hci_cp.iac_lap[2] = 0x9e;
1726 }
1727
1728 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1729 (hci_cp.num_iac * 3) + 1, &hci_cp);
1730
73f22f62 1731 scan |= SCAN_INQUIRY;
310a3d48
MH		 1732 } else {
1733 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1734 }
73f22f62 1735
310a3d48 1736 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1737
9a43e25f
JH		 1738update_ad:
1739 update_adv_data(&req);
1740
bfaf8c9f 1741 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1742 if (err < 0)
a664b5bc 1743 mgmt_pending_remove(cmd);
73f22f62
JH		 1744
1745failed:
09fd0de5 1746 hci_dev_unlock(hdev);
73f22f62
JH		 1747 return err;
1748}
1749
406d7804
JH		 1750static void write_fast_connectable(struct hci_request *req, bool enable)
1751{
bd98b996 1752 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1753 struct hci_cp_write_page_scan_activity acp;
1754 u8 type;
1755
547003b1
JH		 1756 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1757 return;
1758
4c01f8b8
JH		 1759 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1760 return;
1761
406d7804
JH		 1762 if (enable) {
1763 type = PAGE_SCAN_TYPE_INTERLACED;
1764
1765 /* 160 msec page scan interval */
dcf4adbf 1766 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 1767 } else {
1768 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1769
1770 /* default 1.28 sec page scan */
dcf4adbf 1771 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 1772 }
1773
dcf4adbf 1774 acp.window = cpu_to_le16(0x0012);
406d7804 1775
bd98b996
JH		 1776 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1777 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1778 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1779 sizeof(acp), &acp);
1780
1781 if (hdev->page_scan_type != type)
1782 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1783}
1784
1904a853
MH		 1785static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1786 u16 opcode)
2b76f453
JH		 1787{
1788 struct pending_cmd *cmd;
d7b856f9 1789 struct mgmt_mode *cp;
bc6d2d04 1790 bool conn_changed, discov_changed;
2b76f453
JH		 1791
1792 BT_DBG("status 0x%02x", status);
1793
1794 hci_dev_lock(hdev);
1795
1796 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1797 if (!cmd)
1798 goto unlock;
1799
37438c1f
JH		 1800 if (status) {
1801 u8 mgmt_err = mgmt_status(status);
1802 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1803 goto remove_cmd;
1804 }
1805
d7b856f9 1806 cp = cmd->param;
bc6d2d04
JH		 1807 if (cp->val) {
1808 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1809 &hdev->dev_flags);
1810 discov_changed = false;
1811 } else {
1812 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1813 &hdev->dev_flags);
1814 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1815 &hdev->dev_flags);
1816 }
d7b856f9 1817
2b76f453
JH		 1818 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1819
bc6d2d04 1820 if (conn_changed || discov_changed) {
d7b856f9 1821 new_settings(hdev, cmd->sk);
1d2dc5b7 1822 hci_update_page_scan(hdev);
bc6d2d04
JH		 1823 if (discov_changed)
1824 mgmt_update_adv_data(hdev);
2b7be33e
JH		 1825 hci_update_background_scan(hdev);
1826 }
d7b856f9 1827
37438c1f 1828remove_cmd:
2b76f453
JH		 1829 mgmt_pending_remove(cmd);
1830
1831unlock:
1832 hci_dev_unlock(hdev);
1833}
1834
e8ba3a1f
JH		 1835static int set_connectable_update_settings(struct hci_dev *hdev,
1836 struct sock *sk, u8 val)
1837{
1838 bool changed = false;
1839 int err;
1840
1841 if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1842 changed = true;
1843
1844 if (val) {
1845 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1846 } else {
1847 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1848 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1849 }
1850
1851 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1852 if (err < 0)
1853 return err;
1854
562064e6 1855 if (changed) {
1d2dc5b7 1856 hci_update_page_scan(hdev);
562064e6 1857 hci_update_background_scan(hdev);
e8ba3a1f 1858 return new_settings(hdev, sk);
562064e6 1859 }
e8ba3a1f
JH		 1860
1861 return 0;
1862}
1863
bdb6d971 1864static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1865 u16 len)
9fbcbb45 1866{
650f726d 1867 struct mgmt_mode *cp = data;
366a0336 1868 struct pending_cmd *cmd;
2b76f453 1869 struct hci_request req;
1987fdc7 1870 u8 scan;
9fbcbb45
JH		 1871 int err;
1872
bdb6d971 1873 BT_DBG("request for %s", hdev->name);
9fbcbb45 1874
1987fdc7
JH		 1875 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1876 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1877 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1987fdc7 1878 MGMT_STATUS_REJECTED);
33c525c0 1879
a7e80f25
JH		 1880 if (cp->val != 0x00 && cp->val != 0x01)
1881 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1882 MGMT_STATUS_INVALID_PARAMS);
1883
09fd0de5 1884 hci_dev_lock(hdev);
9fbcbb45 1885
4b34ee78 1886 if (!hdev_is_powered(hdev)) {
e8ba3a1f 1887 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 1888 goto failed;
1889 }
1890
2e58ef3e 1891 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1892 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1893 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
04124681 1894 MGMT_STATUS_BUSY);
9fbcbb45
JH		 1895 goto failed;
1896 }
1897
2e58ef3e 1898 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 1899 if (!cmd) {
1900 err = -ENOMEM;
9fbcbb45 1901 goto failed;
366a0336 1902 }
9fbcbb45 1903
9b74246f 1904 hci_req_init(&req, hdev);
9fbcbb45 1905
9a43e25f
JH		 1906 /* If BR/EDR is not enabled and we disable advertising as a
1907 * by-product of disabling connectable, we need to update the
1908 * advertising flags.
1909 */
1910 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1911 if (!cp->val) {
1912 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1913 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1914 }
1915 update_adv_data(&req);
1916 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 1917 if (cp->val) {
1918 scan = SCAN_PAGE;
1919 } else {
3bd27240
JH		 1920 /* If we don't have any whitelist entries just
1921 * disable all scanning. If there are entries
1922 * and we had both page and inquiry scanning
1923 * enabled then fall back to only page scanning.
1924 * Otherwise no changes are needed.
1925 */
1926 if (list_empty(&hdev->whitelist))
1927 scan = SCAN_DISABLED;
1928 else if (test_bit(HCI_ISCAN, &hdev->flags))
1929 scan = SCAN_PAGE;
1930 else
1931 goto no_scan_update;
9b74246f
JH		 1932
1933 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 1934 hdev->discov_timeout > 0)
9b74246f
JH		 1935 cancel_delayed_work(&hdev->discov_off);
1936 }
2b76f453 1937
9b74246f
JH		 1938 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1939 }
2b76f453 1940
3bd27240 1941no_scan_update:
4c01f8b8
JH		 1942 /* If we're going from non-connectable to connectable or
1943 * vice-versa when fast connectable is enabled ensure that fast
1944 * connectable gets disabled. write_fast_connectable won't do
1945 * anything if the page scan parameters are already what they
1946 * should be.
1947 */
1948 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
e36a3769
JH		 1949 write_fast_connectable(&req, false);
1950
e8b1202c
JH		 1951 /* Update the advertising parameters if necessary */
1952 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1987fdc7 1953 enable_advertising(&req);
1987fdc7 1954
2b76f453 1955 err = hci_req_run(&req, set_connectable_complete);
9b74246f 1956 if (err < 0) {
a664b5bc 1957 mgmt_pending_remove(cmd);
9b74246f 1958 if (err == -ENODATA)
a81070ba
JH		 1959 err = set_connectable_update_settings(hdev, sk,
1960 cp->val);
9b74246f
JH		 1961 goto failed;
1962 }
9fbcbb45
JH		 1963
1964failed:
09fd0de5 1965 hci_dev_unlock(hdev);
9fbcbb45
JH		 1966 return err;
1967}
1968
b2939475 1969static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1970 u16 len)
c542a06c 1971{
650f726d 1972 struct mgmt_mode *cp = data;
55594356 1973 bool changed;
c542a06c
JH		 1974 int err;
1975
bdb6d971 1976 BT_DBG("request for %s", hdev->name);
c542a06c 1977
a7e80f25 1978 if (cp->val != 0x00 && cp->val != 0x01)
b2939475 1979 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
a7e80f25
JH		 1980 MGMT_STATUS_INVALID_PARAMS);
1981
09fd0de5 1982 hci_dev_lock(hdev);
c542a06c
JH		 1983
1984 if (cp->val)
b6ae8457 1985 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
c542a06c 1986 else
b6ae8457 1987 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
c542a06c 1988
b2939475 1989 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 1990 if (err < 0)
55594356 1991 goto unlock;
c542a06c 1992
55594356
MH		 1993 if (changed)
1994 err = new_settings(hdev, sk);
c542a06c 1995
55594356 1996unlock:
09fd0de5 1997 hci_dev_unlock(hdev);
c542a06c
JH		 1998 return err;
1999}
2000
04124681
GP		 2001static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2002 u16 len)
33ef95ed
JH		 2003{
2004 struct mgmt_mode *cp = data;
2005 struct pending_cmd *cmd;
e6fe7986 2006 u8 val, status;
33ef95ed
JH		 2007 int err;
2008
bdb6d971 2009 BT_DBG("request for %s", hdev->name);
33ef95ed 2010
e6fe7986
JH		 2011 status = mgmt_bredr_support(hdev);
2012 if (status)
33c525c0 2013 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
e6fe7986 2014 status);
33c525c0 2015
a7e80f25
JH		 2016 if (cp->val != 0x00 && cp->val != 0x01)
2017 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2018 MGMT_STATUS_INVALID_PARAMS);
2019
33ef95ed
JH		 2020 hci_dev_lock(hdev);
2021
4b34ee78 2022 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2023 bool changed = false;
2024
2025 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
8ce8e2b5 2026 &hdev->dev_flags)) {
47990ea0
JH		 2027 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2028 changed = true;
2029 }
2030
2031 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2032 if (err < 0)
2033 goto failed;
2034
2035 if (changed)
2036 err = new_settings(hdev, sk);
2037
33ef95ed
JH		 2038 goto failed;
2039 }
2040
2041 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
bdb6d971 2042 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
04124681 2043 MGMT_STATUS_BUSY);
33ef95ed
JH		 2044 goto failed;
2045 }
2046
2047 val = !!cp->val;
2048
2049 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2050 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2051 goto failed;
2052 }
2053
2054 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2055 if (!cmd) {
2056 err = -ENOMEM;
2057 goto failed;
2058 }
2059
2060 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2061 if (err < 0) {
2062 mgmt_pending_remove(cmd);
2063 goto failed;
2064 }
2065
2066failed:
2067 hci_dev_unlock(hdev);
33ef95ed
JH		 2068 return err;
2069}
2070
bdb6d971 2071static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2072{
2073 struct mgmt_mode *cp = data;
2074 struct pending_cmd *cmd;
72ef0c1a 2075 u8 status;
ed2c4ee3
JH		 2076 int err;
2077
bdb6d971 2078 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2079
cdba5281
MH		 2080 status = mgmt_bredr_support(hdev);
2081 if (status)
2082 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2083
13ecd8b6
JH		 2084 if (!lmp_ssp_capable(hdev))
2085 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2086 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2087
a7e80f25
JH		 2088 if (cp->val != 0x00 && cp->val != 0x01)
2089 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2090 MGMT_STATUS_INVALID_PARAMS);
2091
13ecd8b6 2092 hci_dev_lock(hdev);
6c8f12c1 2093
4b34ee78 2094 if (!hdev_is_powered(hdev)) {
9ecb3e24 2095 bool changed;
c0ecddc2 2096
9ecb3e24
MH		 2097 if (cp->val) {
2098 changed = !test_and_set_bit(HCI_SSP_ENABLED,
2099 &hdev->dev_flags);
2100 } else {
2101 changed = test_and_clear_bit(HCI_SSP_ENABLED,
2102 &hdev->dev_flags);
2103 if (!changed)
2104 changed = test_and_clear_bit(HCI_HS_ENABLED,
2105 &hdev->dev_flags);
2106 else
2107 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
c0ecddc2
JH		 2108 }
2109
2110 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2111 if (err < 0)
2112 goto failed;
2113
2114 if (changed)
2115 err = new_settings(hdev, sk);
2116
ed2c4ee3
JH		 2117 goto failed;
2118 }
2119
94d52dad 2120 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
d97dcb66
SJ		 2121 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2122 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2123 goto failed;
2124 }
2125
72ef0c1a 2126 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
ed2c4ee3
JH		 2127 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2128 goto failed;
2129 }
2130
2131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2132 if (!cmd) {
2133 err = -ENOMEM;
2134 goto failed;
2135 }
2136
3769972b
JH		 2137 if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2138 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2139 sizeof(cp->val), &cp->val);
2140
72ef0c1a 2141 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2142 if (err < 0) {
2143 mgmt_pending_remove(cmd);
2144 goto failed;
2145 }
2146
2147failed:
2148 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2149 return err;
2150}
2151
bdb6d971 2152static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2153{
2154 struct mgmt_mode *cp = data;
ee392693 2155 bool changed;
e6fe7986 2156 u8 status;
ee392693 2157 int err;
6d80dfd0 2158
bdb6d971 2159 BT_DBG("request for %s", hdev->name);
6d80dfd0 2160
e6fe7986
JH		 2161 status = mgmt_bredr_support(hdev);
2162 if (status)
2163 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2164
9ecb3e24
MH		 2165 if (!lmp_ssp_capable(hdev))
2166 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2167 MGMT_STATUS_NOT_SUPPORTED);
2168
2169 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2170 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2171 MGMT_STATUS_REJECTED);
2172
a7e80f25
JH		 2173 if (cp->val != 0x00 && cp->val != 0x01)
2174 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2175 MGMT_STATUS_INVALID_PARAMS);
2176
ee392693
MH		 2177 hci_dev_lock(hdev);
2178
a2cb01de
JH		 2179 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
2180 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2181 MGMT_STATUS_BUSY);
2182 goto unlock;
2183 }
2184
a0cdf960 2185 if (cp->val) {
ee392693 2186 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960
MH		 2187 } else {
2188 if (hdev_is_powered(hdev)) {
2189 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2190 MGMT_STATUS_REJECTED);
2191 goto unlock;
2192 }
2193
ee392693 2194 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960 2195 }
ee392693
MH		 2196
2197 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2198 if (err < 0)
2199 goto unlock;
2200
2201 if (changed)
2202 err = new_settings(hdev, sk);
6d80dfd0 2203
ee392693
MH		 2204unlock:
2205 hci_dev_unlock(hdev);
2206 return err;
6d80dfd0
JH		 2207}
2208
1904a853 2209static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2210{
2211 struct cmd_lookup match = { NULL, hdev };
2212
3ad67582
JK		 2213 hci_dev_lock(hdev);
2214
416a4ae5
JH		 2215 if (status) {
2216 u8 mgmt_err = mgmt_status(status);
2217
2218 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2219 &mgmt_err);
3ad67582 2220 goto unlock;
416a4ae5
JH		 2221 }
2222
2223 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2224
2225 new_settings(hdev, match.sk);
2226
2227 if (match.sk)
2228 sock_put(match.sk);
441ad2d0
MH		 2229
2230 /* Make sure the controller has a good default for
2231 * advertising data. Restrict the update to when LE
2232 * has actually been enabled. During power on, the
2233 * update in powered_update_hci will take care of it.
2234 */
2235 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2236 struct hci_request req;
2237
441ad2d0 2238 hci_req_init(&req, hdev);
5947f4bc 2239 update_adv_data(&req);
f14d8f64 2240 update_scan_rsp_data(&req);
2cf22218 2241 __hci_update_background_scan(&req);
441ad2d0 2242 hci_req_run(&req, NULL);
441ad2d0 2243 }
3ad67582
JK		 2244
2245unlock:
2246 hci_dev_unlock(hdev);
416a4ae5
JH		 2247}
2248
bdb6d971 2249static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2250{
2251 struct mgmt_mode *cp = data;
2252 struct hci_cp_write_le_host_supported hci_cp;
2253 struct pending_cmd *cmd;
416a4ae5 2254 struct hci_request req;
06199cf8 2255 int err;
0b60eba1 2256 u8 val, enabled;
06199cf8 2257
bdb6d971 2258 BT_DBG("request for %s", hdev->name);
06199cf8 2259
13ecd8b6
JH		 2260 if (!lmp_le_capable(hdev))
2261 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2262 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2263
a7e80f25
JH		 2264 if (cp->val != 0x00 && cp->val != 0x01)
2265 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2266 MGMT_STATUS_INVALID_PARAMS);
2267
c73eee91 2268 /* LE-only devices do not allow toggling LE on/off */
56f87901 2269 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
c73eee91
JH		 2270 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2271 MGMT_STATUS_REJECTED);
2272
13ecd8b6 2273 hci_dev_lock(hdev);
06199cf8
JH		 2274
2275 val = !!cp->val;
ffa88e02 2276 enabled = lmp_host_le_capable(hdev);
06199cf8 2277
0b60eba1 2278 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2279 bool changed = false;
2280
2281 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2282 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2283 changed = true;
2284 }
2285
f3d3444a
JH		 2286 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2287 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
eeca6f89
JH		 2288 changed = true;
2289 }
2290
06199cf8
JH		 2291 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2292 if (err < 0)
1de028ce 2293 goto unlock;
06199cf8
JH		 2294
2295 if (changed)
2296 err = new_settings(hdev, sk);
2297
1de028ce 2298 goto unlock;
06199cf8
JH		 2299 }
2300
4375f103
JH		 2301 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2302 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
bdb6d971 2303 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
04124681 2304 MGMT_STATUS_BUSY);
1de028ce 2305 goto unlock;
06199cf8
JH		 2306 }
2307
2308 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2309 if (!cmd) {
2310 err = -ENOMEM;
1de028ce 2311 goto unlock;
06199cf8
JH		 2312 }
2313
441ad2d0
MH		 2314 hci_req_init(&req, hdev);
2315
06199cf8
JH		 2316 memset(&hci_cp, 0, sizeof(hci_cp));
2317
2318 if (val) {
2319 hci_cp.le = val;
32226e4f 2320 hci_cp.simul = 0x00;
441ad2d0 2321 } else {
73e082f8 2322 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
441ad2d0 2323 disable_advertising(&req);
06199cf8
JH		 2324 }
2325
416a4ae5
JH		 2326 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2327 &hci_cp);
2328
2329 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2330 if (err < 0)
06199cf8 2331 mgmt_pending_remove(cmd);
06199cf8 2332
1de028ce
JH		 2333unlock:
2334 hci_dev_unlock(hdev);
06199cf8
JH		 2335 return err;
2336}
2337
0cab9c80
JH		 2338/* This is a helper function to test for pending mgmt commands that can
2339 * cause CoD or EIR HCI commands. We can only allow one such pending
2340 * mgmt command at a time since otherwise we cannot easily track what
2341 * the current values are, will be, and based on that calculate if a new
2342 * HCI command needs to be sent and if yes with what value.
2343 */
2344static bool pending_eir_or_class(struct hci_dev *hdev)
2345{
2346 struct pending_cmd *cmd;
2347
2348 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2349 switch (cmd->opcode) {
2350 case MGMT_OP_ADD_UUID:
2351 case MGMT_OP_REMOVE_UUID:
2352 case MGMT_OP_SET_DEV_CLASS:
2353 case MGMT_OP_SET_POWERED:
2354 return true;
2355 }
2356 }
2357
2358 return false;
2359}
2360
83be8eca
JH		 2361static const u8 bluetooth_base_uuid[] = {
2362 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2363 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2364};
2365
2366static u8 get_uuid_size(const u8 *uuid)
2367{
2368 u32 val;
2369
2370 if (memcmp(uuid, bluetooth_base_uuid, 12))
2371 return 128;
2372
2373 val = get_unaligned_le32(&uuid[12]);
2374 if (val > 0xffff)
2375 return 32;
2376
2377 return 16;
2378}
2379
92da6097
JH		 2380static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2381{
2382 struct pending_cmd *cmd;
2383
2384 hci_dev_lock(hdev);
2385
2386 cmd = mgmt_pending_find(mgmt_op, hdev);
2387 if (!cmd)
2388 goto unlock;
2389
2390 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2391 hdev->dev_class, 3);
2392
2393 mgmt_pending_remove(cmd);
2394
2395unlock:
2396 hci_dev_unlock(hdev);
2397}
2398
1904a853 2399static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2400{
2401 BT_DBG("status 0x%02x", status);
2402
2403 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2404}
2405
bdb6d971 2406static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2407{
650f726d 2408 struct mgmt_cp_add_uuid *cp = data;
90e70454 2409 struct pending_cmd *cmd;
890ea898 2410 struct hci_request req;
2aeb9a1a 2411 struct bt_uuid *uuid;
2aeb9a1a
JH		 2412 int err;
2413
bdb6d971 2414 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2415
09fd0de5 2416 hci_dev_lock(hdev);
2aeb9a1a 2417
0cab9c80 2418 if (pending_eir_or_class(hdev)) {
bdb6d971 2419 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
04124681 2420 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2421 goto failed;
2422 }
2423
92c4c204 2424 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2425 if (!uuid) {
2426 err = -ENOMEM;
2427 goto failed;
2428 }
2429
2430 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2431 uuid->svc_hint = cp->svc_hint;
83be8eca 2432 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2433
de66aa63 2434 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2435
890ea898 2436 hci_req_init(&req, hdev);
1aff6f09 2437
890ea898
JH		 2438 update_class(&req);
2439 update_eir(&req);
2440
92da6097
JH		 2441 err = hci_req_run(&req, add_uuid_complete);
2442 if (err < 0) {
2443 if (err != -ENODATA)
2444 goto failed;
80a1e1db 2445
bdb6d971 2446 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
04124681 2447 hdev->dev_class, 3);
90e70454
JH		 2448 goto failed;
2449 }
2450
2451 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2452 if (!cmd) {
90e70454 2453 err = -ENOMEM;
890ea898
JH		 2454 goto failed;
2455 }
2456
2457 err = 0;
2aeb9a1a
JH		 2458
2459failed:
09fd0de5 2460 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2461 return err;
2462}
2463
24b78d0f
JH		 2464static bool enable_service_cache(struct hci_dev *hdev)
2465{
2466 if (!hdev_is_powered(hdev))
2467 return false;
2468
2469 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
46818ed5
JH		 2470 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2471 CACHE_TIMEOUT);
24b78d0f
JH		 2472 return true;
2473 }
2474
2475 return false;
2476}
2477
1904a853 2478static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2479{
2480 BT_DBG("status 0x%02x", status);
2481
2482 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2483}
2484
bdb6d971 2485static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2486 u16 len)
2aeb9a1a 2487{
650f726d 2488 struct mgmt_cp_remove_uuid *cp = data;
90e70454 2489 struct pending_cmd *cmd;
056341c8 2490 struct bt_uuid *match, *tmp;
2aeb9a1a 2491 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2492 struct hci_request req;
2aeb9a1a
JH		 2493 int err, found;
2494
bdb6d971 2495 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2496
09fd0de5 2497 hci_dev_lock(hdev);
2aeb9a1a 2498
0cab9c80 2499 if (pending_eir_or_class(hdev)) {
bdb6d971 2500 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2501 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2502 goto unlock;
2503 }
2504
2aeb9a1a 2505 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2506 hci_uuids_clear(hdev);
4004b6d9 2507
24b78d0f 2508 if (enable_service_cache(hdev)) {
bdb6d971 2509 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2510 0, hdev->dev_class, 3);
24b78d0f
JH		 2511 goto unlock;
2512 }
4004b6d9 2513
9246a869 2514 goto update_class;
2aeb9a1a
JH		 2515 }
2516
2517 found = 0;
2518
056341c8 2519 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2520 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2521 continue;
2522
2523 list_del(&match->list);
482049f7 2524 kfree(match);
2aeb9a1a
JH		 2525 found++;
2526 }
2527
2528 if (found == 0) {
bdb6d971 2529 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2530 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2531 goto unlock;
2532 }
2533
9246a869 2534update_class:
890ea898 2535 hci_req_init(&req, hdev);
1aff6f09 2536
890ea898
JH		 2537 update_class(&req);
2538 update_eir(&req);
2539
92da6097
JH		 2540 err = hci_req_run(&req, remove_uuid_complete);
2541 if (err < 0) {
2542 if (err != -ENODATA)
2543 goto unlock;
80a1e1db 2544
bdb6d971 2545 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
04124681 2546 hdev->dev_class, 3);
90e70454
JH		 2547 goto unlock;
2548 }
2549
2550 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2551 if (!cmd) {
90e70454 2552 err = -ENOMEM;
890ea898
JH		 2553 goto unlock;
2554 }
2555
2556 err = 0;
2aeb9a1a
JH		 2557
2558unlock:
09fd0de5 2559 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2560 return err;
2561}
2562
1904a853 2563static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2564{
2565 BT_DBG("status 0x%02x", status);
2566
2567 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2568}
2569
bdb6d971 2570static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2571 u16 len)
1aff6f09 2572{
650f726d 2573 struct mgmt_cp_set_dev_class *cp = data;
90e70454 2574 struct pending_cmd *cmd;
890ea898 2575 struct hci_request req;
1aff6f09
JH		 2576 int err;
2577
bdb6d971 2578 BT_DBG("request for %s", hdev->name);
1aff6f09 2579
6203fc98 2580 if (!lmp_bredr_capable(hdev))
13ecd8b6
JH		 2581 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2582 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2583
0cab9c80 2584 hci_dev_lock(hdev);
ee98f473 2585
0cab9c80
JH		 2586 if (pending_eir_or_class(hdev)) {
2587 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2588 MGMT_STATUS_BUSY);
2589 goto unlock;
2590 }
c95f0ba7 2591
0cab9c80
JH		 2592 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2593 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2594 MGMT_STATUS_INVALID_PARAMS);
2595 goto unlock;
2596 }
575b3a02 2597
932f5ff5
JH		 2598 hdev->major_class = cp->major;
2599 hdev->minor_class = cp->minor;
2600
b5235a65 2601 if (!hdev_is_powered(hdev)) {
bdb6d971 2602 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2603 hdev->dev_class, 3);
b5235a65
JH		 2604 goto unlock;
2605 }
2606
890ea898
JH		 2607 hci_req_init(&req, hdev);
2608
a8b2d5c2 2609 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
7d78525d
JH		 2610 hci_dev_unlock(hdev);
2611 cancel_delayed_work_sync(&hdev->service_cache);
2612 hci_dev_lock(hdev);
890ea898 2613 update_eir(&req);
7d78525d 2614 }
14c0b608 2615
890ea898
JH		 2616 update_class(&req);
2617
92da6097
JH		 2618 err = hci_req_run(&req, set_class_complete);
2619 if (err < 0) {
2620 if (err != -ENODATA)
2621 goto unlock;
1aff6f09 2622
bdb6d971 2623 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2624 hdev->dev_class, 3);
90e70454
JH		 2625 goto unlock;
2626 }
2627
2628 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2629 if (!cmd) {
90e70454 2630 err = -ENOMEM;
890ea898
JH		 2631 goto unlock;
2632 }
2633
2634 err = 0;
1aff6f09 2635
b5235a65 2636unlock:
09fd0de5 2637 hci_dev_unlock(hdev);
1aff6f09
JH		 2638 return err;
2639}
2640
bdb6d971 2641static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2642 u16 len)
55ed8ca1 2643{
650f726d 2644 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2645 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2646 sizeof(struct mgmt_link_key_info));
4e51eae9 2647 u16 key_count, expected_len;
b1de97d8 2648 bool changed;
a492cd52 2649 int i;
55ed8ca1 2650
9060d5cf
MH		 2651 BT_DBG("request for %s", hdev->name);
2652
2653 if (!lmp_bredr_capable(hdev))
2654 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2655 MGMT_STATUS_NOT_SUPPORTED);
2656
1f350c87 2657 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2658 if (key_count > max_key_count) {
2659 BT_ERR("load_link_keys: too big key_count value %u",
2660 key_count);
2661 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2662 MGMT_STATUS_INVALID_PARAMS);
2663 }
55ed8ca1 2664
86742e1e
JH		 2665 expected_len = sizeof(*cp) + key_count *
2666 sizeof(struct mgmt_link_key_info);
a492cd52 2667 if (expected_len != len) {
86742e1e 2668 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2669 expected_len, len);
bdb6d971 2670 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
04124681 2671 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2672 }
2673
4ae14301
JH		 2674 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2675 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2676 MGMT_STATUS_INVALID_PARAMS);
2677
bdb6d971 2678 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2679 key_count);
55ed8ca1 2680
4ee71b20
JH		 2681 for (i = 0; i < key_count; i++) {
2682 struct mgmt_link_key_info *key = &cp->keys[i];
2683
8e991132 2684 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
4ee71b20
JH		 2685 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2686 MGMT_STATUS_INVALID_PARAMS);
2687 }
2688
09fd0de5 2689 hci_dev_lock(hdev);
55ed8ca1
JH		 2690
2691 hci_link_keys_clear(hdev);
2692
55ed8ca1 2693 if (cp->debug_keys)
0663b297
JH		 2694 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2695 &hdev->dev_flags);
55ed8ca1 2696 else
0663b297
JH		 2697 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2698 &hdev->dev_flags);
b1de97d8
MH		 2699
2700 if (changed)
2701 new_settings(hdev, NULL);
55ed8ca1 2702
a492cd52 2703 for (i = 0; i < key_count; i++) {
86742e1e 2704 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2705
58e9293c
JH		 2706 /* Always ignore debug keys and require a new pairing if
2707 * the user wants to use them.
2708 */
2709 if (key->type == HCI_LK_DEBUG_COMBINATION)
2710 continue;
2711
7652ff6a
JH		 2712 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2713 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2714 }
2715
bdb6d971 2716 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2717
09fd0de5 2718 hci_dev_unlock(hdev);
55ed8ca1 2719
a492cd52 2720 return 0;
55ed8ca1
JH		 2721}
2722
b1078ad0 2723static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2724 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2725{
2726 struct mgmt_ev_device_unpaired ev;
2727
2728 bacpy(&ev.addr.bdaddr, bdaddr);
2729 ev.addr.type = addr_type;
2730
2731 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2732 skip_sk);
b1078ad0
JH		 2733}
2734
bdb6d971 2735static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2736 u16 len)
55ed8ca1 2737{
124f6e35
JH		 2738 struct mgmt_cp_unpair_device *cp = data;
2739 struct mgmt_rp_unpair_device rp;
a8a1d19e
JH		 2740 struct hci_cp_disconnect dc;
2741 struct pending_cmd *cmd;
55ed8ca1 2742 struct hci_conn *conn;
55ed8ca1
JH		 2743 int err;
2744
a8a1d19e 2745 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2746 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2747 rp.addr.type = cp->addr.type;
a8a1d19e 2748
4ee71b20
JH		 2749 if (!bdaddr_type_is_valid(cp->addr.type))
2750 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2751 MGMT_STATUS_INVALID_PARAMS,
2752 &rp, sizeof(rp));
2753
118da70b
JH		 2754 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2755 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2756 MGMT_STATUS_INVALID_PARAMS,
2757 &rp, sizeof(rp));
2758
4ee71b20
JH		 2759 hci_dev_lock(hdev);
2760
86a8cfc6 2761 if (!hdev_is_powered(hdev)) {
bdb6d971 2762 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2763 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
86a8cfc6
JH		 2764 goto unlock;
2765 }
2766
e0b2b27e 2767 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2768 /* If disconnection is requested, then look up the
2769 * connection. If the remote device is connected, it
2770 * will be later used to terminate the link.
2771 *
2772 * Setting it to NULL explicitly will cause no
2773 * termination of the link.
2774 */
2775 if (cp->disconnect)
2776 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2777 &cp->addr.bdaddr);
2778 else
2779 conn = NULL;
2780
124f6e35 2781 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2782 } else {
2783 u8 addr_type;
2784
89cbb063
AA		 2785 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2786 &cp->addr.bdaddr);
2787 if (conn) {
2788 /* Defer clearing up the connection parameters
2789 * until closing to give a chance of keeping
2790 * them if a repairing happens.
2791 */
2792 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2793
2794 /* If disconnection is not requested, then
2795 * clear the connection variable so that the
2796 * link is not terminated.
2797 */
2798 if (!cp->disconnect)
2799 conn = NULL;
2800 }
2801
e0b2b27e
JH		 2802 if (cp->addr.type == BDADDR_LE_PUBLIC)
2803 addr_type = ADDR_LE_DEV_PUBLIC;
2804 else
2805 addr_type = ADDR_LE_DEV_RANDOM;
2806
a7ec7338
JH		 2807 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2808
e0b2b27e
JH		 2809 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2810 }
b0dbfb46 2811
55ed8ca1 2812 if (err < 0) {
bdb6d971 2813 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2814 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
55ed8ca1
JH		 2815 goto unlock;
2816 }
2817
89cbb063
AA		 2818 /* If the connection variable is set, then termination of the
2819 * link is requested.
2820 */
a8a1d19e 2821 if (!conn) {
bdb6d971 2822 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
04124681 2823 &rp, sizeof(rp));
b1078ad0 2824 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 2825 goto unlock;
2826 }
55ed8ca1 2827
124f6e35 2828 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 2829 sizeof(*cp));
a8a1d19e
JH		 2830 if (!cmd) {
2831 err = -ENOMEM;
2832 goto unlock;
55ed8ca1
JH		 2833 }
2834
d8b7b1e4
JH		 2835 cmd->cmd_complete = addr_cmd_complete;
2836
eb55ef07 2837 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 2838 dc.reason = 0x13; /* Remote User Terminated Connection */
2839 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2840 if (err < 0)
2841 mgmt_pending_remove(cmd);
2842
55ed8ca1 2843unlock:
09fd0de5 2844 hci_dev_unlock(hdev);
55ed8ca1
JH		 2845 return err;
2846}
2847
bdb6d971 2848static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2849 u16 len)
8962ee74 2850{
650f726d 2851 struct mgmt_cp_disconnect *cp = data;
06a63b19 2852 struct mgmt_rp_disconnect rp;
366a0336 2853 struct pending_cmd *cmd;
8962ee74 2854 struct hci_conn *conn;
8962ee74
JH		 2855 int err;
2856
2857 BT_DBG("");
2858
06a63b19
JH		 2859 memset(&rp, 0, sizeof(rp));
2860 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2861 rp.addr.type = cp->addr.type;
2862
4ee71b20 2863 if (!bdaddr_type_is_valid(cp->addr.type))
06a63b19
JH		 2864 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2865 MGMT_STATUS_INVALID_PARAMS,
2866 &rp, sizeof(rp));
4ee71b20 2867
09fd0de5 2868 hci_dev_lock(hdev);
8962ee74
JH		 2869
2870 if (!test_bit(HCI_UP, &hdev->flags)) {
06a63b19
JH		 2871 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2872 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
8962ee74
JH		 2873 goto failed;
2874 }
2875
2e58ef3e 2876 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
06a63b19
JH		 2877 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2878 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 2879 goto failed;
2880 }
2881
591f47f3 2882 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 2883 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2884 &cp->addr.bdaddr);
88c3df13
JH		 2885 else
2886 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 2887
f960727e 2888 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
06a63b19
JH		 2889 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2890 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
8962ee74
JH		 2891 goto failed;
2892 }
2893
2e58ef3e 2894 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 2895 if (!cmd) {
2896 err = -ENOMEM;
8962ee74 2897 goto failed;
366a0336 2898 }
8962ee74 2899
f5818c22
JH		 2900 cmd->cmd_complete = generic_cmd_complete;
2901
e3f2f92a 2902 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 2903 if (err < 0)
a664b5bc 2904 mgmt_pending_remove(cmd);
8962ee74
JH		 2905
2906failed:
09fd0de5 2907 hci_dev_unlock(hdev);
8962ee74
JH		 2908 return err;
2909}
2910
57c1477c 2911static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 2912{
2913 switch (link_type) {
2914 case LE_LINK:
48264f06
JH		 2915 switch (addr_type) {
2916 case ADDR_LE_DEV_PUBLIC:
591f47f3 2917 return BDADDR_LE_PUBLIC;
0ed09148 2918
48264f06 2919 default:
0ed09148 2920 /* Fallback to LE Random address type */
591f47f3 2921 return BDADDR_LE_RANDOM;
48264f06 2922 }
0ed09148 2923
4c659c39 2924 default:
0ed09148 2925 /* Fallback to BR/EDR type */
591f47f3 2926 return BDADDR_BREDR;
4c659c39
JH		 2927 }
2928}
2929
04124681
GP		 2930static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2931 u16 data_len)
2784eb41 2932{
2784eb41 2933 struct mgmt_rp_get_connections *rp;
8035ded4 2934 struct hci_conn *c;
a38528f1 2935 size_t rp_len;
60fc5fb6
JH		 2936 int err;
2937 u16 i;
2784eb41
JH		 2938
2939 BT_DBG("");
2940
09fd0de5 2941 hci_dev_lock(hdev);
2784eb41 2942
5f97c1df 2943 if (!hdev_is_powered(hdev)) {
bdb6d971 2944 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
04124681 2945 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 2946 goto unlock;
2947 }
2948
60fc5fb6 2949 i = 0;
b644ba33
JH		 2950 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2951 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 2952 i++;
2784eb41
JH		 2953 }
2954
60fc5fb6 2955 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 2956 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 2957 if (!rp) {
2784eb41
JH		 2958 err = -ENOMEM;
2959 goto unlock;
2960 }
2961
2784eb41 2962 i = 0;
4c659c39 2963 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 2964 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2965 continue;
4c659c39 2966 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 2967 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 2968 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 2969 continue;
2970 i++;
2971 }
2972
eb55ef07 2973 rp->conn_count = cpu_to_le16(i);
60fc5fb6 2974
4c659c39
JH		 2975 /* Recalculate length in case of filtered SCO connections, etc */
2976 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 2977
bdb6d971 2978 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
04124681 2979 rp_len);
2784eb41 2980
a38528f1 2981 kfree(rp);
5f97c1df
JH		 2982
2983unlock:
09fd0de5 2984 hci_dev_unlock(hdev);
2784eb41
JH		 2985 return err;
2986}
2987
bdb6d971 2988static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 2989 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67
WR		 2990{
2991 struct pending_cmd *cmd;
2992 int err;
2993
2e58ef3e 2994 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 2995 sizeof(*cp));
96d97a67
WR		 2996 if (!cmd)
2997 return -ENOMEM;
2998
d8457698 2999 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3000 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3001 if (err < 0)
3002 mgmt_pending_remove(cmd);
3003
3004 return err;
3005}
3006
bdb6d971 3007static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3008 u16 len)
980e1a53 3009{
96d97a67 3010 struct hci_conn *conn;
650f726d 3011 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3012 struct hci_cp_pin_code_reply reply;
366a0336 3013 struct pending_cmd *cmd;
980e1a53
JH		 3014 int err;
3015
3016 BT_DBG("");
3017
09fd0de5 3018 hci_dev_lock(hdev);
980e1a53 3019
4b34ee78 3020 if (!hdev_is_powered(hdev)) {
bdb6d971 3021 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3022 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3023 goto failed;
3024 }
3025
d8457698 3026 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3027 if (!conn) {
bdb6d971 3028 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3029 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3030 goto failed;
3031 }
3032
3033 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3034 struct mgmt_cp_pin_code_neg_reply ncp;
3035
3036 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3037
3038 BT_ERR("PIN code is not 16 bytes long");
3039
bdb6d971 3040 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3041 if (err >= 0)
bdb6d971 3042 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3043 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3044
3045 goto failed;
3046 }
3047
00abfe44 3048 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3049 if (!cmd) {
3050 err = -ENOMEM;
980e1a53 3051 goto failed;
366a0336 3052 }
980e1a53 3053
7776d1d8
JH		 3054 cmd->cmd_complete = addr_cmd_complete;
3055
d8457698 3056 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3057 reply.pin_len = cp->pin_len;
24718ca5 3058 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3059
3060 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3061 if (err < 0)
a664b5bc 3062 mgmt_pending_remove(cmd);
980e1a53
JH		 3063
3064failed:
09fd0de5 3065 hci_dev_unlock(hdev);
980e1a53
JH		 3066 return err;
3067}
3068
04124681
GP		 3069static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3070 u16 len)
17fa4b9d 3071{
650f726d 3072 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3073
3074 BT_DBG("");
3075
4ec86d4c
JH		 3076 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3077 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3078 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3079
09fd0de5 3080 hci_dev_lock(hdev);
17fa4b9d
JH		 3081
3082 hdev->io_capability = cp->io_capability;
3083
3084 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3085 hdev->io_capability);
17fa4b9d 3086
09fd0de5 3087 hci_dev_unlock(hdev);
17fa4b9d 3088
04124681
GP		 3089 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3090 0);
17fa4b9d
JH		 3091}
3092
6039aa73 3093static struct pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3094{
3095 struct hci_dev *hdev = conn->hdev;
8035ded4 3096 struct pending_cmd *cmd;
e9a416b5 3097
2e58ef3e 3098 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3099 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3100 continue;
3101
e9a416b5
JH		 3102 if (cmd->user_data != conn)
3103 continue;
3104
3105 return cmd;
3106 }
3107
3108 return NULL;
3109}
3110
9df74653 3111static int pairing_complete(struct pending_cmd *cmd, u8 status)
e9a416b5
JH		 3112{
3113 struct mgmt_rp_pair_device rp;
3114 struct hci_conn *conn = cmd->user_data;
9df74653 3115 int err;
e9a416b5 3116
61b1a7fb
JH		 3117 bacpy(&rp.addr.bdaddr, &conn->dst);
3118 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3119
9df74653
JH		 3120 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3121 &rp, sizeof(rp));
e9a416b5
JH		 3122
3123 /* So we don't get further callbacks for this connection */
3124 conn->connect_cfm_cb = NULL;
3125 conn->security_cfm_cb = NULL;
3126 conn->disconn_cfm_cb = NULL;
3127
76a68ba0 3128 hci_conn_drop(conn);
89cbb063
AA		 3129
3130 /* The device is paired so there is no need to remove
3131 * its connection parameters anymore.
3132 */
3133 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3134
3135 hci_conn_put(conn);
9df74653
JH		 3136
3137 return err;
e9a416b5
JH		 3138}
3139
f4a407be
JH		 3140void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3141{
3142 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3143 struct pending_cmd *cmd;
3144
3145 cmd = find_pairing(conn);
a511b35b 3146 if (cmd) {
04ab2749 3147 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3148 mgmt_pending_remove(cmd);
3149 }
f4a407be
JH		 3150}
3151
e9a416b5
JH		 3152static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3153{
3154 struct pending_cmd *cmd;
3155
3156 BT_DBG("status %u", status);
3157
3158 cmd = find_pairing(conn);
a511b35b 3159 if (!cmd) {
e9a416b5 3160 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3161 return;
3162 }
3163
3164 cmd->cmd_complete(cmd, mgmt_status(status));
3165 mgmt_pending_remove(cmd);
e9a416b5
JH		 3166}
3167
f4a407be 3168static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739
VA		 3169{
3170 struct pending_cmd *cmd;
3171
3172 BT_DBG("status %u", status);
3173
3174 if (!status)
3175 return;
3176
3177 cmd = find_pairing(conn);
a511b35b 3178 if (!cmd) {
4c47d739 3179 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3180 return;
3181 }
3182
3183 cmd->cmd_complete(cmd, mgmt_status(status));
3184 mgmt_pending_remove(cmd);
4c47d739
VA		 3185}
3186
bdb6d971 3187static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3188 u16 len)
e9a416b5 3189{
650f726d 3190 struct mgmt_cp_pair_device *cp = data;
1425acb7 3191 struct mgmt_rp_pair_device rp;
e9a416b5
JH		 3192 struct pending_cmd *cmd;
3193 u8 sec_level, auth_type;
3194 struct hci_conn *conn;
e9a416b5
JH		 3195 int err;
3196
3197 BT_DBG("");
3198
f950a30e
SJ		 3199 memset(&rp, 0, sizeof(rp));
3200 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3201 rp.addr.type = cp->addr.type;
3202
4ee71b20
JH		 3203 if (!bdaddr_type_is_valid(cp->addr.type))
3204 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3205 MGMT_STATUS_INVALID_PARAMS,
3206 &rp, sizeof(rp));
3207
4ec86d4c
JH		 3208 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3209 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3210 MGMT_STATUS_INVALID_PARAMS,
3211 &rp, sizeof(rp));
3212
09fd0de5 3213 hci_dev_lock(hdev);
e9a416b5 3214
5f97c1df 3215 if (!hdev_is_powered(hdev)) {
f950a30e
SJ		 3216 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3217 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5f97c1df
JH		 3218 goto unlock;
3219 }
3220
c908df36 3221 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3222 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3223
6f77d8c7 3224 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3225 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3226 auth_type);
6f77d8c7
AG		 3227 } else {
3228 u8 addr_type;
3229
3230 /* Convert from L2CAP channel address type to HCI address type
3231 */
3232 if (cp->addr.type == BDADDR_LE_PUBLIC)
3233 addr_type = ADDR_LE_DEV_PUBLIC;
3234 else
3235 addr_type = ADDR_LE_DEV_RANDOM;
3236
7c264b10
MH		 3237 /* When pairing a new device, it is expected to remember
3238 * this device for future connections. Adding the connection
3239 * parameter information ahead of time allows tracking
3240 * of the slave preferred values and will speed up any
3241 * further connection establishment.
3242 *
3243 * If connection parameters already exist, then they
3244 * will be kept and this function does nothing.
3245 */
3246 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3247
6f77d8c7 3248 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3249 sec_level, HCI_LE_CONN_TIMEOUT,
3250 HCI_ROLE_MASTER);
6f77d8c7 3251 }
7a512d01 3252
30e76272 3253 if (IS_ERR(conn)) {
489dc48e
AK		 3254 int status;
3255
3256 if (PTR_ERR(conn) == -EBUSY)
3257 status = MGMT_STATUS_BUSY;
faa81030
LR		 3258 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3259 status = MGMT_STATUS_NOT_SUPPORTED;
3260 else if (PTR_ERR(conn) == -ECONNREFUSED)
3261 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3262 else
3263 status = MGMT_STATUS_CONNECT_FAILED;
3264
bdb6d971 3265 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
489dc48e 3266 status, &rp,
04124681 3267 sizeof(rp));
e9a416b5
JH		 3268 goto unlock;
3269 }
3270
3271 if (conn->connect_cfm_cb) {
76a68ba0 3272 hci_conn_drop(conn);
bdb6d971 3273 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
04124681 3274 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3275 goto unlock;
3276 }
3277
2e58ef3e 3278 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3279 if (!cmd) {
3280 err = -ENOMEM;
76a68ba0 3281 hci_conn_drop(conn);
e9a416b5
JH		 3282 goto unlock;
3283 }
3284
04ab2749
JH		 3285 cmd->cmd_complete = pairing_complete;
3286
7a512d01 3287 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3288 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3289 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3290 conn->security_cfm_cb = pairing_complete_cb;
3291 conn->disconn_cfm_cb = pairing_complete_cb;
3292 } else {
3293 conn->connect_cfm_cb = le_pairing_complete_cb;
3294 conn->security_cfm_cb = le_pairing_complete_cb;
3295 conn->disconn_cfm_cb = le_pairing_complete_cb;
3296 }
7a512d01 3297
e9a416b5 3298 conn->io_capability = cp->io_cap;
f8aaf9b6 3299 cmd->user_data = hci_conn_get(conn);
e9a416b5 3300
6f78fd4b 3301 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3302 hci_conn_security(conn, sec_level, auth_type, true)) {
3303 cmd->cmd_complete(cmd, 0);
3304 mgmt_pending_remove(cmd);
3305 }
e9a416b5
JH		 3306
3307 err = 0;
3308
3309unlock:
09fd0de5 3310 hci_dev_unlock(hdev);
e9a416b5
JH		 3311 return err;
3312}
3313
04124681
GP		 3314static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3315 u16 len)
28424707 3316{
0f4e68cf 3317 struct mgmt_addr_info *addr = data;
28424707
JH		 3318 struct pending_cmd *cmd;
3319 struct hci_conn *conn;
3320 int err;
3321
3322 BT_DBG("");
3323
28424707
JH		 3324 hci_dev_lock(hdev);
3325
5f97c1df 3326 if (!hdev_is_powered(hdev)) {
bdb6d971 3327 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3328 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3329 goto unlock;
3330 }
3331
28424707
JH		 3332 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3333 if (!cmd) {
bdb6d971 3334 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3335 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3336 goto unlock;
3337 }
3338
3339 conn = cmd->user_data;
3340
3341 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
bdb6d971 3342 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3343 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3344 goto unlock;
3345 }
3346
a511b35b
JH		 3347 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3348 mgmt_pending_remove(cmd);
28424707 3349
bdb6d971 3350 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
04124681 3351 addr, sizeof(*addr));
28424707
JH		 3352unlock:
3353 hci_dev_unlock(hdev);
28424707
JH		 3354 return err;
3355}
3356
bdb6d971 3357static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3358 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3359 u16 hci_op, __le32 passkey)
a5c29683 3360{
a5c29683 3361 struct pending_cmd *cmd;
0df4c185 3362 struct hci_conn *conn;
a5c29683
JH		 3363 int err;
3364
09fd0de5 3365 hci_dev_lock(hdev);
08ba5382 3366
4b34ee78 3367 if (!hdev_is_powered(hdev)) {
feb94d3d
JH		 3368 err = cmd_complete(sk, hdev->id, mgmt_op,
3369 MGMT_STATUS_NOT_POWERED, addr,
3370 sizeof(*addr));
0df4c185 3371 goto done;
a5c29683
JH		 3372 }
3373
1707c60e
JH		 3374 if (addr->type == BDADDR_BREDR)
3375 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3376 else
1707c60e 3377 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3378
3379 if (!conn) {
feb94d3d
JH		 3380 err = cmd_complete(sk, hdev->id, mgmt_op,
3381 MGMT_STATUS_NOT_CONNECTED, addr,
3382 sizeof(*addr));
272d90df
JH		 3383 goto done;
3384 }
47c15e2b 3385
1707c60e 3386 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3387 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3388 if (!err)
feb94d3d
JH		 3389 err = cmd_complete(sk, hdev->id, mgmt_op,
3390 MGMT_STATUS_SUCCESS, addr,
3391 sizeof(*addr));
5fe57d9e 3392 else
feb94d3d
JH		 3393 err = cmd_complete(sk, hdev->id, mgmt_op,
3394 MGMT_STATUS_FAILED, addr,
3395 sizeof(*addr));
47c15e2b 3396
47c15e2b
BG		 3397 goto done;
3398 }
3399
1707c60e 3400 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3401 if (!cmd) {
3402 err = -ENOMEM;
0df4c185 3403 goto done;
a5c29683
JH		 3404 }
3405
7776d1d8
JH		 3406 cmd->cmd_complete = addr_cmd_complete;
3407
0df4c185 3408 /* Continue with pairing via HCI */
604086b7
BG		 3409 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3410 struct hci_cp_user_passkey_reply cp;
3411
1707c60e 3412 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3413 cp.passkey = passkey;
3414 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3415 } else
1707c60e
JH		 3416 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3417 &addr->bdaddr);
604086b7 3418
a664b5bc
JH		 3419 if (err < 0)
3420 mgmt_pending_remove(cmd);
a5c29683 3421
0df4c185 3422done:
09fd0de5 3423 hci_dev_unlock(hdev);
a5c29683
JH		 3424 return err;
3425}
3426
afeb019d
JK		 3427static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3428 void *data, u16 len)
3429{
3430 struct mgmt_cp_pin_code_neg_reply *cp = data;
3431
3432 BT_DBG("");
3433
1707c60e 3434 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3435 MGMT_OP_PIN_CODE_NEG_REPLY,
3436 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3437}
3438
04124681
GP		 3439static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3440 u16 len)
0df4c185 3441{
650f726d 3442 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3443
3444 BT_DBG("");
3445
3446 if (len != sizeof(*cp))
bdb6d971 3447 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
04124681 3448 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3449
1707c60e 3450 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3451 MGMT_OP_USER_CONFIRM_REPLY,
3452 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3453}
3454
bdb6d971 3455static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3456 void *data, u16 len)
0df4c185 3457{
c9c2659f 3458 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3459
3460 BT_DBG("");
3461
1707c60e 3462 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3463 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3464 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3465}
3466
04124681
GP		 3467static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3468 u16 len)
604086b7 3469{
650f726d 3470 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3471
3472 BT_DBG("");
3473
1707c60e 3474 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3475 MGMT_OP_USER_PASSKEY_REPLY,
3476 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3477}
3478
bdb6d971 3479static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3480 void *data, u16 len)
604086b7 3481{
650f726d 3482 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3483
3484 BT_DBG("");
3485
1707c60e 3486 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3487 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3488 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3489}
3490
13928971 3491static void update_name(struct hci_request *req)
2b4bf397 3492{
13928971 3493 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3494 struct hci_cp_write_local_name cp;
3495
13928971 3496 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3497
890ea898 3498 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3499}
3500
1904a853 3501static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3502{
3503 struct mgmt_cp_set_local_name *cp;
3504 struct pending_cmd *cmd;
3505
3506 BT_DBG("status 0x%02x", status);
3507
3508 hci_dev_lock(hdev);
3509
3510 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3511 if (!cmd)
3512 goto unlock;
3513
3514 cp = cmd->param;
3515
3516 if (status)
3517 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3518 mgmt_status(status));
3519 else
3520 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3521 cp, sizeof(*cp));
3522
3523 mgmt_pending_remove(cmd);
3524
3525unlock:
3526 hci_dev_unlock(hdev);
3527}
3528
bdb6d971 3529static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3530 u16 len)
b312b161 3531{
2b4bf397 3532 struct mgmt_cp_set_local_name *cp = data;
b312b161 3533 struct pending_cmd *cmd;
890ea898 3534 struct hci_request req;
b312b161
JH		 3535 int err;
3536
3537 BT_DBG("");
3538
09fd0de5 3539 hci_dev_lock(hdev);
b312b161 3540
b3f2ca94
JH		 3541 /* If the old values are the same as the new ones just return a
3542 * direct command complete event.
3543 */
3544 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3545 !memcmp(hdev->short_name, cp->short_name,
3546 sizeof(hdev->short_name))) {
3547 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3548 data, len);
3549 goto failed;
3550 }
3551
2b4bf397 3552 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3553
b5235a65 3554 if (!hdev_is_powered(hdev)) {
2b4bf397 3555 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde
JH		 3556
3557 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
04124681 3558 data, len);
28cc7bde
JH		 3559 if (err < 0)
3560 goto failed;
3561
3562 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
04124681 3563 sk);
28cc7bde 3564
b5235a65
JH		 3565 goto failed;
3566 }
3567
28cc7bde 3568 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3569 if (!cmd) {
3570 err = -ENOMEM;
3571 goto failed;
3572 }
3573
13928971
JH		 3574 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3575
890ea898 3576 hci_req_init(&req, hdev);
3f985050
JH		 3577
3578 if (lmp_bredr_capable(hdev)) {
3579 update_name(&req);
3580 update_eir(&req);
3581 }
3582
7a5f4990
MH		 3583 /* The name is stored in the scan response data and so
3584 * no need to udpate the advertising data here.
3585 */
3f985050 3586 if (lmp_le_capable(hdev))
7a5f4990 3587 update_scan_rsp_data(&req);
3f985050 3588
13928971 3589 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3590 if (err < 0)
3591 mgmt_pending_remove(cmd);
3592
3593failed:
09fd0de5 3594 hci_dev_unlock(hdev);
b312b161
JH		 3595 return err;
3596}
3597
0f4e68cf 3598static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3599 void *data, u16 data_len)
c35938b2 3600{
c35938b2
SJ		 3601 struct pending_cmd *cmd;
3602 int err;
3603
bdb6d971 3604 BT_DBG("%s", hdev->name);
c35938b2 3605
09fd0de5 3606 hci_dev_lock(hdev);
c35938b2 3607
4b34ee78 3608 if (!hdev_is_powered(hdev)) {
bdb6d971 3609 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3610 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3611 goto unlock;
3612 }
3613
9a1a1996 3614 if (!lmp_ssp_capable(hdev)) {
bdb6d971 3615 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3616 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3617 goto unlock;
3618 }
3619
2e58ef3e 3620 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
bdb6d971 3621 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3622 MGMT_STATUS_BUSY);
c35938b2
SJ		 3623 goto unlock;
3624 }
3625
2e58ef3e 3626 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3627 if (!cmd) {
3628 err = -ENOMEM;
3629 goto unlock;
3630 }
3631
710f11c0 3632 if (bredr_sc_enabled(hdev))
4d2d2796
MH		 3633 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3634 0, NULL);
3635 else
3636 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3637
c35938b2
SJ		 3638 if (err < 0)
3639 mgmt_pending_remove(cmd);
3640
3641unlock:
09fd0de5 3642 hci_dev_unlock(hdev);
c35938b2
SJ		 3643 return err;
3644}
3645
bdb6d971 3646static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3647 void *data, u16 len)
2763eda6 3648{
5d57e796 3649 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3650 int err;
3651
bdb6d971 3652 BT_DBG("%s ", hdev->name);
2763eda6 3653
5d57e796
JH		 3654 if (!bdaddr_type_is_valid(addr->type))
3655 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3656 MGMT_STATUS_INVALID_PARAMS, addr,
3657 sizeof(*addr));
3658
09fd0de5 3659 hci_dev_lock(hdev);
2763eda6 3660
ec109113
MH		 3661 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3662 struct mgmt_cp_add_remote_oob_data *cp = data;
3663 u8 status;
bf1e3541 3664
c19a495c
JH		 3665 if (cp->addr.type != BDADDR_BREDR) {
3666 err = cmd_complete(sk, hdev->id,
3667 MGMT_OP_ADD_REMOTE_OOB_DATA,
3668 MGMT_STATUS_INVALID_PARAMS,
3669 &cp->addr, sizeof(cp->addr));
3670 goto unlock;
3671 }
3672
ec109113 3673 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 3674 cp->addr.type, cp->hash,
3675 cp->rand, NULL, NULL);
ec109113
MH		 3676 if (err < 0)
3677 status = MGMT_STATUS_FAILED;
3678 else
3679 status = MGMT_STATUS_SUCCESS;
3680
3681 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3682 status, &cp->addr, sizeof(cp->addr));
3683 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3684 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 3685 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 3686 u8 status;
3687
86df9200 3688 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 3689 /* Enforce zero-valued 192-bit parameters as
3690 * long as legacy SMP OOB isn't implemented.
3691 */
3692 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3693 memcmp(cp->hash192, ZERO_KEY, 16)) {
3694 err = cmd_complete(sk, hdev->id,
3695 MGMT_OP_ADD_REMOTE_OOB_DATA,
3696 MGMT_STATUS_INVALID_PARAMS,
3697 addr, sizeof(*addr));
3698 goto unlock;
3699 }
3700
86df9200
JH		 3701 rand192 = NULL;
3702 hash192 = NULL;
3703 } else {
41bcfd50
MH		 3704 /* In case one of the P-192 values is set to zero,
3705 * then just disable OOB data for P-192.
3706 */
3707 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3708 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3709 rand192 = NULL;
3710 hash192 = NULL;
3711 } else {
3712 rand192 = cp->rand192;
3713 hash192 = cp->hash192;
3714 }
3715 }
3716
3717 /* In case one of the P-256 values is set to zero, then just
3718 * disable OOB data for P-256.
3719 */
3720 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3721 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3722 rand256 = NULL;
3723 hash256 = NULL;
3724 } else {
3725 rand256 = cp->rand256;
3726 hash256 = cp->hash256;
86df9200
JH		 3727 }
3728
81328d5c 3729 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 3730 cp->addr.type, hash192, rand192,
41bcfd50 3731 hash256, rand256);
ec109113
MH		 3732 if (err < 0)
3733 status = MGMT_STATUS_FAILED;
3734 else
3735 status = MGMT_STATUS_SUCCESS;
3736
3737 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3738 status, &cp->addr, sizeof(cp->addr));
3739 } else {
3740 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3741 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3742 MGMT_STATUS_INVALID_PARAMS);
3743 }
2763eda6 3744
c19a495c 3745unlock:
09fd0de5 3746 hci_dev_unlock(hdev);
2763eda6
SJ		 3747 return err;
3748}
3749
bdb6d971 3750static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3751 void *data, u16 len)
2763eda6 3752{
650f726d 3753 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3754 u8 status;
2763eda6
SJ		 3755 int err;
3756
bdb6d971 3757 BT_DBG("%s", hdev->name);
2763eda6 3758
c19a495c
JH		 3759 if (cp->addr.type != BDADDR_BREDR)
3760 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3761 MGMT_STATUS_INVALID_PARAMS,
3762 &cp->addr, sizeof(cp->addr));
3763
09fd0de5 3764 hci_dev_lock(hdev);
2763eda6 3765
eedbd581
JH		 3766 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3767 hci_remote_oob_data_clear(hdev);
3768 status = MGMT_STATUS_SUCCESS;
3769 goto done;
3770 }
3771
6928a924 3772 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 3773 if (err < 0)
bf1e3541 3774 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3775 else
a6785be2 3776 status = MGMT_STATUS_SUCCESS;
bf1e3541 3777
eedbd581 3778done:
bdb6d971 3779 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
04124681 3780 status, &cp->addr, sizeof(cp->addr));
2763eda6 3781
09fd0de5 3782 hci_dev_unlock(hdev);
2763eda6
SJ		 3783 return err;
3784}
3785
8019044d 3786static bool trigger_discovery(struct hci_request *req, u8 *status)
41dc2bd6 3787{
8019044d
MH		 3788 struct hci_dev *hdev = req->hdev;
3789 struct hci_cp_le_set_scan_param param_cp;
3790 struct hci_cp_le_set_scan_enable enable_cp;
3791 struct hci_cp_inquiry inq_cp;
3792 /* General inquiry access code (GIAC) */
3793 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3794 u8 own_addr_type;
41dc2bd6
AG		 3795 int err;
3796
8019044d
MH		 3797 switch (hdev->discovery.type) {
3798 case DISCOV_TYPE_BREDR:
3799 *status = mgmt_bredr_support(hdev);
3800 if (*status)
3801 return false;
41dc2bd6 3802
8019044d
MH		 3803 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3804 *status = MGMT_STATUS_BUSY;
3805 return false;
3806 }
41dc2bd6 3807
8019044d 3808 hci_inquiry_cache_flush(hdev);
41dc2bd6 3809
8019044d
MH		 3810 memset(&inq_cp, 0, sizeof(inq_cp));
3811 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3812 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3813 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3814 break;
41dc2bd6 3815
8019044d
MH		 3816 case DISCOV_TYPE_LE:
3817 case DISCOV_TYPE_INTERLEAVED:
3818 *status = mgmt_le_support(hdev);
3819 if (*status)
3820 return false;
3821
3822 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3823 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3824 *status = MGMT_STATUS_NOT_SUPPORTED;
3825 return false;
3826 }
3827
3828 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3829 /* Don't let discovery abort an outgoing
3830 * connection attempt that's using directed
3831 * advertising.
3832 */
3833 if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3834 BT_CONNECT)) {
3835 *status = MGMT_STATUS_REJECTED;
3836 return false;
3837 }
3838
3839 disable_advertising(req);
3840 }
3841
3842 /* If controller is scanning, it means the background scanning
3843 * is running. Thus, we should temporarily stop it in order to
3844 * set the discovery scanning parameters.
3845 */
3846 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3847 hci_req_add_le_scan_disable(req);
3848
3849 memset(&param_cp, 0, sizeof(param_cp));
3850
3851 /* All active scans will be done with either a resolvable
3852 * private address (when privacy feature has been enabled)
9437d2ed 3853 * or non-resolvable private address.
8019044d
MH		 3854 */
3855 err = hci_update_random_address(req, true, &own_addr_type);
3856 if (err < 0) {
3857 *status = MGMT_STATUS_FAILED;
3858 return false;
3859 }
3860
3861 param_cp.type = LE_SCAN_ACTIVE;
3862 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3863 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3864 param_cp.own_address_type = own_addr_type;
3865 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3866 &param_cp);
3867
3868 memset(&enable_cp, 0, sizeof(enable_cp));
3869 enable_cp.enable = LE_SCAN_ENABLE;
3870 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3871 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3872 &enable_cp);
3873 break;
3874
3875 default:
3876 *status = MGMT_STATUS_INVALID_PARAMS;
3877 return false;
3878 }
3879
3880 return true;
41dc2bd6
AG		 3881}
3882
1904a853
MH		 3883static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3884 u16 opcode)
7c307720 3885{
41dc2bd6 3886 struct pending_cmd *cmd;
11e6e25d 3887 unsigned long timeout;
ae55f598 3888
7c307720
AG		 3889 BT_DBG("status %d", status);
3890
11e6e25d 3891 hci_dev_lock(hdev);
41dc2bd6 3892
11e6e25d 3893 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427
JP		 3894 if (!cmd)
3895 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3896
11e6e25d 3897 if (cmd) {
2922a94f 3898 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 3899 mgmt_pending_remove(cmd);
3900 }
7c307720
AG		 3901
3902 if (status) {
11e6e25d
MH		 3903 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3904 goto unlock;
7c307720
AG		 3905 }
3906
7c307720 3907 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 3908
2d28cfe7
JP		 3909 /* If the scan involves LE scan, pick proper timeout to schedule
3910 * hdev->le_scan_disable that will stop it.
3911 */
7c307720
AG		 3912 switch (hdev->discovery.type) {
3913 case DISCOV_TYPE_LE:
3d5a76f0 3914 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 3915 break;
7c307720 3916 case DISCOV_TYPE_INTERLEAVED:
b9a7a61e 3917 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 3918 break;
7c307720 3919 case DISCOV_TYPE_BREDR:
11e6e25d 3920 timeout = 0;
7c307720 3921 break;
7c307720
AG		 3922 default:
3923 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 3924 timeout = 0;
3925 break;
7c307720 3926 }
ae55f598 3927
2d28cfe7
JP		 3928 if (timeout) {
3929 /* When service discovery is used and the controller has
3930 * a strict duplicate filter, it is important to remember
3931 * the start and duration of the scan. This is required
3932 * for restarting scanning during the discovery phase.
3933 */
3934 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
3935 &hdev->quirks) &&
3936 (hdev->discovery.uuid_count > 0 ||
3937 hdev->discovery.rssi != HCI_RSSI_INVALID)) {
3938 hdev->discovery.scan_start = jiffies;
3939 hdev->discovery.scan_duration = timeout;
3940 }
3941
11e6e25d
MH		 3942 queue_delayed_work(hdev->workqueue,
3943 &hdev->le_scan_disable, timeout);
2d28cfe7 3944 }
ae55f598 3945
11e6e25d
MH		 3946unlock:
3947 hci_dev_unlock(hdev);
7c307720
AG		 3948}
3949
bdb6d971 3950static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 3951 void *data, u16 len)
14a53664 3952{
650f726d 3953 struct mgmt_cp_start_discovery *cp = data;
14a53664 3954 struct pending_cmd *cmd;
7c307720 3955 struct hci_request req;
8019044d 3956 u8 status;
14a53664
JH		 3957 int err;
3958
bdb6d971 3959 BT_DBG("%s", hdev->name);
14a53664 3960
09fd0de5 3961 hci_dev_lock(hdev);
14a53664 3962
4b34ee78 3963 if (!hdev_is_powered(hdev)) {
a736abc1
SJ		 3964 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3965 MGMT_STATUS_NOT_POWERED,
3966 &cp->type, sizeof(cp->type));
bd2d1334
JH		 3967 goto failed;
3968 }
3969
f5a969f2
MH		 3970 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3971 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
a736abc1
SJ		 3972 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3973 MGMT_STATUS_BUSY, &cp->type,
3974 sizeof(cp->type));
642be6c7
AG		 3975 goto failed;
3976 }
3977
2922a94f 3978 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 3979 if (!cmd) {
3980 err = -ENOMEM;
3981 goto failed;
3982 }
3983
2922a94f
JH		 3984 cmd->cmd_complete = generic_cmd_complete;
3985
22078800
MH		 3986 /* Clear the discovery filter first to free any previously
3987 * allocated memory for the UUID list.
3988 */
3989 hci_discovery_filter_clear(hdev);
3990
4aab14e5 3991 hdev->discovery.type = cp->type;
da25cf6a 3992 hdev->discovery.report_invalid_rssi = false;
4aab14e5 3993
7c307720
AG		 3994 hci_req_init(&req, hdev);
3995
8019044d 3996 if (!trigger_discovery(&req, &status)) {
a736abc1 3997 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
8019044d 3998 status, &cp->type, sizeof(cp->type));
04106755
JH		 3999 mgmt_pending_remove(cmd);
4000 goto failed;
f39799f5 4001 }
04106755 4002
7c307720 4003 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4004 if (err < 0) {
14a53664 4005 mgmt_pending_remove(cmd);
f5a969f2
MH		 4006 goto failed;
4007 }
7c307720 4008
f5a969f2 4009 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4010
14a53664 4011failed:
09fd0de5 4012 hci_dev_unlock(hdev);
14a53664
JH		 4013 return err;
4014}
f39799f5 4015
9df74653 4016static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
2922a94f 4017{
9df74653
JH		 4018 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4019 cmd->param, 1);
2922a94f 4020}
04106755 4021
66ea9427
JP		 4022static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4023 void *data, u16 len)
4024{
4025 struct mgmt_cp_start_service_discovery *cp = data;
4026 struct pending_cmd *cmd;
4027 struct hci_request req;
4028 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4029 u16 uuid_count, expected_len;
4030 u8 status;
4031 int err;
04106755 4032
66ea9427 4033 BT_DBG("%s", hdev->name);
e8bb6b97 4034
66ea9427 4035 hci_dev_lock(hdev);
7c307720 4036
66ea9427
JP		 4037 if (!hdev_is_powered(hdev)) {
4038 err = cmd_complete(sk, hdev->id,
4039 MGMT_OP_START_SERVICE_DISCOVERY,
4040 MGMT_STATUS_NOT_POWERED,
4041 &cp->type, sizeof(cp->type));
4042 goto failed;
4043 }
7c307720 4044
66ea9427
JP		 4045 if (hdev->discovery.state != DISCOVERY_STOPPED ||
4046 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4047 err = cmd_complete(sk, hdev->id,
4048 MGMT_OP_START_SERVICE_DISCOVERY,
4049 MGMT_STATUS_BUSY, &cp->type,
4050 sizeof(cp->type));
4051 goto failed;
4052 }
d9483943 4053
66ea9427
JP		 4054 uuid_count = __le16_to_cpu(cp->uuid_count);
4055 if (uuid_count > max_uuid_count) {
4056 BT_ERR("service_discovery: too big uuid_count value %u",
4057 uuid_count);
4058 err = cmd_complete(sk, hdev->id,
4059 MGMT_OP_START_SERVICE_DISCOVERY,
4060 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4061 sizeof(cp->type));
4062 goto failed;
4063 }
4064
4065 expected_len = sizeof(*cp) + uuid_count * 16;
4066 if (expected_len != len) {
4067 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4068 expected_len, len);
4069 err = cmd_complete(sk, hdev->id,
4070 MGMT_OP_START_SERVICE_DISCOVERY,
4071 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4072 sizeof(cp->type));
4073 goto failed;
4074 }
4075
4076 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4077 hdev, data, len);
66ea9427
JP		 4078 if (!cmd) {
4079 err = -ENOMEM;
4080 goto failed;
4081 }
4082
2922a94f
JH		 4083 cmd->cmd_complete = service_discovery_cmd_complete;
4084
22078800
MH		 4085 /* Clear the discovery filter first to free any previously
4086 * allocated memory for the UUID list.
4087 */
4088 hci_discovery_filter_clear(hdev);
4089
66ea9427
JP		 4090 hdev->discovery.type = cp->type;
4091 hdev->discovery.rssi = cp->rssi;
4092 hdev->discovery.uuid_count = uuid_count;
4093
4094 if (uuid_count > 0) {
4095 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4096 GFP_KERNEL);
4097 if (!hdev->discovery.uuids) {
a736abc1 4098 err = cmd_complete(sk, hdev->id,
66ea9427 4099 MGMT_OP_START_SERVICE_DISCOVERY,
a736abc1
SJ		 4100 MGMT_STATUS_FAILED,
4101 &cp->type, sizeof(cp->type));
d9483943
JH		 4102 mgmt_pending_remove(cmd);
4103 goto failed;
4104 }
66ea9427 4105 }
d9483943 4106
66ea9427 4107 hci_req_init(&req, hdev);
5e0452c0 4108
66ea9427
JP		 4109 if (!trigger_discovery(&req, &status)) {
4110 err = cmd_complete(sk, hdev->id,
4111 MGMT_OP_START_SERVICE_DISCOVERY,
4112 status, &cp->type, sizeof(cp->type));
04106755
JH		 4113 mgmt_pending_remove(cmd);
4114 goto failed;
f39799f5 4115 }
3fd24153 4116
7c307720 4117 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4118 if (err < 0) {
14a53664 4119 mgmt_pending_remove(cmd);
66ea9427
JP		 4120 goto failed;
4121 }
4122
4123 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4124
4125failed:
09fd0de5 4126 hci_dev_unlock(hdev);
14a53664
JH		 4127 return err;
4128}
4129
1904a853 4130static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca
AG		 4131{
4132 struct pending_cmd *cmd;
1183fdca 4133
0e05bba6
AG		 4134 BT_DBG("status %d", status);
4135
4136 hci_dev_lock(hdev);
4137
11e6e25d
MH		 4138 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4139 if (cmd) {
2922a94f 4140 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4141 mgmt_pending_remove(cmd);
0e05bba6
AG		 4142 }
4143
11e6e25d
MH		 4144 if (!status)
4145 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4146
0e05bba6
AG		 4147 hci_dev_unlock(hdev);
4148}
4149
bdb6d971 4150static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4151 u16 len)
14a53664 4152{
d930650b 4153 struct mgmt_cp_stop_discovery *mgmt_cp = data;
14a53664 4154 struct pending_cmd *cmd;
0e05bba6 4155 struct hci_request req;
14a53664
JH		 4156 int err;
4157
bdb6d971 4158 BT_DBG("%s", hdev->name);
14a53664 4159
09fd0de5 4160 hci_dev_lock(hdev);
14a53664 4161
30dc78e1 4162 if (!hci_discovery_active(hdev)) {
bdb6d971 4163 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 4164 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4165 sizeof(mgmt_cp->type));
d930650b
JH		 4166 goto unlock;
4167 }
4168
4169 if (hdev->discovery.type != mgmt_cp->type) {
bdb6d971 4170 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 4171 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4172 sizeof(mgmt_cp->type));
30dc78e1 4173 goto unlock;
ff9ef578
JH		 4174 }
4175
2922a94f 4176 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4177 if (!cmd) {
4178 err = -ENOMEM;
30dc78e1
JH		 4179 goto unlock;
4180 }
4181
2922a94f
JH		 4182 cmd->cmd_complete = generic_cmd_complete;
4183
0e05bba6
AG		 4184 hci_req_init(&req, hdev);
4185
21a60d30 4186 hci_stop_discovery(&req);
e0d9727e 4187
21a60d30
JH		 4188 err = hci_req_run(&req, stop_discovery_complete);
4189 if (!err) {
4190 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4191 goto unlock;
14a53664
JH		 4192 }
4193
21a60d30
JH		 4194 mgmt_pending_remove(cmd);
4195
4196 /* If no HCI commands were sent we're done */
4197 if (err == -ENODATA) {
4198 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4199 &mgmt_cp->type, sizeof(mgmt_cp->type));
4200 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4201 }
14a53664 4202
30dc78e1 4203unlock:
09fd0de5 4204 hci_dev_unlock(hdev);
14a53664
JH		 4205 return err;
4206}
4207
bdb6d971 4208static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4209 u16 len)
561aafbc 4210{
650f726d 4211 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4212 struct inquiry_entry *e;
561aafbc
JH		 4213 int err;
4214
bdb6d971 4215 BT_DBG("%s", hdev->name);
561aafbc 4216
561aafbc
JH		 4217 hci_dev_lock(hdev);
4218
30dc78e1 4219 if (!hci_discovery_active(hdev)) {
d3a2541d
LR		 4220 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4221 MGMT_STATUS_FAILED, &cp->addr,
4222 sizeof(cp->addr));
30dc78e1
JH		 4223 goto failed;
4224 }
4225
a198e7b1 4226 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4227 if (!e) {
d3a2541d
LR		 4228 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4229 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4230 sizeof(cp->addr));
561aafbc
JH		 4231 goto failed;
4232 }
4233
4234 if (cp->name_known) {
4235 e->name_state = NAME_KNOWN;
4236 list_del(&e->list);
4237 } else {
4238 e->name_state = NAME_NEEDED;
a3d4e20a 4239 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4240 }
4241
e384662b
JH		 4242 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4243 sizeof(cp->addr));
561aafbc
JH		 4244
4245failed:
4246 hci_dev_unlock(hdev);
561aafbc
JH		 4247 return err;
4248}
4249
bdb6d971 4250static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4251 u16 len)
7fbec224 4252{
650f726d 4253 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4254 u8 status;
7fbec224
AJ		 4255 int err;
4256
bdb6d971 4257 BT_DBG("%s", hdev->name);
7fbec224 4258
4ee71b20 4259 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 4260 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4261 MGMT_STATUS_INVALID_PARAMS,
4262 &cp->addr, sizeof(cp->addr));
4ee71b20 4263
09fd0de5 4264 hci_dev_lock(hdev);
5e762444 4265
dcc36c16
JH		 4266 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4267 cp->addr.type);
2a8357f2 4268 if (err < 0) {
f0eeea8b 4269 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4270 goto done;
4271 }
4272
4273 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4274 sk);
4275 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4276
2a8357f2 4277done:
bdb6d971 4278 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
04124681 4279 &cp->addr, sizeof(cp->addr));
5e762444 4280
09fd0de5 4281 hci_dev_unlock(hdev);
7fbec224
AJ		 4282
4283 return err;
4284}
4285
bdb6d971 4286static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4287 u16 len)
7fbec224 4288{
650f726d 4289 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4290 u8 status;
7fbec224
AJ		 4291 int err;
4292
bdb6d971 4293 BT_DBG("%s", hdev->name);
7fbec224 4294
4ee71b20 4295 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 4296 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4297 MGMT_STATUS_INVALID_PARAMS,
4298 &cp->addr, sizeof(cp->addr));
4ee71b20 4299
09fd0de5 4300 hci_dev_lock(hdev);
5e762444 4301
dcc36c16
JH		 4302 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4303 cp->addr.type);
2a8357f2 4304 if (err < 0) {
f0eeea8b 4305 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4306 goto done;
4307 }
4308
4309 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4310 sk);
4311 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4312
2a8357f2 4313done:
bdb6d971 4314 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
04124681 4315 &cp->addr, sizeof(cp->addr));
5e762444 4316
09fd0de5 4317 hci_dev_unlock(hdev);
7fbec224
AJ		 4318
4319 return err;
4320}
4321
cdbaccca
MH		 4322static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4323 u16 len)
4324{
4325 struct mgmt_cp_set_device_id *cp = data;
890ea898 4326 struct hci_request req;
cdbaccca 4327 int err;
c72d4b8a 4328 __u16 source;
cdbaccca
MH		 4329
4330 BT_DBG("%s", hdev->name);
4331
c72d4b8a
SJ		 4332 source = __le16_to_cpu(cp->source);
4333
4334 if (source > 0x0002)
4335 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4336 MGMT_STATUS_INVALID_PARAMS);
4337
cdbaccca
MH		 4338 hci_dev_lock(hdev);
4339
c72d4b8a 4340 hdev->devid_source = source;
cdbaccca
MH		 4341 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4342 hdev->devid_product = __le16_to_cpu(cp->product);
4343 hdev->devid_version = __le16_to_cpu(cp->version);
4344
4345 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4346
890ea898
JH		 4347 hci_req_init(&req, hdev);
4348 update_eir(&req);
4349 hci_req_run(&req, NULL);
cdbaccca
MH		 4350
4351 hci_dev_unlock(hdev);
4352
4353 return err;
4354}
4355
1904a853
MH		 4356static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4357 u16 opcode)
4375f103
JH		 4358{
4359 struct cmd_lookup match = { NULL, hdev };
4360
3ad67582
JK		 4361 hci_dev_lock(hdev);
4362
4375f103
JH		 4363 if (status) {
4364 u8 mgmt_err = mgmt_status(status);
4365
4366 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4367 cmd_status_rsp, &mgmt_err);
3ad67582 4368 goto unlock;
4375f103
JH		 4369 }
4370
c93bd150
JH		 4371 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4372 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4373 else
4374 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375
4375f103
JH		 4376 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4377 &match);
4378
4379 new_settings(hdev, match.sk);
4380
4381 if (match.sk)
4382 sock_put(match.sk);
3ad67582
JK		 4383
4384unlock:
4385 hci_dev_unlock(hdev);
4375f103
JH		 4386}
4387
21b5187f
MH		 4388static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4389 u16 len)
4375f103
JH		 4390{
4391 struct mgmt_mode *cp = data;
4392 struct pending_cmd *cmd;
4393 struct hci_request req;
e6fe7986 4394 u8 val, enabled, status;
4375f103
JH		 4395 int err;
4396
4397 BT_DBG("request for %s", hdev->name);
4398
e6fe7986
JH		 4399 status = mgmt_le_support(hdev);
4400 if (status)
4375f103 4401 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
e6fe7986 4402 status);
4375f103
JH		 4403
4404 if (cp->val != 0x00 && cp->val != 0x01)
4405 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4406 MGMT_STATUS_INVALID_PARAMS);
4407
4408 hci_dev_lock(hdev);
4409
4410 val = !!cp->val;
f3d3444a 4411 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103 4412
f74ca9b8
JH		 4413 /* The following conditions are ones which mean that we should
4414 * not do any HCI communication but directly send a mgmt
4415 * response to user space (after toggling the flag if
4416 * necessary).
4417 */
4418 if (!hdev_is_powered(hdev) || val == enabled ||
e8bb6b97
JH		 4419 hci_conn_num(hdev, LE_LINK) > 0 ||
4420 (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4421 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4375f103
JH		 4422 bool changed = false;
4423
f3d3444a
JH		 4424 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4425 change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103
JH		 4426 changed = true;
4427 }
4428
4429 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4430 if (err < 0)
4431 goto unlock;
4432
4433 if (changed)
4434 err = new_settings(hdev, sk);
4435
4436 goto unlock;
4437 }
4438
4439 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4440 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4441 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4442 MGMT_STATUS_BUSY);
4443 goto unlock;
4444 }
4445
4446 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4447 if (!cmd) {
4448 err = -ENOMEM;
4449 goto unlock;
4450 }
4451
4452 hci_req_init(&req, hdev);
4453
bba3aa55
MH		 4454 if (val)
4455 enable_advertising(&req);
4456 else
4457 disable_advertising(&req);
4375f103
JH		 4458
4459 err = hci_req_run(&req, set_advertising_complete);
4460 if (err < 0)
4461 mgmt_pending_remove(cmd);
4462
4463unlock:
4464 hci_dev_unlock(hdev);
4465 return err;
4466}
4467
d13eafce
MH		 4468static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4469 void *data, u16 len)
4470{
4471 struct mgmt_cp_set_static_address *cp = data;
4472 int err;
4473
4474 BT_DBG("%s", hdev->name);
4475
62af4443 4476 if (!lmp_le_capable(hdev))
d13eafce 4477 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
62af4443 4478 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4479
4480 if (hdev_is_powered(hdev))
4481 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4482 MGMT_STATUS_REJECTED);
4483
4484 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4485 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4486 return cmd_status(sk, hdev->id,
4487 MGMT_OP_SET_STATIC_ADDRESS,
4488 MGMT_STATUS_INVALID_PARAMS);
4489
4490 /* Two most significant bits shall be set */
4491 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4492 return cmd_status(sk, hdev->id,
4493 MGMT_OP_SET_STATIC_ADDRESS,
4494 MGMT_STATUS_INVALID_PARAMS);
4495 }
4496
4497 hci_dev_lock(hdev);
4498
4499 bacpy(&hdev->static_addr, &cp->bdaddr);
4500
4501 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4502
4503 hci_dev_unlock(hdev);
4504
4505 return err;
4506}
4507
14b49b9a
MH		 4508static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4509 void *data, u16 len)
4510{
4511 struct mgmt_cp_set_scan_params *cp = data;
4512 __u16 interval, window;
4513 int err;
4514
4515 BT_DBG("%s", hdev->name);
4516
4517 if (!lmp_le_capable(hdev))
4518 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4519 MGMT_STATUS_NOT_SUPPORTED);
4520
4521 interval = __le16_to_cpu(cp->interval);
4522
4523 if (interval < 0x0004 || interval > 0x4000)
4524 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4525 MGMT_STATUS_INVALID_PARAMS);
4526
4527 window = __le16_to_cpu(cp->window);
4528
4529 if (window < 0x0004 || window > 0x4000)
4530 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4531 MGMT_STATUS_INVALID_PARAMS);
4532
899e1075
MH		 4533 if (window > interval)
4534 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4535 MGMT_STATUS_INVALID_PARAMS);
4536
14b49b9a
MH		 4537 hci_dev_lock(hdev);
4538
4539 hdev->le_scan_interval = interval;
4540 hdev->le_scan_window = window;
4541
4542 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4543
dd2ef8e2
AG		 4544 /* If background scan is running, restart it so new parameters are
4545 * loaded.
4546 */
4547 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4548 hdev->discovery.state == DISCOVERY_STOPPED) {
4549 struct hci_request req;
4550
4551 hci_req_init(&req, hdev);
4552
4553 hci_req_add_le_scan_disable(&req);
4554 hci_req_add_le_passive_scan(&req);
4555
4556 hci_req_run(&req, NULL);
4557 }
4558
14b49b9a
MH		 4559 hci_dev_unlock(hdev);
4560
4561 return err;
4562}
4563
1904a853
MH		 4564static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4565 u16 opcode)
33e38b3e
JH		 4566{
4567 struct pending_cmd *cmd;
4568
4569 BT_DBG("status 0x%02x", status);
4570
4571 hci_dev_lock(hdev);
4572
4573 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4574 if (!cmd)
4575 goto unlock;
4576
4577 if (status) {
4578 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4579 mgmt_status(status));
4580 } else {
1a4d3c4b
JH		 4581 struct mgmt_mode *cp = cmd->param;
4582
4583 if (cp->val)
4584 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4585 else
4586 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4587
33e38b3e
JH		 4588 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4589 new_settings(hdev, cmd->sk);
4590 }
4591
4592 mgmt_pending_remove(cmd);
4593
4594unlock:
4595 hci_dev_unlock(hdev);
4596}
4597
bdb6d971 4598static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 4599 void *data, u16 len)
f6422ec6 4600{
650f726d 4601 struct mgmt_mode *cp = data;
33e38b3e
JH		 4602 struct pending_cmd *cmd;
4603 struct hci_request req;
f6422ec6
AJ		 4604 int err;
4605
bdb6d971 4606 BT_DBG("%s", hdev->name);
f6422ec6 4607
56f87901
JH		 4608 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4609 hdev->hci_ver < BLUETOOTH_VER_1_2)
33c525c0
JH		 4610 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4611 MGMT_STATUS_NOT_SUPPORTED);
4612
a7e80f25
JH		 4613 if (cp->val != 0x00 && cp->val != 0x01)
4614 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4615 MGMT_STATUS_INVALID_PARAMS);
4616
5400c044 4617 if (!hdev_is_powered(hdev))
bdb6d971 4618 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4619 MGMT_STATUS_NOT_POWERED);
5400c044
JH		 4620
4621 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
bdb6d971 4622 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4623 MGMT_STATUS_REJECTED);
f6422ec6
AJ		 4624
4625 hci_dev_lock(hdev);
4626
05cbf29f
JH		 4627 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4628 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4629 MGMT_STATUS_BUSY);
4630 goto unlock;
4631 }
4632
1a4d3c4b
JH		 4633 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4634 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4635 hdev);
4636 goto unlock;
4637 }
4638
33e38b3e
JH		 4639 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4640 data, len);
4641 if (!cmd) {
4642 err = -ENOMEM;
4643 goto unlock;
f6422ec6
AJ		 4644 }
4645
33e38b3e
JH		 4646 hci_req_init(&req, hdev);
4647
406d7804 4648 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 4649
4650 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 4651 if (err < 0) {
bdb6d971 4652 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4653 MGMT_STATUS_FAILED);
33e38b3e 4654 mgmt_pending_remove(cmd);
f6422ec6
AJ		 4655 }
4656
33e38b3e 4657unlock:
f6422ec6 4658 hci_dev_unlock(hdev);
33e38b3e 4659
f6422ec6
AJ		 4660 return err;
4661}
4662
1904a853 4663static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a
JH		 4664{
4665 struct pending_cmd *cmd;
4666
4667 BT_DBG("status 0x%02x", status);
4668
4669 hci_dev_lock(hdev);
4670
4671 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4672 if (!cmd)
4673 goto unlock;
4674
4675 if (status) {
4676 u8 mgmt_err = mgmt_status(status);
4677
4678 /* We need to restore the flag if related HCI commands
4679 * failed.
4680 */
4681 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4682
4683 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4684 } else {
4685 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4686 new_settings(hdev, cmd->sk);
4687 }
4688
4689 mgmt_pending_remove(cmd);
4690
4691unlock:
4692 hci_dev_unlock(hdev);
4693}
4694
4695static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4696{
4697 struct mgmt_mode *cp = data;
4698 struct pending_cmd *cmd;
4699 struct hci_request req;
4700 int err;
4701
4702 BT_DBG("request for %s", hdev->name);
4703
4704 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4705 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4706 MGMT_STATUS_NOT_SUPPORTED);
4707
4708 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4709 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4710 MGMT_STATUS_REJECTED);
4711
4712 if (cp->val != 0x00 && cp->val != 0x01)
4713 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4714 MGMT_STATUS_INVALID_PARAMS);
4715
4716 hci_dev_lock(hdev);
4717
4718 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4719 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4720 goto unlock;
4721 }
4722
4723 if (!hdev_is_powered(hdev)) {
4724 if (!cp->val) {
0663ca2a
JH		 4725 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4726 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4727 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4728 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4729 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4730 }
4731
4732 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4733
4734 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4735 if (err < 0)
4736 goto unlock;
4737
4738 err = new_settings(hdev, sk);
4739 goto unlock;
4740 }
4741
4742 /* Reject disabling when powered on */
4743 if (!cp->val) {
4744 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4745 MGMT_STATUS_REJECTED);
4746 goto unlock;
111e4bcc
MH		 4747 } else {
4748 /* When configuring a dual-mode controller to operate
4749 * with LE only and using a static address, then switching
4750 * BR/EDR back on is not allowed.
4751 *
4752 * Dual-mode controllers shall operate with the public
4753 * address as its identity address for BR/EDR and LE. So
4754 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 4755 *
4756 * The same restrictions applies when secure connections
4757 * has been enabled. For BR/EDR this is a controller feature
4758 * while for LE it is a host stack feature. This means that
4759 * switching BR/EDR back on when secure connections has been
4760 * enabled is not a supported transaction.
111e4bcc
MH		 4761 */
4762 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
3a5486e1
MH		 4763 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4764 test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
111e4bcc
MH		 4765 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4766 MGMT_STATUS_REJECTED);
4767 goto unlock;
4768 }
0663ca2a
JH		 4769 }
4770
4771 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4772 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4773 MGMT_STATUS_BUSY);
4774 goto unlock;
4775 }
4776
4777 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4778 if (!cmd) {
4779 err = -ENOMEM;
4780 goto unlock;
4781 }
4782
5947f4bc 4783 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 4784 * generates the correct flags.
4785 */
4786 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4787
4788 hci_req_init(&req, hdev);
aa8af46e 4789
432df05e 4790 write_fast_connectable(&req, false);
1d2dc5b7 4791 __hci_update_page_scan(&req);
aa8af46e 4792
f14d8f64
MH		 4793 /* Since only the advertising data flags will change, there
4794 * is no need to update the scan response data.
4795 */
5947f4bc 4796 update_adv_data(&req);
aa8af46e 4797
0663ca2a
JH		 4798 err = hci_req_run(&req, set_bredr_complete);
4799 if (err < 0)
4800 mgmt_pending_remove(cmd);
4801
4802unlock:
4803 hci_dev_unlock(hdev);
4804 return err;
4805}
4806
a1443f5a
JH		 4807static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4808{
4809 struct pending_cmd *cmd;
4810 struct mgmt_mode *cp;
4811
4812 BT_DBG("%s status %u", hdev->name, status);
4813
4814 hci_dev_lock(hdev);
4815
4816 cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4817 if (!cmd)
4818 goto unlock;
4819
4820 if (status) {
4821 cmd_status(cmd->sk, cmd->index, cmd->opcode,
4822 mgmt_status(status));
4823 goto remove;
4824 }
4825
4826 cp = cmd->param;
4827
4828 switch (cp->val) {
4829 case 0x00:
4830 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4831 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4832 break;
4833 case 0x01:
4834 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4835 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4836 break;
4837 case 0x02:
4838 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4839 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4840 break;
4841 }
4842
4843 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4844 new_settings(hdev, cmd->sk);
4845
4846remove:
4847 mgmt_pending_remove(cmd);
4848unlock:
4849 hci_dev_unlock(hdev);
4850}
4851
eac83dc6
MH		 4852static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4853 void *data, u16 len)
4854{
4855 struct mgmt_mode *cp = data;
4856 struct pending_cmd *cmd;
a1443f5a 4857 struct hci_request req;
a3209694 4858 u8 val;
eac83dc6
MH		 4859 int err;
4860
4861 BT_DBG("request for %s", hdev->name);
4862
05b3c3e7
MH		 4863 if (!lmp_sc_capable(hdev) &&
4864 !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
eac83dc6
MH		 4865 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4866 MGMT_STATUS_NOT_SUPPORTED);
4867
ed93ec69 4868 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
59200286 4869 lmp_sc_capable(hdev) &&
ed93ec69
MH		 4870 !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4871 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4872 MGMT_STATUS_REJECTED);
4873
0ab04a9c 4874 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
eac83dc6
MH		 4875 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4876 MGMT_STATUS_INVALID_PARAMS);
4877
4878 hci_dev_lock(hdev);
4879
05b3c3e7 4880 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
a3209694 4881 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
eac83dc6
MH		 4882 bool changed;
4883
0ab04a9c 4884 if (cp->val) {
eac83dc6
MH		 4885 changed = !test_and_set_bit(HCI_SC_ENABLED,
4886 &hdev->dev_flags);
0ab04a9c
MH		 4887 if (cp->val == 0x02)
4888 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4889 else
4890 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4891 } else {
eac83dc6
MH		 4892 changed = test_and_clear_bit(HCI_SC_ENABLED,
4893 &hdev->dev_flags);
0ab04a9c
MH		 4894 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4895 }
eac83dc6
MH		 4896
4897 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4898 if (err < 0)
4899 goto failed;
4900
4901 if (changed)
4902 err = new_settings(hdev, sk);
4903
4904 goto failed;
4905 }
4906
4907 if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4908 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4909 MGMT_STATUS_BUSY);
4910 goto failed;
4911 }
4912
0ab04a9c
MH		 4913 val = !!cp->val;
4914
4915 if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4916 (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
eac83dc6
MH		 4917 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4918 goto failed;
4919 }
4920
4921 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4922 if (!cmd) {
4923 err = -ENOMEM;
4924 goto failed;
4925 }
4926
a1443f5a
JH		 4927 hci_req_init(&req, hdev);
4928 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4929 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 4930 if (err < 0) {
4931 mgmt_pending_remove(cmd);
4932 goto failed;
4933 }
4934
4935failed:
4936 hci_dev_unlock(hdev);
4937 return err;
4938}
4939
4e39ac81
MH		 4940static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4941 void *data, u16 len)
4942{
4943 struct mgmt_mode *cp = data;
b9710979 4944 bool changed, use_changed;
4e39ac81
MH		 4945 int err;
4946
4947 BT_DBG("request for %s", hdev->name);
4948
b9710979 4949 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4e39ac81
MH		 4950 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4951 MGMT_STATUS_INVALID_PARAMS);
4952
4953 hci_dev_lock(hdev);
4954
4955 if (cp->val)
0663b297
JH		 4956 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4957 &hdev->dev_flags);
4e39ac81 4958 else
0663b297
JH		 4959 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4960 &hdev->dev_flags);
4e39ac81 4961
b9710979
JH		 4962 if (cp->val == 0x02)
4963 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4964 &hdev->dev_flags);
4965 else
4966 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4967 &hdev->dev_flags);
4968
4969 if (hdev_is_powered(hdev) && use_changed &&
4970 test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4971 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4972 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4973 sizeof(mode), &mode);
4974 }
4975
4e39ac81
MH		 4976 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4977 if (err < 0)
4978 goto unlock;
4979
4980 if (changed)
4981 err = new_settings(hdev, sk);
4982
4983unlock:
4984 hci_dev_unlock(hdev);
4985 return err;
4986}
4987
62b04cd1
JH		 4988static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4989 u16 len)
4990{
4991 struct mgmt_cp_set_privacy *cp = cp_data;
4992 bool changed;
4993 int err;
4994
4995 BT_DBG("request for %s", hdev->name);
4996
4997 if (!lmp_le_capable(hdev))
4998 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4999 MGMT_STATUS_NOT_SUPPORTED);
5000
5001 if (cp->privacy != 0x00 && cp->privacy != 0x01)
5002 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5003 MGMT_STATUS_INVALID_PARAMS);
5004
5005 if (hdev_is_powered(hdev))
5006 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5007 MGMT_STATUS_REJECTED);
5008
5009 hci_dev_lock(hdev);
5010
c21c0ea0
JH		 5011 /* If user space supports this command it is also expected to
5012 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5013 */
5014 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5015
62b04cd1
JH		 5016 if (cp->privacy) {
5017 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
5018 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5019 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5020 } else {
5021 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
5022 memset(hdev->irk, 0, sizeof(hdev->irk));
5023 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5024 }
5025
5026 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5027 if (err < 0)
5028 goto unlock;
5029
5030 if (changed)
5031 err = new_settings(hdev, sk);
5032
5033unlock:
5034 hci_dev_unlock(hdev);
5035 return err;
5036}
5037
41edf160
JH		 5038static bool irk_is_valid(struct mgmt_irk_info *irk)
5039{
5040 switch (irk->addr.type) {
5041 case BDADDR_LE_PUBLIC:
5042 return true;
5043
5044 case BDADDR_LE_RANDOM:
5045 /* Two most significant bits shall be set */
5046 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5047 return false;
5048 return true;
5049 }
5050
5051 return false;
5052}
5053
5054static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5055 u16 len)
5056{
5057 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5058 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5059 sizeof(struct mgmt_irk_info));
41edf160
JH		 5060 u16 irk_count, expected_len;
5061 int i, err;
5062
5063 BT_DBG("request for %s", hdev->name);
5064
5065 if (!lmp_le_capable(hdev))
5066 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5067 MGMT_STATUS_NOT_SUPPORTED);
5068
5069 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5070 if (irk_count > max_irk_count) {
5071 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5072 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5073 MGMT_STATUS_INVALID_PARAMS);
5074 }
41edf160
JH		 5075
5076 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5077 if (expected_len != len) {
5078 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5079 expected_len, len);
41edf160
JH		 5080 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5081 MGMT_STATUS_INVALID_PARAMS);
5082 }
5083
5084 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5085
5086 for (i = 0; i < irk_count; i++) {
5087 struct mgmt_irk_info *key = &cp->irks[i];
5088
5089 if (!irk_is_valid(key))
5090 return cmd_status(sk, hdev->id,
5091 MGMT_OP_LOAD_IRKS,
5092 MGMT_STATUS_INVALID_PARAMS);
5093 }
5094
5095 hci_dev_lock(hdev);
5096
5097 hci_smp_irks_clear(hdev);
5098
5099 for (i = 0; i < irk_count; i++) {
5100 struct mgmt_irk_info *irk = &cp->irks[i];
5101 u8 addr_type;
5102
5103 if (irk->addr.type == BDADDR_LE_PUBLIC)
5104 addr_type = ADDR_LE_DEV_PUBLIC;
5105 else
5106 addr_type = ADDR_LE_DEV_RANDOM;
5107
5108 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5109 BDADDR_ANY);
5110 }
5111
5112 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5113
5114 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5115
5116 hci_dev_unlock(hdev);
5117
5118 return err;
5119}
5120
3f706b72
JH		 5121static bool ltk_is_valid(struct mgmt_ltk_info *key)
5122{
5123 if (key->master != 0x00 && key->master != 0x01)
5124 return false;
490cb0b3
MH		 5125
5126 switch (key->addr.type) {
5127 case BDADDR_LE_PUBLIC:
5128 return true;
5129
5130 case BDADDR_LE_RANDOM:
5131 /* Two most significant bits shall be set */
5132 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5133 return false;
5134 return true;
5135 }
5136
5137 return false;
3f706b72
JH		 5138}
5139
bdb6d971 5140static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5141 void *cp_data, u16 len)
346af67b 5142{
346af67b 5143 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5144 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5145 sizeof(struct mgmt_ltk_info));
346af67b 5146 u16 key_count, expected_len;
715a5bf2 5147 int i, err;
346af67b 5148
cf99ba13
MH		 5149 BT_DBG("request for %s", hdev->name);
5150
5151 if (!lmp_le_capable(hdev))
5152 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5153 MGMT_STATUS_NOT_SUPPORTED);
5154
1f350c87 5155 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5156 if (key_count > max_key_count) {
5157 BT_ERR("load_ltks: too big key_count value %u", key_count);
5158 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5159 MGMT_STATUS_INVALID_PARAMS);
5160 }
346af67b
VCG		 5161
5162 expected_len = sizeof(*cp) + key_count *
5163 sizeof(struct mgmt_ltk_info);
5164 if (expected_len != len) {
5165 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5166 expected_len, len);
bdb6d971 5167 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
e57e619f 5168 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5169 }
5170
bdb6d971 5171 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5172
54ad6d8a
JH		 5173 for (i = 0; i < key_count; i++) {
5174 struct mgmt_ltk_info *key = &cp->keys[i];
5175
3f706b72 5176 if (!ltk_is_valid(key))
54ad6d8a
JH		 5177 return cmd_status(sk, hdev->id,
5178 MGMT_OP_LOAD_LONG_TERM_KEYS,
5179 MGMT_STATUS_INVALID_PARAMS);
5180 }
5181
346af67b
VCG		 5182 hci_dev_lock(hdev);
5183
5184 hci_smp_ltks_clear(hdev);
5185
5186 for (i = 0; i < key_count; i++) {
5187 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5188 u8 type, addr_type, authenticated;
79d95a19
MH		 5189
5190 if (key->addr.type == BDADDR_LE_PUBLIC)
5191 addr_type = ADDR_LE_DEV_PUBLIC;
5192 else
5193 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5194
61b43357
JH		 5195 switch (key->type) {
5196 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5197 authenticated = 0x00;
23fb8de3 5198 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5199 break;
5200 case MGMT_LTK_AUTHENTICATED:
d7b25450 5201 authenticated = 0x01;
23fb8de3
JH		 5202 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5203 break;
5204 case MGMT_LTK_P256_UNAUTH:
5205 authenticated = 0x00;
5206 type = SMP_LTK_P256;
61b43357 5207 break;
23fb8de3
JH		 5208 case MGMT_LTK_P256_AUTH:
5209 authenticated = 0x01;
5210 type = SMP_LTK_P256;
61b43357 5211 break;
23fb8de3
JH		 5212 case MGMT_LTK_P256_DEBUG:
5213 authenticated = 0x00;
5214 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5215 default:
5216 continue;
5217 }
d7b25450 5218
35d70271 5219 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5220 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5221 key->rand);
346af67b
VCG		 5222 }
5223
715a5bf2
JH		 5224 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5225 NULL, 0);
5226
346af67b 5227 hci_dev_unlock(hdev);
346af67b 5228
715a5bf2 5229 return err;
346af67b
VCG		 5230}
5231
9df74653 5232static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
dd983808 5233{
dd983808 5234 struct hci_conn *conn = cmd->user_data;
9981bdb0 5235 struct mgmt_rp_get_conn_info rp;
9df74653 5236 int err;
dd983808 5237
9981bdb0 5238 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5239
9981bdb0 5240 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5241 rp.rssi = conn->rssi;
9981bdb0
JH		 5242 rp.tx_power = conn->tx_power;
5243 rp.max_tx_power = conn->max_tx_power;
5244 } else {
5245 rp.rssi = HCI_RSSI_INVALID;
5246 rp.tx_power = HCI_TX_POWER_INVALID;
5247 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5248 }
5249
9df74653
JH		 5250 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5251 &rp, sizeof(rp));
dd983808
AK		 5252
5253 hci_conn_drop(conn);
f8aaf9b6 5254 hci_conn_put(conn);
9df74653
JH		 5255
5256 return err;
dd983808
AK		 5257}
5258
1904a853
MH		 5259static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5260 u16 opcode)
dd983808
AK		 5261{
5262 struct hci_cp_read_rssi *cp;
9981bdb0 5263 struct pending_cmd *cmd;
dd983808 5264 struct hci_conn *conn;
dd983808 5265 u16 handle;
9981bdb0 5266 u8 status;
dd983808 5267
9981bdb0 5268 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5269
5270 hci_dev_lock(hdev);
5271
dd983808
AK		 5272 /* Commands sent in request are either Read RSSI or Read Transmit Power
5273 * Level so we check which one was last sent to retrieve connection
5274 * handle. Both commands have handle as first parameter so it's safe to
5275 * cast data on the same command struct.
5276 *
5277 * First command sent is always Read RSSI and we fail only if it fails.
5278 * In other case we simply override error to indicate success as we
5279 * already remembered if TX power value is actually valid.
5280 */
5281 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5282 if (!cp) {
5283 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5284 status = MGMT_STATUS_SUCCESS;
5285 } else {
5286 status = mgmt_status(hci_status);
dd983808
AK		 5287 }
5288
5289 if (!cp) {
9981bdb0 5290 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5291 goto unlock;
5292 }
5293
5294 handle = __le16_to_cpu(cp->handle);
5295 conn = hci_conn_hash_lookup_handle(hdev, handle);
5296 if (!conn) {
9981bdb0 5297 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5298 goto unlock;
5299 }
5300
9981bdb0
JH		 5301 cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5302 if (!cmd)
5303 goto unlock;
dd983808 5304
9981bdb0
JH		 5305 cmd->cmd_complete(cmd, status);
5306 mgmt_pending_remove(cmd);
dd983808
AK		 5307
5308unlock:
5309 hci_dev_unlock(hdev);
5310}
5311
5312static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5313 u16 len)
5314{
5315 struct mgmt_cp_get_conn_info *cp = data;
5316 struct mgmt_rp_get_conn_info rp;
5317 struct hci_conn *conn;
5318 unsigned long conn_info_age;
5319 int err = 0;
5320
5321 BT_DBG("%s", hdev->name);
5322
5323 memset(&rp, 0, sizeof(rp));
5324 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5325 rp.addr.type = cp->addr.type;
5326
5327 if (!bdaddr_type_is_valid(cp->addr.type))
5328 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5329 MGMT_STATUS_INVALID_PARAMS,
5330 &rp, sizeof(rp));
5331
5332 hci_dev_lock(hdev);
5333
5334 if (!hdev_is_powered(hdev)) {
5335 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5336 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5337 goto unlock;
5338 }
5339
5340 if (cp->addr.type == BDADDR_BREDR)
5341 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5342 &cp->addr.bdaddr);
5343 else
5344 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5345
5346 if (!conn || conn->state != BT_CONNECTED) {
5347 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5348 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5349 goto unlock;
5350 }
5351
9981bdb0
JH		 5352 if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5353 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5354 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5355 goto unlock;
5356 }
5357
dd983808
AK		 5358 /* To avoid client trying to guess when to poll again for information we
5359 * calculate conn info age as random value between min/max set in hdev.
5360 */
5361 conn_info_age = hdev->conn_info_min_age +
5362 prandom_u32_max(hdev->conn_info_max_age -
5363 hdev->conn_info_min_age);
5364
5365 /* Query controller to refresh cached values if they are too old or were
5366 * never read.
5367 */
f4e2dd53
AK		 5368 if (time_after(jiffies, conn->conn_info_timestamp +
5369 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5370 !conn->conn_info_timestamp) {
5371 struct hci_request req;
5372 struct hci_cp_read_tx_power req_txp_cp;
5373 struct hci_cp_read_rssi req_rssi_cp;
5374 struct pending_cmd *cmd;
5375
5376 hci_req_init(&req, hdev);
5377 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5378 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5379 &req_rssi_cp);
5380
f7faab0c
AK		 5381 /* For LE links TX power does not change thus we don't need to
5382 * query for it once value is known.
5383 */
5384 if (!bdaddr_type_is_le(cp->addr.type) ||
5385 conn->tx_power == HCI_TX_POWER_INVALID) {
5386 req_txp_cp.handle = cpu_to_le16(conn->handle);
5387 req_txp_cp.type = 0x00;
5388 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5389 sizeof(req_txp_cp), &req_txp_cp);
5390 }
dd983808 5391
eed5daf3
AK		 5392 /* Max TX power needs to be read only once per connection */
5393 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5394 req_txp_cp.handle = cpu_to_le16(conn->handle);
5395 req_txp_cp.type = 0x01;
5396 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5397 sizeof(req_txp_cp), &req_txp_cp);
5398 }
5399
dd983808
AK		 5400 err = hci_req_run(&req, conn_info_refresh_complete);
5401 if (err < 0)
5402 goto unlock;
5403
5404 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5405 data, len);
5406 if (!cmd) {
5407 err = -ENOMEM;
5408 goto unlock;
5409 }
5410
5411 hci_conn_hold(conn);
f8aaf9b6 5412 cmd->user_data = hci_conn_get(conn);
9981bdb0 5413 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5414
5415 conn->conn_info_timestamp = jiffies;
5416 } else {
5417 /* Cache is valid, just reply with values cached in hci_conn */
5418 rp.rssi = conn->rssi;
5419 rp.tx_power = conn->tx_power;
eed5daf3 5420 rp.max_tx_power = conn->max_tx_power;
dd983808
AK		 5421
5422 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5423 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5424 }
5425
5426unlock:
5427 hci_dev_unlock(hdev);
5428 return err;
5429}
5430
9df74653 5431static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
95868426 5432{
69487371 5433 struct hci_conn *conn = cmd->user_data;
95868426 5434 struct mgmt_rp_get_clock_info rp;
69487371 5435 struct hci_dev *hdev;
9df74653 5436 int err;
69487371
JH		 5437
5438 memset(&rp, 0, sizeof(rp));
5439 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5440
5441 if (status)
5442 goto complete;
5443
5444 hdev = hci_dev_get(cmd->index);
5445 if (hdev) {
5446 rp.local_clock = cpu_to_le32(hdev->clock);
5447 hci_dev_put(hdev);
5448 }
5449
5450 if (conn) {
5451 rp.piconet_clock = cpu_to_le32(conn->clock);
5452 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5453 }
5454
5455complete:
9df74653
JH		 5456 err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5457 sizeof(rp));
69487371
JH		 5458
5459 if (conn) {
5460 hci_conn_drop(conn);
5461 hci_conn_put(conn);
5462 }
9df74653
JH		 5463
5464 return err;
69487371
JH		 5465}
5466
1904a853 5467static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5468{
95868426
JH		 5469 struct hci_cp_read_clock *hci_cp;
5470 struct pending_cmd *cmd;
5471 struct hci_conn *conn;
5472
5473 BT_DBG("%s status %u", hdev->name, status);
5474
5475 hci_dev_lock(hdev);
5476
5477 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5478 if (!hci_cp)
5479 goto unlock;
5480
5481 if (hci_cp->which) {
5482 u16 handle = __le16_to_cpu(hci_cp->handle);
5483 conn = hci_conn_hash_lookup_handle(hdev, handle);
5484 } else {
5485 conn = NULL;
5486 }
5487
5488 cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5489 if (!cmd)
5490 goto unlock;
5491
69487371 5492 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5493 mgmt_pending_remove(cmd);
95868426
JH		 5494
5495unlock:
5496 hci_dev_unlock(hdev);
5497}
5498
5499static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5500 u16 len)
5501{
5502 struct mgmt_cp_get_clock_info *cp = data;
5503 struct mgmt_rp_get_clock_info rp;
5504 struct hci_cp_read_clock hci_cp;
5505 struct pending_cmd *cmd;
5506 struct hci_request req;
5507 struct hci_conn *conn;
5508 int err;
5509
5510 BT_DBG("%s", hdev->name);
5511
5512 memset(&rp, 0, sizeof(rp));
5513 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5514 rp.addr.type = cp->addr.type;
5515
5516 if (cp->addr.type != BDADDR_BREDR)
5517 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5518 MGMT_STATUS_INVALID_PARAMS,
5519 &rp, sizeof(rp));
5520
5521 hci_dev_lock(hdev);
5522
5523 if (!hdev_is_powered(hdev)) {
5524 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5525 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5526 goto unlock;
5527 }
5528
5529 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5530 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5531 &cp->addr.bdaddr);
5532 if (!conn || conn->state != BT_CONNECTED) {
5533 err = cmd_complete(sk, hdev->id,
5534 MGMT_OP_GET_CLOCK_INFO,
5535 MGMT_STATUS_NOT_CONNECTED,
5536 &rp, sizeof(rp));
5537 goto unlock;
5538 }
5539 } else {
5540 conn = NULL;
5541 }
5542
5543 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5544 if (!cmd) {
5545 err = -ENOMEM;
5546 goto unlock;
5547 }
5548
69487371
JH		 5549 cmd->cmd_complete = clock_info_cmd_complete;
5550
95868426
JH		 5551 hci_req_init(&req, hdev);
5552
5553 memset(&hci_cp, 0, sizeof(hci_cp));
5554 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5555
5556 if (conn) {
5557 hci_conn_hold(conn);
f8aaf9b6 5558 cmd->user_data = hci_conn_get(conn);
95868426
JH		 5559
5560 hci_cp.handle = cpu_to_le16(conn->handle);
5561 hci_cp.which = 0x01; /* Piconet clock */
5562 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5563 }
5564
5565 err = hci_req_run(&req, get_clock_info_complete);
5566 if (err < 0)
5567 mgmt_pending_remove(cmd);
5568
5569unlock:
5570 hci_dev_unlock(hdev);
5571 return err;
5572}
5573
5a154e6f
JH		 5574static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5575{
5576 struct hci_conn *conn;
5577
5578 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5579 if (!conn)
5580 return false;
5581
5582 if (conn->dst_type != type)
5583 return false;
5584
5585 if (conn->state != BT_CONNECTED)
5586 return false;
5587
5588 return true;
5589}
5590
5591/* This function requires the caller holds hdev->lock */
5592static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5593 u8 addr_type, u8 auto_connect)
5594{
5595 struct hci_dev *hdev = req->hdev;
5596 struct hci_conn_params *params;
5597
5598 params = hci_conn_params_add(hdev, addr, addr_type);
5599 if (!params)
5600 return -EIO;
5601
5602 if (params->auto_connect == auto_connect)
5603 return 0;
5604
5605 list_del_init(&params->action);
5606
5607 switch (auto_connect) {
5608 case HCI_AUTO_CONN_DISABLED:
5609 case HCI_AUTO_CONN_LINK_LOSS:
5610 __hci_update_background_scan(req);
5611 break;
5612 case HCI_AUTO_CONN_REPORT:
5613 list_add(&params->action, &hdev->pend_le_reports);
5614 __hci_update_background_scan(req);
5615 break;
5616 case HCI_AUTO_CONN_DIRECT:
5617 case HCI_AUTO_CONN_ALWAYS:
5618 if (!is_connected(hdev, addr, addr_type)) {
5619 list_add(&params->action, &hdev->pend_le_conns);
5620 __hci_update_background_scan(req);
5621 }
5622 break;
5623 }
5624
5625 params->auto_connect = auto_connect;
5626
5627 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5628 auto_connect);
5629
5630 return 0;
5631}
5632
8afef092
MH		 5633static void device_added(struct sock *sk, struct hci_dev *hdev,
5634 bdaddr_t *bdaddr, u8 type, u8 action)
5635{
5636 struct mgmt_ev_device_added ev;
5637
5638 bacpy(&ev.addr.bdaddr, bdaddr);
5639 ev.addr.type = type;
5640 ev.action = action;
5641
5642 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5643}
5644
1904a853 5645static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f
JH		 5646{
5647 struct pending_cmd *cmd;
5648
5649 BT_DBG("status 0x%02x", status);
5650
5651 hci_dev_lock(hdev);
5652
5653 cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5654 if (!cmd)
5655 goto unlock;
5656
5657 cmd->cmd_complete(cmd, mgmt_status(status));
5658 mgmt_pending_remove(cmd);
5659
5660unlock:
5661 hci_dev_unlock(hdev);
5662}
5663
2faade53
MH		 5664static int add_device(struct sock *sk, struct hci_dev *hdev,
5665 void *data, u16 len)
5666{
5667 struct mgmt_cp_add_device *cp = data;
5a154e6f
JH		 5668 struct pending_cmd *cmd;
5669 struct hci_request req;
2faade53
MH		 5670 u8 auto_conn, addr_type;
5671 int err;
5672
5673 BT_DBG("%s", hdev->name);
5674
6659358e 5675 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53
MH		 5676 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5677 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5678 MGMT_STATUS_INVALID_PARAMS,
5679 &cp->addr, sizeof(cp->addr));
5680
4b9e7e75 5681 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2faade53
MH		 5682 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5683 MGMT_STATUS_INVALID_PARAMS,
5684 &cp->addr, sizeof(cp->addr));
5685
5a154e6f
JH		 5686 hci_req_init(&req, hdev);
5687
2faade53
MH		 5688 hci_dev_lock(hdev);
5689
5a154e6f
JH		 5690 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5691 if (!cmd) {
5692 err = -ENOMEM;
5693 goto unlock;
5694 }
5695
5696 cmd->cmd_complete = addr_cmd_complete;
5697
6659358e 5698 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 5699 /* Only incoming connections action is supported for now */
6659358e 5700 if (cp->action != 0x01) {
9df74653
JH		 5701 err = cmd->cmd_complete(cmd,
5702 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 5703 mgmt_pending_remove(cmd);
6659358e
JH		 5704 goto unlock;
5705 }
5706
5707 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5708 cp->addr.type);
5709 if (err)
5710 goto unlock;
a397407f 5711
5a154e6f 5712 __hci_update_page_scan(&req);
a397407f 5713
6659358e
JH		 5714 goto added;
5715 }
5716
2faade53
MH		 5717 if (cp->addr.type == BDADDR_LE_PUBLIC)
5718 addr_type = ADDR_LE_DEV_PUBLIC;
5719 else
5720 addr_type = ADDR_LE_DEV_RANDOM;
5721
4b9e7e75 5722 if (cp->action == 0x02)
2faade53 5723 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 5724 else if (cp->action == 0x01)
5725 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 5726 else
a3451d27 5727 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 5728
bf5b3c8b
MH		 5729 /* If the connection parameters don't exist for this device,
5730 * they will be created and configured with defaults.
5731 */
5a154e6f 5732 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 5733 auto_conn) < 0) {
9df74653 5734 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 5735 mgmt_pending_remove(cmd);
2faade53
MH		 5736 goto unlock;
5737 }
5738
6659358e 5739added:
8afef092
MH		 5740 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5741
5a154e6f
JH		 5742 err = hci_req_run(&req, add_device_complete);
5743 if (err < 0) {
5744 /* ENODATA means no HCI commands were needed (e.g. if
5745 * the adapter is powered off).
5746 */
9df74653
JH		 5747 if (err == -ENODATA)
5748 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 5749 mgmt_pending_remove(cmd);
5750 }
2faade53
MH		 5751
5752unlock:
5753 hci_dev_unlock(hdev);
5754 return err;
5755}
5756
8afef092
MH		 5757static void device_removed(struct sock *sk, struct hci_dev *hdev,
5758 bdaddr_t *bdaddr, u8 type)
5759{
5760 struct mgmt_ev_device_removed ev;
5761
5762 bacpy(&ev.addr.bdaddr, bdaddr);
5763 ev.addr.type = type;
5764
5765 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5766}
5767
1904a853 5768static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe
JH		 5769{
5770 struct pending_cmd *cmd;
5771
5772 BT_DBG("status 0x%02x", status);
5773
5774 hci_dev_lock(hdev);
5775
5776 cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5777 if (!cmd)
5778 goto unlock;
5779
5780 cmd->cmd_complete(cmd, mgmt_status(status));
5781 mgmt_pending_remove(cmd);
5782
5783unlock:
5784 hci_dev_unlock(hdev);
5785}
5786
2faade53
MH		 5787static int remove_device(struct sock *sk, struct hci_dev *hdev,
5788 void *data, u16 len)
5789{
5790 struct mgmt_cp_remove_device *cp = data;
51ef3ebe
JH		 5791 struct pending_cmd *cmd;
5792 struct hci_request req;
2faade53
MH		 5793 int err;
5794
5795 BT_DBG("%s", hdev->name);
5796
51ef3ebe
JH		 5797 hci_req_init(&req, hdev);
5798
2faade53
MH		 5799 hci_dev_lock(hdev);
5800
51ef3ebe
JH		 5801 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5802 if (!cmd) {
5803 err = -ENOMEM;
5804 goto unlock;
5805 }
5806
5807 cmd->cmd_complete = addr_cmd_complete;
5808
2faade53 5809 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 5810 struct hci_conn_params *params;
2faade53
MH		 5811 u8 addr_type;
5812
6659358e 5813 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 5814 err = cmd->cmd_complete(cmd,
5815 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5816 mgmt_pending_remove(cmd);
2faade53
MH		 5817 goto unlock;
5818 }
5819
6659358e
JH		 5820 if (cp->addr.type == BDADDR_BREDR) {
5821 err = hci_bdaddr_list_del(&hdev->whitelist,
5822 &cp->addr.bdaddr,
5823 cp->addr.type);
5824 if (err) {
9df74653
JH		 5825 err = cmd->cmd_complete(cmd,
5826 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5827 mgmt_pending_remove(cmd);
6659358e
JH		 5828 goto unlock;
5829 }
5830
51ef3ebe 5831 __hci_update_page_scan(&req);
a397407f 5832
6659358e
JH		 5833 device_removed(sk, hdev, &cp->addr.bdaddr,
5834 cp->addr.type);
5835 goto complete;
5836 }
5837
2faade53
MH		 5838 if (cp->addr.type == BDADDR_LE_PUBLIC)
5839 addr_type = ADDR_LE_DEV_PUBLIC;
5840 else
5841 addr_type = ADDR_LE_DEV_RANDOM;
5842
c71593dd
JH		 5843 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5844 addr_type);
5845 if (!params) {
9df74653
JH		 5846 err = cmd->cmd_complete(cmd,
5847 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5848 mgmt_pending_remove(cmd);
c71593dd
JH		 5849 goto unlock;
5850 }
5851
5852 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 5853 err = cmd->cmd_complete(cmd,
5854 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5855 mgmt_pending_remove(cmd);
c71593dd
JH		 5856 goto unlock;
5857 }
5858
d1dbf12e 5859 list_del(&params->action);
c71593dd
JH		 5860 list_del(&params->list);
5861 kfree(params);
51ef3ebe 5862 __hci_update_background_scan(&req);
8afef092
MH		 5863
5864 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 5865 } else {
19de0825 5866 struct hci_conn_params *p, *tmp;
6659358e 5867 struct bdaddr_list *b, *btmp;
19de0825 5868
2faade53 5869 if (cp->addr.type) {
9df74653
JH		 5870 err = cmd->cmd_complete(cmd,
5871 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5872 mgmt_pending_remove(cmd);
2faade53
MH		 5873 goto unlock;
5874 }
5875
6659358e
JH		 5876 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5877 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5878 list_del(&b->list);
5879 kfree(b);
5880 }
5881
51ef3ebe 5882 __hci_update_page_scan(&req);
a397407f 5883
19de0825
JH		 5884 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5885 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5886 continue;
5887 device_removed(sk, hdev, &p->addr, p->addr_type);
5888 list_del(&p->action);
5889 list_del(&p->list);
5890 kfree(p);
5891 }
5892
5893 BT_DBG("All LE connection parameters were removed");
5894
51ef3ebe 5895 __hci_update_background_scan(&req);
2faade53
MH		 5896 }
5897
6659358e 5898complete:
51ef3ebe
JH		 5899 err = hci_req_run(&req, remove_device_complete);
5900 if (err < 0) {
5901 /* ENODATA means no HCI commands were needed (e.g. if
5902 * the adapter is powered off).
5903 */
9df74653
JH		 5904 if (err == -ENODATA)
5905 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 5906 mgmt_pending_remove(cmd);
5907 }
2faade53
MH		 5908
5909unlock:
5910 hci_dev_unlock(hdev);
5911 return err;
5912}
5913
a26f3dcf
JH		 5914static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5915 u16 len)
5916{
5917 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 5918 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5919 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 5920 u16 param_count, expected_len;
5921 int i;
5922
5923 if (!lmp_le_capable(hdev))
5924 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5925 MGMT_STATUS_NOT_SUPPORTED);
5926
5927 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 5928 if (param_count > max_param_count) {
5929 BT_ERR("load_conn_param: too big param_count value %u",
5930 param_count);
5931 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5932 MGMT_STATUS_INVALID_PARAMS);
5933 }
a26f3dcf
JH		 5934
5935 expected_len = sizeof(*cp) + param_count *
5936 sizeof(struct mgmt_conn_param);
5937 if (expected_len != len) {
5938 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5939 expected_len, len);
5940 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5941 MGMT_STATUS_INVALID_PARAMS);
5942 }
5943
5944 BT_DBG("%s param_count %u", hdev->name, param_count);
5945
5946 hci_dev_lock(hdev);
5947
5948 hci_conn_params_clear_disabled(hdev);
5949
5950 for (i = 0; i < param_count; i++) {
5951 struct mgmt_conn_param *param = &cp->params[i];
5952 struct hci_conn_params *hci_param;
5953 u16 min, max, latency, timeout;
5954 u8 addr_type;
5955
5956 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5957 param->addr.type);
5958
5959 if (param->addr.type == BDADDR_LE_PUBLIC) {
5960 addr_type = ADDR_LE_DEV_PUBLIC;
5961 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5962 addr_type = ADDR_LE_DEV_RANDOM;
5963 } else {
5964 BT_ERR("Ignoring invalid connection parameters");
5965 continue;
5966 }
5967
5968 min = le16_to_cpu(param->min_interval);
5969 max = le16_to_cpu(param->max_interval);
5970 latency = le16_to_cpu(param->latency);
5971 timeout = le16_to_cpu(param->timeout);
5972
5973 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5974 min, max, latency, timeout);
5975
5976 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5977 BT_ERR("Ignoring invalid connection parameters");
5978 continue;
5979 }
5980
5981 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5982 addr_type);
5983 if (!hci_param) {
5984 BT_ERR("Failed to add connection parameters");
5985 continue;
5986 }
5987
5988 hci_param->conn_min_interval = min;
5989 hci_param->conn_max_interval = max;
5990 hci_param->conn_latency = latency;
5991 hci_param->supervision_timeout = timeout;
5992 }
5993
5994 hci_dev_unlock(hdev);
5995
5996 return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5997}
5998
dbece37a
MH		 5999static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6000 void *data, u16 len)
6001{
6002 struct mgmt_cp_set_external_config *cp = data;
6003 bool changed;
6004 int err;
6005
6006 BT_DBG("%s", hdev->name);
6007
6008 if (hdev_is_powered(hdev))
6009 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6010 MGMT_STATUS_REJECTED);
6011
6012 if (cp->config != 0x00 && cp->config != 0x01)
6013 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6014 MGMT_STATUS_INVALID_PARAMS);
6015
6016 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6017 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6018 MGMT_STATUS_NOT_SUPPORTED);
6019
6020 hci_dev_lock(hdev);
6021
6022 if (cp->config)
6023 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
6024 &hdev->dev_flags);
6025 else
6026 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
6027 &hdev->dev_flags);
6028
6029 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6030 if (err < 0)
6031 goto unlock;
6032
6033 if (!changed)
6034 goto unlock;
6035
f4537c04
MH		 6036 err = new_options(hdev, sk);
6037
dbece37a
MH		 6038 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
6039 mgmt_index_removed(hdev);
d603b76b
MH		 6040
6041 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
6042 set_bit(HCI_CONFIG, &hdev->dev_flags);
6043 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6044
6045 queue_work(hdev->req_workqueue, &hdev->power_on);
6046 } else {
5ea234d3 6047 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6048 mgmt_index_added(hdev);
6049 }
dbece37a
MH		 6050 }
6051
6052unlock:
6053 hci_dev_unlock(hdev);
6054 return err;
6055}
6056
9713c17b
MH		 6057static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6058 void *data, u16 len)
6059{
6060 struct mgmt_cp_set_public_address *cp = data;
6061 bool changed;
6062 int err;
6063
6064 BT_DBG("%s", hdev->name);
6065
6066 if (hdev_is_powered(hdev))
6067 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6068 MGMT_STATUS_REJECTED);
6069
6070 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6071 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6072 MGMT_STATUS_INVALID_PARAMS);
6073
6074 if (!hdev->set_bdaddr)
6075 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6076 MGMT_STATUS_NOT_SUPPORTED);
6077
6078 hci_dev_lock(hdev);
6079
6080 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6081 bacpy(&hdev->public_addr, &cp->bdaddr);
6082
6083 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6084 if (err < 0)
6085 goto unlock;
6086
6087 if (!changed)
6088 goto unlock;
6089
6090 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6091 err = new_options(hdev, sk);
6092
6093 if (is_configured(hdev)) {
6094 mgmt_index_removed(hdev);
6095
6096 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
6097
6098 set_bit(HCI_CONFIG, &hdev->dev_flags);
6099 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6100
6101 queue_work(hdev->req_workqueue, &hdev->power_on);
6102 }
6103
6104unlock:
6105 hci_dev_unlock(hdev);
6106 return err;
6107}
6108
2e3c35ea 6109static const struct mgmt_handler {
04124681
GP		 6110 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
6111 u16 data_len);
be22b54e
JH		 6112 bool var_len;
6113 size_t data_len;
0f4e68cf
JH		 6114} mgmt_handlers[] = {
6115 { NULL }, /* 0x0000 (no command) */
be22b54e
JH		 6116 { read_version, false, MGMT_READ_VERSION_SIZE },
6117 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
6118 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
6119 { read_controller_info, false, MGMT_READ_INFO_SIZE },
6120 { set_powered, false, MGMT_SETTING_SIZE },
6121 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
6122 { set_connectable, false, MGMT_SETTING_SIZE },
6123 { set_fast_connectable, false, MGMT_SETTING_SIZE },
b2939475 6124 { set_bondable, false, MGMT_SETTING_SIZE },
be22b54e
JH		 6125 { set_link_security, false, MGMT_SETTING_SIZE },
6126 { set_ssp, false, MGMT_SETTING_SIZE },
6127 { set_hs, false, MGMT_SETTING_SIZE },
6128 { set_le, false, MGMT_SETTING_SIZE },
6129 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
6130 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
6131 { add_uuid, false, MGMT_ADD_UUID_SIZE },
6132 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
6133 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
6134 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
6135 { disconnect, false, MGMT_DISCONNECT_SIZE },
6136 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
6137 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
6138 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6139 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
6140 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
6141 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6142 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
6143 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
6144 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6145 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
6146 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6147 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
ec109113 6148 { add_remote_oob_data, true, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
be22b54e
JH		 6149 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6150 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
6151 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
6152 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
6153 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
6154 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
cdbaccca 6155 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
4375f103 6156 { set_advertising, false, MGMT_SETTING_SIZE },
0663ca2a 6157 { set_bredr, false, MGMT_SETTING_SIZE },
d13eafce 6158 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE },
14b49b9a 6159 { set_scan_params, false, MGMT_SET_SCAN_PARAMS_SIZE },
eac83dc6 6160 { set_secure_conn, false, MGMT_SETTING_SIZE },
4e39ac81 6161 { set_debug_keys, false, MGMT_SETTING_SIZE },
62b04cd1 6162 { set_privacy, false, MGMT_SET_PRIVACY_SIZE },
41edf160 6163 { load_irks, true, MGMT_LOAD_IRKS_SIZE },
dd983808 6164 { get_conn_info, false, MGMT_GET_CONN_INFO_SIZE },
95868426 6165 { get_clock_info, false, MGMT_GET_CLOCK_INFO_SIZE },
2faade53
MH		 6166 { add_device, false, MGMT_ADD_DEVICE_SIZE },
6167 { remove_device, false, MGMT_REMOVE_DEVICE_SIZE },
73d1df2a
MH		 6168 { load_conn_param, true, MGMT_LOAD_CONN_PARAM_SIZE },
6169 { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
9fc3bfb6 6170 { read_config_info, false, MGMT_READ_CONFIG_INFO_SIZE },
dbece37a 6171 { set_external_config, false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
9713c17b 6172 { set_public_address, false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
66ea9427 6173 { start_service_discovery,true, MGMT_START_SERVICE_DISCOVERY_SIZE },
0f4e68cf
JH		 6174};
6175
0381101f
JH		 6176int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
6177{
650f726d
VCG		 6178 void *buf;
6179 u8 *cp;
0381101f 6180 struct mgmt_hdr *hdr;
4e51eae9 6181 u16 opcode, index, len;
bdb6d971 6182 struct hci_dev *hdev = NULL;
2e3c35ea 6183 const struct mgmt_handler *handler;
0381101f
JH		 6184 int err;
6185
6186 BT_DBG("got %zu bytes", msglen);
6187
6188 if (msglen < sizeof(*hdr))
6189 return -EINVAL;
6190
e63a15ec 6191 buf = kmalloc(msglen, GFP_KERNEL);
0381101f
JH		 6192 if (!buf)
6193 return -ENOMEM;
6194
6ce8e9ce 6195 if (memcpy_from_msg(buf, msg, msglen)) {
0381101f
JH		 6196 err = -EFAULT;
6197 goto done;
6198 }
6199
650f726d 6200 hdr = buf;
1f350c87
MH		 6201 opcode = __le16_to_cpu(hdr->opcode);
6202 index = __le16_to_cpu(hdr->index);
6203 len = __le16_to_cpu(hdr->len);
0381101f
JH		 6204
6205 if (len != msglen - sizeof(*hdr)) {
6206 err = -EINVAL;
6207 goto done;
6208 }
6209
0f4e68cf 6210 if (index != MGMT_INDEX_NONE) {
bdb6d971
JH		 6211 hdev = hci_dev_get(index);
6212 if (!hdev) {
6213 err = cmd_status(sk, index, opcode,
04124681 6214 MGMT_STATUS_INVALID_INDEX);
bdb6d971
JH		 6215 goto done;
6216 }
0736cfa8 6217
cebf4cfd 6218 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
d603b76b 6219 test_bit(HCI_CONFIG, &hdev->dev_flags) ||
4a964404 6220 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
0736cfa8
MH		 6221 err = cmd_status(sk, index, opcode,
6222 MGMT_STATUS_INVALID_INDEX);
6223 goto done;
6224 }
42a9bc14
MH		 6225
6226 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
dbece37a 6227 opcode != MGMT_OP_READ_CONFIG_INFO &&
9713c17b
MH		 6228 opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
6229 opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
42a9bc14
MH		 6230 err = cmd_status(sk, index, opcode,
6231 MGMT_STATUS_INVALID_INDEX);
6232 goto done;
6233 }
bdb6d971
JH		 6234 }
6235
0f4e68cf 6236 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
8ce8e2b5 6237 mgmt_handlers[opcode].func == NULL) {
0381101f 6238 BT_DBG("Unknown op %u", opcode);
ca69b795 6239 err = cmd_status(sk, index, opcode,
04124681 6240 MGMT_STATUS_UNKNOWN_COMMAND);
0f4e68cf
JH		 6241 goto done;
6242 }
6243
73d1df2a
MH		 6244 if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
6245 opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6246 err = cmd_status(sk, index, opcode,
6247 MGMT_STATUS_INVALID_INDEX);
6248 goto done;
6249 }
6250
6251 if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
6252 opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
0f4e68cf 6253 err = cmd_status(sk, index, opcode,
04124681 6254 MGMT_STATUS_INVALID_INDEX);
0f4e68cf 6255 goto done;
0381101f
JH		 6256 }
6257
be22b54e
JH		 6258 handler = &mgmt_handlers[opcode];
6259
6260 if ((handler->var_len && len < handler->data_len) ||
8ce8e2b5 6261 (!handler->var_len && len != handler->data_len)) {
be22b54e 6262 err = cmd_status(sk, index, opcode,
04124681 6263 MGMT_STATUS_INVALID_PARAMS);
be22b54e
JH		 6264 goto done;
6265 }
6266
0f4e68cf
JH		 6267 if (hdev)
6268 mgmt_init_hdev(sk, hdev);
6269
6270 cp = buf + sizeof(*hdr);
6271
be22b54e 6272 err = handler->func(sk, hdev, cp, len);
e41d8b4e
JH		 6273 if (err < 0)
6274 goto done;
6275
0381101f
JH		 6276 err = msglen;
6277
6278done:
bdb6d971
JH		 6279 if (hdev)
6280 hci_dev_put(hdev);
6281
0381101f
JH		 6282 kfree(buf);
6283 return err;
6284}
c71e97bf 6285
bf6b56db 6286void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 6287{
1514b892 6288 if (hdev->dev_type != HCI_BREDR)
bf6b56db 6289 return;
bb4b2a9a 6290
0602a8ad
MH		 6291 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6292 return;
6293
6294 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6295 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6296 else
6297 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
c71e97bf
JH		 6298}
6299
bf6b56db 6300void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 6301{
5f159032 6302 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 6303
1514b892 6304 if (hdev->dev_type != HCI_BREDR)
bf6b56db 6305 return;
bb4b2a9a 6306
0602a8ad
MH		 6307 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6308 return;
6309
1b9b5ee5 6310 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 6311
edd3896b
MH		 6312 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6313 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6314 else
6315 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
eec8d2bc
JH		 6316}
6317
6046dc3e 6318/* This function requires the caller holds hdev->lock */
2cf22218 6319static void restart_le_actions(struct hci_request *req)
6046dc3e 6320{
2cf22218 6321 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 6322 struct hci_conn_params *p;
6323
6324 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 6325 /* Needed for AUTO_OFF case where might not "really"
6326 * have been powered off.
6327 */
6328 list_del_init(&p->action);
6329
6330 switch (p->auto_connect) {
4b9e7e75 6331 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 6332 case HCI_AUTO_CONN_ALWAYS:
6333 list_add(&p->action, &hdev->pend_le_conns);
6334 break;
6335 case HCI_AUTO_CONN_REPORT:
6336 list_add(&p->action, &hdev->pend_le_reports);
6337 break;
6338 default:
6339 break;
c83ed19d 6340 }
6046dc3e 6341 }
c83ed19d 6342
2cf22218 6343 __hci_update_background_scan(req);
6046dc3e
AG		 6344}
6345
1904a853 6346static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 6347{
6348 struct cmd_lookup match = { NULL, hdev };
6349
6350 BT_DBG("status 0x%02x", status);
6351
162a3bac
MH		 6352 if (!status) {
6353 /* Register the available SMP channels (BR/EDR and LE) only
6354 * when successfully powering on the controller. This late
6355 * registration is required so that LE SMP can clearly
6356 * decide if the public address or static address is used.
6357 */
6358 smp_register(hdev);
6359 }
6360
229ab39c
JH		 6361 hci_dev_lock(hdev);
6362
6363 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6364
6365 new_settings(hdev, match.sk);
6366
6367 hci_dev_unlock(hdev);
6368
6369 if (match.sk)
6370 sock_put(match.sk);
6371}
6372
70da6243 6373static int powered_update_hci(struct hci_dev *hdev)
5add6af8 6374{
890ea898 6375 struct hci_request req;
70da6243 6376 u8 link_sec;
5add6af8 6377
890ea898
JH		 6378 hci_req_init(&req, hdev);
6379
70da6243
JH		 6380 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6381 !lmp_host_ssp_capable(hdev)) {
574ea3c7 6382 u8 mode = 0x01;
5e5282bb 6383
574ea3c7
MH		 6384 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6385
6386 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6387 u8 support = 0x01;
5add6af8 6388
574ea3c7
MH		 6389 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6390 sizeof(support), &support);
6391 }
ec6f99b8
JH		 6392 }
6393
c73eee91
JH		 6394 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6395 lmp_bredr_capable(hdev)) {
70da6243 6396 struct hci_cp_write_le_host_supported cp;
f0ff92fb 6397
32226e4f
MH		 6398 cp.le = 0x01;
6399 cp.simul = 0x00;
3d1cbdd6 6400
70da6243
JH		 6401 /* Check first if we already have the right
6402 * host state (host features set)
6403 */
6404 if (cp.le != lmp_host_le_capable(hdev) ||
6405 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 6406 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6407 sizeof(cp), &cp);
70da6243 6408 }
3d1cbdd6 6409
d13eafce 6410 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 6411 /* Make sure the controller has a good default for
6412 * advertising data. This also applies to the case
6413 * where BR/EDR was toggled during the AUTO_OFF phase.
6414 */
f14d8f64 6415 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5947f4bc 6416 update_adv_data(&req);
f14d8f64
MH		 6417 update_scan_rsp_data(&req);
6418 }
441ad2d0 6419
bba3aa55
MH		 6420 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6421 enable_advertising(&req);
2cf22218
JH		 6422
6423 restart_le_actions(&req);
eeca6f89
JH		 6424 }
6425
70da6243
JH		 6426 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6427 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 6428 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6429 sizeof(link_sec), &link_sec);
562fcc24 6430
70da6243 6431 if (lmp_bredr_capable(hdev)) {
432df05e 6432 write_fast_connectable(&req, false);
1d2dc5b7 6433 __hci_update_page_scan(&req);
890ea898 6434 update_class(&req);
13928971 6435 update_name(&req);
890ea898 6436 update_eir(&req);
70da6243 6437 }
562fcc24 6438
229ab39c 6439 return hci_req_run(&req, powered_complete);
70da6243 6440}
562fcc24 6441
70da6243
JH		 6442int mgmt_powered(struct hci_dev *hdev, u8 powered)
6443{
6444 struct cmd_lookup match = { NULL, hdev };
9845904f 6445 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 6446 int err;
f0ff92fb 6447
70da6243
JH		 6448 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6449 return 0;
6450
70da6243 6451 if (powered) {
229ab39c
JH		 6452 if (powered_update_hci(hdev) == 0)
6453 return 0;
fe038884 6454
229ab39c
JH		 6455 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6456 &match);
6457 goto new_settings;
b24752fe
JH		 6458 }
6459
229ab39c 6460 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 6461
6462 /* If the power off is because of hdev unregistration let
6463 * use the appropriate INVALID_INDEX status. Otherwise use
6464 * NOT_POWERED. We cover both scenarios here since later in
6465 * mgmt_index_removed() any hci_conn callbacks will have already
6466 * been triggered, potentially causing misleading DISCONNECTED
6467 * status responses.
6468 */
6469 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6470 status = MGMT_STATUS_INVALID_INDEX;
6471 else
6472 status = MGMT_STATUS_NOT_POWERED;
6473
6474 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 6475
6476 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6477 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6478 zero_cod, sizeof(zero_cod), NULL);
6479
6480new_settings:
beadb2bd 6481 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 6482
6483 if (match.sk)
6484 sock_put(match.sk);
6485
7bb895d6 6486 return err;
5add6af8 6487}
73f22f62 6488
3eec705e 6489void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc
JH		 6490{
6491 struct pending_cmd *cmd;
6492 u8 status;
6493
6494 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6495 if (!cmd)
3eec705e 6496 return;
96570ffc
JH		 6497
6498 if (err == -ERFKILL)
6499 status = MGMT_STATUS_RFKILLED;
6500 else
6501 status = MGMT_STATUS_FAILED;
6502
3eec705e 6503 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 6504
6505 mgmt_pending_remove(cmd);
96570ffc
JH		 6506}
6507
d1967ff8
MH		 6508void mgmt_discoverable_timeout(struct hci_dev *hdev)
6509{
6510 struct hci_request req;
d1967ff8
MH		 6511
6512 hci_dev_lock(hdev);
6513
6514 /* When discoverable timeout triggers, then just make sure
6515 * the limited discoverable flag is cleared. Even in the case
6516 * of a timeout triggered from general discoverable, it is
6517 * safe to unconditionally clear the flag.
6518 */
6519 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
9a43e25f 6520 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
d1967ff8
MH		 6521
6522 hci_req_init(&req, hdev);
4b580614
JH		 6523 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6524 u8 scan = SCAN_PAGE;
6525 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6526 sizeof(scan), &scan);
6527 }
d1967ff8 6528 update_class(&req);
9a43e25f 6529 update_adv_data(&req);
d1967ff8
MH		 6530 hci_req_run(&req, NULL);
6531
6532 hdev->discov_timeout = 0;
6533
9a43e25f
JH		 6534 new_settings(hdev, NULL);
6535
d1967ff8
MH		 6536 hci_dev_unlock(hdev);
6537}
6538
dc4a5ee2
MH		 6539void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6540 bool persistent)
55ed8ca1 6541{
86742e1e 6542 struct mgmt_ev_new_link_key ev;
55ed8ca1 6543
a492cd52 6544 memset(&ev, 0, sizeof(ev));
55ed8ca1 6545
a492cd52 6546 ev.store_hint = persistent;
d753fdc4 6547 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 6548 ev.key.addr.type = BDADDR_BREDR;
a492cd52 6549 ev.key.type = key->type;
9b3b4460 6550 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 6551 ev.key.pin_len = key->pin_len;
55ed8ca1 6552
dc4a5ee2 6553 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 6554}
f7520543 6555
d7b25450
JH		 6556static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6557{
23fb8de3
JH		 6558 switch (ltk->type) {
6559 case SMP_LTK:
6560 case SMP_LTK_SLAVE:
6561 if (ltk->authenticated)
6562 return MGMT_LTK_AUTHENTICATED;
6563 return MGMT_LTK_UNAUTHENTICATED;
6564 case SMP_LTK_P256:
6565 if (ltk->authenticated)
6566 return MGMT_LTK_P256_AUTH;
6567 return MGMT_LTK_P256_UNAUTH;
6568 case SMP_LTK_P256_DEBUG:
6569 return MGMT_LTK_P256_DEBUG;
6570 }
d7b25450
JH		 6571
6572 return MGMT_LTK_UNAUTHENTICATED;
6573}
6574
53ac6ab6 6575void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 6576{
6577 struct mgmt_ev_new_long_term_key ev;
6578
6579 memset(&ev, 0, sizeof(ev));
6580
5192d301
MH		 6581 /* Devices using resolvable or non-resolvable random addresses
6582 * without providing an indentity resolving key don't require
6583 * to store long term keys. Their addresses will change the
6584 * next time around.
6585 *
6586 * Only when a remote device provides an identity address
6587 * make sure the long term key is stored. If the remote
6588 * identity is known, the long term keys are internally
6589 * mapped to the identity address. So allow static random
6590 * and public addresses here.
6591 */
ba74b666
JH		 6592 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6593 (key->bdaddr.b[5] & 0xc0) != 0xc0)
6594 ev.store_hint = 0x00;
6595 else
53ac6ab6 6596 ev.store_hint = persistent;
ba74b666 6597
346af67b 6598 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 6599 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 6600 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 6601 ev.key.enc_size = key->enc_size;
6602 ev.key.ediv = key->ediv;
fe39c7b2 6603 ev.key.rand = key->rand;
346af67b 6604
2ceba539 6605 if (key->type == SMP_LTK)
346af67b
VCG		 6606 ev.key.master = 1;
6607
346af67b
VCG		 6608 memcpy(ev.key.val, key->val, sizeof(key->val));
6609
083368f7 6610 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 6611}
6612
95fbac8a
JH		 6613void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6614{
6615 struct mgmt_ev_new_irk ev;
6616
6617 memset(&ev, 0, sizeof(ev));
6618
bab6d1e5
MH		 6619 /* For identity resolving keys from devices that are already
6620 * using a public address or static random address, do not
6621 * ask for storing this key. The identity resolving key really
6622 * is only mandatory for devices using resovlable random
6623 * addresses.
6624 *
6625 * Storing all identity resolving keys has the downside that
6626 * they will be also loaded on next boot of they system. More
6627 * identity resolving keys, means more time during scanning is
6628 * needed to actually resolve these addresses.
6629 */
6630 if (bacmp(&irk->rpa, BDADDR_ANY))
6631 ev.store_hint = 0x01;
6632 else
6633 ev.store_hint = 0x00;
6634
95fbac8a
JH		 6635 bacpy(&ev.rpa, &irk->rpa);
6636 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6637 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6638 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6639
6640 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6641}
6642
53ac6ab6
MH		 6643void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6644 bool persistent)
7ee4ea36
MH		 6645{
6646 struct mgmt_ev_new_csrk ev;
6647
6648 memset(&ev, 0, sizeof(ev));
6649
6650 /* Devices using resolvable or non-resolvable random addresses
6651 * without providing an indentity resolving key don't require
6652 * to store signature resolving keys. Their addresses will change
6653 * the next time around.
6654 *
6655 * Only when a remote device provides an identity address
6656 * make sure the signature resolving key is stored. So allow
6657 * static random and public addresses here.
6658 */
6659 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6660 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6661 ev.store_hint = 0x00;
6662 else
53ac6ab6 6663 ev.store_hint = persistent;
7ee4ea36
MH		 6664
6665 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6666 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6667 ev.key.master = csrk->master;
6668 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6669
6670 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6671}
6672
ffb5a827 6673void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 6674 u8 bdaddr_type, u8 store_hint, u16 min_interval,
6675 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 6676{
6677 struct mgmt_ev_new_conn_param ev;
6678
c103aea6
JH		 6679 if (!hci_is_identity_address(bdaddr, bdaddr_type))
6680 return;
6681
ffb5a827
AG		 6682 memset(&ev, 0, sizeof(ev));
6683 bacpy(&ev.addr.bdaddr, bdaddr);
6684 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 6685 ev.store_hint = store_hint;
ffb5a827
AG		 6686 ev.min_interval = cpu_to_le16(min_interval);
6687 ev.max_interval = cpu_to_le16(max_interval);
6688 ev.latency = cpu_to_le16(latency);
6689 ev.timeout = cpu_to_le16(timeout);
6690
6691 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6692}
6693
94933991
MH		 6694static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6695 u8 data_len)
6696{
6697 eir[eir_len++] = sizeof(type) + data_len;
6698 eir[eir_len++] = type;
6699 memcpy(&eir[eir_len], data, data_len);
6700 eir_len += data_len;
6701
6702 return eir_len;
6703}
6704
48ec92fa
AA		 6705void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6706 u32 flags, u8 *name, u8 name_len)
f7520543 6707{
b644ba33
JH		 6708 char buf[512];
6709 struct mgmt_ev_device_connected *ev = (void *) buf;
6710 u16 eir_len = 0;
f7520543 6711
48ec92fa
AA		 6712 bacpy(&ev->addr.bdaddr, &conn->dst);
6713 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 6714
c95f0ba7 6715 ev->flags = __cpu_to_le32(flags);
08c79b61 6716
fd45ada9
AA		 6717 /* We must ensure that the EIR Data fields are ordered and
6718 * unique. Keep it simple for now and avoid the problem by not
6719 * adding any BR/EDR data to the LE adv.
6720 */
6721 if (conn->le_adv_data_len > 0) {
6722 memcpy(&ev->eir[eir_len],
6723 conn->le_adv_data, conn->le_adv_data_len);
6724 eir_len = conn->le_adv_data_len;
6725 } else {
6726 if (name_len > 0)
6727 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6728 name, name_len);
b644ba33 6729
ddbea5cf 6730 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 6731 eir_len = eir_append_data(ev->eir, eir_len,
6732 EIR_CLASS_OF_DEV,
6733 conn->dev_class, 3);
6734 }
b644ba33 6735
eb55ef07 6736 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 6737
ecd90ae7
MH		 6738 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6739 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 6740}
6741
8962ee74
JH		 6742static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6743{
8962ee74 6744 struct sock **sk = data;
8962ee74 6745
f5818c22 6746 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 6747
6748 *sk = cmd->sk;
6749 sock_hold(*sk);
6750
a664b5bc 6751 mgmt_pending_remove(cmd);
8962ee74
JH		 6752}
6753
124f6e35 6754static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
a8a1d19e 6755{
b1078ad0 6756 struct hci_dev *hdev = data;
124f6e35 6757 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 6758
b1078ad0
JH		 6759 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6760
d8b7b1e4 6761 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 6762 mgmt_pending_remove(cmd);
6763}
6764
84c61d92
JH		 6765bool mgmt_powering_down(struct hci_dev *hdev)
6766{
6767 struct pending_cmd *cmd;
6768 struct mgmt_mode *cp;
6769
6770 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6771 if (!cmd)
6772 return false;
6773
6774 cp = cmd->param;
6775 if (!cp->val)
6776 return true;
6777
6778 return false;
6779}
6780
9b80ec5e 6781void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 6782 u8 link_type, u8 addr_type, u8 reason,
6783 bool mgmt_connected)
f7520543 6784{
f0d6a0ea 6785 struct mgmt_ev_device_disconnected ev;
8962ee74 6786 struct sock *sk = NULL;
8962ee74 6787
84c61d92
JH		 6788 /* The connection is still in hci_conn_hash so test for 1
6789 * instead of 0 to know if this is the last one.
6790 */
6791 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6792 cancel_delayed_work(&hdev->power_off);
6793 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 6794 }
6795
12d4a3b2
JH		 6796 if (!mgmt_connected)
6797 return;
6798
57eb776f
AG		 6799 if (link_type != ACL_LINK && link_type != LE_LINK)
6800 return;
6801
744cf19e 6802 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 6803
f0d6a0ea
MA		 6804 bacpy(&ev.addr.bdaddr, bdaddr);
6805 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6806 ev.reason = reason;
f7520543 6807
9b80ec5e 6808 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 6809
6810 if (sk)
d97dcb66 6811 sock_put(sk);
8962ee74 6812
124f6e35 6813 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 6814 hdev);
8962ee74
JH		 6815}
6816
7892924c
MH		 6817void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6818 u8 link_type, u8 addr_type, u8 status)
8962ee74 6819{
3655bba8
AG		 6820 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6821 struct mgmt_cp_disconnect *cp;
8962ee74 6822 struct pending_cmd *cmd;
8962ee74 6823
36a75f1b
JD		 6824 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6825 hdev);
6826
2e58ef3e 6827 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 6828 if (!cmd)
7892924c 6829 return;
8962ee74 6830
3655bba8
AG		 6831 cp = cmd->param;
6832
6833 if (bacmp(bdaddr, &cp->addr.bdaddr))
6834 return;
6835
6836 if (cp->addr.type != bdaddr_type)
6837 return;
6838
f5818c22 6839 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6840 mgmt_pending_remove(cmd);
f7520543 6841}
17d5c04c 6842
445608d0
MH		 6843void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6844 u8 addr_type, u8 status)
17d5c04c
JH		 6845{
6846 struct mgmt_ev_connect_failed ev;
c9910d0f 6847
84c61d92
JH		 6848 /* The connection is still in hci_conn_hash so test for 1
6849 * instead of 0 to know if this is the last one.
6850 */
6851 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6852 cancel_delayed_work(&hdev->power_off);
6853 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 6854 }
17d5c04c 6855
4c659c39 6856 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6857 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 6858 ev.status = mgmt_status(status);
17d5c04c 6859
445608d0 6860 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 6861}
980e1a53 6862
ce0e4a0d 6863void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 6864{
6865 struct mgmt_ev_pin_code_request ev;
6866
d8457698 6867 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 6868 ev.addr.type = BDADDR_BREDR;
a770bb5a 6869 ev.secure = secure;
980e1a53 6870
ce0e4a0d 6871 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 6872}
6873
e669cf80
MH		 6874void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6875 u8 status)
980e1a53
JH		 6876{
6877 struct pending_cmd *cmd;
980e1a53 6878
2e58ef3e 6879 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 6880 if (!cmd)
e669cf80 6881 return;
980e1a53 6882
7776d1d8 6883 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6884 mgmt_pending_remove(cmd);
980e1a53
JH		 6885}
6886
3eb38528
MH		 6887void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6888 u8 status)
980e1a53
JH		 6889{
6890 struct pending_cmd *cmd;
980e1a53 6891
2e58ef3e 6892 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 6893 if (!cmd)
3eb38528 6894 return;
980e1a53 6895
7776d1d8 6896 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6897 mgmt_pending_remove(cmd);
980e1a53 6898}
a5c29683 6899
744cf19e 6900int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 6901 u8 link_type, u8 addr_type, u32 value,
04124681 6902 u8 confirm_hint)
a5c29683
JH		 6903{
6904 struct mgmt_ev_user_confirm_request ev;
6905
744cf19e 6906 BT_DBG("%s", hdev->name);
a5c29683 6907
272d90df 6908 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6909 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 6910 ev.confirm_hint = confirm_hint;
39adbffe 6911 ev.value = cpu_to_le32(value);
a5c29683 6912
744cf19e 6913 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 6914 NULL);
a5c29683
JH		 6915}
6916
272d90df 6917int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 6918 u8 link_type, u8 addr_type)
604086b7
BG		 6919{
6920 struct mgmt_ev_user_passkey_request ev;
6921
6922 BT_DBG("%s", hdev->name);
6923
272d90df 6924 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6925 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 6926
6927 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 6928 NULL);
604086b7
BG		 6929}
6930
0df4c185 6931static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 6932 u8 link_type, u8 addr_type, u8 status,
6933 u8 opcode)
a5c29683
JH		 6934{
6935 struct pending_cmd *cmd;
a5c29683 6936
2e58ef3e 6937 cmd = mgmt_pending_find(opcode, hdev);
a5c29683
JH		 6938 if (!cmd)
6939 return -ENOENT;
6940
7776d1d8 6941 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6942 mgmt_pending_remove(cmd);
a5c29683 6943
7776d1d8 6944 return 0;
a5c29683
JH		 6945}
6946
744cf19e 6947int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6948 u8 link_type, u8 addr_type, u8 status)
a5c29683 6949{
272d90df 6950 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 6951 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 6952}
6953
272d90df 6954int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6955 u8 link_type, u8 addr_type, u8 status)
a5c29683 6956{
272d90df 6957 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 6958 status,
6959 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 6960}
2a611692 6961
604086b7 6962int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6963 u8 link_type, u8 addr_type, u8 status)
604086b7 6964{
272d90df 6965 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 6966 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 6967}
6968
272d90df 6969int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6970 u8 link_type, u8 addr_type, u8 status)
604086b7 6971{
272d90df 6972 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 6973 status,
6974 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 6975}
6976
92a25256
JH		 6977int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6978 u8 link_type, u8 addr_type, u32 passkey,
6979 u8 entered)
6980{
6981 struct mgmt_ev_passkey_notify ev;
6982
6983 BT_DBG("%s", hdev->name);
6984
6985 bacpy(&ev.addr.bdaddr, bdaddr);
6986 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6987 ev.passkey = __cpu_to_le32(passkey);
6988 ev.entered = entered;
6989
6990 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6991}
6992
e1e930f5 6993void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 6994{
6995 struct mgmt_ev_auth_failed ev;
e1e930f5
JH		 6996 struct pending_cmd *cmd;
6997 u8 status = mgmt_status(hci_status);
2a611692 6998
e1e930f5
JH		 6999 bacpy(&ev.addr.bdaddr, &conn->dst);
7000 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7001 ev.status = status;
2a611692 7002
e1e930f5
JH		 7003 cmd = find_pairing(conn);
7004
7005 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7006 cmd ? cmd->sk : NULL);
7007
a511b35b
JH		 7008 if (cmd) {
7009 cmd->cmd_complete(cmd, status);
7010 mgmt_pending_remove(cmd);
7011 }
2a611692 7012}
b312b161 7013
464996ae 7014void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 7015{
7016 struct cmd_lookup match = { NULL, hdev };
464996ae 7017 bool changed;
33ef95ed
JH		 7018
7019 if (status) {
7020 u8 mgmt_err = mgmt_status(status);
7021 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 7022 cmd_status_rsp, &mgmt_err);
464996ae 7023 return;
33ef95ed
JH		 7024 }
7025
464996ae
MH		 7026 if (test_bit(HCI_AUTH, &hdev->flags))
7027 changed = !test_and_set_bit(HCI_LINK_SECURITY,
7028 &hdev->dev_flags);
7029 else
7030 changed = test_and_clear_bit(HCI_LINK_SECURITY,
7031 &hdev->dev_flags);
47990ea0 7032
33ef95ed 7033 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 7034 &match);
33ef95ed 7035
47990ea0 7036 if (changed)
464996ae 7037 new_settings(hdev, match.sk);
33ef95ed
JH		 7038
7039 if (match.sk)
7040 sock_put(match.sk);
33ef95ed
JH		 7041}
7042
890ea898 7043static void clear_eir(struct hci_request *req)
cacaf52f 7044{
890ea898 7045 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 7046 struct hci_cp_write_eir cp;
7047
976eb20e 7048 if (!lmp_ext_inq_capable(hdev))
890ea898 7049 return;
cacaf52f 7050
c80da27e
JH		 7051 memset(hdev->eir, 0, sizeof(hdev->eir));
7052
cacaf52f
JH		 7053 memset(&cp, 0, sizeof(cp));
7054
890ea898 7055 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 7056}
7057
3e248560 7058void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 7059{
7060 struct cmd_lookup match = { NULL, hdev };
890ea898 7061 struct hci_request req;
c0ecddc2 7062 bool changed = false;
ed2c4ee3
JH		 7063
7064 if (status) {
7065 u8 mgmt_err = mgmt_status(status);
c0ecddc2
JH		 7066
7067 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
9ecb3e24
MH		 7068 &hdev->dev_flags)) {
7069 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3e248560 7070 new_settings(hdev, NULL);
9ecb3e24 7071 }
c0ecddc2 7072
04124681
GP		 7073 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7074 &mgmt_err);
3e248560 7075 return;
c0ecddc2
JH		 7076 }
7077
7078 if (enable) {
9ecb3e24 7079 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
c0ecddc2 7080 } else {
9ecb3e24
MH		 7081 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
7082 if (!changed)
7083 changed = test_and_clear_bit(HCI_HS_ENABLED,
7084 &hdev->dev_flags);
7085 else
7086 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
ed2c4ee3
JH		 7087 }
7088
7089 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7090
c0ecddc2 7091 if (changed)
3e248560 7092 new_settings(hdev, match.sk);
ed2c4ee3 7093
5fc6ebb1 7094 if (match.sk)
ed2c4ee3
JH		 7095 sock_put(match.sk);
7096
890ea898
JH		 7097 hci_req_init(&req, hdev);
7098
3769972b
JH		 7099 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
7100 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
7101 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7102 sizeof(enable), &enable);
890ea898 7103 update_eir(&req);
3769972b 7104 } else {
890ea898 7105 clear_eir(&req);
3769972b 7106 }
890ea898
JH		 7107
7108 hci_req_run(&req, NULL);
ed2c4ee3
JH		 7109}
7110
92da6097 7111static void sk_lookup(struct pending_cmd *cmd, void *data)
90e70454
JH		 7112{
7113 struct cmd_lookup *match = data;
7114
90e70454
JH		 7115 if (match->sk == NULL) {
7116 match->sk = cmd->sk;
7117 sock_hold(match->sk);
7118 }
90e70454
JH		 7119}
7120
4e1b0245
MH		 7121void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7122 u8 status)
7f9a903c 7123{
90e70454 7124 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 7125
92da6097
JH		 7126 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7127 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7128 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 7129
7130 if (!status)
4e1b0245
MH		 7131 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7132 NULL);
90e70454
JH		 7133
7134 if (match.sk)
7135 sock_put(match.sk);
7f9a903c
MH		 7136}
7137
7667da34 7138void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 7139{
b312b161 7140 struct mgmt_cp_set_local_name ev;
13928971 7141 struct pending_cmd *cmd;
28cc7bde 7142
13928971 7143 if (status)
7667da34 7144 return;
b312b161
JH		 7145
7146 memset(&ev, 0, sizeof(ev));
7147 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 7148 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 7149
2e58ef3e 7150 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 7151 if (!cmd) {
7152 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 7153
13928971
JH		 7154 /* If this is a HCI command related to powering on the
7155 * HCI dev don't send any mgmt signals.
7156 */
7157 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 7158 return;
890ea898 7159 }
b312b161 7160
7667da34
MH		 7161 mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7162 cmd ? cmd->sk : NULL);
b312b161 7163}
c35938b2 7164
4d2d2796 7165void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
38da1703
JH		 7166 u8 *rand192, u8 *hash256, u8 *rand256,
7167 u8 status)
c35938b2
SJ		 7168{
7169 struct pending_cmd *cmd;
c35938b2 7170
744cf19e 7171 BT_DBG("%s status %u", hdev->name, status);
c35938b2 7172
2e58ef3e 7173 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 7174 if (!cmd)
3edaf092 7175 return;
c35938b2
SJ		 7176
7177 if (status) {
3edaf092
MH		 7178 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7179 mgmt_status(status));
c35938b2 7180 } else {
66f096f7
JH		 7181 struct mgmt_rp_read_local_oob_data rp;
7182 size_t rp_size = sizeof(rp);
4d2d2796 7183
66f096f7
JH		 7184 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7185 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
c35938b2 7186
66f096f7 7187 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
4d2d2796 7188 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
38da1703 7189 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
4d2d2796 7190 } else {
66f096f7 7191 rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
4d2d2796 7192 }
66f096f7
JH		 7193
7194 cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7195 &rp, rp_size);
c35938b2
SJ		 7196 }
7197
7198 mgmt_pending_remove(cmd);
c35938b2 7199}
e17acd40 7200
799ce93d
JP		 7201static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7202{
7203 int i;
7204
7205 for (i = 0; i < uuid_count; i++) {
7206 if (!memcmp(uuid, uuids[i], 16))
7207 return true;
7208 }
7209
7210 return false;
7211}
7212
b487b9ce
MH		 7213static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7214{
799ce93d
JP		 7215 u16 parsed = 0;
7216
7217 while (parsed < eir_len) {
7218 u8 field_len = eir[0];
7219 u8 uuid[16];
7220 int i;
7221
7222 if (field_len == 0)
7223 break;
7224
7225 if (eir_len - parsed < field_len + 1)
7226 break;
7227
7228 switch (eir[1]) {
7229 case EIR_UUID16_ALL:
7230 case EIR_UUID16_SOME:
7231 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 7232 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7233 uuid[13] = eir[i + 3];
7234 uuid[12] = eir[i + 2];
7235 if (has_uuid(uuid, uuid_count, uuids))
7236 return true;
7237 }
7238 break;
7239 case EIR_UUID32_ALL:
7240 case EIR_UUID32_SOME:
7241 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 7242 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7243 uuid[15] = eir[i + 5];
7244 uuid[14] = eir[i + 4];
7245 uuid[13] = eir[i + 3];
7246 uuid[12] = eir[i + 2];
7247 if (has_uuid(uuid, uuid_count, uuids))
7248 return true;
7249 }
7250 break;
7251 case EIR_UUID128_ALL:
7252 case EIR_UUID128_SOME:
7253 for (i = 0; i + 17 <= field_len; i += 16) {
7254 memcpy(uuid, eir + i + 2, 16);
7255 if (has_uuid(uuid, uuid_count, uuids))
7256 return true;
7257 }
7258 break;
7259 }
7260
7261 parsed += field_len + 1;
7262 eir += field_len + 1;
7263 }
7264
b487b9ce
MH		 7265 return false;
7266}
7267
4b0e0ced
JP		 7268static void restart_le_scan(struct hci_dev *hdev)
7269{
7270 /* If controller is not scanning we are done. */
7271 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
7272 return;
7273
7274 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7275 hdev->discovery.scan_start +
7276 hdev->discovery.scan_duration))
7277 return;
7278
7279 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7280 DISCOV_LE_RESTART_DELAY);
7281}
7282
901801b9 7283void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
af58925c
MH		 7284 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7285 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 7286{
e319d2e7
JH		 7287 char buf[512];
7288 struct mgmt_ev_device_found *ev = (void *) buf;
1dc06093 7289 size_t ev_size;
b487b9ce 7290 bool match;
e17acd40 7291
75ce208c
JH		 7292 /* Don't send events for a non-kernel initiated discovery. With
7293 * LE one exception is if we have pend_le_reports > 0 in which
7294 * case we're doing passive scanning and want these events.
7295 */
7296 if (!hci_discovery_active(hdev)) {
7297 if (link_type == ACL_LINK)
7298 return;
66f8455a 7299 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
75ce208c
JH		 7300 return;
7301 }
12602d0c 7302
bda157a4
MH		 7303 /* When using service discovery with a RSSI threshold, then check
7304 * if such a RSSI threshold is specified. If a RSSI threshold has
4b0e0ced
JP		 7305 * been specified, and HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set,
7306 * then all results with a RSSI smaller than the RSSI threshold will be
7307 * dropped. If the quirk is set, let it through for further processing,
7308 * as we might need to restart the scan.
efb2513f
MH		 7309 *
7310 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7311 * the results are also dropped.
bda157a4
MH		 7312 */
7313 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 7314 (rssi == HCI_RSSI_INVALID ||
7315 (rssi < hdev->discovery.rssi &&
7316 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
bda157a4
MH		 7317 return;
7318
5d2e9fad
JH		 7319 /* Make sure that the buffer is big enough. The 5 extra bytes
7320 * are for the potential CoD field.
7321 */
7322 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
901801b9 7323 return;
7d262f86 7324
1dc06093
JH		 7325 memset(buf, 0, sizeof(buf));
7326
da25cf6a
MH		 7327 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7328 * RSSI value was reported as 0 when not available. This behavior
7329 * is kept when using device discovery. This is required for full
7330 * backwards compatibility with the API.
7331 *
7332 * However when using service discovery, the value 127 will be
7333 * returned when the RSSI is not available.
7334 */
91200e9f
SJ		 7335 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7336 link_type == ACL_LINK)
efb2513f
MH		 7337 rssi = 0;
7338
841c5644
JH		 7339 bacpy(&ev->addr.bdaddr, bdaddr);
7340 ev->addr.type = link_to_bdaddr(link_type, addr_type);
e319d2e7 7341 ev->rssi = rssi;
af58925c 7342 ev->flags = cpu_to_le32(flags);
e17acd40 7343
b487b9ce
MH		 7344 if (eir_len > 0) {
7345 /* When using service discovery and a list of UUID is
7346 * provided, results with no matching UUID should be
7347 * dropped. In case there is a match the result is
7348 * kept and checking possible scan response data
7349 * will be skipped.
7350 */
4b0e0ced 7351 if (hdev->discovery.uuid_count > 0) {
b487b9ce
MH		 7352 match = eir_has_uuids(eir, eir_len,
7353 hdev->discovery.uuid_count,
7354 hdev->discovery.uuids);
4b0e0ced
JP		 7355 /* If duplicate filtering does not report RSSI changes,
7356 * then restart scanning to ensure updated result with
7357 * updated RSSI values.
7358 */
7359 if (match && test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
7360 &hdev->quirks))
7361 restart_le_scan(hdev);
7362 } else {
ea8ae251 7363 match = true;
4b0e0ced 7364 }
ea8ae251
MH		 7365
7366 if (!match && !scan_rsp_len)
7367 return;
b487b9ce
MH		 7368
7369 /* Copy EIR or advertising data into event */
e319d2e7 7370 memcpy(ev->eir, eir, eir_len);
b487b9ce
MH		 7371 } else {
7372 /* When using service discovery and a list of UUID is
7373 * provided, results with empty EIR or advertising data
7374 * should be dropped since they do not match any UUID.
7375 */
ea8ae251 7376 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
b487b9ce 7377 return;
ea8ae251
MH		 7378
7379 match = false;
b487b9ce 7380 }
e17acd40 7381
1dc06093
JH		 7382 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7383 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
04124681 7384 dev_class, 3);
1dc06093 7385
b487b9ce
MH		 7386 if (scan_rsp_len > 0) {
7387 /* When using service discovery and a list of UUID is
7388 * provided, results with no matching UUID should be
7389 * dropped if there is no previous match from the
7390 * advertising data.
7391 */
7392 if (hdev->discovery.uuid_count > 0) {
7393 if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7394 hdev->discovery.uuid_count,
7395 hdev->discovery.uuids))
7396 return;
4b0e0ced
JP		 7397
7398 /* If duplicate filtering does not report RSSI changes,
7399 * then restart scanning to ensure updated result with
7400 * updated RSSI values.
7401 */
7402 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
7403 &hdev->quirks))
7404 restart_le_scan(hdev);
b487b9ce
MH		 7405 }
7406
7407 /* Append scan response data to event */
5d2e9fad 7408 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
b487b9ce
MH		 7409 } else {
7410 /* When using service discovery and a list of UUID is
7411 * provided, results with empty scan response and no
7412 * previous matched advertising data should be dropped.
7413 */
7414 if (hdev->discovery.uuid_count > 0 && !match)
7415 return;
7416 }
5d2e9fad 7417
4b0e0ced
JP		 7418 /* Validate the reported RSSI value against the RSSI threshold once more
7419 * incase HCI_QUIRK_STRICT_DUPLICATE_FILTER forced a restart of LE
7420 * scanning.
7421 */
7422 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7423 rssi < hdev->discovery.rssi)
7424 return;
7425
5d2e9fad
JH		 7426 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7427 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 7428
901801b9 7429 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 7430}
a88a9652 7431
9cf12aee
MH		 7432void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7433 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 7434{
b644ba33
JH		 7435 struct mgmt_ev_device_found *ev;
7436 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7437 u16 eir_len;
a88a9652 7438
b644ba33 7439 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 7440
b644ba33
JH		 7441 memset(buf, 0, sizeof(buf));
7442
7443 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 7444 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 7445 ev->rssi = rssi;
7446
7447 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 7448 name_len);
b644ba33 7449
eb55ef07 7450 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 7451
9cf12aee 7452 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 7453}
314b2381 7454
2f1e063b 7455void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 7456{
f963e8e9 7457 struct mgmt_ev_discovering ev;
164a6e78 7458
343fb145
AG		 7459 BT_DBG("%s discovering %u", hdev->name, discovering);
7460
f963e8e9
JH		 7461 memset(&ev, 0, sizeof(ev));
7462 ev.type = hdev->discovery.type;
7463 ev.discovering = discovering;
7464
2f1e063b 7465 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 7466}
5e762444 7467
1904a853 7468static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 7469{
7470 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 7471}
7472
7473void mgmt_reenable_advertising(struct hci_dev *hdev)
7474{
7475 struct hci_request req;
7476
5976e608
MH		 7477 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7478 return;
7479
7480 hci_req_init(&req, hdev);
7481 enable_advertising(&req);
0ec5ae84 7482 hci_req_run(&req, adv_enable_complete);
5976e608 7483}
Linux kernel - Deliverables
This page took 0.819106 seconds and 5 git commands to generate.