projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Update adv. parameters when conn. setting changes
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
beb1c21b 41#define MGMT_REVISION 9
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 103 MGMT_OP_ADD_ADVERTISING,
da929335 104 MGMT_OP_REMOVE_ADVERTISING,
e70bb2e8
JH		 105};
106
107static const u16 mgmt_events[] = {
108 MGMT_EV_CONTROLLER_ERROR,
109 MGMT_EV_INDEX_ADDED,
110 MGMT_EV_INDEX_REMOVED,
111 MGMT_EV_NEW_SETTINGS,
112 MGMT_EV_CLASS_OF_DEV_CHANGED,
113 MGMT_EV_LOCAL_NAME_CHANGED,
114 MGMT_EV_NEW_LINK_KEY,
115 MGMT_EV_NEW_LONG_TERM_KEY,
116 MGMT_EV_DEVICE_CONNECTED,
117 MGMT_EV_DEVICE_DISCONNECTED,
118 MGMT_EV_CONNECT_FAILED,
119 MGMT_EV_PIN_CODE_REQUEST,
120 MGMT_EV_USER_CONFIRM_REQUEST,
121 MGMT_EV_USER_PASSKEY_REQUEST,
122 MGMT_EV_AUTH_FAILED,
123 MGMT_EV_DEVICE_FOUND,
124 MGMT_EV_DISCOVERING,
125 MGMT_EV_DEVICE_BLOCKED,
126 MGMT_EV_DEVICE_UNBLOCKED,
127 MGMT_EV_DEVICE_UNPAIRED,
92a25256 128 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 129 MGMT_EV_NEW_IRK,
7ee4ea36 130 MGMT_EV_NEW_CSRK,
8afef092
MH		 131 MGMT_EV_DEVICE_ADDED,
132 MGMT_EV_DEVICE_REMOVED,
ffb5a827 133 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 134 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 135 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 136 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 137 MGMT_EV_EXT_INDEX_ADDED,
138 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 139 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 140 MGMT_EV_ADVERTISING_ADDED,
141 MGMT_EV_ADVERTISING_REMOVED,
e70bb2e8
JH		 142};
143
99c679ac
MH		 144static const u16 mgmt_untrusted_commands[] = {
145 MGMT_OP_READ_INDEX_LIST,
146 MGMT_OP_READ_INFO,
147 MGMT_OP_READ_UNCONF_INDEX_LIST,
148 MGMT_OP_READ_CONFIG_INFO,
149 MGMT_OP_READ_EXT_INDEX_LIST,
150};
151
152static const u16 mgmt_untrusted_events[] = {
153 MGMT_EV_INDEX_ADDED,
154 MGMT_EV_INDEX_REMOVED,
155 MGMT_EV_NEW_SETTINGS,
156 MGMT_EV_CLASS_OF_DEV_CHANGED,
157 MGMT_EV_LOCAL_NAME_CHANGED,
158 MGMT_EV_UNCONF_INDEX_ADDED,
159 MGMT_EV_UNCONF_INDEX_REMOVED,
160 MGMT_EV_NEW_CONFIG_OPTIONS,
161 MGMT_EV_EXT_INDEX_ADDED,
162 MGMT_EV_EXT_INDEX_REMOVED,
163};
164
17b02e62 165#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 166
d25b78e2
JH		 167#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
168 "\x00\x00\x00\x00\x00\x00\x00\x00"
169
ca69b795
JH		 170/* HCI to MGMT error code conversion table */
171static u8 mgmt_status_table[] = {
172 MGMT_STATUS_SUCCESS,
173 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
174 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
175 MGMT_STATUS_FAILED, /* Hardware Failure */
176 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
177 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 178 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 179 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
180 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
181 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
182 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
183 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
184 MGMT_STATUS_BUSY, /* Command Disallowed */
185 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
186 MGMT_STATUS_REJECTED, /* Rejected Security */
187 MGMT_STATUS_REJECTED, /* Rejected Personal */
188 MGMT_STATUS_TIMEOUT, /* Host Timeout */
189 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
190 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
191 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
192 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
193 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
194 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
195 MGMT_STATUS_BUSY, /* Repeated Attempts */
196 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
197 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
199 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
200 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
201 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
202 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
203 MGMT_STATUS_FAILED, /* Unspecified Error */
204 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
205 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
206 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
207 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
208 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
209 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
210 MGMT_STATUS_FAILED, /* Unit Link Key Used */
211 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
212 MGMT_STATUS_TIMEOUT, /* Instant Passed */
213 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
214 MGMT_STATUS_FAILED, /* Transaction Collision */
215 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
216 MGMT_STATUS_REJECTED, /* QoS Rejected */
217 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
218 MGMT_STATUS_REJECTED, /* Insufficient Security */
219 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
220 MGMT_STATUS_BUSY, /* Role Switch Pending */
221 MGMT_STATUS_FAILED, /* Slot Violation */
222 MGMT_STATUS_FAILED, /* Role Switch Failed */
223 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
224 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
225 MGMT_STATUS_BUSY, /* Host Busy Pairing */
226 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
227 MGMT_STATUS_BUSY, /* Controller Busy */
228 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
229 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
230 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
231 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
232 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
233};
234
235static u8 mgmt_status(u8 hci_status)
236{
237 if (hci_status < ARRAY_SIZE(mgmt_status_table))
238 return mgmt_status_table[hci_status];
239
240 return MGMT_STATUS_FAILED;
241}
242
c08b1a1d
MH		 243static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
244 u16 len, int flag)
f9207338 245{
c08b1a1d
MH		 246 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
247 flag, NULL);
f9207338
MH		 248}
249
72000df2
MH		 250static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag, struct sock *skip_sk)
252{
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, skip_sk);
255}
256
f6b7712e
MH		 257static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, struct sock *skip_sk)
259{
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 HCI_MGMT_GENERIC_EVENTS, skip_sk);
262}
263
7a00ff44
JH		 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266{
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 268 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 269}
270
04124681
GP		 271static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
272 u16 data_len)
a38528f1
JH		 273{
274 struct mgmt_rp_read_version rp;
275
276 BT_DBG("sock %p", sk);
277
278 rp.version = MGMT_VERSION;
dcf4adbf 279 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 280
2a1afb5a
JH		 281 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
282 &rp, sizeof(rp));
a38528f1
JH		 283}
284
04124681
GP		 285static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
286 u16 data_len)
e70bb2e8
JH		 287{
288 struct mgmt_rp_read_commands *rp;
99c679ac 289 u16 num_commands, num_events;
e70bb2e8
JH		 290 size_t rp_size;
291 int i, err;
292
293 BT_DBG("sock %p", sk);
294
99c679ac
MH		 295 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
296 num_commands = ARRAY_SIZE(mgmt_commands);
297 num_events = ARRAY_SIZE(mgmt_events);
298 } else {
299 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
300 num_events = ARRAY_SIZE(mgmt_untrusted_events);
301 }
302
e70bb2e8
JH		 303 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
304
305 rp = kmalloc(rp_size, GFP_KERNEL);
306 if (!rp)
307 return -ENOMEM;
308
dcf4adbf
JP		 309 rp->num_commands = cpu_to_le16(num_commands);
310 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 311
99c679ac
MH		 312 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
313 __le16 *opcode = rp->opcodes;
314
315 for (i = 0; i < num_commands; i++, opcode++)
316 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 317
99c679ac
MH		 318 for (i = 0; i < num_events; i++, opcode++)
319 put_unaligned_le16(mgmt_events[i], opcode);
320 } else {
321 __le16 *opcode = rp->opcodes;
322
323 for (i = 0; i < num_commands; i++, opcode++)
324 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
325
326 for (i = 0; i < num_events; i++, opcode++)
327 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
328 }
e70bb2e8 329
2a1afb5a
JH		 330 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
331 rp, rp_size);
e70bb2e8
JH		 332 kfree(rp);
333
334 return err;
335}
336
04124681
GP		 337static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
338 u16 data_len)
faba42eb 339{
faba42eb 340 struct mgmt_rp_read_index_list *rp;
8035ded4 341 struct hci_dev *d;
a38528f1 342 size_t rp_len;
faba42eb 343 u16 count;
476e44cb 344 int err;
faba42eb
JH		 345
346 BT_DBG("sock %p", sk);
347
348 read_lock(&hci_dev_list_lock);
349
350 count = 0;
bb4b2a9a 351 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 352 if (d->dev_type == HCI_BREDR &&
d7a5a11d 353 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 354 count++;
faba42eb
JH		 355 }
356
a38528f1
JH		 357 rp_len = sizeof(*rp) + (2 * count);
358 rp = kmalloc(rp_len, GFP_ATOMIC);
359 if (!rp) {
b2c60d42 360 read_unlock(&hci_dev_list_lock);
faba42eb 361 return -ENOMEM;
b2c60d42 362 }
faba42eb 363
476e44cb 364 count = 0;
8035ded4 365 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 366 if (hci_dev_test_flag(d, HCI_SETUP) ||
367 hci_dev_test_flag(d, HCI_CONFIG) ||
368 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 369 continue;
370
73d1df2a
MH		 371 /* Devices marked as raw-only are neither configured
372 * nor unconfigured controllers.
373 */
374 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 375 continue;
376
73d1df2a 377 if (d->dev_type == HCI_BREDR &&
d7a5a11d 378 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 379 rp->index[count++] = cpu_to_le16(d->id);
380 BT_DBG("Added hci%u", d->id);
381 }
faba42eb
JH		 382 }
383
476e44cb
JH		 384 rp->num_controllers = cpu_to_le16(count);
385 rp_len = sizeof(*rp) + (2 * count);
386
faba42eb
JH		 387 read_unlock(&hci_dev_list_lock);
388
2a1afb5a
JH		 389 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
390 0, rp, rp_len);
faba42eb 391
a38528f1
JH		 392 kfree(rp);
393
394 return err;
faba42eb
JH		 395}
396
73d1df2a
MH		 397static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
398 void *data, u16 data_len)
399{
400 struct mgmt_rp_read_unconf_index_list *rp;
401 struct hci_dev *d;
402 size_t rp_len;
403 u16 count;
404 int err;
405
406 BT_DBG("sock %p", sk);
407
408 read_lock(&hci_dev_list_lock);
409
410 count = 0;
411 list_for_each_entry(d, &hci_dev_list, list) {
412 if (d->dev_type == HCI_BREDR &&
d7a5a11d 413 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 414 count++;
415 }
416
417 rp_len = sizeof(*rp) + (2 * count);
418 rp = kmalloc(rp_len, GFP_ATOMIC);
419 if (!rp) {
420 read_unlock(&hci_dev_list_lock);
421 return -ENOMEM;
422 }
423
424 count = 0;
425 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 426 if (hci_dev_test_flag(d, HCI_SETUP) ||
427 hci_dev_test_flag(d, HCI_CONFIG) ||
428 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 429 continue;
430
431 /* Devices marked as raw-only are neither configured
432 * nor unconfigured controllers.
433 */
434 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
435 continue;
436
437 if (d->dev_type == HCI_BREDR &&
d7a5a11d 438 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 439 rp->index[count++] = cpu_to_le16(d->id);
440 BT_DBG("Added hci%u", d->id);
441 }
442 }
443
444 rp->num_controllers = cpu_to_le16(count);
445 rp_len = sizeof(*rp) + (2 * count);
446
447 read_unlock(&hci_dev_list_lock);
448
2a1afb5a
JH		 449 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
450 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 451
452 kfree(rp);
453
454 return err;
455}
456
96f1474a
MH		 457static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
458 void *data, u16 data_len)
459{
460 struct mgmt_rp_read_ext_index_list *rp;
461 struct hci_dev *d;
462 size_t rp_len;
463 u16 count;
464 int err;
465
466 BT_DBG("sock %p", sk);
467
468 read_lock(&hci_dev_list_lock);
469
470 count = 0;
471 list_for_each_entry(d, &hci_dev_list, list) {
472 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
473 count++;
474 }
475
476 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
477 rp = kmalloc(rp_len, GFP_ATOMIC);
478 if (!rp) {
479 read_unlock(&hci_dev_list_lock);
480 return -ENOMEM;
481 }
482
483 count = 0;
484 list_for_each_entry(d, &hci_dev_list, list) {
485 if (hci_dev_test_flag(d, HCI_SETUP) ||
486 hci_dev_test_flag(d, HCI_CONFIG) ||
487 hci_dev_test_flag(d, HCI_USER_CHANNEL))
488 continue;
489
490 /* Devices marked as raw-only are neither configured
491 * nor unconfigured controllers.
492 */
493 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
494 continue;
495
496 if (d->dev_type == HCI_BREDR) {
497 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
498 rp->entry[count].type = 0x01;
499 else
500 rp->entry[count].type = 0x00;
501 } else if (d->dev_type == HCI_AMP) {
502 rp->entry[count].type = 0x02;
503 } else {
504 continue;
505 }
506
507 rp->entry[count].bus = d->bus;
508 rp->entry[count++].index = cpu_to_le16(d->id);
509 BT_DBG("Added hci%u", d->id);
510 }
511
512 rp->num_controllers = cpu_to_le16(count);
513 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
514
515 read_unlock(&hci_dev_list_lock);
516
517 /* If this command is called at least once, then all the
518 * default index and unconfigured index events are disabled
519 * and from now on only extended index events are used.
520 */
521 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
522 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
523 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
524
525 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
526 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
527
528 kfree(rp);
529
530 return err;
531}
532
dbece37a
MH		 533static bool is_configured(struct hci_dev *hdev)
534{
535 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 536 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 537 return false;
538
539 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
540 !bacmp(&hdev->public_addr, BDADDR_ANY))
541 return false;
542
543 return true;
544}
545
89bc22d2
MH		 546static __le32 get_missing_options(struct hci_dev *hdev)
547{
548 u32 options = 0;
549
dbece37a 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 552 options |= MGMT_OPTION_EXTERNAL_CONFIG;
553
89bc22d2
MH		 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 options |= MGMT_OPTION_PUBLIC_ADDRESS;
557
558 return cpu_to_le32(options);
559}
560
f4537c04
MH		 561static int new_options(struct hci_dev *hdev, struct sock *skip)
562{
563 __le32 options = get_missing_options(hdev);
564
f6b7712e
MH		 565 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
566 sizeof(options), skip);
f4537c04
MH		 567}
568
dbece37a
MH		 569static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
570{
571 __le32 options = get_missing_options(hdev);
572
2a1afb5a
JH		 573 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
574 sizeof(options));
dbece37a
MH		 575}
576
9fc3bfb6
MH		 577static int read_config_info(struct sock *sk, struct hci_dev *hdev,
578 void *data, u16 data_len)
579{
580 struct mgmt_rp_read_config_info rp;
89bc22d2 581 u32 options = 0;
9fc3bfb6
MH		 582
583 BT_DBG("sock %p %s", sk, hdev->name);
584
585 hci_dev_lock(hdev);
586
587 memset(&rp, 0, sizeof(rp));
588 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 589
eb1904f4
MH		 590 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
591 options |= MGMT_OPTION_EXTERNAL_CONFIG;
592
9fc3bfb6 593 if (hdev->set_bdaddr)
89bc22d2
MH		 594 options |= MGMT_OPTION_PUBLIC_ADDRESS;
595
596 rp.supported_options = cpu_to_le32(options);
597 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 598
599 hci_dev_unlock(hdev);
600
2a1afb5a
JH		 601 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
602 &rp, sizeof(rp));
9fc3bfb6
MH		 603}
604
69ab39ea
JH		 605static u32 get_supported_settings(struct hci_dev *hdev)
606{
607 u32 settings = 0;
608
609 settings |= MGMT_SETTING_POWERED;
b2939475 610 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 611 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 612 settings |= MGMT_SETTING_CONNECTABLE;
613 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 614
ed3fa31f 615 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 616 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
617 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 618 settings |= MGMT_SETTING_BREDR;
619 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 620
621 if (lmp_ssp_capable(hdev)) {
622 settings |= MGMT_SETTING_SSP;
623 settings |= MGMT_SETTING_HS;
624 }
e98d2ce2 625
05b3c3e7 626 if (lmp_sc_capable(hdev))
e98d2ce2 627 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 628 }
d7b7e796 629
eeca6f89 630 if (lmp_le_capable(hdev)) {
9d42820f 631 settings |= MGMT_SETTING_LE;
eeca6f89 632 settings |= MGMT_SETTING_ADVERTISING;
a3209694 633 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 634 settings |= MGMT_SETTING_PRIVACY;
93690c22 635 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 636 }
69ab39ea 637
eb1904f4
MH		 638 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
639 hdev->set_bdaddr)
9fc3bfb6
MH		 640 settings |= MGMT_SETTING_CONFIGURATION;
641
69ab39ea
JH		 642 return settings;
643}
644
645static u32 get_current_settings(struct hci_dev *hdev)
646{
647 u32 settings = 0;
648
f1f0eb02 649 if (hdev_is_powered(hdev))
f0d4b78a
MH		 650 settings |= MGMT_SETTING_POWERED;
651
d7a5a11d 652 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 653 settings |= MGMT_SETTING_CONNECTABLE;
654
d7a5a11d 655 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 656 settings |= MGMT_SETTING_FAST_CONNECTABLE;
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 659 settings |= MGMT_SETTING_DISCOVERABLE;
660
d7a5a11d 661 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 662 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 663
d7a5a11d 664 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 665 settings |= MGMT_SETTING_BREDR;
666
d7a5a11d 667 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 668 settings |= MGMT_SETTING_LE;
669
d7a5a11d 670 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 671 settings |= MGMT_SETTING_LINK_SECURITY;
672
d7a5a11d 673 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 674 settings |= MGMT_SETTING_SSP;
675
d7a5a11d 676 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 677 settings |= MGMT_SETTING_HS;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 680 settings |= MGMT_SETTING_ADVERTISING;
681
d7a5a11d 682 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 683 settings |= MGMT_SETTING_SECURE_CONN;
684
d7a5a11d 685 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 686 settings |= MGMT_SETTING_DEBUG_KEYS;
687
d7a5a11d 688 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 689 settings |= MGMT_SETTING_PRIVACY;
690
93690c22
MH		 691 /* The current setting for static address has two purposes. The
692 * first is to indicate if the static address will be used and
693 * the second is to indicate if it is actually set.
694 *
695 * This means if the static address is not configured, this flag
08dc0e98 696 * will never be set. If the address is configured, then if the
93690c22
MH		 697 * address is actually used decides if the flag is set or not.
698 *
699 * For single mode LE only controllers and dual-mode controllers
700 * with BR/EDR disabled, the existence of the static address will
701 * be evaluated.
702 */
b7cb93e5 703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 704 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 705 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
706 if (bacmp(&hdev->static_addr, BDADDR_ANY))
707 settings |= MGMT_SETTING_STATIC_ADDRESS;
708 }
709
69ab39ea
JH		 710 return settings;
711}
712
ef580372
JH		 713#define PNP_INFO_SVCLASS_ID 0x1200
714
213202ed
JH		 715static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
716{
717 u8 *ptr = data, *uuids_start = NULL;
718 struct bt_uuid *uuid;
719
720 if (len < 4)
721 return ptr;
722
723 list_for_each_entry(uuid, &hdev->uuids, list) {
724 u16 uuid16;
725
726 if (uuid->size != 16)
727 continue;
728
729 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
730 if (uuid16 < 0x1100)
731 continue;
732
733 if (uuid16 == PNP_INFO_SVCLASS_ID)
734 continue;
735
736 if (!uuids_start) {
737 uuids_start = ptr;
738 uuids_start[0] = 1;
739 uuids_start[1] = EIR_UUID16_ALL;
740 ptr += 2;
741 }
742
743 /* Stop if not enough space to put next UUID */
744 if ((ptr - data) + sizeof(u16) > len) {
745 uuids_start[1] = EIR_UUID16_SOME;
746 break;
747 }
748
749 *ptr++ = (uuid16 & 0x00ff);
750 *ptr++ = (uuid16 & 0xff00) >> 8;
751 uuids_start[0] += sizeof(uuid16);
752 }
753
754 return ptr;
755}
756
cdf1963f
JH		 757static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
758{
759 u8 *ptr = data, *uuids_start = NULL;
760 struct bt_uuid *uuid;
761
762 if (len < 6)
763 return ptr;
764
765 list_for_each_entry(uuid, &hdev->uuids, list) {
766 if (uuid->size != 32)
767 continue;
768
769 if (!uuids_start) {
770 uuids_start = ptr;
771 uuids_start[0] = 1;
772 uuids_start[1] = EIR_UUID32_ALL;
773 ptr += 2;
774 }
775
776 /* Stop if not enough space to put next UUID */
777 if ((ptr - data) + sizeof(u32) > len) {
778 uuids_start[1] = EIR_UUID32_SOME;
779 break;
780 }
781
782 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
783 ptr += sizeof(u32);
784 uuids_start[0] += sizeof(u32);
785 }
786
787 return ptr;
788}
789
c00d575b
JH		 790static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
791{
792 u8 *ptr = data, *uuids_start = NULL;
793 struct bt_uuid *uuid;
794
795 if (len < 18)
796 return ptr;
797
798 list_for_each_entry(uuid, &hdev->uuids, list) {
799 if (uuid->size != 128)
800 continue;
801
802 if (!uuids_start) {
803 uuids_start = ptr;
804 uuids_start[0] = 1;
805 uuids_start[1] = EIR_UUID128_ALL;
806 ptr += 2;
807 }
808
809 /* Stop if not enough space to put next UUID */
810 if ((ptr - data) + 16 > len) {
811 uuids_start[1] = EIR_UUID128_SOME;
812 break;
813 }
814
815 memcpy(ptr, uuid->uuid, 16);
816 ptr += 16;
817 uuids_start[0] += 16;
818 }
819
820 return ptr;
821}
822
333ae95d
JH		 823static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
824{
825 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
826}
827
333ae95d
JH		 828static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
829 struct hci_dev *hdev,
830 const void *data)
831{
832 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
833}
834
4117ed70 835static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
f14d8f64 836{
7a5f4990
MH		 837 u8 ad_len = 0;
838 size_t name_len;
839
840 name_len = strlen(hdev->dev_name);
841 if (name_len > 0) {
842 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
843
844 if (name_len > max_len) {
845 name_len = max_len;
846 ptr[1] = EIR_NAME_SHORT;
847 } else
848 ptr[1] = EIR_NAME_COMPLETE;
849
850 ptr[0] = name_len + 1;
851
852 memcpy(ptr + 2, hdev->dev_name, name_len);
853
854 ad_len += (name_len + 2);
855 ptr += (name_len + 2);
856 }
857
858 return ad_len;
f14d8f64
MH		 859}
860
4117ed70
AU		 861static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
862{
863 /* TODO: Set the appropriate entries based on advertising instance flags
864 * here once flags other than 0 are supported.
865 */
866 memcpy(ptr, hdev->adv_instance.scan_rsp_data,
867 hdev->adv_instance.scan_rsp_len);
868
869 return hdev->adv_instance.scan_rsp_len;
870}
871
872static void update_scan_rsp_data_for_instance(struct hci_request *req,
873 u8 instance)
f14d8f64
MH		 874{
875 struct hci_dev *hdev = req->hdev;
876 struct hci_cp_le_set_scan_rsp_data cp;
877 u8 len;
878
d7a5a11d 879 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 880 return;
881
882 memset(&cp, 0, sizeof(cp));
883
4117ed70
AU		 884 if (instance)
885 len = create_instance_scan_rsp_data(hdev, cp.data);
886 else
887 len = create_default_scan_rsp_data(hdev, cp.data);
f14d8f64 888
eb438b5f 889 if (hdev->scan_rsp_data_len == len &&
4117ed70 890 !memcmp(cp.data, hdev->scan_rsp_data, len))
f14d8f64
MH		 891 return;
892
eb438b5f
JH		 893 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
894 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 895
896 cp.length = len;
897
898 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
899}
900
4117ed70
AU		 901static void update_scan_rsp_data(struct hci_request *req)
902{
903 struct hci_dev *hdev = req->hdev;
904 u8 instance;
905
906 /* The "Set Advertising" setting supersedes the "Add Advertising"
907 * setting. Here we set the scan response data based on which
908 * setting was set. When neither apply, default to the global settings,
909 * represented by instance "0".
910 */
911 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
912 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
913 instance = 0x01;
914 else
915 instance = 0x00;
916
917 update_scan_rsp_data_for_instance(req, instance);
918}
919
9a43e25f
JH		 920static u8 get_adv_discov_flags(struct hci_dev *hdev)
921{
3b0602cd 922 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 923
924 /* If there's a pending mgmt command the flags will not yet have
925 * their final values, so check for this first.
926 */
333ae95d 927 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 928 if (cmd) {
929 struct mgmt_mode *cp = cmd->param;
930 if (cp->val == 0x01)
931 return LE_AD_GENERAL;
932 else if (cp->val == 0x02)
933 return LE_AD_LIMITED;
934 } else {
d7a5a11d 935 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 936 return LE_AD_LIMITED;
d7a5a11d 937 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 938 return LE_AD_GENERAL;
939 }
940
941 return 0;
942}
943
fdf51784 944static u8 get_current_adv_instance(struct hci_dev *hdev)
441ad2d0 945{
fdf51784
AU		 946 /* The "Set Advertising" setting supersedes the "Add Advertising"
947 * setting. Here we set the advertising data based on which
948 * setting was set. When neither apply, default to the global settings,
949 * represented by instance "0".
950 */
951 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
952 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
953 return 0x01;
441ad2d0 954
fdf51784
AU		 955 return 0x00;
956}
441ad2d0 957
fdf51784
AU		 958static bool get_connectable(struct hci_dev *hdev)
959{
960 struct mgmt_pending_cmd *cmd;
441ad2d0 961
fdf51784
AU		 962 /* If there's a pending mgmt command the flag will not yet have
963 * it's final value, so check for this first.
964 */
965 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
966 if (cmd) {
967 struct mgmt_mode *cp = cmd->param;
441ad2d0 968
fdf51784 969 return cp->val;
441ad2d0
MH		 970 }
971
fdf51784
AU		 972 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
973}
441ad2d0 974
fdf51784
AU		 975static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
976{
977 u32 flags;
441ad2d0 978
fdf51784
AU		 979 if (instance > 0x01)
980 return 0;
981
982 if (instance == 0x01)
983 return hdev->adv_instance.flags;
984
985 /* Instance 0 always manages the "Tx Power" and "Flags" fields */
986 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
987
faccb950
AU		 988 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting corresponds
989 * to the "connectable" instance flag.
990 */
991 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
fdf51784
AU		 992 flags |= MGMT_ADV_FLAG_CONNECTABLE;
993
994 return flags;
441ad2d0
MH		 995}
996
c7d4883b
AU		 997static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance)
998{
999 /* Ignore instance 0 and other unsupported instances */
1000 if (instance != 0x01)
1001 return 0;
1002
1003 /* TODO: Take into account the "appearance" and "local-name" flags here.
1004 * These are currently being ignored as they are not supported.
1005 */
1006 return hdev->adv_instance.scan_rsp_len;
1007}
1008
fdf51784 1009static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
24b4f38f 1010{
b44133ff 1011 u8 ad_len = 0, flags = 0;
fdf51784 1012 u32 instance_flags = get_adv_instance_flags(hdev, instance);
b44133ff 1013
807ec772
AU		 1014 /* The Add Advertising command allows userspace to set both the general
1015 * and limited discoverable flags.
1016 */
fdf51784 1017 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
b44133ff
AU		 1018 flags |= LE_AD_GENERAL;
1019
fdf51784 1020 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
807ec772
AU		 1021 flags |= LE_AD_LIMITED;
1022
fdf51784 1023 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
67e0c0cd
AU		 1024 /* If a discovery flag wasn't provided, simply use the global
1025 * settings.
1026 */
1027 if (!flags)
1028 flags |= get_adv_discov_flags(hdev);
1029
b44133ff
AU		 1030 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1031 flags |= LE_AD_NO_BREDR;
1032
fdf51784
AU		 1033 /* If flags would still be empty, then there is no need to
1034 * include the "Flags" AD field".
1035 */
1036 if (flags) {
1037 ptr[0] = 0x02;
1038 ptr[1] = EIR_FLAGS;
1039 ptr[2] = flags;
b44133ff 1040
fdf51784
AU		 1041 ad_len += 3;
1042 ptr += 3;
1043 }
b44133ff
AU		 1044 }
1045
fdf51784 1046 /* Provide Tx Power only if we can provide a valid value for it */
5507e358 1047 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
fdf51784 1048 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
5507e358
AU		 1049 ptr[0] = 0x02;
1050 ptr[1] = EIR_TX_POWER;
1051 ptr[2] = (u8)hdev->adv_tx_power;
1052
1053 ad_len += 3;
1054 ptr += 3;
1055 }
1056
fdf51784
AU		 1057 if (instance) {
1058 memcpy(ptr, hdev->adv_instance.adv_data,
1059 hdev->adv_instance.adv_data_len);
1060 ad_len += hdev->adv_instance.adv_data_len;
1061 }
24b4f38f 1062
b44133ff 1063 return ad_len;
24b4f38f
AU		 1064}
1065
1066static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
441ad2d0
MH		 1067{
1068 struct hci_dev *hdev = req->hdev;
1069 struct hci_cp_le_set_adv_data cp;
1070 u8 len;
1071
d7a5a11d 1072 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 1073 return;
1074
1075 memset(&cp, 0, sizeof(cp));
1076
fdf51784 1077 len = create_instance_adv_data(hdev, instance, cp.data);
441ad2d0 1078
24b4f38f 1079 /* There's nothing to do if the data hasn't changed */
441ad2d0
MH		 1080 if (hdev->adv_data_len == len &&
1081 memcmp(cp.data, hdev->adv_data, len) == 0)
1082 return;
1083
1084 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1085 hdev->adv_data_len = len;
1086
1087 cp.length = len;
1088
1089 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1090}
1091
e7a685d3
AU		 1092static void update_adv_data(struct hci_request *req)
1093{
1094 struct hci_dev *hdev = req->hdev;
1095 u8 instance = get_current_adv_instance(hdev);
24b4f38f
AU		 1096
1097 update_adv_data_for_instance(req, instance);
1098}
1099
bc6d2d04
JH		 1100int mgmt_update_adv_data(struct hci_dev *hdev)
1101{
1102 struct hci_request req;
1103
1104 hci_req_init(&req, hdev);
1105 update_adv_data(&req);
1106
1107 return hci_req_run(&req, NULL);
1108}
1109
ef580372
JH		 1110static void create_eir(struct hci_dev *hdev, u8 *data)
1111{
1112 u8 *ptr = data;
ef580372
JH		 1113 size_t name_len;
1114
1115 name_len = strlen(hdev->dev_name);
1116
1117 if (name_len > 0) {
1118 /* EIR Data type */
1119 if (name_len > 48) {
1120 name_len = 48;
1121 ptr[1] = EIR_NAME_SHORT;
1122 } else
1123 ptr[1] = EIR_NAME_COMPLETE;
1124
1125 /* EIR Data length */
1126 ptr[0] = name_len + 1;
1127
1128 memcpy(ptr + 2, hdev->dev_name, name_len);
1129
ef580372
JH		 1130 ptr += (name_len + 2);
1131 }
1132
bbaf444a 1133 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 1134 ptr[0] = 2;
1135 ptr[1] = EIR_TX_POWER;
1136 ptr[2] = (u8) hdev->inq_tx_power;
1137
91c4e9b1
MH		 1138 ptr += 3;
1139 }
1140
2b9be137
MH		 1141 if (hdev->devid_source > 0) {
1142 ptr[0] = 9;
1143 ptr[1] = EIR_DEVICE_ID;
1144
1145 put_unaligned_le16(hdev->devid_source, ptr + 2);
1146 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1147 put_unaligned_le16(hdev->devid_product, ptr + 6);
1148 put_unaligned_le16(hdev->devid_version, ptr + 8);
1149
2b9be137
MH		 1150 ptr += 10;
1151 }
1152
213202ed 1153 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 1154 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 1155 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 1156}
1157
890ea898 1158static void update_eir(struct hci_request *req)
ef580372 1159{
890ea898 1160 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1161 struct hci_cp_write_eir cp;
1162
504c8dcd 1163 if (!hdev_is_powered(hdev))
890ea898 1164 return;
7770c4aa 1165
976eb20e 1166 if (!lmp_ext_inq_capable(hdev))
890ea898 1167 return;
ef580372 1168
d7a5a11d 1169 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 1170 return;
ef580372 1171
d7a5a11d 1172 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1173 return;
ef580372
JH		 1174
1175 memset(&cp, 0, sizeof(cp));
1176
1177 create_eir(hdev, cp.data);
1178
1179 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1180 return;
ef580372
JH		 1181
1182 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1183
890ea898 1184 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1185}
1186
1187static u8 get_service_classes(struct hci_dev *hdev)
1188{
1189 struct bt_uuid *uuid;
1190 u8 val = 0;
1191
1192 list_for_each_entry(uuid, &hdev->uuids, list)
1193 val |= uuid->svc_hint;
1194
1195 return val;
1196}
1197
890ea898 1198static void update_class(struct hci_request *req)
ef580372 1199{
890ea898 1200 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1201 u8 cod[3];
1202
1203 BT_DBG("%s", hdev->name);
1204
504c8dcd 1205 if (!hdev_is_powered(hdev))
890ea898 1206 return;
7770c4aa 1207
d7a5a11d 1208 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1209 return;
1210
d7a5a11d 1211 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1212 return;
ef580372
JH		 1213
1214 cod[0] = hdev->minor_class;
1215 cod[1] = hdev->major_class;
1216 cod[2] = get_service_classes(hdev);
1217
d7a5a11d 1218 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1219 cod[1] |= 0x20;
1220
ef580372 1221 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1222 return;
ef580372 1223
890ea898 1224 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1225}
1226
0ec5ae84
JH		 1227static void disable_advertising(struct hci_request *req)
1228{
1229 u8 enable = 0x00;
1230
1231 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1232}
1233
199a2fb1
JH		 1234static void enable_advertising(struct hci_request *req)
1235{
1236 struct hci_dev *hdev = req->hdev;
1237 struct hci_cp_le_set_adv_param cp;
8f2a0601 1238 u8 own_addr_type, enable = 0x01;
a4858cb9 1239 bool connectable;
e7a685d3
AU		 1240 u8 instance;
1241 u32 flags;
199a2fb1 1242
0ec5ae84
JH		 1243 if (hci_conn_num(hdev, LE_LINK) > 0)
1244 return;
1245
d7a5a11d 1246 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1247 disable_advertising(req);
1248
5ce194c4 1249 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1250 * hci_update_random_address knows that it's safe to go ahead
1251 * and write a new random address. The flag will be set back on
1252 * as soon as the SET_ADV_ENABLE HCI command completes.
1253 */
a358dc11 1254 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1255
e7a685d3
AU		 1256 instance = get_current_adv_instance(hdev);
1257 flags = get_adv_instance_flags(hdev, instance);
faccb950
AU		 1258
1259 /* If the "connectable" instance flag was not set, then choose between
1260 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1261 */
1262 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1263 get_connectable(hdev);
8f2a0601 1264
a4858cb9
JH		 1265 /* Set require_privacy to true only when non-connectable
1266 * advertising is used. In that case it is fine to use a
1267 * non-resolvable private address.
1268 */
1269 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1270 return;
1271
41c90c18 1272 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1273 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1274 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
c7d4883b
AU		 1275
1276 if (connectable)
1277 cp.type = LE_ADV_IND;
1278 else if (get_adv_instance_scan_rsp_len(hdev, instance))
1279 cp.type = LE_ADV_SCAN_IND;
1280 else
1281 cp.type = LE_ADV_NONCONN_IND;
1282
8f2a0601 1283 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1284 cp.channel_map = hdev->le_adv_channel_map;
1285
1286 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1287
1288 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1289}
1290
7d78525d
JH		 1291static void service_cache_off(struct work_struct *work)
1292{
1293 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1294 service_cache.work);
890ea898 1295 struct hci_request req;
7d78525d 1296
a69d8927 1297 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1298 return;
1299
890ea898
JH		 1300 hci_req_init(&req, hdev);
1301
7d78525d
JH		 1302 hci_dev_lock(hdev);
1303
890ea898
JH		 1304 update_eir(&req);
1305 update_class(&req);
7d78525d
JH		 1306
1307 hci_dev_unlock(hdev);
890ea898
JH		 1308
1309 hci_req_run(&req, NULL);
7d78525d
JH		 1310}
1311
d6bfd59c
JH		 1312static void rpa_expired(struct work_struct *work)
1313{
1314 struct hci_dev *hdev = container_of(work, struct hci_dev,
1315 rpa_expired.work);
1316 struct hci_request req;
1317
1318 BT_DBG("");
1319
a1536da2 1320 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1321
d7a5a11d 1322 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1323 return;
1324
1325 /* The generation of a new RPA and programming it into the
1326 * controller happens in the enable_advertising() function.
1327 */
d6bfd59c 1328 hci_req_init(&req, hdev);
d6bfd59c 1329 enable_advertising(&req);
d6bfd59c
JH		 1330 hci_req_run(&req, NULL);
1331}
1332
6a919082 1333static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1334{
238be788 1335 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1336 return;
1337
4f87da80 1338 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1339 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1340
4f87da80
JH		 1341 /* Non-mgmt controlled devices get this bit set
1342 * implicitly so that pairing works for them, however
1343 * for mgmt we require user-space to explicitly enable
1344 * it
1345 */
a358dc11 1346 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1347}
1348
0f4e68cf 1349static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1350 void *data, u16 data_len)
0381101f 1351{
a38528f1 1352 struct mgmt_rp_read_info rp;
f7b64e69 1353
bdb6d971 1354 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1355
09fd0de5 1356 hci_dev_lock(hdev);
f7b64e69 1357
dc4fe30b
JH		 1358 memset(&rp, 0, sizeof(rp));
1359
69ab39ea 1360 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1361
69ab39ea 1362 rp.version = hdev->hci_ver;
eb55ef07 1363 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1364
1365 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1366 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1367
a38528f1 1368 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1369
dc4fe30b 1370 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1371 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1372
09fd0de5 1373 hci_dev_unlock(hdev);
0381101f 1374
2a1afb5a
JH		 1375 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1376 sizeof(rp));
0381101f
JH		 1377}
1378
69ab39ea 1379static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1380{
69ab39ea 1381 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1382
2a1afb5a
JH		 1383 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1384 sizeof(settings));
8680570b
JH		 1385}
1386
1904a853 1387static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1388{
1389 BT_DBG("%s status 0x%02x", hdev->name, status);
1390
a3172b7e
JH		 1391 if (hci_conn_count(hdev) == 0) {
1392 cancel_delayed_work(&hdev->power_off);
8b064a3a 1393 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1394 }
8b064a3a
JH		 1395}
1396
23a48093 1397static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1398{
1399 struct hci_dev *hdev = req->hdev;
1400 struct hci_cp_remote_name_req_cancel cp;
1401 struct inquiry_entry *e;
1402
1403 switch (hdev->discovery.state) {
1404 case DISCOVERY_FINDING:
07d2334a 1405 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1406 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1407
1408 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1409 cancel_delayed_work(&hdev->le_scan_disable);
1410 hci_req_add_le_scan_disable(req);
1411 }
1412
23a48093 1413 return true;
21a60d30
JH		 1414
1415 case DISCOVERY_RESOLVING:
1416 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1417 NAME_PENDING);
1418 if (!e)
23a48093 1419 break;
21a60d30
JH		 1420
1421 bacpy(&cp.bdaddr, &e->data.bdaddr);
1422 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1423 &cp);
1424
23a48093 1425 return true;
21a60d30
JH		 1426
1427 default:
1428 /* Passive scanning */
d7a5a11d 1429 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1430 hci_req_add_le_scan_disable(req);
23a48093
JH		 1431 return true;
1432 }
1433
21a60d30
JH		 1434 break;
1435 }
23a48093
JH		 1436
1437 return false;
21a60d30
JH		 1438}
1439
912098a6
AU		 1440static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1441 u8 instance)
1442{
1443 struct mgmt_ev_advertising_added ev;
1444
1445 ev.instance = instance;
1446
1447 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1448}
1449
1450static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1451 u8 instance)
1452{
1453 struct mgmt_ev_advertising_removed ev;
1454
1455 ev.instance = instance;
1456
1457 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1458}
1459
1460static void clear_adv_instance(struct hci_dev *hdev)
1461{
1462 struct hci_request req;
1463
1464 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1465 return;
1466
1467 if (hdev->adv_instance.timeout)
1468 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
1469
1470 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1471 advertising_removed(NULL, hdev, 1);
1472 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1473
1474 if (!hdev_is_powered(hdev) ||
1475 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1476 return;
1477
1478 hci_req_init(&req, hdev);
1479 disable_advertising(&req);
1480 hci_req_run(&req, NULL);
1481}
1482
8b064a3a
JH		 1483static int clean_up_hci_state(struct hci_dev *hdev)
1484{
1485 struct hci_request req;
1486 struct hci_conn *conn;
23a48093
JH		 1487 bool discov_stopped;
1488 int err;
8b064a3a
JH		 1489
1490 hci_req_init(&req, hdev);
1491
1492 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1493 test_bit(HCI_PSCAN, &hdev->flags)) {
1494 u8 scan = 0x00;
1495 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1496 }
1497
912098a6
AU		 1498 if (hdev->adv_instance.timeout)
1499 clear_adv_instance(hdev);
1500
d7a5a11d 1501 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1502 disable_advertising(&req);
1503
23a48093 1504 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1505
1506 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1507 struct hci_cp_disconnect dc;
c9910d0f
JH		 1508 struct hci_cp_reject_conn_req rej;
1509
1510 switch (conn->state) {
1511 case BT_CONNECTED:
1512 case BT_CONFIG:
1513 dc.handle = cpu_to_le16(conn->handle);
1514 dc.reason = 0x15; /* Terminated due to Power Off */
1515 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1516 break;
1517 case BT_CONNECT:
1518 if (conn->type == LE_LINK)
1519 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1520 0, NULL);
1521 else if (conn->type == ACL_LINK)
1522 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1523 6, &conn->dst);
1524 break;
1525 case BT_CONNECT2:
1526 bacpy(&rej.bdaddr, &conn->dst);
1527 rej.reason = 0x15; /* Terminated due to Power Off */
1528 if (conn->type == ACL_LINK)
1529 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1530 sizeof(rej), &rej);
1531 else if (conn->type == SCO_LINK)
1532 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1533 sizeof(rej), &rej);
1534 break;
1535 }
8b064a3a
JH		 1536 }
1537
23a48093
JH		 1538 err = hci_req_run(&req, clean_up_hci_complete);
1539 if (!err && discov_stopped)
1540 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1541
1542 return err;
8b064a3a
JH		 1543}
1544
bdb6d971 1545static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1546 u16 len)
eec8d2bc 1547{
650f726d 1548 struct mgmt_mode *cp = data;
3b0602cd 1549 struct mgmt_pending_cmd *cmd;
4b34ee78 1550 int err;
eec8d2bc 1551
bdb6d971 1552 BT_DBG("request for %s", hdev->name);
eec8d2bc 1553
a7e80f25 1554 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1556 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1557
09fd0de5 1558 hci_dev_lock(hdev);
eec8d2bc 1559
333ae95d 1560 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1561 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1562 MGMT_STATUS_BUSY);
87b95ba6
JH		 1563 goto failed;
1564 }
1565
a69d8927 1566 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1567 cancel_delayed_work(&hdev->power_off);
1568
1569 if (cp->val) {
a1d70450
JH		 1570 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1571 data, len);
1572 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1573 goto failed;
1574 }
1575 }
1576
4b34ee78 1577 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1578 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1579 goto failed;
1580 }
1581
2e58ef3e 1582 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1583 if (!cmd) {
1584 err = -ENOMEM;
eec8d2bc 1585 goto failed;
366a0336 1586 }
eec8d2bc 1587
8b064a3a 1588 if (cp->val) {
19202573 1589 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1590 err = 0;
1591 } else {
1592 /* Disconnect connections, stop scans, etc */
1593 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1594 if (!err)
1595 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1596 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1597
8b064a3a
JH		 1598 /* ENODATA means there were no HCI commands queued */
1599 if (err == -ENODATA) {
a3172b7e 1600 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1601 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1602 err = 0;
1603 }
1604 }
eec8d2bc
JH		 1605
1606failed:
09fd0de5 1607 hci_dev_unlock(hdev);
366a0336 1608 return err;
eec8d2bc
JH		 1609}
1610
beadb2bd
JH		 1611static int new_settings(struct hci_dev *hdev, struct sock *skip)
1612{
f6b7712e 1613 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1614
f6b7712e
MH		 1615 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1616 sizeof(ev), skip);
beadb2bd
JH		 1617}
1618
91a668b0
JH		 1619int mgmt_new_settings(struct hci_dev *hdev)
1620{
1621 return new_settings(hdev, NULL);
1622}
1623
bd99abdd
JH		 1624struct cmd_lookup {
1625 struct sock *sk;
1626 struct hci_dev *hdev;
1627 u8 mgmt_status;
1628};
1629
3b0602cd 1630static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1631{
1632 struct cmd_lookup *match = data;
1633
1634 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1635
1636 list_del(&cmd->list);
1637
1638 if (match->sk == NULL) {
1639 match->sk = cmd->sk;
1640 sock_hold(match->sk);
1641 }
1642
1643 mgmt_pending_free(cmd);
1644}
1645
3b0602cd 1646static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1647{
1648 u8 *status = data;
1649
a69e8375 1650 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1651 mgmt_pending_remove(cmd);
1652}
1653
3b0602cd 1654static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1655{
1656 if (cmd->cmd_complete) {
1657 u8 *status = data;
1658
1659 cmd->cmd_complete(cmd, *status);
1660 mgmt_pending_remove(cmd);
1661
1662 return;
1663 }
1664
1665 cmd_status_rsp(cmd, data);
1666}
1667
3b0602cd 1668static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1669{
2a1afb5a
JH		 1670 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1671 cmd->param, cmd->param_len);
f5818c22
JH		 1672}
1673
3b0602cd 1674static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1675{
2a1afb5a
JH		 1676 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1677 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1678}
1679
e6fe7986
JH		 1680static u8 mgmt_bredr_support(struct hci_dev *hdev)
1681{
1682 if (!lmp_bredr_capable(hdev))
1683 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1684 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1685 return MGMT_STATUS_REJECTED;
1686 else
1687 return MGMT_STATUS_SUCCESS;
1688}
1689
1690static u8 mgmt_le_support(struct hci_dev *hdev)
1691{
1692 if (!lmp_le_capable(hdev))
1693 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1694 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1695 return MGMT_STATUS_REJECTED;
1696 else
1697 return MGMT_STATUS_SUCCESS;
1698}
1699
1904a853
MH		 1700static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1701 u16 opcode)
bfaf8c9f 1702{
3b0602cd 1703 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1704 struct mgmt_mode *cp;
970ba524 1705 struct hci_request req;
bfaf8c9f
JH		 1706 bool changed;
1707
1708 BT_DBG("status 0x%02x", status);
1709
1710 hci_dev_lock(hdev);
1711
333ae95d 1712 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1713 if (!cmd)
1714 goto unlock;
1715
1716 if (status) {
1717 u8 mgmt_err = mgmt_status(status);
a69e8375 1718 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1719 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1720 goto remove_cmd;
1721 }
1722
1723 cp = cmd->param;
d4462a07 1724 if (cp->val) {
238be788 1725 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1726
1727 if (hdev->discov_timeout > 0) {
1728 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1729 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1730 to);
1731 }
1732 } else {
a69d8927 1733 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1734 }
bfaf8c9f
JH		 1735
1736 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1737
1738 if (changed)
1739 new_settings(hdev, cmd->sk);
1740
970ba524
MH		 1741 /* When the discoverable mode gets changed, make sure
1742 * that class of device has the limited discoverable
432df05e
JH		 1743 * bit correctly set. Also update page scan based on whitelist
1744 * entries.
970ba524
MH		 1745 */
1746 hci_req_init(&req, hdev);
1d2dc5b7 1747 __hci_update_page_scan(&req);
970ba524
MH		 1748 update_class(&req);
1749 hci_req_run(&req, NULL);
1750
bfaf8c9f
JH		 1751remove_cmd:
1752 mgmt_pending_remove(cmd);
1753
1754unlock:
1755 hci_dev_unlock(hdev);
1756}
1757
bdb6d971 1758static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1759 u16 len)
73f22f62 1760{
650f726d 1761 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1762 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1763 struct hci_request req;
5e5282bb 1764 u16 timeout;
9a43e25f 1765 u8 scan;
73f22f62
JH		 1766 int err;
1767
bdb6d971 1768 BT_DBG("request for %s", hdev->name);
73f22f62 1769
d7a5a11d
MH		 1770 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1771 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1772 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1773 MGMT_STATUS_REJECTED);
33c525c0 1774
310a3d48 1775 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1776 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1777 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1778
1f350c87 1779 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1780
1781 /* Disabling discoverable requires that no timeout is set,
1782 * and enabling limited discoverable requires a timeout.
1783 */
1784 if ((cp->val == 0x00 && timeout > 0) ||
1785 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1786 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1787 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1788
09fd0de5 1789 hci_dev_lock(hdev);
73f22f62 1790
5e5282bb 1791 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1792 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1793 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1794 goto failed;
1795 }
1796
333ae95d
JH		 1797 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1798 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1800 MGMT_STATUS_BUSY);
73f22f62
JH		 1801 goto failed;
1802 }
1803
d7a5a11d 1804 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1805 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1806 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1807 goto failed;
1808 }
1809
1810 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1811 bool changed = false;
1812
310a3d48
MH		 1813 /* Setting limited discoverable when powered off is
1814 * not a valid operation since it requires a timeout
1815 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1816 */
d7a5a11d 1817 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1818 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1819 changed = true;
1820 }
1821
5e5282bb 1822 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1823 if (err < 0)
1824 goto failed;
1825
1826 if (changed)
1827 err = new_settings(hdev, sk);
1828
5e5282bb
JH		 1829 goto failed;
1830 }
1831
310a3d48
MH		 1832 /* If the current mode is the same, then just update the timeout
1833 * value with the new value. And if only the timeout gets updated,
1834 * then no need for any HCI transactions.
1835 */
d7a5a11d
MH		 1836 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1837 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1838 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1839 cancel_delayed_work(&hdev->discov_off);
1840 hdev->discov_timeout = timeout;
955638ec 1841
36261547
MH		 1842 if (cp->val && hdev->discov_timeout > 0) {
1843 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1844 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1845 to);
955638ec
MH		 1846 }
1847
69ab39ea 1848 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1849 goto failed;
1850 }
1851
2e58ef3e 1852 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1853 if (!cmd) {
1854 err = -ENOMEM;
73f22f62 1855 goto failed;
366a0336 1856 }
73f22f62 1857
310a3d48
MH		 1858 /* Cancel any potential discoverable timeout that might be
1859 * still active and store new timeout value. The arming of
1860 * the timeout happens in the complete handler.
1861 */
1862 cancel_delayed_work(&hdev->discov_off);
1863 hdev->discov_timeout = timeout;
1864
b456f87c
JH		 1865 /* Limited discoverable mode */
1866 if (cp->val == 0x02)
a1536da2 1867 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1868 else
a358dc11 1869 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1870
bfaf8c9f
JH		 1871 hci_req_init(&req, hdev);
1872
9a43e25f
JH		 1873 /* The procedure for LE-only controllers is much simpler - just
1874 * update the advertising data.
1875 */
d7a5a11d 1876 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 1877 goto update_ad;
1878
73f22f62
JH		 1879 scan = SCAN_PAGE;
1880
310a3d48
MH		 1881 if (cp->val) {
1882 struct hci_cp_write_current_iac_lap hci_cp;
1883
1884 if (cp->val == 0x02) {
1885 /* Limited discoverable mode */
33337dcb 1886 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1887 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1888 hci_cp.iac_lap[1] = 0x8b;
1889 hci_cp.iac_lap[2] = 0x9e;
1890 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1891 hci_cp.iac_lap[4] = 0x8b;
1892 hci_cp.iac_lap[5] = 0x9e;
1893 } else {
1894 /* General discoverable mode */
310a3d48
MH		 1895 hci_cp.num_iac = 1;
1896 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1897 hci_cp.iac_lap[1] = 0x8b;
1898 hci_cp.iac_lap[2] = 0x9e;
1899 }
1900
1901 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1902 (hci_cp.num_iac * 3) + 1, &hci_cp);
1903
73f22f62 1904 scan |= SCAN_INQUIRY;
310a3d48 1905 } else {
a358dc11 1906 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 1907 }
73f22f62 1908
310a3d48 1909 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1910
9a43e25f
JH		 1911update_ad:
1912 update_adv_data(&req);
1913
bfaf8c9f 1914 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1915 if (err < 0)
a664b5bc 1916 mgmt_pending_remove(cmd);
73f22f62
JH		 1917
1918failed:
09fd0de5 1919 hci_dev_unlock(hdev);
73f22f62
JH		 1920 return err;
1921}
1922
406d7804
JH		 1923static void write_fast_connectable(struct hci_request *req, bool enable)
1924{
bd98b996 1925 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1926 struct hci_cp_write_page_scan_activity acp;
1927 u8 type;
1928
d7a5a11d 1929 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 1930 return;
1931
4c01f8b8
JH		 1932 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1933 return;
1934
406d7804
JH		 1935 if (enable) {
1936 type = PAGE_SCAN_TYPE_INTERLACED;
1937
1938 /* 160 msec page scan interval */
dcf4adbf 1939 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 1940 } else {
1941 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1942
1943 /* default 1.28 sec page scan */
dcf4adbf 1944 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 1945 }
1946
dcf4adbf 1947 acp.window = cpu_to_le16(0x0012);
406d7804 1948
bd98b996
JH		 1949 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1950 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1951 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1952 sizeof(acp), &acp);
1953
1954 if (hdev->page_scan_type != type)
1955 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1956}
1957
1904a853
MH		 1958static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1959 u16 opcode)
2b76f453 1960{
3b0602cd 1961 struct mgmt_pending_cmd *cmd;
d7b856f9 1962 struct mgmt_mode *cp;
bc6d2d04 1963 bool conn_changed, discov_changed;
2b76f453
JH		 1964
1965 BT_DBG("status 0x%02x", status);
1966
1967 hci_dev_lock(hdev);
1968
333ae95d 1969 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 1970 if (!cmd)
1971 goto unlock;
1972
37438c1f
JH		 1973 if (status) {
1974 u8 mgmt_err = mgmt_status(status);
a69e8375 1975 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 1976 goto remove_cmd;
1977 }
1978
d7b856f9 1979 cp = cmd->param;
bc6d2d04 1980 if (cp->val) {
238be788
MH		 1981 conn_changed = !hci_dev_test_and_set_flag(hdev,
1982 HCI_CONNECTABLE);
bc6d2d04
JH		 1983 discov_changed = false;
1984 } else {
a69d8927
MH		 1985 conn_changed = hci_dev_test_and_clear_flag(hdev,
1986 HCI_CONNECTABLE);
1987 discov_changed = hci_dev_test_and_clear_flag(hdev,
1988 HCI_DISCOVERABLE);
bc6d2d04 1989 }
d7b856f9 1990
2b76f453
JH		 1991 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1992
bc6d2d04 1993 if (conn_changed || discov_changed) {
d7b856f9 1994 new_settings(hdev, cmd->sk);
1d2dc5b7 1995 hci_update_page_scan(hdev);
bc6d2d04
JH		 1996 if (discov_changed)
1997 mgmt_update_adv_data(hdev);
2b7be33e
JH		 1998 hci_update_background_scan(hdev);
1999 }
d7b856f9 2000
37438c1f 2001remove_cmd:
2b76f453
JH		 2002 mgmt_pending_remove(cmd);
2003
2004unlock:
2005 hci_dev_unlock(hdev);
2006}
2007
e8ba3a1f
JH		 2008static int set_connectable_update_settings(struct hci_dev *hdev,
2009 struct sock *sk, u8 val)
2010{
2011 bool changed = false;
2012 int err;
2013
d7a5a11d 2014 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 2015 changed = true;
2016
2017 if (val) {
a1536da2 2018 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 2019 } else {
a358dc11
MH		 2020 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2021 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 2022 }
2023
2024 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2025 if (err < 0)
2026 return err;
2027
562064e6 2028 if (changed) {
1d2dc5b7 2029 hci_update_page_scan(hdev);
562064e6 2030 hci_update_background_scan(hdev);
e8ba3a1f 2031 return new_settings(hdev, sk);
562064e6 2032 }
e8ba3a1f
JH		 2033
2034 return 0;
2035}
2036
bdb6d971 2037static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2038 u16 len)
9fbcbb45 2039{
650f726d 2040 struct mgmt_mode *cp = data;
3b0602cd 2041 struct mgmt_pending_cmd *cmd;
2b76f453 2042 struct hci_request req;
1987fdc7 2043 u8 scan;
9fbcbb45
JH		 2044 int err;
2045
bdb6d971 2046 BT_DBG("request for %s", hdev->name);
9fbcbb45 2047
d7a5a11d
MH		 2048 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2049 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2050 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2051 MGMT_STATUS_REJECTED);
33c525c0 2052
a7e80f25 2053 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2054 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2055 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2056
09fd0de5 2057 hci_dev_lock(hdev);
9fbcbb45 2058
4b34ee78 2059 if (!hdev_is_powered(hdev)) {
e8ba3a1f 2060 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 2061 goto failed;
2062 }
2063
333ae95d
JH		 2064 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2065 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 2066 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2067 MGMT_STATUS_BUSY);
9fbcbb45
JH		 2068 goto failed;
2069 }
2070
2e58ef3e 2071 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 2072 if (!cmd) {
2073 err = -ENOMEM;
9fbcbb45 2074 goto failed;
366a0336 2075 }
9fbcbb45 2076
9b74246f 2077 hci_req_init(&req, hdev);
9fbcbb45 2078
9a43e25f
JH		 2079 /* If BR/EDR is not enabled and we disable advertising as a
2080 * by-product of disabling connectable, we need to update the
2081 * advertising flags.
2082 */
d7a5a11d 2083 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 2084 if (!cp->val) {
a358dc11
MH		 2085 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2086 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 2087 }
2088 update_adv_data(&req);
2089 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 2090 if (cp->val) {
2091 scan = SCAN_PAGE;
2092 } else {
3bd27240
JH		 2093 /* If we don't have any whitelist entries just
2094 * disable all scanning. If there are entries
2095 * and we had both page and inquiry scanning
2096 * enabled then fall back to only page scanning.
2097 * Otherwise no changes are needed.
2098 */
2099 if (list_empty(&hdev->whitelist))
2100 scan = SCAN_DISABLED;
2101 else if (test_bit(HCI_ISCAN, &hdev->flags))
2102 scan = SCAN_PAGE;
2103 else
2104 goto no_scan_update;
9b74246f
JH		 2105
2106 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 2107 hdev->discov_timeout > 0)
9b74246f
JH		 2108 cancel_delayed_work(&hdev->discov_off);
2109 }
2b76f453 2110
9b74246f
JH		 2111 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2112 }
2b76f453 2113
3bd27240 2114no_scan_update:
e8b1202c 2115 /* Update the advertising parameters if necessary */
880897d4
AU		 2116 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2117 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1987fdc7 2118 enable_advertising(&req);
1987fdc7 2119
2b76f453 2120 err = hci_req_run(&req, set_connectable_complete);
9b74246f 2121 if (err < 0) {
a664b5bc 2122 mgmt_pending_remove(cmd);
9b74246f 2123 if (err == -ENODATA)
a81070ba
JH		 2124 err = set_connectable_update_settings(hdev, sk,
2125 cp->val);
9b74246f
JH		 2126 goto failed;
2127 }
9fbcbb45
JH		 2128
2129failed:
09fd0de5 2130 hci_dev_unlock(hdev);
9fbcbb45
JH		 2131 return err;
2132}
2133
b2939475 2134static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2135 u16 len)
c542a06c 2136{
650f726d 2137 struct mgmt_mode *cp = data;
55594356 2138 bool changed;
c542a06c
JH		 2139 int err;
2140
bdb6d971 2141 BT_DBG("request for %s", hdev->name);
c542a06c 2142
a7e80f25 2143 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2144 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2145 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2146
09fd0de5 2147 hci_dev_lock(hdev);
c542a06c
JH		 2148
2149 if (cp->val)
238be788 2150 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 2151 else
a69d8927 2152 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 2153
b2939475 2154 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2155 if (err < 0)
55594356 2156 goto unlock;
c542a06c 2157
55594356
MH		 2158 if (changed)
2159 err = new_settings(hdev, sk);
c542a06c 2160
55594356 2161unlock:
09fd0de5 2162 hci_dev_unlock(hdev);
c542a06c
JH		 2163 return err;
2164}
2165
04124681
GP		 2166static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2167 u16 len)
33ef95ed
JH		 2168{
2169 struct mgmt_mode *cp = data;
3b0602cd 2170 struct mgmt_pending_cmd *cmd;
e6fe7986 2171 u8 val, status;
33ef95ed
JH		 2172 int err;
2173
bdb6d971 2174 BT_DBG("request for %s", hdev->name);
33ef95ed 2175
e6fe7986
JH		 2176 status = mgmt_bredr_support(hdev);
2177 if (status)
a69e8375
JH		 2178 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2179 status);
33c525c0 2180
a7e80f25 2181 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2182 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2183 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2184
33ef95ed
JH		 2185 hci_dev_lock(hdev);
2186
4b34ee78 2187 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2188 bool changed = false;
2189
d7a5a11d 2190 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 2191 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 2192 changed = true;
2193 }
2194
2195 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2196 if (err < 0)
2197 goto failed;
2198
2199 if (changed)
2200 err = new_settings(hdev, sk);
2201
33ef95ed
JH		 2202 goto failed;
2203 }
2204
333ae95d 2205 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 2206 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2207 MGMT_STATUS_BUSY);
33ef95ed
JH		 2208 goto failed;
2209 }
2210
2211 val = !!cp->val;
2212
2213 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2214 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2215 goto failed;
2216 }
2217
2218 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2219 if (!cmd) {
2220 err = -ENOMEM;
2221 goto failed;
2222 }
2223
2224 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2225 if (err < 0) {
2226 mgmt_pending_remove(cmd);
2227 goto failed;
2228 }
2229
2230failed:
2231 hci_dev_unlock(hdev);
33ef95ed
JH		 2232 return err;
2233}
2234
bdb6d971 2235static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2236{
2237 struct mgmt_mode *cp = data;
3b0602cd 2238 struct mgmt_pending_cmd *cmd;
72ef0c1a 2239 u8 status;
ed2c4ee3
JH		 2240 int err;
2241
bdb6d971 2242 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2243
cdba5281
MH		 2244 status = mgmt_bredr_support(hdev);
2245 if (status)
a69e8375 2246 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2247
13ecd8b6 2248 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2249 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2250 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2251
a7e80f25 2252 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2253 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2254 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2255
13ecd8b6 2256 hci_dev_lock(hdev);
6c8f12c1 2257
4b34ee78 2258 if (!hdev_is_powered(hdev)) {
9ecb3e24 2259 bool changed;
c0ecddc2 2260
9ecb3e24 2261 if (cp->val) {
238be788
MH		 2262 changed = !hci_dev_test_and_set_flag(hdev,
2263 HCI_SSP_ENABLED);
9ecb3e24 2264 } else {
a69d8927
MH		 2265 changed = hci_dev_test_and_clear_flag(hdev,
2266 HCI_SSP_ENABLED);
9ecb3e24 2267 if (!changed)
a69d8927
MH		 2268 changed = hci_dev_test_and_clear_flag(hdev,
2269 HCI_HS_ENABLED);
9ecb3e24 2270 else
a358dc11 2271 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2272 }
2273
2274 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2275 if (err < 0)
2276 goto failed;
2277
2278 if (changed)
2279 err = new_settings(hdev, sk);
2280
ed2c4ee3
JH		 2281 goto failed;
2282 }
2283
333ae95d 2284 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2285 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2286 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2287 goto failed;
2288 }
2289
d7a5a11d 2290 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2291 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2292 goto failed;
2293 }
2294
2295 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2296 if (!cmd) {
2297 err = -ENOMEM;
2298 goto failed;
2299 }
2300
d7a5a11d 2301 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2302 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2303 sizeof(cp->val), &cp->val);
2304
72ef0c1a 2305 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2306 if (err < 0) {
2307 mgmt_pending_remove(cmd);
2308 goto failed;
2309 }
2310
2311failed:
2312 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2313 return err;
2314}
2315
bdb6d971 2316static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2317{
2318 struct mgmt_mode *cp = data;
ee392693 2319 bool changed;
e6fe7986 2320 u8 status;
ee392693 2321 int err;
6d80dfd0 2322
bdb6d971 2323 BT_DBG("request for %s", hdev->name);
6d80dfd0 2324
e6fe7986
JH		 2325 status = mgmt_bredr_support(hdev);
2326 if (status)
a69e8375 2327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2328
9ecb3e24 2329 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2330 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2331 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2332
d7a5a11d 2333 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2334 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2335 MGMT_STATUS_REJECTED);
9ecb3e24 2336
a7e80f25 2337 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2339 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2340
ee392693
MH		 2341 hci_dev_lock(hdev);
2342
333ae95d 2343 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2344 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2345 MGMT_STATUS_BUSY);
a2cb01de
JH		 2346 goto unlock;
2347 }
2348
a0cdf960 2349 if (cp->val) {
238be788 2350 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2351 } else {
2352 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2353 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2354 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2355 goto unlock;
2356 }
2357
a69d8927 2358 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2359 }
ee392693
MH		 2360
2361 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2362 if (err < 0)
2363 goto unlock;
2364
2365 if (changed)
2366 err = new_settings(hdev, sk);
6d80dfd0 2367
ee392693
MH		 2368unlock:
2369 hci_dev_unlock(hdev);
2370 return err;
6d80dfd0
JH		 2371}
2372
1904a853 2373static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2374{
2375 struct cmd_lookup match = { NULL, hdev };
2376
3ad67582
JK		 2377 hci_dev_lock(hdev);
2378
416a4ae5
JH		 2379 if (status) {
2380 u8 mgmt_err = mgmt_status(status);
2381
2382 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2383 &mgmt_err);
3ad67582 2384 goto unlock;
416a4ae5
JH		 2385 }
2386
2387 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2388
2389 new_settings(hdev, match.sk);
2390
2391 if (match.sk)
2392 sock_put(match.sk);
441ad2d0
MH		 2393
2394 /* Make sure the controller has a good default for
2395 * advertising data. Restrict the update to when LE
2396 * has actually been enabled. During power on, the
2397 * update in powered_update_hci will take care of it.
2398 */
d7a5a11d 2399 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2400 struct hci_request req;
2401
441ad2d0 2402 hci_req_init(&req, hdev);
5947f4bc 2403 update_adv_data(&req);
f14d8f64 2404 update_scan_rsp_data(&req);
2cf22218 2405 __hci_update_background_scan(&req);
441ad2d0 2406 hci_req_run(&req, NULL);
441ad2d0 2407 }
3ad67582
JK		 2408
2409unlock:
2410 hci_dev_unlock(hdev);
416a4ae5
JH		 2411}
2412
bdb6d971 2413static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2414{
2415 struct mgmt_mode *cp = data;
2416 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2417 struct mgmt_pending_cmd *cmd;
416a4ae5 2418 struct hci_request req;
06199cf8 2419 int err;
0b60eba1 2420 u8 val, enabled;
06199cf8 2421
bdb6d971 2422 BT_DBG("request for %s", hdev->name);
06199cf8 2423
13ecd8b6 2424 if (!lmp_le_capable(hdev))
a69e8375
JH		 2425 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2426 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2427
a7e80f25 2428 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2429 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2430 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2431
e7844ee5
MH		 2432 /* Bluetooth single mode LE only controllers or dual-mode
2433 * controllers configured as LE only devices, do not allow
2434 * switching LE off. These have either LE enabled explicitly
2435 * or BR/EDR has been previously switched off.
2436 *
2437 * When trying to enable an already enabled LE, then gracefully
2438 * send a positive response. Trying to disable it however will
2439 * result into rejection.
2440 */
2441 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2442 if (cp->val == 0x01)
2443 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2444
a69e8375
JH		 2445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2446 MGMT_STATUS_REJECTED);
e7844ee5 2447 }
c73eee91 2448
13ecd8b6 2449 hci_dev_lock(hdev);
06199cf8
JH		 2450
2451 val = !!cp->val;
ffa88e02 2452 enabled = lmp_host_le_capable(hdev);
06199cf8 2453
0b60eba1 2454 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2455 bool changed = false;
2456
d7a5a11d 2457 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2458 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2459 changed = true;
2460 }
2461
d7a5a11d 2462 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2463 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2464 changed = true;
2465 }
2466
06199cf8
JH		 2467 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2468 if (err < 0)
1de028ce 2469 goto unlock;
06199cf8
JH		 2470
2471 if (changed)
2472 err = new_settings(hdev, sk);
2473
1de028ce 2474 goto unlock;
06199cf8
JH		 2475 }
2476
333ae95d
JH		 2477 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2478 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2479 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2480 MGMT_STATUS_BUSY);
1de028ce 2481 goto unlock;
06199cf8
JH		 2482 }
2483
2484 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2485 if (!cmd) {
2486 err = -ENOMEM;
1de028ce 2487 goto unlock;
06199cf8
JH		 2488 }
2489
441ad2d0
MH		 2490 hci_req_init(&req, hdev);
2491
06199cf8
JH		 2492 memset(&hci_cp, 0, sizeof(hci_cp));
2493
2494 if (val) {
2495 hci_cp.le = val;
32226e4f 2496 hci_cp.simul = 0x00;
441ad2d0 2497 } else {
d7a5a11d 2498 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2499 disable_advertising(&req);
06199cf8
JH		 2500 }
2501
416a4ae5
JH		 2502 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2503 &hci_cp);
2504
2505 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2506 if (err < 0)
06199cf8 2507 mgmt_pending_remove(cmd);
06199cf8 2508
1de028ce
JH		 2509unlock:
2510 hci_dev_unlock(hdev);
06199cf8
JH		 2511 return err;
2512}
2513
0cab9c80
JH		 2514/* This is a helper function to test for pending mgmt commands that can
2515 * cause CoD or EIR HCI commands. We can only allow one such pending
2516 * mgmt command at a time since otherwise we cannot easily track what
2517 * the current values are, will be, and based on that calculate if a new
2518 * HCI command needs to be sent and if yes with what value.
2519 */
2520static bool pending_eir_or_class(struct hci_dev *hdev)
2521{
3b0602cd 2522 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2523
2524 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2525 switch (cmd->opcode) {
2526 case MGMT_OP_ADD_UUID:
2527 case MGMT_OP_REMOVE_UUID:
2528 case MGMT_OP_SET_DEV_CLASS:
2529 case MGMT_OP_SET_POWERED:
2530 return true;
2531 }
2532 }
2533
2534 return false;
2535}
2536
83be8eca
JH		 2537static const u8 bluetooth_base_uuid[] = {
2538 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2539 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2540};
2541
2542static u8 get_uuid_size(const u8 *uuid)
2543{
2544 u32 val;
2545
2546 if (memcmp(uuid, bluetooth_base_uuid, 12))
2547 return 128;
2548
2549 val = get_unaligned_le32(&uuid[12]);
2550 if (val > 0xffff)
2551 return 32;
2552
2553 return 16;
2554}
2555
92da6097
JH		 2556static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2557{
3b0602cd 2558 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2559
2560 hci_dev_lock(hdev);
2561
333ae95d 2562 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2563 if (!cmd)
2564 goto unlock;
2565
2a1afb5a
JH		 2566 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2567 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2568
2569 mgmt_pending_remove(cmd);
2570
2571unlock:
2572 hci_dev_unlock(hdev);
2573}
2574
1904a853 2575static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2576{
2577 BT_DBG("status 0x%02x", status);
2578
2579 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2580}
2581
bdb6d971 2582static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2583{
650f726d 2584 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2585 struct mgmt_pending_cmd *cmd;
890ea898 2586 struct hci_request req;
2aeb9a1a 2587 struct bt_uuid *uuid;
2aeb9a1a
JH		 2588 int err;
2589
bdb6d971 2590 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2591
09fd0de5 2592 hci_dev_lock(hdev);
2aeb9a1a 2593
0cab9c80 2594 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2595 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2596 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2597 goto failed;
2598 }
2599
92c4c204 2600 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2601 if (!uuid) {
2602 err = -ENOMEM;
2603 goto failed;
2604 }
2605
2606 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2607 uuid->svc_hint = cp->svc_hint;
83be8eca 2608 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2609
de66aa63 2610 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2611
890ea898 2612 hci_req_init(&req, hdev);
1aff6f09 2613
890ea898
JH		 2614 update_class(&req);
2615 update_eir(&req);
2616
92da6097
JH		 2617 err = hci_req_run(&req, add_uuid_complete);
2618 if (err < 0) {
2619 if (err != -ENODATA)
2620 goto failed;
80a1e1db 2621
2a1afb5a
JH		 2622 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2623 hdev->dev_class, 3);
90e70454
JH		 2624 goto failed;
2625 }
2626
2627 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2628 if (!cmd) {
90e70454 2629 err = -ENOMEM;
890ea898
JH		 2630 goto failed;
2631 }
2632
2633 err = 0;
2aeb9a1a
JH		 2634
2635failed:
09fd0de5 2636 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2637 return err;
2638}
2639
24b78d0f
JH		 2640static bool enable_service_cache(struct hci_dev *hdev)
2641{
2642 if (!hdev_is_powered(hdev))
2643 return false;
2644
238be788 2645 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2646 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2647 CACHE_TIMEOUT);
24b78d0f
JH		 2648 return true;
2649 }
2650
2651 return false;
2652}
2653
1904a853 2654static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2655{
2656 BT_DBG("status 0x%02x", status);
2657
2658 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2659}
2660
bdb6d971 2661static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2662 u16 len)
2aeb9a1a 2663{
650f726d 2664 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2665 struct mgmt_pending_cmd *cmd;
056341c8 2666 struct bt_uuid *match, *tmp;
2aeb9a1a 2667 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2668 struct hci_request req;
2aeb9a1a
JH		 2669 int err, found;
2670
bdb6d971 2671 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2672
09fd0de5 2673 hci_dev_lock(hdev);
2aeb9a1a 2674
0cab9c80 2675 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2677 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2678 goto unlock;
2679 }
2680
2aeb9a1a 2681 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2682 hci_uuids_clear(hdev);
4004b6d9 2683
24b78d0f 2684 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2685 err = mgmt_cmd_complete(sk, hdev->id,
2686 MGMT_OP_REMOVE_UUID,
2687 0, hdev->dev_class, 3);
24b78d0f
JH		 2688 goto unlock;
2689 }
4004b6d9 2690
9246a869 2691 goto update_class;
2aeb9a1a
JH		 2692 }
2693
2694 found = 0;
2695
056341c8 2696 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2697 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2698 continue;
2699
2700 list_del(&match->list);
482049f7 2701 kfree(match);
2aeb9a1a
JH		 2702 found++;
2703 }
2704
2705 if (found == 0) {
a69e8375
JH		 2706 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2707 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2708 goto unlock;
2709 }
2710
9246a869 2711update_class:
890ea898 2712 hci_req_init(&req, hdev);
1aff6f09 2713
890ea898
JH		 2714 update_class(&req);
2715 update_eir(&req);
2716
92da6097
JH		 2717 err = hci_req_run(&req, remove_uuid_complete);
2718 if (err < 0) {
2719 if (err != -ENODATA)
2720 goto unlock;
80a1e1db 2721
2a1afb5a
JH		 2722 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2723 hdev->dev_class, 3);
90e70454
JH		 2724 goto unlock;
2725 }
2726
2727 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2728 if (!cmd) {
90e70454 2729 err = -ENOMEM;
890ea898
JH		 2730 goto unlock;
2731 }
2732
2733 err = 0;
2aeb9a1a
JH		 2734
2735unlock:
09fd0de5 2736 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2737 return err;
2738}
2739
1904a853 2740static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2741{
2742 BT_DBG("status 0x%02x", status);
2743
2744 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2745}
2746
bdb6d971 2747static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2748 u16 len)
1aff6f09 2749{
650f726d 2750 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2751 struct mgmt_pending_cmd *cmd;
890ea898 2752 struct hci_request req;
1aff6f09
JH		 2753 int err;
2754
bdb6d971 2755 BT_DBG("request for %s", hdev->name);
1aff6f09 2756
6203fc98 2757 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2758 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2759 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2760
0cab9c80 2761 hci_dev_lock(hdev);
ee98f473 2762
0cab9c80 2763 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2764 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2765 MGMT_STATUS_BUSY);
0cab9c80
JH		 2766 goto unlock;
2767 }
c95f0ba7 2768
0cab9c80 2769 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2770 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2771 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2772 goto unlock;
2773 }
575b3a02 2774
932f5ff5
JH		 2775 hdev->major_class = cp->major;
2776 hdev->minor_class = cp->minor;
2777
b5235a65 2778 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2779 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2780 hdev->dev_class, 3);
b5235a65
JH		 2781 goto unlock;
2782 }
2783
890ea898
JH		 2784 hci_req_init(&req, hdev);
2785
a69d8927 2786 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2787 hci_dev_unlock(hdev);
2788 cancel_delayed_work_sync(&hdev->service_cache);
2789 hci_dev_lock(hdev);
890ea898 2790 update_eir(&req);
7d78525d 2791 }
14c0b608 2792
890ea898
JH		 2793 update_class(&req);
2794
92da6097
JH		 2795 err = hci_req_run(&req, set_class_complete);
2796 if (err < 0) {
2797 if (err != -ENODATA)
2798 goto unlock;
1aff6f09 2799
2a1afb5a
JH		 2800 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2801 hdev->dev_class, 3);
90e70454
JH		 2802 goto unlock;
2803 }
2804
2805 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2806 if (!cmd) {
90e70454 2807 err = -ENOMEM;
890ea898
JH		 2808 goto unlock;
2809 }
2810
2811 err = 0;
1aff6f09 2812
b5235a65 2813unlock:
09fd0de5 2814 hci_dev_unlock(hdev);
1aff6f09
JH		 2815 return err;
2816}
2817
bdb6d971 2818static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2819 u16 len)
55ed8ca1 2820{
650f726d 2821 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2822 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2823 sizeof(struct mgmt_link_key_info));
4e51eae9 2824 u16 key_count, expected_len;
b1de97d8 2825 bool changed;
a492cd52 2826 int i;
55ed8ca1 2827
9060d5cf
MH		 2828 BT_DBG("request for %s", hdev->name);
2829
2830 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2831 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2832 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2833
1f350c87 2834 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2835 if (key_count > max_key_count) {
2836 BT_ERR("load_link_keys: too big key_count value %u",
2837 key_count);
a69e8375
JH		 2838 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2839 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2840 }
55ed8ca1 2841
86742e1e
JH		 2842 expected_len = sizeof(*cp) + key_count *
2843 sizeof(struct mgmt_link_key_info);
a492cd52 2844 if (expected_len != len) {
86742e1e 2845 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2846 expected_len, len);
a69e8375
JH		 2847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2848 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2849 }
2850
4ae14301 2851 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2852 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2853 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2854
bdb6d971 2855 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2856 key_count);
55ed8ca1 2857
4ee71b20
JH		 2858 for (i = 0; i < key_count; i++) {
2859 struct mgmt_link_key_info *key = &cp->keys[i];
2860
8e991132 2861 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 2862 return mgmt_cmd_status(sk, hdev->id,
2863 MGMT_OP_LOAD_LINK_KEYS,
2864 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2865 }
2866
09fd0de5 2867 hci_dev_lock(hdev);
55ed8ca1
JH		 2868
2869 hci_link_keys_clear(hdev);
2870
55ed8ca1 2871 if (cp->debug_keys)
238be788 2872 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 2873 else
a69d8927
MH		 2874 changed = hci_dev_test_and_clear_flag(hdev,
2875 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 2876
2877 if (changed)
2878 new_settings(hdev, NULL);
55ed8ca1 2879
a492cd52 2880 for (i = 0; i < key_count; i++) {
86742e1e 2881 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2882
58e9293c
JH		 2883 /* Always ignore debug keys and require a new pairing if
2884 * the user wants to use them.
2885 */
2886 if (key->type == HCI_LK_DEBUG_COMBINATION)
2887 continue;
2888
7652ff6a
JH		 2889 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2890 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2891 }
2892
2a1afb5a 2893 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2894
09fd0de5 2895 hci_dev_unlock(hdev);
55ed8ca1 2896
a492cd52 2897 return 0;
55ed8ca1
JH		 2898}
2899
b1078ad0 2900static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2901 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2902{
2903 struct mgmt_ev_device_unpaired ev;
2904
2905 bacpy(&ev.addr.bdaddr, bdaddr);
2906 ev.addr.type = addr_type;
2907
2908 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2909 skip_sk);
b1078ad0
JH		 2910}
2911
bdb6d971 2912static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2913 u16 len)
55ed8ca1 2914{
124f6e35
JH		 2915 struct mgmt_cp_unpair_device *cp = data;
2916 struct mgmt_rp_unpair_device rp;
a8a1d19e 2917 struct hci_cp_disconnect dc;
3b0602cd 2918 struct mgmt_pending_cmd *cmd;
55ed8ca1 2919 struct hci_conn *conn;
55ed8ca1
JH		 2920 int err;
2921
a8a1d19e 2922 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2923 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2924 rp.addr.type = cp->addr.type;
a8a1d19e 2925
4ee71b20 2926 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 2927 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2928 MGMT_STATUS_INVALID_PARAMS,
2929 &rp, sizeof(rp));
4ee71b20 2930
118da70b 2931 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 2932 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2933 MGMT_STATUS_INVALID_PARAMS,
2934 &rp, sizeof(rp));
118da70b 2935
4ee71b20
JH		 2936 hci_dev_lock(hdev);
2937
86a8cfc6 2938 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2939 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2940 MGMT_STATUS_NOT_POWERED, &rp,
2941 sizeof(rp));
86a8cfc6
JH		 2942 goto unlock;
2943 }
2944
e0b2b27e 2945 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2946 /* If disconnection is requested, then look up the
2947 * connection. If the remote device is connected, it
2948 * will be later used to terminate the link.
2949 *
2950 * Setting it to NULL explicitly will cause no
2951 * termination of the link.
2952 */
2953 if (cp->disconnect)
2954 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2955 &cp->addr.bdaddr);
2956 else
2957 conn = NULL;
2958
124f6e35 2959 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2960 } else {
2961 u8 addr_type;
2962
89cbb063
AA		 2963 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2964 &cp->addr.bdaddr);
2965 if (conn) {
2966 /* Defer clearing up the connection parameters
2967 * until closing to give a chance of keeping
2968 * them if a repairing happens.
2969 */
2970 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2971
2972 /* If disconnection is not requested, then
2973 * clear the connection variable so that the
2974 * link is not terminated.
2975 */
2976 if (!cp->disconnect)
2977 conn = NULL;
2978 }
2979
e0b2b27e
JH		 2980 if (cp->addr.type == BDADDR_LE_PUBLIC)
2981 addr_type = ADDR_LE_DEV_PUBLIC;
2982 else
2983 addr_type = ADDR_LE_DEV_RANDOM;
2984
a7ec7338
JH		 2985 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2986
e0b2b27e
JH		 2987 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2988 }
b0dbfb46 2989
55ed8ca1 2990 if (err < 0) {
2a1afb5a
JH		 2991 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2992 MGMT_STATUS_NOT_PAIRED, &rp,
2993 sizeof(rp));
55ed8ca1
JH		 2994 goto unlock;
2995 }
2996
89cbb063
AA		 2997 /* If the connection variable is set, then termination of the
2998 * link is requested.
2999 */
a8a1d19e 3000 if (!conn) {
2a1afb5a
JH		 3001 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3002 &rp, sizeof(rp));
b1078ad0 3003 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3004 goto unlock;
3005 }
55ed8ca1 3006
124f6e35 3007 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3008 sizeof(*cp));
a8a1d19e
JH		 3009 if (!cmd) {
3010 err = -ENOMEM;
3011 goto unlock;
55ed8ca1
JH		 3012 }
3013
d8b7b1e4
JH		 3014 cmd->cmd_complete = addr_cmd_complete;
3015
eb55ef07 3016 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 3017 dc.reason = 0x13; /* Remote User Terminated Connection */
3018 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3019 if (err < 0)
3020 mgmt_pending_remove(cmd);
3021
55ed8ca1 3022unlock:
09fd0de5 3023 hci_dev_unlock(hdev);
55ed8ca1
JH		 3024 return err;
3025}
3026
bdb6d971 3027static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3028 u16 len)
8962ee74 3029{
650f726d 3030 struct mgmt_cp_disconnect *cp = data;
06a63b19 3031 struct mgmt_rp_disconnect rp;
3b0602cd 3032 struct mgmt_pending_cmd *cmd;
8962ee74 3033 struct hci_conn *conn;
8962ee74
JH		 3034 int err;
3035
3036 BT_DBG("");
3037
06a63b19
JH		 3038 memset(&rp, 0, sizeof(rp));
3039 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3040 rp.addr.type = cp->addr.type;
3041
4ee71b20 3042 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3043 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3044 MGMT_STATUS_INVALID_PARAMS,
3045 &rp, sizeof(rp));
4ee71b20 3046
09fd0de5 3047 hci_dev_lock(hdev);
8962ee74
JH		 3048
3049 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3050 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3051 MGMT_STATUS_NOT_POWERED, &rp,
3052 sizeof(rp));
8962ee74
JH		 3053 goto failed;
3054 }
3055
333ae95d 3056 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3057 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3058 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3059 goto failed;
3060 }
3061
591f47f3 3062 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3063 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3064 &cp->addr.bdaddr);
88c3df13
JH		 3065 else
3066 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 3067
f960727e 3068 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3069 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3070 MGMT_STATUS_NOT_CONNECTED, &rp,
3071 sizeof(rp));
8962ee74
JH		 3072 goto failed;
3073 }
3074
2e58ef3e 3075 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3076 if (!cmd) {
3077 err = -ENOMEM;
8962ee74 3078 goto failed;
366a0336 3079 }
8962ee74 3080
f5818c22
JH		 3081 cmd->cmd_complete = generic_cmd_complete;
3082
e3f2f92a 3083 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3084 if (err < 0)
a664b5bc 3085 mgmt_pending_remove(cmd);
8962ee74
JH		 3086
3087failed:
09fd0de5 3088 hci_dev_unlock(hdev);
8962ee74
JH		 3089 return err;
3090}
3091
57c1477c 3092static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3093{
3094 switch (link_type) {
3095 case LE_LINK:
48264f06
JH		 3096 switch (addr_type) {
3097 case ADDR_LE_DEV_PUBLIC:
591f47f3 3098 return BDADDR_LE_PUBLIC;
0ed09148 3099
48264f06 3100 default:
0ed09148 3101 /* Fallback to LE Random address type */
591f47f3 3102 return BDADDR_LE_RANDOM;
48264f06 3103 }
0ed09148 3104
4c659c39 3105 default:
0ed09148 3106 /* Fallback to BR/EDR type */
591f47f3 3107 return BDADDR_BREDR;
4c659c39
JH		 3108 }
3109}
3110
04124681
GP		 3111static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3112 u16 data_len)
2784eb41 3113{
2784eb41 3114 struct mgmt_rp_get_connections *rp;
8035ded4 3115 struct hci_conn *c;
a38528f1 3116 size_t rp_len;
60fc5fb6
JH		 3117 int err;
3118 u16 i;
2784eb41
JH		 3119
3120 BT_DBG("");
3121
09fd0de5 3122 hci_dev_lock(hdev);
2784eb41 3123
5f97c1df 3124 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3125 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3126 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3127 goto unlock;
3128 }
3129
60fc5fb6 3130 i = 0;
b644ba33
JH		 3131 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3132 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3133 i++;
2784eb41
JH		 3134 }
3135
60fc5fb6 3136 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 3137 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 3138 if (!rp) {
2784eb41
JH		 3139 err = -ENOMEM;
3140 goto unlock;
3141 }
3142
2784eb41 3143 i = 0;
4c659c39 3144 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3145 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3146 continue;
4c659c39 3147 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3148 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3149 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3150 continue;
3151 i++;
3152 }
3153
eb55ef07 3154 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3155
4c659c39
JH		 3156 /* Recalculate length in case of filtered SCO connections, etc */
3157 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 3158
2a1afb5a
JH		 3159 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3160 rp_len);
2784eb41 3161
a38528f1 3162 kfree(rp);
5f97c1df
JH		 3163
3164unlock:
09fd0de5 3165 hci_dev_unlock(hdev);
2784eb41
JH		 3166 return err;
3167}
3168
bdb6d971 3169static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3170 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3171{
3b0602cd 3172 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3173 int err;
3174
2e58ef3e 3175 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3176 sizeof(*cp));
96d97a67
WR		 3177 if (!cmd)
3178 return -ENOMEM;
3179
d8457698 3180 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3181 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3182 if (err < 0)
3183 mgmt_pending_remove(cmd);
3184
3185 return err;
3186}
3187
bdb6d971 3188static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3189 u16 len)
980e1a53 3190{
96d97a67 3191 struct hci_conn *conn;
650f726d 3192 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3193 struct hci_cp_pin_code_reply reply;
3b0602cd 3194 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3195 int err;
3196
3197 BT_DBG("");
3198
09fd0de5 3199 hci_dev_lock(hdev);
980e1a53 3200
4b34ee78 3201 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3202 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3203 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3204 goto failed;
3205 }
3206
d8457698 3207 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3208 if (!conn) {
a69e8375
JH		 3209 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3210 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3211 goto failed;
3212 }
3213
3214 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3215 struct mgmt_cp_pin_code_neg_reply ncp;
3216
3217 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3218
3219 BT_ERR("PIN code is not 16 bytes long");
3220
bdb6d971 3221 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3222 if (err >= 0)
a69e8375
JH		 3223 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3224 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3225
3226 goto failed;
3227 }
3228
00abfe44 3229 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3230 if (!cmd) {
3231 err = -ENOMEM;
980e1a53 3232 goto failed;
366a0336 3233 }
980e1a53 3234
7776d1d8
JH		 3235 cmd->cmd_complete = addr_cmd_complete;
3236
d8457698 3237 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3238 reply.pin_len = cp->pin_len;
24718ca5 3239 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3240
3241 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3242 if (err < 0)
a664b5bc 3243 mgmt_pending_remove(cmd);
980e1a53
JH		 3244
3245failed:
09fd0de5 3246 hci_dev_unlock(hdev);
980e1a53
JH		 3247 return err;
3248}
3249
04124681
GP		 3250static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3251 u16 len)
17fa4b9d 3252{
650f726d 3253 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3254
3255 BT_DBG("");
3256
4ec86d4c 3257 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3258 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3259 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3260
09fd0de5 3261 hci_dev_lock(hdev);
17fa4b9d
JH		 3262
3263 hdev->io_capability = cp->io_capability;
3264
3265 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3266 hdev->io_capability);
17fa4b9d 3267
09fd0de5 3268 hci_dev_unlock(hdev);
17fa4b9d 3269
2a1afb5a
JH		 3270 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3271 NULL, 0);
17fa4b9d
JH		 3272}
3273
3b0602cd 3274static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3275{
3276 struct hci_dev *hdev = conn->hdev;
3b0602cd 3277 struct mgmt_pending_cmd *cmd;
e9a416b5 3278
2e58ef3e 3279 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3280 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3281 continue;
3282
e9a416b5
JH		 3283 if (cmd->user_data != conn)
3284 continue;
3285
3286 return cmd;
3287 }
3288
3289 return NULL;
3290}
3291
3b0602cd 3292static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3293{
3294 struct mgmt_rp_pair_device rp;
3295 struct hci_conn *conn = cmd->user_data;
9df74653 3296 int err;
e9a416b5 3297
61b1a7fb
JH		 3298 bacpy(&rp.addr.bdaddr, &conn->dst);
3299 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3300
2a1afb5a
JH		 3301 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3302 status, &rp, sizeof(rp));
e9a416b5
JH		 3303
3304 /* So we don't get further callbacks for this connection */
3305 conn->connect_cfm_cb = NULL;
3306 conn->security_cfm_cb = NULL;
3307 conn->disconn_cfm_cb = NULL;
3308
76a68ba0 3309 hci_conn_drop(conn);
89cbb063
AA		 3310
3311 /* The device is paired so there is no need to remove
3312 * its connection parameters anymore.
3313 */
3314 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3315
3316 hci_conn_put(conn);
9df74653
JH		 3317
3318 return err;
e9a416b5
JH		 3319}
3320
f4a407be
JH		 3321void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3322{
3323 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3324 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3325
3326 cmd = find_pairing(conn);
a511b35b 3327 if (cmd) {
04ab2749 3328 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3329 mgmt_pending_remove(cmd);
3330 }
f4a407be
JH		 3331}
3332
e9a416b5
JH		 3333static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3334{
3b0602cd 3335 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3336
3337 BT_DBG("status %u", status);
3338
3339 cmd = find_pairing(conn);
a511b35b 3340 if (!cmd) {
e9a416b5 3341 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3342 return;
3343 }
3344
3345 cmd->cmd_complete(cmd, mgmt_status(status));
3346 mgmt_pending_remove(cmd);
e9a416b5
JH		 3347}
3348
f4a407be 3349static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3350{
3b0602cd 3351 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3352
3353 BT_DBG("status %u", status);
3354
3355 if (!status)
3356 return;
3357
3358 cmd = find_pairing(conn);
a511b35b 3359 if (!cmd) {
4c47d739 3360 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3361 return;
3362 }
3363
3364 cmd->cmd_complete(cmd, mgmt_status(status));
3365 mgmt_pending_remove(cmd);
4c47d739
VA		 3366}
3367
bdb6d971 3368static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3369 u16 len)
e9a416b5 3370{
650f726d 3371 struct mgmt_cp_pair_device *cp = data;
1425acb7 3372 struct mgmt_rp_pair_device rp;
3b0602cd 3373 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3374 u8 sec_level, auth_type;
3375 struct hci_conn *conn;
e9a416b5
JH		 3376 int err;
3377
3378 BT_DBG("");
3379
f950a30e
SJ		 3380 memset(&rp, 0, sizeof(rp));
3381 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3382 rp.addr.type = cp->addr.type;
3383
4ee71b20 3384 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3385 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3386 MGMT_STATUS_INVALID_PARAMS,
3387 &rp, sizeof(rp));
4ee71b20 3388
4ec86d4c 3389 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3390 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3391 MGMT_STATUS_INVALID_PARAMS,
3392 &rp, sizeof(rp));
4ec86d4c 3393
09fd0de5 3394 hci_dev_lock(hdev);
e9a416b5 3395
5f97c1df 3396 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3397 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3398 MGMT_STATUS_NOT_POWERED, &rp,
3399 sizeof(rp));
5f97c1df
JH		 3400 goto unlock;
3401 }
3402
55e76b38
JH		 3403 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3404 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3405 MGMT_STATUS_ALREADY_PAIRED, &rp,
3406 sizeof(rp));
3407 goto unlock;
3408 }
3409
c908df36 3410 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3411 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3412
6f77d8c7 3413 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3414 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3415 auth_type);
6f77d8c7
AG		 3416 } else {
3417 u8 addr_type;
3418
3419 /* Convert from L2CAP channel address type to HCI address type
3420 */
3421 if (cp->addr.type == BDADDR_LE_PUBLIC)
3422 addr_type = ADDR_LE_DEV_PUBLIC;
3423 else
3424 addr_type = ADDR_LE_DEV_RANDOM;
3425
7c264b10
MH		 3426 /* When pairing a new device, it is expected to remember
3427 * this device for future connections. Adding the connection
3428 * parameter information ahead of time allows tracking
3429 * of the slave preferred values and will speed up any
3430 * further connection establishment.
3431 *
3432 * If connection parameters already exist, then they
3433 * will be kept and this function does nothing.
3434 */
3435 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3436
6f77d8c7 3437 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3438 sec_level, HCI_LE_CONN_TIMEOUT,
3439 HCI_ROLE_MASTER);
6f77d8c7 3440 }
7a512d01 3441
30e76272 3442 if (IS_ERR(conn)) {
489dc48e
AK		 3443 int status;
3444
3445 if (PTR_ERR(conn) == -EBUSY)
3446 status = MGMT_STATUS_BUSY;
faa81030
LR		 3447 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3448 status = MGMT_STATUS_NOT_SUPPORTED;
3449 else if (PTR_ERR(conn) == -ECONNREFUSED)
3450 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3451 else
3452 status = MGMT_STATUS_CONNECT_FAILED;
3453
2a1afb5a
JH		 3454 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3455 status, &rp, sizeof(rp));
e9a416b5
JH		 3456 goto unlock;
3457 }
3458
3459 if (conn->connect_cfm_cb) {
76a68ba0 3460 hci_conn_drop(conn);
2a1afb5a
JH		 3461 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3462 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3463 goto unlock;
3464 }
3465
2e58ef3e 3466 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3467 if (!cmd) {
3468 err = -ENOMEM;
76a68ba0 3469 hci_conn_drop(conn);
e9a416b5
JH		 3470 goto unlock;
3471 }
3472
04ab2749
JH		 3473 cmd->cmd_complete = pairing_complete;
3474
7a512d01 3475 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3476 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3477 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3478 conn->security_cfm_cb = pairing_complete_cb;
3479 conn->disconn_cfm_cb = pairing_complete_cb;
3480 } else {
3481 conn->connect_cfm_cb = le_pairing_complete_cb;
3482 conn->security_cfm_cb = le_pairing_complete_cb;
3483 conn->disconn_cfm_cb = le_pairing_complete_cb;
3484 }
7a512d01 3485
e9a416b5 3486 conn->io_capability = cp->io_cap;
f8aaf9b6 3487 cmd->user_data = hci_conn_get(conn);
e9a416b5 3488
6f78fd4b 3489 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3490 hci_conn_security(conn, sec_level, auth_type, true)) {
3491 cmd->cmd_complete(cmd, 0);
3492 mgmt_pending_remove(cmd);
3493 }
e9a416b5
JH		 3494
3495 err = 0;
3496
3497unlock:
09fd0de5 3498 hci_dev_unlock(hdev);
e9a416b5
JH		 3499 return err;
3500}
3501
04124681
GP		 3502static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3503 u16 len)
28424707 3504{
0f4e68cf 3505 struct mgmt_addr_info *addr = data;
3b0602cd 3506 struct mgmt_pending_cmd *cmd;
28424707
JH		 3507 struct hci_conn *conn;
3508 int err;
3509
3510 BT_DBG("");
3511
28424707
JH		 3512 hci_dev_lock(hdev);
3513
5f97c1df 3514 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3515 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3516 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3517 goto unlock;
3518 }
3519
333ae95d 3520 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3521 if (!cmd) {
a69e8375
JH		 3522 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3523 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3524 goto unlock;
3525 }
3526
3527 conn = cmd->user_data;
3528
3529 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3530 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3531 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3532 goto unlock;
3533 }
3534
a511b35b
JH		 3535 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3536 mgmt_pending_remove(cmd);
28424707 3537
2a1afb5a
JH		 3538 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3539 addr, sizeof(*addr));
28424707
JH		 3540unlock:
3541 hci_dev_unlock(hdev);
28424707
JH		 3542 return err;
3543}
3544
bdb6d971 3545static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3546 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3547 u16 hci_op, __le32 passkey)
a5c29683 3548{
3b0602cd 3549 struct mgmt_pending_cmd *cmd;
0df4c185 3550 struct hci_conn *conn;
a5c29683
JH		 3551 int err;
3552
09fd0de5 3553 hci_dev_lock(hdev);
08ba5382 3554
4b34ee78 3555 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3556 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3557 MGMT_STATUS_NOT_POWERED, addr,
3558 sizeof(*addr));
0df4c185 3559 goto done;
a5c29683
JH		 3560 }
3561
1707c60e
JH		 3562 if (addr->type == BDADDR_BREDR)
3563 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3564 else
1707c60e 3565 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3566
3567 if (!conn) {
2a1afb5a
JH		 3568 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3569 MGMT_STATUS_NOT_CONNECTED, addr,
3570 sizeof(*addr));
272d90df
JH		 3571 goto done;
3572 }
47c15e2b 3573
1707c60e 3574 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3575 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3576 if (!err)
2a1afb5a
JH		 3577 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3578 MGMT_STATUS_SUCCESS, addr,
3579 sizeof(*addr));
5fe57d9e 3580 else
2a1afb5a
JH		 3581 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3582 MGMT_STATUS_FAILED, addr,
3583 sizeof(*addr));
47c15e2b 3584
47c15e2b
BG		 3585 goto done;
3586 }
3587
1707c60e 3588 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3589 if (!cmd) {
3590 err = -ENOMEM;
0df4c185 3591 goto done;
a5c29683
JH		 3592 }
3593
7776d1d8
JH		 3594 cmd->cmd_complete = addr_cmd_complete;
3595
0df4c185 3596 /* Continue with pairing via HCI */
604086b7
BG		 3597 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3598 struct hci_cp_user_passkey_reply cp;
3599
1707c60e 3600 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3601 cp.passkey = passkey;
3602 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3603 } else
1707c60e
JH		 3604 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3605 &addr->bdaddr);
604086b7 3606
a664b5bc
JH		 3607 if (err < 0)
3608 mgmt_pending_remove(cmd);
a5c29683 3609
0df4c185 3610done:
09fd0de5 3611 hci_dev_unlock(hdev);
a5c29683
JH		 3612 return err;
3613}
3614
afeb019d
JK		 3615static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3616 void *data, u16 len)
3617{
3618 struct mgmt_cp_pin_code_neg_reply *cp = data;
3619
3620 BT_DBG("");
3621
1707c60e 3622 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3623 MGMT_OP_PIN_CODE_NEG_REPLY,
3624 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3625}
3626
04124681
GP		 3627static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3628 u16 len)
0df4c185 3629{
650f726d 3630 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3631
3632 BT_DBG("");
3633
3634 if (len != sizeof(*cp))
a69e8375
JH		 3635 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3636 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3637
1707c60e 3638 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3639 MGMT_OP_USER_CONFIRM_REPLY,
3640 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3641}
3642
bdb6d971 3643static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3644 void *data, u16 len)
0df4c185 3645{
c9c2659f 3646 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3647
3648 BT_DBG("");
3649
1707c60e 3650 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3651 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3652 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3653}
3654
04124681
GP		 3655static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3656 u16 len)
604086b7 3657{
650f726d 3658 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3659
3660 BT_DBG("");
3661
1707c60e 3662 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3663 MGMT_OP_USER_PASSKEY_REPLY,
3664 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3665}
3666
bdb6d971 3667static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3668 void *data, u16 len)
604086b7 3669{
650f726d 3670 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3671
3672 BT_DBG("");
3673
1707c60e 3674 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3675 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3676 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3677}
3678
13928971 3679static void update_name(struct hci_request *req)
2b4bf397 3680{
13928971 3681 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3682 struct hci_cp_write_local_name cp;
3683
13928971 3684 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3685
890ea898 3686 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3687}
3688
1904a853 3689static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3690{
3691 struct mgmt_cp_set_local_name *cp;
3b0602cd 3692 struct mgmt_pending_cmd *cmd;
13928971
JH		 3693
3694 BT_DBG("status 0x%02x", status);
3695
3696 hci_dev_lock(hdev);
3697
333ae95d 3698 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3699 if (!cmd)
3700 goto unlock;
3701
3702 cp = cmd->param;
3703
3704 if (status)
a69e8375
JH		 3705 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3706 mgmt_status(status));
13928971 3707 else
2a1afb5a
JH		 3708 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3709 cp, sizeof(*cp));
13928971
JH		 3710
3711 mgmt_pending_remove(cmd);
3712
3713unlock:
3714 hci_dev_unlock(hdev);
3715}
3716
bdb6d971 3717static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3718 u16 len)
b312b161 3719{
2b4bf397 3720 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3721 struct mgmt_pending_cmd *cmd;
890ea898 3722 struct hci_request req;
b312b161
JH		 3723 int err;
3724
3725 BT_DBG("");
3726
09fd0de5 3727 hci_dev_lock(hdev);
b312b161 3728
b3f2ca94
JH		 3729 /* If the old values are the same as the new ones just return a
3730 * direct command complete event.
3731 */
3732 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3733 !memcmp(hdev->short_name, cp->short_name,
3734 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3735 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3736 data, len);
b3f2ca94
JH		 3737 goto failed;
3738 }
3739
2b4bf397 3740 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3741
b5235a65 3742 if (!hdev_is_powered(hdev)) {
2b4bf397 3743 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3744
2a1afb5a
JH		 3745 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3746 data, len);
28cc7bde
JH		 3747 if (err < 0)
3748 goto failed;
3749
f6b7712e
MH		 3750 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3751 data, len, sk);
28cc7bde 3752
b5235a65
JH		 3753 goto failed;
3754 }
3755
28cc7bde 3756 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3757 if (!cmd) {
3758 err = -ENOMEM;
3759 goto failed;
3760 }
3761
13928971
JH		 3762 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3763
890ea898 3764 hci_req_init(&req, hdev);
3f985050
JH		 3765
3766 if (lmp_bredr_capable(hdev)) {
3767 update_name(&req);
3768 update_eir(&req);
3769 }
3770
7a5f4990
MH		 3771 /* The name is stored in the scan response data and so
3772 * no need to udpate the advertising data here.
3773 */
3f985050 3774 if (lmp_le_capable(hdev))
7a5f4990 3775 update_scan_rsp_data(&req);
3f985050 3776
13928971 3777 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3778 if (err < 0)
3779 mgmt_pending_remove(cmd);
3780
3781failed:
09fd0de5 3782 hci_dev_unlock(hdev);
b312b161
JH		 3783 return err;
3784}
3785
0f4e68cf 3786static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3787 void *data, u16 data_len)
c35938b2 3788{
3b0602cd 3789 struct mgmt_pending_cmd *cmd;
c35938b2
SJ		 3790 int err;
3791
bdb6d971 3792 BT_DBG("%s", hdev->name);
c35938b2 3793
09fd0de5 3794 hci_dev_lock(hdev);
c35938b2 3795
4b34ee78 3796 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3797 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3798 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3799 goto unlock;
3800 }
3801
9a1a1996 3802 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3803 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3804 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3805 goto unlock;
3806 }
3807
333ae95d 3808 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 3809 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3810 MGMT_STATUS_BUSY);
c35938b2
SJ		 3811 goto unlock;
3812 }
3813
2e58ef3e 3814 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3815 if (!cmd) {
3816 err = -ENOMEM;
3817 goto unlock;
3818 }
3819
710f11c0 3820 if (bredr_sc_enabled(hdev))
4d2d2796
MH		 3821 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3822 0, NULL);
3823 else
3824 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3825
c35938b2
SJ		 3826 if (err < 0)
3827 mgmt_pending_remove(cmd);
3828
3829unlock:
09fd0de5 3830 hci_dev_unlock(hdev);
c35938b2
SJ		 3831 return err;
3832}
3833
bdb6d971 3834static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3835 void *data, u16 len)
2763eda6 3836{
5d57e796 3837 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3838 int err;
3839
bdb6d971 3840 BT_DBG("%s ", hdev->name);
2763eda6 3841
5d57e796 3842 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 3843 return mgmt_cmd_complete(sk, hdev->id,
3844 MGMT_OP_ADD_REMOTE_OOB_DATA,
3845 MGMT_STATUS_INVALID_PARAMS,
3846 addr, sizeof(*addr));
5d57e796 3847
09fd0de5 3848 hci_dev_lock(hdev);
2763eda6 3849
ec109113
MH		 3850 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3851 struct mgmt_cp_add_remote_oob_data *cp = data;
3852 u8 status;
bf1e3541 3853
c19a495c 3854 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 3855 err = mgmt_cmd_complete(sk, hdev->id,
3856 MGMT_OP_ADD_REMOTE_OOB_DATA,
3857 MGMT_STATUS_INVALID_PARAMS,
3858 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 3859 goto unlock;
3860 }
3861
ec109113 3862 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 3863 cp->addr.type, cp->hash,
3864 cp->rand, NULL, NULL);
ec109113
MH		 3865 if (err < 0)
3866 status = MGMT_STATUS_FAILED;
3867 else
3868 status = MGMT_STATUS_SUCCESS;
3869
2a1afb5a
JH		 3870 err = mgmt_cmd_complete(sk, hdev->id,
3871 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3872 &cp->addr, sizeof(cp->addr));
ec109113
MH		 3873 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3874 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 3875 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 3876 u8 status;
3877
86df9200 3878 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 3879 /* Enforce zero-valued 192-bit parameters as
3880 * long as legacy SMP OOB isn't implemented.
3881 */
3882 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3883 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 3884 err = mgmt_cmd_complete(sk, hdev->id,
3885 MGMT_OP_ADD_REMOTE_OOB_DATA,
3886 MGMT_STATUS_INVALID_PARAMS,
3887 addr, sizeof(*addr));
d25b78e2
JH		 3888 goto unlock;
3889 }
3890
86df9200
JH		 3891 rand192 = NULL;
3892 hash192 = NULL;
3893 } else {
41bcfd50
MH		 3894 /* In case one of the P-192 values is set to zero,
3895 * then just disable OOB data for P-192.
3896 */
3897 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3898 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3899 rand192 = NULL;
3900 hash192 = NULL;
3901 } else {
3902 rand192 = cp->rand192;
3903 hash192 = cp->hash192;
3904 }
3905 }
3906
3907 /* In case one of the P-256 values is set to zero, then just
3908 * disable OOB data for P-256.
3909 */
3910 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3911 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3912 rand256 = NULL;
3913 hash256 = NULL;
3914 } else {
3915 rand256 = cp->rand256;
3916 hash256 = cp->hash256;
86df9200
JH		 3917 }
3918
81328d5c 3919 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 3920 cp->addr.type, hash192, rand192,
41bcfd50 3921 hash256, rand256);
ec109113
MH		 3922 if (err < 0)
3923 status = MGMT_STATUS_FAILED;
3924 else
3925 status = MGMT_STATUS_SUCCESS;
3926
2a1afb5a
JH		 3927 err = mgmt_cmd_complete(sk, hdev->id,
3928 MGMT_OP_ADD_REMOTE_OOB_DATA,
3929 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 3930 } else {
3931 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 3932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3933 MGMT_STATUS_INVALID_PARAMS);
ec109113 3934 }
2763eda6 3935
c19a495c 3936unlock:
09fd0de5 3937 hci_dev_unlock(hdev);
2763eda6
SJ		 3938 return err;
3939}
3940
bdb6d971 3941static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3942 void *data, u16 len)
2763eda6 3943{
650f726d 3944 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3945 u8 status;
2763eda6
SJ		 3946 int err;
3947
bdb6d971 3948 BT_DBG("%s", hdev->name);
2763eda6 3949
c19a495c 3950 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 3951 return mgmt_cmd_complete(sk, hdev->id,
3952 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3953 MGMT_STATUS_INVALID_PARAMS,
3954 &cp->addr, sizeof(cp->addr));
c19a495c 3955
09fd0de5 3956 hci_dev_lock(hdev);
2763eda6 3957
eedbd581
JH		 3958 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3959 hci_remote_oob_data_clear(hdev);
3960 status = MGMT_STATUS_SUCCESS;
3961 goto done;
3962 }
3963
6928a924 3964 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 3965 if (err < 0)
bf1e3541 3966 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3967 else
a6785be2 3968 status = MGMT_STATUS_SUCCESS;
bf1e3541 3969
eedbd581 3970done:
2a1afb5a
JH		 3971 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3972 status, &cp->addr, sizeof(cp->addr));
2763eda6 3973
09fd0de5 3974 hci_dev_unlock(hdev);
2763eda6
SJ		 3975 return err;
3976}
3977
812abb13 3978static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 3979{
8019044d 3980 struct hci_dev *hdev = req->hdev;
812abb13 3981 struct hci_cp_inquiry cp;
8019044d
MH		 3982 /* General inquiry access code (GIAC) */
3983 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 3984
3985 *status = mgmt_bredr_support(hdev);
3986 if (*status)
3987 return false;
3988
3989 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3990 *status = MGMT_STATUS_BUSY;
3991 return false;
3992 }
3993
3994 hci_inquiry_cache_flush(hdev);
3995
3996 memset(&cp, 0, sizeof(cp));
3997 memcpy(&cp.lap, lap, sizeof(cp.lap));
3998 cp.length = DISCOV_BREDR_INQUIRY_LEN;
3999
4000 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4001
4002 return true;
4003}
4004
4005static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4006{
4007 struct hci_dev *hdev = req->hdev;
4008 struct hci_cp_le_set_scan_param param_cp;
4009 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 4010 u8 own_addr_type;
41dc2bd6
AG		 4011 int err;
4012
812abb13
JP		 4013 *status = mgmt_le_support(hdev);
4014 if (*status)
4015 return false;
41dc2bd6 4016
812abb13
JP		 4017 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4018 /* Don't let discovery abort an outgoing connection attempt
4019 * that's using directed advertising.
4020 */
4021 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4022 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 4023 return false;
4024 }
41dc2bd6 4025
812abb13
JP		 4026 disable_advertising(req);
4027 }
41dc2bd6 4028
812abb13
JP		 4029 /* If controller is scanning, it means the background scanning is
4030 * running. Thus, we should temporarily stop it in order to set the
4031 * discovery scanning parameters.
4032 */
4033 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4034 hci_req_add_le_scan_disable(req);
41dc2bd6 4035
812abb13
JP		 4036 /* All active scans will be done with either a resolvable private
4037 * address (when privacy feature has been enabled) or non-resolvable
4038 * private address.
4039 */
4040 err = hci_update_random_address(req, true, &own_addr_type);
4041 if (err < 0) {
4042 *status = MGMT_STATUS_FAILED;
4043 return false;
4044 }
8019044d 4045
812abb13
JP		 4046 memset(&param_cp, 0, sizeof(param_cp));
4047 param_cp.type = LE_SCAN_ACTIVE;
4048 param_cp.interval = cpu_to_le16(interval);
4049 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4050 param_cp.own_address_type = own_addr_type;
8019044d 4051
812abb13
JP		 4052 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4053 &param_cp);
8019044d 4054
812abb13
JP		 4055 memset(&enable_cp, 0, sizeof(enable_cp));
4056 enable_cp.enable = LE_SCAN_ENABLE;
4057 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 4058
812abb13
JP		 4059 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4060 &enable_cp);
4061
4062 return true;
4063}
8019044d 4064
812abb13
JP		 4065static bool trigger_discovery(struct hci_request *req, u8 *status)
4066{
4067 struct hci_dev *hdev = req->hdev;
8019044d 4068
812abb13
JP		 4069 switch (hdev->discovery.type) {
4070 case DISCOV_TYPE_BREDR:
4071 if (!trigger_bredr_inquiry(req, status))
4072 return false;
4073 break;
4074
4075 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4076 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4077 &hdev->quirks)) {
4078 /* During simultaneous discovery, we double LE scan
4079 * interval. We must leave some time for the controller
4080 * to do BR/EDR inquiry.
4081 */
4082 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4083 status))
4084 return false;
4085
4086 if (!trigger_bredr_inquiry(req, status))
4087 return false;
4088
4089 return true;
4090 }
4091
812abb13
JP		 4092 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4093 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 4094 return false;
4095 }
812abb13 4096 /* fall through */
8019044d 4097
812abb13
JP		 4098 case DISCOV_TYPE_LE:
4099 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4100 return false;
8019044d
MH		 4101 break;
4102
4103 default:
4104 *status = MGMT_STATUS_INVALID_PARAMS;
4105 return false;
4106 }
4107
4108 return true;
41dc2bd6
AG		 4109}
4110
1904a853
MH		 4111static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4112 u16 opcode)
7c307720 4113{
3b0602cd 4114 struct mgmt_pending_cmd *cmd;
11e6e25d 4115 unsigned long timeout;
ae55f598 4116
7c307720
AG		 4117 BT_DBG("status %d", status);
4118
11e6e25d 4119 hci_dev_lock(hdev);
41dc2bd6 4120
333ae95d 4121 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 4122 if (!cmd)
333ae95d 4123 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 4124
11e6e25d 4125 if (cmd) {
2922a94f 4126 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 4127 mgmt_pending_remove(cmd);
4128 }
7c307720
AG		 4129
4130 if (status) {
11e6e25d
MH		 4131 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4132 goto unlock;
7c307720
AG		 4133 }
4134
7c307720 4135 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 4136
2d28cfe7
JP		 4137 /* If the scan involves LE scan, pick proper timeout to schedule
4138 * hdev->le_scan_disable that will stop it.
4139 */
7c307720
AG		 4140 switch (hdev->discovery.type) {
4141 case DISCOV_TYPE_LE:
3d5a76f0 4142 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 4143 break;
7c307720 4144 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4145 /* When running simultaneous discovery, the LE scanning time
4146 * should occupy the whole discovery time sine BR/EDR inquiry
4147 * and LE scanning are scheduled by the controller.
4148 *
4149 * For interleaving discovery in comparison, BR/EDR inquiry
4150 * and LE scanning are done sequentially with separate
4151 * timeouts.
4152 */
4153 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4154 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4155 else
4156 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 4157 break;
7c307720 4158 case DISCOV_TYPE_BREDR:
11e6e25d 4159 timeout = 0;
7c307720 4160 break;
7c307720
AG		 4161 default:
4162 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 4163 timeout = 0;
4164 break;
7c307720 4165 }
ae55f598 4166
2d28cfe7
JP		 4167 if (timeout) {
4168 /* When service discovery is used and the controller has
4169 * a strict duplicate filter, it is important to remember
4170 * the start and duration of the scan. This is required
4171 * for restarting scanning during the discovery phase.
4172 */
4173 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4174 &hdev->quirks) &&
82f8b651 4175 hdev->discovery.result_filtering) {
2d28cfe7
JP		 4176 hdev->discovery.scan_start = jiffies;
4177 hdev->discovery.scan_duration = timeout;
4178 }
4179
11e6e25d
MH		 4180 queue_delayed_work(hdev->workqueue,
4181 &hdev->le_scan_disable, timeout);
2d28cfe7 4182 }
ae55f598 4183
11e6e25d
MH		 4184unlock:
4185 hci_dev_unlock(hdev);
7c307720
AG		 4186}
4187
bdb6d971 4188static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 4189 void *data, u16 len)
14a53664 4190{
650f726d 4191 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 4192 struct mgmt_pending_cmd *cmd;
7c307720 4193 struct hci_request req;
8019044d 4194 u8 status;
14a53664
JH		 4195 int err;
4196
bdb6d971 4197 BT_DBG("%s", hdev->name);
14a53664 4198
09fd0de5 4199 hci_dev_lock(hdev);
14a53664 4200
4b34ee78 4201 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4202 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4203 MGMT_STATUS_NOT_POWERED,
4204 &cp->type, sizeof(cp->type));
bd2d1334
JH		 4205 goto failed;
4206 }
4207
f5a969f2 4208 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4209 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4210 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4211 MGMT_STATUS_BUSY, &cp->type,
4212 sizeof(cp->type));
642be6c7
AG		 4213 goto failed;
4214 }
4215
2922a94f 4216 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 4217 if (!cmd) {
4218 err = -ENOMEM;
4219 goto failed;
4220 }
4221
2922a94f
JH		 4222 cmd->cmd_complete = generic_cmd_complete;
4223
22078800
MH		 4224 /* Clear the discovery filter first to free any previously
4225 * allocated memory for the UUID list.
4226 */
4227 hci_discovery_filter_clear(hdev);
4228
4aab14e5 4229 hdev->discovery.type = cp->type;
da25cf6a 4230 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4231
7c307720
AG		 4232 hci_req_init(&req, hdev);
4233
8019044d 4234 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4235 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4236 status, &cp->type, sizeof(cp->type));
04106755
JH		 4237 mgmt_pending_remove(cmd);
4238 goto failed;
f39799f5 4239 }
04106755 4240
7c307720 4241 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4242 if (err < 0) {
14a53664 4243 mgmt_pending_remove(cmd);
f5a969f2
MH		 4244 goto failed;
4245 }
7c307720 4246
f5a969f2 4247 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4248
14a53664 4249failed:
09fd0de5 4250 hci_dev_unlock(hdev);
14a53664
JH		 4251 return err;
4252}
f39799f5 4253
3b0602cd
JH		 4254static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4255 u8 status)
2922a94f 4256{
2a1afb5a
JH		 4257 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4258 cmd->param, 1);
2922a94f 4259}
04106755 4260
66ea9427
JP		 4261static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4262 void *data, u16 len)
4263{
4264 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4265 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4266 struct hci_request req;
4267 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4268 u16 uuid_count, expected_len;
4269 u8 status;
4270 int err;
04106755 4271
66ea9427 4272 BT_DBG("%s", hdev->name);
e8bb6b97 4273
66ea9427 4274 hci_dev_lock(hdev);
7c307720 4275
66ea9427 4276 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4277 err = mgmt_cmd_complete(sk, hdev->id,
4278 MGMT_OP_START_SERVICE_DISCOVERY,
4279 MGMT_STATUS_NOT_POWERED,
4280 &cp->type, sizeof(cp->type));
66ea9427
JP		 4281 goto failed;
4282 }
7c307720 4283
66ea9427 4284 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4285 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4286 err = mgmt_cmd_complete(sk, hdev->id,
4287 MGMT_OP_START_SERVICE_DISCOVERY,
4288 MGMT_STATUS_BUSY, &cp->type,
4289 sizeof(cp->type));
66ea9427
JP		 4290 goto failed;
4291 }
d9483943 4292
66ea9427
JP		 4293 uuid_count = __le16_to_cpu(cp->uuid_count);
4294 if (uuid_count > max_uuid_count) {
4295 BT_ERR("service_discovery: too big uuid_count value %u",
4296 uuid_count);
2a1afb5a
JH		 4297 err = mgmt_cmd_complete(sk, hdev->id,
4298 MGMT_OP_START_SERVICE_DISCOVERY,
4299 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4300 sizeof(cp->type));
66ea9427
JP		 4301 goto failed;
4302 }
4303
4304 expected_len = sizeof(*cp) + uuid_count * 16;
4305 if (expected_len != len) {
4306 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4307 expected_len, len);
2a1afb5a
JH		 4308 err = mgmt_cmd_complete(sk, hdev->id,
4309 MGMT_OP_START_SERVICE_DISCOVERY,
4310 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4311 sizeof(cp->type));
66ea9427
JP		 4312 goto failed;
4313 }
4314
4315 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4316 hdev, data, len);
66ea9427
JP		 4317 if (!cmd) {
4318 err = -ENOMEM;
4319 goto failed;
4320 }
4321
2922a94f
JH		 4322 cmd->cmd_complete = service_discovery_cmd_complete;
4323
22078800
MH		 4324 /* Clear the discovery filter first to free any previously
4325 * allocated memory for the UUID list.
4326 */
4327 hci_discovery_filter_clear(hdev);
4328
82f8b651 4329 hdev->discovery.result_filtering = true;
66ea9427
JP		 4330 hdev->discovery.type = cp->type;
4331 hdev->discovery.rssi = cp->rssi;
4332 hdev->discovery.uuid_count = uuid_count;
4333
4334 if (uuid_count > 0) {
4335 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4336 GFP_KERNEL);
4337 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4338 err = mgmt_cmd_complete(sk, hdev->id,
4339 MGMT_OP_START_SERVICE_DISCOVERY,
4340 MGMT_STATUS_FAILED,
4341 &cp->type, sizeof(cp->type));
d9483943
JH		 4342 mgmt_pending_remove(cmd);
4343 goto failed;
4344 }
66ea9427 4345 }
d9483943 4346
66ea9427 4347 hci_req_init(&req, hdev);
5e0452c0 4348
66ea9427 4349 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4350 err = mgmt_cmd_complete(sk, hdev->id,
4351 MGMT_OP_START_SERVICE_DISCOVERY,
4352 status, &cp->type, sizeof(cp->type));
04106755
JH		 4353 mgmt_pending_remove(cmd);
4354 goto failed;
f39799f5 4355 }
3fd24153 4356
7c307720 4357 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4358 if (err < 0) {
14a53664 4359 mgmt_pending_remove(cmd);
66ea9427
JP		 4360 goto failed;
4361 }
4362
4363 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4364
4365failed:
09fd0de5 4366 hci_dev_unlock(hdev);
14a53664
JH		 4367 return err;
4368}
4369
1904a853 4370static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4371{
3b0602cd 4372 struct mgmt_pending_cmd *cmd;
1183fdca 4373
0e05bba6
AG		 4374 BT_DBG("status %d", status);
4375
4376 hci_dev_lock(hdev);
4377
333ae95d 4378 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4379 if (cmd) {
2922a94f 4380 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4381 mgmt_pending_remove(cmd);
0e05bba6
AG		 4382 }
4383
11e6e25d
MH		 4384 if (!status)
4385 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4386
0e05bba6
AG		 4387 hci_dev_unlock(hdev);
4388}
4389
bdb6d971 4390static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4391 u16 len)
14a53664 4392{
d930650b 4393 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4394 struct mgmt_pending_cmd *cmd;
0e05bba6 4395 struct hci_request req;
14a53664
JH		 4396 int err;
4397
bdb6d971 4398 BT_DBG("%s", hdev->name);
14a53664 4399
09fd0de5 4400 hci_dev_lock(hdev);
14a53664 4401
30dc78e1 4402 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4403 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4404 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4405 sizeof(mgmt_cp->type));
d930650b
JH		 4406 goto unlock;
4407 }
4408
4409 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4410 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4411 MGMT_STATUS_INVALID_PARAMS,
4412 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4413 goto unlock;
ff9ef578
JH		 4414 }
4415
2922a94f 4416 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4417 if (!cmd) {
4418 err = -ENOMEM;
30dc78e1
JH		 4419 goto unlock;
4420 }
4421
2922a94f
JH		 4422 cmd->cmd_complete = generic_cmd_complete;
4423
0e05bba6
AG		 4424 hci_req_init(&req, hdev);
4425
21a60d30 4426 hci_stop_discovery(&req);
e0d9727e 4427
21a60d30
JH		 4428 err = hci_req_run(&req, stop_discovery_complete);
4429 if (!err) {
4430 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4431 goto unlock;
14a53664
JH		 4432 }
4433
21a60d30
JH		 4434 mgmt_pending_remove(cmd);
4435
4436 /* If no HCI commands were sent we're done */
4437 if (err == -ENODATA) {
2a1afb5a
JH		 4438 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4439 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4440 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4441 }
14a53664 4442
30dc78e1 4443unlock:
09fd0de5 4444 hci_dev_unlock(hdev);
14a53664
JH		 4445 return err;
4446}
4447
bdb6d971 4448static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4449 u16 len)
561aafbc 4450{
650f726d 4451 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4452 struct inquiry_entry *e;
561aafbc
JH		 4453 int err;
4454
bdb6d971 4455 BT_DBG("%s", hdev->name);
561aafbc 4456
561aafbc
JH		 4457 hci_dev_lock(hdev);
4458
30dc78e1 4459 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4460 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4461 MGMT_STATUS_FAILED, &cp->addr,
4462 sizeof(cp->addr));
30dc78e1
JH		 4463 goto failed;
4464 }
4465
a198e7b1 4466 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4467 if (!e) {
2a1afb5a
JH		 4468 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4469 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4470 sizeof(cp->addr));
561aafbc
JH		 4471 goto failed;
4472 }
4473
4474 if (cp->name_known) {
4475 e->name_state = NAME_KNOWN;
4476 list_del(&e->list);
4477 } else {
4478 e->name_state = NAME_NEEDED;
a3d4e20a 4479 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4480 }
4481
2a1afb5a
JH		 4482 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4483 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4484
4485failed:
4486 hci_dev_unlock(hdev);
561aafbc
JH		 4487 return err;
4488}
4489
bdb6d971 4490static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4491 u16 len)
7fbec224 4492{
650f726d 4493 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4494 u8 status;
7fbec224
AJ		 4495 int err;
4496
bdb6d971 4497 BT_DBG("%s", hdev->name);
7fbec224 4498
4ee71b20 4499 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4500 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4501 MGMT_STATUS_INVALID_PARAMS,
4502 &cp->addr, sizeof(cp->addr));
4ee71b20 4503
09fd0de5 4504 hci_dev_lock(hdev);
5e762444 4505
dcc36c16
JH		 4506 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4507 cp->addr.type);
2a8357f2 4508 if (err < 0) {
f0eeea8b 4509 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4510 goto done;
4511 }
4512
4513 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4514 sk);
4515 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4516
2a8357f2 4517done:
2a1afb5a
JH		 4518 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4519 &cp->addr, sizeof(cp->addr));
5e762444 4520
09fd0de5 4521 hci_dev_unlock(hdev);
7fbec224
AJ		 4522
4523 return err;
4524}
4525
bdb6d971 4526static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4527 u16 len)
7fbec224 4528{
650f726d 4529 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4530 u8 status;
7fbec224
AJ		 4531 int err;
4532
bdb6d971 4533 BT_DBG("%s", hdev->name);
7fbec224 4534
4ee71b20 4535 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4536 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4537 MGMT_STATUS_INVALID_PARAMS,
4538 &cp->addr, sizeof(cp->addr));
4ee71b20 4539
09fd0de5 4540 hci_dev_lock(hdev);
5e762444 4541
dcc36c16
JH		 4542 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4543 cp->addr.type);
2a8357f2 4544 if (err < 0) {
f0eeea8b 4545 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4546 goto done;
4547 }
4548
4549 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4550 sk);
4551 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4552
2a8357f2 4553done:
2a1afb5a
JH		 4554 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4555 &cp->addr, sizeof(cp->addr));
5e762444 4556
09fd0de5 4557 hci_dev_unlock(hdev);
7fbec224
AJ		 4558
4559 return err;
4560}
4561
cdbaccca
MH		 4562static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4563 u16 len)
4564{
4565 struct mgmt_cp_set_device_id *cp = data;
890ea898 4566 struct hci_request req;
cdbaccca 4567 int err;
c72d4b8a 4568 __u16 source;
cdbaccca
MH		 4569
4570 BT_DBG("%s", hdev->name);
4571
c72d4b8a
SJ		 4572 source = __le16_to_cpu(cp->source);
4573
4574 if (source > 0x0002)
a69e8375
JH		 4575 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4576 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4577
cdbaccca
MH		 4578 hci_dev_lock(hdev);
4579
c72d4b8a 4580 hdev->devid_source = source;
cdbaccca
MH		 4581 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4582 hdev->devid_product = __le16_to_cpu(cp->product);
4583 hdev->devid_version = __le16_to_cpu(cp->version);
4584
2a1afb5a
JH		 4585 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4586 NULL, 0);
cdbaccca 4587
890ea898
JH		 4588 hci_req_init(&req, hdev);
4589 update_eir(&req);
4590 hci_req_run(&req, NULL);
cdbaccca
MH		 4591
4592 hci_dev_unlock(hdev);
4593
4594 return err;
4595}
4596
24b4f38f
AU		 4597static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4598 u16 opcode)
4599{
4600 BT_DBG("status %d", status);
4601}
4602
1904a853
MH		 4603static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4604 u16 opcode)
4375f103
JH		 4605{
4606 struct cmd_lookup match = { NULL, hdev };
24b4f38f 4607 struct hci_request req;
4375f103 4608
3ad67582
JK		 4609 hci_dev_lock(hdev);
4610
4375f103
JH		 4611 if (status) {
4612 u8 mgmt_err = mgmt_status(status);
4613
4614 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4615 cmd_status_rsp, &mgmt_err);
3ad67582 4616 goto unlock;
4375f103
JH		 4617 }
4618
d7a5a11d 4619 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4620 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4621 else
a358dc11 4622 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4623
4375f103
JH		 4624 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4625 &match);
4626
4627 new_settings(hdev, match.sk);
4628
4629 if (match.sk)
4630 sock_put(match.sk);
3ad67582 4631
24b4f38f
AU		 4632 /* If "Set Advertising" was just disabled and instance advertising was
4633 * set up earlier, then enable the advertising instance.
4634 */
4635 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
4636 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
4637 goto unlock;
4638
4639 hci_req_init(&req, hdev);
4640
4641 update_adv_data(&req);
4642 enable_advertising(&req);
4643
4644 if (hci_req_run(&req, enable_advertising_instance) < 0)
4645 BT_ERR("Failed to re-configure advertising");
4646
3ad67582
JK		 4647unlock:
4648 hci_dev_unlock(hdev);
4375f103
JH		 4649}
4650
21b5187f
MH		 4651static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4652 u16 len)
4375f103
JH		 4653{
4654 struct mgmt_mode *cp = data;
3b0602cd 4655 struct mgmt_pending_cmd *cmd;
4375f103 4656 struct hci_request req;
cc91cb04 4657 u8 val, status;
4375f103
JH		 4658 int err;
4659
4660 BT_DBG("request for %s", hdev->name);
4661
e6fe7986
JH		 4662 status = mgmt_le_support(hdev);
4663 if (status)
a69e8375
JH		 4664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4665 status);
4375f103 4666
cc91cb04 4667 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4669 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4670
4671 hci_dev_lock(hdev);
4672
4673 val = !!cp->val;
4375f103 4674
f74ca9b8
JH		 4675 /* The following conditions are ones which mean that we should
4676 * not do any HCI communication but directly send a mgmt
4677 * response to user space (after toggling the flag if
4678 * necessary).
4679 */
cc91cb04 4680 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4681 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4682 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4683 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4684 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4685 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4686 bool changed;
4375f103 4687
cc91cb04 4688 if (cp->val) {
238be788 4689 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4690 if (cp->val == 0x02)
a1536da2 4691 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4692 else
a358dc11 4693 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4694 } else {
a69d8927 4695 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4696 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4697 }
4698
4699 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4700 if (err < 0)
4701 goto unlock;
4702
4703 if (changed)
4704 err = new_settings(hdev, sk);
4705
4706 goto unlock;
4707 }
4708
333ae95d
JH		 4709 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4710 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4711 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4712 MGMT_STATUS_BUSY);
4375f103
JH		 4713 goto unlock;
4714 }
4715
4716 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4717 if (!cmd) {
4718 err = -ENOMEM;
4719 goto unlock;
4720 }
4721
4722 hci_req_init(&req, hdev);
4723
cc91cb04 4724 if (cp->val == 0x02)
a1536da2 4725 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4726 else
a358dc11 4727 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4728
24b4f38f
AU		 4729 if (val) {
4730 /* Switch to instance "0" for the Set Advertising setting. */
4731 update_adv_data_for_instance(&req, 0);
4117ed70 4732 update_scan_rsp_data_for_instance(&req, 0);
bba3aa55 4733 enable_advertising(&req);
24b4f38f 4734 } else {
bba3aa55 4735 disable_advertising(&req);
24b4f38f 4736 }
4375f103
JH		 4737
4738 err = hci_req_run(&req, set_advertising_complete);
4739 if (err < 0)
4740 mgmt_pending_remove(cmd);
4741
4742unlock:
4743 hci_dev_unlock(hdev);
4744 return err;
4745}
4746
d13eafce
MH		 4747static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4748 void *data, u16 len)
4749{
4750 struct mgmt_cp_set_static_address *cp = data;
4751 int err;
4752
4753 BT_DBG("%s", hdev->name);
4754
62af4443 4755 if (!lmp_le_capable(hdev))
a69e8375
JH		 4756 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4757 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4758
4759 if (hdev_is_powered(hdev))
a69e8375
JH		 4760 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4761 MGMT_STATUS_REJECTED);
d13eafce
MH		 4762
4763 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4764 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4765 return mgmt_cmd_status(sk, hdev->id,
4766 MGMT_OP_SET_STATIC_ADDRESS,
4767 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4768
4769 /* Two most significant bits shall be set */
4770 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4771 return mgmt_cmd_status(sk, hdev->id,
4772 MGMT_OP_SET_STATIC_ADDRESS,
4773 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4774 }
4775
4776 hci_dev_lock(hdev);
4777
4778 bacpy(&hdev->static_addr, &cp->bdaddr);
4779
93690c22
MH		 4780 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4781 if (err < 0)
4782 goto unlock;
4783
4784 err = new_settings(hdev, sk);
d13eafce 4785
93690c22 4786unlock:
d13eafce 4787 hci_dev_unlock(hdev);
d13eafce
MH		 4788 return err;
4789}
4790
14b49b9a
MH		 4791static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4792 void *data, u16 len)
4793{
4794 struct mgmt_cp_set_scan_params *cp = data;
4795 __u16 interval, window;
4796 int err;
4797
4798 BT_DBG("%s", hdev->name);
4799
4800 if (!lmp_le_capable(hdev))
a69e8375
JH		 4801 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4802 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 4803
4804 interval = __le16_to_cpu(cp->interval);
4805
4806 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 4807 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4808 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 4809
4810 window = __le16_to_cpu(cp->window);
4811
4812 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 4813 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4814 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 4815
899e1075 4816 if (window > interval)
a69e8375
JH		 4817 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4818 MGMT_STATUS_INVALID_PARAMS);
899e1075 4819
14b49b9a
MH		 4820 hci_dev_lock(hdev);
4821
4822 hdev->le_scan_interval = interval;
4823 hdev->le_scan_window = window;
4824
2a1afb5a
JH		 4825 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4826 NULL, 0);
14b49b9a 4827
dd2ef8e2
AG		 4828 /* If background scan is running, restart it so new parameters are
4829 * loaded.
4830 */
d7a5a11d 4831 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 4832 hdev->discovery.state == DISCOVERY_STOPPED) {
4833 struct hci_request req;
4834
4835 hci_req_init(&req, hdev);
4836
4837 hci_req_add_le_scan_disable(&req);
4838 hci_req_add_le_passive_scan(&req);
4839
4840 hci_req_run(&req, NULL);
4841 }
4842
14b49b9a
MH		 4843 hci_dev_unlock(hdev);
4844
4845 return err;
4846}
4847
1904a853
MH		 4848static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4849 u16 opcode)
33e38b3e 4850{
3b0602cd 4851 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 4852
4853 BT_DBG("status 0x%02x", status);
4854
4855 hci_dev_lock(hdev);
4856
333ae95d 4857 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 4858 if (!cmd)
4859 goto unlock;
4860
4861 if (status) {
a69e8375
JH		 4862 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4863 mgmt_status(status));
33e38b3e 4864 } else {
1a4d3c4b
JH		 4865 struct mgmt_mode *cp = cmd->param;
4866
4867 if (cp->val)
a1536da2 4868 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 4869 else
a358dc11 4870 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 4871
33e38b3e
JH		 4872 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4873 new_settings(hdev, cmd->sk);
4874 }
4875
4876 mgmt_pending_remove(cmd);
4877
4878unlock:
4879 hci_dev_unlock(hdev);
4880}
4881
bdb6d971 4882static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 4883 void *data, u16 len)
f6422ec6 4884{
650f726d 4885 struct mgmt_mode *cp = data;
3b0602cd 4886 struct mgmt_pending_cmd *cmd;
33e38b3e 4887 struct hci_request req;
f6422ec6
AJ		 4888 int err;
4889
bdb6d971 4890 BT_DBG("%s", hdev->name);
f6422ec6 4891
d7a5a11d 4892 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 4893 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 4894 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4895 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 4896
a7e80f25 4897 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 4898 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4899 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 4900
f6422ec6
AJ		 4901 hci_dev_lock(hdev);
4902
333ae95d 4903 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 4904 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4905 MGMT_STATUS_BUSY);
05cbf29f
JH		 4906 goto unlock;
4907 }
4908
d7a5a11d 4909 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 4910 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4911 hdev);
4912 goto unlock;
4913 }
4914
406ef2a6 4915 if (!hdev_is_powered(hdev)) {
ce05d603 4916 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 4917 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4918 hdev);
4919 new_settings(hdev, sk);
4920 goto unlock;
4921 }
4922
33e38b3e
JH		 4923 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4924 data, len);
4925 if (!cmd) {
4926 err = -ENOMEM;
4927 goto unlock;
f6422ec6
AJ		 4928 }
4929
33e38b3e
JH		 4930 hci_req_init(&req, hdev);
4931
406d7804 4932 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 4933
4934 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 4935 if (err < 0) {
a69e8375
JH		 4936 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4937 MGMT_STATUS_FAILED);
33e38b3e 4938 mgmt_pending_remove(cmd);
f6422ec6
AJ		 4939 }
4940
33e38b3e 4941unlock:
f6422ec6 4942 hci_dev_unlock(hdev);
33e38b3e 4943
f6422ec6
AJ		 4944 return err;
4945}
4946
1904a853 4947static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 4948{
3b0602cd 4949 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 4950
4951 BT_DBG("status 0x%02x", status);
4952
4953 hci_dev_lock(hdev);
4954
333ae95d 4955 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 4956 if (!cmd)
4957 goto unlock;
4958
4959 if (status) {
4960 u8 mgmt_err = mgmt_status(status);
4961
4962 /* We need to restore the flag if related HCI commands
4963 * failed.
4964 */
a358dc11 4965 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 4966
a69e8375 4967 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 4968 } else {
4969 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4970 new_settings(hdev, cmd->sk);
4971 }
4972
4973 mgmt_pending_remove(cmd);
4974
4975unlock:
4976 hci_dev_unlock(hdev);
4977}
4978
4979static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4980{
4981 struct mgmt_mode *cp = data;
3b0602cd 4982 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 4983 struct hci_request req;
4984 int err;
4985
4986 BT_DBG("request for %s", hdev->name);
4987
4988 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 4989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4990 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 4991
d7a5a11d 4992 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 4993 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4994 MGMT_STATUS_REJECTED);
0663ca2a
JH		 4995
4996 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 4997 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4998 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 4999
5000 hci_dev_lock(hdev);
5001
d7a5a11d 5002 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 5003 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5004 goto unlock;
5005 }
5006
5007 if (!hdev_is_powered(hdev)) {
5008 if (!cp->val) {
a358dc11
MH		 5009 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5010 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5011 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5012 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5013 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 5014 }
5015
ce05d603 5016 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5017
5018 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5019 if (err < 0)
5020 goto unlock;
5021
5022 err = new_settings(hdev, sk);
5023 goto unlock;
5024 }
5025
5026 /* Reject disabling when powered on */
5027 if (!cp->val) {
a69e8375
JH		 5028 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5029 MGMT_STATUS_REJECTED);
0663ca2a 5030 goto unlock;
111e4bcc
MH		 5031 } else {
5032 /* When configuring a dual-mode controller to operate
5033 * with LE only and using a static address, then switching
5034 * BR/EDR back on is not allowed.
5035 *
5036 * Dual-mode controllers shall operate with the public
5037 * address as its identity address for BR/EDR and LE. So
5038 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 5039 *
5040 * The same restrictions applies when secure connections
5041 * has been enabled. For BR/EDR this is a controller feature
5042 * while for LE it is a host stack feature. This means that
5043 * switching BR/EDR back on when secure connections has been
5044 * enabled is not a supported transaction.
111e4bcc 5045 */
d7a5a11d 5046 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 5047 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 5048 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 5049 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5050 MGMT_STATUS_REJECTED);
111e4bcc
MH		 5051 goto unlock;
5052 }
0663ca2a
JH		 5053 }
5054
333ae95d 5055 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 5056 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5057 MGMT_STATUS_BUSY);
0663ca2a
JH		 5058 goto unlock;
5059 }
5060
5061 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5062 if (!cmd) {
5063 err = -ENOMEM;
5064 goto unlock;
5065 }
5066
5947f4bc 5067 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 5068 * generates the correct flags.
5069 */
a1536da2 5070 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5071
5072 hci_req_init(&req, hdev);
aa8af46e 5073
432df05e 5074 write_fast_connectable(&req, false);
1d2dc5b7 5075 __hci_update_page_scan(&req);
aa8af46e 5076
f14d8f64
MH		 5077 /* Since only the advertising data flags will change, there
5078 * is no need to update the scan response data.
5079 */
5947f4bc 5080 update_adv_data(&req);
aa8af46e 5081
0663ca2a
JH		 5082 err = hci_req_run(&req, set_bredr_complete);
5083 if (err < 0)
5084 mgmt_pending_remove(cmd);
5085
5086unlock:
5087 hci_dev_unlock(hdev);
5088 return err;
5089}
5090
a1443f5a
JH		 5091static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5092{
3b0602cd 5093 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 5094 struct mgmt_mode *cp;
5095
5096 BT_DBG("%s status %u", hdev->name, status);
5097
5098 hci_dev_lock(hdev);
5099
333ae95d 5100 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 5101 if (!cmd)
5102 goto unlock;
5103
5104 if (status) {
a69e8375
JH		 5105 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5106 mgmt_status(status));
a1443f5a
JH		 5107 goto remove;
5108 }
5109
5110 cp = cmd->param;
5111
5112 switch (cp->val) {
5113 case 0x00:
a358dc11
MH		 5114 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5115 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5116 break;
5117 case 0x01:
a1536da2 5118 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 5119 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5120 break;
5121 case 0x02:
a1536da2
MH		 5122 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5123 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5124 break;
5125 }
5126
5127 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5128 new_settings(hdev, cmd->sk);
5129
5130remove:
5131 mgmt_pending_remove(cmd);
5132unlock:
5133 hci_dev_unlock(hdev);
5134}
5135
eac83dc6
MH		 5136static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5137 void *data, u16 len)
5138{
5139 struct mgmt_mode *cp = data;
3b0602cd 5140 struct mgmt_pending_cmd *cmd;
a1443f5a 5141 struct hci_request req;
a3209694 5142 u8 val;
eac83dc6
MH		 5143 int err;
5144
5145 BT_DBG("request for %s", hdev->name);
5146
05b3c3e7 5147 if (!lmp_sc_capable(hdev) &&
d7a5a11d 5148 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5149 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5150 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 5151
d7a5a11d 5152 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 5153 lmp_sc_capable(hdev) &&
d7a5a11d 5154 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 5155 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5156 MGMT_STATUS_REJECTED);
ed93ec69 5157
0ab04a9c 5158 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 5159 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 5160 MGMT_STATUS_INVALID_PARAMS);
5161
5162 hci_dev_lock(hdev);
5163
05b3c3e7 5164 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 5165 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 5166 bool changed;
5167
0ab04a9c 5168 if (cp->val) {
238be788
MH		 5169 changed = !hci_dev_test_and_set_flag(hdev,
5170 HCI_SC_ENABLED);
0ab04a9c 5171 if (cp->val == 0x02)
a1536da2 5172 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5173 else
a358dc11 5174 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5175 } else {
a69d8927
MH		 5176 changed = hci_dev_test_and_clear_flag(hdev,
5177 HCI_SC_ENABLED);
a358dc11 5178 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5179 }
eac83dc6
MH		 5180
5181 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5182 if (err < 0)
5183 goto failed;
5184
5185 if (changed)
5186 err = new_settings(hdev, sk);
5187
5188 goto failed;
5189 }
5190
333ae95d 5191 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 5192 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5193 MGMT_STATUS_BUSY);
eac83dc6
MH		 5194 goto failed;
5195 }
5196
0ab04a9c
MH		 5197 val = !!cp->val;
5198
d7a5a11d
MH		 5199 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5200 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 5201 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5202 goto failed;
5203 }
5204
5205 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5206 if (!cmd) {
5207 err = -ENOMEM;
5208 goto failed;
5209 }
5210
a1443f5a
JH		 5211 hci_req_init(&req, hdev);
5212 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5213 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 5214 if (err < 0) {
5215 mgmt_pending_remove(cmd);
5216 goto failed;
5217 }
5218
5219failed:
5220 hci_dev_unlock(hdev);
5221 return err;
5222}
5223
4e39ac81
MH		 5224static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5225 void *data, u16 len)
5226{
5227 struct mgmt_mode *cp = data;
b9710979 5228 bool changed, use_changed;
4e39ac81
MH		 5229 int err;
5230
5231 BT_DBG("request for %s", hdev->name);
5232
b9710979 5233 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 5234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5235 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 5236
5237 hci_dev_lock(hdev);
5238
5239 if (cp->val)
238be788 5240 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 5241 else
a69d8927
MH		 5242 changed = hci_dev_test_and_clear_flag(hdev,
5243 HCI_KEEP_DEBUG_KEYS);
4e39ac81 5244
b9710979 5245 if (cp->val == 0x02)
238be788
MH		 5246 use_changed = !hci_dev_test_and_set_flag(hdev,
5247 HCI_USE_DEBUG_KEYS);
b9710979 5248 else
a69d8927
MH		 5249 use_changed = hci_dev_test_and_clear_flag(hdev,
5250 HCI_USE_DEBUG_KEYS);
b9710979
JH		 5251
5252 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 5253 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 5254 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5255 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5256 sizeof(mode), &mode);
5257 }
5258
4e39ac81
MH		 5259 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5260 if (err < 0)
5261 goto unlock;
5262
5263 if (changed)
5264 err = new_settings(hdev, sk);
5265
5266unlock:
5267 hci_dev_unlock(hdev);
5268 return err;
5269}
5270
62b04cd1
JH		 5271static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5272 u16 len)
5273{
5274 struct mgmt_cp_set_privacy *cp = cp_data;
5275 bool changed;
5276 int err;
5277
5278 BT_DBG("request for %s", hdev->name);
5279
5280 if (!lmp_le_capable(hdev))
a69e8375
JH		 5281 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5282 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5283
5284 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5285 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5286 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5287
5288 if (hdev_is_powered(hdev))
a69e8375
JH		 5289 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5290 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5291
5292 hci_dev_lock(hdev);
5293
c21c0ea0
JH		 5294 /* If user space supports this command it is also expected to
5295 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5296 */
a1536da2 5297 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5298
62b04cd1 5299 if (cp->privacy) {
238be788 5300 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5301 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5302 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5303 } else {
a69d8927 5304 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5305 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5306 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5307 }
5308
5309 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5310 if (err < 0)
5311 goto unlock;
5312
5313 if (changed)
5314 err = new_settings(hdev, sk);
5315
5316unlock:
5317 hci_dev_unlock(hdev);
5318 return err;
5319}
5320
41edf160
JH		 5321static bool irk_is_valid(struct mgmt_irk_info *irk)
5322{
5323 switch (irk->addr.type) {
5324 case BDADDR_LE_PUBLIC:
5325 return true;
5326
5327 case BDADDR_LE_RANDOM:
5328 /* Two most significant bits shall be set */
5329 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5330 return false;
5331 return true;
5332 }
5333
5334 return false;
5335}
5336
5337static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5338 u16 len)
5339{
5340 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5341 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5342 sizeof(struct mgmt_irk_info));
41edf160
JH		 5343 u16 irk_count, expected_len;
5344 int i, err;
5345
5346 BT_DBG("request for %s", hdev->name);
5347
5348 if (!lmp_le_capable(hdev))
a69e8375
JH		 5349 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5350 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5351
5352 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5353 if (irk_count > max_irk_count) {
5354 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5355 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5356 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5357 }
41edf160
JH		 5358
5359 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5360 if (expected_len != len) {
5361 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5362 expected_len, len);
a69e8375
JH		 5363 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5364 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5365 }
5366
5367 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5368
5369 for (i = 0; i < irk_count; i++) {
5370 struct mgmt_irk_info *key = &cp->irks[i];
5371
5372 if (!irk_is_valid(key))
a69e8375
JH		 5373 return mgmt_cmd_status(sk, hdev->id,
5374 MGMT_OP_LOAD_IRKS,
5375 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5376 }
5377
5378 hci_dev_lock(hdev);
5379
5380 hci_smp_irks_clear(hdev);
5381
5382 for (i = 0; i < irk_count; i++) {
5383 struct mgmt_irk_info *irk = &cp->irks[i];
5384 u8 addr_type;
5385
5386 if (irk->addr.type == BDADDR_LE_PUBLIC)
5387 addr_type = ADDR_LE_DEV_PUBLIC;
5388 else
5389 addr_type = ADDR_LE_DEV_RANDOM;
5390
5391 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5392 BDADDR_ANY);
5393 }
5394
a1536da2 5395 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5396
2a1afb5a 5397 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5398
5399 hci_dev_unlock(hdev);
5400
5401 return err;
5402}
5403
3f706b72
JH		 5404static bool ltk_is_valid(struct mgmt_ltk_info *key)
5405{
5406 if (key->master != 0x00 && key->master != 0x01)
5407 return false;
490cb0b3
MH		 5408
5409 switch (key->addr.type) {
5410 case BDADDR_LE_PUBLIC:
5411 return true;
5412
5413 case BDADDR_LE_RANDOM:
5414 /* Two most significant bits shall be set */
5415 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5416 return false;
5417 return true;
5418 }
5419
5420 return false;
3f706b72
JH		 5421}
5422
bdb6d971 5423static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5424 void *cp_data, u16 len)
346af67b 5425{
346af67b 5426 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5427 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5428 sizeof(struct mgmt_ltk_info));
346af67b 5429 u16 key_count, expected_len;
715a5bf2 5430 int i, err;
346af67b 5431
cf99ba13
MH		 5432 BT_DBG("request for %s", hdev->name);
5433
5434 if (!lmp_le_capable(hdev))
a69e8375
JH		 5435 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5436 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5437
1f350c87 5438 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5439 if (key_count > max_key_count) {
5440 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5441 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5442 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5443 }
346af67b
VCG		 5444
5445 expected_len = sizeof(*cp) + key_count *
5446 sizeof(struct mgmt_ltk_info);
5447 if (expected_len != len) {
5448 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5449 expected_len, len);
a69e8375
JH		 5450 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5451 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5452 }
5453
bdb6d971 5454 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5455
54ad6d8a
JH		 5456 for (i = 0; i < key_count; i++) {
5457 struct mgmt_ltk_info *key = &cp->keys[i];
5458
3f706b72 5459 if (!ltk_is_valid(key))
a69e8375
JH		 5460 return mgmt_cmd_status(sk, hdev->id,
5461 MGMT_OP_LOAD_LONG_TERM_KEYS,
5462 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5463 }
5464
346af67b
VCG		 5465 hci_dev_lock(hdev);
5466
5467 hci_smp_ltks_clear(hdev);
5468
5469 for (i = 0; i < key_count; i++) {
5470 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5471 u8 type, addr_type, authenticated;
79d95a19
MH		 5472
5473 if (key->addr.type == BDADDR_LE_PUBLIC)
5474 addr_type = ADDR_LE_DEV_PUBLIC;
5475 else
5476 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5477
61b43357
JH		 5478 switch (key->type) {
5479 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5480 authenticated = 0x00;
23fb8de3 5481 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5482 break;
5483 case MGMT_LTK_AUTHENTICATED:
d7b25450 5484 authenticated = 0x01;
23fb8de3
JH		 5485 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5486 break;
5487 case MGMT_LTK_P256_UNAUTH:
5488 authenticated = 0x00;
5489 type = SMP_LTK_P256;
61b43357 5490 break;
23fb8de3
JH		 5491 case MGMT_LTK_P256_AUTH:
5492 authenticated = 0x01;
5493 type = SMP_LTK_P256;
61b43357 5494 break;
23fb8de3
JH		 5495 case MGMT_LTK_P256_DEBUG:
5496 authenticated = 0x00;
5497 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5498 default:
5499 continue;
5500 }
d7b25450 5501
35d70271 5502 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5503 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5504 key->rand);
346af67b
VCG		 5505 }
5506
2a1afb5a 5507 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5508 NULL, 0);
5509
346af67b 5510 hci_dev_unlock(hdev);
346af67b 5511
715a5bf2 5512 return err;
346af67b
VCG		 5513}
5514
3b0602cd 5515static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5516{
dd983808 5517 struct hci_conn *conn = cmd->user_data;
9981bdb0 5518 struct mgmt_rp_get_conn_info rp;
9df74653 5519 int err;
dd983808 5520
9981bdb0 5521 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5522
9981bdb0 5523 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5524 rp.rssi = conn->rssi;
9981bdb0
JH		 5525 rp.tx_power = conn->tx_power;
5526 rp.max_tx_power = conn->max_tx_power;
5527 } else {
5528 rp.rssi = HCI_RSSI_INVALID;
5529 rp.tx_power = HCI_TX_POWER_INVALID;
5530 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5531 }
5532
2a1afb5a
JH		 5533 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5534 status, &rp, sizeof(rp));
dd983808
AK		 5535
5536 hci_conn_drop(conn);
f8aaf9b6 5537 hci_conn_put(conn);
9df74653
JH		 5538
5539 return err;
dd983808
AK		 5540}
5541
1904a853
MH		 5542static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5543 u16 opcode)
dd983808
AK		 5544{
5545 struct hci_cp_read_rssi *cp;
3b0602cd 5546 struct mgmt_pending_cmd *cmd;
dd983808 5547 struct hci_conn *conn;
dd983808 5548 u16 handle;
9981bdb0 5549 u8 status;
dd983808 5550
9981bdb0 5551 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5552
5553 hci_dev_lock(hdev);
5554
dd983808
AK		 5555 /* Commands sent in request are either Read RSSI or Read Transmit Power
5556 * Level so we check which one was last sent to retrieve connection
5557 * handle. Both commands have handle as first parameter so it's safe to
5558 * cast data on the same command struct.
5559 *
5560 * First command sent is always Read RSSI and we fail only if it fails.
5561 * In other case we simply override error to indicate success as we
5562 * already remembered if TX power value is actually valid.
5563 */
5564 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5565 if (!cp) {
5566 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5567 status = MGMT_STATUS_SUCCESS;
5568 } else {
5569 status = mgmt_status(hci_status);
dd983808
AK		 5570 }
5571
5572 if (!cp) {
9981bdb0 5573 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5574 goto unlock;
5575 }
5576
5577 handle = __le16_to_cpu(cp->handle);
5578 conn = hci_conn_hash_lookup_handle(hdev, handle);
5579 if (!conn) {
9981bdb0 5580 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5581 goto unlock;
5582 }
5583
333ae95d 5584 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5585 if (!cmd)
5586 goto unlock;
dd983808 5587
9981bdb0
JH		 5588 cmd->cmd_complete(cmd, status);
5589 mgmt_pending_remove(cmd);
dd983808
AK		 5590
5591unlock:
5592 hci_dev_unlock(hdev);
5593}
5594
5595static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5596 u16 len)
5597{
5598 struct mgmt_cp_get_conn_info *cp = data;
5599 struct mgmt_rp_get_conn_info rp;
5600 struct hci_conn *conn;
5601 unsigned long conn_info_age;
5602 int err = 0;
5603
5604 BT_DBG("%s", hdev->name);
5605
5606 memset(&rp, 0, sizeof(rp));
5607 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5608 rp.addr.type = cp->addr.type;
5609
5610 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5611 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5612 MGMT_STATUS_INVALID_PARAMS,
5613 &rp, sizeof(rp));
dd983808
AK		 5614
5615 hci_dev_lock(hdev);
5616
5617 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5618 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5619 MGMT_STATUS_NOT_POWERED, &rp,
5620 sizeof(rp));
dd983808
AK		 5621 goto unlock;
5622 }
5623
5624 if (cp->addr.type == BDADDR_BREDR)
5625 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5626 &cp->addr.bdaddr);
5627 else
5628 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5629
5630 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5632 MGMT_STATUS_NOT_CONNECTED, &rp,
5633 sizeof(rp));
dd983808
AK		 5634 goto unlock;
5635 }
5636
333ae95d 5637 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5638 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5639 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5640 goto unlock;
5641 }
5642
dd983808
AK		 5643 /* To avoid client trying to guess when to poll again for information we
5644 * calculate conn info age as random value between min/max set in hdev.
5645 */
5646 conn_info_age = hdev->conn_info_min_age +
5647 prandom_u32_max(hdev->conn_info_max_age -
5648 hdev->conn_info_min_age);
5649
5650 /* Query controller to refresh cached values if they are too old or were
5651 * never read.
5652 */
f4e2dd53
AK		 5653 if (time_after(jiffies, conn->conn_info_timestamp +
5654 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5655 !conn->conn_info_timestamp) {
5656 struct hci_request req;
5657 struct hci_cp_read_tx_power req_txp_cp;
5658 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5659 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5660
5661 hci_req_init(&req, hdev);
5662 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5663 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5664 &req_rssi_cp);
5665
f7faab0c
AK		 5666 /* For LE links TX power does not change thus we don't need to
5667 * query for it once value is known.
5668 */
5669 if (!bdaddr_type_is_le(cp->addr.type) ||
5670 conn->tx_power == HCI_TX_POWER_INVALID) {
5671 req_txp_cp.handle = cpu_to_le16(conn->handle);
5672 req_txp_cp.type = 0x00;
5673 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5674 sizeof(req_txp_cp), &req_txp_cp);
5675 }
dd983808 5676
eed5daf3
AK		 5677 /* Max TX power needs to be read only once per connection */
5678 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5679 req_txp_cp.handle = cpu_to_le16(conn->handle);
5680 req_txp_cp.type = 0x01;
5681 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5682 sizeof(req_txp_cp), &req_txp_cp);
5683 }
5684
dd983808
AK		 5685 err = hci_req_run(&req, conn_info_refresh_complete);
5686 if (err < 0)
5687 goto unlock;
5688
5689 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5690 data, len);
5691 if (!cmd) {
5692 err = -ENOMEM;
5693 goto unlock;
5694 }
5695
5696 hci_conn_hold(conn);
f8aaf9b6 5697 cmd->user_data = hci_conn_get(conn);
9981bdb0 5698 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5699
5700 conn->conn_info_timestamp = jiffies;
5701 } else {
5702 /* Cache is valid, just reply with values cached in hci_conn */
5703 rp.rssi = conn->rssi;
5704 rp.tx_power = conn->tx_power;
eed5daf3 5705 rp.max_tx_power = conn->max_tx_power;
dd983808 5706
2a1afb5a
JH		 5707 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5708 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5709 }
5710
5711unlock:
5712 hci_dev_unlock(hdev);
5713 return err;
5714}
5715
3b0602cd 5716static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5717{
69487371 5718 struct hci_conn *conn = cmd->user_data;
95868426 5719 struct mgmt_rp_get_clock_info rp;
69487371 5720 struct hci_dev *hdev;
9df74653 5721 int err;
69487371
JH		 5722
5723 memset(&rp, 0, sizeof(rp));
5724 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5725
5726 if (status)
5727 goto complete;
5728
5729 hdev = hci_dev_get(cmd->index);
5730 if (hdev) {
5731 rp.local_clock = cpu_to_le32(hdev->clock);
5732 hci_dev_put(hdev);
5733 }
5734
5735 if (conn) {
5736 rp.piconet_clock = cpu_to_le32(conn->clock);
5737 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5738 }
5739
5740complete:
2a1afb5a
JH		 5741 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5742 sizeof(rp));
69487371
JH		 5743
5744 if (conn) {
5745 hci_conn_drop(conn);
5746 hci_conn_put(conn);
5747 }
9df74653
JH		 5748
5749 return err;
69487371
JH		 5750}
5751
1904a853 5752static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5753{
95868426 5754 struct hci_cp_read_clock *hci_cp;
3b0602cd 5755 struct mgmt_pending_cmd *cmd;
95868426
JH		 5756 struct hci_conn *conn;
5757
5758 BT_DBG("%s status %u", hdev->name, status);
5759
5760 hci_dev_lock(hdev);
5761
5762 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5763 if (!hci_cp)
5764 goto unlock;
5765
5766 if (hci_cp->which) {
5767 u16 handle = __le16_to_cpu(hci_cp->handle);
5768 conn = hci_conn_hash_lookup_handle(hdev, handle);
5769 } else {
5770 conn = NULL;
5771 }
5772
333ae95d 5773 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5774 if (!cmd)
5775 goto unlock;
5776
69487371 5777 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5778 mgmt_pending_remove(cmd);
95868426
JH		 5779
5780unlock:
5781 hci_dev_unlock(hdev);
5782}
5783
5784static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5785 u16 len)
5786{
5787 struct mgmt_cp_get_clock_info *cp = data;
5788 struct mgmt_rp_get_clock_info rp;
5789 struct hci_cp_read_clock hci_cp;
3b0602cd 5790 struct mgmt_pending_cmd *cmd;
95868426
JH		 5791 struct hci_request req;
5792 struct hci_conn *conn;
5793 int err;
5794
5795 BT_DBG("%s", hdev->name);
5796
5797 memset(&rp, 0, sizeof(rp));
5798 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5799 rp.addr.type = cp->addr.type;
5800
5801 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 5802 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5803 MGMT_STATUS_INVALID_PARAMS,
5804 &rp, sizeof(rp));
95868426
JH		 5805
5806 hci_dev_lock(hdev);
5807
5808 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5809 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5810 MGMT_STATUS_NOT_POWERED, &rp,
5811 sizeof(rp));
95868426
JH		 5812 goto unlock;
5813 }
5814
5815 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5816 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5817 &cp->addr.bdaddr);
5818 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5819 err = mgmt_cmd_complete(sk, hdev->id,
5820 MGMT_OP_GET_CLOCK_INFO,
5821 MGMT_STATUS_NOT_CONNECTED,
5822 &rp, sizeof(rp));
95868426
JH		 5823 goto unlock;
5824 }
5825 } else {
5826 conn = NULL;
5827 }
5828
5829 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5830 if (!cmd) {
5831 err = -ENOMEM;
5832 goto unlock;
5833 }
5834
69487371
JH		 5835 cmd->cmd_complete = clock_info_cmd_complete;
5836
95868426
JH		 5837 hci_req_init(&req, hdev);
5838
5839 memset(&hci_cp, 0, sizeof(hci_cp));
5840 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5841
5842 if (conn) {
5843 hci_conn_hold(conn);
f8aaf9b6 5844 cmd->user_data = hci_conn_get(conn);
95868426
JH		 5845
5846 hci_cp.handle = cpu_to_le16(conn->handle);
5847 hci_cp.which = 0x01; /* Piconet clock */
5848 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5849 }
5850
5851 err = hci_req_run(&req, get_clock_info_complete);
5852 if (err < 0)
5853 mgmt_pending_remove(cmd);
5854
5855unlock:
5856 hci_dev_unlock(hdev);
5857 return err;
5858}
5859
5a154e6f
JH		 5860static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5861{
5862 struct hci_conn *conn;
5863
5864 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5865 if (!conn)
5866 return false;
5867
5868 if (conn->dst_type != type)
5869 return false;
5870
5871 if (conn->state != BT_CONNECTED)
5872 return false;
5873
5874 return true;
5875}
5876
5877/* This function requires the caller holds hdev->lock */
5878static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5879 u8 addr_type, u8 auto_connect)
5880{
5881 struct hci_dev *hdev = req->hdev;
5882 struct hci_conn_params *params;
5883
5884 params = hci_conn_params_add(hdev, addr, addr_type);
5885 if (!params)
5886 return -EIO;
5887
5888 if (params->auto_connect == auto_connect)
5889 return 0;
5890
5891 list_del_init(&params->action);
5892
5893 switch (auto_connect) {
5894 case HCI_AUTO_CONN_DISABLED:
5895 case HCI_AUTO_CONN_LINK_LOSS:
5896 __hci_update_background_scan(req);
5897 break;
5898 case HCI_AUTO_CONN_REPORT:
5899 list_add(&params->action, &hdev->pend_le_reports);
5900 __hci_update_background_scan(req);
5901 break;
5902 case HCI_AUTO_CONN_DIRECT:
5903 case HCI_AUTO_CONN_ALWAYS:
5904 if (!is_connected(hdev, addr, addr_type)) {
5905 list_add(&params->action, &hdev->pend_le_conns);
5906 __hci_update_background_scan(req);
5907 }
5908 break;
5909 }
5910
5911 params->auto_connect = auto_connect;
5912
5913 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5914 auto_connect);
5915
5916 return 0;
5917}
5918
8afef092
MH		 5919static void device_added(struct sock *sk, struct hci_dev *hdev,
5920 bdaddr_t *bdaddr, u8 type, u8 action)
5921{
5922 struct mgmt_ev_device_added ev;
5923
5924 bacpy(&ev.addr.bdaddr, bdaddr);
5925 ev.addr.type = type;
5926 ev.action = action;
5927
5928 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5929}
5930
1904a853 5931static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 5932{
3b0602cd 5933 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 5934
5935 BT_DBG("status 0x%02x", status);
5936
5937 hci_dev_lock(hdev);
5938
333ae95d 5939 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 5940 if (!cmd)
5941 goto unlock;
5942
5943 cmd->cmd_complete(cmd, mgmt_status(status));
5944 mgmt_pending_remove(cmd);
5945
5946unlock:
5947 hci_dev_unlock(hdev);
5948}
5949
2faade53
MH		 5950static int add_device(struct sock *sk, struct hci_dev *hdev,
5951 void *data, u16 len)
5952{
5953 struct mgmt_cp_add_device *cp = data;
3b0602cd 5954 struct mgmt_pending_cmd *cmd;
5a154e6f 5955 struct hci_request req;
2faade53
MH		 5956 u8 auto_conn, addr_type;
5957 int err;
5958
5959 BT_DBG("%s", hdev->name);
5960
6659358e 5961 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 5962 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 5963 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5964 MGMT_STATUS_INVALID_PARAMS,
5965 &cp->addr, sizeof(cp->addr));
2faade53 5966
4b9e7e75 5967 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 5968 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5969 MGMT_STATUS_INVALID_PARAMS,
5970 &cp->addr, sizeof(cp->addr));
2faade53 5971
5a154e6f
JH		 5972 hci_req_init(&req, hdev);
5973
2faade53
MH		 5974 hci_dev_lock(hdev);
5975
5a154e6f
JH		 5976 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5977 if (!cmd) {
5978 err = -ENOMEM;
5979 goto unlock;
5980 }
5981
5982 cmd->cmd_complete = addr_cmd_complete;
5983
6659358e 5984 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 5985 /* Only incoming connections action is supported for now */
6659358e 5986 if (cp->action != 0x01) {
9df74653
JH		 5987 err = cmd->cmd_complete(cmd,
5988 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 5989 mgmt_pending_remove(cmd);
6659358e
JH		 5990 goto unlock;
5991 }
5992
5993 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5994 cp->addr.type);
5995 if (err)
5996 goto unlock;
a397407f 5997
5a154e6f 5998 __hci_update_page_scan(&req);
a397407f 5999
6659358e
JH		 6000 goto added;
6001 }
6002
2faade53
MH		 6003 if (cp->addr.type == BDADDR_LE_PUBLIC)
6004 addr_type = ADDR_LE_DEV_PUBLIC;
6005 else
6006 addr_type = ADDR_LE_DEV_RANDOM;
6007
4b9e7e75 6008 if (cp->action == 0x02)
2faade53 6009 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 6010 else if (cp->action == 0x01)
6011 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 6012 else
a3451d27 6013 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 6014
bf5b3c8b
MH		 6015 /* If the connection parameters don't exist for this device,
6016 * they will be created and configured with defaults.
6017 */
5a154e6f 6018 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 6019 auto_conn) < 0) {
9df74653 6020 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 6021 mgmt_pending_remove(cmd);
2faade53
MH		 6022 goto unlock;
6023 }
6024
6659358e 6025added:
8afef092
MH		 6026 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6027
5a154e6f
JH		 6028 err = hci_req_run(&req, add_device_complete);
6029 if (err < 0) {
6030 /* ENODATA means no HCI commands were needed (e.g. if
6031 * the adapter is powered off).
6032 */
9df74653
JH		 6033 if (err == -ENODATA)
6034 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 6035 mgmt_pending_remove(cmd);
6036 }
2faade53
MH		 6037
6038unlock:
6039 hci_dev_unlock(hdev);
6040 return err;
6041}
6042
8afef092
MH		 6043static void device_removed(struct sock *sk, struct hci_dev *hdev,
6044 bdaddr_t *bdaddr, u8 type)
6045{
6046 struct mgmt_ev_device_removed ev;
6047
6048 bacpy(&ev.addr.bdaddr, bdaddr);
6049 ev.addr.type = type;
6050
6051 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6052}
6053
1904a853 6054static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 6055{
3b0602cd 6056 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 6057
6058 BT_DBG("status 0x%02x", status);
6059
6060 hci_dev_lock(hdev);
6061
333ae95d 6062 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 6063 if (!cmd)
6064 goto unlock;
6065
6066 cmd->cmd_complete(cmd, mgmt_status(status));
6067 mgmt_pending_remove(cmd);
6068
6069unlock:
6070 hci_dev_unlock(hdev);
6071}
6072
2faade53
MH		 6073static int remove_device(struct sock *sk, struct hci_dev *hdev,
6074 void *data, u16 len)
6075{
6076 struct mgmt_cp_remove_device *cp = data;
3b0602cd 6077 struct mgmt_pending_cmd *cmd;
51ef3ebe 6078 struct hci_request req;
2faade53
MH		 6079 int err;
6080
6081 BT_DBG("%s", hdev->name);
6082
51ef3ebe
JH		 6083 hci_req_init(&req, hdev);
6084
2faade53
MH		 6085 hci_dev_lock(hdev);
6086
51ef3ebe
JH		 6087 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6088 if (!cmd) {
6089 err = -ENOMEM;
6090 goto unlock;
6091 }
6092
6093 cmd->cmd_complete = addr_cmd_complete;
6094
2faade53 6095 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 6096 struct hci_conn_params *params;
2faade53
MH		 6097 u8 addr_type;
6098
6659358e 6099 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 6100 err = cmd->cmd_complete(cmd,
6101 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6102 mgmt_pending_remove(cmd);
2faade53
MH		 6103 goto unlock;
6104 }
6105
6659358e
JH		 6106 if (cp->addr.type == BDADDR_BREDR) {
6107 err = hci_bdaddr_list_del(&hdev->whitelist,
6108 &cp->addr.bdaddr,
6109 cp->addr.type);
6110 if (err) {
9df74653
JH		 6111 err = cmd->cmd_complete(cmd,
6112 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6113 mgmt_pending_remove(cmd);
6659358e
JH		 6114 goto unlock;
6115 }
6116
51ef3ebe 6117 __hci_update_page_scan(&req);
a397407f 6118
6659358e
JH		 6119 device_removed(sk, hdev, &cp->addr.bdaddr,
6120 cp->addr.type);
6121 goto complete;
6122 }
6123
2faade53
MH		 6124 if (cp->addr.type == BDADDR_LE_PUBLIC)
6125 addr_type = ADDR_LE_DEV_PUBLIC;
6126 else
6127 addr_type = ADDR_LE_DEV_RANDOM;
6128
c71593dd
JH		 6129 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6130 addr_type);
6131 if (!params) {
9df74653
JH		 6132 err = cmd->cmd_complete(cmd,
6133 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6134 mgmt_pending_remove(cmd);
c71593dd
JH		 6135 goto unlock;
6136 }
6137
6138 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 6139 err = cmd->cmd_complete(cmd,
6140 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6141 mgmt_pending_remove(cmd);
c71593dd
JH		 6142 goto unlock;
6143 }
6144
d1dbf12e 6145 list_del(&params->action);
c71593dd
JH		 6146 list_del(&params->list);
6147 kfree(params);
51ef3ebe 6148 __hci_update_background_scan(&req);
8afef092
MH		 6149
6150 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 6151 } else {
19de0825 6152 struct hci_conn_params *p, *tmp;
6659358e 6153 struct bdaddr_list *b, *btmp;
19de0825 6154
2faade53 6155 if (cp->addr.type) {
9df74653
JH		 6156 err = cmd->cmd_complete(cmd,
6157 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6158 mgmt_pending_remove(cmd);
2faade53
MH		 6159 goto unlock;
6160 }
6161
6659358e
JH		 6162 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6163 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6164 list_del(&b->list);
6165 kfree(b);
6166 }
6167
51ef3ebe 6168 __hci_update_page_scan(&req);
a397407f 6169
19de0825
JH		 6170 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6171 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6172 continue;
6173 device_removed(sk, hdev, &p->addr, p->addr_type);
6174 list_del(&p->action);
6175 list_del(&p->list);
6176 kfree(p);
6177 }
6178
6179 BT_DBG("All LE connection parameters were removed");
6180
51ef3ebe 6181 __hci_update_background_scan(&req);
2faade53
MH		 6182 }
6183
6659358e 6184complete:
51ef3ebe
JH		 6185 err = hci_req_run(&req, remove_device_complete);
6186 if (err < 0) {
6187 /* ENODATA means no HCI commands were needed (e.g. if
6188 * the adapter is powered off).
6189 */
9df74653
JH		 6190 if (err == -ENODATA)
6191 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 6192 mgmt_pending_remove(cmd);
6193 }
2faade53
MH		 6194
6195unlock:
6196 hci_dev_unlock(hdev);
6197 return err;
6198}
6199
a26f3dcf
JH		 6200static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6201 u16 len)
6202{
6203 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 6204 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6205 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 6206 u16 param_count, expected_len;
6207 int i;
6208
6209 if (!lmp_le_capable(hdev))
a69e8375
JH		 6210 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6211 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 6212
6213 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 6214 if (param_count > max_param_count) {
6215 BT_ERR("load_conn_param: too big param_count value %u",
6216 param_count);
a69e8375
JH		 6217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6218 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 6219 }
a26f3dcf
JH		 6220
6221 expected_len = sizeof(*cp) + param_count *
6222 sizeof(struct mgmt_conn_param);
6223 if (expected_len != len) {
6224 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6225 expected_len, len);
a69e8375
JH		 6226 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6227 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 6228 }
6229
6230 BT_DBG("%s param_count %u", hdev->name, param_count);
6231
6232 hci_dev_lock(hdev);
6233
6234 hci_conn_params_clear_disabled(hdev);
6235
6236 for (i = 0; i < param_count; i++) {
6237 struct mgmt_conn_param *param = &cp->params[i];
6238 struct hci_conn_params *hci_param;
6239 u16 min, max, latency, timeout;
6240 u8 addr_type;
6241
6242 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6243 param->addr.type);
6244
6245 if (param->addr.type == BDADDR_LE_PUBLIC) {
6246 addr_type = ADDR_LE_DEV_PUBLIC;
6247 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6248 addr_type = ADDR_LE_DEV_RANDOM;
6249 } else {
6250 BT_ERR("Ignoring invalid connection parameters");
6251 continue;
6252 }
6253
6254 min = le16_to_cpu(param->min_interval);
6255 max = le16_to_cpu(param->max_interval);
6256 latency = le16_to_cpu(param->latency);
6257 timeout = le16_to_cpu(param->timeout);
6258
6259 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6260 min, max, latency, timeout);
6261
6262 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6263 BT_ERR("Ignoring invalid connection parameters");
6264 continue;
6265 }
6266
6267 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6268 addr_type);
6269 if (!hci_param) {
6270 BT_ERR("Failed to add connection parameters");
6271 continue;
6272 }
6273
6274 hci_param->conn_min_interval = min;
6275 hci_param->conn_max_interval = max;
6276 hci_param->conn_latency = latency;
6277 hci_param->supervision_timeout = timeout;
6278 }
6279
6280 hci_dev_unlock(hdev);
6281
2a1afb5a
JH		 6282 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6283 NULL, 0);
a26f3dcf
JH		 6284}
6285
dbece37a
MH		 6286static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6287 void *data, u16 len)
6288{
6289 struct mgmt_cp_set_external_config *cp = data;
6290 bool changed;
6291 int err;
6292
6293 BT_DBG("%s", hdev->name);
6294
6295 if (hdev_is_powered(hdev))
a69e8375
JH		 6296 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6297 MGMT_STATUS_REJECTED);
dbece37a
MH		 6298
6299 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6300 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6301 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6302
6303 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6304 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6305 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6306
6307 hci_dev_lock(hdev);
6308
6309 if (cp->config)
238be788 6310 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6311 else
a69d8927 6312 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6313
6314 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6315 if (err < 0)
6316 goto unlock;
6317
6318 if (!changed)
6319 goto unlock;
6320
f4537c04
MH		 6321 err = new_options(hdev, sk);
6322
d7a5a11d 6323 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6324 mgmt_index_removed(hdev);
d603b76b 6325
516018a9 6326 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6327 hci_dev_set_flag(hdev, HCI_CONFIG);
6328 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6329
6330 queue_work(hdev->req_workqueue, &hdev->power_on);
6331 } else {
5ea234d3 6332 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6333 mgmt_index_added(hdev);
6334 }
dbece37a
MH		 6335 }
6336
6337unlock:
6338 hci_dev_unlock(hdev);
6339 return err;
6340}
6341
9713c17b
MH		 6342static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6343 void *data, u16 len)
6344{
6345 struct mgmt_cp_set_public_address *cp = data;
6346 bool changed;
6347 int err;
6348
6349 BT_DBG("%s", hdev->name);
6350
6351 if (hdev_is_powered(hdev))
a69e8375
JH		 6352 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6353 MGMT_STATUS_REJECTED);
9713c17b
MH		 6354
6355 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6356 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6357 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6358
6359 if (!hdev->set_bdaddr)
a69e8375
JH		 6360 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6361 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6362
6363 hci_dev_lock(hdev);
6364
6365 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6366 bacpy(&hdev->public_addr, &cp->bdaddr);
6367
6368 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6369 if (err < 0)
6370 goto unlock;
6371
6372 if (!changed)
6373 goto unlock;
6374
d7a5a11d 6375 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6376 err = new_options(hdev, sk);
6377
6378 if (is_configured(hdev)) {
6379 mgmt_index_removed(hdev);
6380
a358dc11 6381 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6382
a1536da2
MH		 6383 hci_dev_set_flag(hdev, HCI_CONFIG);
6384 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6385
6386 queue_work(hdev->req_workqueue, &hdev->power_on);
6387 }
6388
6389unlock:
6390 hci_dev_unlock(hdev);
6391 return err;
6392}
6393
bea41609
MH		 6394static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6395 u8 data_len)
6396{
6397 eir[eir_len++] = sizeof(type) + data_len;
6398 eir[eir_len++] = type;
6399 memcpy(&eir[eir_len], data, data_len);
6400 eir_len += data_len;
6401
6402 return eir_len;
6403}
6404
4f0f155c
MH		 6405static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6406 void *data, u16 data_len)
6407{
6408 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6409 struct mgmt_rp_read_local_oob_ext_data *rp;
6410 size_t rp_len;
6411 u16 eir_len;
0821a2c5 6412 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6413 int err;
6414
6415 BT_DBG("%s", hdev->name);
6416
6417 if (!hdev_is_powered(hdev))
6418 return mgmt_cmd_complete(sk, hdev->id,
6419 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6420 MGMT_STATUS_NOT_POWERED,
6421 &cp->type, sizeof(cp->type));
6422
6423 switch (cp->type) {
6424 case BIT(BDADDR_BREDR):
6425 status = mgmt_bredr_support(hdev);
6426 if (status)
6427 return mgmt_cmd_complete(sk, hdev->id,
6428 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6429 status, &cp->type,
6430 sizeof(cp->type));
6431 eir_len = 5;
6432 break;
6433 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6434 status = mgmt_le_support(hdev);
6435 if (status)
6436 return mgmt_cmd_complete(sk, hdev->id,
6437 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6438 status, &cp->type,
6439 sizeof(cp->type));
0821a2c5 6440 eir_len = 9 + 3 + 18 + 18 + 3;
4f0f155c
MH		 6441 break;
6442 default:
6443 return mgmt_cmd_complete(sk, hdev->id,
6444 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6445 MGMT_STATUS_INVALID_PARAMS,
6446 &cp->type, sizeof(cp->type));
6447 }
6448
6449 hci_dev_lock(hdev);
6450
6451 rp_len = sizeof(*rp) + eir_len;
6452 rp = kmalloc(rp_len, GFP_ATOMIC);
6453 if (!rp) {
6454 hci_dev_unlock(hdev);
6455 return -ENOMEM;
6456 }
6457
6458 eir_len = 0;
6459 switch (cp->type) {
6460 case BIT(BDADDR_BREDR):
6461 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6462 hdev->dev_class, 3);
6463 break;
6464 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6465 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6466 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5
MH		 6467 hci_dev_unlock(hdev);
6468 err = mgmt_cmd_complete(sk, hdev->id,
5082a599
MH		 6469 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6470 MGMT_STATUS_FAILED,
6471 &cp->type, sizeof(cp->type));
0821a2c5
MH		 6472 goto done;
6473 }
6474
4f0f155c
MH		 6475 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6476 memcpy(addr, &hdev->rpa, 6);
6477 addr[6] = 0x01;
6478 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6479 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6480 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6481 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6482 memcpy(addr, &hdev->static_addr, 6);
6483 addr[6] = 0x01;
6484 } else {
6485 memcpy(addr, &hdev->bdaddr, 6);
6486 addr[6] = 0x00;
6487 }
6488
6489 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6490 addr, sizeof(addr));
6491
6492 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6493 role = 0x02;
6494 else
6495 role = 0x01;
6496
6497 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6498 &role, sizeof(role));
6499
5082a599
MH		 6500 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6501 eir_len = eir_append_data(rp->eir, eir_len,
6502 EIR_LE_SC_CONFIRM,
6503 hash, sizeof(hash));
0821a2c5 6504
5082a599
MH		 6505 eir_len = eir_append_data(rp->eir, eir_len,
6506 EIR_LE_SC_RANDOM,
6507 rand, sizeof(rand));
6508 }
0821a2c5 6509
4f0f155c
MH		 6510 flags = get_adv_discov_flags(hdev);
6511
6512 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6513 flags |= LE_AD_NO_BREDR;
6514
6515 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6516 &flags, sizeof(flags));
6517 break;
6518 }
6519
6520 rp->type = cp->type;
6521 rp->eir_len = cpu_to_le16(eir_len);
6522
6523 hci_dev_unlock(hdev);
6524
72000df2
MH		 6525 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6526
4f0f155c 6527 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5425f98e 6528 MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
72000df2
MH		 6529 if (err < 0)
6530 goto done;
6531
6532 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6533 rp, sizeof(*rp) + eir_len,
6534 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6535
0821a2c5 6536done:
4f0f155c
MH		 6537 kfree(rp);
6538
6539 return err;
6540}
6541
089fa8c0
AU		 6542static u32 get_supported_adv_flags(struct hci_dev *hdev)
6543{
6544 u32 flags = 0;
6545
6546 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6547 flags |= MGMT_ADV_FLAG_DISCOV;
6548 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6549 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6550
6551 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6552 flags |= MGMT_ADV_FLAG_TX_POWER;
6553
6554 return flags;
6555}
6556
d3d5305b
MH		 6557static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6558 void *data, u16 data_len)
6559{
6560 struct mgmt_rp_read_adv_features *rp;
6561 size_t rp_len;
6562 int err;
24b4f38f 6563 bool instance;
089fa8c0 6564 u32 supported_flags;
d3d5305b
MH		 6565
6566 BT_DBG("%s", hdev->name);
6567
089fa8c0
AU		 6568 if (!lmp_le_capable(hdev))
6569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6570 MGMT_STATUS_REJECTED);
6571
d3d5305b
MH		 6572 hci_dev_lock(hdev);
6573
6574 rp_len = sizeof(*rp);
24b4f38f
AU		 6575
6576 /* Currently only one instance is supported, so just add 1 to the
6577 * response length.
6578 */
6579 instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6580 if (instance)
6581 rp_len++;
6582
d3d5305b
MH		 6583 rp = kmalloc(rp_len, GFP_ATOMIC);
6584 if (!rp) {
6585 hci_dev_unlock(hdev);
6586 return -ENOMEM;
6587 }
6588
089fa8c0
AU		 6589 supported_flags = get_supported_adv_flags(hdev);
6590
6591 rp->supported_flags = cpu_to_le32(supported_flags);
dc5d82a9
MH		 6592 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6593 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
24b4f38f
AU		 6594 rp->max_instances = 1;
6595
6596 /* Currently only one instance is supported, so simply return the
6597 * current instance number.
6598 */
6599 if (instance) {
6600 rp->num_instances = 1;
6601 rp->instance[0] = 1;
6602 } else {
6603 rp->num_instances = 0;
6604 }
d3d5305b
MH		 6605
6606 hci_dev_unlock(hdev);
6607
6608 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6609 MGMT_STATUS_SUCCESS, rp, rp_len);
6610
6611 kfree(rp);
6612
6613 return err;
6614}
6615
4117ed70 6616static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
b44133ff 6617 u8 len, bool is_adv_data)
24b4f38f 6618{
4117ed70 6619 u8 max_len = HCI_MAX_AD_LENGTH;
24b4f38f 6620 int i, cur_len;
b44133ff 6621 bool flags_managed = false;
5507e358 6622 bool tx_power_managed = false;
67e0c0cd
AU		 6623 u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6624 MGMT_ADV_FLAG_MANAGED_FLAGS;
24b4f38f 6625
807ec772 6626 if (is_adv_data && (adv_flags & flags_params)) {
b44133ff
AU		 6627 flags_managed = true;
6628 max_len -= 3;
6629 }
24b4f38f 6630
5507e358
AU		 6631 if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
6632 tx_power_managed = true;
6633 max_len -= 3;
6634 }
6635
4117ed70 6636 if (len > max_len)
24b4f38f
AU		 6637 return false;
6638
4117ed70
AU		 6639 /* Make sure that the data is correctly formatted. */
6640 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6641 cur_len = data[i];
24b4f38f 6642
b44133ff
AU		 6643 if (flags_managed && data[i + 1] == EIR_FLAGS)
6644 return false;
6645
5507e358
AU		 6646 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
6647 return false;
6648
24b4f38f
AU		 6649 /* If the current field length would exceed the total data
6650 * length, then it's invalid.
6651 */
4117ed70 6652 if (i + cur_len >= len)
24b4f38f
AU		 6653 return false;
6654 }
6655
6656 return true;
6657}
6658
24b4f38f
AU		 6659static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6660 u16 opcode)
6661{
6662 struct mgmt_pending_cmd *cmd;
6663 struct mgmt_rp_add_advertising rp;
6664
6665 BT_DBG("status %d", status);
6666
6667 hci_dev_lock(hdev);
6668
6669 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6670
6671 if (status) {
6672 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6673 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6674 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6675 }
6676
6677 if (!cmd)
6678 goto unlock;
6679
6680 rp.instance = 0x01;
6681
6682 if (status)
6683 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
6684 mgmt_status(status));
6685 else
6686 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
6687 mgmt_status(status), &rp, sizeof(rp));
6688
6689 mgmt_pending_remove(cmd);
6690
6691unlock:
6692 hci_dev_unlock(hdev);
6693}
6694
912098a6
AU		 6695static void adv_timeout_expired(struct work_struct *work)
6696{
6697 struct hci_dev *hdev = container_of(work, struct hci_dev,
6698 adv_instance.timeout_exp.work);
6699
6700 hdev->adv_instance.timeout = 0;
6701
6702 hci_dev_lock(hdev);
6703 clear_adv_instance(hdev);
6704 hci_dev_unlock(hdev);
6705}
6706
24b4f38f
AU		 6707static int add_advertising(struct sock *sk, struct hci_dev *hdev,
6708 void *data, u16 data_len)
6709{
6710 struct mgmt_cp_add_advertising *cp = data;
6711 struct mgmt_rp_add_advertising rp;
6712 u32 flags;
089fa8c0 6713 u32 supported_flags;
24b4f38f 6714 u8 status;
912098a6 6715 u16 timeout;
24b4f38f
AU		 6716 int err;
6717 struct mgmt_pending_cmd *cmd;
6718 struct hci_request req;
6719
6720 BT_DBG("%s", hdev->name);
6721
6722 status = mgmt_le_support(hdev);
6723 if (status)
6724 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6725 status);
6726
6727 flags = __le32_to_cpu(cp->flags);
912098a6 6728 timeout = __le16_to_cpu(cp->timeout);
24b4f38f 6729
089fa8c0
AU		 6730 /* The current implementation only supports adding one instance and only
6731 * a subset of the specified flags.
6732 */
6733 supported_flags = get_supported_adv_flags(hdev);
6734 if (cp->instance != 0x01 || (flags & ~supported_flags))
24b4f38f
AU		 6735 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6736 MGMT_STATUS_INVALID_PARAMS);
6737
6738 hci_dev_lock(hdev);
6739
912098a6
AU		 6740 if (timeout && !hdev_is_powered(hdev)) {
6741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6742 MGMT_STATUS_REJECTED);
6743 goto unlock;
6744 }
6745
24b4f38f 6746 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
da929335 6747 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
24b4f38f
AU		 6748 pending_find(MGMT_OP_SET_LE, hdev)) {
6749 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6750 MGMT_STATUS_BUSY);
6751 goto unlock;
6752 }
6753
b44133ff 6754 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
4117ed70 6755 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 6756 cp->scan_rsp_len, false)) {
24b4f38f
AU		 6757 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6758 MGMT_STATUS_INVALID_PARAMS);
6759 goto unlock;
6760 }
6761
912098a6
AU		 6762 INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
6763
24b4f38f
AU		 6764 hdev->adv_instance.flags = flags;
6765 hdev->adv_instance.adv_data_len = cp->adv_data_len;
6766 hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
6767
6768 if (cp->adv_data_len)
6769 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
6770
6771 if (cp->scan_rsp_len)
6772 memcpy(hdev->adv_instance.scan_rsp_data,
6773 cp->data + cp->adv_data_len, cp->scan_rsp_len);
6774
912098a6
AU		 6775 if (hdev->adv_instance.timeout)
6776 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6777
6778 hdev->adv_instance.timeout = timeout;
6779
6780 if (timeout)
6781 queue_delayed_work(hdev->workqueue,
6782 &hdev->adv_instance.timeout_exp,
6783 msecs_to_jiffies(timeout * 1000));
6784
24b4f38f
AU		 6785 if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
6786 advertising_added(sk, hdev, 1);
6787
6788 /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6789 * we have no HCI communication to make. Simply return.
6790 */
6791 if (!hdev_is_powered(hdev) ||
6792 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6793 rp.instance = 0x01;
6794 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
6795 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6796 goto unlock;
6797 }
6798
6799 /* We're good to go, update advertising data, parameters, and start
6800 * advertising.
6801 */
6802 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
6803 data_len);
6804 if (!cmd) {
6805 err = -ENOMEM;
6806 goto unlock;
6807 }
6808
6809 hci_req_init(&req, hdev);
6810
6811 update_adv_data(&req);
4117ed70 6812 update_scan_rsp_data(&req);
24b4f38f
AU		 6813 enable_advertising(&req);
6814
6815 err = hci_req_run(&req, add_advertising_complete);
6816 if (err < 0)
6817 mgmt_pending_remove(cmd);
6818
6819unlock:
6820 hci_dev_unlock(hdev);
6821
6822 return err;
6823}
6824
da929335
AU		 6825static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
6826 u16 opcode)
6827{
6828 struct mgmt_pending_cmd *cmd;
6829 struct mgmt_rp_remove_advertising rp;
6830
6831 BT_DBG("status %d", status);
6832
6833 hci_dev_lock(hdev);
6834
6835 /* A failure status here only means that we failed to disable
6836 * advertising. Otherwise, the advertising instance has been removed,
6837 * so report success.
6838 */
6839 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
6840 if (!cmd)
6841 goto unlock;
6842
6843 rp.instance = 1;
6844
6845 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
6846 &rp, sizeof(rp));
6847 mgmt_pending_remove(cmd);
6848
6849unlock:
6850 hci_dev_unlock(hdev);
6851}
6852
6853static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
6854 void *data, u16 data_len)
6855{
6856 struct mgmt_cp_remove_advertising *cp = data;
6857 struct mgmt_rp_remove_advertising rp;
6858 int err;
6859 struct mgmt_pending_cmd *cmd;
6860 struct hci_request req;
6861
6862 BT_DBG("%s", hdev->name);
6863
6864 /* The current implementation only allows modifying instance no 1. A
6865 * value of 0 indicates that all instances should be cleared.
6866 */
6867 if (cp->instance > 1)
6868 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6869 MGMT_STATUS_INVALID_PARAMS);
6870
6871 hci_dev_lock(hdev);
6872
6873 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
6874 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
6875 pending_find(MGMT_OP_SET_LE, hdev)) {
6876 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6877 MGMT_STATUS_BUSY);
6878 goto unlock;
6879 }
6880
6881 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
6882 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
6883 MGMT_STATUS_INVALID_PARAMS);
6884 goto unlock;
6885 }
6886
912098a6
AU		 6887 if (hdev->adv_instance.timeout)
6888 cancel_delayed_work(&hdev->adv_instance.timeout_exp);
6889
da929335
AU		 6890 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6891
6892 advertising_removed(sk, hdev, 1);
6893
6894 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6895
6896 /* If the HCI_ADVERTISING flag is set or the device isn't powered then
6897 * we have no HCI communication to make. Simply return.
6898 */
6899 if (!hdev_is_powered(hdev) ||
6900 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
6901 rp.instance = 1;
6902 err = mgmt_cmd_complete(sk, hdev->id,
6903 MGMT_OP_REMOVE_ADVERTISING,
6904 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
6905 goto unlock;
6906 }
6907
6908 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
6909 data_len);
6910 if (!cmd) {
6911 err = -ENOMEM;
6912 goto unlock;
6913 }
6914
6915 hci_req_init(&req, hdev);
6916 disable_advertising(&req);
6917
6918 err = hci_req_run(&req, remove_advertising_complete);
6919 if (err < 0)
6920 mgmt_pending_remove(cmd);
6921
6922unlock:
6923 hci_dev_unlock(hdev);
6924
6925 return err;
6926}
6927
6d785aa3 6928static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 6929 { NULL }, /* 0x0000 (no command) */
b9a245fb 6930 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 6931 HCI_MGMT_NO_HDEV |
6932 HCI_MGMT_UNTRUSTED },
b9a245fb 6933 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 6934 HCI_MGMT_NO_HDEV |
6935 HCI_MGMT_UNTRUSTED },
b9a245fb 6936 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 6937 HCI_MGMT_NO_HDEV |
6938 HCI_MGMT_UNTRUSTED },
6939 { read_controller_info, MGMT_READ_INFO_SIZE,
6940 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 6941 { set_powered, MGMT_SETTING_SIZE },
6942 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6943 { set_connectable, MGMT_SETTING_SIZE },
6944 { set_fast_connectable, MGMT_SETTING_SIZE },
6945 { set_bondable, MGMT_SETTING_SIZE },
6946 { set_link_security, MGMT_SETTING_SIZE },
6947 { set_ssp, MGMT_SETTING_SIZE },
6948 { set_hs, MGMT_SETTING_SIZE },
6949 { set_le, MGMT_SETTING_SIZE },
6950 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6951 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6952 { add_uuid, MGMT_ADD_UUID_SIZE },
6953 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 6954 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6955 HCI_MGMT_VAR_LEN },
6956 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6957 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6958 { disconnect, MGMT_DISCONNECT_SIZE },
6959 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6960 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6961 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6962 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6963 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6964 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6965 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6966 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6967 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6968 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6969 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 6970 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6971 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6972 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6973 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6974 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6975 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6976 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6977 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6978 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6979 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6980 { set_advertising, MGMT_SETTING_SIZE },
6981 { set_bredr, MGMT_SETTING_SIZE },
6982 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6983 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6984 { set_secure_conn, MGMT_SETTING_SIZE },
6985 { set_debug_keys, MGMT_SETTING_SIZE },
6986 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 6987 { load_irks, MGMT_LOAD_IRKS_SIZE,
6988 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6989 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6990 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6991 { add_device, MGMT_ADD_DEVICE_SIZE },
6992 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 6993 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6994 HCI_MGMT_VAR_LEN },
6995 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 6996 HCI_MGMT_NO_HDEV |
6997 HCI_MGMT_UNTRUSTED },
b9a245fb 6998 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 6999 HCI_MGMT_UNCONFIGURED |
7000 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 7001 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
7002 HCI_MGMT_UNCONFIGURED },
7003 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
7004 HCI_MGMT_UNCONFIGURED },
7005 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7006 HCI_MGMT_VAR_LEN },
4f0f155c 7007 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 7008 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 7009 HCI_MGMT_NO_HDEV |
7010 HCI_MGMT_UNTRUSTED },
d3d5305b 7011 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 7012 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7013 HCI_MGMT_VAR_LEN },
da929335 7014 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
0f4e68cf
JH		 7015};
7016
bf6b56db 7017void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 7018{
ced85549 7019 struct mgmt_ev_ext_index ev;
bb4b2a9a 7020
0602a8ad
MH		 7021 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7022 return;
7023
f9207338
MH		 7024 switch (hdev->dev_type) {
7025 case HCI_BREDR:
7026 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7027 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7028 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7029 ev.type = 0x01;
f9207338
MH		 7030 } else {
7031 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7032 HCI_MGMT_INDEX_EVENTS);
ced85549 7033 ev.type = 0x00;
f9207338
MH		 7034 }
7035 break;
ced85549
MH		 7036 case HCI_AMP:
7037 ev.type = 0x02;
7038 break;
7039 default:
7040 return;
f9207338 7041 }
ced85549
MH		 7042
7043 ev.bus = hdev->bus;
7044
7045 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7046 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 7047}
7048
bf6b56db 7049void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 7050{
ced85549 7051 struct mgmt_ev_ext_index ev;
5f159032 7052 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 7053
0602a8ad
MH		 7054 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7055 return;
7056
f9207338
MH		 7057 switch (hdev->dev_type) {
7058 case HCI_BREDR:
7059 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 7060
f9207338
MH		 7061 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7062 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7063 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7064 ev.type = 0x01;
f9207338
MH		 7065 } else {
7066 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7067 HCI_MGMT_INDEX_EVENTS);
ced85549 7068 ev.type = 0x00;
f9207338
MH		 7069 }
7070 break;
ced85549
MH		 7071 case HCI_AMP:
7072 ev.type = 0x02;
7073 break;
7074 default:
7075 return;
f9207338 7076 }
ced85549
MH		 7077
7078 ev.bus = hdev->bus;
7079
7080 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7081 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 7082}
7083
6046dc3e 7084/* This function requires the caller holds hdev->lock */
2cf22218 7085static void restart_le_actions(struct hci_request *req)
6046dc3e 7086{
2cf22218 7087 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 7088 struct hci_conn_params *p;
7089
7090 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 7091 /* Needed for AUTO_OFF case where might not "really"
7092 * have been powered off.
7093 */
7094 list_del_init(&p->action);
7095
7096 switch (p->auto_connect) {
4b9e7e75 7097 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 7098 case HCI_AUTO_CONN_ALWAYS:
7099 list_add(&p->action, &hdev->pend_le_conns);
7100 break;
7101 case HCI_AUTO_CONN_REPORT:
7102 list_add(&p->action, &hdev->pend_le_reports);
7103 break;
7104 default:
7105 break;
c83ed19d 7106 }
6046dc3e 7107 }
c83ed19d 7108
2cf22218 7109 __hci_update_background_scan(req);
6046dc3e
AG		 7110}
7111
1904a853 7112static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 7113{
7114 struct cmd_lookup match = { NULL, hdev };
7115
7116 BT_DBG("status 0x%02x", status);
7117
162a3bac
MH		 7118 if (!status) {
7119 /* Register the available SMP channels (BR/EDR and LE) only
7120 * when successfully powering on the controller. This late
7121 * registration is required so that LE SMP can clearly
7122 * decide if the public address or static address is used.
7123 */
7124 smp_register(hdev);
7125 }
7126
229ab39c
JH		 7127 hci_dev_lock(hdev);
7128
7129 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7130
7131 new_settings(hdev, match.sk);
7132
7133 hci_dev_unlock(hdev);
7134
7135 if (match.sk)
7136 sock_put(match.sk);
7137}
7138
70da6243 7139static int powered_update_hci(struct hci_dev *hdev)
5add6af8 7140{
890ea898 7141 struct hci_request req;
70da6243 7142 u8 link_sec;
5add6af8 7143
890ea898
JH		 7144 hci_req_init(&req, hdev);
7145
d7a5a11d 7146 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 7147 !lmp_host_ssp_capable(hdev)) {
574ea3c7 7148 u8 mode = 0x01;
5e5282bb 7149
574ea3c7
MH		 7150 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7151
7152 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7153 u8 support = 0x01;
5add6af8 7154
574ea3c7
MH		 7155 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7156 sizeof(support), &support);
7157 }
ec6f99b8
JH		 7158 }
7159
d7a5a11d 7160 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 7161 lmp_bredr_capable(hdev)) {
70da6243 7162 struct hci_cp_write_le_host_supported cp;
f0ff92fb 7163
32226e4f
MH		 7164 cp.le = 0x01;
7165 cp.simul = 0x00;
3d1cbdd6 7166
70da6243
JH		 7167 /* Check first if we already have the right
7168 * host state (host features set)
7169 */
7170 if (cp.le != lmp_host_le_capable(hdev) ||
7171 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 7172 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7173 sizeof(cp), &cp);
70da6243 7174 }
3d1cbdd6 7175
d13eafce 7176 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 7177 /* Make sure the controller has a good default for
7178 * advertising data. This also applies to the case
7179 * where BR/EDR was toggled during the AUTO_OFF phase.
7180 */
d7a5a11d 7181 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
5947f4bc 7182 update_adv_data(&req);
f14d8f64
MH		 7183 update_scan_rsp_data(&req);
7184 }
441ad2d0 7185
24b4f38f
AU		 7186 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7187 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
bba3aa55 7188 enable_advertising(&req);
2cf22218
JH		 7189
7190 restart_le_actions(&req);
eeca6f89
JH		 7191 }
7192
d7a5a11d 7193 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 7194 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 7195 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7196 sizeof(link_sec), &link_sec);
562fcc24 7197
70da6243 7198 if (lmp_bredr_capable(hdev)) {
d7a5a11d 7199 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 7200 write_fast_connectable(&req, true);
7201 else
7202 write_fast_connectable(&req, false);
1d2dc5b7 7203 __hci_update_page_scan(&req);
890ea898 7204 update_class(&req);
13928971 7205 update_name(&req);
890ea898 7206 update_eir(&req);
70da6243 7207 }
562fcc24 7208
229ab39c 7209 return hci_req_run(&req, powered_complete);
70da6243 7210}
562fcc24 7211
70da6243
JH		 7212int mgmt_powered(struct hci_dev *hdev, u8 powered)
7213{
7214 struct cmd_lookup match = { NULL, hdev };
9845904f 7215 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 7216 int err;
f0ff92fb 7217
d7a5a11d 7218 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 7219 return 0;
7220
70da6243 7221 if (powered) {
229ab39c
JH		 7222 if (powered_update_hci(hdev) == 0)
7223 return 0;
fe038884 7224
229ab39c
JH		 7225 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7226 &match);
7227 goto new_settings;
b24752fe
JH		 7228 }
7229
229ab39c 7230 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 7231
7232 /* If the power off is because of hdev unregistration let
7233 * use the appropriate INVALID_INDEX status. Otherwise use
7234 * NOT_POWERED. We cover both scenarios here since later in
7235 * mgmt_index_removed() any hci_conn callbacks will have already
7236 * been triggered, potentially causing misleading DISCONNECTED
7237 * status responses.
7238 */
d7a5a11d 7239 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 7240 status = MGMT_STATUS_INVALID_INDEX;
7241 else
7242 status = MGMT_STATUS_NOT_POWERED;
7243
7244 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 7245
7246 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 7247 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7248 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 7249
7250new_settings:
beadb2bd 7251 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 7252
7253 if (match.sk)
7254 sock_put(match.sk);
7255
7bb895d6 7256 return err;
5add6af8 7257}
73f22f62 7258
3eec705e 7259void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 7260{
3b0602cd 7261 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 7262 u8 status;
7263
333ae95d 7264 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 7265 if (!cmd)
3eec705e 7266 return;
96570ffc
JH		 7267
7268 if (err == -ERFKILL)
7269 status = MGMT_STATUS_RFKILLED;
7270 else
7271 status = MGMT_STATUS_FAILED;
7272
a69e8375 7273 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 7274
7275 mgmt_pending_remove(cmd);
96570ffc
JH		 7276}
7277
d1967ff8
MH		 7278void mgmt_discoverable_timeout(struct hci_dev *hdev)
7279{
7280 struct hci_request req;
d1967ff8
MH		 7281
7282 hci_dev_lock(hdev);
7283
7284 /* When discoverable timeout triggers, then just make sure
7285 * the limited discoverable flag is cleared. Even in the case
7286 * of a timeout triggered from general discoverable, it is
7287 * safe to unconditionally clear the flag.
7288 */
a358dc11
MH		 7289 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7290 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 7291
7292 hci_req_init(&req, hdev);
d7a5a11d 7293 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 7294 u8 scan = SCAN_PAGE;
7295 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7296 sizeof(scan), &scan);
7297 }
d1967ff8 7298 update_class(&req);
24b4f38f
AU		 7299
7300 /* Advertising instances don't use the global discoverable setting, so
7301 * only update AD if advertising was enabled using Set Advertising.
7302 */
7303 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7304 update_adv_data(&req);
7305
d1967ff8
MH		 7306 hci_req_run(&req, NULL);
7307
7308 hdev->discov_timeout = 0;
7309
9a43e25f
JH		 7310 new_settings(hdev, NULL);
7311
d1967ff8
MH		 7312 hci_dev_unlock(hdev);
7313}
7314
dc4a5ee2
MH		 7315void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7316 bool persistent)
55ed8ca1 7317{
86742e1e 7318 struct mgmt_ev_new_link_key ev;
55ed8ca1 7319
a492cd52 7320 memset(&ev, 0, sizeof(ev));
55ed8ca1 7321
a492cd52 7322 ev.store_hint = persistent;
d753fdc4 7323 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 7324 ev.key.addr.type = BDADDR_BREDR;
a492cd52 7325 ev.key.type = key->type;
9b3b4460 7326 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 7327 ev.key.pin_len = key->pin_len;
55ed8ca1 7328
dc4a5ee2 7329 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 7330}
f7520543 7331
d7b25450
JH		 7332static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7333{
23fb8de3
JH		 7334 switch (ltk->type) {
7335 case SMP_LTK:
7336 case SMP_LTK_SLAVE:
7337 if (ltk->authenticated)
7338 return MGMT_LTK_AUTHENTICATED;
7339 return MGMT_LTK_UNAUTHENTICATED;
7340 case SMP_LTK_P256:
7341 if (ltk->authenticated)
7342 return MGMT_LTK_P256_AUTH;
7343 return MGMT_LTK_P256_UNAUTH;
7344 case SMP_LTK_P256_DEBUG:
7345 return MGMT_LTK_P256_DEBUG;
7346 }
d7b25450
JH		 7347
7348 return MGMT_LTK_UNAUTHENTICATED;
7349}
7350
53ac6ab6 7351void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 7352{
7353 struct mgmt_ev_new_long_term_key ev;
7354
7355 memset(&ev, 0, sizeof(ev));
7356
5192d301
MH		 7357 /* Devices using resolvable or non-resolvable random addresses
7358 * without providing an indentity resolving key don't require
7359 * to store long term keys. Their addresses will change the
7360 * next time around.
7361 *
7362 * Only when a remote device provides an identity address
7363 * make sure the long term key is stored. If the remote
7364 * identity is known, the long term keys are internally
7365 * mapped to the identity address. So allow static random
7366 * and public addresses here.
7367 */
ba74b666
JH		 7368 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7369 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7370 ev.store_hint = 0x00;
7371 else
53ac6ab6 7372 ev.store_hint = persistent;
ba74b666 7373
346af67b 7374 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 7375 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 7376 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 7377 ev.key.enc_size = key->enc_size;
7378 ev.key.ediv = key->ediv;
fe39c7b2 7379 ev.key.rand = key->rand;
346af67b 7380
2ceba539 7381 if (key->type == SMP_LTK)
346af67b
VCG		 7382 ev.key.master = 1;
7383
346af67b
VCG		 7384 memcpy(ev.key.val, key->val, sizeof(key->val));
7385
083368f7 7386 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 7387}
7388
95fbac8a
JH		 7389void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7390{
7391 struct mgmt_ev_new_irk ev;
7392
7393 memset(&ev, 0, sizeof(ev));
7394
bab6d1e5
MH		 7395 /* For identity resolving keys from devices that are already
7396 * using a public address or static random address, do not
7397 * ask for storing this key. The identity resolving key really
7398 * is only mandatory for devices using resovlable random
7399 * addresses.
7400 *
7401 * Storing all identity resolving keys has the downside that
7402 * they will be also loaded on next boot of they system. More
7403 * identity resolving keys, means more time during scanning is
7404 * needed to actually resolve these addresses.
7405 */
7406 if (bacmp(&irk->rpa, BDADDR_ANY))
7407 ev.store_hint = 0x01;
7408 else
7409 ev.store_hint = 0x00;
7410
95fbac8a
JH		 7411 bacpy(&ev.rpa, &irk->rpa);
7412 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7413 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7414 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7415
7416 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7417}
7418
53ac6ab6
MH		 7419void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7420 bool persistent)
7ee4ea36
MH		 7421{
7422 struct mgmt_ev_new_csrk ev;
7423
7424 memset(&ev, 0, sizeof(ev));
7425
7426 /* Devices using resolvable or non-resolvable random addresses
7427 * without providing an indentity resolving key don't require
7428 * to store signature resolving keys. Their addresses will change
7429 * the next time around.
7430 *
7431 * Only when a remote device provides an identity address
7432 * make sure the signature resolving key is stored. So allow
7433 * static random and public addresses here.
7434 */
7435 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7436 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7437 ev.store_hint = 0x00;
7438 else
53ac6ab6 7439 ev.store_hint = persistent;
7ee4ea36
MH		 7440
7441 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7442 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 7443 ev.key.type = csrk->type;
7ee4ea36
MH		 7444 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7445
7446 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7447}
7448
ffb5a827 7449void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 7450 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7451 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 7452{
7453 struct mgmt_ev_new_conn_param ev;
7454
c103aea6
JH		 7455 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7456 return;
7457
ffb5a827
AG		 7458 memset(&ev, 0, sizeof(ev));
7459 bacpy(&ev.addr.bdaddr, bdaddr);
7460 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 7461 ev.store_hint = store_hint;
ffb5a827
AG		 7462 ev.min_interval = cpu_to_le16(min_interval);
7463 ev.max_interval = cpu_to_le16(max_interval);
7464 ev.latency = cpu_to_le16(latency);
7465 ev.timeout = cpu_to_le16(timeout);
7466
7467 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7468}
7469
48ec92fa
AA		 7470void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7471 u32 flags, u8 *name, u8 name_len)
f7520543 7472{
b644ba33
JH		 7473 char buf[512];
7474 struct mgmt_ev_device_connected *ev = (void *) buf;
7475 u16 eir_len = 0;
f7520543 7476
48ec92fa
AA		 7477 bacpy(&ev->addr.bdaddr, &conn->dst);
7478 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 7479
c95f0ba7 7480 ev->flags = __cpu_to_le32(flags);
08c79b61 7481
fd45ada9
AA		 7482 /* We must ensure that the EIR Data fields are ordered and
7483 * unique. Keep it simple for now and avoid the problem by not
7484 * adding any BR/EDR data to the LE adv.
7485 */
7486 if (conn->le_adv_data_len > 0) {
7487 memcpy(&ev->eir[eir_len],
7488 conn->le_adv_data, conn->le_adv_data_len);
7489 eir_len = conn->le_adv_data_len;
7490 } else {
7491 if (name_len > 0)
7492 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7493 name, name_len);
b644ba33 7494
ddbea5cf 7495 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 7496 eir_len = eir_append_data(ev->eir, eir_len,
7497 EIR_CLASS_OF_DEV,
7498 conn->dev_class, 3);
7499 }
b644ba33 7500
eb55ef07 7501 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 7502
ecd90ae7
MH		 7503 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7504 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 7505}
7506
3b0602cd 7507static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 7508{
8962ee74 7509 struct sock **sk = data;
8962ee74 7510
f5818c22 7511 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7512
7513 *sk = cmd->sk;
7514 sock_hold(*sk);
7515
a664b5bc 7516 mgmt_pending_remove(cmd);
8962ee74
JH		 7517}
7518
3b0602cd 7519static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7520{
b1078ad0 7521 struct hci_dev *hdev = data;
124f6e35 7522 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7523
b1078ad0
JH		 7524 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7525
d8b7b1e4 7526 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7527 mgmt_pending_remove(cmd);
7528}
7529
84c61d92
JH		 7530bool mgmt_powering_down(struct hci_dev *hdev)
7531{
3b0602cd 7532 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 7533 struct mgmt_mode *cp;
7534
333ae95d 7535 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 7536 if (!cmd)
7537 return false;
7538
7539 cp = cmd->param;
7540 if (!cp->val)
7541 return true;
7542
7543 return false;
7544}
7545
9b80ec5e 7546void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 7547 u8 link_type, u8 addr_type, u8 reason,
7548 bool mgmt_connected)
f7520543 7549{
f0d6a0ea 7550 struct mgmt_ev_device_disconnected ev;
8962ee74 7551 struct sock *sk = NULL;
8962ee74 7552
84c61d92
JH		 7553 /* The connection is still in hci_conn_hash so test for 1
7554 * instead of 0 to know if this is the last one.
7555 */
7556 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7557 cancel_delayed_work(&hdev->power_off);
7558 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 7559 }
7560
12d4a3b2
JH		 7561 if (!mgmt_connected)
7562 return;
7563
57eb776f
AG		 7564 if (link_type != ACL_LINK && link_type != LE_LINK)
7565 return;
7566
744cf19e 7567 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 7568
f0d6a0ea
MA		 7569 bacpy(&ev.addr.bdaddr, bdaddr);
7570 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7571 ev.reason = reason;
f7520543 7572
9b80ec5e 7573 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 7574
7575 if (sk)
d97dcb66 7576 sock_put(sk);
8962ee74 7577
124f6e35 7578 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 7579 hdev);
8962ee74
JH		 7580}
7581
7892924c
MH		 7582void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7583 u8 link_type, u8 addr_type, u8 status)
8962ee74 7584{
3655bba8
AG		 7585 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7586 struct mgmt_cp_disconnect *cp;
3b0602cd 7587 struct mgmt_pending_cmd *cmd;
8962ee74 7588
36a75f1b
JD		 7589 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7590 hdev);
7591
333ae95d 7592 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 7593 if (!cmd)
7892924c 7594 return;
8962ee74 7595
3655bba8
AG		 7596 cp = cmd->param;
7597
7598 if (bacmp(bdaddr, &cp->addr.bdaddr))
7599 return;
7600
7601 if (cp->addr.type != bdaddr_type)
7602 return;
7603
f5818c22 7604 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7605 mgmt_pending_remove(cmd);
f7520543 7606}
17d5c04c 7607
445608d0
MH		 7608void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7609 u8 addr_type, u8 status)
17d5c04c
JH		 7610{
7611 struct mgmt_ev_connect_failed ev;
c9910d0f 7612
84c61d92
JH		 7613 /* The connection is still in hci_conn_hash so test for 1
7614 * instead of 0 to know if this is the last one.
7615 */
7616 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7617 cancel_delayed_work(&hdev->power_off);
7618 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 7619 }
17d5c04c 7620
4c659c39 7621 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7622 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 7623 ev.status = mgmt_status(status);
17d5c04c 7624
445608d0 7625 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 7626}
980e1a53 7627
ce0e4a0d 7628void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 7629{
7630 struct mgmt_ev_pin_code_request ev;
7631
d8457698 7632 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 7633 ev.addr.type = BDADDR_BREDR;
a770bb5a 7634 ev.secure = secure;
980e1a53 7635
ce0e4a0d 7636 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 7637}
7638
e669cf80
MH		 7639void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7640 u8 status)
980e1a53 7641{
3b0602cd 7642 struct mgmt_pending_cmd *cmd;
980e1a53 7643
333ae95d 7644 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 7645 if (!cmd)
e669cf80 7646 return;
980e1a53 7647
7776d1d8 7648 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7649 mgmt_pending_remove(cmd);
980e1a53
JH		 7650}
7651
3eb38528
MH		 7652void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7653 u8 status)
980e1a53 7654{
3b0602cd 7655 struct mgmt_pending_cmd *cmd;
980e1a53 7656
333ae95d 7657 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 7658 if (!cmd)
3eb38528 7659 return;
980e1a53 7660
7776d1d8 7661 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7662 mgmt_pending_remove(cmd);
980e1a53 7663}
a5c29683 7664
744cf19e 7665int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 7666 u8 link_type, u8 addr_type, u32 value,
04124681 7667 u8 confirm_hint)
a5c29683
JH		 7668{
7669 struct mgmt_ev_user_confirm_request ev;
7670
744cf19e 7671 BT_DBG("%s", hdev->name);
a5c29683 7672
272d90df 7673 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7674 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 7675 ev.confirm_hint = confirm_hint;
39adbffe 7676 ev.value = cpu_to_le32(value);
a5c29683 7677
744cf19e 7678 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 7679 NULL);
a5c29683
JH		 7680}
7681
272d90df 7682int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 7683 u8 link_type, u8 addr_type)
604086b7
BG		 7684{
7685 struct mgmt_ev_user_passkey_request ev;
7686
7687 BT_DBG("%s", hdev->name);
7688
272d90df 7689 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7690 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 7691
7692 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 7693 NULL);
604086b7
BG		 7694}
7695
0df4c185 7696static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 7697 u8 link_type, u8 addr_type, u8 status,
7698 u8 opcode)
a5c29683 7699{
3b0602cd 7700 struct mgmt_pending_cmd *cmd;
a5c29683 7701
333ae95d 7702 cmd = pending_find(opcode, hdev);
a5c29683
JH		 7703 if (!cmd)
7704 return -ENOENT;
7705
7776d1d8 7706 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7707 mgmt_pending_remove(cmd);
a5c29683 7708
7776d1d8 7709 return 0;
a5c29683
JH		 7710}
7711
744cf19e 7712int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7713 u8 link_type, u8 addr_type, u8 status)
a5c29683 7714{
272d90df 7715 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 7716 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 7717}
7718
272d90df 7719int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7720 u8 link_type, u8 addr_type, u8 status)
a5c29683 7721{
272d90df 7722 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 7723 status,
7724 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 7725}
2a611692 7726
604086b7 7727int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7728 u8 link_type, u8 addr_type, u8 status)
604086b7 7729{
272d90df 7730 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 7731 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 7732}
7733
272d90df 7734int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7735 u8 link_type, u8 addr_type, u8 status)
604086b7 7736{
272d90df 7737 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 7738 status,
7739 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 7740}
7741
92a25256
JH		 7742int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7743 u8 link_type, u8 addr_type, u32 passkey,
7744 u8 entered)
7745{
7746 struct mgmt_ev_passkey_notify ev;
7747
7748 BT_DBG("%s", hdev->name);
7749
7750 bacpy(&ev.addr.bdaddr, bdaddr);
7751 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7752 ev.passkey = __cpu_to_le32(passkey);
7753 ev.entered = entered;
7754
7755 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7756}
7757
e1e930f5 7758void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 7759{
7760 struct mgmt_ev_auth_failed ev;
3b0602cd 7761 struct mgmt_pending_cmd *cmd;
e1e930f5 7762 u8 status = mgmt_status(hci_status);
2a611692 7763
e1e930f5
JH		 7764 bacpy(&ev.addr.bdaddr, &conn->dst);
7765 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7766 ev.status = status;
2a611692 7767
e1e930f5
JH		 7768 cmd = find_pairing(conn);
7769
7770 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7771 cmd ? cmd->sk : NULL);
7772
a511b35b
JH		 7773 if (cmd) {
7774 cmd->cmd_complete(cmd, status);
7775 mgmt_pending_remove(cmd);
7776 }
2a611692 7777}
b312b161 7778
464996ae 7779void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 7780{
7781 struct cmd_lookup match = { NULL, hdev };
464996ae 7782 bool changed;
33ef95ed
JH		 7783
7784 if (status) {
7785 u8 mgmt_err = mgmt_status(status);
7786 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 7787 cmd_status_rsp, &mgmt_err);
464996ae 7788 return;
33ef95ed
JH		 7789 }
7790
464996ae 7791 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 7792 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 7793 else
a69d8927 7794 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 7795
33ef95ed 7796 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 7797 &match);
33ef95ed 7798
47990ea0 7799 if (changed)
464996ae 7800 new_settings(hdev, match.sk);
33ef95ed
JH		 7801
7802 if (match.sk)
7803 sock_put(match.sk);
33ef95ed
JH		 7804}
7805
890ea898 7806static void clear_eir(struct hci_request *req)
cacaf52f 7807{
890ea898 7808 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 7809 struct hci_cp_write_eir cp;
7810
976eb20e 7811 if (!lmp_ext_inq_capable(hdev))
890ea898 7812 return;
cacaf52f 7813
c80da27e
JH		 7814 memset(hdev->eir, 0, sizeof(hdev->eir));
7815
cacaf52f
JH		 7816 memset(&cp, 0, sizeof(cp));
7817
890ea898 7818 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 7819}
7820
3e248560 7821void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 7822{
7823 struct cmd_lookup match = { NULL, hdev };
890ea898 7824 struct hci_request req;
c0ecddc2 7825 bool changed = false;
ed2c4ee3
JH		 7826
7827 if (status) {
7828 u8 mgmt_err = mgmt_status(status);
c0ecddc2 7829
a69d8927
MH		 7830 if (enable && hci_dev_test_and_clear_flag(hdev,
7831 HCI_SSP_ENABLED)) {
a358dc11 7832 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 7833 new_settings(hdev, NULL);
9ecb3e24 7834 }
c0ecddc2 7835
04124681
GP		 7836 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7837 &mgmt_err);
3e248560 7838 return;
c0ecddc2
JH		 7839 }
7840
7841 if (enable) {
238be788 7842 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 7843 } else {
a69d8927 7844 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 7845 if (!changed)
a69d8927
MH		 7846 changed = hci_dev_test_and_clear_flag(hdev,
7847 HCI_HS_ENABLED);
9ecb3e24 7848 else
a358dc11 7849 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 7850 }
7851
7852 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7853
c0ecddc2 7854 if (changed)
3e248560 7855 new_settings(hdev, match.sk);
ed2c4ee3 7856
5fc6ebb1 7857 if (match.sk)
ed2c4ee3
JH		 7858 sock_put(match.sk);
7859
890ea898
JH		 7860 hci_req_init(&req, hdev);
7861
d7a5a11d
MH		 7862 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7863 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 7864 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7865 sizeof(enable), &enable);
890ea898 7866 update_eir(&req);
3769972b 7867 } else {
890ea898 7868 clear_eir(&req);
3769972b 7869 }
890ea898
JH		 7870
7871 hci_req_run(&req, NULL);
ed2c4ee3
JH		 7872}
7873
3b0602cd 7874static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 7875{
7876 struct cmd_lookup *match = data;
7877
90e70454
JH		 7878 if (match->sk == NULL) {
7879 match->sk = cmd->sk;
7880 sock_hold(match->sk);
7881 }
90e70454
JH		 7882}
7883
4e1b0245
MH		 7884void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7885 u8 status)
7f9a903c 7886{
90e70454 7887 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 7888
92da6097
JH		 7889 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7890 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7891 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 7892
7893 if (!status)
f6b7712e
MH		 7894 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7895 dev_class, 3, NULL);
90e70454
JH		 7896
7897 if (match.sk)
7898 sock_put(match.sk);
7f9a903c
MH		 7899}
7900
7667da34 7901void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 7902{
b312b161 7903 struct mgmt_cp_set_local_name ev;
3b0602cd 7904 struct mgmt_pending_cmd *cmd;
28cc7bde 7905
13928971 7906 if (status)
7667da34 7907 return;
b312b161
JH		 7908
7909 memset(&ev, 0, sizeof(ev));
7910 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 7911 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 7912
333ae95d 7913 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 7914 if (!cmd) {
7915 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 7916
13928971
JH		 7917 /* If this is a HCI command related to powering on the
7918 * HCI dev don't send any mgmt signals.
7919 */
333ae95d 7920 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 7921 return;
890ea898 7922 }
b312b161 7923
f6b7712e
MH		 7924 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7925 cmd ? cmd->sk : NULL);
b312b161 7926}
c35938b2 7927
4d2d2796 7928void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
38da1703
JH		 7929 u8 *rand192, u8 *hash256, u8 *rand256,
7930 u8 status)
c35938b2 7931{
3b0602cd 7932 struct mgmt_pending_cmd *cmd;
c35938b2 7933
744cf19e 7934 BT_DBG("%s status %u", hdev->name, status);
c35938b2 7935
333ae95d 7936 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 7937 if (!cmd)
3edaf092 7938 return;
c35938b2
SJ		 7939
7940 if (status) {
a69e8375
JH		 7941 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7942 mgmt_status(status));
c35938b2 7943 } else {
66f096f7
JH		 7944 struct mgmt_rp_read_local_oob_data rp;
7945 size_t rp_size = sizeof(rp);
4d2d2796 7946
66f096f7
JH		 7947 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7948 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
c35938b2 7949
66f096f7 7950 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
4d2d2796 7951 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
38da1703 7952 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
4d2d2796 7953 } else {
66f096f7 7954 rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
4d2d2796 7955 }
66f096f7 7956
2a1afb5a
JH		 7957 mgmt_cmd_complete(cmd->sk, hdev->id,
7958 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7959 &rp, rp_size);
c35938b2
SJ		 7960 }
7961
7962 mgmt_pending_remove(cmd);
c35938b2 7963}
e17acd40 7964
799ce93d
JP		 7965static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7966{
7967 int i;
7968
7969 for (i = 0; i < uuid_count; i++) {
7970 if (!memcmp(uuid, uuids[i], 16))
7971 return true;
7972 }
7973
7974 return false;
7975}
7976
b487b9ce
MH		 7977static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7978{
799ce93d
JP		 7979 u16 parsed = 0;
7980
7981 while (parsed < eir_len) {
7982 u8 field_len = eir[0];
7983 u8 uuid[16];
7984 int i;
7985
7986 if (field_len == 0)
7987 break;
7988
7989 if (eir_len - parsed < field_len + 1)
7990 break;
7991
7992 switch (eir[1]) {
7993 case EIR_UUID16_ALL:
7994 case EIR_UUID16_SOME:
7995 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 7996 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7997 uuid[13] = eir[i + 3];
7998 uuid[12] = eir[i + 2];
7999 if (has_uuid(uuid, uuid_count, uuids))
8000 return true;
8001 }
8002 break;
8003 case EIR_UUID32_ALL:
8004 case EIR_UUID32_SOME:
8005 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 8006 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8007 uuid[15] = eir[i + 5];
8008 uuid[14] = eir[i + 4];
8009 uuid[13] = eir[i + 3];
8010 uuid[12] = eir[i + 2];
8011 if (has_uuid(uuid, uuid_count, uuids))
8012 return true;
8013 }
8014 break;
8015 case EIR_UUID128_ALL:
8016 case EIR_UUID128_SOME:
8017 for (i = 0; i + 17 <= field_len; i += 16) {
8018 memcpy(uuid, eir + i + 2, 16);
8019 if (has_uuid(uuid, uuid_count, uuids))
8020 return true;
8021 }
8022 break;
8023 }
8024
8025 parsed += field_len + 1;
8026 eir += field_len + 1;
8027 }
8028
b487b9ce
MH		 8029 return false;
8030}
8031
4b0e0ced
JP		 8032static void restart_le_scan(struct hci_dev *hdev)
8033{
8034 /* If controller is not scanning we are done. */
d7a5a11d 8035 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 8036 return;
8037
8038 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8039 hdev->discovery.scan_start +
8040 hdev->discovery.scan_duration))
8041 return;
8042
8043 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8044 DISCOV_LE_RESTART_DELAY);
8045}
8046
48f86b7f
JP		 8047static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8048 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 8049{
48f86b7f
JP		 8050 /* If a RSSI threshold has been specified, and
8051 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8052 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8053 * is set, let it through for further processing, as we might need to
8054 * restart the scan.
efb2513f
MH		 8055 *
8056 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8057 * the results are also dropped.
bda157a4
MH		 8058 */
8059 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 8060 (rssi == HCI_RSSI_INVALID ||
8061 (rssi < hdev->discovery.rssi &&
8062 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 8063 return false;
efb2513f 8064
2976cdeb
JP		 8065 if (hdev->discovery.uuid_count != 0) {
8066 /* If a list of UUIDs is provided in filter, results with no
8067 * matching UUID should be dropped.
b487b9ce 8068 */
2976cdeb
JP		 8069 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8070 hdev->discovery.uuids) &&
8071 !eir_has_uuids(scan_rsp, scan_rsp_len,
8072 hdev->discovery.uuid_count,
8073 hdev->discovery.uuids))
8074 return false;
b487b9ce 8075 }
5d2e9fad 8076
2976cdeb
JP		 8077 /* If duplicate filtering does not report RSSI changes, then restart
8078 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 8079 */
2976cdeb
JP		 8080 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8081 restart_le_scan(hdev);
8082
8083 /* Validate RSSI value against the RSSI threshold once more. */
8084 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8085 rssi < hdev->discovery.rssi)
8086 return false;
8087 }
48f86b7f
JP		 8088
8089 return true;
8090}
8091
8092void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8093 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8094 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8095{
8096 char buf[512];
8097 struct mgmt_ev_device_found *ev = (void *)buf;
8098 size_t ev_size;
8099
8100 /* Don't send events for a non-kernel initiated discovery. With
8101 * LE one exception is if we have pend_le_reports > 0 in which
8102 * case we're doing passive scanning and want these events.
8103 */
8104 if (!hci_discovery_active(hdev)) {
8105 if (link_type == ACL_LINK)
8106 return;
8107 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8108 return;
8109 }
8110
82f8b651 8111 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 8112 /* We are using service discovery */
8113 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8114 scan_rsp_len))
8115 return;
8116 }
8117
8118 /* Make sure that the buffer is big enough. The 5 extra bytes
8119 * are for the potential CoD field.
8120 */
8121 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 8122 return;
8123
48f86b7f
JP		 8124 memset(buf, 0, sizeof(buf));
8125
8126 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8127 * RSSI value was reported as 0 when not available. This behavior
8128 * is kept when using device discovery. This is required for full
8129 * backwards compatibility with the API.
8130 *
8131 * However when using service discovery, the value 127 will be
8132 * returned when the RSSI is not available.
8133 */
8134 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8135 link_type == ACL_LINK)
8136 rssi = 0;
8137
8138 bacpy(&ev->addr.bdaddr, bdaddr);
8139 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8140 ev->rssi = rssi;
8141 ev->flags = cpu_to_le32(flags);
8142
8143 if (eir_len > 0)
8144 /* Copy EIR or advertising data into event */
8145 memcpy(ev->eir, eir, eir_len);
8146
8147 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8148 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8149 dev_class, 3);
8150
8151 if (scan_rsp_len > 0)
8152 /* Append scan response data to event */
8153 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8154
5d2e9fad
JH		 8155 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8156 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 8157
901801b9 8158 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 8159}
a88a9652 8160
9cf12aee
MH		 8161void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8162 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 8163{
b644ba33
JH		 8164 struct mgmt_ev_device_found *ev;
8165 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8166 u16 eir_len;
a88a9652 8167
b644ba33 8168 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 8169
b644ba33
JH		 8170 memset(buf, 0, sizeof(buf));
8171
8172 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 8173 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 8174 ev->rssi = rssi;
8175
8176 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 8177 name_len);
b644ba33 8178
eb55ef07 8179 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 8180
9cf12aee 8181 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 8182}
314b2381 8183
2f1e063b 8184void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 8185{
f963e8e9 8186 struct mgmt_ev_discovering ev;
164a6e78 8187
343fb145
AG		 8188 BT_DBG("%s discovering %u", hdev->name, discovering);
8189
f963e8e9
JH		 8190 memset(&ev, 0, sizeof(ev));
8191 ev.type = hdev->discovery.type;
8192 ev.discovering = discovering;
8193
2f1e063b 8194 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 8195}
5e762444 8196
1904a853 8197static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 8198{
8199 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 8200}
8201
8202void mgmt_reenable_advertising(struct hci_dev *hdev)
8203{
8204 struct hci_request req;
8205
24b4f38f
AU		 8206 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8207 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
5976e608
MH		 8208 return;
8209
8210 hci_req_init(&req, hdev);
8211 enable_advertising(&req);
0ec5ae84 8212 hci_req_run(&req, adv_enable_complete);
5976e608 8213}
6d785aa3
JH		 8214
8215static struct hci_mgmt_chan chan = {
8216 .channel = HCI_CHANNEL_CONTROL,
8217 .handler_count = ARRAY_SIZE(mgmt_handlers),
8218 .handlers = mgmt_handlers,
88b94ce9 8219 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 8220};
8221
8222int mgmt_init(void)
8223{
8224 return hci_mgmt_chan_register(&chan);
8225}
8226
8227void mgmt_exit(void)
8228{
8229 hci_mgmt_chan_unregister(&chan);
8230}
Linux kernel - Deliverables
This page took 1.200855 seconds and 5 git commands to generate.