projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add generic mgmt helper API
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
beb1c21b 41#define MGMT_REVISION 9
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
e70bb2e8
JH		 103};
104
105static const u16 mgmt_events[] = {
106 MGMT_EV_CONTROLLER_ERROR,
107 MGMT_EV_INDEX_ADDED,
108 MGMT_EV_INDEX_REMOVED,
109 MGMT_EV_NEW_SETTINGS,
110 MGMT_EV_CLASS_OF_DEV_CHANGED,
111 MGMT_EV_LOCAL_NAME_CHANGED,
112 MGMT_EV_NEW_LINK_KEY,
113 MGMT_EV_NEW_LONG_TERM_KEY,
114 MGMT_EV_DEVICE_CONNECTED,
115 MGMT_EV_DEVICE_DISCONNECTED,
116 MGMT_EV_CONNECT_FAILED,
117 MGMT_EV_PIN_CODE_REQUEST,
118 MGMT_EV_USER_CONFIRM_REQUEST,
119 MGMT_EV_USER_PASSKEY_REQUEST,
120 MGMT_EV_AUTH_FAILED,
121 MGMT_EV_DEVICE_FOUND,
122 MGMT_EV_DISCOVERING,
123 MGMT_EV_DEVICE_BLOCKED,
124 MGMT_EV_DEVICE_UNBLOCKED,
125 MGMT_EV_DEVICE_UNPAIRED,
92a25256 126 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 127 MGMT_EV_NEW_IRK,
7ee4ea36 128 MGMT_EV_NEW_CSRK,
8afef092
MH		 129 MGMT_EV_DEVICE_ADDED,
130 MGMT_EV_DEVICE_REMOVED,
ffb5a827 131 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 132 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 133 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 134 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 135 MGMT_EV_EXT_INDEX_ADDED,
136 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 137 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
e70bb2e8
JH		 138};
139
17b02e62 140#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 141
d25b78e2
JH		 142#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
143 "\x00\x00\x00\x00\x00\x00\x00\x00"
144
ca69b795
JH		 145/* HCI to MGMT error code conversion table */
146static u8 mgmt_status_table[] = {
147 MGMT_STATUS_SUCCESS,
148 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
149 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
150 MGMT_STATUS_FAILED, /* Hardware Failure */
151 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
152 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 153 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 154 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
155 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
156 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
157 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
158 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
159 MGMT_STATUS_BUSY, /* Command Disallowed */
160 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
161 MGMT_STATUS_REJECTED, /* Rejected Security */
162 MGMT_STATUS_REJECTED, /* Rejected Personal */
163 MGMT_STATUS_TIMEOUT, /* Host Timeout */
164 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
165 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
166 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
167 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
168 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
169 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
170 MGMT_STATUS_BUSY, /* Repeated Attempts */
171 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
172 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
173 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
174 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
175 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
176 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
177 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
178 MGMT_STATUS_FAILED, /* Unspecified Error */
179 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
180 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
181 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
182 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
183 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
184 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
185 MGMT_STATUS_FAILED, /* Unit Link Key Used */
186 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
187 MGMT_STATUS_TIMEOUT, /* Instant Passed */
188 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
189 MGMT_STATUS_FAILED, /* Transaction Collision */
190 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
191 MGMT_STATUS_REJECTED, /* QoS Rejected */
192 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
193 MGMT_STATUS_REJECTED, /* Insufficient Security */
194 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
195 MGMT_STATUS_BUSY, /* Role Switch Pending */
196 MGMT_STATUS_FAILED, /* Slot Violation */
197 MGMT_STATUS_FAILED, /* Role Switch Failed */
198 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
199 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
200 MGMT_STATUS_BUSY, /* Host Busy Pairing */
201 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
202 MGMT_STATUS_BUSY, /* Controller Busy */
203 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
204 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
205 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
206 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
207 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
208};
209
210static u8 mgmt_status(u8 hci_status)
211{
212 if (hci_status < ARRAY_SIZE(mgmt_status_table))
213 return mgmt_status_table[hci_status];
214
215 return MGMT_STATUS_FAILED;
216}
217
c08b1a1d
MH		 218static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
219 u16 len, int flag)
f9207338 220{
c08b1a1d
MH		 221 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
222 flag, NULL);
f9207338
MH		 223}
224
72000df2
MH		 225static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
226 u16 len, int flag, struct sock *skip_sk)
227{
228 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
229 flag, skip_sk);
230}
231
f6b7712e
MH		 232static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
233 u16 len, struct sock *skip_sk)
234{
235 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
236 HCI_MGMT_GENERIC_EVENTS, skip_sk);
237}
238
7a00ff44
JH		 239static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
240 struct sock *skip_sk)
241{
242 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 243 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 244}
245
04124681
GP		 246static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
247 u16 data_len)
a38528f1
JH		 248{
249 struct mgmt_rp_read_version rp;
250
251 BT_DBG("sock %p", sk);
252
253 rp.version = MGMT_VERSION;
dcf4adbf 254 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 255
2a1afb5a
JH		 256 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
257 &rp, sizeof(rp));
a38528f1
JH		 258}
259
04124681
GP		 260static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
261 u16 data_len)
e70bb2e8
JH		 262{
263 struct mgmt_rp_read_commands *rp;
eb55ef07
MH		 264 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
265 const u16 num_events = ARRAY_SIZE(mgmt_events);
2e3c35ea 266 __le16 *opcode;
e70bb2e8
JH		 267 size_t rp_size;
268 int i, err;
269
270 BT_DBG("sock %p", sk);
271
272 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
273
274 rp = kmalloc(rp_size, GFP_KERNEL);
275 if (!rp)
276 return -ENOMEM;
277
dcf4adbf
JP		 278 rp->num_commands = cpu_to_le16(num_commands);
279 rp->num_events = cpu_to_le16(num_events);
e70bb2e8
JH		 280
281 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
282 put_unaligned_le16(mgmt_commands[i], opcode);
283
284 for (i = 0; i < num_events; i++, opcode++)
285 put_unaligned_le16(mgmt_events[i], opcode);
286
2a1afb5a
JH		 287 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
288 rp, rp_size);
e70bb2e8
JH		 289 kfree(rp);
290
291 return err;
292}
293
04124681
GP		 294static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
295 u16 data_len)
faba42eb 296{
faba42eb 297 struct mgmt_rp_read_index_list *rp;
8035ded4 298 struct hci_dev *d;
a38528f1 299 size_t rp_len;
faba42eb 300 u16 count;
476e44cb 301 int err;
faba42eb
JH		 302
303 BT_DBG("sock %p", sk);
304
305 read_lock(&hci_dev_list_lock);
306
307 count = 0;
bb4b2a9a 308 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 309 if (d->dev_type == HCI_BREDR &&
d7a5a11d 310 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 311 count++;
faba42eb
JH		 312 }
313
a38528f1
JH		 314 rp_len = sizeof(*rp) + (2 * count);
315 rp = kmalloc(rp_len, GFP_ATOMIC);
316 if (!rp) {
b2c60d42 317 read_unlock(&hci_dev_list_lock);
faba42eb 318 return -ENOMEM;
b2c60d42 319 }
faba42eb 320
476e44cb 321 count = 0;
8035ded4 322 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 323 if (hci_dev_test_flag(d, HCI_SETUP) ||
324 hci_dev_test_flag(d, HCI_CONFIG) ||
325 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 326 continue;
327
73d1df2a
MH		 328 /* Devices marked as raw-only are neither configured
329 * nor unconfigured controllers.
330 */
331 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 332 continue;
333
73d1df2a 334 if (d->dev_type == HCI_BREDR &&
d7a5a11d 335 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 336 rp->index[count++] = cpu_to_le16(d->id);
337 BT_DBG("Added hci%u", d->id);
338 }
faba42eb
JH		 339 }
340
476e44cb
JH		 341 rp->num_controllers = cpu_to_le16(count);
342 rp_len = sizeof(*rp) + (2 * count);
343
faba42eb
JH		 344 read_unlock(&hci_dev_list_lock);
345
2a1afb5a
JH		 346 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
347 0, rp, rp_len);
faba42eb 348
a38528f1
JH		 349 kfree(rp);
350
351 return err;
faba42eb
JH		 352}
353
73d1df2a
MH		 354static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
355 void *data, u16 data_len)
356{
357 struct mgmt_rp_read_unconf_index_list *rp;
358 struct hci_dev *d;
359 size_t rp_len;
360 u16 count;
361 int err;
362
363 BT_DBG("sock %p", sk);
364
365 read_lock(&hci_dev_list_lock);
366
367 count = 0;
368 list_for_each_entry(d, &hci_dev_list, list) {
369 if (d->dev_type == HCI_BREDR &&
d7a5a11d 370 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 371 count++;
372 }
373
374 rp_len = sizeof(*rp) + (2 * count);
375 rp = kmalloc(rp_len, GFP_ATOMIC);
376 if (!rp) {
377 read_unlock(&hci_dev_list_lock);
378 return -ENOMEM;
379 }
380
381 count = 0;
382 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 383 if (hci_dev_test_flag(d, HCI_SETUP) ||
384 hci_dev_test_flag(d, HCI_CONFIG) ||
385 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 386 continue;
387
388 /* Devices marked as raw-only are neither configured
389 * nor unconfigured controllers.
390 */
391 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
392 continue;
393
394 if (d->dev_type == HCI_BREDR &&
d7a5a11d 395 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 396 rp->index[count++] = cpu_to_le16(d->id);
397 BT_DBG("Added hci%u", d->id);
398 }
399 }
400
401 rp->num_controllers = cpu_to_le16(count);
402 rp_len = sizeof(*rp) + (2 * count);
403
404 read_unlock(&hci_dev_list_lock);
405
2a1afb5a
JH		 406 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
407 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 408
409 kfree(rp);
410
411 return err;
412}
413
96f1474a
MH		 414static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
415 void *data, u16 data_len)
416{
417 struct mgmt_rp_read_ext_index_list *rp;
418 struct hci_dev *d;
419 size_t rp_len;
420 u16 count;
421 int err;
422
423 BT_DBG("sock %p", sk);
424
425 read_lock(&hci_dev_list_lock);
426
427 count = 0;
428 list_for_each_entry(d, &hci_dev_list, list) {
429 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
430 count++;
431 }
432
433 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
434 rp = kmalloc(rp_len, GFP_ATOMIC);
435 if (!rp) {
436 read_unlock(&hci_dev_list_lock);
437 return -ENOMEM;
438 }
439
440 count = 0;
441 list_for_each_entry(d, &hci_dev_list, list) {
442 if (hci_dev_test_flag(d, HCI_SETUP) ||
443 hci_dev_test_flag(d, HCI_CONFIG) ||
444 hci_dev_test_flag(d, HCI_USER_CHANNEL))
445 continue;
446
447 /* Devices marked as raw-only are neither configured
448 * nor unconfigured controllers.
449 */
450 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
451 continue;
452
453 if (d->dev_type == HCI_BREDR) {
454 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
455 rp->entry[count].type = 0x01;
456 else
457 rp->entry[count].type = 0x00;
458 } else if (d->dev_type == HCI_AMP) {
459 rp->entry[count].type = 0x02;
460 } else {
461 continue;
462 }
463
464 rp->entry[count].bus = d->bus;
465 rp->entry[count++].index = cpu_to_le16(d->id);
466 BT_DBG("Added hci%u", d->id);
467 }
468
469 rp->num_controllers = cpu_to_le16(count);
470 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
471
472 read_unlock(&hci_dev_list_lock);
473
474 /* If this command is called at least once, then all the
475 * default index and unconfigured index events are disabled
476 * and from now on only extended index events are used.
477 */
478 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
479 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
480 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
481
482 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
483 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
484
485 kfree(rp);
486
487 return err;
488}
489
dbece37a
MH		 490static bool is_configured(struct hci_dev *hdev)
491{
492 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 493 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 494 return false;
495
496 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
497 !bacmp(&hdev->public_addr, BDADDR_ANY))
498 return false;
499
500 return true;
501}
502
89bc22d2
MH		 503static __le32 get_missing_options(struct hci_dev *hdev)
504{
505 u32 options = 0;
506
dbece37a 507 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 508 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 509 options |= MGMT_OPTION_EXTERNAL_CONFIG;
510
89bc22d2
MH		 511 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
512 !bacmp(&hdev->public_addr, BDADDR_ANY))
513 options |= MGMT_OPTION_PUBLIC_ADDRESS;
514
515 return cpu_to_le32(options);
516}
517
f4537c04
MH		 518static int new_options(struct hci_dev *hdev, struct sock *skip)
519{
520 __le32 options = get_missing_options(hdev);
521
f6b7712e
MH		 522 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
523 sizeof(options), skip);
f4537c04
MH		 524}
525
dbece37a
MH		 526static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
527{
528 __le32 options = get_missing_options(hdev);
529
2a1afb5a
JH		 530 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
531 sizeof(options));
dbece37a
MH		 532}
533
9fc3bfb6
MH		 534static int read_config_info(struct sock *sk, struct hci_dev *hdev,
535 void *data, u16 data_len)
536{
537 struct mgmt_rp_read_config_info rp;
89bc22d2 538 u32 options = 0;
9fc3bfb6
MH		 539
540 BT_DBG("sock %p %s", sk, hdev->name);
541
542 hci_dev_lock(hdev);
543
544 memset(&rp, 0, sizeof(rp));
545 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 546
eb1904f4
MH		 547 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
548 options |= MGMT_OPTION_EXTERNAL_CONFIG;
549
9fc3bfb6 550 if (hdev->set_bdaddr)
89bc22d2
MH		 551 options |= MGMT_OPTION_PUBLIC_ADDRESS;
552
553 rp.supported_options = cpu_to_le32(options);
554 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 555
556 hci_dev_unlock(hdev);
557
2a1afb5a
JH		 558 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
559 &rp, sizeof(rp));
9fc3bfb6
MH		 560}
561
69ab39ea
JH		 562static u32 get_supported_settings(struct hci_dev *hdev)
563{
564 u32 settings = 0;
565
566 settings |= MGMT_SETTING_POWERED;
b2939475 567 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 568 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 569 settings |= MGMT_SETTING_CONNECTABLE;
570 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 571
ed3fa31f 572 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 573 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
574 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 575 settings |= MGMT_SETTING_BREDR;
576 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 577
578 if (lmp_ssp_capable(hdev)) {
579 settings |= MGMT_SETTING_SSP;
580 settings |= MGMT_SETTING_HS;
581 }
e98d2ce2 582
05b3c3e7 583 if (lmp_sc_capable(hdev))
e98d2ce2 584 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 585 }
d7b7e796 586
eeca6f89 587 if (lmp_le_capable(hdev)) {
9d42820f 588 settings |= MGMT_SETTING_LE;
eeca6f89 589 settings |= MGMT_SETTING_ADVERTISING;
a3209694 590 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 591 settings |= MGMT_SETTING_PRIVACY;
93690c22 592 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 593 }
69ab39ea 594
eb1904f4
MH		 595 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
596 hdev->set_bdaddr)
9fc3bfb6
MH		 597 settings |= MGMT_SETTING_CONFIGURATION;
598
69ab39ea
JH		 599 return settings;
600}
601
602static u32 get_current_settings(struct hci_dev *hdev)
603{
604 u32 settings = 0;
605
f1f0eb02 606 if (hdev_is_powered(hdev))
f0d4b78a
MH		 607 settings |= MGMT_SETTING_POWERED;
608
d7a5a11d 609 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 610 settings |= MGMT_SETTING_CONNECTABLE;
611
d7a5a11d 612 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 613 settings |= MGMT_SETTING_FAST_CONNECTABLE;
614
d7a5a11d 615 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 616 settings |= MGMT_SETTING_DISCOVERABLE;
617
d7a5a11d 618 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 619 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 620
d7a5a11d 621 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 622 settings |= MGMT_SETTING_BREDR;
623
d7a5a11d 624 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 625 settings |= MGMT_SETTING_LE;
626
d7a5a11d 627 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 628 settings |= MGMT_SETTING_LINK_SECURITY;
629
d7a5a11d 630 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 631 settings |= MGMT_SETTING_SSP;
632
d7a5a11d 633 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 634 settings |= MGMT_SETTING_HS;
635
d7a5a11d 636 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 637 settings |= MGMT_SETTING_ADVERTISING;
638
d7a5a11d 639 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 640 settings |= MGMT_SETTING_SECURE_CONN;
641
d7a5a11d 642 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 643 settings |= MGMT_SETTING_DEBUG_KEYS;
644
d7a5a11d 645 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 646 settings |= MGMT_SETTING_PRIVACY;
647
93690c22
MH		 648 /* The current setting for static address has two purposes. The
649 * first is to indicate if the static address will be used and
650 * the second is to indicate if it is actually set.
651 *
652 * This means if the static address is not configured, this flag
653 * will never bet set. If the address is configured, then if the
654 * address is actually used decides if the flag is set or not.
655 *
656 * For single mode LE only controllers and dual-mode controllers
657 * with BR/EDR disabled, the existence of the static address will
658 * be evaluated.
659 */
b7cb93e5 660 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 661 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 662 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
663 if (bacmp(&hdev->static_addr, BDADDR_ANY))
664 settings |= MGMT_SETTING_STATIC_ADDRESS;
665 }
666
69ab39ea
JH		 667 return settings;
668}
669
ef580372
JH		 670#define PNP_INFO_SVCLASS_ID 0x1200
671
213202ed
JH		 672static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
673{
674 u8 *ptr = data, *uuids_start = NULL;
675 struct bt_uuid *uuid;
676
677 if (len < 4)
678 return ptr;
679
680 list_for_each_entry(uuid, &hdev->uuids, list) {
681 u16 uuid16;
682
683 if (uuid->size != 16)
684 continue;
685
686 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
687 if (uuid16 < 0x1100)
688 continue;
689
690 if (uuid16 == PNP_INFO_SVCLASS_ID)
691 continue;
692
693 if (!uuids_start) {
694 uuids_start = ptr;
695 uuids_start[0] = 1;
696 uuids_start[1] = EIR_UUID16_ALL;
697 ptr += 2;
698 }
699
700 /* Stop if not enough space to put next UUID */
701 if ((ptr - data) + sizeof(u16) > len) {
702 uuids_start[1] = EIR_UUID16_SOME;
703 break;
704 }
705
706 *ptr++ = (uuid16 & 0x00ff);
707 *ptr++ = (uuid16 & 0xff00) >> 8;
708 uuids_start[0] += sizeof(uuid16);
709 }
710
711 return ptr;
712}
713
cdf1963f
JH		 714static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
715{
716 u8 *ptr = data, *uuids_start = NULL;
717 struct bt_uuid *uuid;
718
719 if (len < 6)
720 return ptr;
721
722 list_for_each_entry(uuid, &hdev->uuids, list) {
723 if (uuid->size != 32)
724 continue;
725
726 if (!uuids_start) {
727 uuids_start = ptr;
728 uuids_start[0] = 1;
729 uuids_start[1] = EIR_UUID32_ALL;
730 ptr += 2;
731 }
732
733 /* Stop if not enough space to put next UUID */
734 if ((ptr - data) + sizeof(u32) > len) {
735 uuids_start[1] = EIR_UUID32_SOME;
736 break;
737 }
738
739 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
740 ptr += sizeof(u32);
741 uuids_start[0] += sizeof(u32);
742 }
743
744 return ptr;
745}
746
c00d575b
JH		 747static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
748{
749 u8 *ptr = data, *uuids_start = NULL;
750 struct bt_uuid *uuid;
751
752 if (len < 18)
753 return ptr;
754
755 list_for_each_entry(uuid, &hdev->uuids, list) {
756 if (uuid->size != 128)
757 continue;
758
759 if (!uuids_start) {
760 uuids_start = ptr;
761 uuids_start[0] = 1;
762 uuids_start[1] = EIR_UUID128_ALL;
763 ptr += 2;
764 }
765
766 /* Stop if not enough space to put next UUID */
767 if ((ptr - data) + 16 > len) {
768 uuids_start[1] = EIR_UUID128_SOME;
769 break;
770 }
771
772 memcpy(ptr, uuid->uuid, 16);
773 ptr += 16;
774 uuids_start[0] += 16;
775 }
776
777 return ptr;
778}
779
333ae95d
JH		 780static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
781{
782 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
783}
784
333ae95d
JH		 785static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
786 struct hci_dev *hdev,
787 const void *data)
788{
789 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
790}
791
f14d8f64
MH		 792static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
793{
7a5f4990
MH		 794 u8 ad_len = 0;
795 size_t name_len;
796
797 name_len = strlen(hdev->dev_name);
798 if (name_len > 0) {
799 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
800
801 if (name_len > max_len) {
802 name_len = max_len;
803 ptr[1] = EIR_NAME_SHORT;
804 } else
805 ptr[1] = EIR_NAME_COMPLETE;
806
807 ptr[0] = name_len + 1;
808
809 memcpy(ptr + 2, hdev->dev_name, name_len);
810
811 ad_len += (name_len + 2);
812 ptr += (name_len + 2);
813 }
814
815 return ad_len;
f14d8f64
MH		 816}
817
818static void update_scan_rsp_data(struct hci_request *req)
819{
820 struct hci_dev *hdev = req->hdev;
821 struct hci_cp_le_set_scan_rsp_data cp;
822 u8 len;
823
d7a5a11d 824 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 825 return;
826
827 memset(&cp, 0, sizeof(cp));
828
829 len = create_scan_rsp_data(hdev, cp.data);
830
eb438b5f
JH		 831 if (hdev->scan_rsp_data_len == len &&
832 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
f14d8f64
MH		 833 return;
834
eb438b5f
JH		 835 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
836 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 837
838 cp.length = len;
839
840 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
841}
842
9a43e25f
JH		 843static u8 get_adv_discov_flags(struct hci_dev *hdev)
844{
3b0602cd 845 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 846
847 /* If there's a pending mgmt command the flags will not yet have
848 * their final values, so check for this first.
849 */
333ae95d 850 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 851 if (cmd) {
852 struct mgmt_mode *cp = cmd->param;
853 if (cp->val == 0x01)
854 return LE_AD_GENERAL;
855 else if (cp->val == 0x02)
856 return LE_AD_LIMITED;
857 } else {
d7a5a11d 858 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 859 return LE_AD_LIMITED;
d7a5a11d 860 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 861 return LE_AD_GENERAL;
862 }
863
864 return 0;
865}
866
46cad2ed 867static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
441ad2d0
MH		 868{
869 u8 ad_len = 0, flags = 0;
441ad2d0 870
9a43e25f 871 flags |= get_adv_discov_flags(hdev);
441ad2d0 872
d7a5a11d 873 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
441ad2d0 874 flags |= LE_AD_NO_BREDR;
441ad2d0
MH		 875
876 if (flags) {
877 BT_DBG("adv flags 0x%02x", flags);
878
879 ptr[0] = 2;
880 ptr[1] = EIR_FLAGS;
881 ptr[2] = flags;
882
883 ad_len += 3;
884 ptr += 3;
885 }
886
887 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
888 ptr[0] = 2;
889 ptr[1] = EIR_TX_POWER;
890 ptr[2] = (u8) hdev->adv_tx_power;
891
892 ad_len += 3;
893 ptr += 3;
894 }
895
441ad2d0
MH		 896 return ad_len;
897}
898
5947f4bc 899static void update_adv_data(struct hci_request *req)
441ad2d0
MH		 900{
901 struct hci_dev *hdev = req->hdev;
902 struct hci_cp_le_set_adv_data cp;
903 u8 len;
904
d7a5a11d 905 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 906 return;
907
908 memset(&cp, 0, sizeof(cp));
909
46cad2ed 910 len = create_adv_data(hdev, cp.data);
441ad2d0
MH		 911
912 if (hdev->adv_data_len == len &&
913 memcmp(cp.data, hdev->adv_data, len) == 0)
914 return;
915
916 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
917 hdev->adv_data_len = len;
918
919 cp.length = len;
920
921 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
922}
923
bc6d2d04
JH		 924int mgmt_update_adv_data(struct hci_dev *hdev)
925{
926 struct hci_request req;
927
928 hci_req_init(&req, hdev);
929 update_adv_data(&req);
930
931 return hci_req_run(&req, NULL);
932}
933
ef580372
JH		 934static void create_eir(struct hci_dev *hdev, u8 *data)
935{
936 u8 *ptr = data;
ef580372
JH		 937 size_t name_len;
938
939 name_len = strlen(hdev->dev_name);
940
941 if (name_len > 0) {
942 /* EIR Data type */
943 if (name_len > 48) {
944 name_len = 48;
945 ptr[1] = EIR_NAME_SHORT;
946 } else
947 ptr[1] = EIR_NAME_COMPLETE;
948
949 /* EIR Data length */
950 ptr[0] = name_len + 1;
951
952 memcpy(ptr + 2, hdev->dev_name, name_len);
953
ef580372
JH		 954 ptr += (name_len + 2);
955 }
956
bbaf444a 957 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 958 ptr[0] = 2;
959 ptr[1] = EIR_TX_POWER;
960 ptr[2] = (u8) hdev->inq_tx_power;
961
91c4e9b1
MH		 962 ptr += 3;
963 }
964
2b9be137
MH		 965 if (hdev->devid_source > 0) {
966 ptr[0] = 9;
967 ptr[1] = EIR_DEVICE_ID;
968
969 put_unaligned_le16(hdev->devid_source, ptr + 2);
970 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
971 put_unaligned_le16(hdev->devid_product, ptr + 6);
972 put_unaligned_le16(hdev->devid_version, ptr + 8);
973
2b9be137
MH		 974 ptr += 10;
975 }
976
213202ed 977 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 978 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 979 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 980}
981
890ea898 982static void update_eir(struct hci_request *req)
ef580372 983{
890ea898 984 struct hci_dev *hdev = req->hdev;
ef580372
JH		 985 struct hci_cp_write_eir cp;
986
504c8dcd 987 if (!hdev_is_powered(hdev))
890ea898 988 return;
7770c4aa 989
976eb20e 990 if (!lmp_ext_inq_capable(hdev))
890ea898 991 return;
ef580372 992
d7a5a11d 993 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 994 return;
ef580372 995
d7a5a11d 996 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 997 return;
ef580372
JH		 998
999 memset(&cp, 0, sizeof(cp));
1000
1001 create_eir(hdev, cp.data);
1002
1003 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1004 return;
ef580372
JH		 1005
1006 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1007
890ea898 1008 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1009}
1010
1011static u8 get_service_classes(struct hci_dev *hdev)
1012{
1013 struct bt_uuid *uuid;
1014 u8 val = 0;
1015
1016 list_for_each_entry(uuid, &hdev->uuids, list)
1017 val |= uuid->svc_hint;
1018
1019 return val;
1020}
1021
890ea898 1022static void update_class(struct hci_request *req)
ef580372 1023{
890ea898 1024 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1025 u8 cod[3];
1026
1027 BT_DBG("%s", hdev->name);
1028
504c8dcd 1029 if (!hdev_is_powered(hdev))
890ea898 1030 return;
7770c4aa 1031
d7a5a11d 1032 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1033 return;
1034
d7a5a11d 1035 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1036 return;
ef580372
JH		 1037
1038 cod[0] = hdev->minor_class;
1039 cod[1] = hdev->major_class;
1040 cod[2] = get_service_classes(hdev);
1041
d7a5a11d 1042 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1043 cod[1] |= 0x20;
1044
ef580372 1045 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1046 return;
ef580372 1047
890ea898 1048 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1049}
1050
a4858cb9 1051static bool get_connectable(struct hci_dev *hdev)
199a2fb1 1052{
3b0602cd 1053 struct mgmt_pending_cmd *cmd;
199a2fb1
JH		 1054
1055 /* If there's a pending mgmt command the flag will not yet have
1056 * it's final value, so check for this first.
1057 */
333ae95d 1058 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
199a2fb1
JH		 1059 if (cmd) {
1060 struct mgmt_mode *cp = cmd->param;
a4858cb9 1061 return cp->val;
199a2fb1
JH		 1062 }
1063
d7a5a11d 1064 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
199a2fb1
JH		 1065}
1066
0ec5ae84
JH		 1067static void disable_advertising(struct hci_request *req)
1068{
1069 u8 enable = 0x00;
1070
1071 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1072}
1073
199a2fb1
JH		 1074static void enable_advertising(struct hci_request *req)
1075{
1076 struct hci_dev *hdev = req->hdev;
1077 struct hci_cp_le_set_adv_param cp;
8f2a0601 1078 u8 own_addr_type, enable = 0x01;
a4858cb9 1079 bool connectable;
199a2fb1 1080
0ec5ae84
JH		 1081 if (hci_conn_num(hdev, LE_LINK) > 0)
1082 return;
1083
d7a5a11d 1084 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1085 disable_advertising(req);
1086
5ce194c4 1087 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1088 * hci_update_random_address knows that it's safe to go ahead
1089 * and write a new random address. The flag will be set back on
1090 * as soon as the SET_ADV_ENABLE HCI command completes.
1091 */
a358dc11 1092 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1093
d7a5a11d 1094 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
cc91cb04
MH		 1095 connectable = true;
1096 else
1097 connectable = get_connectable(hdev);
8f2a0601 1098
a4858cb9
JH		 1099 /* Set require_privacy to true only when non-connectable
1100 * advertising is used. In that case it is fine to use a
1101 * non-resolvable private address.
1102 */
1103 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1104 return;
1105
41c90c18 1106 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1107 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1108 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
a4858cb9 1109 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
8f2a0601 1110 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1111 cp.channel_map = hdev->le_adv_channel_map;
1112
1113 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1114
1115 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1116}
1117
7d78525d
JH		 1118static void service_cache_off(struct work_struct *work)
1119{
1120 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1121 service_cache.work);
890ea898 1122 struct hci_request req;
7d78525d 1123
a69d8927 1124 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1125 return;
1126
890ea898
JH		 1127 hci_req_init(&req, hdev);
1128
7d78525d
JH		 1129 hci_dev_lock(hdev);
1130
890ea898
JH		 1131 update_eir(&req);
1132 update_class(&req);
7d78525d
JH		 1133
1134 hci_dev_unlock(hdev);
890ea898
JH		 1135
1136 hci_req_run(&req, NULL);
7d78525d
JH		 1137}
1138
d6bfd59c
JH		 1139static void rpa_expired(struct work_struct *work)
1140{
1141 struct hci_dev *hdev = container_of(work, struct hci_dev,
1142 rpa_expired.work);
1143 struct hci_request req;
1144
1145 BT_DBG("");
1146
a1536da2 1147 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1148
d7a5a11d 1149 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1150 return;
1151
1152 /* The generation of a new RPA and programming it into the
1153 * controller happens in the enable_advertising() function.
1154 */
d6bfd59c 1155 hci_req_init(&req, hdev);
d6bfd59c 1156 enable_advertising(&req);
d6bfd59c
JH		 1157 hci_req_run(&req, NULL);
1158}
1159
6a919082 1160static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1161{
238be788 1162 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1163 return;
1164
4f87da80 1165 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1166 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1167
4f87da80
JH		 1168 /* Non-mgmt controlled devices get this bit set
1169 * implicitly so that pairing works for them, however
1170 * for mgmt we require user-space to explicitly enable
1171 * it
1172 */
a358dc11 1173 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1174}
1175
0f4e68cf 1176static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1177 void *data, u16 data_len)
0381101f 1178{
a38528f1 1179 struct mgmt_rp_read_info rp;
f7b64e69 1180
bdb6d971 1181 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1182
09fd0de5 1183 hci_dev_lock(hdev);
f7b64e69 1184
dc4fe30b
JH		 1185 memset(&rp, 0, sizeof(rp));
1186
69ab39ea 1187 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1188
69ab39ea 1189 rp.version = hdev->hci_ver;
eb55ef07 1190 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1191
1192 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1193 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1194
a38528f1 1195 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1196
dc4fe30b 1197 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1198 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1199
09fd0de5 1200 hci_dev_unlock(hdev);
0381101f 1201
2a1afb5a
JH		 1202 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1203 sizeof(rp));
0381101f
JH		 1204}
1205
69ab39ea 1206static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1207{
69ab39ea 1208 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1209
2a1afb5a
JH		 1210 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1211 sizeof(settings));
8680570b
JH		 1212}
1213
1904a853 1214static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1215{
1216 BT_DBG("%s status 0x%02x", hdev->name, status);
1217
a3172b7e
JH		 1218 if (hci_conn_count(hdev) == 0) {
1219 cancel_delayed_work(&hdev->power_off);
8b064a3a 1220 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1221 }
8b064a3a
JH		 1222}
1223
23a48093 1224static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1225{
1226 struct hci_dev *hdev = req->hdev;
1227 struct hci_cp_remote_name_req_cancel cp;
1228 struct inquiry_entry *e;
1229
1230 switch (hdev->discovery.state) {
1231 case DISCOVERY_FINDING:
07d2334a 1232 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1233 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1234
1235 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1236 cancel_delayed_work(&hdev->le_scan_disable);
1237 hci_req_add_le_scan_disable(req);
1238 }
1239
23a48093 1240 return true;
21a60d30
JH		 1241
1242 case DISCOVERY_RESOLVING:
1243 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1244 NAME_PENDING);
1245 if (!e)
23a48093 1246 break;
21a60d30
JH		 1247
1248 bacpy(&cp.bdaddr, &e->data.bdaddr);
1249 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1250 &cp);
1251
23a48093 1252 return true;
21a60d30
JH		 1253
1254 default:
1255 /* Passive scanning */
d7a5a11d 1256 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1257 hci_req_add_le_scan_disable(req);
23a48093
JH		 1258 return true;
1259 }
1260
21a60d30
JH		 1261 break;
1262 }
23a48093
JH		 1263
1264 return false;
21a60d30
JH		 1265}
1266
8b064a3a
JH		 1267static int clean_up_hci_state(struct hci_dev *hdev)
1268{
1269 struct hci_request req;
1270 struct hci_conn *conn;
23a48093
JH		 1271 bool discov_stopped;
1272 int err;
8b064a3a
JH		 1273
1274 hci_req_init(&req, hdev);
1275
1276 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1277 test_bit(HCI_PSCAN, &hdev->flags)) {
1278 u8 scan = 0x00;
1279 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1280 }
1281
d7a5a11d 1282 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1283 disable_advertising(&req);
1284
23a48093 1285 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1286
1287 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1288 struct hci_cp_disconnect dc;
c9910d0f
JH		 1289 struct hci_cp_reject_conn_req rej;
1290
1291 switch (conn->state) {
1292 case BT_CONNECTED:
1293 case BT_CONFIG:
1294 dc.handle = cpu_to_le16(conn->handle);
1295 dc.reason = 0x15; /* Terminated due to Power Off */
1296 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1297 break;
1298 case BT_CONNECT:
1299 if (conn->type == LE_LINK)
1300 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1301 0, NULL);
1302 else if (conn->type == ACL_LINK)
1303 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1304 6, &conn->dst);
1305 break;
1306 case BT_CONNECT2:
1307 bacpy(&rej.bdaddr, &conn->dst);
1308 rej.reason = 0x15; /* Terminated due to Power Off */
1309 if (conn->type == ACL_LINK)
1310 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1311 sizeof(rej), &rej);
1312 else if (conn->type == SCO_LINK)
1313 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1314 sizeof(rej), &rej);
1315 break;
1316 }
8b064a3a
JH		 1317 }
1318
23a48093
JH		 1319 err = hci_req_run(&req, clean_up_hci_complete);
1320 if (!err && discov_stopped)
1321 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1322
1323 return err;
8b064a3a
JH		 1324}
1325
bdb6d971 1326static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1327 u16 len)
eec8d2bc 1328{
650f726d 1329 struct mgmt_mode *cp = data;
3b0602cd 1330 struct mgmt_pending_cmd *cmd;
4b34ee78 1331 int err;
eec8d2bc 1332
bdb6d971 1333 BT_DBG("request for %s", hdev->name);
eec8d2bc 1334
a7e80f25 1335 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1336 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1337 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1338
09fd0de5 1339 hci_dev_lock(hdev);
eec8d2bc 1340
333ae95d 1341 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1342 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1343 MGMT_STATUS_BUSY);
87b95ba6
JH		 1344 goto failed;
1345 }
1346
a69d8927 1347 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1348 cancel_delayed_work(&hdev->power_off);
1349
1350 if (cp->val) {
a1d70450
JH		 1351 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1352 data, len);
1353 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1354 goto failed;
1355 }
1356 }
1357
4b34ee78 1358 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1359 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1360 goto failed;
1361 }
1362
2e58ef3e 1363 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1364 if (!cmd) {
1365 err = -ENOMEM;
eec8d2bc 1366 goto failed;
366a0336 1367 }
eec8d2bc 1368
8b064a3a 1369 if (cp->val) {
19202573 1370 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1371 err = 0;
1372 } else {
1373 /* Disconnect connections, stop scans, etc */
1374 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1375 if (!err)
1376 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1377 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1378
8b064a3a
JH		 1379 /* ENODATA means there were no HCI commands queued */
1380 if (err == -ENODATA) {
a3172b7e 1381 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1382 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1383 err = 0;
1384 }
1385 }
eec8d2bc
JH		 1386
1387failed:
09fd0de5 1388 hci_dev_unlock(hdev);
366a0336 1389 return err;
eec8d2bc
JH		 1390}
1391
beadb2bd
JH		 1392static int new_settings(struct hci_dev *hdev, struct sock *skip)
1393{
f6b7712e 1394 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1395
f6b7712e
MH		 1396 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1397 sizeof(ev), skip);
beadb2bd
JH		 1398}
1399
91a668b0
JH		 1400int mgmt_new_settings(struct hci_dev *hdev)
1401{
1402 return new_settings(hdev, NULL);
1403}
1404
bd99abdd
JH		 1405struct cmd_lookup {
1406 struct sock *sk;
1407 struct hci_dev *hdev;
1408 u8 mgmt_status;
1409};
1410
3b0602cd 1411static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1412{
1413 struct cmd_lookup *match = data;
1414
1415 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1416
1417 list_del(&cmd->list);
1418
1419 if (match->sk == NULL) {
1420 match->sk = cmd->sk;
1421 sock_hold(match->sk);
1422 }
1423
1424 mgmt_pending_free(cmd);
1425}
1426
3b0602cd 1427static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1428{
1429 u8 *status = data;
1430
a69e8375 1431 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1432 mgmt_pending_remove(cmd);
1433}
1434
3b0602cd 1435static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1436{
1437 if (cmd->cmd_complete) {
1438 u8 *status = data;
1439
1440 cmd->cmd_complete(cmd, *status);
1441 mgmt_pending_remove(cmd);
1442
1443 return;
1444 }
1445
1446 cmd_status_rsp(cmd, data);
1447}
1448
3b0602cd 1449static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1450{
2a1afb5a
JH		 1451 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1452 cmd->param, cmd->param_len);
f5818c22
JH		 1453}
1454
3b0602cd 1455static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1456{
2a1afb5a
JH		 1457 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1458 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1459}
1460
e6fe7986
JH		 1461static u8 mgmt_bredr_support(struct hci_dev *hdev)
1462{
1463 if (!lmp_bredr_capable(hdev))
1464 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1465 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1466 return MGMT_STATUS_REJECTED;
1467 else
1468 return MGMT_STATUS_SUCCESS;
1469}
1470
1471static u8 mgmt_le_support(struct hci_dev *hdev)
1472{
1473 if (!lmp_le_capable(hdev))
1474 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1475 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1476 return MGMT_STATUS_REJECTED;
1477 else
1478 return MGMT_STATUS_SUCCESS;
1479}
1480
1904a853
MH		 1481static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1482 u16 opcode)
bfaf8c9f 1483{
3b0602cd 1484 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1485 struct mgmt_mode *cp;
970ba524 1486 struct hci_request req;
bfaf8c9f
JH		 1487 bool changed;
1488
1489 BT_DBG("status 0x%02x", status);
1490
1491 hci_dev_lock(hdev);
1492
333ae95d 1493 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1494 if (!cmd)
1495 goto unlock;
1496
1497 if (status) {
1498 u8 mgmt_err = mgmt_status(status);
a69e8375 1499 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1500 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1501 goto remove_cmd;
1502 }
1503
1504 cp = cmd->param;
d4462a07 1505 if (cp->val) {
238be788 1506 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1507
1508 if (hdev->discov_timeout > 0) {
1509 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1510 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1511 to);
1512 }
1513 } else {
a69d8927 1514 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1515 }
bfaf8c9f
JH		 1516
1517 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1518
1519 if (changed)
1520 new_settings(hdev, cmd->sk);
1521
970ba524
MH		 1522 /* When the discoverable mode gets changed, make sure
1523 * that class of device has the limited discoverable
432df05e
JH		 1524 * bit correctly set. Also update page scan based on whitelist
1525 * entries.
970ba524
MH		 1526 */
1527 hci_req_init(&req, hdev);
1d2dc5b7 1528 __hci_update_page_scan(&req);
970ba524
MH		 1529 update_class(&req);
1530 hci_req_run(&req, NULL);
1531
bfaf8c9f
JH		 1532remove_cmd:
1533 mgmt_pending_remove(cmd);
1534
1535unlock:
1536 hci_dev_unlock(hdev);
1537}
1538
bdb6d971 1539static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1540 u16 len)
73f22f62 1541{
650f726d 1542 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1543 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1544 struct hci_request req;
5e5282bb 1545 u16 timeout;
9a43e25f 1546 u8 scan;
73f22f62
JH		 1547 int err;
1548
bdb6d971 1549 BT_DBG("request for %s", hdev->name);
73f22f62 1550
d7a5a11d
MH		 1551 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1552 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1553 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1554 MGMT_STATUS_REJECTED);
33c525c0 1555
310a3d48 1556 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1557 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1558 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1559
1f350c87 1560 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1561
1562 /* Disabling discoverable requires that no timeout is set,
1563 * and enabling limited discoverable requires a timeout.
1564 */
1565 if ((cp->val == 0x00 && timeout > 0) ||
1566 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1568 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1569
09fd0de5 1570 hci_dev_lock(hdev);
73f22f62 1571
5e5282bb 1572 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1573 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1574 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1575 goto failed;
1576 }
1577
333ae95d
JH		 1578 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1579 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1580 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1581 MGMT_STATUS_BUSY);
73f22f62
JH		 1582 goto failed;
1583 }
1584
d7a5a11d 1585 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1586 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1587 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1588 goto failed;
1589 }
1590
1591 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1592 bool changed = false;
1593
310a3d48
MH		 1594 /* Setting limited discoverable when powered off is
1595 * not a valid operation since it requires a timeout
1596 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1597 */
d7a5a11d 1598 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1599 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1600 changed = true;
1601 }
1602
5e5282bb 1603 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1604 if (err < 0)
1605 goto failed;
1606
1607 if (changed)
1608 err = new_settings(hdev, sk);
1609
5e5282bb
JH		 1610 goto failed;
1611 }
1612
310a3d48
MH		 1613 /* If the current mode is the same, then just update the timeout
1614 * value with the new value. And if only the timeout gets updated,
1615 * then no need for any HCI transactions.
1616 */
d7a5a11d
MH		 1617 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1618 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1619 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1620 cancel_delayed_work(&hdev->discov_off);
1621 hdev->discov_timeout = timeout;
955638ec 1622
36261547
MH		 1623 if (cp->val && hdev->discov_timeout > 0) {
1624 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1625 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1626 to);
955638ec
MH		 1627 }
1628
69ab39ea 1629 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1630 goto failed;
1631 }
1632
2e58ef3e 1633 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1634 if (!cmd) {
1635 err = -ENOMEM;
73f22f62 1636 goto failed;
366a0336 1637 }
73f22f62 1638
310a3d48
MH		 1639 /* Cancel any potential discoverable timeout that might be
1640 * still active and store new timeout value. The arming of
1641 * the timeout happens in the complete handler.
1642 */
1643 cancel_delayed_work(&hdev->discov_off);
1644 hdev->discov_timeout = timeout;
1645
b456f87c
JH		 1646 /* Limited discoverable mode */
1647 if (cp->val == 0x02)
a1536da2 1648 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1649 else
a358dc11 1650 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1651
bfaf8c9f
JH		 1652 hci_req_init(&req, hdev);
1653
9a43e25f
JH		 1654 /* The procedure for LE-only controllers is much simpler - just
1655 * update the advertising data.
1656 */
d7a5a11d 1657 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 1658 goto update_ad;
1659
73f22f62
JH		 1660 scan = SCAN_PAGE;
1661
310a3d48
MH		 1662 if (cp->val) {
1663 struct hci_cp_write_current_iac_lap hci_cp;
1664
1665 if (cp->val == 0x02) {
1666 /* Limited discoverable mode */
33337dcb 1667 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1668 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1669 hci_cp.iac_lap[1] = 0x8b;
1670 hci_cp.iac_lap[2] = 0x9e;
1671 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1672 hci_cp.iac_lap[4] = 0x8b;
1673 hci_cp.iac_lap[5] = 0x9e;
1674 } else {
1675 /* General discoverable mode */
310a3d48
MH		 1676 hci_cp.num_iac = 1;
1677 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1678 hci_cp.iac_lap[1] = 0x8b;
1679 hci_cp.iac_lap[2] = 0x9e;
1680 }
1681
1682 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1683 (hci_cp.num_iac * 3) + 1, &hci_cp);
1684
73f22f62 1685 scan |= SCAN_INQUIRY;
310a3d48 1686 } else {
a358dc11 1687 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 1688 }
73f22f62 1689
310a3d48 1690 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1691
9a43e25f
JH		 1692update_ad:
1693 update_adv_data(&req);
1694
bfaf8c9f 1695 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1696 if (err < 0)
a664b5bc 1697 mgmt_pending_remove(cmd);
73f22f62
JH		 1698
1699failed:
09fd0de5 1700 hci_dev_unlock(hdev);
73f22f62
JH		 1701 return err;
1702}
1703
406d7804
JH		 1704static void write_fast_connectable(struct hci_request *req, bool enable)
1705{
bd98b996 1706 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1707 struct hci_cp_write_page_scan_activity acp;
1708 u8 type;
1709
d7a5a11d 1710 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 1711 return;
1712
4c01f8b8
JH		 1713 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1714 return;
1715
406d7804
JH		 1716 if (enable) {
1717 type = PAGE_SCAN_TYPE_INTERLACED;
1718
1719 /* 160 msec page scan interval */
dcf4adbf 1720 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 1721 } else {
1722 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1723
1724 /* default 1.28 sec page scan */
dcf4adbf 1725 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 1726 }
1727
dcf4adbf 1728 acp.window = cpu_to_le16(0x0012);
406d7804 1729
bd98b996
JH		 1730 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1731 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1732 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1733 sizeof(acp), &acp);
1734
1735 if (hdev->page_scan_type != type)
1736 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1737}
1738
1904a853
MH		 1739static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1740 u16 opcode)
2b76f453 1741{
3b0602cd 1742 struct mgmt_pending_cmd *cmd;
d7b856f9 1743 struct mgmt_mode *cp;
bc6d2d04 1744 bool conn_changed, discov_changed;
2b76f453
JH		 1745
1746 BT_DBG("status 0x%02x", status);
1747
1748 hci_dev_lock(hdev);
1749
333ae95d 1750 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 1751 if (!cmd)
1752 goto unlock;
1753
37438c1f
JH		 1754 if (status) {
1755 u8 mgmt_err = mgmt_status(status);
a69e8375 1756 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 1757 goto remove_cmd;
1758 }
1759
d7b856f9 1760 cp = cmd->param;
bc6d2d04 1761 if (cp->val) {
238be788
MH		 1762 conn_changed = !hci_dev_test_and_set_flag(hdev,
1763 HCI_CONNECTABLE);
bc6d2d04
JH		 1764 discov_changed = false;
1765 } else {
a69d8927
MH		 1766 conn_changed = hci_dev_test_and_clear_flag(hdev,
1767 HCI_CONNECTABLE);
1768 discov_changed = hci_dev_test_and_clear_flag(hdev,
1769 HCI_DISCOVERABLE);
bc6d2d04 1770 }
d7b856f9 1771
2b76f453
JH		 1772 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1773
bc6d2d04 1774 if (conn_changed || discov_changed) {
d7b856f9 1775 new_settings(hdev, cmd->sk);
1d2dc5b7 1776 hci_update_page_scan(hdev);
bc6d2d04
JH		 1777 if (discov_changed)
1778 mgmt_update_adv_data(hdev);
2b7be33e
JH		 1779 hci_update_background_scan(hdev);
1780 }
d7b856f9 1781
37438c1f 1782remove_cmd:
2b76f453
JH		 1783 mgmt_pending_remove(cmd);
1784
1785unlock:
1786 hci_dev_unlock(hdev);
1787}
1788
e8ba3a1f
JH		 1789static int set_connectable_update_settings(struct hci_dev *hdev,
1790 struct sock *sk, u8 val)
1791{
1792 bool changed = false;
1793 int err;
1794
d7a5a11d 1795 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 1796 changed = true;
1797
1798 if (val) {
a1536da2 1799 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 1800 } else {
a358dc11
MH		 1801 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
1802 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 1803 }
1804
1805 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1806 if (err < 0)
1807 return err;
1808
562064e6 1809 if (changed) {
1d2dc5b7 1810 hci_update_page_scan(hdev);
562064e6 1811 hci_update_background_scan(hdev);
e8ba3a1f 1812 return new_settings(hdev, sk);
562064e6 1813 }
e8ba3a1f
JH		 1814
1815 return 0;
1816}
1817
bdb6d971 1818static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1819 u16 len)
9fbcbb45 1820{
650f726d 1821 struct mgmt_mode *cp = data;
3b0602cd 1822 struct mgmt_pending_cmd *cmd;
2b76f453 1823 struct hci_request req;
1987fdc7 1824 u8 scan;
9fbcbb45
JH		 1825 int err;
1826
bdb6d971 1827 BT_DBG("request for %s", hdev->name);
9fbcbb45 1828
d7a5a11d
MH		 1829 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1830 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1831 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1832 MGMT_STATUS_REJECTED);
33c525c0 1833
a7e80f25 1834 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1835 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1836 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1837
09fd0de5 1838 hci_dev_lock(hdev);
9fbcbb45 1839
4b34ee78 1840 if (!hdev_is_powered(hdev)) {
e8ba3a1f 1841 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 1842 goto failed;
1843 }
1844
333ae95d
JH		 1845 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1846 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1847 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1848 MGMT_STATUS_BUSY);
9fbcbb45
JH		 1849 goto failed;
1850 }
1851
2e58ef3e 1852 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 1853 if (!cmd) {
1854 err = -ENOMEM;
9fbcbb45 1855 goto failed;
366a0336 1856 }
9fbcbb45 1857
9b74246f 1858 hci_req_init(&req, hdev);
9fbcbb45 1859
9a43e25f
JH		 1860 /* If BR/EDR is not enabled and we disable advertising as a
1861 * by-product of disabling connectable, we need to update the
1862 * advertising flags.
1863 */
d7a5a11d 1864 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 1865 if (!cp->val) {
a358dc11
MH		 1866 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1867 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 1868 }
1869 update_adv_data(&req);
1870 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 1871 if (cp->val) {
1872 scan = SCAN_PAGE;
1873 } else {
3bd27240
JH		 1874 /* If we don't have any whitelist entries just
1875 * disable all scanning. If there are entries
1876 * and we had both page and inquiry scanning
1877 * enabled then fall back to only page scanning.
1878 * Otherwise no changes are needed.
1879 */
1880 if (list_empty(&hdev->whitelist))
1881 scan = SCAN_DISABLED;
1882 else if (test_bit(HCI_ISCAN, &hdev->flags))
1883 scan = SCAN_PAGE;
1884 else
1885 goto no_scan_update;
9b74246f
JH		 1886
1887 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 1888 hdev->discov_timeout > 0)
9b74246f
JH		 1889 cancel_delayed_work(&hdev->discov_off);
1890 }
2b76f453 1891
9b74246f
JH		 1892 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1893 }
2b76f453 1894
3bd27240 1895no_scan_update:
e8b1202c 1896 /* Update the advertising parameters if necessary */
d7a5a11d 1897 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
1987fdc7 1898 enable_advertising(&req);
1987fdc7 1899
2b76f453 1900 err = hci_req_run(&req, set_connectable_complete);
9b74246f 1901 if (err < 0) {
a664b5bc 1902 mgmt_pending_remove(cmd);
9b74246f 1903 if (err == -ENODATA)
a81070ba
JH		 1904 err = set_connectable_update_settings(hdev, sk,
1905 cp->val);
9b74246f
JH		 1906 goto failed;
1907 }
9fbcbb45
JH		 1908
1909failed:
09fd0de5 1910 hci_dev_unlock(hdev);
9fbcbb45
JH		 1911 return err;
1912}
1913
b2939475 1914static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1915 u16 len)
c542a06c 1916{
650f726d 1917 struct mgmt_mode *cp = data;
55594356 1918 bool changed;
c542a06c
JH		 1919 int err;
1920
bdb6d971 1921 BT_DBG("request for %s", hdev->name);
c542a06c 1922
a7e80f25 1923 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1924 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
1925 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1926
09fd0de5 1927 hci_dev_lock(hdev);
c542a06c
JH		 1928
1929 if (cp->val)
238be788 1930 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 1931 else
a69d8927 1932 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 1933
b2939475 1934 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 1935 if (err < 0)
55594356 1936 goto unlock;
c542a06c 1937
55594356
MH		 1938 if (changed)
1939 err = new_settings(hdev, sk);
c542a06c 1940
55594356 1941unlock:
09fd0de5 1942 hci_dev_unlock(hdev);
c542a06c
JH		 1943 return err;
1944}
1945
04124681
GP		 1946static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
1947 u16 len)
33ef95ed
JH		 1948{
1949 struct mgmt_mode *cp = data;
3b0602cd 1950 struct mgmt_pending_cmd *cmd;
e6fe7986 1951 u8 val, status;
33ef95ed
JH		 1952 int err;
1953
bdb6d971 1954 BT_DBG("request for %s", hdev->name);
33ef95ed 1955
e6fe7986
JH		 1956 status = mgmt_bredr_support(hdev);
1957 if (status)
a69e8375
JH		 1958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1959 status);
33c525c0 1960
a7e80f25 1961 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1962 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1963 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1964
33ef95ed
JH		 1965 hci_dev_lock(hdev);
1966
4b34ee78 1967 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 1968 bool changed = false;
1969
d7a5a11d 1970 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 1971 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 1972 changed = true;
1973 }
1974
1975 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1976 if (err < 0)
1977 goto failed;
1978
1979 if (changed)
1980 err = new_settings(hdev, sk);
1981
33ef95ed
JH		 1982 goto failed;
1983 }
1984
333ae95d 1985 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 1986 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
1987 MGMT_STATUS_BUSY);
33ef95ed
JH		 1988 goto failed;
1989 }
1990
1991 val = !!cp->val;
1992
1993 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
1994 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
1995 goto failed;
1996 }
1997
1998 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
1999 if (!cmd) {
2000 err = -ENOMEM;
2001 goto failed;
2002 }
2003
2004 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2005 if (err < 0) {
2006 mgmt_pending_remove(cmd);
2007 goto failed;
2008 }
2009
2010failed:
2011 hci_dev_unlock(hdev);
33ef95ed
JH		 2012 return err;
2013}
2014
bdb6d971 2015static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2016{
2017 struct mgmt_mode *cp = data;
3b0602cd 2018 struct mgmt_pending_cmd *cmd;
72ef0c1a 2019 u8 status;
ed2c4ee3
JH		 2020 int err;
2021
bdb6d971 2022 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2023
cdba5281
MH		 2024 status = mgmt_bredr_support(hdev);
2025 if (status)
a69e8375 2026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2027
13ecd8b6 2028 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2030 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2031
a7e80f25 2032 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2034 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2035
13ecd8b6 2036 hci_dev_lock(hdev);
6c8f12c1 2037
4b34ee78 2038 if (!hdev_is_powered(hdev)) {
9ecb3e24 2039 bool changed;
c0ecddc2 2040
9ecb3e24 2041 if (cp->val) {
238be788
MH		 2042 changed = !hci_dev_test_and_set_flag(hdev,
2043 HCI_SSP_ENABLED);
9ecb3e24 2044 } else {
a69d8927
MH		 2045 changed = hci_dev_test_and_clear_flag(hdev,
2046 HCI_SSP_ENABLED);
9ecb3e24 2047 if (!changed)
a69d8927
MH		 2048 changed = hci_dev_test_and_clear_flag(hdev,
2049 HCI_HS_ENABLED);
9ecb3e24 2050 else
a358dc11 2051 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2052 }
2053
2054 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2055 if (err < 0)
2056 goto failed;
2057
2058 if (changed)
2059 err = new_settings(hdev, sk);
2060
ed2c4ee3
JH		 2061 goto failed;
2062 }
2063
333ae95d 2064 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2065 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2066 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2067 goto failed;
2068 }
2069
d7a5a11d 2070 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2071 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2072 goto failed;
2073 }
2074
2075 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2076 if (!cmd) {
2077 err = -ENOMEM;
2078 goto failed;
2079 }
2080
d7a5a11d 2081 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2082 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2083 sizeof(cp->val), &cp->val);
2084
72ef0c1a 2085 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2086 if (err < 0) {
2087 mgmt_pending_remove(cmd);
2088 goto failed;
2089 }
2090
2091failed:
2092 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2093 return err;
2094}
2095
bdb6d971 2096static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2097{
2098 struct mgmt_mode *cp = data;
ee392693 2099 bool changed;
e6fe7986 2100 u8 status;
ee392693 2101 int err;
6d80dfd0 2102
bdb6d971 2103 BT_DBG("request for %s", hdev->name);
6d80dfd0 2104
e6fe7986
JH		 2105 status = mgmt_bredr_support(hdev);
2106 if (status)
a69e8375 2107 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2108
9ecb3e24 2109 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2110 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2111 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2112
d7a5a11d 2113 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2114 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2115 MGMT_STATUS_REJECTED);
9ecb3e24 2116
a7e80f25 2117 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2118 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2119 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2120
ee392693
MH		 2121 hci_dev_lock(hdev);
2122
333ae95d 2123 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2124 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2125 MGMT_STATUS_BUSY);
a2cb01de
JH		 2126 goto unlock;
2127 }
2128
a0cdf960 2129 if (cp->val) {
238be788 2130 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2131 } else {
2132 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2133 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2134 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2135 goto unlock;
2136 }
2137
a69d8927 2138 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2139 }
ee392693
MH		 2140
2141 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2142 if (err < 0)
2143 goto unlock;
2144
2145 if (changed)
2146 err = new_settings(hdev, sk);
6d80dfd0 2147
ee392693
MH		 2148unlock:
2149 hci_dev_unlock(hdev);
2150 return err;
6d80dfd0
JH		 2151}
2152
1904a853 2153static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2154{
2155 struct cmd_lookup match = { NULL, hdev };
2156
3ad67582
JK		 2157 hci_dev_lock(hdev);
2158
416a4ae5
JH		 2159 if (status) {
2160 u8 mgmt_err = mgmt_status(status);
2161
2162 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2163 &mgmt_err);
3ad67582 2164 goto unlock;
416a4ae5
JH		 2165 }
2166
2167 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2168
2169 new_settings(hdev, match.sk);
2170
2171 if (match.sk)
2172 sock_put(match.sk);
441ad2d0
MH		 2173
2174 /* Make sure the controller has a good default for
2175 * advertising data. Restrict the update to when LE
2176 * has actually been enabled. During power on, the
2177 * update in powered_update_hci will take care of it.
2178 */
d7a5a11d 2179 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2180 struct hci_request req;
2181
441ad2d0 2182 hci_req_init(&req, hdev);
5947f4bc 2183 update_adv_data(&req);
f14d8f64 2184 update_scan_rsp_data(&req);
2cf22218 2185 __hci_update_background_scan(&req);
441ad2d0 2186 hci_req_run(&req, NULL);
441ad2d0 2187 }
3ad67582
JK		 2188
2189unlock:
2190 hci_dev_unlock(hdev);
416a4ae5
JH		 2191}
2192
bdb6d971 2193static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2194{
2195 struct mgmt_mode *cp = data;
2196 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2197 struct mgmt_pending_cmd *cmd;
416a4ae5 2198 struct hci_request req;
06199cf8 2199 int err;
0b60eba1 2200 u8 val, enabled;
06199cf8 2201
bdb6d971 2202 BT_DBG("request for %s", hdev->name);
06199cf8 2203
13ecd8b6 2204 if (!lmp_le_capable(hdev))
a69e8375
JH		 2205 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2206 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2207
a7e80f25 2208 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2209 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2210 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2211
c73eee91 2212 /* LE-only devices do not allow toggling LE on/off */
d7a5a11d 2213 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2215 MGMT_STATUS_REJECTED);
c73eee91 2216
13ecd8b6 2217 hci_dev_lock(hdev);
06199cf8
JH		 2218
2219 val = !!cp->val;
ffa88e02 2220 enabled = lmp_host_le_capable(hdev);
06199cf8 2221
0b60eba1 2222 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2223 bool changed = false;
2224
d7a5a11d 2225 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2226 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2227 changed = true;
2228 }
2229
d7a5a11d 2230 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2231 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2232 changed = true;
2233 }
2234
06199cf8
JH		 2235 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2236 if (err < 0)
1de028ce 2237 goto unlock;
06199cf8
JH		 2238
2239 if (changed)
2240 err = new_settings(hdev, sk);
2241
1de028ce 2242 goto unlock;
06199cf8
JH		 2243 }
2244
333ae95d
JH		 2245 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2246 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2248 MGMT_STATUS_BUSY);
1de028ce 2249 goto unlock;
06199cf8
JH		 2250 }
2251
2252 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2253 if (!cmd) {
2254 err = -ENOMEM;
1de028ce 2255 goto unlock;
06199cf8
JH		 2256 }
2257
441ad2d0
MH		 2258 hci_req_init(&req, hdev);
2259
06199cf8
JH		 2260 memset(&hci_cp, 0, sizeof(hci_cp));
2261
2262 if (val) {
2263 hci_cp.le = val;
32226e4f 2264 hci_cp.simul = 0x00;
441ad2d0 2265 } else {
d7a5a11d 2266 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2267 disable_advertising(&req);
06199cf8
JH		 2268 }
2269
416a4ae5
JH		 2270 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2271 &hci_cp);
2272
2273 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2274 if (err < 0)
06199cf8 2275 mgmt_pending_remove(cmd);
06199cf8 2276
1de028ce
JH		 2277unlock:
2278 hci_dev_unlock(hdev);
06199cf8
JH		 2279 return err;
2280}
2281
0cab9c80
JH		 2282/* This is a helper function to test for pending mgmt commands that can
2283 * cause CoD or EIR HCI commands. We can only allow one such pending
2284 * mgmt command at a time since otherwise we cannot easily track what
2285 * the current values are, will be, and based on that calculate if a new
2286 * HCI command needs to be sent and if yes with what value.
2287 */
2288static bool pending_eir_or_class(struct hci_dev *hdev)
2289{
3b0602cd 2290 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2291
2292 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2293 switch (cmd->opcode) {
2294 case MGMT_OP_ADD_UUID:
2295 case MGMT_OP_REMOVE_UUID:
2296 case MGMT_OP_SET_DEV_CLASS:
2297 case MGMT_OP_SET_POWERED:
2298 return true;
2299 }
2300 }
2301
2302 return false;
2303}
2304
83be8eca
JH		 2305static const u8 bluetooth_base_uuid[] = {
2306 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2307 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2308};
2309
2310static u8 get_uuid_size(const u8 *uuid)
2311{
2312 u32 val;
2313
2314 if (memcmp(uuid, bluetooth_base_uuid, 12))
2315 return 128;
2316
2317 val = get_unaligned_le32(&uuid[12]);
2318 if (val > 0xffff)
2319 return 32;
2320
2321 return 16;
2322}
2323
92da6097
JH		 2324static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2325{
3b0602cd 2326 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2327
2328 hci_dev_lock(hdev);
2329
333ae95d 2330 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2331 if (!cmd)
2332 goto unlock;
2333
2a1afb5a
JH		 2334 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2335 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2336
2337 mgmt_pending_remove(cmd);
2338
2339unlock:
2340 hci_dev_unlock(hdev);
2341}
2342
1904a853 2343static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2344{
2345 BT_DBG("status 0x%02x", status);
2346
2347 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2348}
2349
bdb6d971 2350static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2351{
650f726d 2352 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2353 struct mgmt_pending_cmd *cmd;
890ea898 2354 struct hci_request req;
2aeb9a1a 2355 struct bt_uuid *uuid;
2aeb9a1a
JH		 2356 int err;
2357
bdb6d971 2358 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2359
09fd0de5 2360 hci_dev_lock(hdev);
2aeb9a1a 2361
0cab9c80 2362 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2363 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2364 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2365 goto failed;
2366 }
2367
92c4c204 2368 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2369 if (!uuid) {
2370 err = -ENOMEM;
2371 goto failed;
2372 }
2373
2374 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2375 uuid->svc_hint = cp->svc_hint;
83be8eca 2376 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2377
de66aa63 2378 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2379
890ea898 2380 hci_req_init(&req, hdev);
1aff6f09 2381
890ea898
JH		 2382 update_class(&req);
2383 update_eir(&req);
2384
92da6097
JH		 2385 err = hci_req_run(&req, add_uuid_complete);
2386 if (err < 0) {
2387 if (err != -ENODATA)
2388 goto failed;
80a1e1db 2389
2a1afb5a
JH		 2390 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2391 hdev->dev_class, 3);
90e70454
JH		 2392 goto failed;
2393 }
2394
2395 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2396 if (!cmd) {
90e70454 2397 err = -ENOMEM;
890ea898
JH		 2398 goto failed;
2399 }
2400
2401 err = 0;
2aeb9a1a
JH		 2402
2403failed:
09fd0de5 2404 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2405 return err;
2406}
2407
24b78d0f
JH		 2408static bool enable_service_cache(struct hci_dev *hdev)
2409{
2410 if (!hdev_is_powered(hdev))
2411 return false;
2412
238be788 2413 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2414 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2415 CACHE_TIMEOUT);
24b78d0f
JH		 2416 return true;
2417 }
2418
2419 return false;
2420}
2421
1904a853 2422static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2423{
2424 BT_DBG("status 0x%02x", status);
2425
2426 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2427}
2428
bdb6d971 2429static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2430 u16 len)
2aeb9a1a 2431{
650f726d 2432 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2433 struct mgmt_pending_cmd *cmd;
056341c8 2434 struct bt_uuid *match, *tmp;
2aeb9a1a 2435 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2436 struct hci_request req;
2aeb9a1a
JH		 2437 int err, found;
2438
bdb6d971 2439 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2440
09fd0de5 2441 hci_dev_lock(hdev);
2aeb9a1a 2442
0cab9c80 2443 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2444 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2445 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2446 goto unlock;
2447 }
2448
2aeb9a1a 2449 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2450 hci_uuids_clear(hdev);
4004b6d9 2451
24b78d0f 2452 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2453 err = mgmt_cmd_complete(sk, hdev->id,
2454 MGMT_OP_REMOVE_UUID,
2455 0, hdev->dev_class, 3);
24b78d0f
JH		 2456 goto unlock;
2457 }
4004b6d9 2458
9246a869 2459 goto update_class;
2aeb9a1a
JH		 2460 }
2461
2462 found = 0;
2463
056341c8 2464 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2465 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2466 continue;
2467
2468 list_del(&match->list);
482049f7 2469 kfree(match);
2aeb9a1a
JH		 2470 found++;
2471 }
2472
2473 if (found == 0) {
a69e8375
JH		 2474 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2475 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2476 goto unlock;
2477 }
2478
9246a869 2479update_class:
890ea898 2480 hci_req_init(&req, hdev);
1aff6f09 2481
890ea898
JH		 2482 update_class(&req);
2483 update_eir(&req);
2484
92da6097
JH		 2485 err = hci_req_run(&req, remove_uuid_complete);
2486 if (err < 0) {
2487 if (err != -ENODATA)
2488 goto unlock;
80a1e1db 2489
2a1afb5a
JH		 2490 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2491 hdev->dev_class, 3);
90e70454
JH		 2492 goto unlock;
2493 }
2494
2495 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2496 if (!cmd) {
90e70454 2497 err = -ENOMEM;
890ea898
JH		 2498 goto unlock;
2499 }
2500
2501 err = 0;
2aeb9a1a
JH		 2502
2503unlock:
09fd0de5 2504 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2505 return err;
2506}
2507
1904a853 2508static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2509{
2510 BT_DBG("status 0x%02x", status);
2511
2512 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2513}
2514
bdb6d971 2515static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2516 u16 len)
1aff6f09 2517{
650f726d 2518 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2519 struct mgmt_pending_cmd *cmd;
890ea898 2520 struct hci_request req;
1aff6f09
JH		 2521 int err;
2522
bdb6d971 2523 BT_DBG("request for %s", hdev->name);
1aff6f09 2524
6203fc98 2525 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2526 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2527 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2528
0cab9c80 2529 hci_dev_lock(hdev);
ee98f473 2530
0cab9c80 2531 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2532 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2533 MGMT_STATUS_BUSY);
0cab9c80
JH		 2534 goto unlock;
2535 }
c95f0ba7 2536
0cab9c80 2537 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2538 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2539 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2540 goto unlock;
2541 }
575b3a02 2542
932f5ff5
JH		 2543 hdev->major_class = cp->major;
2544 hdev->minor_class = cp->minor;
2545
b5235a65 2546 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2547 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2548 hdev->dev_class, 3);
b5235a65
JH		 2549 goto unlock;
2550 }
2551
890ea898
JH		 2552 hci_req_init(&req, hdev);
2553
a69d8927 2554 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2555 hci_dev_unlock(hdev);
2556 cancel_delayed_work_sync(&hdev->service_cache);
2557 hci_dev_lock(hdev);
890ea898 2558 update_eir(&req);
7d78525d 2559 }
14c0b608 2560
890ea898
JH		 2561 update_class(&req);
2562
92da6097
JH		 2563 err = hci_req_run(&req, set_class_complete);
2564 if (err < 0) {
2565 if (err != -ENODATA)
2566 goto unlock;
1aff6f09 2567
2a1afb5a
JH		 2568 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2569 hdev->dev_class, 3);
90e70454
JH		 2570 goto unlock;
2571 }
2572
2573 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2574 if (!cmd) {
90e70454 2575 err = -ENOMEM;
890ea898
JH		 2576 goto unlock;
2577 }
2578
2579 err = 0;
1aff6f09 2580
b5235a65 2581unlock:
09fd0de5 2582 hci_dev_unlock(hdev);
1aff6f09
JH		 2583 return err;
2584}
2585
bdb6d971 2586static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2587 u16 len)
55ed8ca1 2588{
650f726d 2589 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2590 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2591 sizeof(struct mgmt_link_key_info));
4e51eae9 2592 u16 key_count, expected_len;
b1de97d8 2593 bool changed;
a492cd52 2594 int i;
55ed8ca1 2595
9060d5cf
MH		 2596 BT_DBG("request for %s", hdev->name);
2597
2598 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2599 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2600 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2601
1f350c87 2602 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2603 if (key_count > max_key_count) {
2604 BT_ERR("load_link_keys: too big key_count value %u",
2605 key_count);
a69e8375
JH		 2606 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2607 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2608 }
55ed8ca1 2609
86742e1e
JH		 2610 expected_len = sizeof(*cp) + key_count *
2611 sizeof(struct mgmt_link_key_info);
a492cd52 2612 if (expected_len != len) {
86742e1e 2613 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2614 expected_len, len);
a69e8375
JH		 2615 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2616 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2617 }
2618
4ae14301 2619 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2620 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2621 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2622
bdb6d971 2623 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2624 key_count);
55ed8ca1 2625
4ee71b20
JH		 2626 for (i = 0; i < key_count; i++) {
2627 struct mgmt_link_key_info *key = &cp->keys[i];
2628
8e991132 2629 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 2630 return mgmt_cmd_status(sk, hdev->id,
2631 MGMT_OP_LOAD_LINK_KEYS,
2632 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2633 }
2634
09fd0de5 2635 hci_dev_lock(hdev);
55ed8ca1
JH		 2636
2637 hci_link_keys_clear(hdev);
2638
55ed8ca1 2639 if (cp->debug_keys)
238be788 2640 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 2641 else
a69d8927
MH		 2642 changed = hci_dev_test_and_clear_flag(hdev,
2643 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 2644
2645 if (changed)
2646 new_settings(hdev, NULL);
55ed8ca1 2647
a492cd52 2648 for (i = 0; i < key_count; i++) {
86742e1e 2649 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2650
58e9293c
JH		 2651 /* Always ignore debug keys and require a new pairing if
2652 * the user wants to use them.
2653 */
2654 if (key->type == HCI_LK_DEBUG_COMBINATION)
2655 continue;
2656
7652ff6a
JH		 2657 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2658 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2659 }
2660
2a1afb5a 2661 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2662
09fd0de5 2663 hci_dev_unlock(hdev);
55ed8ca1 2664
a492cd52 2665 return 0;
55ed8ca1
JH		 2666}
2667
b1078ad0 2668static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2669 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2670{
2671 struct mgmt_ev_device_unpaired ev;
2672
2673 bacpy(&ev.addr.bdaddr, bdaddr);
2674 ev.addr.type = addr_type;
2675
2676 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2677 skip_sk);
b1078ad0
JH		 2678}
2679
bdb6d971 2680static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2681 u16 len)
55ed8ca1 2682{
124f6e35
JH		 2683 struct mgmt_cp_unpair_device *cp = data;
2684 struct mgmt_rp_unpair_device rp;
a8a1d19e 2685 struct hci_cp_disconnect dc;
3b0602cd 2686 struct mgmt_pending_cmd *cmd;
55ed8ca1 2687 struct hci_conn *conn;
55ed8ca1
JH		 2688 int err;
2689
a8a1d19e 2690 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2691 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2692 rp.addr.type = cp->addr.type;
a8a1d19e 2693
4ee71b20 2694 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 2695 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2696 MGMT_STATUS_INVALID_PARAMS,
2697 &rp, sizeof(rp));
4ee71b20 2698
118da70b 2699 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 2700 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2701 MGMT_STATUS_INVALID_PARAMS,
2702 &rp, sizeof(rp));
118da70b 2703
4ee71b20
JH		 2704 hci_dev_lock(hdev);
2705
86a8cfc6 2706 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2707 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2708 MGMT_STATUS_NOT_POWERED, &rp,
2709 sizeof(rp));
86a8cfc6
JH		 2710 goto unlock;
2711 }
2712
e0b2b27e 2713 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2714 /* If disconnection is requested, then look up the
2715 * connection. If the remote device is connected, it
2716 * will be later used to terminate the link.
2717 *
2718 * Setting it to NULL explicitly will cause no
2719 * termination of the link.
2720 */
2721 if (cp->disconnect)
2722 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2723 &cp->addr.bdaddr);
2724 else
2725 conn = NULL;
2726
124f6e35 2727 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2728 } else {
2729 u8 addr_type;
2730
89cbb063
AA		 2731 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2732 &cp->addr.bdaddr);
2733 if (conn) {
2734 /* Defer clearing up the connection parameters
2735 * until closing to give a chance of keeping
2736 * them if a repairing happens.
2737 */
2738 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2739
2740 /* If disconnection is not requested, then
2741 * clear the connection variable so that the
2742 * link is not terminated.
2743 */
2744 if (!cp->disconnect)
2745 conn = NULL;
2746 }
2747
e0b2b27e
JH		 2748 if (cp->addr.type == BDADDR_LE_PUBLIC)
2749 addr_type = ADDR_LE_DEV_PUBLIC;
2750 else
2751 addr_type = ADDR_LE_DEV_RANDOM;
2752
a7ec7338
JH		 2753 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2754
e0b2b27e
JH		 2755 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2756 }
b0dbfb46 2757
55ed8ca1 2758 if (err < 0) {
2a1afb5a
JH		 2759 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2760 MGMT_STATUS_NOT_PAIRED, &rp,
2761 sizeof(rp));
55ed8ca1
JH		 2762 goto unlock;
2763 }
2764
89cbb063
AA		 2765 /* If the connection variable is set, then termination of the
2766 * link is requested.
2767 */
a8a1d19e 2768 if (!conn) {
2a1afb5a
JH		 2769 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
2770 &rp, sizeof(rp));
b1078ad0 2771 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 2772 goto unlock;
2773 }
55ed8ca1 2774
124f6e35 2775 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 2776 sizeof(*cp));
a8a1d19e
JH		 2777 if (!cmd) {
2778 err = -ENOMEM;
2779 goto unlock;
55ed8ca1
JH		 2780 }
2781
d8b7b1e4
JH		 2782 cmd->cmd_complete = addr_cmd_complete;
2783
eb55ef07 2784 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 2785 dc.reason = 0x13; /* Remote User Terminated Connection */
2786 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2787 if (err < 0)
2788 mgmt_pending_remove(cmd);
2789
55ed8ca1 2790unlock:
09fd0de5 2791 hci_dev_unlock(hdev);
55ed8ca1
JH		 2792 return err;
2793}
2794
bdb6d971 2795static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2796 u16 len)
8962ee74 2797{
650f726d 2798 struct mgmt_cp_disconnect *cp = data;
06a63b19 2799 struct mgmt_rp_disconnect rp;
3b0602cd 2800 struct mgmt_pending_cmd *cmd;
8962ee74 2801 struct hci_conn *conn;
8962ee74
JH		 2802 int err;
2803
2804 BT_DBG("");
2805
06a63b19
JH		 2806 memset(&rp, 0, sizeof(rp));
2807 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2808 rp.addr.type = cp->addr.type;
2809
4ee71b20 2810 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 2811 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2812 MGMT_STATUS_INVALID_PARAMS,
2813 &rp, sizeof(rp));
4ee71b20 2814
09fd0de5 2815 hci_dev_lock(hdev);
8962ee74
JH		 2816
2817 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 2818 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2819 MGMT_STATUS_NOT_POWERED, &rp,
2820 sizeof(rp));
8962ee74
JH		 2821 goto failed;
2822 }
2823
333ae95d 2824 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 2825 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2826 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 2827 goto failed;
2828 }
2829
591f47f3 2830 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 2831 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2832 &cp->addr.bdaddr);
88c3df13
JH		 2833 else
2834 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 2835
f960727e 2836 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 2837 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2838 MGMT_STATUS_NOT_CONNECTED, &rp,
2839 sizeof(rp));
8962ee74
JH		 2840 goto failed;
2841 }
2842
2e58ef3e 2843 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 2844 if (!cmd) {
2845 err = -ENOMEM;
8962ee74 2846 goto failed;
366a0336 2847 }
8962ee74 2848
f5818c22
JH		 2849 cmd->cmd_complete = generic_cmd_complete;
2850
e3f2f92a 2851 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 2852 if (err < 0)
a664b5bc 2853 mgmt_pending_remove(cmd);
8962ee74
JH		 2854
2855failed:
09fd0de5 2856 hci_dev_unlock(hdev);
8962ee74
JH		 2857 return err;
2858}
2859
57c1477c 2860static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 2861{
2862 switch (link_type) {
2863 case LE_LINK:
48264f06
JH		 2864 switch (addr_type) {
2865 case ADDR_LE_DEV_PUBLIC:
591f47f3 2866 return BDADDR_LE_PUBLIC;
0ed09148 2867
48264f06 2868 default:
0ed09148 2869 /* Fallback to LE Random address type */
591f47f3 2870 return BDADDR_LE_RANDOM;
48264f06 2871 }
0ed09148 2872
4c659c39 2873 default:
0ed09148 2874 /* Fallback to BR/EDR type */
591f47f3 2875 return BDADDR_BREDR;
4c659c39
JH		 2876 }
2877}
2878
04124681
GP		 2879static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2880 u16 data_len)
2784eb41 2881{
2784eb41 2882 struct mgmt_rp_get_connections *rp;
8035ded4 2883 struct hci_conn *c;
a38528f1 2884 size_t rp_len;
60fc5fb6
JH		 2885 int err;
2886 u16 i;
2784eb41
JH		 2887
2888 BT_DBG("");
2889
09fd0de5 2890 hci_dev_lock(hdev);
2784eb41 2891
5f97c1df 2892 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 2893 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
2894 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 2895 goto unlock;
2896 }
2897
60fc5fb6 2898 i = 0;
b644ba33
JH		 2899 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2900 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 2901 i++;
2784eb41
JH		 2902 }
2903
60fc5fb6 2904 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 2905 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 2906 if (!rp) {
2784eb41
JH		 2907 err = -ENOMEM;
2908 goto unlock;
2909 }
2910
2784eb41 2911 i = 0;
4c659c39 2912 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 2913 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2914 continue;
4c659c39 2915 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 2916 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 2917 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 2918 continue;
2919 i++;
2920 }
2921
eb55ef07 2922 rp->conn_count = cpu_to_le16(i);
60fc5fb6 2923
4c659c39
JH		 2924 /* Recalculate length in case of filtered SCO connections, etc */
2925 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 2926
2a1afb5a
JH		 2927 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
2928 rp_len);
2784eb41 2929
a38528f1 2930 kfree(rp);
5f97c1df
JH		 2931
2932unlock:
09fd0de5 2933 hci_dev_unlock(hdev);
2784eb41
JH		 2934 return err;
2935}
2936
bdb6d971 2937static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 2938 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 2939{
3b0602cd 2940 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 2941 int err;
2942
2e58ef3e 2943 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 2944 sizeof(*cp));
96d97a67
WR		 2945 if (!cmd)
2946 return -ENOMEM;
2947
d8457698 2948 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 2949 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 2950 if (err < 0)
2951 mgmt_pending_remove(cmd);
2952
2953 return err;
2954}
2955
bdb6d971 2956static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2957 u16 len)
980e1a53 2958{
96d97a67 2959 struct hci_conn *conn;
650f726d 2960 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 2961 struct hci_cp_pin_code_reply reply;
3b0602cd 2962 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 2963 int err;
2964
2965 BT_DBG("");
2966
09fd0de5 2967 hci_dev_lock(hdev);
980e1a53 2968
4b34ee78 2969 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 2970 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2971 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 2972 goto failed;
2973 }
2974
d8457698 2975 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 2976 if (!conn) {
a69e8375
JH		 2977 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2978 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 2979 goto failed;
2980 }
2981
2982 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 2983 struct mgmt_cp_pin_code_neg_reply ncp;
2984
2985 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 2986
2987 BT_ERR("PIN code is not 16 bytes long");
2988
bdb6d971 2989 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 2990 if (err >= 0)
a69e8375
JH		 2991 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
2992 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 2993
2994 goto failed;
2995 }
2996
00abfe44 2997 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 2998 if (!cmd) {
2999 err = -ENOMEM;
980e1a53 3000 goto failed;
366a0336 3001 }
980e1a53 3002
7776d1d8
JH		 3003 cmd->cmd_complete = addr_cmd_complete;
3004
d8457698 3005 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3006 reply.pin_len = cp->pin_len;
24718ca5 3007 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3008
3009 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3010 if (err < 0)
a664b5bc 3011 mgmt_pending_remove(cmd);
980e1a53
JH		 3012
3013failed:
09fd0de5 3014 hci_dev_unlock(hdev);
980e1a53
JH		 3015 return err;
3016}
3017
04124681
GP		 3018static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3019 u16 len)
17fa4b9d 3020{
650f726d 3021 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3022
3023 BT_DBG("");
3024
4ec86d4c 3025 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3026 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3027 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3028
09fd0de5 3029 hci_dev_lock(hdev);
17fa4b9d
JH		 3030
3031 hdev->io_capability = cp->io_capability;
3032
3033 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3034 hdev->io_capability);
17fa4b9d 3035
09fd0de5 3036 hci_dev_unlock(hdev);
17fa4b9d 3037
2a1afb5a
JH		 3038 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3039 NULL, 0);
17fa4b9d
JH		 3040}
3041
3b0602cd 3042static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3043{
3044 struct hci_dev *hdev = conn->hdev;
3b0602cd 3045 struct mgmt_pending_cmd *cmd;
e9a416b5 3046
2e58ef3e 3047 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3048 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3049 continue;
3050
e9a416b5
JH		 3051 if (cmd->user_data != conn)
3052 continue;
3053
3054 return cmd;
3055 }
3056
3057 return NULL;
3058}
3059
3b0602cd 3060static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3061{
3062 struct mgmt_rp_pair_device rp;
3063 struct hci_conn *conn = cmd->user_data;
9df74653 3064 int err;
e9a416b5 3065
61b1a7fb
JH		 3066 bacpy(&rp.addr.bdaddr, &conn->dst);
3067 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3068
2a1afb5a
JH		 3069 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3070 status, &rp, sizeof(rp));
e9a416b5
JH		 3071
3072 /* So we don't get further callbacks for this connection */
3073 conn->connect_cfm_cb = NULL;
3074 conn->security_cfm_cb = NULL;
3075 conn->disconn_cfm_cb = NULL;
3076
76a68ba0 3077 hci_conn_drop(conn);
89cbb063
AA		 3078
3079 /* The device is paired so there is no need to remove
3080 * its connection parameters anymore.
3081 */
3082 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3083
3084 hci_conn_put(conn);
9df74653
JH		 3085
3086 return err;
e9a416b5
JH		 3087}
3088
f4a407be
JH		 3089void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3090{
3091 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3092 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3093
3094 cmd = find_pairing(conn);
a511b35b 3095 if (cmd) {
04ab2749 3096 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3097 mgmt_pending_remove(cmd);
3098 }
f4a407be
JH		 3099}
3100
e9a416b5
JH		 3101static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3102{
3b0602cd 3103 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3104
3105 BT_DBG("status %u", status);
3106
3107 cmd = find_pairing(conn);
a511b35b 3108 if (!cmd) {
e9a416b5 3109 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3110 return;
3111 }
3112
3113 cmd->cmd_complete(cmd, mgmt_status(status));
3114 mgmt_pending_remove(cmd);
e9a416b5
JH		 3115}
3116
f4a407be 3117static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3118{
3b0602cd 3119 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3120
3121 BT_DBG("status %u", status);
3122
3123 if (!status)
3124 return;
3125
3126 cmd = find_pairing(conn);
a511b35b 3127 if (!cmd) {
4c47d739 3128 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3129 return;
3130 }
3131
3132 cmd->cmd_complete(cmd, mgmt_status(status));
3133 mgmt_pending_remove(cmd);
4c47d739
VA		 3134}
3135
bdb6d971 3136static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3137 u16 len)
e9a416b5 3138{
650f726d 3139 struct mgmt_cp_pair_device *cp = data;
1425acb7 3140 struct mgmt_rp_pair_device rp;
3b0602cd 3141 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3142 u8 sec_level, auth_type;
3143 struct hci_conn *conn;
e9a416b5
JH		 3144 int err;
3145
3146 BT_DBG("");
3147
f950a30e
SJ		 3148 memset(&rp, 0, sizeof(rp));
3149 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3150 rp.addr.type = cp->addr.type;
3151
4ee71b20 3152 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3153 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3154 MGMT_STATUS_INVALID_PARAMS,
3155 &rp, sizeof(rp));
4ee71b20 3156
4ec86d4c 3157 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3158 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3159 MGMT_STATUS_INVALID_PARAMS,
3160 &rp, sizeof(rp));
4ec86d4c 3161
09fd0de5 3162 hci_dev_lock(hdev);
e9a416b5 3163
5f97c1df 3164 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3165 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3166 MGMT_STATUS_NOT_POWERED, &rp,
3167 sizeof(rp));
5f97c1df
JH		 3168 goto unlock;
3169 }
3170
55e76b38
JH		 3171 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3172 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3173 MGMT_STATUS_ALREADY_PAIRED, &rp,
3174 sizeof(rp));
3175 goto unlock;
3176 }
3177
c908df36 3178 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3179 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3180
6f77d8c7 3181 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3182 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3183 auth_type);
6f77d8c7
AG		 3184 } else {
3185 u8 addr_type;
3186
3187 /* Convert from L2CAP channel address type to HCI address type
3188 */
3189 if (cp->addr.type == BDADDR_LE_PUBLIC)
3190 addr_type = ADDR_LE_DEV_PUBLIC;
3191 else
3192 addr_type = ADDR_LE_DEV_RANDOM;
3193
7c264b10
MH		 3194 /* When pairing a new device, it is expected to remember
3195 * this device for future connections. Adding the connection
3196 * parameter information ahead of time allows tracking
3197 * of the slave preferred values and will speed up any
3198 * further connection establishment.
3199 *
3200 * If connection parameters already exist, then they
3201 * will be kept and this function does nothing.
3202 */
3203 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3204
6f77d8c7 3205 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3206 sec_level, HCI_LE_CONN_TIMEOUT,
3207 HCI_ROLE_MASTER);
6f77d8c7 3208 }
7a512d01 3209
30e76272 3210 if (IS_ERR(conn)) {
489dc48e
AK		 3211 int status;
3212
3213 if (PTR_ERR(conn) == -EBUSY)
3214 status = MGMT_STATUS_BUSY;
faa81030
LR		 3215 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3216 status = MGMT_STATUS_NOT_SUPPORTED;
3217 else if (PTR_ERR(conn) == -ECONNREFUSED)
3218 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3219 else
3220 status = MGMT_STATUS_CONNECT_FAILED;
3221
2a1afb5a
JH		 3222 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3223 status, &rp, sizeof(rp));
e9a416b5
JH		 3224 goto unlock;
3225 }
3226
3227 if (conn->connect_cfm_cb) {
76a68ba0 3228 hci_conn_drop(conn);
2a1afb5a
JH		 3229 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3230 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3231 goto unlock;
3232 }
3233
2e58ef3e 3234 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3235 if (!cmd) {
3236 err = -ENOMEM;
76a68ba0 3237 hci_conn_drop(conn);
e9a416b5
JH		 3238 goto unlock;
3239 }
3240
04ab2749
JH		 3241 cmd->cmd_complete = pairing_complete;
3242
7a512d01 3243 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3244 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3245 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3246 conn->security_cfm_cb = pairing_complete_cb;
3247 conn->disconn_cfm_cb = pairing_complete_cb;
3248 } else {
3249 conn->connect_cfm_cb = le_pairing_complete_cb;
3250 conn->security_cfm_cb = le_pairing_complete_cb;
3251 conn->disconn_cfm_cb = le_pairing_complete_cb;
3252 }
7a512d01 3253
e9a416b5 3254 conn->io_capability = cp->io_cap;
f8aaf9b6 3255 cmd->user_data = hci_conn_get(conn);
e9a416b5 3256
6f78fd4b 3257 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3258 hci_conn_security(conn, sec_level, auth_type, true)) {
3259 cmd->cmd_complete(cmd, 0);
3260 mgmt_pending_remove(cmd);
3261 }
e9a416b5
JH		 3262
3263 err = 0;
3264
3265unlock:
09fd0de5 3266 hci_dev_unlock(hdev);
e9a416b5
JH		 3267 return err;
3268}
3269
04124681
GP		 3270static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3271 u16 len)
28424707 3272{
0f4e68cf 3273 struct mgmt_addr_info *addr = data;
3b0602cd 3274 struct mgmt_pending_cmd *cmd;
28424707
JH		 3275 struct hci_conn *conn;
3276 int err;
3277
3278 BT_DBG("");
3279
28424707
JH		 3280 hci_dev_lock(hdev);
3281
5f97c1df 3282 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3283 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3284 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3285 goto unlock;
3286 }
3287
333ae95d 3288 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3289 if (!cmd) {
a69e8375
JH		 3290 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3291 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3292 goto unlock;
3293 }
3294
3295 conn = cmd->user_data;
3296
3297 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3298 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3299 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3300 goto unlock;
3301 }
3302
a511b35b
JH		 3303 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3304 mgmt_pending_remove(cmd);
28424707 3305
2a1afb5a
JH		 3306 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3307 addr, sizeof(*addr));
28424707
JH		 3308unlock:
3309 hci_dev_unlock(hdev);
28424707
JH		 3310 return err;
3311}
3312
bdb6d971 3313static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3314 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3315 u16 hci_op, __le32 passkey)
a5c29683 3316{
3b0602cd 3317 struct mgmt_pending_cmd *cmd;
0df4c185 3318 struct hci_conn *conn;
a5c29683
JH		 3319 int err;
3320
09fd0de5 3321 hci_dev_lock(hdev);
08ba5382 3322
4b34ee78 3323 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3324 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3325 MGMT_STATUS_NOT_POWERED, addr,
3326 sizeof(*addr));
0df4c185 3327 goto done;
a5c29683
JH		 3328 }
3329
1707c60e
JH		 3330 if (addr->type == BDADDR_BREDR)
3331 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3332 else
1707c60e 3333 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3334
3335 if (!conn) {
2a1afb5a
JH		 3336 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3337 MGMT_STATUS_NOT_CONNECTED, addr,
3338 sizeof(*addr));
272d90df
JH		 3339 goto done;
3340 }
47c15e2b 3341
1707c60e 3342 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3343 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3344 if (!err)
2a1afb5a
JH		 3345 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3346 MGMT_STATUS_SUCCESS, addr,
3347 sizeof(*addr));
5fe57d9e 3348 else
2a1afb5a
JH		 3349 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3350 MGMT_STATUS_FAILED, addr,
3351 sizeof(*addr));
47c15e2b 3352
47c15e2b
BG		 3353 goto done;
3354 }
3355
1707c60e 3356 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3357 if (!cmd) {
3358 err = -ENOMEM;
0df4c185 3359 goto done;
a5c29683
JH		 3360 }
3361
7776d1d8
JH		 3362 cmd->cmd_complete = addr_cmd_complete;
3363
0df4c185 3364 /* Continue with pairing via HCI */
604086b7
BG		 3365 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3366 struct hci_cp_user_passkey_reply cp;
3367
1707c60e 3368 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3369 cp.passkey = passkey;
3370 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3371 } else
1707c60e
JH		 3372 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3373 &addr->bdaddr);
604086b7 3374
a664b5bc
JH		 3375 if (err < 0)
3376 mgmt_pending_remove(cmd);
a5c29683 3377
0df4c185 3378done:
09fd0de5 3379 hci_dev_unlock(hdev);
a5c29683
JH		 3380 return err;
3381}
3382
afeb019d
JK		 3383static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3384 void *data, u16 len)
3385{
3386 struct mgmt_cp_pin_code_neg_reply *cp = data;
3387
3388 BT_DBG("");
3389
1707c60e 3390 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3391 MGMT_OP_PIN_CODE_NEG_REPLY,
3392 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3393}
3394
04124681
GP		 3395static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3396 u16 len)
0df4c185 3397{
650f726d 3398 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3399
3400 BT_DBG("");
3401
3402 if (len != sizeof(*cp))
a69e8375
JH		 3403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3404 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3405
1707c60e 3406 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3407 MGMT_OP_USER_CONFIRM_REPLY,
3408 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3409}
3410
bdb6d971 3411static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3412 void *data, u16 len)
0df4c185 3413{
c9c2659f 3414 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3415
3416 BT_DBG("");
3417
1707c60e 3418 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3419 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3420 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3421}
3422
04124681
GP		 3423static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3424 u16 len)
604086b7 3425{
650f726d 3426 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3427
3428 BT_DBG("");
3429
1707c60e 3430 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3431 MGMT_OP_USER_PASSKEY_REPLY,
3432 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3433}
3434
bdb6d971 3435static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3436 void *data, u16 len)
604086b7 3437{
650f726d 3438 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3439
3440 BT_DBG("");
3441
1707c60e 3442 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3443 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3444 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3445}
3446
13928971 3447static void update_name(struct hci_request *req)
2b4bf397 3448{
13928971 3449 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3450 struct hci_cp_write_local_name cp;
3451
13928971 3452 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3453
890ea898 3454 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3455}
3456
1904a853 3457static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3458{
3459 struct mgmt_cp_set_local_name *cp;
3b0602cd 3460 struct mgmt_pending_cmd *cmd;
13928971
JH		 3461
3462 BT_DBG("status 0x%02x", status);
3463
3464 hci_dev_lock(hdev);
3465
333ae95d 3466 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3467 if (!cmd)
3468 goto unlock;
3469
3470 cp = cmd->param;
3471
3472 if (status)
a69e8375
JH		 3473 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3474 mgmt_status(status));
13928971 3475 else
2a1afb5a
JH		 3476 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3477 cp, sizeof(*cp));
13928971
JH		 3478
3479 mgmt_pending_remove(cmd);
3480
3481unlock:
3482 hci_dev_unlock(hdev);
3483}
3484
bdb6d971 3485static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3486 u16 len)
b312b161 3487{
2b4bf397 3488 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3489 struct mgmt_pending_cmd *cmd;
890ea898 3490 struct hci_request req;
b312b161
JH		 3491 int err;
3492
3493 BT_DBG("");
3494
09fd0de5 3495 hci_dev_lock(hdev);
b312b161 3496
b3f2ca94
JH		 3497 /* If the old values are the same as the new ones just return a
3498 * direct command complete event.
3499 */
3500 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3501 !memcmp(hdev->short_name, cp->short_name,
3502 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3503 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3504 data, len);
b3f2ca94
JH		 3505 goto failed;
3506 }
3507
2b4bf397 3508 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3509
b5235a65 3510 if (!hdev_is_powered(hdev)) {
2b4bf397 3511 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3512
2a1afb5a
JH		 3513 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3514 data, len);
28cc7bde
JH		 3515 if (err < 0)
3516 goto failed;
3517
f6b7712e
MH		 3518 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3519 data, len, sk);
28cc7bde 3520
b5235a65
JH		 3521 goto failed;
3522 }
3523
28cc7bde 3524 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3525 if (!cmd) {
3526 err = -ENOMEM;
3527 goto failed;
3528 }
3529
13928971
JH		 3530 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3531
890ea898 3532 hci_req_init(&req, hdev);
3f985050
JH		 3533
3534 if (lmp_bredr_capable(hdev)) {
3535 update_name(&req);
3536 update_eir(&req);
3537 }
3538
7a5f4990
MH		 3539 /* The name is stored in the scan response data and so
3540 * no need to udpate the advertising data here.
3541 */
3f985050 3542 if (lmp_le_capable(hdev))
7a5f4990 3543 update_scan_rsp_data(&req);
3f985050 3544
13928971 3545 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3546 if (err < 0)
3547 mgmt_pending_remove(cmd);
3548
3549failed:
09fd0de5 3550 hci_dev_unlock(hdev);
b312b161
JH		 3551 return err;
3552}
3553
0f4e68cf 3554static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3555 void *data, u16 data_len)
c35938b2 3556{
3b0602cd 3557 struct mgmt_pending_cmd *cmd;
c35938b2
SJ		 3558 int err;
3559
bdb6d971 3560 BT_DBG("%s", hdev->name);
c35938b2 3561
09fd0de5 3562 hci_dev_lock(hdev);
c35938b2 3563
4b34ee78 3564 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3565 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3566 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3567 goto unlock;
3568 }
3569
9a1a1996 3570 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3571 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3572 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3573 goto unlock;
3574 }
3575
333ae95d 3576 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 3577 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3578 MGMT_STATUS_BUSY);
c35938b2
SJ		 3579 goto unlock;
3580 }
3581
2e58ef3e 3582 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3583 if (!cmd) {
3584 err = -ENOMEM;
3585 goto unlock;
3586 }
3587
710f11c0 3588 if (bredr_sc_enabled(hdev))
4d2d2796
MH		 3589 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3590 0, NULL);
3591 else
3592 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3593
c35938b2
SJ		 3594 if (err < 0)
3595 mgmt_pending_remove(cmd);
3596
3597unlock:
09fd0de5 3598 hci_dev_unlock(hdev);
c35938b2
SJ		 3599 return err;
3600}
3601
bdb6d971 3602static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3603 void *data, u16 len)
2763eda6 3604{
5d57e796 3605 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3606 int err;
3607
bdb6d971 3608 BT_DBG("%s ", hdev->name);
2763eda6 3609
5d57e796 3610 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 3611 return mgmt_cmd_complete(sk, hdev->id,
3612 MGMT_OP_ADD_REMOTE_OOB_DATA,
3613 MGMT_STATUS_INVALID_PARAMS,
3614 addr, sizeof(*addr));
5d57e796 3615
09fd0de5 3616 hci_dev_lock(hdev);
2763eda6 3617
ec109113
MH		 3618 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3619 struct mgmt_cp_add_remote_oob_data *cp = data;
3620 u8 status;
bf1e3541 3621
c19a495c 3622 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 3623 err = mgmt_cmd_complete(sk, hdev->id,
3624 MGMT_OP_ADD_REMOTE_OOB_DATA,
3625 MGMT_STATUS_INVALID_PARAMS,
3626 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 3627 goto unlock;
3628 }
3629
ec109113 3630 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 3631 cp->addr.type, cp->hash,
3632 cp->rand, NULL, NULL);
ec109113
MH		 3633 if (err < 0)
3634 status = MGMT_STATUS_FAILED;
3635 else
3636 status = MGMT_STATUS_SUCCESS;
3637
2a1afb5a
JH		 3638 err = mgmt_cmd_complete(sk, hdev->id,
3639 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
3640 &cp->addr, sizeof(cp->addr));
ec109113
MH		 3641 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3642 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 3643 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 3644 u8 status;
3645
86df9200 3646 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 3647 /* Enforce zero-valued 192-bit parameters as
3648 * long as legacy SMP OOB isn't implemented.
3649 */
3650 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3651 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 3652 err = mgmt_cmd_complete(sk, hdev->id,
3653 MGMT_OP_ADD_REMOTE_OOB_DATA,
3654 MGMT_STATUS_INVALID_PARAMS,
3655 addr, sizeof(*addr));
d25b78e2
JH		 3656 goto unlock;
3657 }
3658
86df9200
JH		 3659 rand192 = NULL;
3660 hash192 = NULL;
3661 } else {
41bcfd50
MH		 3662 /* In case one of the P-192 values is set to zero,
3663 * then just disable OOB data for P-192.
3664 */
3665 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3666 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3667 rand192 = NULL;
3668 hash192 = NULL;
3669 } else {
3670 rand192 = cp->rand192;
3671 hash192 = cp->hash192;
3672 }
3673 }
3674
3675 /* In case one of the P-256 values is set to zero, then just
3676 * disable OOB data for P-256.
3677 */
3678 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3679 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3680 rand256 = NULL;
3681 hash256 = NULL;
3682 } else {
3683 rand256 = cp->rand256;
3684 hash256 = cp->hash256;
86df9200
JH		 3685 }
3686
81328d5c 3687 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 3688 cp->addr.type, hash192, rand192,
41bcfd50 3689 hash256, rand256);
ec109113
MH		 3690 if (err < 0)
3691 status = MGMT_STATUS_FAILED;
3692 else
3693 status = MGMT_STATUS_SUCCESS;
3694
2a1afb5a
JH		 3695 err = mgmt_cmd_complete(sk, hdev->id,
3696 MGMT_OP_ADD_REMOTE_OOB_DATA,
3697 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 3698 } else {
3699 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 3700 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3701 MGMT_STATUS_INVALID_PARAMS);
ec109113 3702 }
2763eda6 3703
c19a495c 3704unlock:
09fd0de5 3705 hci_dev_unlock(hdev);
2763eda6
SJ		 3706 return err;
3707}
3708
bdb6d971 3709static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3710 void *data, u16 len)
2763eda6 3711{
650f726d 3712 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3713 u8 status;
2763eda6
SJ		 3714 int err;
3715
bdb6d971 3716 BT_DBG("%s", hdev->name);
2763eda6 3717
c19a495c 3718 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 3719 return mgmt_cmd_complete(sk, hdev->id,
3720 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3721 MGMT_STATUS_INVALID_PARAMS,
3722 &cp->addr, sizeof(cp->addr));
c19a495c 3723
09fd0de5 3724 hci_dev_lock(hdev);
2763eda6 3725
eedbd581
JH		 3726 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3727 hci_remote_oob_data_clear(hdev);
3728 status = MGMT_STATUS_SUCCESS;
3729 goto done;
3730 }
3731
6928a924 3732 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 3733 if (err < 0)
bf1e3541 3734 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3735 else
a6785be2 3736 status = MGMT_STATUS_SUCCESS;
bf1e3541 3737
eedbd581 3738done:
2a1afb5a
JH		 3739 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3740 status, &cp->addr, sizeof(cp->addr));
2763eda6 3741
09fd0de5 3742 hci_dev_unlock(hdev);
2763eda6
SJ		 3743 return err;
3744}
3745
812abb13 3746static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 3747{
8019044d 3748 struct hci_dev *hdev = req->hdev;
812abb13 3749 struct hci_cp_inquiry cp;
8019044d
MH		 3750 /* General inquiry access code (GIAC) */
3751 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 3752
3753 *status = mgmt_bredr_support(hdev);
3754 if (*status)
3755 return false;
3756
3757 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
3758 *status = MGMT_STATUS_BUSY;
3759 return false;
3760 }
3761
3762 hci_inquiry_cache_flush(hdev);
3763
3764 memset(&cp, 0, sizeof(cp));
3765 memcpy(&cp.lap, lap, sizeof(cp.lap));
3766 cp.length = DISCOV_BREDR_INQUIRY_LEN;
3767
3768 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3769
3770 return true;
3771}
3772
3773static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
3774{
3775 struct hci_dev *hdev = req->hdev;
3776 struct hci_cp_le_set_scan_param param_cp;
3777 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 3778 u8 own_addr_type;
41dc2bd6
AG		 3779 int err;
3780
812abb13
JP		 3781 *status = mgmt_le_support(hdev);
3782 if (*status)
3783 return false;
41dc2bd6 3784
812abb13
JP		 3785 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
3786 /* Don't let discovery abort an outgoing connection attempt
3787 * that's using directed advertising.
3788 */
3789 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3790 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 3791 return false;
3792 }
41dc2bd6 3793
812abb13
JP		 3794 disable_advertising(req);
3795 }
41dc2bd6 3796
812abb13
JP		 3797 /* If controller is scanning, it means the background scanning is
3798 * running. Thus, we should temporarily stop it in order to set the
3799 * discovery scanning parameters.
3800 */
3801 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
3802 hci_req_add_le_scan_disable(req);
41dc2bd6 3803
812abb13
JP		 3804 /* All active scans will be done with either a resolvable private
3805 * address (when privacy feature has been enabled) or non-resolvable
3806 * private address.
3807 */
3808 err = hci_update_random_address(req, true, &own_addr_type);
3809 if (err < 0) {
3810 *status = MGMT_STATUS_FAILED;
3811 return false;
3812 }
8019044d 3813
812abb13
JP		 3814 memset(&param_cp, 0, sizeof(param_cp));
3815 param_cp.type = LE_SCAN_ACTIVE;
3816 param_cp.interval = cpu_to_le16(interval);
3817 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3818 param_cp.own_address_type = own_addr_type;
8019044d 3819
812abb13
JP		 3820 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3821 &param_cp);
8019044d 3822
812abb13
JP		 3823 memset(&enable_cp, 0, sizeof(enable_cp));
3824 enable_cp.enable = LE_SCAN_ENABLE;
3825 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 3826
812abb13
JP		 3827 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3828 &enable_cp);
3829
3830 return true;
3831}
8019044d 3832
812abb13
JP		 3833static bool trigger_discovery(struct hci_request *req, u8 *status)
3834{
3835 struct hci_dev *hdev = req->hdev;
8019044d 3836
812abb13
JP		 3837 switch (hdev->discovery.type) {
3838 case DISCOV_TYPE_BREDR:
3839 if (!trigger_bredr_inquiry(req, status))
3840 return false;
3841 break;
3842
3843 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 3844 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
3845 &hdev->quirks)) {
3846 /* During simultaneous discovery, we double LE scan
3847 * interval. We must leave some time for the controller
3848 * to do BR/EDR inquiry.
3849 */
3850 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
3851 status))
3852 return false;
3853
3854 if (!trigger_bredr_inquiry(req, status))
3855 return false;
3856
3857 return true;
3858 }
3859
812abb13
JP		 3860 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
3861 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 3862 return false;
3863 }
812abb13 3864 /* fall through */
8019044d 3865
812abb13
JP		 3866 case DISCOV_TYPE_LE:
3867 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
3868 return false;
8019044d
MH		 3869 break;
3870
3871 default:
3872 *status = MGMT_STATUS_INVALID_PARAMS;
3873 return false;
3874 }
3875
3876 return true;
41dc2bd6
AG		 3877}
3878
1904a853
MH		 3879static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3880 u16 opcode)
7c307720 3881{
3b0602cd 3882 struct mgmt_pending_cmd *cmd;
11e6e25d 3883 unsigned long timeout;
ae55f598 3884
7c307720
AG		 3885 BT_DBG("status %d", status);
3886
11e6e25d 3887 hci_dev_lock(hdev);
41dc2bd6 3888
333ae95d 3889 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 3890 if (!cmd)
333ae95d 3891 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 3892
11e6e25d 3893 if (cmd) {
2922a94f 3894 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 3895 mgmt_pending_remove(cmd);
3896 }
7c307720
AG		 3897
3898 if (status) {
11e6e25d
MH		 3899 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3900 goto unlock;
7c307720
AG		 3901 }
3902
7c307720 3903 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 3904
2d28cfe7
JP		 3905 /* If the scan involves LE scan, pick proper timeout to schedule
3906 * hdev->le_scan_disable that will stop it.
3907 */
7c307720
AG		 3908 switch (hdev->discovery.type) {
3909 case DISCOV_TYPE_LE:
3d5a76f0 3910 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 3911 break;
7c307720 3912 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 3913 /* When running simultaneous discovery, the LE scanning time
3914 * should occupy the whole discovery time sine BR/EDR inquiry
3915 * and LE scanning are scheduled by the controller.
3916 *
3917 * For interleaving discovery in comparison, BR/EDR inquiry
3918 * and LE scanning are done sequentially with separate
3919 * timeouts.
3920 */
3921 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3922 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3923 else
3924 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 3925 break;
7c307720 3926 case DISCOV_TYPE_BREDR:
11e6e25d 3927 timeout = 0;
7c307720 3928 break;
7c307720
AG		 3929 default:
3930 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 3931 timeout = 0;
3932 break;
7c307720 3933 }
ae55f598 3934
2d28cfe7
JP		 3935 if (timeout) {
3936 /* When service discovery is used and the controller has
3937 * a strict duplicate filter, it is important to remember
3938 * the start and duration of the scan. This is required
3939 * for restarting scanning during the discovery phase.
3940 */
3941 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
3942 &hdev->quirks) &&
82f8b651 3943 hdev->discovery.result_filtering) {
2d28cfe7
JP		 3944 hdev->discovery.scan_start = jiffies;
3945 hdev->discovery.scan_duration = timeout;
3946 }
3947
11e6e25d
MH		 3948 queue_delayed_work(hdev->workqueue,
3949 &hdev->le_scan_disable, timeout);
2d28cfe7 3950 }
ae55f598 3951
11e6e25d
MH		 3952unlock:
3953 hci_dev_unlock(hdev);
7c307720
AG		 3954}
3955
bdb6d971 3956static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 3957 void *data, u16 len)
14a53664 3958{
650f726d 3959 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 3960 struct mgmt_pending_cmd *cmd;
7c307720 3961 struct hci_request req;
8019044d 3962 u8 status;
14a53664
JH		 3963 int err;
3964
bdb6d971 3965 BT_DBG("%s", hdev->name);
14a53664 3966
09fd0de5 3967 hci_dev_lock(hdev);
14a53664 3968
4b34ee78 3969 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3970 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3971 MGMT_STATUS_NOT_POWERED,
3972 &cp->type, sizeof(cp->type));
bd2d1334
JH		 3973 goto failed;
3974 }
3975
f5a969f2 3976 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 3977 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 3978 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3979 MGMT_STATUS_BUSY, &cp->type,
3980 sizeof(cp->type));
642be6c7
AG		 3981 goto failed;
3982 }
3983
2922a94f 3984 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 3985 if (!cmd) {
3986 err = -ENOMEM;
3987 goto failed;
3988 }
3989
2922a94f
JH		 3990 cmd->cmd_complete = generic_cmd_complete;
3991
22078800
MH		 3992 /* Clear the discovery filter first to free any previously
3993 * allocated memory for the UUID list.
3994 */
3995 hci_discovery_filter_clear(hdev);
3996
4aab14e5 3997 hdev->discovery.type = cp->type;
da25cf6a 3998 hdev->discovery.report_invalid_rssi = false;
4aab14e5 3999
7c307720
AG		 4000 hci_req_init(&req, hdev);
4001
8019044d 4002 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4003 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4004 status, &cp->type, sizeof(cp->type));
04106755
JH		 4005 mgmt_pending_remove(cmd);
4006 goto failed;
f39799f5 4007 }
04106755 4008
7c307720 4009 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4010 if (err < 0) {
14a53664 4011 mgmt_pending_remove(cmd);
f5a969f2
MH		 4012 goto failed;
4013 }
7c307720 4014
f5a969f2 4015 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4016
14a53664 4017failed:
09fd0de5 4018 hci_dev_unlock(hdev);
14a53664
JH		 4019 return err;
4020}
f39799f5 4021
3b0602cd
JH		 4022static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4023 u8 status)
2922a94f 4024{
2a1afb5a
JH		 4025 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4026 cmd->param, 1);
2922a94f 4027}
04106755 4028
66ea9427
JP		 4029static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4030 void *data, u16 len)
4031{
4032 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4033 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4034 struct hci_request req;
4035 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4036 u16 uuid_count, expected_len;
4037 u8 status;
4038 int err;
04106755 4039
66ea9427 4040 BT_DBG("%s", hdev->name);
e8bb6b97 4041
66ea9427 4042 hci_dev_lock(hdev);
7c307720 4043
66ea9427 4044 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4045 err = mgmt_cmd_complete(sk, hdev->id,
4046 MGMT_OP_START_SERVICE_DISCOVERY,
4047 MGMT_STATUS_NOT_POWERED,
4048 &cp->type, sizeof(cp->type));
66ea9427
JP		 4049 goto failed;
4050 }
7c307720 4051
66ea9427 4052 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4053 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4054 err = mgmt_cmd_complete(sk, hdev->id,
4055 MGMT_OP_START_SERVICE_DISCOVERY,
4056 MGMT_STATUS_BUSY, &cp->type,
4057 sizeof(cp->type));
66ea9427
JP		 4058 goto failed;
4059 }
d9483943 4060
66ea9427
JP		 4061 uuid_count = __le16_to_cpu(cp->uuid_count);
4062 if (uuid_count > max_uuid_count) {
4063 BT_ERR("service_discovery: too big uuid_count value %u",
4064 uuid_count);
2a1afb5a
JH		 4065 err = mgmt_cmd_complete(sk, hdev->id,
4066 MGMT_OP_START_SERVICE_DISCOVERY,
4067 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4068 sizeof(cp->type));
66ea9427
JP		 4069 goto failed;
4070 }
4071
4072 expected_len = sizeof(*cp) + uuid_count * 16;
4073 if (expected_len != len) {
4074 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4075 expected_len, len);
2a1afb5a
JH		 4076 err = mgmt_cmd_complete(sk, hdev->id,
4077 MGMT_OP_START_SERVICE_DISCOVERY,
4078 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4079 sizeof(cp->type));
66ea9427
JP		 4080 goto failed;
4081 }
4082
4083 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4084 hdev, data, len);
66ea9427
JP		 4085 if (!cmd) {
4086 err = -ENOMEM;
4087 goto failed;
4088 }
4089
2922a94f
JH		 4090 cmd->cmd_complete = service_discovery_cmd_complete;
4091
22078800
MH		 4092 /* Clear the discovery filter first to free any previously
4093 * allocated memory for the UUID list.
4094 */
4095 hci_discovery_filter_clear(hdev);
4096
82f8b651 4097 hdev->discovery.result_filtering = true;
66ea9427
JP		 4098 hdev->discovery.type = cp->type;
4099 hdev->discovery.rssi = cp->rssi;
4100 hdev->discovery.uuid_count = uuid_count;
4101
4102 if (uuid_count > 0) {
4103 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4104 GFP_KERNEL);
4105 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4106 err = mgmt_cmd_complete(sk, hdev->id,
4107 MGMT_OP_START_SERVICE_DISCOVERY,
4108 MGMT_STATUS_FAILED,
4109 &cp->type, sizeof(cp->type));
d9483943
JH		 4110 mgmt_pending_remove(cmd);
4111 goto failed;
4112 }
66ea9427 4113 }
d9483943 4114
66ea9427 4115 hci_req_init(&req, hdev);
5e0452c0 4116
66ea9427 4117 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4118 err = mgmt_cmd_complete(sk, hdev->id,
4119 MGMT_OP_START_SERVICE_DISCOVERY,
4120 status, &cp->type, sizeof(cp->type));
04106755
JH		 4121 mgmt_pending_remove(cmd);
4122 goto failed;
f39799f5 4123 }
3fd24153 4124
7c307720 4125 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4126 if (err < 0) {
14a53664 4127 mgmt_pending_remove(cmd);
66ea9427
JP		 4128 goto failed;
4129 }
4130
4131 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4132
4133failed:
09fd0de5 4134 hci_dev_unlock(hdev);
14a53664
JH		 4135 return err;
4136}
4137
1904a853 4138static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4139{
3b0602cd 4140 struct mgmt_pending_cmd *cmd;
1183fdca 4141
0e05bba6
AG		 4142 BT_DBG("status %d", status);
4143
4144 hci_dev_lock(hdev);
4145
333ae95d 4146 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4147 if (cmd) {
2922a94f 4148 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4149 mgmt_pending_remove(cmd);
0e05bba6
AG		 4150 }
4151
11e6e25d
MH		 4152 if (!status)
4153 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4154
0e05bba6
AG		 4155 hci_dev_unlock(hdev);
4156}
4157
bdb6d971 4158static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4159 u16 len)
14a53664 4160{
d930650b 4161 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4162 struct mgmt_pending_cmd *cmd;
0e05bba6 4163 struct hci_request req;
14a53664
JH		 4164 int err;
4165
bdb6d971 4166 BT_DBG("%s", hdev->name);
14a53664 4167
09fd0de5 4168 hci_dev_lock(hdev);
14a53664 4169
30dc78e1 4170 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4171 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4172 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4173 sizeof(mgmt_cp->type));
d930650b
JH		 4174 goto unlock;
4175 }
4176
4177 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4178 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4179 MGMT_STATUS_INVALID_PARAMS,
4180 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4181 goto unlock;
ff9ef578
JH		 4182 }
4183
2922a94f 4184 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4185 if (!cmd) {
4186 err = -ENOMEM;
30dc78e1
JH		 4187 goto unlock;
4188 }
4189
2922a94f
JH		 4190 cmd->cmd_complete = generic_cmd_complete;
4191
0e05bba6
AG		 4192 hci_req_init(&req, hdev);
4193
21a60d30 4194 hci_stop_discovery(&req);
e0d9727e 4195
21a60d30
JH		 4196 err = hci_req_run(&req, stop_discovery_complete);
4197 if (!err) {
4198 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4199 goto unlock;
14a53664
JH		 4200 }
4201
21a60d30
JH		 4202 mgmt_pending_remove(cmd);
4203
4204 /* If no HCI commands were sent we're done */
4205 if (err == -ENODATA) {
2a1afb5a
JH		 4206 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4207 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4208 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4209 }
14a53664 4210
30dc78e1 4211unlock:
09fd0de5 4212 hci_dev_unlock(hdev);
14a53664
JH		 4213 return err;
4214}
4215
bdb6d971 4216static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4217 u16 len)
561aafbc 4218{
650f726d 4219 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4220 struct inquiry_entry *e;
561aafbc
JH		 4221 int err;
4222
bdb6d971 4223 BT_DBG("%s", hdev->name);
561aafbc 4224
561aafbc
JH		 4225 hci_dev_lock(hdev);
4226
30dc78e1 4227 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4228 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4229 MGMT_STATUS_FAILED, &cp->addr,
4230 sizeof(cp->addr));
30dc78e1
JH		 4231 goto failed;
4232 }
4233
a198e7b1 4234 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4235 if (!e) {
2a1afb5a
JH		 4236 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4237 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4238 sizeof(cp->addr));
561aafbc
JH		 4239 goto failed;
4240 }
4241
4242 if (cp->name_known) {
4243 e->name_state = NAME_KNOWN;
4244 list_del(&e->list);
4245 } else {
4246 e->name_state = NAME_NEEDED;
a3d4e20a 4247 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4248 }
4249
2a1afb5a
JH		 4250 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4251 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4252
4253failed:
4254 hci_dev_unlock(hdev);
561aafbc
JH		 4255 return err;
4256}
4257
bdb6d971 4258static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4259 u16 len)
7fbec224 4260{
650f726d 4261 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4262 u8 status;
7fbec224
AJ		 4263 int err;
4264
bdb6d971 4265 BT_DBG("%s", hdev->name);
7fbec224 4266
4ee71b20 4267 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4268 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4269 MGMT_STATUS_INVALID_PARAMS,
4270 &cp->addr, sizeof(cp->addr));
4ee71b20 4271
09fd0de5 4272 hci_dev_lock(hdev);
5e762444 4273
dcc36c16
JH		 4274 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4275 cp->addr.type);
2a8357f2 4276 if (err < 0) {
f0eeea8b 4277 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4278 goto done;
4279 }
4280
4281 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4282 sk);
4283 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4284
2a8357f2 4285done:
2a1afb5a
JH		 4286 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4287 &cp->addr, sizeof(cp->addr));
5e762444 4288
09fd0de5 4289 hci_dev_unlock(hdev);
7fbec224
AJ		 4290
4291 return err;
4292}
4293
bdb6d971 4294static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4295 u16 len)
7fbec224 4296{
650f726d 4297 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4298 u8 status;
7fbec224
AJ		 4299 int err;
4300
bdb6d971 4301 BT_DBG("%s", hdev->name);
7fbec224 4302
4ee71b20 4303 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4304 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4305 MGMT_STATUS_INVALID_PARAMS,
4306 &cp->addr, sizeof(cp->addr));
4ee71b20 4307
09fd0de5 4308 hci_dev_lock(hdev);
5e762444 4309
dcc36c16
JH		 4310 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4311 cp->addr.type);
2a8357f2 4312 if (err < 0) {
f0eeea8b 4313 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4314 goto done;
4315 }
4316
4317 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4318 sk);
4319 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4320
2a8357f2 4321done:
2a1afb5a
JH		 4322 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4323 &cp->addr, sizeof(cp->addr));
5e762444 4324
09fd0de5 4325 hci_dev_unlock(hdev);
7fbec224
AJ		 4326
4327 return err;
4328}
4329
cdbaccca
MH		 4330static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4331 u16 len)
4332{
4333 struct mgmt_cp_set_device_id *cp = data;
890ea898 4334 struct hci_request req;
cdbaccca 4335 int err;
c72d4b8a 4336 __u16 source;
cdbaccca
MH		 4337
4338 BT_DBG("%s", hdev->name);
4339
c72d4b8a
SJ		 4340 source = __le16_to_cpu(cp->source);
4341
4342 if (source > 0x0002)
a69e8375
JH		 4343 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4344 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4345
cdbaccca
MH		 4346 hci_dev_lock(hdev);
4347
c72d4b8a 4348 hdev->devid_source = source;
cdbaccca
MH		 4349 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4350 hdev->devid_product = __le16_to_cpu(cp->product);
4351 hdev->devid_version = __le16_to_cpu(cp->version);
4352
2a1afb5a
JH		 4353 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4354 NULL, 0);
cdbaccca 4355
890ea898
JH		 4356 hci_req_init(&req, hdev);
4357 update_eir(&req);
4358 hci_req_run(&req, NULL);
cdbaccca
MH		 4359
4360 hci_dev_unlock(hdev);
4361
4362 return err;
4363}
4364
1904a853
MH		 4365static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4366 u16 opcode)
4375f103
JH		 4367{
4368 struct cmd_lookup match = { NULL, hdev };
4369
3ad67582
JK		 4370 hci_dev_lock(hdev);
4371
4375f103
JH		 4372 if (status) {
4373 u8 mgmt_err = mgmt_status(status);
4374
4375 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4376 cmd_status_rsp, &mgmt_err);
3ad67582 4377 goto unlock;
4375f103
JH		 4378 }
4379
d7a5a11d 4380 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4381 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4382 else
a358dc11 4383 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4384
4375f103
JH		 4385 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4386 &match);
4387
4388 new_settings(hdev, match.sk);
4389
4390 if (match.sk)
4391 sock_put(match.sk);
3ad67582
JK		 4392
4393unlock:
4394 hci_dev_unlock(hdev);
4375f103
JH		 4395}
4396
21b5187f
MH		 4397static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4398 u16 len)
4375f103
JH		 4399{
4400 struct mgmt_mode *cp = data;
3b0602cd 4401 struct mgmt_pending_cmd *cmd;
4375f103 4402 struct hci_request req;
cc91cb04 4403 u8 val, status;
4375f103
JH		 4404 int err;
4405
4406 BT_DBG("request for %s", hdev->name);
4407
e6fe7986
JH		 4408 status = mgmt_le_support(hdev);
4409 if (status)
a69e8375
JH		 4410 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4411 status);
4375f103 4412
cc91cb04 4413 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4414 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4415 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4416
4417 hci_dev_lock(hdev);
4418
4419 val = !!cp->val;
4375f103 4420
f74ca9b8
JH		 4421 /* The following conditions are ones which mean that we should
4422 * not do any HCI communication but directly send a mgmt
4423 * response to user space (after toggling the flag if
4424 * necessary).
4425 */
cc91cb04 4426 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4427 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4428 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4429 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4430 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4431 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4432 bool changed;
4375f103 4433
cc91cb04 4434 if (cp->val) {
238be788 4435 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4436 if (cp->val == 0x02)
a1536da2 4437 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4438 else
a358dc11 4439 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4440 } else {
a69d8927 4441 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4442 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4443 }
4444
4445 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4446 if (err < 0)
4447 goto unlock;
4448
4449 if (changed)
4450 err = new_settings(hdev, sk);
4451
4452 goto unlock;
4453 }
4454
333ae95d
JH		 4455 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4456 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4457 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4458 MGMT_STATUS_BUSY);
4375f103
JH		 4459 goto unlock;
4460 }
4461
4462 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4463 if (!cmd) {
4464 err = -ENOMEM;
4465 goto unlock;
4466 }
4467
4468 hci_req_init(&req, hdev);
4469
cc91cb04 4470 if (cp->val == 0x02)
a1536da2 4471 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4472 else
a358dc11 4473 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4474
bba3aa55
MH		 4475 if (val)
4476 enable_advertising(&req);
4477 else
4478 disable_advertising(&req);
4375f103
JH		 4479
4480 err = hci_req_run(&req, set_advertising_complete);
4481 if (err < 0)
4482 mgmt_pending_remove(cmd);
4483
4484unlock:
4485 hci_dev_unlock(hdev);
4486 return err;
4487}
4488
d13eafce
MH		 4489static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4490 void *data, u16 len)
4491{
4492 struct mgmt_cp_set_static_address *cp = data;
4493 int err;
4494
4495 BT_DBG("%s", hdev->name);
4496
62af4443 4497 if (!lmp_le_capable(hdev))
a69e8375
JH		 4498 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4499 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4500
4501 if (hdev_is_powered(hdev))
a69e8375
JH		 4502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4503 MGMT_STATUS_REJECTED);
d13eafce
MH		 4504
4505 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4506 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4507 return mgmt_cmd_status(sk, hdev->id,
4508 MGMT_OP_SET_STATIC_ADDRESS,
4509 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4510
4511 /* Two most significant bits shall be set */
4512 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4513 return mgmt_cmd_status(sk, hdev->id,
4514 MGMT_OP_SET_STATIC_ADDRESS,
4515 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4516 }
4517
4518 hci_dev_lock(hdev);
4519
4520 bacpy(&hdev->static_addr, &cp->bdaddr);
4521
93690c22
MH		 4522 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4523 if (err < 0)
4524 goto unlock;
4525
4526 err = new_settings(hdev, sk);
d13eafce 4527
93690c22 4528unlock:
d13eafce 4529 hci_dev_unlock(hdev);
d13eafce
MH		 4530 return err;
4531}
4532
14b49b9a
MH		 4533static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4534 void *data, u16 len)
4535{
4536 struct mgmt_cp_set_scan_params *cp = data;
4537 __u16 interval, window;
4538 int err;
4539
4540 BT_DBG("%s", hdev->name);
4541
4542 if (!lmp_le_capable(hdev))
a69e8375
JH		 4543 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4544 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 4545
4546 interval = __le16_to_cpu(cp->interval);
4547
4548 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 4549 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4550 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 4551
4552 window = __le16_to_cpu(cp->window);
4553
4554 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 4555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4556 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 4557
899e1075 4558 if (window > interval)
a69e8375
JH		 4559 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4560 MGMT_STATUS_INVALID_PARAMS);
899e1075 4561
14b49b9a
MH		 4562 hci_dev_lock(hdev);
4563
4564 hdev->le_scan_interval = interval;
4565 hdev->le_scan_window = window;
4566
2a1afb5a
JH		 4567 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4568 NULL, 0);
14b49b9a 4569
dd2ef8e2
AG		 4570 /* If background scan is running, restart it so new parameters are
4571 * loaded.
4572 */
d7a5a11d 4573 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 4574 hdev->discovery.state == DISCOVERY_STOPPED) {
4575 struct hci_request req;
4576
4577 hci_req_init(&req, hdev);
4578
4579 hci_req_add_le_scan_disable(&req);
4580 hci_req_add_le_passive_scan(&req);
4581
4582 hci_req_run(&req, NULL);
4583 }
4584
14b49b9a
MH		 4585 hci_dev_unlock(hdev);
4586
4587 return err;
4588}
4589
1904a853
MH		 4590static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4591 u16 opcode)
33e38b3e 4592{
3b0602cd 4593 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 4594
4595 BT_DBG("status 0x%02x", status);
4596
4597 hci_dev_lock(hdev);
4598
333ae95d 4599 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 4600 if (!cmd)
4601 goto unlock;
4602
4603 if (status) {
a69e8375
JH		 4604 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4605 mgmt_status(status));
33e38b3e 4606 } else {
1a4d3c4b
JH		 4607 struct mgmt_mode *cp = cmd->param;
4608
4609 if (cp->val)
a1536da2 4610 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 4611 else
a358dc11 4612 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 4613
33e38b3e
JH		 4614 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4615 new_settings(hdev, cmd->sk);
4616 }
4617
4618 mgmt_pending_remove(cmd);
4619
4620unlock:
4621 hci_dev_unlock(hdev);
4622}
4623
bdb6d971 4624static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 4625 void *data, u16 len)
f6422ec6 4626{
650f726d 4627 struct mgmt_mode *cp = data;
3b0602cd 4628 struct mgmt_pending_cmd *cmd;
33e38b3e 4629 struct hci_request req;
f6422ec6
AJ		 4630 int err;
4631
bdb6d971 4632 BT_DBG("%s", hdev->name);
f6422ec6 4633
d7a5a11d 4634 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 4635 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 4636 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4637 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 4638
a7e80f25 4639 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 4640 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4641 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 4642
f6422ec6
AJ		 4643 hci_dev_lock(hdev);
4644
333ae95d 4645 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 4646 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4647 MGMT_STATUS_BUSY);
05cbf29f
JH		 4648 goto unlock;
4649 }
4650
d7a5a11d 4651 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 4652 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4653 hdev);
4654 goto unlock;
4655 }
4656
406ef2a6 4657 if (!hdev_is_powered(hdev)) {
ce05d603 4658 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 4659 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4660 hdev);
4661 new_settings(hdev, sk);
4662 goto unlock;
4663 }
4664
33e38b3e
JH		 4665 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4666 data, len);
4667 if (!cmd) {
4668 err = -ENOMEM;
4669 goto unlock;
f6422ec6
AJ		 4670 }
4671
33e38b3e
JH		 4672 hci_req_init(&req, hdev);
4673
406d7804 4674 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 4675
4676 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 4677 if (err < 0) {
a69e8375
JH		 4678 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4679 MGMT_STATUS_FAILED);
33e38b3e 4680 mgmt_pending_remove(cmd);
f6422ec6
AJ		 4681 }
4682
33e38b3e 4683unlock:
f6422ec6 4684 hci_dev_unlock(hdev);
33e38b3e 4685
f6422ec6
AJ		 4686 return err;
4687}
4688
1904a853 4689static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 4690{
3b0602cd 4691 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 4692
4693 BT_DBG("status 0x%02x", status);
4694
4695 hci_dev_lock(hdev);
4696
333ae95d 4697 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 4698 if (!cmd)
4699 goto unlock;
4700
4701 if (status) {
4702 u8 mgmt_err = mgmt_status(status);
4703
4704 /* We need to restore the flag if related HCI commands
4705 * failed.
4706 */
a358dc11 4707 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 4708
a69e8375 4709 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 4710 } else {
4711 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4712 new_settings(hdev, cmd->sk);
4713 }
4714
4715 mgmt_pending_remove(cmd);
4716
4717unlock:
4718 hci_dev_unlock(hdev);
4719}
4720
4721static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4722{
4723 struct mgmt_mode *cp = data;
3b0602cd 4724 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 4725 struct hci_request req;
4726 int err;
4727
4728 BT_DBG("request for %s", hdev->name);
4729
4730 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 4731 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4732 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 4733
d7a5a11d 4734 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 4735 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4736 MGMT_STATUS_REJECTED);
0663ca2a
JH		 4737
4738 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 4739 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4740 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 4741
4742 hci_dev_lock(hdev);
4743
d7a5a11d 4744 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 4745 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4746 goto unlock;
4747 }
4748
4749 if (!hdev_is_powered(hdev)) {
4750 if (!cp->val) {
a358dc11
MH		 4751 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4752 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
4753 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
4754 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
4755 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 4756 }
4757
ce05d603 4758 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 4759
4760 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4761 if (err < 0)
4762 goto unlock;
4763
4764 err = new_settings(hdev, sk);
4765 goto unlock;
4766 }
4767
4768 /* Reject disabling when powered on */
4769 if (!cp->val) {
a69e8375
JH		 4770 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4771 MGMT_STATUS_REJECTED);
0663ca2a 4772 goto unlock;
111e4bcc
MH		 4773 } else {
4774 /* When configuring a dual-mode controller to operate
4775 * with LE only and using a static address, then switching
4776 * BR/EDR back on is not allowed.
4777 *
4778 * Dual-mode controllers shall operate with the public
4779 * address as its identity address for BR/EDR and LE. So
4780 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 4781 *
4782 * The same restrictions applies when secure connections
4783 * has been enabled. For BR/EDR this is a controller feature
4784 * while for LE it is a host stack feature. This means that
4785 * switching BR/EDR back on when secure connections has been
4786 * enabled is not a supported transaction.
111e4bcc 4787 */
d7a5a11d 4788 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 4789 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 4790 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 4791 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4792 MGMT_STATUS_REJECTED);
111e4bcc
MH		 4793 goto unlock;
4794 }
0663ca2a
JH		 4795 }
4796
333ae95d 4797 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 4798 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4799 MGMT_STATUS_BUSY);
0663ca2a
JH		 4800 goto unlock;
4801 }
4802
4803 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4804 if (!cmd) {
4805 err = -ENOMEM;
4806 goto unlock;
4807 }
4808
5947f4bc 4809 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 4810 * generates the correct flags.
4811 */
a1536da2 4812 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 4813
4814 hci_req_init(&req, hdev);
aa8af46e 4815
432df05e 4816 write_fast_connectable(&req, false);
1d2dc5b7 4817 __hci_update_page_scan(&req);
aa8af46e 4818
f14d8f64
MH		 4819 /* Since only the advertising data flags will change, there
4820 * is no need to update the scan response data.
4821 */
5947f4bc 4822 update_adv_data(&req);
aa8af46e 4823
0663ca2a
JH		 4824 err = hci_req_run(&req, set_bredr_complete);
4825 if (err < 0)
4826 mgmt_pending_remove(cmd);
4827
4828unlock:
4829 hci_dev_unlock(hdev);
4830 return err;
4831}
4832
a1443f5a
JH		 4833static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4834{
3b0602cd 4835 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 4836 struct mgmt_mode *cp;
4837
4838 BT_DBG("%s status %u", hdev->name, status);
4839
4840 hci_dev_lock(hdev);
4841
333ae95d 4842 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 4843 if (!cmd)
4844 goto unlock;
4845
4846 if (status) {
a69e8375
JH		 4847 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
4848 mgmt_status(status));
a1443f5a
JH		 4849 goto remove;
4850 }
4851
4852 cp = cmd->param;
4853
4854 switch (cp->val) {
4855 case 0x00:
a358dc11
MH		 4856 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
4857 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 4858 break;
4859 case 0x01:
a1536da2 4860 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 4861 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 4862 break;
4863 case 0x02:
a1536da2
MH		 4864 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
4865 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 4866 break;
4867 }
4868
4869 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4870 new_settings(hdev, cmd->sk);
4871
4872remove:
4873 mgmt_pending_remove(cmd);
4874unlock:
4875 hci_dev_unlock(hdev);
4876}
4877
eac83dc6
MH		 4878static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4879 void *data, u16 len)
4880{
4881 struct mgmt_mode *cp = data;
3b0602cd 4882 struct mgmt_pending_cmd *cmd;
a1443f5a 4883 struct hci_request req;
a3209694 4884 u8 val;
eac83dc6
MH		 4885 int err;
4886
4887 BT_DBG("request for %s", hdev->name);
4888
05b3c3e7 4889 if (!lmp_sc_capable(hdev) &&
d7a5a11d 4890 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 4891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4892 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 4893
d7a5a11d 4894 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 4895 lmp_sc_capable(hdev) &&
d7a5a11d 4896 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 4897 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4898 MGMT_STATUS_REJECTED);
ed93ec69 4899
0ab04a9c 4900 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 4901 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 4902 MGMT_STATUS_INVALID_PARAMS);
4903
4904 hci_dev_lock(hdev);
4905
05b3c3e7 4906 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 4907 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 4908 bool changed;
4909
0ab04a9c 4910 if (cp->val) {
238be788
MH		 4911 changed = !hci_dev_test_and_set_flag(hdev,
4912 HCI_SC_ENABLED);
0ab04a9c 4913 if (cp->val == 0x02)
a1536da2 4914 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 4915 else
a358dc11 4916 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 4917 } else {
a69d8927
MH		 4918 changed = hci_dev_test_and_clear_flag(hdev,
4919 HCI_SC_ENABLED);
a358dc11 4920 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 4921 }
eac83dc6
MH		 4922
4923 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4924 if (err < 0)
4925 goto failed;
4926
4927 if (changed)
4928 err = new_settings(hdev, sk);
4929
4930 goto failed;
4931 }
4932
333ae95d 4933 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 4934 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4935 MGMT_STATUS_BUSY);
eac83dc6
MH		 4936 goto failed;
4937 }
4938
0ab04a9c
MH		 4939 val = !!cp->val;
4940
d7a5a11d
MH		 4941 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
4942 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 4943 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4944 goto failed;
4945 }
4946
4947 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4948 if (!cmd) {
4949 err = -ENOMEM;
4950 goto failed;
4951 }
4952
a1443f5a
JH		 4953 hci_req_init(&req, hdev);
4954 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4955 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 4956 if (err < 0) {
4957 mgmt_pending_remove(cmd);
4958 goto failed;
4959 }
4960
4961failed:
4962 hci_dev_unlock(hdev);
4963 return err;
4964}
4965
4e39ac81
MH		 4966static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4967 void *data, u16 len)
4968{
4969 struct mgmt_mode *cp = data;
b9710979 4970 bool changed, use_changed;
4e39ac81
MH		 4971 int err;
4972
4973 BT_DBG("request for %s", hdev->name);
4974
b9710979 4975 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4976 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4977 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 4978
4979 hci_dev_lock(hdev);
4980
4981 if (cp->val)
238be788 4982 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 4983 else
a69d8927
MH		 4984 changed = hci_dev_test_and_clear_flag(hdev,
4985 HCI_KEEP_DEBUG_KEYS);
4e39ac81 4986
b9710979 4987 if (cp->val == 0x02)
238be788
MH		 4988 use_changed = !hci_dev_test_and_set_flag(hdev,
4989 HCI_USE_DEBUG_KEYS);
b9710979 4990 else
a69d8927
MH		 4991 use_changed = hci_dev_test_and_clear_flag(hdev,
4992 HCI_USE_DEBUG_KEYS);
b9710979
JH		 4993
4994 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 4995 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 4996 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4997 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4998 sizeof(mode), &mode);
4999 }
5000
4e39ac81
MH		 5001 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5002 if (err < 0)
5003 goto unlock;
5004
5005 if (changed)
5006 err = new_settings(hdev, sk);
5007
5008unlock:
5009 hci_dev_unlock(hdev);
5010 return err;
5011}
5012
62b04cd1
JH		 5013static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5014 u16 len)
5015{
5016 struct mgmt_cp_set_privacy *cp = cp_data;
5017 bool changed;
5018 int err;
5019
5020 BT_DBG("request for %s", hdev->name);
5021
5022 if (!lmp_le_capable(hdev))
a69e8375
JH		 5023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5024 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5025
5026 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5028 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5029
5030 if (hdev_is_powered(hdev))
a69e8375
JH		 5031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5032 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5033
5034 hci_dev_lock(hdev);
5035
c21c0ea0
JH		 5036 /* If user space supports this command it is also expected to
5037 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5038 */
a1536da2 5039 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5040
62b04cd1 5041 if (cp->privacy) {
238be788 5042 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5043 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5044 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5045 } else {
a69d8927 5046 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5047 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5048 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5049 }
5050
5051 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5052 if (err < 0)
5053 goto unlock;
5054
5055 if (changed)
5056 err = new_settings(hdev, sk);
5057
5058unlock:
5059 hci_dev_unlock(hdev);
5060 return err;
5061}
5062
41edf160
JH		 5063static bool irk_is_valid(struct mgmt_irk_info *irk)
5064{
5065 switch (irk->addr.type) {
5066 case BDADDR_LE_PUBLIC:
5067 return true;
5068
5069 case BDADDR_LE_RANDOM:
5070 /* Two most significant bits shall be set */
5071 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5072 return false;
5073 return true;
5074 }
5075
5076 return false;
5077}
5078
5079static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5080 u16 len)
5081{
5082 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5083 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5084 sizeof(struct mgmt_irk_info));
41edf160
JH		 5085 u16 irk_count, expected_len;
5086 int i, err;
5087
5088 BT_DBG("request for %s", hdev->name);
5089
5090 if (!lmp_le_capable(hdev))
a69e8375
JH		 5091 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5092 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5093
5094 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5095 if (irk_count > max_irk_count) {
5096 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5097 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5098 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5099 }
41edf160
JH		 5100
5101 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5102 if (expected_len != len) {
5103 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5104 expected_len, len);
a69e8375
JH		 5105 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5106 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5107 }
5108
5109 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5110
5111 for (i = 0; i < irk_count; i++) {
5112 struct mgmt_irk_info *key = &cp->irks[i];
5113
5114 if (!irk_is_valid(key))
a69e8375
JH		 5115 return mgmt_cmd_status(sk, hdev->id,
5116 MGMT_OP_LOAD_IRKS,
5117 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5118 }
5119
5120 hci_dev_lock(hdev);
5121
5122 hci_smp_irks_clear(hdev);
5123
5124 for (i = 0; i < irk_count; i++) {
5125 struct mgmt_irk_info *irk = &cp->irks[i];
5126 u8 addr_type;
5127
5128 if (irk->addr.type == BDADDR_LE_PUBLIC)
5129 addr_type = ADDR_LE_DEV_PUBLIC;
5130 else
5131 addr_type = ADDR_LE_DEV_RANDOM;
5132
5133 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5134 BDADDR_ANY);
5135 }
5136
a1536da2 5137 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5138
2a1afb5a 5139 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5140
5141 hci_dev_unlock(hdev);
5142
5143 return err;
5144}
5145
3f706b72
JH		 5146static bool ltk_is_valid(struct mgmt_ltk_info *key)
5147{
5148 if (key->master != 0x00 && key->master != 0x01)
5149 return false;
490cb0b3
MH		 5150
5151 switch (key->addr.type) {
5152 case BDADDR_LE_PUBLIC:
5153 return true;
5154
5155 case BDADDR_LE_RANDOM:
5156 /* Two most significant bits shall be set */
5157 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5158 return false;
5159 return true;
5160 }
5161
5162 return false;
3f706b72
JH		 5163}
5164
bdb6d971 5165static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5166 void *cp_data, u16 len)
346af67b 5167{
346af67b 5168 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5169 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5170 sizeof(struct mgmt_ltk_info));
346af67b 5171 u16 key_count, expected_len;
715a5bf2 5172 int i, err;
346af67b 5173
cf99ba13
MH		 5174 BT_DBG("request for %s", hdev->name);
5175
5176 if (!lmp_le_capable(hdev))
a69e8375
JH		 5177 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5178 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5179
1f350c87 5180 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5181 if (key_count > max_key_count) {
5182 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5183 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5184 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5185 }
346af67b
VCG		 5186
5187 expected_len = sizeof(*cp) + key_count *
5188 sizeof(struct mgmt_ltk_info);
5189 if (expected_len != len) {
5190 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5191 expected_len, len);
a69e8375
JH		 5192 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5193 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5194 }
5195
bdb6d971 5196 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5197
54ad6d8a
JH		 5198 for (i = 0; i < key_count; i++) {
5199 struct mgmt_ltk_info *key = &cp->keys[i];
5200
3f706b72 5201 if (!ltk_is_valid(key))
a69e8375
JH		 5202 return mgmt_cmd_status(sk, hdev->id,
5203 MGMT_OP_LOAD_LONG_TERM_KEYS,
5204 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5205 }
5206
346af67b
VCG		 5207 hci_dev_lock(hdev);
5208
5209 hci_smp_ltks_clear(hdev);
5210
5211 for (i = 0; i < key_count; i++) {
5212 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5213 u8 type, addr_type, authenticated;
79d95a19
MH		 5214
5215 if (key->addr.type == BDADDR_LE_PUBLIC)
5216 addr_type = ADDR_LE_DEV_PUBLIC;
5217 else
5218 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5219
61b43357
JH		 5220 switch (key->type) {
5221 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5222 authenticated = 0x00;
23fb8de3 5223 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5224 break;
5225 case MGMT_LTK_AUTHENTICATED:
d7b25450 5226 authenticated = 0x01;
23fb8de3
JH		 5227 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5228 break;
5229 case MGMT_LTK_P256_UNAUTH:
5230 authenticated = 0x00;
5231 type = SMP_LTK_P256;
61b43357 5232 break;
23fb8de3
JH		 5233 case MGMT_LTK_P256_AUTH:
5234 authenticated = 0x01;
5235 type = SMP_LTK_P256;
61b43357 5236 break;
23fb8de3
JH		 5237 case MGMT_LTK_P256_DEBUG:
5238 authenticated = 0x00;
5239 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5240 default:
5241 continue;
5242 }
d7b25450 5243
35d70271 5244 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5245 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5246 key->rand);
346af67b
VCG		 5247 }
5248
2a1afb5a 5249 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5250 NULL, 0);
5251
346af67b 5252 hci_dev_unlock(hdev);
346af67b 5253
715a5bf2 5254 return err;
346af67b
VCG		 5255}
5256
3b0602cd 5257static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5258{
dd983808 5259 struct hci_conn *conn = cmd->user_data;
9981bdb0 5260 struct mgmt_rp_get_conn_info rp;
9df74653 5261 int err;
dd983808 5262
9981bdb0 5263 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5264
9981bdb0 5265 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5266 rp.rssi = conn->rssi;
9981bdb0
JH		 5267 rp.tx_power = conn->tx_power;
5268 rp.max_tx_power = conn->max_tx_power;
5269 } else {
5270 rp.rssi = HCI_RSSI_INVALID;
5271 rp.tx_power = HCI_TX_POWER_INVALID;
5272 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5273 }
5274
2a1afb5a
JH		 5275 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5276 status, &rp, sizeof(rp));
dd983808
AK		 5277
5278 hci_conn_drop(conn);
f8aaf9b6 5279 hci_conn_put(conn);
9df74653
JH		 5280
5281 return err;
dd983808
AK		 5282}
5283
1904a853
MH		 5284static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5285 u16 opcode)
dd983808
AK		 5286{
5287 struct hci_cp_read_rssi *cp;
3b0602cd 5288 struct mgmt_pending_cmd *cmd;
dd983808 5289 struct hci_conn *conn;
dd983808 5290 u16 handle;
9981bdb0 5291 u8 status;
dd983808 5292
9981bdb0 5293 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5294
5295 hci_dev_lock(hdev);
5296
dd983808
AK		 5297 /* Commands sent in request are either Read RSSI or Read Transmit Power
5298 * Level so we check which one was last sent to retrieve connection
5299 * handle. Both commands have handle as first parameter so it's safe to
5300 * cast data on the same command struct.
5301 *
5302 * First command sent is always Read RSSI and we fail only if it fails.
5303 * In other case we simply override error to indicate success as we
5304 * already remembered if TX power value is actually valid.
5305 */
5306 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5307 if (!cp) {
5308 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5309 status = MGMT_STATUS_SUCCESS;
5310 } else {
5311 status = mgmt_status(hci_status);
dd983808
AK		 5312 }
5313
5314 if (!cp) {
9981bdb0 5315 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5316 goto unlock;
5317 }
5318
5319 handle = __le16_to_cpu(cp->handle);
5320 conn = hci_conn_hash_lookup_handle(hdev, handle);
5321 if (!conn) {
9981bdb0 5322 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5323 goto unlock;
5324 }
5325
333ae95d 5326 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5327 if (!cmd)
5328 goto unlock;
dd983808 5329
9981bdb0
JH		 5330 cmd->cmd_complete(cmd, status);
5331 mgmt_pending_remove(cmd);
dd983808
AK		 5332
5333unlock:
5334 hci_dev_unlock(hdev);
5335}
5336
5337static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5338 u16 len)
5339{
5340 struct mgmt_cp_get_conn_info *cp = data;
5341 struct mgmt_rp_get_conn_info rp;
5342 struct hci_conn *conn;
5343 unsigned long conn_info_age;
5344 int err = 0;
5345
5346 BT_DBG("%s", hdev->name);
5347
5348 memset(&rp, 0, sizeof(rp));
5349 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5350 rp.addr.type = cp->addr.type;
5351
5352 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5353 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5354 MGMT_STATUS_INVALID_PARAMS,
5355 &rp, sizeof(rp));
dd983808
AK		 5356
5357 hci_dev_lock(hdev);
5358
5359 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5360 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5361 MGMT_STATUS_NOT_POWERED, &rp,
5362 sizeof(rp));
dd983808
AK		 5363 goto unlock;
5364 }
5365
5366 if (cp->addr.type == BDADDR_BREDR)
5367 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5368 &cp->addr.bdaddr);
5369 else
5370 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5371
5372 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5373 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5374 MGMT_STATUS_NOT_CONNECTED, &rp,
5375 sizeof(rp));
dd983808
AK		 5376 goto unlock;
5377 }
5378
333ae95d 5379 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5380 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5381 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5382 goto unlock;
5383 }
5384
dd983808
AK		 5385 /* To avoid client trying to guess when to poll again for information we
5386 * calculate conn info age as random value between min/max set in hdev.
5387 */
5388 conn_info_age = hdev->conn_info_min_age +
5389 prandom_u32_max(hdev->conn_info_max_age -
5390 hdev->conn_info_min_age);
5391
5392 /* Query controller to refresh cached values if they are too old or were
5393 * never read.
5394 */
f4e2dd53
AK		 5395 if (time_after(jiffies, conn->conn_info_timestamp +
5396 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5397 !conn->conn_info_timestamp) {
5398 struct hci_request req;
5399 struct hci_cp_read_tx_power req_txp_cp;
5400 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5401 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5402
5403 hci_req_init(&req, hdev);
5404 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5405 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5406 &req_rssi_cp);
5407
f7faab0c
AK		 5408 /* For LE links TX power does not change thus we don't need to
5409 * query for it once value is known.
5410 */
5411 if (!bdaddr_type_is_le(cp->addr.type) ||
5412 conn->tx_power == HCI_TX_POWER_INVALID) {
5413 req_txp_cp.handle = cpu_to_le16(conn->handle);
5414 req_txp_cp.type = 0x00;
5415 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5416 sizeof(req_txp_cp), &req_txp_cp);
5417 }
dd983808 5418
eed5daf3
AK		 5419 /* Max TX power needs to be read only once per connection */
5420 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5421 req_txp_cp.handle = cpu_to_le16(conn->handle);
5422 req_txp_cp.type = 0x01;
5423 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5424 sizeof(req_txp_cp), &req_txp_cp);
5425 }
5426
dd983808
AK		 5427 err = hci_req_run(&req, conn_info_refresh_complete);
5428 if (err < 0)
5429 goto unlock;
5430
5431 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5432 data, len);
5433 if (!cmd) {
5434 err = -ENOMEM;
5435 goto unlock;
5436 }
5437
5438 hci_conn_hold(conn);
f8aaf9b6 5439 cmd->user_data = hci_conn_get(conn);
9981bdb0 5440 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5441
5442 conn->conn_info_timestamp = jiffies;
5443 } else {
5444 /* Cache is valid, just reply with values cached in hci_conn */
5445 rp.rssi = conn->rssi;
5446 rp.tx_power = conn->tx_power;
eed5daf3 5447 rp.max_tx_power = conn->max_tx_power;
dd983808 5448
2a1afb5a
JH		 5449 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5450 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5451 }
5452
5453unlock:
5454 hci_dev_unlock(hdev);
5455 return err;
5456}
5457
3b0602cd 5458static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5459{
69487371 5460 struct hci_conn *conn = cmd->user_data;
95868426 5461 struct mgmt_rp_get_clock_info rp;
69487371 5462 struct hci_dev *hdev;
9df74653 5463 int err;
69487371
JH		 5464
5465 memset(&rp, 0, sizeof(rp));
5466 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5467
5468 if (status)
5469 goto complete;
5470
5471 hdev = hci_dev_get(cmd->index);
5472 if (hdev) {
5473 rp.local_clock = cpu_to_le32(hdev->clock);
5474 hci_dev_put(hdev);
5475 }
5476
5477 if (conn) {
5478 rp.piconet_clock = cpu_to_le32(conn->clock);
5479 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5480 }
5481
5482complete:
2a1afb5a
JH		 5483 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5484 sizeof(rp));
69487371
JH		 5485
5486 if (conn) {
5487 hci_conn_drop(conn);
5488 hci_conn_put(conn);
5489 }
9df74653
JH		 5490
5491 return err;
69487371
JH		 5492}
5493
1904a853 5494static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5495{
95868426 5496 struct hci_cp_read_clock *hci_cp;
3b0602cd 5497 struct mgmt_pending_cmd *cmd;
95868426
JH		 5498 struct hci_conn *conn;
5499
5500 BT_DBG("%s status %u", hdev->name, status);
5501
5502 hci_dev_lock(hdev);
5503
5504 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5505 if (!hci_cp)
5506 goto unlock;
5507
5508 if (hci_cp->which) {
5509 u16 handle = __le16_to_cpu(hci_cp->handle);
5510 conn = hci_conn_hash_lookup_handle(hdev, handle);
5511 } else {
5512 conn = NULL;
5513 }
5514
333ae95d 5515 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5516 if (!cmd)
5517 goto unlock;
5518
69487371 5519 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5520 mgmt_pending_remove(cmd);
95868426
JH		 5521
5522unlock:
5523 hci_dev_unlock(hdev);
5524}
5525
5526static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5527 u16 len)
5528{
5529 struct mgmt_cp_get_clock_info *cp = data;
5530 struct mgmt_rp_get_clock_info rp;
5531 struct hci_cp_read_clock hci_cp;
3b0602cd 5532 struct mgmt_pending_cmd *cmd;
95868426
JH		 5533 struct hci_request req;
5534 struct hci_conn *conn;
5535 int err;
5536
5537 BT_DBG("%s", hdev->name);
5538
5539 memset(&rp, 0, sizeof(rp));
5540 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5541 rp.addr.type = cp->addr.type;
5542
5543 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 5544 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5545 MGMT_STATUS_INVALID_PARAMS,
5546 &rp, sizeof(rp));
95868426
JH		 5547
5548 hci_dev_lock(hdev);
5549
5550 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5551 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5552 MGMT_STATUS_NOT_POWERED, &rp,
5553 sizeof(rp));
95868426
JH		 5554 goto unlock;
5555 }
5556
5557 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5558 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5559 &cp->addr.bdaddr);
5560 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5561 err = mgmt_cmd_complete(sk, hdev->id,
5562 MGMT_OP_GET_CLOCK_INFO,
5563 MGMT_STATUS_NOT_CONNECTED,
5564 &rp, sizeof(rp));
95868426
JH		 5565 goto unlock;
5566 }
5567 } else {
5568 conn = NULL;
5569 }
5570
5571 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5572 if (!cmd) {
5573 err = -ENOMEM;
5574 goto unlock;
5575 }
5576
69487371
JH		 5577 cmd->cmd_complete = clock_info_cmd_complete;
5578
95868426
JH		 5579 hci_req_init(&req, hdev);
5580
5581 memset(&hci_cp, 0, sizeof(hci_cp));
5582 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5583
5584 if (conn) {
5585 hci_conn_hold(conn);
f8aaf9b6 5586 cmd->user_data = hci_conn_get(conn);
95868426
JH		 5587
5588 hci_cp.handle = cpu_to_le16(conn->handle);
5589 hci_cp.which = 0x01; /* Piconet clock */
5590 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5591 }
5592
5593 err = hci_req_run(&req, get_clock_info_complete);
5594 if (err < 0)
5595 mgmt_pending_remove(cmd);
5596
5597unlock:
5598 hci_dev_unlock(hdev);
5599 return err;
5600}
5601
5a154e6f
JH		 5602static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5603{
5604 struct hci_conn *conn;
5605
5606 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5607 if (!conn)
5608 return false;
5609
5610 if (conn->dst_type != type)
5611 return false;
5612
5613 if (conn->state != BT_CONNECTED)
5614 return false;
5615
5616 return true;
5617}
5618
5619/* This function requires the caller holds hdev->lock */
5620static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5621 u8 addr_type, u8 auto_connect)
5622{
5623 struct hci_dev *hdev = req->hdev;
5624 struct hci_conn_params *params;
5625
5626 params = hci_conn_params_add(hdev, addr, addr_type);
5627 if (!params)
5628 return -EIO;
5629
5630 if (params->auto_connect == auto_connect)
5631 return 0;
5632
5633 list_del_init(&params->action);
5634
5635 switch (auto_connect) {
5636 case HCI_AUTO_CONN_DISABLED:
5637 case HCI_AUTO_CONN_LINK_LOSS:
5638 __hci_update_background_scan(req);
5639 break;
5640 case HCI_AUTO_CONN_REPORT:
5641 list_add(&params->action, &hdev->pend_le_reports);
5642 __hci_update_background_scan(req);
5643 break;
5644 case HCI_AUTO_CONN_DIRECT:
5645 case HCI_AUTO_CONN_ALWAYS:
5646 if (!is_connected(hdev, addr, addr_type)) {
5647 list_add(&params->action, &hdev->pend_le_conns);
5648 __hci_update_background_scan(req);
5649 }
5650 break;
5651 }
5652
5653 params->auto_connect = auto_connect;
5654
5655 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5656 auto_connect);
5657
5658 return 0;
5659}
5660
8afef092
MH		 5661static void device_added(struct sock *sk, struct hci_dev *hdev,
5662 bdaddr_t *bdaddr, u8 type, u8 action)
5663{
5664 struct mgmt_ev_device_added ev;
5665
5666 bacpy(&ev.addr.bdaddr, bdaddr);
5667 ev.addr.type = type;
5668 ev.action = action;
5669
5670 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5671}
5672
1904a853 5673static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 5674{
3b0602cd 5675 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 5676
5677 BT_DBG("status 0x%02x", status);
5678
5679 hci_dev_lock(hdev);
5680
333ae95d 5681 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 5682 if (!cmd)
5683 goto unlock;
5684
5685 cmd->cmd_complete(cmd, mgmt_status(status));
5686 mgmt_pending_remove(cmd);
5687
5688unlock:
5689 hci_dev_unlock(hdev);
5690}
5691
2faade53
MH		 5692static int add_device(struct sock *sk, struct hci_dev *hdev,
5693 void *data, u16 len)
5694{
5695 struct mgmt_cp_add_device *cp = data;
3b0602cd 5696 struct mgmt_pending_cmd *cmd;
5a154e6f 5697 struct hci_request req;
2faade53
MH		 5698 u8 auto_conn, addr_type;
5699 int err;
5700
5701 BT_DBG("%s", hdev->name);
5702
6659358e 5703 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 5704 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 5705 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5706 MGMT_STATUS_INVALID_PARAMS,
5707 &cp->addr, sizeof(cp->addr));
2faade53 5708
4b9e7e75 5709 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 5710 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5711 MGMT_STATUS_INVALID_PARAMS,
5712 &cp->addr, sizeof(cp->addr));
2faade53 5713
5a154e6f
JH		 5714 hci_req_init(&req, hdev);
5715
2faade53
MH		 5716 hci_dev_lock(hdev);
5717
5a154e6f
JH		 5718 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5719 if (!cmd) {
5720 err = -ENOMEM;
5721 goto unlock;
5722 }
5723
5724 cmd->cmd_complete = addr_cmd_complete;
5725
6659358e 5726 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 5727 /* Only incoming connections action is supported for now */
6659358e 5728 if (cp->action != 0x01) {
9df74653
JH		 5729 err = cmd->cmd_complete(cmd,
5730 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 5731 mgmt_pending_remove(cmd);
6659358e
JH		 5732 goto unlock;
5733 }
5734
5735 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5736 cp->addr.type);
5737 if (err)
5738 goto unlock;
a397407f 5739
5a154e6f 5740 __hci_update_page_scan(&req);
a397407f 5741
6659358e
JH		 5742 goto added;
5743 }
5744
2faade53
MH		 5745 if (cp->addr.type == BDADDR_LE_PUBLIC)
5746 addr_type = ADDR_LE_DEV_PUBLIC;
5747 else
5748 addr_type = ADDR_LE_DEV_RANDOM;
5749
4b9e7e75 5750 if (cp->action == 0x02)
2faade53 5751 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 5752 else if (cp->action == 0x01)
5753 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 5754 else
a3451d27 5755 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 5756
bf5b3c8b
MH		 5757 /* If the connection parameters don't exist for this device,
5758 * they will be created and configured with defaults.
5759 */
5a154e6f 5760 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 5761 auto_conn) < 0) {
9df74653 5762 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 5763 mgmt_pending_remove(cmd);
2faade53
MH		 5764 goto unlock;
5765 }
5766
6659358e 5767added:
8afef092
MH		 5768 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5769
5a154e6f
JH		 5770 err = hci_req_run(&req, add_device_complete);
5771 if (err < 0) {
5772 /* ENODATA means no HCI commands were needed (e.g. if
5773 * the adapter is powered off).
5774 */
9df74653
JH		 5775 if (err == -ENODATA)
5776 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 5777 mgmt_pending_remove(cmd);
5778 }
2faade53
MH		 5779
5780unlock:
5781 hci_dev_unlock(hdev);
5782 return err;
5783}
5784
8afef092
MH		 5785static void device_removed(struct sock *sk, struct hci_dev *hdev,
5786 bdaddr_t *bdaddr, u8 type)
5787{
5788 struct mgmt_ev_device_removed ev;
5789
5790 bacpy(&ev.addr.bdaddr, bdaddr);
5791 ev.addr.type = type;
5792
5793 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5794}
5795
1904a853 5796static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 5797{
3b0602cd 5798 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 5799
5800 BT_DBG("status 0x%02x", status);
5801
5802 hci_dev_lock(hdev);
5803
333ae95d 5804 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 5805 if (!cmd)
5806 goto unlock;
5807
5808 cmd->cmd_complete(cmd, mgmt_status(status));
5809 mgmt_pending_remove(cmd);
5810
5811unlock:
5812 hci_dev_unlock(hdev);
5813}
5814
2faade53
MH		 5815static int remove_device(struct sock *sk, struct hci_dev *hdev,
5816 void *data, u16 len)
5817{
5818 struct mgmt_cp_remove_device *cp = data;
3b0602cd 5819 struct mgmt_pending_cmd *cmd;
51ef3ebe 5820 struct hci_request req;
2faade53
MH		 5821 int err;
5822
5823 BT_DBG("%s", hdev->name);
5824
51ef3ebe
JH		 5825 hci_req_init(&req, hdev);
5826
2faade53
MH		 5827 hci_dev_lock(hdev);
5828
51ef3ebe
JH		 5829 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5830 if (!cmd) {
5831 err = -ENOMEM;
5832 goto unlock;
5833 }
5834
5835 cmd->cmd_complete = addr_cmd_complete;
5836
2faade53 5837 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 5838 struct hci_conn_params *params;
2faade53
MH		 5839 u8 addr_type;
5840
6659358e 5841 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 5842 err = cmd->cmd_complete(cmd,
5843 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5844 mgmt_pending_remove(cmd);
2faade53
MH		 5845 goto unlock;
5846 }
5847
6659358e
JH		 5848 if (cp->addr.type == BDADDR_BREDR) {
5849 err = hci_bdaddr_list_del(&hdev->whitelist,
5850 &cp->addr.bdaddr,
5851 cp->addr.type);
5852 if (err) {
9df74653
JH		 5853 err = cmd->cmd_complete(cmd,
5854 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5855 mgmt_pending_remove(cmd);
6659358e
JH		 5856 goto unlock;
5857 }
5858
51ef3ebe 5859 __hci_update_page_scan(&req);
a397407f 5860
6659358e
JH		 5861 device_removed(sk, hdev, &cp->addr.bdaddr,
5862 cp->addr.type);
5863 goto complete;
5864 }
5865
2faade53
MH		 5866 if (cp->addr.type == BDADDR_LE_PUBLIC)
5867 addr_type = ADDR_LE_DEV_PUBLIC;
5868 else
5869 addr_type = ADDR_LE_DEV_RANDOM;
5870
c71593dd
JH		 5871 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5872 addr_type);
5873 if (!params) {
9df74653
JH		 5874 err = cmd->cmd_complete(cmd,
5875 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5876 mgmt_pending_remove(cmd);
c71593dd
JH		 5877 goto unlock;
5878 }
5879
5880 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 5881 err = cmd->cmd_complete(cmd,
5882 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5883 mgmt_pending_remove(cmd);
c71593dd
JH		 5884 goto unlock;
5885 }
5886
d1dbf12e 5887 list_del(&params->action);
c71593dd
JH		 5888 list_del(&params->list);
5889 kfree(params);
51ef3ebe 5890 __hci_update_background_scan(&req);
8afef092
MH		 5891
5892 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 5893 } else {
19de0825 5894 struct hci_conn_params *p, *tmp;
6659358e 5895 struct bdaddr_list *b, *btmp;
19de0825 5896
2faade53 5897 if (cp->addr.type) {
9df74653
JH		 5898 err = cmd->cmd_complete(cmd,
5899 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5900 mgmt_pending_remove(cmd);
2faade53
MH		 5901 goto unlock;
5902 }
5903
6659358e
JH		 5904 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5905 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5906 list_del(&b->list);
5907 kfree(b);
5908 }
5909
51ef3ebe 5910 __hci_update_page_scan(&req);
a397407f 5911
19de0825
JH		 5912 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5913 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5914 continue;
5915 device_removed(sk, hdev, &p->addr, p->addr_type);
5916 list_del(&p->action);
5917 list_del(&p->list);
5918 kfree(p);
5919 }
5920
5921 BT_DBG("All LE connection parameters were removed");
5922
51ef3ebe 5923 __hci_update_background_scan(&req);
2faade53
MH		 5924 }
5925
6659358e 5926complete:
51ef3ebe
JH		 5927 err = hci_req_run(&req, remove_device_complete);
5928 if (err < 0) {
5929 /* ENODATA means no HCI commands were needed (e.g. if
5930 * the adapter is powered off).
5931 */
9df74653
JH		 5932 if (err == -ENODATA)
5933 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 5934 mgmt_pending_remove(cmd);
5935 }
2faade53
MH		 5936
5937unlock:
5938 hci_dev_unlock(hdev);
5939 return err;
5940}
5941
a26f3dcf
JH		 5942static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5943 u16 len)
5944{
5945 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 5946 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5947 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 5948 u16 param_count, expected_len;
5949 int i;
5950
5951 if (!lmp_le_capable(hdev))
a69e8375
JH		 5952 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5953 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 5954
5955 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 5956 if (param_count > max_param_count) {
5957 BT_ERR("load_conn_param: too big param_count value %u",
5958 param_count);
a69e8375
JH		 5959 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5960 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5961 }
a26f3dcf
JH		 5962
5963 expected_len = sizeof(*cp) + param_count *
5964 sizeof(struct mgmt_conn_param);
5965 if (expected_len != len) {
5966 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5967 expected_len, len);
a69e8375
JH		 5968 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5969 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 5970 }
5971
5972 BT_DBG("%s param_count %u", hdev->name, param_count);
5973
5974 hci_dev_lock(hdev);
5975
5976 hci_conn_params_clear_disabled(hdev);
5977
5978 for (i = 0; i < param_count; i++) {
5979 struct mgmt_conn_param *param = &cp->params[i];
5980 struct hci_conn_params *hci_param;
5981 u16 min, max, latency, timeout;
5982 u8 addr_type;
5983
5984 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5985 param->addr.type);
5986
5987 if (param->addr.type == BDADDR_LE_PUBLIC) {
5988 addr_type = ADDR_LE_DEV_PUBLIC;
5989 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5990 addr_type = ADDR_LE_DEV_RANDOM;
5991 } else {
5992 BT_ERR("Ignoring invalid connection parameters");
5993 continue;
5994 }
5995
5996 min = le16_to_cpu(param->min_interval);
5997 max = le16_to_cpu(param->max_interval);
5998 latency = le16_to_cpu(param->latency);
5999 timeout = le16_to_cpu(param->timeout);
6000
6001 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6002 min, max, latency, timeout);
6003
6004 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6005 BT_ERR("Ignoring invalid connection parameters");
6006 continue;
6007 }
6008
6009 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6010 addr_type);
6011 if (!hci_param) {
6012 BT_ERR("Failed to add connection parameters");
6013 continue;
6014 }
6015
6016 hci_param->conn_min_interval = min;
6017 hci_param->conn_max_interval = max;
6018 hci_param->conn_latency = latency;
6019 hci_param->supervision_timeout = timeout;
6020 }
6021
6022 hci_dev_unlock(hdev);
6023
2a1afb5a
JH		 6024 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6025 NULL, 0);
a26f3dcf
JH		 6026}
6027
dbece37a
MH		 6028static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6029 void *data, u16 len)
6030{
6031 struct mgmt_cp_set_external_config *cp = data;
6032 bool changed;
6033 int err;
6034
6035 BT_DBG("%s", hdev->name);
6036
6037 if (hdev_is_powered(hdev))
a69e8375
JH		 6038 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6039 MGMT_STATUS_REJECTED);
dbece37a
MH		 6040
6041 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6042 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6043 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6044
6045 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6046 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6047 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6048
6049 hci_dev_lock(hdev);
6050
6051 if (cp->config)
238be788 6052 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6053 else
a69d8927 6054 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6055
6056 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6057 if (err < 0)
6058 goto unlock;
6059
6060 if (!changed)
6061 goto unlock;
6062
f4537c04
MH		 6063 err = new_options(hdev, sk);
6064
d7a5a11d 6065 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6066 mgmt_index_removed(hdev);
d603b76b 6067
516018a9 6068 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6069 hci_dev_set_flag(hdev, HCI_CONFIG);
6070 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6071
6072 queue_work(hdev->req_workqueue, &hdev->power_on);
6073 } else {
5ea234d3 6074 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6075 mgmt_index_added(hdev);
6076 }
dbece37a
MH		 6077 }
6078
6079unlock:
6080 hci_dev_unlock(hdev);
6081 return err;
6082}
6083
9713c17b
MH		 6084static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6085 void *data, u16 len)
6086{
6087 struct mgmt_cp_set_public_address *cp = data;
6088 bool changed;
6089 int err;
6090
6091 BT_DBG("%s", hdev->name);
6092
6093 if (hdev_is_powered(hdev))
a69e8375
JH		 6094 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6095 MGMT_STATUS_REJECTED);
9713c17b
MH		 6096
6097 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6098 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6099 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6100
6101 if (!hdev->set_bdaddr)
a69e8375
JH		 6102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6103 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6104
6105 hci_dev_lock(hdev);
6106
6107 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6108 bacpy(&hdev->public_addr, &cp->bdaddr);
6109
6110 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6111 if (err < 0)
6112 goto unlock;
6113
6114 if (!changed)
6115 goto unlock;
6116
d7a5a11d 6117 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6118 err = new_options(hdev, sk);
6119
6120 if (is_configured(hdev)) {
6121 mgmt_index_removed(hdev);
6122
a358dc11 6123 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6124
a1536da2
MH		 6125 hci_dev_set_flag(hdev, HCI_CONFIG);
6126 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6127
6128 queue_work(hdev->req_workqueue, &hdev->power_on);
6129 }
6130
6131unlock:
6132 hci_dev_unlock(hdev);
6133 return err;
6134}
6135
bea41609
MH		 6136static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6137 u8 data_len)
6138{
6139 eir[eir_len++] = sizeof(type) + data_len;
6140 eir[eir_len++] = type;
6141 memcpy(&eir[eir_len], data, data_len);
6142 eir_len += data_len;
6143
6144 return eir_len;
6145}
6146
4f0f155c
MH		 6147static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6148 void *data, u16 data_len)
6149{
6150 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6151 struct mgmt_rp_read_local_oob_ext_data *rp;
6152 size_t rp_len;
6153 u16 eir_len;
0821a2c5 6154 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6155 int err;
6156
6157 BT_DBG("%s", hdev->name);
6158
6159 if (!hdev_is_powered(hdev))
6160 return mgmt_cmd_complete(sk, hdev->id,
6161 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6162 MGMT_STATUS_NOT_POWERED,
6163 &cp->type, sizeof(cp->type));
6164
6165 switch (cp->type) {
6166 case BIT(BDADDR_BREDR):
6167 status = mgmt_bredr_support(hdev);
6168 if (status)
6169 return mgmt_cmd_complete(sk, hdev->id,
6170 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6171 status, &cp->type,
6172 sizeof(cp->type));
6173 eir_len = 5;
6174 break;
6175 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6176 status = mgmt_le_support(hdev);
6177 if (status)
6178 return mgmt_cmd_complete(sk, hdev->id,
6179 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6180 status, &cp->type,
6181 sizeof(cp->type));
0821a2c5 6182 eir_len = 9 + 3 + 18 + 18 + 3;
4f0f155c
MH		 6183 break;
6184 default:
6185 return mgmt_cmd_complete(sk, hdev->id,
6186 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6187 MGMT_STATUS_INVALID_PARAMS,
6188 &cp->type, sizeof(cp->type));
6189 }
6190
6191 hci_dev_lock(hdev);
6192
6193 rp_len = sizeof(*rp) + eir_len;
6194 rp = kmalloc(rp_len, GFP_ATOMIC);
6195 if (!rp) {
6196 hci_dev_unlock(hdev);
6197 return -ENOMEM;
6198 }
6199
6200 eir_len = 0;
6201 switch (cp->type) {
6202 case BIT(BDADDR_BREDR):
6203 eir_len = eir_append_data(rp->eir, eir_len, EIR_CLASS_OF_DEV,
6204 hdev->dev_class, 3);
6205 break;
6206 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6207 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6208 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5
MH		 6209 hci_dev_unlock(hdev);
6210 err = mgmt_cmd_complete(sk, hdev->id,
5082a599
MH		 6211 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
6212 MGMT_STATUS_FAILED,
6213 &cp->type, sizeof(cp->type));
0821a2c5
MH		 6214 goto done;
6215 }
6216
4f0f155c
MH		 6217 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6218 memcpy(addr, &hdev->rpa, 6);
6219 addr[6] = 0x01;
6220 } else if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6221 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6222 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6223 bacmp(&hdev->static_addr, BDADDR_ANY))) {
6224 memcpy(addr, &hdev->static_addr, 6);
6225 addr[6] = 0x01;
6226 } else {
6227 memcpy(addr, &hdev->bdaddr, 6);
6228 addr[6] = 0x00;
6229 }
6230
6231 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6232 addr, sizeof(addr));
6233
6234 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6235 role = 0x02;
6236 else
6237 role = 0x01;
6238
6239 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6240 &role, sizeof(role));
6241
5082a599
MH		 6242 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6243 eir_len = eir_append_data(rp->eir, eir_len,
6244 EIR_LE_SC_CONFIRM,
6245 hash, sizeof(hash));
0821a2c5 6246
5082a599
MH		 6247 eir_len = eir_append_data(rp->eir, eir_len,
6248 EIR_LE_SC_RANDOM,
6249 rand, sizeof(rand));
6250 }
0821a2c5 6251
4f0f155c
MH		 6252 flags = get_adv_discov_flags(hdev);
6253
6254 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6255 flags |= LE_AD_NO_BREDR;
6256
6257 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6258 &flags, sizeof(flags));
6259 break;
6260 }
6261
6262 rp->type = cp->type;
6263 rp->eir_len = cpu_to_le16(eir_len);
6264
6265 hci_dev_unlock(hdev);
6266
72000df2
MH		 6267 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6268
4f0f155c 6269 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
5425f98e 6270 MGMT_STATUS_SUCCESS, rp, sizeof(*rp) + eir_len);
72000df2
MH		 6271 if (err < 0)
6272 goto done;
6273
6274 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6275 rp, sizeof(*rp) + eir_len,
6276 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6277
0821a2c5 6278done:
4f0f155c
MH		 6279 kfree(rp);
6280
6281 return err;
6282}
6283
d3d5305b
MH		 6284static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6285 void *data, u16 data_len)
6286{
6287 struct mgmt_rp_read_adv_features *rp;
6288 size_t rp_len;
6289 int err;
6290
6291 BT_DBG("%s", hdev->name);
6292
6293 hci_dev_lock(hdev);
6294
6295 rp_len = sizeof(*rp);
6296 rp = kmalloc(rp_len, GFP_ATOMIC);
6297 if (!rp) {
6298 hci_dev_unlock(hdev);
6299 return -ENOMEM;
6300 }
6301
6302 rp->supported_flags = cpu_to_le32(0);
6303 rp->max_adv_data_len = 31;
6304 rp->max_scan_rsp_len = 31;
6305 rp->max_instances = 0;
6306 rp->num_instances = 0;
6307
6308 hci_dev_unlock(hdev);
6309
6310 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6311 MGMT_STATUS_SUCCESS, rp, rp_len);
6312
6313 kfree(rp);
6314
6315 return err;
6316}
6317
6d785aa3 6318static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 6319 { NULL }, /* 0x0000 (no command) */
b9a245fb 6320 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 6321 HCI_MGMT_NO_HDEV |
6322 HCI_MGMT_UNTRUSTED },
b9a245fb 6323 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 6324 HCI_MGMT_NO_HDEV |
6325 HCI_MGMT_UNTRUSTED },
b9a245fb 6326 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 6327 HCI_MGMT_NO_HDEV |
6328 HCI_MGMT_UNTRUSTED },
6329 { read_controller_info, MGMT_READ_INFO_SIZE,
6330 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 6331 { set_powered, MGMT_SETTING_SIZE },
6332 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
6333 { set_connectable, MGMT_SETTING_SIZE },
6334 { set_fast_connectable, MGMT_SETTING_SIZE },
6335 { set_bondable, MGMT_SETTING_SIZE },
6336 { set_link_security, MGMT_SETTING_SIZE },
6337 { set_ssp, MGMT_SETTING_SIZE },
6338 { set_hs, MGMT_SETTING_SIZE },
6339 { set_le, MGMT_SETTING_SIZE },
6340 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
6341 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
6342 { add_uuid, MGMT_ADD_UUID_SIZE },
6343 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 6344 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6345 HCI_MGMT_VAR_LEN },
6346 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6347 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6348 { disconnect, MGMT_DISCONNECT_SIZE },
6349 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
6350 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
6351 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6352 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
6353 { pair_device, MGMT_PAIR_DEVICE_SIZE },
6354 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6355 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
6356 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
6357 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6358 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
6359 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 6360 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6361 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6362 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6363 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6364 { start_discovery, MGMT_START_DISCOVERY_SIZE },
6365 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
6366 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
6367 { block_device, MGMT_BLOCK_DEVICE_SIZE },
6368 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
6369 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
6370 { set_advertising, MGMT_SETTING_SIZE },
6371 { set_bredr, MGMT_SETTING_SIZE },
6372 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
6373 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
6374 { set_secure_conn, MGMT_SETTING_SIZE },
6375 { set_debug_keys, MGMT_SETTING_SIZE },
6376 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 6377 { load_irks, MGMT_LOAD_IRKS_SIZE,
6378 HCI_MGMT_VAR_LEN },
7aea8616
MH		 6379 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
6380 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
6381 { add_device, MGMT_ADD_DEVICE_SIZE },
6382 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 6383 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6384 HCI_MGMT_VAR_LEN },
6385 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 6386 HCI_MGMT_NO_HDEV |
6387 HCI_MGMT_UNTRUSTED },
b9a245fb 6388 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 6389 HCI_MGMT_UNCONFIGURED |
6390 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 6391 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6392 HCI_MGMT_UNCONFIGURED },
6393 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6394 HCI_MGMT_UNCONFIGURED },
6395 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6396 HCI_MGMT_VAR_LEN },
4f0f155c 6397 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 6398 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 6399 HCI_MGMT_NO_HDEV |
6400 HCI_MGMT_UNTRUSTED },
d3d5305b 6401 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
0f4e68cf
JH		 6402};
6403
6d785aa3
JH		 6404int mgmt_control(struct hci_mgmt_chan *chan, struct sock *sk,
6405 struct msghdr *msg, size_t msglen)
0381101f 6406{
650f726d
VCG		 6407 void *buf;
6408 u8 *cp;
0381101f 6409 struct mgmt_hdr *hdr;
4e51eae9 6410 u16 opcode, index, len;
bdb6d971 6411 struct hci_dev *hdev = NULL;
6d785aa3 6412 const struct hci_mgmt_handler *handler;
b9a245fb 6413 bool var_len, no_hdev;
0381101f
JH		 6414 int err;
6415
6416 BT_DBG("got %zu bytes", msglen);
6417
6418 if (msglen < sizeof(*hdr))
6419 return -EINVAL;
6420
e63a15ec 6421 buf = kmalloc(msglen, GFP_KERNEL);
0381101f
JH		 6422 if (!buf)
6423 return -ENOMEM;
6424
6ce8e9ce 6425 if (memcpy_from_msg(buf, msg, msglen)) {
0381101f
JH		 6426 err = -EFAULT;
6427 goto done;
6428 }
6429
650f726d 6430 hdr = buf;
1f350c87
MH		 6431 opcode = __le16_to_cpu(hdr->opcode);
6432 index = __le16_to_cpu(hdr->index);
6433 len = __le16_to_cpu(hdr->len);
0381101f
JH		 6434
6435 if (len != msglen - sizeof(*hdr)) {
6436 err = -EINVAL;
6437 goto done;
6438 }
6439
b9a245fb
JH		 6440 if (opcode >= chan->handler_count ||
6441 chan->handlers[opcode].func == NULL) {
6442 BT_DBG("Unknown op %u", opcode);
a69e8375
JH		 6443 err = mgmt_cmd_status(sk, index, opcode,
6444 MGMT_STATUS_UNKNOWN_COMMAND);
b9a245fb
JH		 6445 goto done;
6446 }
6447
6448 handler = &chan->handlers[opcode];
6449
c927a104
MH		 6450 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
6451 !(handler->flags & HCI_MGMT_UNTRUSTED)) {
6452 err = mgmt_cmd_status(sk, index, opcode,
6453 MGMT_STATUS_PERMISSION_DENIED);
6454 goto done;
6455 }
6456
0f4e68cf 6457 if (index != MGMT_INDEX_NONE) {
bdb6d971
JH		 6458 hdev = hci_dev_get(index);
6459 if (!hdev) {
a69e8375
JH		 6460 err = mgmt_cmd_status(sk, index, opcode,
6461 MGMT_STATUS_INVALID_INDEX);
bdb6d971
JH		 6462 goto done;
6463 }
0736cfa8 6464
d7a5a11d
MH		 6465 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
6466 hci_dev_test_flag(hdev, HCI_CONFIG) ||
6467 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
a69e8375
JH		 6468 err = mgmt_cmd_status(sk, index, opcode,
6469 MGMT_STATUS_INVALID_INDEX);
0736cfa8
MH		 6470 goto done;
6471 }
42a9bc14 6472
d7a5a11d 6473 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
b9a245fb 6474 !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
a69e8375
JH		 6475 err = mgmt_cmd_status(sk, index, opcode,
6476 MGMT_STATUS_INVALID_INDEX);
42a9bc14
MH		 6477 goto done;
6478 }
bdb6d971
JH		 6479 }
6480
b9a245fb
JH		 6481 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
6482 if (no_hdev != !hdev) {
a69e8375
JH		 6483 err = mgmt_cmd_status(sk, index, opcode,
6484 MGMT_STATUS_INVALID_INDEX);
0f4e68cf 6485 goto done;
0381101f
JH		 6486 }
6487
b9a245fb
JH		 6488 var_len = (handler->flags & HCI_MGMT_VAR_LEN);
6489 if ((var_len && len < handler->data_len) ||
6490 (!var_len && len != handler->data_len)) {
a69e8375
JH		 6491 err = mgmt_cmd_status(sk, index, opcode,
6492 MGMT_STATUS_INVALID_PARAMS);
be22b54e
JH		 6493 goto done;
6494 }
6495
0f4e68cf
JH		 6496 if (hdev)
6497 mgmt_init_hdev(sk, hdev);
6498
6499 cp = buf + sizeof(*hdr);
6500
be22b54e 6501 err = handler->func(sk, hdev, cp, len);
e41d8b4e
JH		 6502 if (err < 0)
6503 goto done;
6504
0381101f
JH		 6505 err = msglen;
6506
6507done:
bdb6d971
JH		 6508 if (hdev)
6509 hci_dev_put(hdev);
6510
0381101f
JH		 6511 kfree(buf);
6512 return err;
6513}
c71e97bf 6514
bf6b56db 6515void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 6516{
ced85549 6517 struct mgmt_ev_ext_index ev;
bb4b2a9a 6518
0602a8ad
MH		 6519 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6520 return;
6521
f9207338
MH		 6522 switch (hdev->dev_type) {
6523 case HCI_BREDR:
6524 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6525 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
6526 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 6527 ev.type = 0x01;
f9207338
MH		 6528 } else {
6529 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
6530 HCI_MGMT_INDEX_EVENTS);
ced85549 6531 ev.type = 0x00;
f9207338
MH		 6532 }
6533 break;
ced85549
MH		 6534 case HCI_AMP:
6535 ev.type = 0x02;
6536 break;
6537 default:
6538 return;
f9207338 6539 }
ced85549
MH		 6540
6541 ev.bus = hdev->bus;
6542
6543 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
6544 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 6545}
6546
bf6b56db 6547void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 6548{
ced85549 6549 struct mgmt_ev_ext_index ev;
5f159032 6550 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 6551
0602a8ad
MH		 6552 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6553 return;
6554
f9207338
MH		 6555 switch (hdev->dev_type) {
6556 case HCI_BREDR:
6557 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 6558
f9207338
MH		 6559 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6560 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
6561 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 6562 ev.type = 0x01;
f9207338
MH		 6563 } else {
6564 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
6565 HCI_MGMT_INDEX_EVENTS);
ced85549 6566 ev.type = 0x00;
f9207338
MH		 6567 }
6568 break;
ced85549
MH		 6569 case HCI_AMP:
6570 ev.type = 0x02;
6571 break;
6572 default:
6573 return;
f9207338 6574 }
ced85549
MH		 6575
6576 ev.bus = hdev->bus;
6577
6578 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
6579 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 6580}
6581
6046dc3e 6582/* This function requires the caller holds hdev->lock */
2cf22218 6583static void restart_le_actions(struct hci_request *req)
6046dc3e 6584{
2cf22218 6585 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 6586 struct hci_conn_params *p;
6587
6588 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 6589 /* Needed for AUTO_OFF case where might not "really"
6590 * have been powered off.
6591 */
6592 list_del_init(&p->action);
6593
6594 switch (p->auto_connect) {
4b9e7e75 6595 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 6596 case HCI_AUTO_CONN_ALWAYS:
6597 list_add(&p->action, &hdev->pend_le_conns);
6598 break;
6599 case HCI_AUTO_CONN_REPORT:
6600 list_add(&p->action, &hdev->pend_le_reports);
6601 break;
6602 default:
6603 break;
c83ed19d 6604 }
6046dc3e 6605 }
c83ed19d 6606
2cf22218 6607 __hci_update_background_scan(req);
6046dc3e
AG		 6608}
6609
1904a853 6610static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 6611{
6612 struct cmd_lookup match = { NULL, hdev };
6613
6614 BT_DBG("status 0x%02x", status);
6615
162a3bac
MH		 6616 if (!status) {
6617 /* Register the available SMP channels (BR/EDR and LE) only
6618 * when successfully powering on the controller. This late
6619 * registration is required so that LE SMP can clearly
6620 * decide if the public address or static address is used.
6621 */
6622 smp_register(hdev);
6623 }
6624
229ab39c
JH		 6625 hci_dev_lock(hdev);
6626
6627 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6628
6629 new_settings(hdev, match.sk);
6630
6631 hci_dev_unlock(hdev);
6632
6633 if (match.sk)
6634 sock_put(match.sk);
6635}
6636
70da6243 6637static int powered_update_hci(struct hci_dev *hdev)
5add6af8 6638{
890ea898 6639 struct hci_request req;
70da6243 6640 u8 link_sec;
5add6af8 6641
890ea898
JH		 6642 hci_req_init(&req, hdev);
6643
d7a5a11d 6644 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 6645 !lmp_host_ssp_capable(hdev)) {
574ea3c7 6646 u8 mode = 0x01;
5e5282bb 6647
574ea3c7
MH		 6648 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6649
6650 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6651 u8 support = 0x01;
5add6af8 6652
574ea3c7
MH		 6653 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6654 sizeof(support), &support);
6655 }
ec6f99b8
JH		 6656 }
6657
d7a5a11d 6658 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 6659 lmp_bredr_capable(hdev)) {
70da6243 6660 struct hci_cp_write_le_host_supported cp;
f0ff92fb 6661
32226e4f
MH		 6662 cp.le = 0x01;
6663 cp.simul = 0x00;
3d1cbdd6 6664
70da6243
JH		 6665 /* Check first if we already have the right
6666 * host state (host features set)
6667 */
6668 if (cp.le != lmp_host_le_capable(hdev) ||
6669 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 6670 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6671 sizeof(cp), &cp);
70da6243 6672 }
3d1cbdd6 6673
d13eafce 6674 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 6675 /* Make sure the controller has a good default for
6676 * advertising data. This also applies to the case
6677 * where BR/EDR was toggled during the AUTO_OFF phase.
6678 */
d7a5a11d 6679 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
5947f4bc 6680 update_adv_data(&req);
f14d8f64
MH		 6681 update_scan_rsp_data(&req);
6682 }
441ad2d0 6683
d7a5a11d 6684 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
bba3aa55 6685 enable_advertising(&req);
2cf22218
JH		 6686
6687 restart_le_actions(&req);
eeca6f89
JH		 6688 }
6689
d7a5a11d 6690 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 6691 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 6692 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6693 sizeof(link_sec), &link_sec);
562fcc24 6694
70da6243 6695 if (lmp_bredr_capable(hdev)) {
d7a5a11d 6696 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 6697 write_fast_connectable(&req, true);
6698 else
6699 write_fast_connectable(&req, false);
1d2dc5b7 6700 __hci_update_page_scan(&req);
890ea898 6701 update_class(&req);
13928971 6702 update_name(&req);
890ea898 6703 update_eir(&req);
70da6243 6704 }
562fcc24 6705
229ab39c 6706 return hci_req_run(&req, powered_complete);
70da6243 6707}
562fcc24 6708
70da6243
JH		 6709int mgmt_powered(struct hci_dev *hdev, u8 powered)
6710{
6711 struct cmd_lookup match = { NULL, hdev };
9845904f 6712 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 6713 int err;
f0ff92fb 6714
d7a5a11d 6715 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 6716 return 0;
6717
70da6243 6718 if (powered) {
229ab39c
JH		 6719 if (powered_update_hci(hdev) == 0)
6720 return 0;
fe038884 6721
229ab39c
JH		 6722 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6723 &match);
6724 goto new_settings;
b24752fe
JH		 6725 }
6726
229ab39c 6727 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 6728
6729 /* If the power off is because of hdev unregistration let
6730 * use the appropriate INVALID_INDEX status. Otherwise use
6731 * NOT_POWERED. We cover both scenarios here since later in
6732 * mgmt_index_removed() any hci_conn callbacks will have already
6733 * been triggered, potentially causing misleading DISCONNECTED
6734 * status responses.
6735 */
d7a5a11d 6736 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 6737 status = MGMT_STATUS_INVALID_INDEX;
6738 else
6739 status = MGMT_STATUS_NOT_POWERED;
6740
6741 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 6742
6743 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 6744 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6745 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 6746
6747new_settings:
beadb2bd 6748 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 6749
6750 if (match.sk)
6751 sock_put(match.sk);
6752
7bb895d6 6753 return err;
5add6af8 6754}
73f22f62 6755
3eec705e 6756void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 6757{
3b0602cd 6758 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 6759 u8 status;
6760
333ae95d 6761 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 6762 if (!cmd)
3eec705e 6763 return;
96570ffc
JH		 6764
6765 if (err == -ERFKILL)
6766 status = MGMT_STATUS_RFKILLED;
6767 else
6768 status = MGMT_STATUS_FAILED;
6769
a69e8375 6770 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 6771
6772 mgmt_pending_remove(cmd);
96570ffc
JH		 6773}
6774
d1967ff8
MH		 6775void mgmt_discoverable_timeout(struct hci_dev *hdev)
6776{
6777 struct hci_request req;
d1967ff8
MH		 6778
6779 hci_dev_lock(hdev);
6780
6781 /* When discoverable timeout triggers, then just make sure
6782 * the limited discoverable flag is cleared. Even in the case
6783 * of a timeout triggered from general discoverable, it is
6784 * safe to unconditionally clear the flag.
6785 */
a358dc11
MH		 6786 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
6787 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 6788
6789 hci_req_init(&req, hdev);
d7a5a11d 6790 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 6791 u8 scan = SCAN_PAGE;
6792 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6793 sizeof(scan), &scan);
6794 }
d1967ff8 6795 update_class(&req);
9a43e25f 6796 update_adv_data(&req);
d1967ff8
MH		 6797 hci_req_run(&req, NULL);
6798
6799 hdev->discov_timeout = 0;
6800
9a43e25f
JH		 6801 new_settings(hdev, NULL);
6802
d1967ff8
MH		 6803 hci_dev_unlock(hdev);
6804}
6805
dc4a5ee2
MH		 6806void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6807 bool persistent)
55ed8ca1 6808{
86742e1e 6809 struct mgmt_ev_new_link_key ev;
55ed8ca1 6810
a492cd52 6811 memset(&ev, 0, sizeof(ev));
55ed8ca1 6812
a492cd52 6813 ev.store_hint = persistent;
d753fdc4 6814 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 6815 ev.key.addr.type = BDADDR_BREDR;
a492cd52 6816 ev.key.type = key->type;
9b3b4460 6817 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 6818 ev.key.pin_len = key->pin_len;
55ed8ca1 6819
dc4a5ee2 6820 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 6821}
f7520543 6822
d7b25450
JH		 6823static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6824{
23fb8de3
JH		 6825 switch (ltk->type) {
6826 case SMP_LTK:
6827 case SMP_LTK_SLAVE:
6828 if (ltk->authenticated)
6829 return MGMT_LTK_AUTHENTICATED;
6830 return MGMT_LTK_UNAUTHENTICATED;
6831 case SMP_LTK_P256:
6832 if (ltk->authenticated)
6833 return MGMT_LTK_P256_AUTH;
6834 return MGMT_LTK_P256_UNAUTH;
6835 case SMP_LTK_P256_DEBUG:
6836 return MGMT_LTK_P256_DEBUG;
6837 }
d7b25450
JH		 6838
6839 return MGMT_LTK_UNAUTHENTICATED;
6840}
6841
53ac6ab6 6842void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 6843{
6844 struct mgmt_ev_new_long_term_key ev;
6845
6846 memset(&ev, 0, sizeof(ev));
6847
5192d301
MH		 6848 /* Devices using resolvable or non-resolvable random addresses
6849 * without providing an indentity resolving key don't require
6850 * to store long term keys. Their addresses will change the
6851 * next time around.
6852 *
6853 * Only when a remote device provides an identity address
6854 * make sure the long term key is stored. If the remote
6855 * identity is known, the long term keys are internally
6856 * mapped to the identity address. So allow static random
6857 * and public addresses here.
6858 */
ba74b666
JH		 6859 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6860 (key->bdaddr.b[5] & 0xc0) != 0xc0)
6861 ev.store_hint = 0x00;
6862 else
53ac6ab6 6863 ev.store_hint = persistent;
ba74b666 6864
346af67b 6865 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 6866 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 6867 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 6868 ev.key.enc_size = key->enc_size;
6869 ev.key.ediv = key->ediv;
fe39c7b2 6870 ev.key.rand = key->rand;
346af67b 6871
2ceba539 6872 if (key->type == SMP_LTK)
346af67b
VCG		 6873 ev.key.master = 1;
6874
346af67b
VCG		 6875 memcpy(ev.key.val, key->val, sizeof(key->val));
6876
083368f7 6877 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 6878}
6879
95fbac8a
JH		 6880void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6881{
6882 struct mgmt_ev_new_irk ev;
6883
6884 memset(&ev, 0, sizeof(ev));
6885
bab6d1e5
MH		 6886 /* For identity resolving keys from devices that are already
6887 * using a public address or static random address, do not
6888 * ask for storing this key. The identity resolving key really
6889 * is only mandatory for devices using resovlable random
6890 * addresses.
6891 *
6892 * Storing all identity resolving keys has the downside that
6893 * they will be also loaded on next boot of they system. More
6894 * identity resolving keys, means more time during scanning is
6895 * needed to actually resolve these addresses.
6896 */
6897 if (bacmp(&irk->rpa, BDADDR_ANY))
6898 ev.store_hint = 0x01;
6899 else
6900 ev.store_hint = 0x00;
6901
95fbac8a
JH		 6902 bacpy(&ev.rpa, &irk->rpa);
6903 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6904 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6905 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6906
6907 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6908}
6909
53ac6ab6
MH		 6910void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6911 bool persistent)
7ee4ea36
MH		 6912{
6913 struct mgmt_ev_new_csrk ev;
6914
6915 memset(&ev, 0, sizeof(ev));
6916
6917 /* Devices using resolvable or non-resolvable random addresses
6918 * without providing an indentity resolving key don't require
6919 * to store signature resolving keys. Their addresses will change
6920 * the next time around.
6921 *
6922 * Only when a remote device provides an identity address
6923 * make sure the signature resolving key is stored. So allow
6924 * static random and public addresses here.
6925 */
6926 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6927 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6928 ev.store_hint = 0x00;
6929 else
53ac6ab6 6930 ev.store_hint = persistent;
7ee4ea36
MH		 6931
6932 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6933 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 6934 ev.key.type = csrk->type;
7ee4ea36
MH		 6935 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6936
6937 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6938}
6939
ffb5a827 6940void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 6941 u8 bdaddr_type, u8 store_hint, u16 min_interval,
6942 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 6943{
6944 struct mgmt_ev_new_conn_param ev;
6945
c103aea6
JH		 6946 if (!hci_is_identity_address(bdaddr, bdaddr_type))
6947 return;
6948
ffb5a827
AG		 6949 memset(&ev, 0, sizeof(ev));
6950 bacpy(&ev.addr.bdaddr, bdaddr);
6951 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 6952 ev.store_hint = store_hint;
ffb5a827
AG		 6953 ev.min_interval = cpu_to_le16(min_interval);
6954 ev.max_interval = cpu_to_le16(max_interval);
6955 ev.latency = cpu_to_le16(latency);
6956 ev.timeout = cpu_to_le16(timeout);
6957
6958 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6959}
6960
48ec92fa
AA		 6961void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6962 u32 flags, u8 *name, u8 name_len)
f7520543 6963{
b644ba33
JH		 6964 char buf[512];
6965 struct mgmt_ev_device_connected *ev = (void *) buf;
6966 u16 eir_len = 0;
f7520543 6967
48ec92fa
AA		 6968 bacpy(&ev->addr.bdaddr, &conn->dst);
6969 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 6970
c95f0ba7 6971 ev->flags = __cpu_to_le32(flags);
08c79b61 6972
fd45ada9
AA		 6973 /* We must ensure that the EIR Data fields are ordered and
6974 * unique. Keep it simple for now and avoid the problem by not
6975 * adding any BR/EDR data to the LE adv.
6976 */
6977 if (conn->le_adv_data_len > 0) {
6978 memcpy(&ev->eir[eir_len],
6979 conn->le_adv_data, conn->le_adv_data_len);
6980 eir_len = conn->le_adv_data_len;
6981 } else {
6982 if (name_len > 0)
6983 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6984 name, name_len);
b644ba33 6985
ddbea5cf 6986 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 6987 eir_len = eir_append_data(ev->eir, eir_len,
6988 EIR_CLASS_OF_DEV,
6989 conn->dev_class, 3);
6990 }
b644ba33 6991
eb55ef07 6992 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 6993
ecd90ae7
MH		 6994 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6995 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 6996}
6997
3b0602cd 6998static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 6999{
8962ee74 7000 struct sock **sk = data;
8962ee74 7001
f5818c22 7002 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7003
7004 *sk = cmd->sk;
7005 sock_hold(*sk);
7006
a664b5bc 7007 mgmt_pending_remove(cmd);
8962ee74
JH		 7008}
7009
3b0602cd 7010static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7011{
b1078ad0 7012 struct hci_dev *hdev = data;
124f6e35 7013 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7014
b1078ad0
JH		 7015 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7016
d8b7b1e4 7017 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7018 mgmt_pending_remove(cmd);
7019}
7020
84c61d92
JH		 7021bool mgmt_powering_down(struct hci_dev *hdev)
7022{
3b0602cd 7023 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 7024 struct mgmt_mode *cp;
7025
333ae95d 7026 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 7027 if (!cmd)
7028 return false;
7029
7030 cp = cmd->param;
7031 if (!cp->val)
7032 return true;
7033
7034 return false;
7035}
7036
9b80ec5e 7037void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 7038 u8 link_type, u8 addr_type, u8 reason,
7039 bool mgmt_connected)
f7520543 7040{
f0d6a0ea 7041 struct mgmt_ev_device_disconnected ev;
8962ee74 7042 struct sock *sk = NULL;
8962ee74 7043
84c61d92
JH		 7044 /* The connection is still in hci_conn_hash so test for 1
7045 * instead of 0 to know if this is the last one.
7046 */
7047 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7048 cancel_delayed_work(&hdev->power_off);
7049 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 7050 }
7051
12d4a3b2
JH		 7052 if (!mgmt_connected)
7053 return;
7054
57eb776f
AG		 7055 if (link_type != ACL_LINK && link_type != LE_LINK)
7056 return;
7057
744cf19e 7058 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 7059
f0d6a0ea
MA		 7060 bacpy(&ev.addr.bdaddr, bdaddr);
7061 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7062 ev.reason = reason;
f7520543 7063
9b80ec5e 7064 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 7065
7066 if (sk)
d97dcb66 7067 sock_put(sk);
8962ee74 7068
124f6e35 7069 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 7070 hdev);
8962ee74
JH		 7071}
7072
7892924c
MH		 7073void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7074 u8 link_type, u8 addr_type, u8 status)
8962ee74 7075{
3655bba8
AG		 7076 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7077 struct mgmt_cp_disconnect *cp;
3b0602cd 7078 struct mgmt_pending_cmd *cmd;
8962ee74 7079
36a75f1b
JD		 7080 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7081 hdev);
7082
333ae95d 7083 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 7084 if (!cmd)
7892924c 7085 return;
8962ee74 7086
3655bba8
AG		 7087 cp = cmd->param;
7088
7089 if (bacmp(bdaddr, &cp->addr.bdaddr))
7090 return;
7091
7092 if (cp->addr.type != bdaddr_type)
7093 return;
7094
f5818c22 7095 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7096 mgmt_pending_remove(cmd);
f7520543 7097}
17d5c04c 7098
445608d0
MH		 7099void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7100 u8 addr_type, u8 status)
17d5c04c
JH		 7101{
7102 struct mgmt_ev_connect_failed ev;
c9910d0f 7103
84c61d92
JH		 7104 /* The connection is still in hci_conn_hash so test for 1
7105 * instead of 0 to know if this is the last one.
7106 */
7107 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7108 cancel_delayed_work(&hdev->power_off);
7109 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 7110 }
17d5c04c 7111
4c659c39 7112 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7113 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 7114 ev.status = mgmt_status(status);
17d5c04c 7115
445608d0 7116 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 7117}
980e1a53 7118
ce0e4a0d 7119void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 7120{
7121 struct mgmt_ev_pin_code_request ev;
7122
d8457698 7123 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 7124 ev.addr.type = BDADDR_BREDR;
a770bb5a 7125 ev.secure = secure;
980e1a53 7126
ce0e4a0d 7127 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 7128}
7129
e669cf80
MH		 7130void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7131 u8 status)
980e1a53 7132{
3b0602cd 7133 struct mgmt_pending_cmd *cmd;
980e1a53 7134
333ae95d 7135 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 7136 if (!cmd)
e669cf80 7137 return;
980e1a53 7138
7776d1d8 7139 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7140 mgmt_pending_remove(cmd);
980e1a53
JH		 7141}
7142
3eb38528
MH		 7143void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7144 u8 status)
980e1a53 7145{
3b0602cd 7146 struct mgmt_pending_cmd *cmd;
980e1a53 7147
333ae95d 7148 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 7149 if (!cmd)
3eb38528 7150 return;
980e1a53 7151
7776d1d8 7152 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7153 mgmt_pending_remove(cmd);
980e1a53 7154}
a5c29683 7155
744cf19e 7156int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 7157 u8 link_type, u8 addr_type, u32 value,
04124681 7158 u8 confirm_hint)
a5c29683
JH		 7159{
7160 struct mgmt_ev_user_confirm_request ev;
7161
744cf19e 7162 BT_DBG("%s", hdev->name);
a5c29683 7163
272d90df 7164 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7165 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 7166 ev.confirm_hint = confirm_hint;
39adbffe 7167 ev.value = cpu_to_le32(value);
a5c29683 7168
744cf19e 7169 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 7170 NULL);
a5c29683
JH		 7171}
7172
272d90df 7173int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 7174 u8 link_type, u8 addr_type)
604086b7
BG		 7175{
7176 struct mgmt_ev_user_passkey_request ev;
7177
7178 BT_DBG("%s", hdev->name);
7179
272d90df 7180 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7181 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 7182
7183 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 7184 NULL);
604086b7
BG		 7185}
7186
0df4c185 7187static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 7188 u8 link_type, u8 addr_type, u8 status,
7189 u8 opcode)
a5c29683 7190{
3b0602cd 7191 struct mgmt_pending_cmd *cmd;
a5c29683 7192
333ae95d 7193 cmd = pending_find(opcode, hdev);
a5c29683
JH		 7194 if (!cmd)
7195 return -ENOENT;
7196
7776d1d8 7197 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7198 mgmt_pending_remove(cmd);
a5c29683 7199
7776d1d8 7200 return 0;
a5c29683
JH		 7201}
7202
744cf19e 7203int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7204 u8 link_type, u8 addr_type, u8 status)
a5c29683 7205{
272d90df 7206 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 7207 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 7208}
7209
272d90df 7210int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7211 u8 link_type, u8 addr_type, u8 status)
a5c29683 7212{
272d90df 7213 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 7214 status,
7215 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 7216}
2a611692 7217
604086b7 7218int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7219 u8 link_type, u8 addr_type, u8 status)
604086b7 7220{
272d90df 7221 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 7222 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 7223}
7224
272d90df 7225int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 7226 u8 link_type, u8 addr_type, u8 status)
604086b7 7227{
272d90df 7228 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 7229 status,
7230 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 7231}
7232
92a25256
JH		 7233int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7234 u8 link_type, u8 addr_type, u32 passkey,
7235 u8 entered)
7236{
7237 struct mgmt_ev_passkey_notify ev;
7238
7239 BT_DBG("%s", hdev->name);
7240
7241 bacpy(&ev.addr.bdaddr, bdaddr);
7242 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7243 ev.passkey = __cpu_to_le32(passkey);
7244 ev.entered = entered;
7245
7246 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7247}
7248
e1e930f5 7249void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 7250{
7251 struct mgmt_ev_auth_failed ev;
3b0602cd 7252 struct mgmt_pending_cmd *cmd;
e1e930f5 7253 u8 status = mgmt_status(hci_status);
2a611692 7254
e1e930f5
JH		 7255 bacpy(&ev.addr.bdaddr, &conn->dst);
7256 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7257 ev.status = status;
2a611692 7258
e1e930f5
JH		 7259 cmd = find_pairing(conn);
7260
7261 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7262 cmd ? cmd->sk : NULL);
7263
a511b35b
JH		 7264 if (cmd) {
7265 cmd->cmd_complete(cmd, status);
7266 mgmt_pending_remove(cmd);
7267 }
2a611692 7268}
b312b161 7269
464996ae 7270void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 7271{
7272 struct cmd_lookup match = { NULL, hdev };
464996ae 7273 bool changed;
33ef95ed
JH		 7274
7275 if (status) {
7276 u8 mgmt_err = mgmt_status(status);
7277 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 7278 cmd_status_rsp, &mgmt_err);
464996ae 7279 return;
33ef95ed
JH		 7280 }
7281
464996ae 7282 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 7283 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 7284 else
a69d8927 7285 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 7286
33ef95ed 7287 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 7288 &match);
33ef95ed 7289
47990ea0 7290 if (changed)
464996ae 7291 new_settings(hdev, match.sk);
33ef95ed
JH		 7292
7293 if (match.sk)
7294 sock_put(match.sk);
33ef95ed
JH		 7295}
7296
890ea898 7297static void clear_eir(struct hci_request *req)
cacaf52f 7298{
890ea898 7299 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 7300 struct hci_cp_write_eir cp;
7301
976eb20e 7302 if (!lmp_ext_inq_capable(hdev))
890ea898 7303 return;
cacaf52f 7304
c80da27e
JH		 7305 memset(hdev->eir, 0, sizeof(hdev->eir));
7306
cacaf52f
JH		 7307 memset(&cp, 0, sizeof(cp));
7308
890ea898 7309 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 7310}
7311
3e248560 7312void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 7313{
7314 struct cmd_lookup match = { NULL, hdev };
890ea898 7315 struct hci_request req;
c0ecddc2 7316 bool changed = false;
ed2c4ee3
JH		 7317
7318 if (status) {
7319 u8 mgmt_err = mgmt_status(status);
c0ecddc2 7320
a69d8927
MH		 7321 if (enable && hci_dev_test_and_clear_flag(hdev,
7322 HCI_SSP_ENABLED)) {
a358dc11 7323 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 7324 new_settings(hdev, NULL);
9ecb3e24 7325 }
c0ecddc2 7326
04124681
GP		 7327 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7328 &mgmt_err);
3e248560 7329 return;
c0ecddc2
JH		 7330 }
7331
7332 if (enable) {
238be788 7333 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 7334 } else {
a69d8927 7335 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 7336 if (!changed)
a69d8927
MH		 7337 changed = hci_dev_test_and_clear_flag(hdev,
7338 HCI_HS_ENABLED);
9ecb3e24 7339 else
a358dc11 7340 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 7341 }
7342
7343 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7344
c0ecddc2 7345 if (changed)
3e248560 7346 new_settings(hdev, match.sk);
ed2c4ee3 7347
5fc6ebb1 7348 if (match.sk)
ed2c4ee3
JH		 7349 sock_put(match.sk);
7350
890ea898
JH		 7351 hci_req_init(&req, hdev);
7352
d7a5a11d
MH		 7353 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
7354 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 7355 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7356 sizeof(enable), &enable);
890ea898 7357 update_eir(&req);
3769972b 7358 } else {
890ea898 7359 clear_eir(&req);
3769972b 7360 }
890ea898
JH		 7361
7362 hci_req_run(&req, NULL);
ed2c4ee3
JH		 7363}
7364
3b0602cd 7365static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 7366{
7367 struct cmd_lookup *match = data;
7368
90e70454
JH		 7369 if (match->sk == NULL) {
7370 match->sk = cmd->sk;
7371 sock_hold(match->sk);
7372 }
90e70454
JH		 7373}
7374
4e1b0245
MH		 7375void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7376 u8 status)
7f9a903c 7377{
90e70454 7378 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 7379
92da6097
JH		 7380 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7381 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7382 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 7383
7384 if (!status)
f6b7712e
MH		 7385 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7386 dev_class, 3, NULL);
90e70454
JH		 7387
7388 if (match.sk)
7389 sock_put(match.sk);
7f9a903c
MH		 7390}
7391
7667da34 7392void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 7393{
b312b161 7394 struct mgmt_cp_set_local_name ev;
3b0602cd 7395 struct mgmt_pending_cmd *cmd;
28cc7bde 7396
13928971 7397 if (status)
7667da34 7398 return;
b312b161
JH		 7399
7400 memset(&ev, 0, sizeof(ev));
7401 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 7402 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 7403
333ae95d 7404 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 7405 if (!cmd) {
7406 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 7407
13928971
JH		 7408 /* If this is a HCI command related to powering on the
7409 * HCI dev don't send any mgmt signals.
7410 */
333ae95d 7411 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 7412 return;
890ea898 7413 }
b312b161 7414
f6b7712e
MH		 7415 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7416 cmd ? cmd->sk : NULL);
b312b161 7417}
c35938b2 7418
4d2d2796 7419void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
38da1703
JH		 7420 u8 *rand192, u8 *hash256, u8 *rand256,
7421 u8 status)
c35938b2 7422{
3b0602cd 7423 struct mgmt_pending_cmd *cmd;
c35938b2 7424
744cf19e 7425 BT_DBG("%s status %u", hdev->name, status);
c35938b2 7426
333ae95d 7427 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 7428 if (!cmd)
3edaf092 7429 return;
c35938b2
SJ		 7430
7431 if (status) {
a69e8375
JH		 7432 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7433 mgmt_status(status));
c35938b2 7434 } else {
66f096f7
JH		 7435 struct mgmt_rp_read_local_oob_data rp;
7436 size_t rp_size = sizeof(rp);
4d2d2796 7437
66f096f7
JH		 7438 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7439 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
c35938b2 7440
66f096f7 7441 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
4d2d2796 7442 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
38da1703 7443 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
4d2d2796 7444 } else {
66f096f7 7445 rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
4d2d2796 7446 }
66f096f7 7447
2a1afb5a
JH		 7448 mgmt_cmd_complete(cmd->sk, hdev->id,
7449 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7450 &rp, rp_size);
c35938b2
SJ		 7451 }
7452
7453 mgmt_pending_remove(cmd);
c35938b2 7454}
e17acd40 7455
799ce93d
JP		 7456static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7457{
7458 int i;
7459
7460 for (i = 0; i < uuid_count; i++) {
7461 if (!memcmp(uuid, uuids[i], 16))
7462 return true;
7463 }
7464
7465 return false;
7466}
7467
b487b9ce
MH		 7468static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7469{
799ce93d
JP		 7470 u16 parsed = 0;
7471
7472 while (parsed < eir_len) {
7473 u8 field_len = eir[0];
7474 u8 uuid[16];
7475 int i;
7476
7477 if (field_len == 0)
7478 break;
7479
7480 if (eir_len - parsed < field_len + 1)
7481 break;
7482
7483 switch (eir[1]) {
7484 case EIR_UUID16_ALL:
7485 case EIR_UUID16_SOME:
7486 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 7487 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7488 uuid[13] = eir[i + 3];
7489 uuid[12] = eir[i + 2];
7490 if (has_uuid(uuid, uuid_count, uuids))
7491 return true;
7492 }
7493 break;
7494 case EIR_UUID32_ALL:
7495 case EIR_UUID32_SOME:
7496 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 7497 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7498 uuid[15] = eir[i + 5];
7499 uuid[14] = eir[i + 4];
7500 uuid[13] = eir[i + 3];
7501 uuid[12] = eir[i + 2];
7502 if (has_uuid(uuid, uuid_count, uuids))
7503 return true;
7504 }
7505 break;
7506 case EIR_UUID128_ALL:
7507 case EIR_UUID128_SOME:
7508 for (i = 0; i + 17 <= field_len; i += 16) {
7509 memcpy(uuid, eir + i + 2, 16);
7510 if (has_uuid(uuid, uuid_count, uuids))
7511 return true;
7512 }
7513 break;
7514 }
7515
7516 parsed += field_len + 1;
7517 eir += field_len + 1;
7518 }
7519
b487b9ce
MH		 7520 return false;
7521}
7522
4b0e0ced
JP		 7523static void restart_le_scan(struct hci_dev *hdev)
7524{
7525 /* If controller is not scanning we are done. */
d7a5a11d 7526 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 7527 return;
7528
7529 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7530 hdev->discovery.scan_start +
7531 hdev->discovery.scan_duration))
7532 return;
7533
7534 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7535 DISCOV_LE_RESTART_DELAY);
7536}
7537
48f86b7f
JP		 7538static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7539 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 7540{
48f86b7f
JP		 7541 /* If a RSSI threshold has been specified, and
7542 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7543 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7544 * is set, let it through for further processing, as we might need to
7545 * restart the scan.
efb2513f
MH		 7546 *
7547 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7548 * the results are also dropped.
bda157a4
MH		 7549 */
7550 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 7551 (rssi == HCI_RSSI_INVALID ||
7552 (rssi < hdev->discovery.rssi &&
7553 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 7554 return false;
efb2513f 7555
2976cdeb
JP		 7556 if (hdev->discovery.uuid_count != 0) {
7557 /* If a list of UUIDs is provided in filter, results with no
7558 * matching UUID should be dropped.
b487b9ce 7559 */
2976cdeb
JP		 7560 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7561 hdev->discovery.uuids) &&
7562 !eir_has_uuids(scan_rsp, scan_rsp_len,
7563 hdev->discovery.uuid_count,
7564 hdev->discovery.uuids))
7565 return false;
b487b9ce 7566 }
5d2e9fad 7567
2976cdeb
JP		 7568 /* If duplicate filtering does not report RSSI changes, then restart
7569 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 7570 */
2976cdeb
JP		 7571 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7572 restart_le_scan(hdev);
7573
7574 /* Validate RSSI value against the RSSI threshold once more. */
7575 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7576 rssi < hdev->discovery.rssi)
7577 return false;
7578 }
48f86b7f
JP		 7579
7580 return true;
7581}
7582
7583void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7584 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7585 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7586{
7587 char buf[512];
7588 struct mgmt_ev_device_found *ev = (void *)buf;
7589 size_t ev_size;
7590
7591 /* Don't send events for a non-kernel initiated discovery. With
7592 * LE one exception is if we have pend_le_reports > 0 in which
7593 * case we're doing passive scanning and want these events.
7594 */
7595 if (!hci_discovery_active(hdev)) {
7596 if (link_type == ACL_LINK)
7597 return;
7598 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7599 return;
7600 }
7601
82f8b651 7602 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 7603 /* We are using service discovery */
7604 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7605 scan_rsp_len))
7606 return;
7607 }
7608
7609 /* Make sure that the buffer is big enough. The 5 extra bytes
7610 * are for the potential CoD field.
7611 */
7612 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 7613 return;
7614
48f86b7f
JP		 7615 memset(buf, 0, sizeof(buf));
7616
7617 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7618 * RSSI value was reported as 0 when not available. This behavior
7619 * is kept when using device discovery. This is required for full
7620 * backwards compatibility with the API.
7621 *
7622 * However when using service discovery, the value 127 will be
7623 * returned when the RSSI is not available.
7624 */
7625 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7626 link_type == ACL_LINK)
7627 rssi = 0;
7628
7629 bacpy(&ev->addr.bdaddr, bdaddr);
7630 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7631 ev->rssi = rssi;
7632 ev->flags = cpu_to_le32(flags);
7633
7634 if (eir_len > 0)
7635 /* Copy EIR or advertising data into event */
7636 memcpy(ev->eir, eir, eir_len);
7637
7638 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7639 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7640 dev_class, 3);
7641
7642 if (scan_rsp_len > 0)
7643 /* Append scan response data to event */
7644 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7645
5d2e9fad
JH		 7646 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7647 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 7648
901801b9 7649 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 7650}
a88a9652 7651
9cf12aee
MH		 7652void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7653 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 7654{
b644ba33
JH		 7655 struct mgmt_ev_device_found *ev;
7656 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7657 u16 eir_len;
a88a9652 7658
b644ba33 7659 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 7660
b644ba33
JH		 7661 memset(buf, 0, sizeof(buf));
7662
7663 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 7664 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 7665 ev->rssi = rssi;
7666
7667 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 7668 name_len);
b644ba33 7669
eb55ef07 7670 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 7671
9cf12aee 7672 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 7673}
314b2381 7674
2f1e063b 7675void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 7676{
f963e8e9 7677 struct mgmt_ev_discovering ev;
164a6e78 7678
343fb145
AG		 7679 BT_DBG("%s discovering %u", hdev->name, discovering);
7680
f963e8e9
JH		 7681 memset(&ev, 0, sizeof(ev));
7682 ev.type = hdev->discovery.type;
7683 ev.discovering = discovering;
7684
2f1e063b 7685 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 7686}
5e762444 7687
1904a853 7688static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 7689{
7690 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 7691}
7692
7693void mgmt_reenable_advertising(struct hci_dev *hdev)
7694{
7695 struct hci_request req;
7696
d7a5a11d 7697 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
5976e608
MH		 7698 return;
7699
7700 hci_req_init(&req, hdev);
7701 enable_advertising(&req);
0ec5ae84 7702 hci_req_run(&req, adv_enable_complete);
5976e608 7703}
6d785aa3
JH		 7704
7705static struct hci_mgmt_chan chan = {
7706 .channel = HCI_CHANNEL_CONTROL,
7707 .handler_count = ARRAY_SIZE(mgmt_handlers),
7708 .handlers = mgmt_handlers,
7709};
7710
7711int mgmt_init(void)
7712{
7713 return hci_mgmt_chan_register(&chan);
7714}
7715
7716void mgmt_exit(void)
7717{
7718 hci_mgmt_chan_unregister(&chan);
7719}
Linux kernel - Deliverables
This page took 0.867824 seconds and 5 git commands to generate.