projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Move all mgmt command quirks to handler table
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
0381101f 38
2da9c55c 39#define MGMT_VERSION 1
854bda19 40#define MGMT_REVISION 8
02d98129 41
e70bb2e8
JH		 42static const u16 mgmt_commands[] = {
43 MGMT_OP_READ_INDEX_LIST,
44 MGMT_OP_READ_INFO,
45 MGMT_OP_SET_POWERED,
46 MGMT_OP_SET_DISCOVERABLE,
47 MGMT_OP_SET_CONNECTABLE,
48 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 49 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 50 MGMT_OP_SET_LINK_SECURITY,
51 MGMT_OP_SET_SSP,
52 MGMT_OP_SET_HS,
53 MGMT_OP_SET_LE,
54 MGMT_OP_SET_DEV_CLASS,
55 MGMT_OP_SET_LOCAL_NAME,
56 MGMT_OP_ADD_UUID,
57 MGMT_OP_REMOVE_UUID,
58 MGMT_OP_LOAD_LINK_KEYS,
59 MGMT_OP_LOAD_LONG_TERM_KEYS,
60 MGMT_OP_DISCONNECT,
61 MGMT_OP_GET_CONNECTIONS,
62 MGMT_OP_PIN_CODE_REPLY,
63 MGMT_OP_PIN_CODE_NEG_REPLY,
64 MGMT_OP_SET_IO_CAPABILITY,
65 MGMT_OP_PAIR_DEVICE,
66 MGMT_OP_CANCEL_PAIR_DEVICE,
67 MGMT_OP_UNPAIR_DEVICE,
68 MGMT_OP_USER_CONFIRM_REPLY,
69 MGMT_OP_USER_CONFIRM_NEG_REPLY,
70 MGMT_OP_USER_PASSKEY_REPLY,
71 MGMT_OP_USER_PASSKEY_NEG_REPLY,
72 MGMT_OP_READ_LOCAL_OOB_DATA,
73 MGMT_OP_ADD_REMOTE_OOB_DATA,
74 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
75 MGMT_OP_START_DISCOVERY,
76 MGMT_OP_STOP_DISCOVERY,
77 MGMT_OP_CONFIRM_NAME,
78 MGMT_OP_BLOCK_DEVICE,
79 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 80 MGMT_OP_SET_DEVICE_ID,
4375f103 81 MGMT_OP_SET_ADVERTISING,
0663ca2a 82 MGMT_OP_SET_BREDR,
d13eafce 83 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 84 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 85 MGMT_OP_SET_SECURE_CONN,
4e39ac81 86 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 87 MGMT_OP_SET_PRIVACY,
41edf160 88 MGMT_OP_LOAD_IRKS,
dd983808 89 MGMT_OP_GET_CONN_INFO,
95868426 90 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 91 MGMT_OP_ADD_DEVICE,
92 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 93 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 94 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 95 MGMT_OP_READ_CONFIG_INFO,
dbece37a 96 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 97 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 98 MGMT_OP_START_SERVICE_DISCOVERY,
e70bb2e8
JH		 99};
100
101static const u16 mgmt_events[] = {
102 MGMT_EV_CONTROLLER_ERROR,
103 MGMT_EV_INDEX_ADDED,
104 MGMT_EV_INDEX_REMOVED,
105 MGMT_EV_NEW_SETTINGS,
106 MGMT_EV_CLASS_OF_DEV_CHANGED,
107 MGMT_EV_LOCAL_NAME_CHANGED,
108 MGMT_EV_NEW_LINK_KEY,
109 MGMT_EV_NEW_LONG_TERM_KEY,
110 MGMT_EV_DEVICE_CONNECTED,
111 MGMT_EV_DEVICE_DISCONNECTED,
112 MGMT_EV_CONNECT_FAILED,
113 MGMT_EV_PIN_CODE_REQUEST,
114 MGMT_EV_USER_CONFIRM_REQUEST,
115 MGMT_EV_USER_PASSKEY_REQUEST,
116 MGMT_EV_AUTH_FAILED,
117 MGMT_EV_DEVICE_FOUND,
118 MGMT_EV_DISCOVERING,
119 MGMT_EV_DEVICE_BLOCKED,
120 MGMT_EV_DEVICE_UNBLOCKED,
121 MGMT_EV_DEVICE_UNPAIRED,
92a25256 122 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 123 MGMT_EV_NEW_IRK,
7ee4ea36 124 MGMT_EV_NEW_CSRK,
8afef092
MH		 125 MGMT_EV_DEVICE_ADDED,
126 MGMT_EV_DEVICE_REMOVED,
ffb5a827 127 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 128 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 129 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 130 MGMT_EV_NEW_CONFIG_OPTIONS,
e70bb2e8
JH		 131};
132
17b02e62 133#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 134
d25b78e2
JH		 135#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
136 "\x00\x00\x00\x00\x00\x00\x00\x00"
137
eec8d2bc
JH		 138struct pending_cmd {
139 struct list_head list;
fc2f4b13 140 u16 opcode;
eec8d2bc 141 int index;
c68fb7ff 142 void *param;
323b0b88 143 size_t param_len;
eec8d2bc 144 struct sock *sk;
e9a416b5 145 void *user_data;
9df74653 146 int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
eec8d2bc
JH		 147};
148
ca69b795
JH		 149/* HCI to MGMT error code conversion table */
150static u8 mgmt_status_table[] = {
151 MGMT_STATUS_SUCCESS,
152 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
153 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
154 MGMT_STATUS_FAILED, /* Hardware Failure */
155 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
156 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 157 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 158 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
159 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
160 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
161 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
162 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
163 MGMT_STATUS_BUSY, /* Command Disallowed */
164 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
165 MGMT_STATUS_REJECTED, /* Rejected Security */
166 MGMT_STATUS_REJECTED, /* Rejected Personal */
167 MGMT_STATUS_TIMEOUT, /* Host Timeout */
168 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
169 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
170 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
171 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
172 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
173 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
174 MGMT_STATUS_BUSY, /* Repeated Attempts */
175 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
176 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
177 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
178 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
179 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
180 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
181 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
182 MGMT_STATUS_FAILED, /* Unspecified Error */
183 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
184 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
185 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
186 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
187 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
188 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
189 MGMT_STATUS_FAILED, /* Unit Link Key Used */
190 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
191 MGMT_STATUS_TIMEOUT, /* Instant Passed */
192 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
193 MGMT_STATUS_FAILED, /* Transaction Collision */
194 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
195 MGMT_STATUS_REJECTED, /* QoS Rejected */
196 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
197 MGMT_STATUS_REJECTED, /* Insufficient Security */
198 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
199 MGMT_STATUS_BUSY, /* Role Switch Pending */
200 MGMT_STATUS_FAILED, /* Slot Violation */
201 MGMT_STATUS_FAILED, /* Role Switch Failed */
202 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
203 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
204 MGMT_STATUS_BUSY, /* Host Busy Pairing */
205 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
206 MGMT_STATUS_BUSY, /* Controller Busy */
207 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
208 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
209 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
210 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
211 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
212};
213
214static u8 mgmt_status(u8 hci_status)
215{
216 if (hci_status < ARRAY_SIZE(mgmt_status_table))
217 return mgmt_status_table[hci_status];
218
219 return MGMT_STATUS_FAILED;
220}
221
04c60f05
MH		 222static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
223 struct sock *skip_sk)
224{
225 struct sk_buff *skb;
226 struct mgmt_hdr *hdr;
227
228 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
229 if (!skb)
230 return -ENOMEM;
231
232 hdr = (void *) skb_put(skb, sizeof(*hdr));
233 hdr->opcode = cpu_to_le16(event);
234 if (hdev)
235 hdr->index = cpu_to_le16(hdev->id);
236 else
237 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
238 hdr->len = cpu_to_le16(data_len);
239
240 if (data)
241 memcpy(skb_put(skb, data_len), data, data_len);
242
243 /* Time stamp */
244 __net_timestamp(skb);
245
7129069e 246 hci_send_to_channel(HCI_CHANNEL_CONTROL, skb, skip_sk);
04c60f05
MH		 247 kfree_skb(skb);
248
249 return 0;
250}
251
4e51eae9 252static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
f7b64e69
JH		 253{
254 struct sk_buff *skb;
255 struct mgmt_hdr *hdr;
256 struct mgmt_ev_cmd_status *ev;
56b7d137 257 int err;
f7b64e69 258
34eb525c 259 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
f7b64e69 260
790eff44 261 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
f7b64e69
JH		 262 if (!skb)
263 return -ENOMEM;
264
265 hdr = (void *) skb_put(skb, sizeof(*hdr));
266
dcf4adbf 267 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
4e51eae9 268 hdr->index = cpu_to_le16(index);
f7b64e69
JH		 269 hdr->len = cpu_to_le16(sizeof(*ev));
270
271 ev = (void *) skb_put(skb, sizeof(*ev));
272 ev->status = status;
eb55ef07 273 ev->opcode = cpu_to_le16(cmd);
f7b64e69 274
56b7d137
GP		 275 err = sock_queue_rcv_skb(sk, skb);
276 if (err < 0)
f7b64e69
JH		 277 kfree_skb(skb);
278
56b7d137 279 return err;
f7b64e69
JH		 280}
281
aee9b218 282static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
04124681 283 void *rp, size_t rp_len)
02d98129
JH		 284{
285 struct sk_buff *skb;
286 struct mgmt_hdr *hdr;
287 struct mgmt_ev_cmd_complete *ev;
56b7d137 288 int err;
02d98129
JH		 289
290 BT_DBG("sock %p", sk);
291
790eff44 292 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
02d98129
JH		 293 if (!skb)
294 return -ENOMEM;
295
296 hdr = (void *) skb_put(skb, sizeof(*hdr));
02d98129 297
dcf4adbf 298 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
4e51eae9 299 hdr->index = cpu_to_le16(index);
a38528f1 300 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
02d98129 301
a38528f1 302 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
eb55ef07 303 ev->opcode = cpu_to_le16(cmd);
aee9b218 304 ev->status = status;
8020c16a
SJ		 305
306 if (rp)
307 memcpy(ev->data, rp, rp_len);
02d98129 308
56b7d137
GP		 309 err = sock_queue_rcv_skb(sk, skb);
310 if (err < 0)
02d98129
JH		 311 kfree_skb(skb);
312
e5f0e151 313 return err;
02d98129
JH		 314}
315
04124681
GP		 316static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
317 u16 data_len)
a38528f1
JH		 318{
319 struct mgmt_rp_read_version rp;
320
321 BT_DBG("sock %p", sk);
322
323 rp.version = MGMT_VERSION;
dcf4adbf 324 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 325
aee9b218 326 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
04124681 327 sizeof(rp));
a38528f1
JH		 328}
329
04124681
GP		 330static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
331 u16 data_len)
e70bb2e8
JH		 332{
333 struct mgmt_rp_read_commands *rp;
eb55ef07
MH		 334 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
335 const u16 num_events = ARRAY_SIZE(mgmt_events);
2e3c35ea 336 __le16 *opcode;
e70bb2e8
JH		 337 size_t rp_size;
338 int i, err;
339
340 BT_DBG("sock %p", sk);
341
342 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
343
344 rp = kmalloc(rp_size, GFP_KERNEL);
345 if (!rp)
346 return -ENOMEM;
347
dcf4adbf
JP		 348 rp->num_commands = cpu_to_le16(num_commands);
349 rp->num_events = cpu_to_le16(num_events);
e70bb2e8
JH		 350
351 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
352 put_unaligned_le16(mgmt_commands[i], opcode);
353
354 for (i = 0; i < num_events; i++, opcode++)
355 put_unaligned_le16(mgmt_events[i], opcode);
356
aee9b218 357 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
04124681 358 rp_size);
e70bb2e8
JH		 359 kfree(rp);
360
361 return err;
362}
363
04124681
GP		 364static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
365 u16 data_len)
faba42eb 366{
faba42eb 367 struct mgmt_rp_read_index_list *rp;
8035ded4 368 struct hci_dev *d;
a38528f1 369 size_t rp_len;
faba42eb 370 u16 count;
476e44cb 371 int err;
faba42eb
JH		 372
373 BT_DBG("sock %p", sk);
374
375 read_lock(&hci_dev_list_lock);
376
377 count = 0;
bb4b2a9a 378 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a
MH		 379 if (d->dev_type == HCI_BREDR &&
380 !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
1514b892 381 count++;
faba42eb
JH		 382 }
383
a38528f1
JH		 384 rp_len = sizeof(*rp) + (2 * count);
385 rp = kmalloc(rp_len, GFP_ATOMIC);
386 if (!rp) {
b2c60d42 387 read_unlock(&hci_dev_list_lock);
faba42eb 388 return -ENOMEM;
b2c60d42 389 }
faba42eb 390
476e44cb 391 count = 0;
8035ded4 392 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 393 if (test_bit(HCI_SETUP, &d->dev_flags) ||
d603b76b 394 test_bit(HCI_CONFIG, &d->dev_flags) ||
73d1df2a 395 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
ab81cbf9
JH		 396 continue;
397
73d1df2a
MH		 398 /* Devices marked as raw-only are neither configured
399 * nor unconfigured controllers.
400 */
401 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 402 continue;
403
73d1df2a
MH		 404 if (d->dev_type == HCI_BREDR &&
405 !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
1514b892
MH		 406 rp->index[count++] = cpu_to_le16(d->id);
407 BT_DBG("Added hci%u", d->id);
408 }
faba42eb
JH		 409 }
410
476e44cb
JH		 411 rp->num_controllers = cpu_to_le16(count);
412 rp_len = sizeof(*rp) + (2 * count);
413
faba42eb
JH		 414 read_unlock(&hci_dev_list_lock);
415
aee9b218 416 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
04124681 417 rp_len);
faba42eb 418
a38528f1
JH		 419 kfree(rp);
420
421 return err;
faba42eb
JH		 422}
423
73d1df2a
MH		 424static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
425 void *data, u16 data_len)
426{
427 struct mgmt_rp_read_unconf_index_list *rp;
428 struct hci_dev *d;
429 size_t rp_len;
430 u16 count;
431 int err;
432
433 BT_DBG("sock %p", sk);
434
435 read_lock(&hci_dev_list_lock);
436
437 count = 0;
438 list_for_each_entry(d, &hci_dev_list, list) {
439 if (d->dev_type == HCI_BREDR &&
440 test_bit(HCI_UNCONFIGURED, &d->dev_flags))
441 count++;
442 }
443
444 rp_len = sizeof(*rp) + (2 * count);
445 rp = kmalloc(rp_len, GFP_ATOMIC);
446 if (!rp) {
447 read_unlock(&hci_dev_list_lock);
448 return -ENOMEM;
449 }
450
451 count = 0;
452 list_for_each_entry(d, &hci_dev_list, list) {
453 if (test_bit(HCI_SETUP, &d->dev_flags) ||
d603b76b 454 test_bit(HCI_CONFIG, &d->dev_flags) ||
73d1df2a
MH		 455 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
456 continue;
457
458 /* Devices marked as raw-only are neither configured
459 * nor unconfigured controllers.
460 */
461 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
462 continue;
463
464 if (d->dev_type == HCI_BREDR &&
465 test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
466 rp->index[count++] = cpu_to_le16(d->id);
467 BT_DBG("Added hci%u", d->id);
468 }
469 }
470
471 rp->num_controllers = cpu_to_le16(count);
472 rp_len = sizeof(*rp) + (2 * count);
473
474 read_unlock(&hci_dev_list_lock);
475
476 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
477 0, rp, rp_len);
478
479 kfree(rp);
480
481 return err;
482}
483
dbece37a
MH		 484static bool is_configured(struct hci_dev *hdev)
485{
486 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
487 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
488 return false;
489
490 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
491 !bacmp(&hdev->public_addr, BDADDR_ANY))
492 return false;
493
494 return true;
495}
496
89bc22d2
MH		 497static __le32 get_missing_options(struct hci_dev *hdev)
498{
499 u32 options = 0;
500
dbece37a
MH		 501 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
502 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
eb1904f4
MH		 503 options |= MGMT_OPTION_EXTERNAL_CONFIG;
504
89bc22d2
MH		 505 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
506 !bacmp(&hdev->public_addr, BDADDR_ANY))
507 options |= MGMT_OPTION_PUBLIC_ADDRESS;
508
509 return cpu_to_le32(options);
510}
511
f4537c04
MH		 512static int new_options(struct hci_dev *hdev, struct sock *skip)
513{
514 __le32 options = get_missing_options(hdev);
515
516 return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
517 sizeof(options), skip);
518}
519
dbece37a
MH		 520static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
521{
522 __le32 options = get_missing_options(hdev);
523
524 return cmd_complete(sk, hdev->id, opcode, 0, &options,
525 sizeof(options));
526}
527
9fc3bfb6
MH		 528static int read_config_info(struct sock *sk, struct hci_dev *hdev,
529 void *data, u16 data_len)
530{
531 struct mgmt_rp_read_config_info rp;
89bc22d2 532 u32 options = 0;
9fc3bfb6
MH		 533
534 BT_DBG("sock %p %s", sk, hdev->name);
535
536 hci_dev_lock(hdev);
537
538 memset(&rp, 0, sizeof(rp));
539 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 540
eb1904f4
MH		 541 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
542 options |= MGMT_OPTION_EXTERNAL_CONFIG;
543
9fc3bfb6 544 if (hdev->set_bdaddr)
89bc22d2
MH		 545 options |= MGMT_OPTION_PUBLIC_ADDRESS;
546
547 rp.supported_options = cpu_to_le32(options);
548 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 549
550 hci_dev_unlock(hdev);
551
552 return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
553 sizeof(rp));
554}
555
69ab39ea
JH		 556static u32 get_supported_settings(struct hci_dev *hdev)
557{
558 u32 settings = 0;
559
560 settings |= MGMT_SETTING_POWERED;
b2939475 561 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 562 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 563 settings |= MGMT_SETTING_CONNECTABLE;
564 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 565
ed3fa31f 566 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 567 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
568 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 569 settings |= MGMT_SETTING_BREDR;
570 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 571
572 if (lmp_ssp_capable(hdev)) {
573 settings |= MGMT_SETTING_SSP;
574 settings |= MGMT_SETTING_HS;
575 }
e98d2ce2 576
05b3c3e7 577 if (lmp_sc_capable(hdev))
e98d2ce2 578 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 579 }
d7b7e796 580
eeca6f89 581 if (lmp_le_capable(hdev)) {
9d42820f 582 settings |= MGMT_SETTING_LE;
eeca6f89 583 settings |= MGMT_SETTING_ADVERTISING;
a3209694 584 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 585 settings |= MGMT_SETTING_PRIVACY;
93690c22 586 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 587 }
69ab39ea 588
eb1904f4
MH		 589 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
590 hdev->set_bdaddr)
9fc3bfb6
MH		 591 settings |= MGMT_SETTING_CONFIGURATION;
592
69ab39ea
JH		 593 return settings;
594}
595
596static u32 get_current_settings(struct hci_dev *hdev)
597{
598 u32 settings = 0;
599
f1f0eb02 600 if (hdev_is_powered(hdev))
f0d4b78a
MH		 601 settings |= MGMT_SETTING_POWERED;
602
5e5282bb 603 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
69ab39ea
JH		 604 settings |= MGMT_SETTING_CONNECTABLE;
605
1a4d3c4b
JH		 606 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
607 settings |= MGMT_SETTING_FAST_CONNECTABLE;
608
5e5282bb 609 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
69ab39ea
JH		 610 settings |= MGMT_SETTING_DISCOVERABLE;
611
b6ae8457 612 if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
b2939475 613 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 614
56f87901 615 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 616 settings |= MGMT_SETTING_BREDR;
617
06199cf8 618 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 619 settings |= MGMT_SETTING_LE;
620
47990ea0 621 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
69ab39ea
JH		 622 settings |= MGMT_SETTING_LINK_SECURITY;
623
84bde9d6 624 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 625 settings |= MGMT_SETTING_SSP;
626
6d80dfd0
JH		 627 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
628 settings |= MGMT_SETTING_HS;
629
f3d3444a 630 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
eeca6f89
JH		 631 settings |= MGMT_SETTING_ADVERTISING;
632
e98d2ce2
MH		 633 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
634 settings |= MGMT_SETTING_SECURE_CONN;
635
0663b297 636 if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
b1de97d8
MH		 637 settings |= MGMT_SETTING_DEBUG_KEYS;
638
0f4bd942
JH		 639 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
640 settings |= MGMT_SETTING_PRIVACY;
641
93690c22
MH		 642 /* The current setting for static address has two purposes. The
643 * first is to indicate if the static address will be used and
644 * the second is to indicate if it is actually set.
645 *
646 * This means if the static address is not configured, this flag
647 * will never bet set. If the address is configured, then if the
648 * address is actually used decides if the flag is set or not.
649 *
650 * For single mode LE only controllers and dual-mode controllers
651 * with BR/EDR disabled, the existence of the static address will
652 * be evaluated.
653 */
654 if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
655 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
656 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
657 if (bacmp(&hdev->static_addr, BDADDR_ANY))
658 settings |= MGMT_SETTING_STATIC_ADDRESS;
659 }
660
69ab39ea
JH		 661 return settings;
662}
663
ef580372
JH		 664#define PNP_INFO_SVCLASS_ID 0x1200
665
213202ed
JH		 666static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
667{
668 u8 *ptr = data, *uuids_start = NULL;
669 struct bt_uuid *uuid;
670
671 if (len < 4)
672 return ptr;
673
674 list_for_each_entry(uuid, &hdev->uuids, list) {
675 u16 uuid16;
676
677 if (uuid->size != 16)
678 continue;
679
680 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
681 if (uuid16 < 0x1100)
682 continue;
683
684 if (uuid16 == PNP_INFO_SVCLASS_ID)
685 continue;
686
687 if (!uuids_start) {
688 uuids_start = ptr;
689 uuids_start[0] = 1;
690 uuids_start[1] = EIR_UUID16_ALL;
691 ptr += 2;
692 }
693
694 /* Stop if not enough space to put next UUID */
695 if ((ptr - data) + sizeof(u16) > len) {
696 uuids_start[1] = EIR_UUID16_SOME;
697 break;
698 }
699
700 *ptr++ = (uuid16 & 0x00ff);
701 *ptr++ = (uuid16 & 0xff00) >> 8;
702 uuids_start[0] += sizeof(uuid16);
703 }
704
705 return ptr;
706}
707
cdf1963f
JH		 708static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
709{
710 u8 *ptr = data, *uuids_start = NULL;
711 struct bt_uuid *uuid;
712
713 if (len < 6)
714 return ptr;
715
716 list_for_each_entry(uuid, &hdev->uuids, list) {
717 if (uuid->size != 32)
718 continue;
719
720 if (!uuids_start) {
721 uuids_start = ptr;
722 uuids_start[0] = 1;
723 uuids_start[1] = EIR_UUID32_ALL;
724 ptr += 2;
725 }
726
727 /* Stop if not enough space to put next UUID */
728 if ((ptr - data) + sizeof(u32) > len) {
729 uuids_start[1] = EIR_UUID32_SOME;
730 break;
731 }
732
733 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
734 ptr += sizeof(u32);
735 uuids_start[0] += sizeof(u32);
736 }
737
738 return ptr;
739}
740
c00d575b
JH		 741static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
742{
743 u8 *ptr = data, *uuids_start = NULL;
744 struct bt_uuid *uuid;
745
746 if (len < 18)
747 return ptr;
748
749 list_for_each_entry(uuid, &hdev->uuids, list) {
750 if (uuid->size != 128)
751 continue;
752
753 if (!uuids_start) {
754 uuids_start = ptr;
755 uuids_start[0] = 1;
756 uuids_start[1] = EIR_UUID128_ALL;
757 ptr += 2;
758 }
759
760 /* Stop if not enough space to put next UUID */
761 if ((ptr - data) + 16 > len) {
762 uuids_start[1] = EIR_UUID128_SOME;
763 break;
764 }
765
766 memcpy(ptr, uuid->uuid, 16);
767 ptr += 16;
768 uuids_start[0] += 16;
769 }
770
771 return ptr;
772}
773
eb2a8d20
JH		 774static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
775{
776 struct pending_cmd *cmd;
777
778 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
779 if (cmd->opcode == opcode)
780 return cmd;
781 }
782
783 return NULL;
784}
785
95868426
JH		 786static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
787 struct hci_dev *hdev,
788 const void *data)
789{
790 struct pending_cmd *cmd;
791
792 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
793 if (cmd->user_data != data)
794 continue;
795 if (cmd->opcode == opcode)
796 return cmd;
797 }
798
799 return NULL;
800}
801
f14d8f64
MH		 802static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
803{
7a5f4990
MH		 804 u8 ad_len = 0;
805 size_t name_len;
806
807 name_len = strlen(hdev->dev_name);
808 if (name_len > 0) {
809 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
810
811 if (name_len > max_len) {
812 name_len = max_len;
813 ptr[1] = EIR_NAME_SHORT;
814 } else
815 ptr[1] = EIR_NAME_COMPLETE;
816
817 ptr[0] = name_len + 1;
818
819 memcpy(ptr + 2, hdev->dev_name, name_len);
820
821 ad_len += (name_len + 2);
822 ptr += (name_len + 2);
823 }
824
825 return ad_len;
f14d8f64
MH		 826}
827
828static void update_scan_rsp_data(struct hci_request *req)
829{
830 struct hci_dev *hdev = req->hdev;
831 struct hci_cp_le_set_scan_rsp_data cp;
832 u8 len;
833
7751ef1b 834 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
f14d8f64
MH		 835 return;
836
837 memset(&cp, 0, sizeof(cp));
838
839 len = create_scan_rsp_data(hdev, cp.data);
840
eb438b5f
JH		 841 if (hdev->scan_rsp_data_len == len &&
842 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
f14d8f64
MH		 843 return;
844
eb438b5f
JH		 845 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
846 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 847
848 cp.length = len;
849
850 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
851}
852
9a43e25f
JH		 853static u8 get_adv_discov_flags(struct hci_dev *hdev)
854{
855 struct pending_cmd *cmd;
856
857 /* If there's a pending mgmt command the flags will not yet have
858 * their final values, so check for this first.
859 */
860 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
861 if (cmd) {
862 struct mgmt_mode *cp = cmd->param;
863 if (cp->val == 0x01)
864 return LE_AD_GENERAL;
865 else if (cp->val == 0x02)
866 return LE_AD_LIMITED;
867 } else {
868 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
869 return LE_AD_LIMITED;
870 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
871 return LE_AD_GENERAL;
872 }
873
874 return 0;
875}
876
46cad2ed 877static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
441ad2d0
MH		 878{
879 u8 ad_len = 0, flags = 0;
441ad2d0 880
9a43e25f 881 flags |= get_adv_discov_flags(hdev);
441ad2d0 882
e834004b 883 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
441ad2d0 884 flags |= LE_AD_NO_BREDR;
441ad2d0
MH		 885
886 if (flags) {
887 BT_DBG("adv flags 0x%02x", flags);
888
889 ptr[0] = 2;
890 ptr[1] = EIR_FLAGS;
891 ptr[2] = flags;
892
893 ad_len += 3;
894 ptr += 3;
895 }
896
897 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
898 ptr[0] = 2;
899 ptr[1] = EIR_TX_POWER;
900 ptr[2] = (u8) hdev->adv_tx_power;
901
902 ad_len += 3;
903 ptr += 3;
904 }
905
441ad2d0
MH		 906 return ad_len;
907}
908
5947f4bc 909static void update_adv_data(struct hci_request *req)
441ad2d0
MH		 910{
911 struct hci_dev *hdev = req->hdev;
912 struct hci_cp_le_set_adv_data cp;
913 u8 len;
914
10994ce6 915 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
441ad2d0
MH		 916 return;
917
918 memset(&cp, 0, sizeof(cp));
919
46cad2ed 920 len = create_adv_data(hdev, cp.data);
441ad2d0
MH		 921
922 if (hdev->adv_data_len == len &&
923 memcmp(cp.data, hdev->adv_data, len) == 0)
924 return;
925
926 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
927 hdev->adv_data_len = len;
928
929 cp.length = len;
930
931 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
932}
933
bc6d2d04
JH		 934int mgmt_update_adv_data(struct hci_dev *hdev)
935{
936 struct hci_request req;
937
938 hci_req_init(&req, hdev);
939 update_adv_data(&req);
940
941 return hci_req_run(&req, NULL);
942}
943
ef580372
JH		 944static void create_eir(struct hci_dev *hdev, u8 *data)
945{
946 u8 *ptr = data;
ef580372
JH		 947 size_t name_len;
948
949 name_len = strlen(hdev->dev_name);
950
951 if (name_len > 0) {
952 /* EIR Data type */
953 if (name_len > 48) {
954 name_len = 48;
955 ptr[1] = EIR_NAME_SHORT;
956 } else
957 ptr[1] = EIR_NAME_COMPLETE;
958
959 /* EIR Data length */
960 ptr[0] = name_len + 1;
961
962 memcpy(ptr + 2, hdev->dev_name, name_len);
963
ef580372
JH		 964 ptr += (name_len + 2);
965 }
966
bbaf444a 967 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 968 ptr[0] = 2;
969 ptr[1] = EIR_TX_POWER;
970 ptr[2] = (u8) hdev->inq_tx_power;
971
91c4e9b1
MH		 972 ptr += 3;
973 }
974
2b9be137
MH		 975 if (hdev->devid_source > 0) {
976 ptr[0] = 9;
977 ptr[1] = EIR_DEVICE_ID;
978
979 put_unaligned_le16(hdev->devid_source, ptr + 2);
980 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
981 put_unaligned_le16(hdev->devid_product, ptr + 6);
982 put_unaligned_le16(hdev->devid_version, ptr + 8);
983
2b9be137
MH		 984 ptr += 10;
985 }
986
213202ed 987 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 988 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 989 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 990}
991
890ea898 992static void update_eir(struct hci_request *req)
ef580372 993{
890ea898 994 struct hci_dev *hdev = req->hdev;
ef580372
JH		 995 struct hci_cp_write_eir cp;
996
504c8dcd 997 if (!hdev_is_powered(hdev))
890ea898 998 return;
7770c4aa 999
976eb20e 1000 if (!lmp_ext_inq_capable(hdev))
890ea898 1001 return;
ef580372 1002
84bde9d6 1003 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
890ea898 1004 return;
ef580372 1005
a8b2d5c2 1006 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 1007 return;
ef580372
JH		 1008
1009 memset(&cp, 0, sizeof(cp));
1010
1011 create_eir(hdev, cp.data);
1012
1013 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1014 return;
ef580372
JH		 1015
1016 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1017
890ea898 1018 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1019}
1020
1021static u8 get_service_classes(struct hci_dev *hdev)
1022{
1023 struct bt_uuid *uuid;
1024 u8 val = 0;
1025
1026 list_for_each_entry(uuid, &hdev->uuids, list)
1027 val |= uuid->svc_hint;
1028
1029 return val;
1030}
1031
890ea898 1032static void update_class(struct hci_request *req)
ef580372 1033{
890ea898 1034 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1035 u8 cod[3];
1036
1037 BT_DBG("%s", hdev->name);
1038
504c8dcd 1039 if (!hdev_is_powered(hdev))
890ea898 1040 return;
7770c4aa 1041
f87ea1da
JH		 1042 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1043 return;
1044
a8b2d5c2 1045 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 1046 return;
ef580372
JH		 1047
1048 cod[0] = hdev->minor_class;
1049 cod[1] = hdev->major_class;
1050 cod[2] = get_service_classes(hdev);
1051
6acd7db4
MH		 1052 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1053 cod[1] |= 0x20;
1054
ef580372 1055 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1056 return;
ef580372 1057
890ea898 1058 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1059}
1060
a4858cb9 1061static bool get_connectable(struct hci_dev *hdev)
199a2fb1
JH		 1062{
1063 struct pending_cmd *cmd;
199a2fb1
JH		 1064
1065 /* If there's a pending mgmt command the flag will not yet have
1066 * it's final value, so check for this first.
1067 */
1068 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1069 if (cmd) {
1070 struct mgmt_mode *cp = cmd->param;
a4858cb9 1071 return cp->val;
199a2fb1
JH		 1072 }
1073
a4858cb9 1074 return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
199a2fb1
JH		 1075}
1076
0ec5ae84
JH		 1077static void disable_advertising(struct hci_request *req)
1078{
1079 u8 enable = 0x00;
1080
1081 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1082}
1083
199a2fb1
JH		 1084static void enable_advertising(struct hci_request *req)
1085{
1086 struct hci_dev *hdev = req->hdev;
1087 struct hci_cp_le_set_adv_param cp;
8f2a0601 1088 u8 own_addr_type, enable = 0x01;
a4858cb9 1089 bool connectable;
199a2fb1 1090
0ec5ae84
JH		 1091 if (hci_conn_num(hdev, LE_LINK) > 0)
1092 return;
1093
1094 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1095 disable_advertising(req);
1096
5ce194c4 1097 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1098 * hci_update_random_address knows that it's safe to go ahead
1099 * and write a new random address. The flag will be set back on
1100 * as soon as the SET_ADV_ENABLE HCI command completes.
1101 */
5ce194c4 1102 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
8d97250e 1103
a4858cb9 1104 connectable = get_connectable(hdev);
8f2a0601 1105
a4858cb9
JH		 1106 /* Set require_privacy to true only when non-connectable
1107 * advertising is used. In that case it is fine to use a
1108 * non-resolvable private address.
1109 */
1110 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1111 return;
1112
41c90c18 1113 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1114 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1115 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
a4858cb9 1116 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
8f2a0601 1117 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1118 cp.channel_map = hdev->le_adv_channel_map;
1119
1120 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1121
1122 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1123}
1124
7d78525d
JH		 1125static void service_cache_off(struct work_struct *work)
1126{
1127 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1128 service_cache.work);
890ea898 1129 struct hci_request req;
7d78525d 1130
a8b2d5c2 1131 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1132 return;
1133
890ea898
JH		 1134 hci_req_init(&req, hdev);
1135
7d78525d
JH		 1136 hci_dev_lock(hdev);
1137
890ea898
JH		 1138 update_eir(&req);
1139 update_class(&req);
7d78525d
JH		 1140
1141 hci_dev_unlock(hdev);
890ea898
JH		 1142
1143 hci_req_run(&req, NULL);
7d78525d
JH		 1144}
1145
d6bfd59c
JH		 1146static void rpa_expired(struct work_struct *work)
1147{
1148 struct hci_dev *hdev = container_of(work, struct hci_dev,
1149 rpa_expired.work);
1150 struct hci_request req;
1151
1152 BT_DBG("");
1153
1154 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1155
0ec5ae84 1156 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
d6bfd59c
JH		 1157 return;
1158
1159 /* The generation of a new RPA and programming it into the
1160 * controller happens in the enable_advertising() function.
1161 */
d6bfd59c 1162 hci_req_init(&req, hdev);
d6bfd59c 1163 enable_advertising(&req);
d6bfd59c
JH		 1164 hci_req_run(&req, NULL);
1165}
1166
6a919082 1167static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1168{
4f87da80 1169 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
6a919082
JH		 1170 return;
1171
4f87da80 1172 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1173 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1174
4f87da80
JH		 1175 /* Non-mgmt controlled devices get this bit set
1176 * implicitly so that pairing works for them, however
1177 * for mgmt we require user-space to explicitly enable
1178 * it
1179 */
b6ae8457 1180 clear_bit(HCI_BONDABLE, &hdev->dev_flags);
7d78525d
JH		 1181}
1182
0f4e68cf 1183static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1184 void *data, u16 data_len)
0381101f 1185{
a38528f1 1186 struct mgmt_rp_read_info rp;
f7b64e69 1187
bdb6d971 1188 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1189
09fd0de5 1190 hci_dev_lock(hdev);
f7b64e69 1191
dc4fe30b
JH		 1192 memset(&rp, 0, sizeof(rp));
1193
69ab39ea 1194 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1195
69ab39ea 1196 rp.version = hdev->hci_ver;
eb55ef07 1197 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1198
1199 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1200 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1201
a38528f1 1202 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1203
dc4fe30b 1204 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1205 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1206
09fd0de5 1207 hci_dev_unlock(hdev);
0381101f 1208
bdb6d971 1209 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
04124681 1210 sizeof(rp));
0381101f
JH		 1211}
1212
eec8d2bc
JH		 1213static void mgmt_pending_free(struct pending_cmd *cmd)
1214{
1215 sock_put(cmd->sk);
c68fb7ff 1216 kfree(cmd->param);
eec8d2bc
JH		 1217 kfree(cmd);
1218}
1219
366a0336 1220static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
04124681
GP		 1221 struct hci_dev *hdev, void *data,
1222 u16 len)
eec8d2bc
JH		 1223{
1224 struct pending_cmd *cmd;
1225
fca20018 1226 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
eec8d2bc 1227 if (!cmd)
366a0336 1228 return NULL;
eec8d2bc
JH		 1229
1230 cmd->opcode = opcode;
2e58ef3e 1231 cmd->index = hdev->id;
eec8d2bc 1232
323b0b88 1233 cmd->param = kmemdup(data, len, GFP_KERNEL);
c68fb7ff 1234 if (!cmd->param) {
eec8d2bc 1235 kfree(cmd);
366a0336 1236 return NULL;
eec8d2bc
JH		 1237 }
1238
323b0b88 1239 cmd->param_len = len;
eec8d2bc
JH		 1240
1241 cmd->sk = sk;
1242 sock_hold(sk);
1243
2e58ef3e 1244 list_add(&cmd->list, &hdev->mgmt_pending);
eec8d2bc 1245
366a0336 1246 return cmd;
eec8d2bc
JH		 1247}
1248
744cf19e 1249static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
8fc9ced3
GP		 1250 void (*cb)(struct pending_cmd *cmd,
1251 void *data),
04124681 1252 void *data)
eec8d2bc 1253{
a3d09356 1254 struct pending_cmd *cmd, *tmp;
eec8d2bc 1255
a3d09356 1256 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
b24752fe 1257 if (opcode > 0 && cmd->opcode != opcode)
eec8d2bc
JH		 1258 continue;
1259
eec8d2bc
JH		 1260 cb(cmd, data);
1261 }
1262}
1263
a664b5bc 1264static void mgmt_pending_remove(struct pending_cmd *cmd)
73f22f62 1265{
73f22f62
JH		 1266 list_del(&cmd->list);
1267 mgmt_pending_free(cmd);
1268}
1269
69ab39ea 1270static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1271{
69ab39ea 1272 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1273
aee9b218 1274 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
04124681 1275 sizeof(settings));
8680570b
JH		 1276}
1277
1904a853 1278static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1279{
1280 BT_DBG("%s status 0x%02x", hdev->name, status);
1281
a3172b7e
JH		 1282 if (hci_conn_count(hdev) == 0) {
1283 cancel_delayed_work(&hdev->power_off);
8b064a3a 1284 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1285 }
8b064a3a
JH		 1286}
1287
23a48093 1288static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1289{
1290 struct hci_dev *hdev = req->hdev;
1291 struct hci_cp_remote_name_req_cancel cp;
1292 struct inquiry_entry *e;
1293
1294 switch (hdev->discovery.state) {
1295 case DISCOVERY_FINDING:
1296 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1297 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1298 } else {
1299 cancel_delayed_work(&hdev->le_scan_disable);
1300 hci_req_add_le_scan_disable(req);
1301 }
1302
23a48093 1303 return true;
21a60d30
JH		 1304
1305 case DISCOVERY_RESOLVING:
1306 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1307 NAME_PENDING);
1308 if (!e)
23a48093 1309 break;
21a60d30
JH		 1310
1311 bacpy(&cp.bdaddr, &e->data.bdaddr);
1312 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1313 &cp);
1314
23a48093 1315 return true;
21a60d30
JH		 1316
1317 default:
1318 /* Passive scanning */
23a48093 1319 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
21a60d30 1320 hci_req_add_le_scan_disable(req);
23a48093
JH		 1321 return true;
1322 }
1323
21a60d30
JH		 1324 break;
1325 }
23a48093
JH		 1326
1327 return false;
21a60d30
JH		 1328}
1329
8b064a3a
JH		 1330static int clean_up_hci_state(struct hci_dev *hdev)
1331{
1332 struct hci_request req;
1333 struct hci_conn *conn;
23a48093
JH		 1334 bool discov_stopped;
1335 int err;
8b064a3a
JH		 1336
1337 hci_req_init(&req, hdev);
1338
1339 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1340 test_bit(HCI_PSCAN, &hdev->flags)) {
1341 u8 scan = 0x00;
1342 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1343 }
1344
73e082f8 1345 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
8b064a3a
JH		 1346 disable_advertising(&req);
1347
23a48093 1348 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1349
1350 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1351 struct hci_cp_disconnect dc;
c9910d0f
JH		 1352 struct hci_cp_reject_conn_req rej;
1353
1354 switch (conn->state) {
1355 case BT_CONNECTED:
1356 case BT_CONFIG:
1357 dc.handle = cpu_to_le16(conn->handle);
1358 dc.reason = 0x15; /* Terminated due to Power Off */
1359 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1360 break;
1361 case BT_CONNECT:
1362 if (conn->type == LE_LINK)
1363 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1364 0, NULL);
1365 else if (conn->type == ACL_LINK)
1366 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1367 6, &conn->dst);
1368 break;
1369 case BT_CONNECT2:
1370 bacpy(&rej.bdaddr, &conn->dst);
1371 rej.reason = 0x15; /* Terminated due to Power Off */
1372 if (conn->type == ACL_LINK)
1373 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1374 sizeof(rej), &rej);
1375 else if (conn->type == SCO_LINK)
1376 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1377 sizeof(rej), &rej);
1378 break;
1379 }
8b064a3a
JH		 1380 }
1381
23a48093
JH		 1382 err = hci_req_run(&req, clean_up_hci_complete);
1383 if (!err && discov_stopped)
1384 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1385
1386 return err;
8b064a3a
JH		 1387}
1388
bdb6d971 1389static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1390 u16 len)
eec8d2bc 1391{
650f726d 1392 struct mgmt_mode *cp = data;
366a0336 1393 struct pending_cmd *cmd;
4b34ee78 1394 int err;
eec8d2bc 1395
bdb6d971 1396 BT_DBG("request for %s", hdev->name);
eec8d2bc 1397
a7e80f25
JH		 1398 if (cp->val != 0x00 && cp->val != 0x01)
1399 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1400 MGMT_STATUS_INVALID_PARAMS);
1401
09fd0de5 1402 hci_dev_lock(hdev);
eec8d2bc 1403
87b95ba6
JH		 1404 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1405 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1406 MGMT_STATUS_BUSY);
1407 goto failed;
1408 }
1409
f0d4b78a
MH		 1410 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1411 cancel_delayed_work(&hdev->power_off);
1412
1413 if (cp->val) {
a1d70450
JH		 1414 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1415 data, len);
1416 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1417 goto failed;
1418 }
1419 }
1420
4b34ee78 1421 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1422 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1423 goto failed;
1424 }
1425
2e58ef3e 1426 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1427 if (!cmd) {
1428 err = -ENOMEM;
eec8d2bc 1429 goto failed;
366a0336 1430 }
eec8d2bc 1431
8b064a3a 1432 if (cp->val) {
19202573 1433 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1434 err = 0;
1435 } else {
1436 /* Disconnect connections, stop scans, etc */
1437 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1438 if (!err)
1439 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1440 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1441
8b064a3a
JH		 1442 /* ENODATA means there were no HCI commands queued */
1443 if (err == -ENODATA) {
a3172b7e 1444 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1445 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1446 err = 0;
1447 }
1448 }
eec8d2bc
JH		 1449
1450failed:
09fd0de5 1451 hci_dev_unlock(hdev);
366a0336 1452 return err;
eec8d2bc
JH		 1453}
1454
beadb2bd
JH		 1455static int new_settings(struct hci_dev *hdev, struct sock *skip)
1456{
1457 __le32 ev;
1458
1459 ev = cpu_to_le32(get_current_settings(hdev));
1460
1461 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1462}
1463
91a668b0
JH		 1464int mgmt_new_settings(struct hci_dev *hdev)
1465{
1466 return new_settings(hdev, NULL);
1467}
1468
bd99abdd
JH		 1469struct cmd_lookup {
1470 struct sock *sk;
1471 struct hci_dev *hdev;
1472 u8 mgmt_status;
1473};
1474
1475static void settings_rsp(struct pending_cmd *cmd, void *data)
1476{
1477 struct cmd_lookup *match = data;
1478
1479 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1480
1481 list_del(&cmd->list);
1482
1483 if (match->sk == NULL) {
1484 match->sk = cmd->sk;
1485 sock_hold(match->sk);
1486 }
1487
1488 mgmt_pending_free(cmd);
1489}
1490
1491static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1492{
1493 u8 *status = data;
1494
1495 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1496 mgmt_pending_remove(cmd);
1497}
1498
1b9b5ee5
JH		 1499static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1500{
1501 if (cmd->cmd_complete) {
1502 u8 *status = data;
1503
1504 cmd->cmd_complete(cmd, *status);
1505 mgmt_pending_remove(cmd);
1506
1507 return;
1508 }
1509
1510 cmd_status_rsp(cmd, data);
1511}
1512
9df74653 1513static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
f5818c22 1514{
9df74653
JH		 1515 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1516 cmd->param, cmd->param_len);
f5818c22
JH		 1517}
1518
9df74653 1519static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
7776d1d8 1520{
9df74653
JH		 1521 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1522 sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1523}
1524
e6fe7986
JH		 1525static u8 mgmt_bredr_support(struct hci_dev *hdev)
1526{
1527 if (!lmp_bredr_capable(hdev))
1528 return MGMT_STATUS_NOT_SUPPORTED;
1529 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1530 return MGMT_STATUS_REJECTED;
1531 else
1532 return MGMT_STATUS_SUCCESS;
1533}
1534
1535static u8 mgmt_le_support(struct hci_dev *hdev)
1536{
1537 if (!lmp_le_capable(hdev))
1538 return MGMT_STATUS_NOT_SUPPORTED;
1539 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1540 return MGMT_STATUS_REJECTED;
1541 else
1542 return MGMT_STATUS_SUCCESS;
1543}
1544
1904a853
MH		 1545static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1546 u16 opcode)
bfaf8c9f
JH		 1547{
1548 struct pending_cmd *cmd;
1549 struct mgmt_mode *cp;
970ba524 1550 struct hci_request req;
bfaf8c9f
JH		 1551 bool changed;
1552
1553 BT_DBG("status 0x%02x", status);
1554
1555 hci_dev_lock(hdev);
1556
1557 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1558 if (!cmd)
1559 goto unlock;
1560
1561 if (status) {
1562 u8 mgmt_err = mgmt_status(status);
1563 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
310a3d48 1564 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
bfaf8c9f
JH		 1565 goto remove_cmd;
1566 }
1567
1568 cp = cmd->param;
d4462a07 1569 if (cp->val) {
bfaf8c9f
JH		 1570 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1571 &hdev->dev_flags);
d4462a07
MH		 1572
1573 if (hdev->discov_timeout > 0) {
1574 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1575 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1576 to);
1577 }
1578 } else {
bfaf8c9f
JH		 1579 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1580 &hdev->dev_flags);
d4462a07 1581 }
bfaf8c9f
JH		 1582
1583 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1584
1585 if (changed)
1586 new_settings(hdev, cmd->sk);
1587
970ba524
MH		 1588 /* When the discoverable mode gets changed, make sure
1589 * that class of device has the limited discoverable
432df05e
JH		 1590 * bit correctly set. Also update page scan based on whitelist
1591 * entries.
970ba524
MH		 1592 */
1593 hci_req_init(&req, hdev);
1d2dc5b7 1594 __hci_update_page_scan(&req);
970ba524
MH		 1595 update_class(&req);
1596 hci_req_run(&req, NULL);
1597
bfaf8c9f
JH		 1598remove_cmd:
1599 mgmt_pending_remove(cmd);
1600
1601unlock:
1602 hci_dev_unlock(hdev);
1603}
1604
bdb6d971 1605static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1606 u16 len)
73f22f62 1607{
650f726d 1608 struct mgmt_cp_set_discoverable *cp = data;
366a0336 1609 struct pending_cmd *cmd;
bfaf8c9f 1610 struct hci_request req;
5e5282bb 1611 u16 timeout;
9a43e25f 1612 u8 scan;
73f22f62
JH		 1613 int err;
1614
bdb6d971 1615 BT_DBG("request for %s", hdev->name);
73f22f62 1616
9a43e25f
JH		 1617 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1618 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1619 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
9a43e25f 1620 MGMT_STATUS_REJECTED);
33c525c0 1621
310a3d48 1622 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a7e80f25
JH		 1623 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1624 MGMT_STATUS_INVALID_PARAMS);
1625
1f350c87 1626 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1627
1628 /* Disabling discoverable requires that no timeout is set,
1629 * and enabling limited discoverable requires a timeout.
1630 */
1631 if ((cp->val == 0x00 && timeout > 0) ||
1632 (cp->val == 0x02 && timeout == 0))
bdb6d971 1633 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1634 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1635
09fd0de5 1636 hci_dev_lock(hdev);
73f22f62 1637
5e5282bb 1638 if (!hdev_is_powered(hdev) && timeout > 0) {
bdb6d971 1639 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1640 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1641 goto failed;
1642 }
1643
2e58ef3e 1644 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1645 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1646 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1647 MGMT_STATUS_BUSY);
73f22f62
JH		 1648 goto failed;
1649 }
1650
5e5282bb 1651 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
bdb6d971 1652 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1653 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1654 goto failed;
1655 }
1656
1657 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1658 bool changed = false;
1659
310a3d48
MH		 1660 /* Setting limited discoverable when powered off is
1661 * not a valid operation since it requires a timeout
1662 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1663 */
0224d2fa
JH		 1664 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1665 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1666 changed = true;
1667 }
1668
5e5282bb 1669 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1670 if (err < 0)
1671 goto failed;
1672
1673 if (changed)
1674 err = new_settings(hdev, sk);
1675
5e5282bb
JH		 1676 goto failed;
1677 }
1678
310a3d48
MH		 1679 /* If the current mode is the same, then just update the timeout
1680 * value with the new value. And if only the timeout gets updated,
1681 * then no need for any HCI transactions.
1682 */
1683 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1684 (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1685 &hdev->dev_flags)) {
36261547
MH		 1686 cancel_delayed_work(&hdev->discov_off);
1687 hdev->discov_timeout = timeout;
955638ec 1688
36261547
MH		 1689 if (cp->val && hdev->discov_timeout > 0) {
1690 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1691 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1692 to);
955638ec
MH		 1693 }
1694
69ab39ea 1695 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1696 goto failed;
1697 }
1698
2e58ef3e 1699 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1700 if (!cmd) {
1701 err = -ENOMEM;
73f22f62 1702 goto failed;
366a0336 1703 }
73f22f62 1704
310a3d48
MH		 1705 /* Cancel any potential discoverable timeout that might be
1706 * still active and store new timeout value. The arming of
1707 * the timeout happens in the complete handler.
1708 */
1709 cancel_delayed_work(&hdev->discov_off);
1710 hdev->discov_timeout = timeout;
1711
b456f87c
JH		 1712 /* Limited discoverable mode */
1713 if (cp->val == 0x02)
1714 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1715 else
1716 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1717
bfaf8c9f
JH		 1718 hci_req_init(&req, hdev);
1719
9a43e25f
JH		 1720 /* The procedure for LE-only controllers is much simpler - just
1721 * update the advertising data.
1722 */
1723 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1724 goto update_ad;
1725
73f22f62
JH		 1726 scan = SCAN_PAGE;
1727
310a3d48
MH		 1728 if (cp->val) {
1729 struct hci_cp_write_current_iac_lap hci_cp;
1730
1731 if (cp->val == 0x02) {
1732 /* Limited discoverable mode */
33337dcb 1733 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1734 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1735 hci_cp.iac_lap[1] = 0x8b;
1736 hci_cp.iac_lap[2] = 0x9e;
1737 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1738 hci_cp.iac_lap[4] = 0x8b;
1739 hci_cp.iac_lap[5] = 0x9e;
1740 } else {
1741 /* General discoverable mode */
310a3d48
MH		 1742 hci_cp.num_iac = 1;
1743 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1744 hci_cp.iac_lap[1] = 0x8b;
1745 hci_cp.iac_lap[2] = 0x9e;
1746 }
1747
1748 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1749 (hci_cp.num_iac * 3) + 1, &hci_cp);
1750
73f22f62 1751 scan |= SCAN_INQUIRY;
310a3d48
MH		 1752 } else {
1753 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1754 }
73f22f62 1755
310a3d48 1756 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1757
9a43e25f
JH		 1758update_ad:
1759 update_adv_data(&req);
1760
bfaf8c9f 1761 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1762 if (err < 0)
a664b5bc 1763 mgmt_pending_remove(cmd);
73f22f62
JH		 1764
1765failed:
09fd0de5 1766 hci_dev_unlock(hdev);
73f22f62
JH		 1767 return err;
1768}
1769
406d7804
JH		 1770static void write_fast_connectable(struct hci_request *req, bool enable)
1771{
bd98b996 1772 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1773 struct hci_cp_write_page_scan_activity acp;
1774 u8 type;
1775
547003b1
JH		 1776 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1777 return;
1778
4c01f8b8
JH		 1779 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1780 return;
1781
406d7804
JH		 1782 if (enable) {
1783 type = PAGE_SCAN_TYPE_INTERLACED;
1784
1785 /* 160 msec page scan interval */
dcf4adbf 1786 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 1787 } else {
1788 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1789
1790 /* default 1.28 sec page scan */
dcf4adbf 1791 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 1792 }
1793
dcf4adbf 1794 acp.window = cpu_to_le16(0x0012);
406d7804 1795
bd98b996
JH		 1796 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1797 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1798 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1799 sizeof(acp), &acp);
1800
1801 if (hdev->page_scan_type != type)
1802 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1803}
1804
1904a853
MH		 1805static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1806 u16 opcode)
2b76f453
JH		 1807{
1808 struct pending_cmd *cmd;
d7b856f9 1809 struct mgmt_mode *cp;
bc6d2d04 1810 bool conn_changed, discov_changed;
2b76f453
JH		 1811
1812 BT_DBG("status 0x%02x", status);
1813
1814 hci_dev_lock(hdev);
1815
1816 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1817 if (!cmd)
1818 goto unlock;
1819
37438c1f
JH		 1820 if (status) {
1821 u8 mgmt_err = mgmt_status(status);
1822 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1823 goto remove_cmd;
1824 }
1825
d7b856f9 1826 cp = cmd->param;
bc6d2d04
JH		 1827 if (cp->val) {
1828 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1829 &hdev->dev_flags);
1830 discov_changed = false;
1831 } else {
1832 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1833 &hdev->dev_flags);
1834 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1835 &hdev->dev_flags);
1836 }
d7b856f9 1837
2b76f453
JH		 1838 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1839
bc6d2d04 1840 if (conn_changed || discov_changed) {
d7b856f9 1841 new_settings(hdev, cmd->sk);
1d2dc5b7 1842 hci_update_page_scan(hdev);
bc6d2d04
JH		 1843 if (discov_changed)
1844 mgmt_update_adv_data(hdev);
2b7be33e
JH		 1845 hci_update_background_scan(hdev);
1846 }
d7b856f9 1847
37438c1f 1848remove_cmd:
2b76f453
JH		 1849 mgmt_pending_remove(cmd);
1850
1851unlock:
1852 hci_dev_unlock(hdev);
1853}
1854
e8ba3a1f
JH		 1855static int set_connectable_update_settings(struct hci_dev *hdev,
1856 struct sock *sk, u8 val)
1857{
1858 bool changed = false;
1859 int err;
1860
1861 if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1862 changed = true;
1863
1864 if (val) {
1865 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1866 } else {
1867 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1868 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1869 }
1870
1871 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1872 if (err < 0)
1873 return err;
1874
562064e6 1875 if (changed) {
1d2dc5b7 1876 hci_update_page_scan(hdev);
562064e6 1877 hci_update_background_scan(hdev);
e8ba3a1f 1878 return new_settings(hdev, sk);
562064e6 1879 }
e8ba3a1f
JH		 1880
1881 return 0;
1882}
1883
bdb6d971 1884static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1885 u16 len)
9fbcbb45 1886{
650f726d 1887 struct mgmt_mode *cp = data;
366a0336 1888 struct pending_cmd *cmd;
2b76f453 1889 struct hci_request req;
1987fdc7 1890 u8 scan;
9fbcbb45
JH		 1891 int err;
1892
bdb6d971 1893 BT_DBG("request for %s", hdev->name);
9fbcbb45 1894
1987fdc7
JH		 1895 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1896 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1897 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1987fdc7 1898 MGMT_STATUS_REJECTED);
33c525c0 1899
a7e80f25
JH		 1900 if (cp->val != 0x00 && cp->val != 0x01)
1901 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1902 MGMT_STATUS_INVALID_PARAMS);
1903
09fd0de5 1904 hci_dev_lock(hdev);
9fbcbb45 1905
4b34ee78 1906 if (!hdev_is_powered(hdev)) {
e8ba3a1f 1907 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 1908 goto failed;
1909 }
1910
2e58ef3e 1911 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1912 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1913 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
04124681 1914 MGMT_STATUS_BUSY);
9fbcbb45
JH		 1915 goto failed;
1916 }
1917
2e58ef3e 1918 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 1919 if (!cmd) {
1920 err = -ENOMEM;
9fbcbb45 1921 goto failed;
366a0336 1922 }
9fbcbb45 1923
9b74246f 1924 hci_req_init(&req, hdev);
9fbcbb45 1925
9a43e25f
JH		 1926 /* If BR/EDR is not enabled and we disable advertising as a
1927 * by-product of disabling connectable, we need to update the
1928 * advertising flags.
1929 */
1930 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1931 if (!cp->val) {
1932 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1933 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1934 }
1935 update_adv_data(&req);
1936 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 1937 if (cp->val) {
1938 scan = SCAN_PAGE;
1939 } else {
3bd27240
JH		 1940 /* If we don't have any whitelist entries just
1941 * disable all scanning. If there are entries
1942 * and we had both page and inquiry scanning
1943 * enabled then fall back to only page scanning.
1944 * Otherwise no changes are needed.
1945 */
1946 if (list_empty(&hdev->whitelist))
1947 scan = SCAN_DISABLED;
1948 else if (test_bit(HCI_ISCAN, &hdev->flags))
1949 scan = SCAN_PAGE;
1950 else
1951 goto no_scan_update;
9b74246f
JH		 1952
1953 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 1954 hdev->discov_timeout > 0)
9b74246f
JH		 1955 cancel_delayed_work(&hdev->discov_off);
1956 }
2b76f453 1957
9b74246f
JH		 1958 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1959 }
2b76f453 1960
3bd27240 1961no_scan_update:
4c01f8b8
JH		 1962 /* If we're going from non-connectable to connectable or
1963 * vice-versa when fast connectable is enabled ensure that fast
1964 * connectable gets disabled. write_fast_connectable won't do
1965 * anything if the page scan parameters are already what they
1966 * should be.
1967 */
1968 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
e36a3769
JH		 1969 write_fast_connectable(&req, false);
1970
e8b1202c
JH		 1971 /* Update the advertising parameters if necessary */
1972 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1987fdc7 1973 enable_advertising(&req);
1987fdc7 1974
2b76f453 1975 err = hci_req_run(&req, set_connectable_complete);
9b74246f 1976 if (err < 0) {
a664b5bc 1977 mgmt_pending_remove(cmd);
9b74246f 1978 if (err == -ENODATA)
a81070ba
JH		 1979 err = set_connectable_update_settings(hdev, sk,
1980 cp->val);
9b74246f
JH		 1981 goto failed;
1982 }
9fbcbb45
JH		 1983
1984failed:
09fd0de5 1985 hci_dev_unlock(hdev);
9fbcbb45
JH		 1986 return err;
1987}
1988
b2939475 1989static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1990 u16 len)
c542a06c 1991{
650f726d 1992 struct mgmt_mode *cp = data;
55594356 1993 bool changed;
c542a06c
JH		 1994 int err;
1995
bdb6d971 1996 BT_DBG("request for %s", hdev->name);
c542a06c 1997
a7e80f25 1998 if (cp->val != 0x00 && cp->val != 0x01)
b2939475 1999 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
a7e80f25
JH		 2000 MGMT_STATUS_INVALID_PARAMS);
2001
09fd0de5 2002 hci_dev_lock(hdev);
c542a06c
JH		 2003
2004 if (cp->val)
b6ae8457 2005 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
c542a06c 2006 else
b6ae8457 2007 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
c542a06c 2008
b2939475 2009 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2010 if (err < 0)
55594356 2011 goto unlock;
c542a06c 2012
55594356
MH		 2013 if (changed)
2014 err = new_settings(hdev, sk);
c542a06c 2015
55594356 2016unlock:
09fd0de5 2017 hci_dev_unlock(hdev);
c542a06c
JH		 2018 return err;
2019}
2020
04124681
GP		 2021static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2022 u16 len)
33ef95ed
JH		 2023{
2024 struct mgmt_mode *cp = data;
2025 struct pending_cmd *cmd;
e6fe7986 2026 u8 val, status;
33ef95ed
JH		 2027 int err;
2028
bdb6d971 2029 BT_DBG("request for %s", hdev->name);
33ef95ed 2030
e6fe7986
JH		 2031 status = mgmt_bredr_support(hdev);
2032 if (status)
33c525c0 2033 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
e6fe7986 2034 status);
33c525c0 2035
a7e80f25
JH		 2036 if (cp->val != 0x00 && cp->val != 0x01)
2037 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2038 MGMT_STATUS_INVALID_PARAMS);
2039
33ef95ed
JH		 2040 hci_dev_lock(hdev);
2041
4b34ee78 2042 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2043 bool changed = false;
2044
2045 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
8ce8e2b5 2046 &hdev->dev_flags)) {
47990ea0
JH		 2047 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2048 changed = true;
2049 }
2050
2051 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2052 if (err < 0)
2053 goto failed;
2054
2055 if (changed)
2056 err = new_settings(hdev, sk);
2057
33ef95ed
JH		 2058 goto failed;
2059 }
2060
2061 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
bdb6d971 2062 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
04124681 2063 MGMT_STATUS_BUSY);
33ef95ed
JH		 2064 goto failed;
2065 }
2066
2067 val = !!cp->val;
2068
2069 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2070 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2071 goto failed;
2072 }
2073
2074 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2075 if (!cmd) {
2076 err = -ENOMEM;
2077 goto failed;
2078 }
2079
2080 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2081 if (err < 0) {
2082 mgmt_pending_remove(cmd);
2083 goto failed;
2084 }
2085
2086failed:
2087 hci_dev_unlock(hdev);
33ef95ed
JH		 2088 return err;
2089}
2090
bdb6d971 2091static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2092{
2093 struct mgmt_mode *cp = data;
2094 struct pending_cmd *cmd;
72ef0c1a 2095 u8 status;
ed2c4ee3
JH		 2096 int err;
2097
bdb6d971 2098 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2099
cdba5281
MH		 2100 status = mgmt_bredr_support(hdev);
2101 if (status)
2102 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2103
13ecd8b6
JH		 2104 if (!lmp_ssp_capable(hdev))
2105 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2106 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2107
a7e80f25
JH		 2108 if (cp->val != 0x00 && cp->val != 0x01)
2109 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2110 MGMT_STATUS_INVALID_PARAMS);
2111
13ecd8b6 2112 hci_dev_lock(hdev);
6c8f12c1 2113
4b34ee78 2114 if (!hdev_is_powered(hdev)) {
9ecb3e24 2115 bool changed;
c0ecddc2 2116
9ecb3e24
MH		 2117 if (cp->val) {
2118 changed = !test_and_set_bit(HCI_SSP_ENABLED,
2119 &hdev->dev_flags);
2120 } else {
2121 changed = test_and_clear_bit(HCI_SSP_ENABLED,
2122 &hdev->dev_flags);
2123 if (!changed)
2124 changed = test_and_clear_bit(HCI_HS_ENABLED,
2125 &hdev->dev_flags);
2126 else
2127 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
c0ecddc2
JH		 2128 }
2129
2130 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2131 if (err < 0)
2132 goto failed;
2133
2134 if (changed)
2135 err = new_settings(hdev, sk);
2136
ed2c4ee3
JH		 2137 goto failed;
2138 }
2139
94d52dad 2140 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
d97dcb66
SJ		 2141 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2142 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2143 goto failed;
2144 }
2145
72ef0c1a 2146 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
ed2c4ee3
JH		 2147 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2148 goto failed;
2149 }
2150
2151 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2152 if (!cmd) {
2153 err = -ENOMEM;
2154 goto failed;
2155 }
2156
3769972b
JH		 2157 if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2158 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2159 sizeof(cp->val), &cp->val);
2160
72ef0c1a 2161 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2162 if (err < 0) {
2163 mgmt_pending_remove(cmd);
2164 goto failed;
2165 }
2166
2167failed:
2168 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2169 return err;
2170}
2171
bdb6d971 2172static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2173{
2174 struct mgmt_mode *cp = data;
ee392693 2175 bool changed;
e6fe7986 2176 u8 status;
ee392693 2177 int err;
6d80dfd0 2178
bdb6d971 2179 BT_DBG("request for %s", hdev->name);
6d80dfd0 2180
e6fe7986
JH		 2181 status = mgmt_bredr_support(hdev);
2182 if (status)
2183 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2184
9ecb3e24
MH		 2185 if (!lmp_ssp_capable(hdev))
2186 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2187 MGMT_STATUS_NOT_SUPPORTED);
2188
2189 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2190 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2191 MGMT_STATUS_REJECTED);
2192
a7e80f25
JH		 2193 if (cp->val != 0x00 && cp->val != 0x01)
2194 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2195 MGMT_STATUS_INVALID_PARAMS);
2196
ee392693
MH		 2197 hci_dev_lock(hdev);
2198
a2cb01de
JH		 2199 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
2200 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2201 MGMT_STATUS_BUSY);
2202 goto unlock;
2203 }
2204
a0cdf960 2205 if (cp->val) {
ee392693 2206 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960
MH		 2207 } else {
2208 if (hdev_is_powered(hdev)) {
2209 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2210 MGMT_STATUS_REJECTED);
2211 goto unlock;
2212 }
2213
ee392693 2214 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960 2215 }
ee392693
MH		 2216
2217 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2218 if (err < 0)
2219 goto unlock;
2220
2221 if (changed)
2222 err = new_settings(hdev, sk);
6d80dfd0 2223
ee392693
MH		 2224unlock:
2225 hci_dev_unlock(hdev);
2226 return err;
6d80dfd0
JH		 2227}
2228
1904a853 2229static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2230{
2231 struct cmd_lookup match = { NULL, hdev };
2232
3ad67582
JK		 2233 hci_dev_lock(hdev);
2234
416a4ae5
JH		 2235 if (status) {
2236 u8 mgmt_err = mgmt_status(status);
2237
2238 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2239 &mgmt_err);
3ad67582 2240 goto unlock;
416a4ae5
JH		 2241 }
2242
2243 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2244
2245 new_settings(hdev, match.sk);
2246
2247 if (match.sk)
2248 sock_put(match.sk);
441ad2d0
MH		 2249
2250 /* Make sure the controller has a good default for
2251 * advertising data. Restrict the update to when LE
2252 * has actually been enabled. During power on, the
2253 * update in powered_update_hci will take care of it.
2254 */
2255 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2256 struct hci_request req;
2257
441ad2d0 2258 hci_req_init(&req, hdev);
5947f4bc 2259 update_adv_data(&req);
f14d8f64 2260 update_scan_rsp_data(&req);
2cf22218 2261 __hci_update_background_scan(&req);
441ad2d0 2262 hci_req_run(&req, NULL);
441ad2d0 2263 }
3ad67582
JK		 2264
2265unlock:
2266 hci_dev_unlock(hdev);
416a4ae5
JH		 2267}
2268
bdb6d971 2269static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2270{
2271 struct mgmt_mode *cp = data;
2272 struct hci_cp_write_le_host_supported hci_cp;
2273 struct pending_cmd *cmd;
416a4ae5 2274 struct hci_request req;
06199cf8 2275 int err;
0b60eba1 2276 u8 val, enabled;
06199cf8 2277
bdb6d971 2278 BT_DBG("request for %s", hdev->name);
06199cf8 2279
13ecd8b6
JH		 2280 if (!lmp_le_capable(hdev))
2281 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2282 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2283
a7e80f25
JH		 2284 if (cp->val != 0x00 && cp->val != 0x01)
2285 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2286 MGMT_STATUS_INVALID_PARAMS);
2287
c73eee91 2288 /* LE-only devices do not allow toggling LE on/off */
56f87901 2289 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
c73eee91
JH		 2290 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2291 MGMT_STATUS_REJECTED);
2292
13ecd8b6 2293 hci_dev_lock(hdev);
06199cf8
JH		 2294
2295 val = !!cp->val;
ffa88e02 2296 enabled = lmp_host_le_capable(hdev);
06199cf8 2297
0b60eba1 2298 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2299 bool changed = false;
2300
2301 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2302 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2303 changed = true;
2304 }
2305
f3d3444a
JH		 2306 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2307 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
eeca6f89
JH		 2308 changed = true;
2309 }
2310
06199cf8
JH		 2311 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2312 if (err < 0)
1de028ce 2313 goto unlock;
06199cf8
JH		 2314
2315 if (changed)
2316 err = new_settings(hdev, sk);
2317
1de028ce 2318 goto unlock;
06199cf8
JH		 2319 }
2320
4375f103
JH		 2321 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2322 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
bdb6d971 2323 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
04124681 2324 MGMT_STATUS_BUSY);
1de028ce 2325 goto unlock;
06199cf8
JH		 2326 }
2327
2328 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2329 if (!cmd) {
2330 err = -ENOMEM;
1de028ce 2331 goto unlock;
06199cf8
JH		 2332 }
2333
441ad2d0
MH		 2334 hci_req_init(&req, hdev);
2335
06199cf8
JH		 2336 memset(&hci_cp, 0, sizeof(hci_cp));
2337
2338 if (val) {
2339 hci_cp.le = val;
32226e4f 2340 hci_cp.simul = 0x00;
441ad2d0 2341 } else {
73e082f8 2342 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
441ad2d0 2343 disable_advertising(&req);
06199cf8
JH		 2344 }
2345
416a4ae5
JH		 2346 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2347 &hci_cp);
2348
2349 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2350 if (err < 0)
06199cf8 2351 mgmt_pending_remove(cmd);
06199cf8 2352
1de028ce
JH		 2353unlock:
2354 hci_dev_unlock(hdev);
06199cf8
JH		 2355 return err;
2356}
2357
0cab9c80
JH		 2358/* This is a helper function to test for pending mgmt commands that can
2359 * cause CoD or EIR HCI commands. We can only allow one such pending
2360 * mgmt command at a time since otherwise we cannot easily track what
2361 * the current values are, will be, and based on that calculate if a new
2362 * HCI command needs to be sent and if yes with what value.
2363 */
2364static bool pending_eir_or_class(struct hci_dev *hdev)
2365{
2366 struct pending_cmd *cmd;
2367
2368 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2369 switch (cmd->opcode) {
2370 case MGMT_OP_ADD_UUID:
2371 case MGMT_OP_REMOVE_UUID:
2372 case MGMT_OP_SET_DEV_CLASS:
2373 case MGMT_OP_SET_POWERED:
2374 return true;
2375 }
2376 }
2377
2378 return false;
2379}
2380
83be8eca
JH		 2381static const u8 bluetooth_base_uuid[] = {
2382 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2383 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2384};
2385
2386static u8 get_uuid_size(const u8 *uuid)
2387{
2388 u32 val;
2389
2390 if (memcmp(uuid, bluetooth_base_uuid, 12))
2391 return 128;
2392
2393 val = get_unaligned_le32(&uuid[12]);
2394 if (val > 0xffff)
2395 return 32;
2396
2397 return 16;
2398}
2399
92da6097
JH		 2400static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2401{
2402 struct pending_cmd *cmd;
2403
2404 hci_dev_lock(hdev);
2405
2406 cmd = mgmt_pending_find(mgmt_op, hdev);
2407 if (!cmd)
2408 goto unlock;
2409
2410 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2411 hdev->dev_class, 3);
2412
2413 mgmt_pending_remove(cmd);
2414
2415unlock:
2416 hci_dev_unlock(hdev);
2417}
2418
1904a853 2419static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2420{
2421 BT_DBG("status 0x%02x", status);
2422
2423 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2424}
2425
bdb6d971 2426static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2427{
650f726d 2428 struct mgmt_cp_add_uuid *cp = data;
90e70454 2429 struct pending_cmd *cmd;
890ea898 2430 struct hci_request req;
2aeb9a1a 2431 struct bt_uuid *uuid;
2aeb9a1a
JH		 2432 int err;
2433
bdb6d971 2434 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2435
09fd0de5 2436 hci_dev_lock(hdev);
2aeb9a1a 2437
0cab9c80 2438 if (pending_eir_or_class(hdev)) {
bdb6d971 2439 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
04124681 2440 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2441 goto failed;
2442 }
2443
92c4c204 2444 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2445 if (!uuid) {
2446 err = -ENOMEM;
2447 goto failed;
2448 }
2449
2450 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2451 uuid->svc_hint = cp->svc_hint;
83be8eca 2452 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2453
de66aa63 2454 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2455
890ea898 2456 hci_req_init(&req, hdev);
1aff6f09 2457
890ea898
JH		 2458 update_class(&req);
2459 update_eir(&req);
2460
92da6097
JH		 2461 err = hci_req_run(&req, add_uuid_complete);
2462 if (err < 0) {
2463 if (err != -ENODATA)
2464 goto failed;
80a1e1db 2465
bdb6d971 2466 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
04124681 2467 hdev->dev_class, 3);
90e70454
JH		 2468 goto failed;
2469 }
2470
2471 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2472 if (!cmd) {
90e70454 2473 err = -ENOMEM;
890ea898
JH		 2474 goto failed;
2475 }
2476
2477 err = 0;
2aeb9a1a
JH		 2478
2479failed:
09fd0de5 2480 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2481 return err;
2482}
2483
24b78d0f
JH		 2484static bool enable_service_cache(struct hci_dev *hdev)
2485{
2486 if (!hdev_is_powered(hdev))
2487 return false;
2488
2489 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
46818ed5
JH		 2490 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2491 CACHE_TIMEOUT);
24b78d0f
JH		 2492 return true;
2493 }
2494
2495 return false;
2496}
2497
1904a853 2498static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2499{
2500 BT_DBG("status 0x%02x", status);
2501
2502 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2503}
2504
bdb6d971 2505static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2506 u16 len)
2aeb9a1a 2507{
650f726d 2508 struct mgmt_cp_remove_uuid *cp = data;
90e70454 2509 struct pending_cmd *cmd;
056341c8 2510 struct bt_uuid *match, *tmp;
2aeb9a1a 2511 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2512 struct hci_request req;
2aeb9a1a
JH		 2513 int err, found;
2514
bdb6d971 2515 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2516
09fd0de5 2517 hci_dev_lock(hdev);
2aeb9a1a 2518
0cab9c80 2519 if (pending_eir_or_class(hdev)) {
bdb6d971 2520 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2521 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2522 goto unlock;
2523 }
2524
2aeb9a1a 2525 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2526 hci_uuids_clear(hdev);
4004b6d9 2527
24b78d0f 2528 if (enable_service_cache(hdev)) {
bdb6d971 2529 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2530 0, hdev->dev_class, 3);
24b78d0f
JH		 2531 goto unlock;
2532 }
4004b6d9 2533
9246a869 2534 goto update_class;
2aeb9a1a
JH		 2535 }
2536
2537 found = 0;
2538
056341c8 2539 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2540 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2541 continue;
2542
2543 list_del(&match->list);
482049f7 2544 kfree(match);
2aeb9a1a
JH		 2545 found++;
2546 }
2547
2548 if (found == 0) {
bdb6d971 2549 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2550 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2551 goto unlock;
2552 }
2553
9246a869 2554update_class:
890ea898 2555 hci_req_init(&req, hdev);
1aff6f09 2556
890ea898
JH		 2557 update_class(&req);
2558 update_eir(&req);
2559
92da6097
JH		 2560 err = hci_req_run(&req, remove_uuid_complete);
2561 if (err < 0) {
2562 if (err != -ENODATA)
2563 goto unlock;
80a1e1db 2564
bdb6d971 2565 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
04124681 2566 hdev->dev_class, 3);
90e70454
JH		 2567 goto unlock;
2568 }
2569
2570 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2571 if (!cmd) {
90e70454 2572 err = -ENOMEM;
890ea898
JH		 2573 goto unlock;
2574 }
2575
2576 err = 0;
2aeb9a1a
JH		 2577
2578unlock:
09fd0de5 2579 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2580 return err;
2581}
2582
1904a853 2583static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2584{
2585 BT_DBG("status 0x%02x", status);
2586
2587 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2588}
2589
bdb6d971 2590static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2591 u16 len)
1aff6f09 2592{
650f726d 2593 struct mgmt_cp_set_dev_class *cp = data;
90e70454 2594 struct pending_cmd *cmd;
890ea898 2595 struct hci_request req;
1aff6f09
JH		 2596 int err;
2597
bdb6d971 2598 BT_DBG("request for %s", hdev->name);
1aff6f09 2599
6203fc98 2600 if (!lmp_bredr_capable(hdev))
13ecd8b6
JH		 2601 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2602 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2603
0cab9c80 2604 hci_dev_lock(hdev);
ee98f473 2605
0cab9c80
JH		 2606 if (pending_eir_or_class(hdev)) {
2607 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2608 MGMT_STATUS_BUSY);
2609 goto unlock;
2610 }
c95f0ba7 2611
0cab9c80
JH		 2612 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2613 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2614 MGMT_STATUS_INVALID_PARAMS);
2615 goto unlock;
2616 }
575b3a02 2617
932f5ff5
JH		 2618 hdev->major_class = cp->major;
2619 hdev->minor_class = cp->minor;
2620
b5235a65 2621 if (!hdev_is_powered(hdev)) {
bdb6d971 2622 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2623 hdev->dev_class, 3);
b5235a65
JH		 2624 goto unlock;
2625 }
2626
890ea898
JH		 2627 hci_req_init(&req, hdev);
2628
a8b2d5c2 2629 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
7d78525d
JH		 2630 hci_dev_unlock(hdev);
2631 cancel_delayed_work_sync(&hdev->service_cache);
2632 hci_dev_lock(hdev);
890ea898 2633 update_eir(&req);
7d78525d 2634 }
14c0b608 2635
890ea898
JH		 2636 update_class(&req);
2637
92da6097
JH		 2638 err = hci_req_run(&req, set_class_complete);
2639 if (err < 0) {
2640 if (err != -ENODATA)
2641 goto unlock;
1aff6f09 2642
bdb6d971 2643 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2644 hdev->dev_class, 3);
90e70454
JH		 2645 goto unlock;
2646 }
2647
2648 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2649 if (!cmd) {
90e70454 2650 err = -ENOMEM;
890ea898
JH		 2651 goto unlock;
2652 }
2653
2654 err = 0;
1aff6f09 2655
b5235a65 2656unlock:
09fd0de5 2657 hci_dev_unlock(hdev);
1aff6f09
JH		 2658 return err;
2659}
2660
bdb6d971 2661static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2662 u16 len)
55ed8ca1 2663{
650f726d 2664 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2665 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2666 sizeof(struct mgmt_link_key_info));
4e51eae9 2667 u16 key_count, expected_len;
b1de97d8 2668 bool changed;
a492cd52 2669 int i;
55ed8ca1 2670
9060d5cf
MH		 2671 BT_DBG("request for %s", hdev->name);
2672
2673 if (!lmp_bredr_capable(hdev))
2674 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2675 MGMT_STATUS_NOT_SUPPORTED);
2676
1f350c87 2677 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2678 if (key_count > max_key_count) {
2679 BT_ERR("load_link_keys: too big key_count value %u",
2680 key_count);
2681 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2682 MGMT_STATUS_INVALID_PARAMS);
2683 }
55ed8ca1 2684
86742e1e
JH		 2685 expected_len = sizeof(*cp) + key_count *
2686 sizeof(struct mgmt_link_key_info);
a492cd52 2687 if (expected_len != len) {
86742e1e 2688 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2689 expected_len, len);
bdb6d971 2690 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
04124681 2691 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2692 }
2693
4ae14301
JH		 2694 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2695 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2696 MGMT_STATUS_INVALID_PARAMS);
2697
bdb6d971 2698 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2699 key_count);
55ed8ca1 2700
4ee71b20
JH		 2701 for (i = 0; i < key_count; i++) {
2702 struct mgmt_link_key_info *key = &cp->keys[i];
2703
8e991132 2704 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
4ee71b20
JH		 2705 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2706 MGMT_STATUS_INVALID_PARAMS);
2707 }
2708
09fd0de5 2709 hci_dev_lock(hdev);
55ed8ca1
JH		 2710
2711 hci_link_keys_clear(hdev);
2712
55ed8ca1 2713 if (cp->debug_keys)
0663b297
JH		 2714 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2715 &hdev->dev_flags);
55ed8ca1 2716 else
0663b297
JH		 2717 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2718 &hdev->dev_flags);
b1de97d8
MH		 2719
2720 if (changed)
2721 new_settings(hdev, NULL);
55ed8ca1 2722
a492cd52 2723 for (i = 0; i < key_count; i++) {
86742e1e 2724 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2725
58e9293c
JH		 2726 /* Always ignore debug keys and require a new pairing if
2727 * the user wants to use them.
2728 */
2729 if (key->type == HCI_LK_DEBUG_COMBINATION)
2730 continue;
2731
7652ff6a
JH		 2732 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2733 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2734 }
2735
bdb6d971 2736 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2737
09fd0de5 2738 hci_dev_unlock(hdev);
55ed8ca1 2739
a492cd52 2740 return 0;
55ed8ca1
JH		 2741}
2742
b1078ad0 2743static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2744 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2745{
2746 struct mgmt_ev_device_unpaired ev;
2747
2748 bacpy(&ev.addr.bdaddr, bdaddr);
2749 ev.addr.type = addr_type;
2750
2751 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2752 skip_sk);
b1078ad0
JH		 2753}
2754
bdb6d971 2755static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2756 u16 len)
55ed8ca1 2757{
124f6e35
JH		 2758 struct mgmt_cp_unpair_device *cp = data;
2759 struct mgmt_rp_unpair_device rp;
a8a1d19e
JH		 2760 struct hci_cp_disconnect dc;
2761 struct pending_cmd *cmd;
55ed8ca1 2762 struct hci_conn *conn;
55ed8ca1
JH		 2763 int err;
2764
a8a1d19e 2765 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2766 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2767 rp.addr.type = cp->addr.type;
a8a1d19e 2768
4ee71b20
JH		 2769 if (!bdaddr_type_is_valid(cp->addr.type))
2770 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2771 MGMT_STATUS_INVALID_PARAMS,
2772 &rp, sizeof(rp));
2773
118da70b
JH		 2774 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2775 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2776 MGMT_STATUS_INVALID_PARAMS,
2777 &rp, sizeof(rp));
2778
4ee71b20
JH		 2779 hci_dev_lock(hdev);
2780
86a8cfc6 2781 if (!hdev_is_powered(hdev)) {
bdb6d971 2782 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2783 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
86a8cfc6
JH		 2784 goto unlock;
2785 }
2786
e0b2b27e 2787 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2788 /* If disconnection is requested, then look up the
2789 * connection. If the remote device is connected, it
2790 * will be later used to terminate the link.
2791 *
2792 * Setting it to NULL explicitly will cause no
2793 * termination of the link.
2794 */
2795 if (cp->disconnect)
2796 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2797 &cp->addr.bdaddr);
2798 else
2799 conn = NULL;
2800
124f6e35 2801 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2802 } else {
2803 u8 addr_type;
2804
89cbb063
AA		 2805 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2806 &cp->addr.bdaddr);
2807 if (conn) {
2808 /* Defer clearing up the connection parameters
2809 * until closing to give a chance of keeping
2810 * them if a repairing happens.
2811 */
2812 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2813
2814 /* If disconnection is not requested, then
2815 * clear the connection variable so that the
2816 * link is not terminated.
2817 */
2818 if (!cp->disconnect)
2819 conn = NULL;
2820 }
2821
e0b2b27e
JH		 2822 if (cp->addr.type == BDADDR_LE_PUBLIC)
2823 addr_type = ADDR_LE_DEV_PUBLIC;
2824 else
2825 addr_type = ADDR_LE_DEV_RANDOM;
2826
a7ec7338
JH		 2827 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2828
e0b2b27e
JH		 2829 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2830 }
b0dbfb46 2831
55ed8ca1 2832 if (err < 0) {
bdb6d971 2833 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2834 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
55ed8ca1
JH		 2835 goto unlock;
2836 }
2837
89cbb063
AA		 2838 /* If the connection variable is set, then termination of the
2839 * link is requested.
2840 */
a8a1d19e 2841 if (!conn) {
bdb6d971 2842 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
04124681 2843 &rp, sizeof(rp));
b1078ad0 2844 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 2845 goto unlock;
2846 }
55ed8ca1 2847
124f6e35 2848 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 2849 sizeof(*cp));
a8a1d19e
JH		 2850 if (!cmd) {
2851 err = -ENOMEM;
2852 goto unlock;
55ed8ca1
JH		 2853 }
2854
d8b7b1e4
JH		 2855 cmd->cmd_complete = addr_cmd_complete;
2856
eb55ef07 2857 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 2858 dc.reason = 0x13; /* Remote User Terminated Connection */
2859 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2860 if (err < 0)
2861 mgmt_pending_remove(cmd);
2862
55ed8ca1 2863unlock:
09fd0de5 2864 hci_dev_unlock(hdev);
55ed8ca1
JH		 2865 return err;
2866}
2867
bdb6d971 2868static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2869 u16 len)
8962ee74 2870{
650f726d 2871 struct mgmt_cp_disconnect *cp = data;
06a63b19 2872 struct mgmt_rp_disconnect rp;
366a0336 2873 struct pending_cmd *cmd;
8962ee74 2874 struct hci_conn *conn;
8962ee74
JH		 2875 int err;
2876
2877 BT_DBG("");
2878
06a63b19
JH		 2879 memset(&rp, 0, sizeof(rp));
2880 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2881 rp.addr.type = cp->addr.type;
2882
4ee71b20 2883 if (!bdaddr_type_is_valid(cp->addr.type))
06a63b19
JH		 2884 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2885 MGMT_STATUS_INVALID_PARAMS,
2886 &rp, sizeof(rp));
4ee71b20 2887
09fd0de5 2888 hci_dev_lock(hdev);
8962ee74
JH		 2889
2890 if (!test_bit(HCI_UP, &hdev->flags)) {
06a63b19
JH		 2891 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2892 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
8962ee74
JH		 2893 goto failed;
2894 }
2895
2e58ef3e 2896 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
06a63b19
JH		 2897 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2898 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 2899 goto failed;
2900 }
2901
591f47f3 2902 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 2903 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2904 &cp->addr.bdaddr);
88c3df13
JH		 2905 else
2906 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 2907
f960727e 2908 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
06a63b19
JH		 2909 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2910 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
8962ee74
JH		 2911 goto failed;
2912 }
2913
2e58ef3e 2914 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 2915 if (!cmd) {
2916 err = -ENOMEM;
8962ee74 2917 goto failed;
366a0336 2918 }
8962ee74 2919
f5818c22
JH		 2920 cmd->cmd_complete = generic_cmd_complete;
2921
e3f2f92a 2922 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 2923 if (err < 0)
a664b5bc 2924 mgmt_pending_remove(cmd);
8962ee74
JH		 2925
2926failed:
09fd0de5 2927 hci_dev_unlock(hdev);
8962ee74
JH		 2928 return err;
2929}
2930
57c1477c 2931static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 2932{
2933 switch (link_type) {
2934 case LE_LINK:
48264f06
JH		 2935 switch (addr_type) {
2936 case ADDR_LE_DEV_PUBLIC:
591f47f3 2937 return BDADDR_LE_PUBLIC;
0ed09148 2938
48264f06 2939 default:
0ed09148 2940 /* Fallback to LE Random address type */
591f47f3 2941 return BDADDR_LE_RANDOM;
48264f06 2942 }
0ed09148 2943
4c659c39 2944 default:
0ed09148 2945 /* Fallback to BR/EDR type */
591f47f3 2946 return BDADDR_BREDR;
4c659c39
JH		 2947 }
2948}
2949
04124681
GP		 2950static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2951 u16 data_len)
2784eb41 2952{
2784eb41 2953 struct mgmt_rp_get_connections *rp;
8035ded4 2954 struct hci_conn *c;
a38528f1 2955 size_t rp_len;
60fc5fb6
JH		 2956 int err;
2957 u16 i;
2784eb41
JH		 2958
2959 BT_DBG("");
2960
09fd0de5 2961 hci_dev_lock(hdev);
2784eb41 2962
5f97c1df 2963 if (!hdev_is_powered(hdev)) {
bdb6d971 2964 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
04124681 2965 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 2966 goto unlock;
2967 }
2968
60fc5fb6 2969 i = 0;
b644ba33
JH		 2970 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2971 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 2972 i++;
2784eb41
JH		 2973 }
2974
60fc5fb6 2975 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 2976 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 2977 if (!rp) {
2784eb41
JH		 2978 err = -ENOMEM;
2979 goto unlock;
2980 }
2981
2784eb41 2982 i = 0;
4c659c39 2983 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 2984 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2985 continue;
4c659c39 2986 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 2987 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 2988 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 2989 continue;
2990 i++;
2991 }
2992
eb55ef07 2993 rp->conn_count = cpu_to_le16(i);
60fc5fb6 2994
4c659c39
JH		 2995 /* Recalculate length in case of filtered SCO connections, etc */
2996 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 2997
bdb6d971 2998 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
04124681 2999 rp_len);
2784eb41 3000
a38528f1 3001 kfree(rp);
5f97c1df
JH		 3002
3003unlock:
09fd0de5 3004 hci_dev_unlock(hdev);
2784eb41
JH		 3005 return err;
3006}
3007
bdb6d971 3008static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3009 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67
WR		 3010{
3011 struct pending_cmd *cmd;
3012 int err;
3013
2e58ef3e 3014 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3015 sizeof(*cp));
96d97a67
WR		 3016 if (!cmd)
3017 return -ENOMEM;
3018
d8457698 3019 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3020 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3021 if (err < 0)
3022 mgmt_pending_remove(cmd);
3023
3024 return err;
3025}
3026
bdb6d971 3027static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3028 u16 len)
980e1a53 3029{
96d97a67 3030 struct hci_conn *conn;
650f726d 3031 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3032 struct hci_cp_pin_code_reply reply;
366a0336 3033 struct pending_cmd *cmd;
980e1a53
JH		 3034 int err;
3035
3036 BT_DBG("");
3037
09fd0de5 3038 hci_dev_lock(hdev);
980e1a53 3039
4b34ee78 3040 if (!hdev_is_powered(hdev)) {
bdb6d971 3041 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3042 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3043 goto failed;
3044 }
3045
d8457698 3046 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3047 if (!conn) {
bdb6d971 3048 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3049 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3050 goto failed;
3051 }
3052
3053 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3054 struct mgmt_cp_pin_code_neg_reply ncp;
3055
3056 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3057
3058 BT_ERR("PIN code is not 16 bytes long");
3059
bdb6d971 3060 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3061 if (err >= 0)
bdb6d971 3062 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3063 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3064
3065 goto failed;
3066 }
3067
00abfe44 3068 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3069 if (!cmd) {
3070 err = -ENOMEM;
980e1a53 3071 goto failed;
366a0336 3072 }
980e1a53 3073
7776d1d8
JH		 3074 cmd->cmd_complete = addr_cmd_complete;
3075
d8457698 3076 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3077 reply.pin_len = cp->pin_len;
24718ca5 3078 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3079
3080 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3081 if (err < 0)
a664b5bc 3082 mgmt_pending_remove(cmd);
980e1a53
JH		 3083
3084failed:
09fd0de5 3085 hci_dev_unlock(hdev);
980e1a53
JH		 3086 return err;
3087}
3088
04124681
GP		 3089static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3090 u16 len)
17fa4b9d 3091{
650f726d 3092 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3093
3094 BT_DBG("");
3095
4ec86d4c
JH		 3096 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3097 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3098 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3099
09fd0de5 3100 hci_dev_lock(hdev);
17fa4b9d
JH		 3101
3102 hdev->io_capability = cp->io_capability;
3103
3104 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3105 hdev->io_capability);
17fa4b9d 3106
09fd0de5 3107 hci_dev_unlock(hdev);
17fa4b9d 3108
04124681
GP		 3109 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3110 0);
17fa4b9d
JH		 3111}
3112
6039aa73 3113static struct pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3114{
3115 struct hci_dev *hdev = conn->hdev;
8035ded4 3116 struct pending_cmd *cmd;
e9a416b5 3117
2e58ef3e 3118 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3119 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3120 continue;
3121
e9a416b5
JH		 3122 if (cmd->user_data != conn)
3123 continue;
3124
3125 return cmd;
3126 }
3127
3128 return NULL;
3129}
3130
9df74653 3131static int pairing_complete(struct pending_cmd *cmd, u8 status)
e9a416b5
JH		 3132{
3133 struct mgmt_rp_pair_device rp;
3134 struct hci_conn *conn = cmd->user_data;
9df74653 3135 int err;
e9a416b5 3136
61b1a7fb
JH		 3137 bacpy(&rp.addr.bdaddr, &conn->dst);
3138 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3139
9df74653
JH		 3140 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3141 &rp, sizeof(rp));
e9a416b5
JH		 3142
3143 /* So we don't get further callbacks for this connection */
3144 conn->connect_cfm_cb = NULL;
3145 conn->security_cfm_cb = NULL;
3146 conn->disconn_cfm_cb = NULL;
3147
76a68ba0 3148 hci_conn_drop(conn);
89cbb063
AA		 3149
3150 /* The device is paired so there is no need to remove
3151 * its connection parameters anymore.
3152 */
3153 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3154
3155 hci_conn_put(conn);
9df74653
JH		 3156
3157 return err;
e9a416b5
JH		 3158}
3159
f4a407be
JH		 3160void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3161{
3162 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3163 struct pending_cmd *cmd;
3164
3165 cmd = find_pairing(conn);
a511b35b 3166 if (cmd) {
04ab2749 3167 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3168 mgmt_pending_remove(cmd);
3169 }
f4a407be
JH		 3170}
3171
e9a416b5
JH		 3172static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3173{
3174 struct pending_cmd *cmd;
3175
3176 BT_DBG("status %u", status);
3177
3178 cmd = find_pairing(conn);
a511b35b 3179 if (!cmd) {
e9a416b5 3180 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3181 return;
3182 }
3183
3184 cmd->cmd_complete(cmd, mgmt_status(status));
3185 mgmt_pending_remove(cmd);
e9a416b5
JH		 3186}
3187
f4a407be 3188static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739
VA		 3189{
3190 struct pending_cmd *cmd;
3191
3192 BT_DBG("status %u", status);
3193
3194 if (!status)
3195 return;
3196
3197 cmd = find_pairing(conn);
a511b35b 3198 if (!cmd) {
4c47d739 3199 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3200 return;
3201 }
3202
3203 cmd->cmd_complete(cmd, mgmt_status(status));
3204 mgmt_pending_remove(cmd);
4c47d739
VA		 3205}
3206
bdb6d971 3207static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3208 u16 len)
e9a416b5 3209{
650f726d 3210 struct mgmt_cp_pair_device *cp = data;
1425acb7 3211 struct mgmt_rp_pair_device rp;
e9a416b5
JH		 3212 struct pending_cmd *cmd;
3213 u8 sec_level, auth_type;
3214 struct hci_conn *conn;
e9a416b5
JH		 3215 int err;
3216
3217 BT_DBG("");
3218
f950a30e
SJ		 3219 memset(&rp, 0, sizeof(rp));
3220 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3221 rp.addr.type = cp->addr.type;
3222
4ee71b20
JH		 3223 if (!bdaddr_type_is_valid(cp->addr.type))
3224 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3225 MGMT_STATUS_INVALID_PARAMS,
3226 &rp, sizeof(rp));
3227
4ec86d4c
JH		 3228 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3229 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3230 MGMT_STATUS_INVALID_PARAMS,
3231 &rp, sizeof(rp));
3232
09fd0de5 3233 hci_dev_lock(hdev);
e9a416b5 3234
5f97c1df 3235 if (!hdev_is_powered(hdev)) {
f950a30e
SJ		 3236 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3237 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5f97c1df
JH		 3238 goto unlock;
3239 }
3240
c908df36 3241 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3242 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3243
6f77d8c7 3244 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3245 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3246 auth_type);
6f77d8c7
AG		 3247 } else {
3248 u8 addr_type;
3249
3250 /* Convert from L2CAP channel address type to HCI address type
3251 */
3252 if (cp->addr.type == BDADDR_LE_PUBLIC)
3253 addr_type = ADDR_LE_DEV_PUBLIC;
3254 else
3255 addr_type = ADDR_LE_DEV_RANDOM;
3256
7c264b10
MH		 3257 /* When pairing a new device, it is expected to remember
3258 * this device for future connections. Adding the connection
3259 * parameter information ahead of time allows tracking
3260 * of the slave preferred values and will speed up any
3261 * further connection establishment.
3262 *
3263 * If connection parameters already exist, then they
3264 * will be kept and this function does nothing.
3265 */
3266 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3267
6f77d8c7 3268 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3269 sec_level, HCI_LE_CONN_TIMEOUT,
3270 HCI_ROLE_MASTER);
6f77d8c7 3271 }
7a512d01 3272
30e76272 3273 if (IS_ERR(conn)) {
489dc48e
AK		 3274 int status;
3275
3276 if (PTR_ERR(conn) == -EBUSY)
3277 status = MGMT_STATUS_BUSY;
faa81030
LR		 3278 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3279 status = MGMT_STATUS_NOT_SUPPORTED;
3280 else if (PTR_ERR(conn) == -ECONNREFUSED)
3281 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3282 else
3283 status = MGMT_STATUS_CONNECT_FAILED;
3284
bdb6d971 3285 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
489dc48e 3286 status, &rp,
04124681 3287 sizeof(rp));
e9a416b5
JH		 3288 goto unlock;
3289 }
3290
3291 if (conn->connect_cfm_cb) {
76a68ba0 3292 hci_conn_drop(conn);
bdb6d971 3293 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
04124681 3294 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3295 goto unlock;
3296 }
3297
2e58ef3e 3298 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3299 if (!cmd) {
3300 err = -ENOMEM;
76a68ba0 3301 hci_conn_drop(conn);
e9a416b5
JH		 3302 goto unlock;
3303 }
3304
04ab2749
JH		 3305 cmd->cmd_complete = pairing_complete;
3306
7a512d01 3307 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3308 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3309 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3310 conn->security_cfm_cb = pairing_complete_cb;
3311 conn->disconn_cfm_cb = pairing_complete_cb;
3312 } else {
3313 conn->connect_cfm_cb = le_pairing_complete_cb;
3314 conn->security_cfm_cb = le_pairing_complete_cb;
3315 conn->disconn_cfm_cb = le_pairing_complete_cb;
3316 }
7a512d01 3317
e9a416b5 3318 conn->io_capability = cp->io_cap;
f8aaf9b6 3319 cmd->user_data = hci_conn_get(conn);
e9a416b5 3320
6f78fd4b 3321 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3322 hci_conn_security(conn, sec_level, auth_type, true)) {
3323 cmd->cmd_complete(cmd, 0);
3324 mgmt_pending_remove(cmd);
3325 }
e9a416b5
JH		 3326
3327 err = 0;
3328
3329unlock:
09fd0de5 3330 hci_dev_unlock(hdev);
e9a416b5
JH		 3331 return err;
3332}
3333
04124681
GP		 3334static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3335 u16 len)
28424707 3336{
0f4e68cf 3337 struct mgmt_addr_info *addr = data;
28424707
JH		 3338 struct pending_cmd *cmd;
3339 struct hci_conn *conn;
3340 int err;
3341
3342 BT_DBG("");
3343
28424707
JH		 3344 hci_dev_lock(hdev);
3345
5f97c1df 3346 if (!hdev_is_powered(hdev)) {
bdb6d971 3347 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3348 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3349 goto unlock;
3350 }
3351
28424707
JH		 3352 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3353 if (!cmd) {
bdb6d971 3354 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3355 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3356 goto unlock;
3357 }
3358
3359 conn = cmd->user_data;
3360
3361 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
bdb6d971 3362 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3363 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3364 goto unlock;
3365 }
3366
a511b35b
JH		 3367 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3368 mgmt_pending_remove(cmd);
28424707 3369
bdb6d971 3370 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
04124681 3371 addr, sizeof(*addr));
28424707
JH		 3372unlock:
3373 hci_dev_unlock(hdev);
28424707
JH		 3374 return err;
3375}
3376
bdb6d971 3377static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3378 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3379 u16 hci_op, __le32 passkey)
a5c29683 3380{
a5c29683 3381 struct pending_cmd *cmd;
0df4c185 3382 struct hci_conn *conn;
a5c29683
JH		 3383 int err;
3384
09fd0de5 3385 hci_dev_lock(hdev);
08ba5382 3386
4b34ee78 3387 if (!hdev_is_powered(hdev)) {
feb94d3d
JH		 3388 err = cmd_complete(sk, hdev->id, mgmt_op,
3389 MGMT_STATUS_NOT_POWERED, addr,
3390 sizeof(*addr));
0df4c185 3391 goto done;
a5c29683
JH		 3392 }
3393
1707c60e
JH		 3394 if (addr->type == BDADDR_BREDR)
3395 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3396 else
1707c60e 3397 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3398
3399 if (!conn) {
feb94d3d
JH		 3400 err = cmd_complete(sk, hdev->id, mgmt_op,
3401 MGMT_STATUS_NOT_CONNECTED, addr,
3402 sizeof(*addr));
272d90df
JH		 3403 goto done;
3404 }
47c15e2b 3405
1707c60e 3406 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3407 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3408 if (!err)
feb94d3d
JH		 3409 err = cmd_complete(sk, hdev->id, mgmt_op,
3410 MGMT_STATUS_SUCCESS, addr,
3411 sizeof(*addr));
5fe57d9e 3412 else
feb94d3d
JH		 3413 err = cmd_complete(sk, hdev->id, mgmt_op,
3414 MGMT_STATUS_FAILED, addr,
3415 sizeof(*addr));
47c15e2b 3416
47c15e2b
BG		 3417 goto done;
3418 }
3419
1707c60e 3420 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3421 if (!cmd) {
3422 err = -ENOMEM;
0df4c185 3423 goto done;
a5c29683
JH		 3424 }
3425
7776d1d8
JH		 3426 cmd->cmd_complete = addr_cmd_complete;
3427
0df4c185 3428 /* Continue with pairing via HCI */
604086b7
BG		 3429 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3430 struct hci_cp_user_passkey_reply cp;
3431
1707c60e 3432 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3433 cp.passkey = passkey;
3434 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3435 } else
1707c60e
JH		 3436 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3437 &addr->bdaddr);
604086b7 3438
a664b5bc
JH		 3439 if (err < 0)
3440 mgmt_pending_remove(cmd);
a5c29683 3441
0df4c185 3442done:
09fd0de5 3443 hci_dev_unlock(hdev);
a5c29683
JH		 3444 return err;
3445}
3446
afeb019d
JK		 3447static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3448 void *data, u16 len)
3449{
3450 struct mgmt_cp_pin_code_neg_reply *cp = data;
3451
3452 BT_DBG("");
3453
1707c60e 3454 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3455 MGMT_OP_PIN_CODE_NEG_REPLY,
3456 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3457}
3458
04124681
GP		 3459static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3460 u16 len)
0df4c185 3461{
650f726d 3462 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3463
3464 BT_DBG("");
3465
3466 if (len != sizeof(*cp))
bdb6d971 3467 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
04124681 3468 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3469
1707c60e 3470 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3471 MGMT_OP_USER_CONFIRM_REPLY,
3472 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3473}
3474
bdb6d971 3475static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3476 void *data, u16 len)
0df4c185 3477{
c9c2659f 3478 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3479
3480 BT_DBG("");
3481
1707c60e 3482 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3483 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3484 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3485}
3486
04124681
GP		 3487static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3488 u16 len)
604086b7 3489{
650f726d 3490 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3491
3492 BT_DBG("");
3493
1707c60e 3494 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3495 MGMT_OP_USER_PASSKEY_REPLY,
3496 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3497}
3498
bdb6d971 3499static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3500 void *data, u16 len)
604086b7 3501{
650f726d 3502 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3503
3504 BT_DBG("");
3505
1707c60e 3506 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3507 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3508 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3509}
3510
13928971 3511static void update_name(struct hci_request *req)
2b4bf397 3512{
13928971 3513 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3514 struct hci_cp_write_local_name cp;
3515
13928971 3516 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3517
890ea898 3518 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3519}
3520
1904a853 3521static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3522{
3523 struct mgmt_cp_set_local_name *cp;
3524 struct pending_cmd *cmd;
3525
3526 BT_DBG("status 0x%02x", status);
3527
3528 hci_dev_lock(hdev);
3529
3530 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3531 if (!cmd)
3532 goto unlock;
3533
3534 cp = cmd->param;
3535
3536 if (status)
3537 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3538 mgmt_status(status));
3539 else
3540 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3541 cp, sizeof(*cp));
3542
3543 mgmt_pending_remove(cmd);
3544
3545unlock:
3546 hci_dev_unlock(hdev);
3547}
3548
bdb6d971 3549static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3550 u16 len)
b312b161 3551{
2b4bf397 3552 struct mgmt_cp_set_local_name *cp = data;
b312b161 3553 struct pending_cmd *cmd;
890ea898 3554 struct hci_request req;
b312b161
JH		 3555 int err;
3556
3557 BT_DBG("");
3558
09fd0de5 3559 hci_dev_lock(hdev);
b312b161 3560
b3f2ca94
JH		 3561 /* If the old values are the same as the new ones just return a
3562 * direct command complete event.
3563 */
3564 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3565 !memcmp(hdev->short_name, cp->short_name,
3566 sizeof(hdev->short_name))) {
3567 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3568 data, len);
3569 goto failed;
3570 }
3571
2b4bf397 3572 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3573
b5235a65 3574 if (!hdev_is_powered(hdev)) {
2b4bf397 3575 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde
JH		 3576
3577 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
04124681 3578 data, len);
28cc7bde
JH		 3579 if (err < 0)
3580 goto failed;
3581
3582 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
04124681 3583 sk);
28cc7bde 3584
b5235a65
JH		 3585 goto failed;
3586 }
3587
28cc7bde 3588 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3589 if (!cmd) {
3590 err = -ENOMEM;
3591 goto failed;
3592 }
3593
13928971
JH		 3594 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3595
890ea898 3596 hci_req_init(&req, hdev);
3f985050
JH		 3597
3598 if (lmp_bredr_capable(hdev)) {
3599 update_name(&req);
3600 update_eir(&req);
3601 }
3602
7a5f4990
MH		 3603 /* The name is stored in the scan response data and so
3604 * no need to udpate the advertising data here.
3605 */
3f985050 3606 if (lmp_le_capable(hdev))
7a5f4990 3607 update_scan_rsp_data(&req);
3f985050 3608
13928971 3609 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3610 if (err < 0)
3611 mgmt_pending_remove(cmd);
3612
3613failed:
09fd0de5 3614 hci_dev_unlock(hdev);
b312b161
JH		 3615 return err;
3616}
3617
0f4e68cf 3618static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3619 void *data, u16 data_len)
c35938b2 3620{
c35938b2
SJ		 3621 struct pending_cmd *cmd;
3622 int err;
3623
bdb6d971 3624 BT_DBG("%s", hdev->name);
c35938b2 3625
09fd0de5 3626 hci_dev_lock(hdev);
c35938b2 3627
4b34ee78 3628 if (!hdev_is_powered(hdev)) {
bdb6d971 3629 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3630 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3631 goto unlock;
3632 }
3633
9a1a1996 3634 if (!lmp_ssp_capable(hdev)) {
bdb6d971 3635 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3636 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3637 goto unlock;
3638 }
3639
2e58ef3e 3640 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
bdb6d971 3641 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3642 MGMT_STATUS_BUSY);
c35938b2
SJ		 3643 goto unlock;
3644 }
3645
2e58ef3e 3646 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3647 if (!cmd) {
3648 err = -ENOMEM;
3649 goto unlock;
3650 }
3651
710f11c0 3652 if (bredr_sc_enabled(hdev))
4d2d2796
MH		 3653 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3654 0, NULL);
3655 else
3656 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3657
c35938b2
SJ		 3658 if (err < 0)
3659 mgmt_pending_remove(cmd);
3660
3661unlock:
09fd0de5 3662 hci_dev_unlock(hdev);
c35938b2
SJ		 3663 return err;
3664}
3665
bdb6d971 3666static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3667 void *data, u16 len)
2763eda6 3668{
5d57e796 3669 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3670 int err;
3671
bdb6d971 3672 BT_DBG("%s ", hdev->name);
2763eda6 3673
5d57e796
JH		 3674 if (!bdaddr_type_is_valid(addr->type))
3675 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3676 MGMT_STATUS_INVALID_PARAMS, addr,
3677 sizeof(*addr));
3678
09fd0de5 3679 hci_dev_lock(hdev);
2763eda6 3680
ec109113
MH		 3681 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3682 struct mgmt_cp_add_remote_oob_data *cp = data;
3683 u8 status;
bf1e3541 3684
c19a495c
JH		 3685 if (cp->addr.type != BDADDR_BREDR) {
3686 err = cmd_complete(sk, hdev->id,
3687 MGMT_OP_ADD_REMOTE_OOB_DATA,
3688 MGMT_STATUS_INVALID_PARAMS,
3689 &cp->addr, sizeof(cp->addr));
3690 goto unlock;
3691 }
3692
ec109113 3693 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 3694 cp->addr.type, cp->hash,
3695 cp->rand, NULL, NULL);
ec109113
MH		 3696 if (err < 0)
3697 status = MGMT_STATUS_FAILED;
3698 else
3699 status = MGMT_STATUS_SUCCESS;
3700
3701 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3702 status, &cp->addr, sizeof(cp->addr));
3703 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3704 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 3705 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 3706 u8 status;
3707
86df9200 3708 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 3709 /* Enforce zero-valued 192-bit parameters as
3710 * long as legacy SMP OOB isn't implemented.
3711 */
3712 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3713 memcmp(cp->hash192, ZERO_KEY, 16)) {
3714 err = cmd_complete(sk, hdev->id,
3715 MGMT_OP_ADD_REMOTE_OOB_DATA,
3716 MGMT_STATUS_INVALID_PARAMS,
3717 addr, sizeof(*addr));
3718 goto unlock;
3719 }
3720
86df9200
JH		 3721 rand192 = NULL;
3722 hash192 = NULL;
3723 } else {
41bcfd50
MH		 3724 /* In case one of the P-192 values is set to zero,
3725 * then just disable OOB data for P-192.
3726 */
3727 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3728 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3729 rand192 = NULL;
3730 hash192 = NULL;
3731 } else {
3732 rand192 = cp->rand192;
3733 hash192 = cp->hash192;
3734 }
3735 }
3736
3737 /* In case one of the P-256 values is set to zero, then just
3738 * disable OOB data for P-256.
3739 */
3740 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3741 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3742 rand256 = NULL;
3743 hash256 = NULL;
3744 } else {
3745 rand256 = cp->rand256;
3746 hash256 = cp->hash256;
86df9200
JH		 3747 }
3748
81328d5c 3749 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 3750 cp->addr.type, hash192, rand192,
41bcfd50 3751 hash256, rand256);
ec109113
MH		 3752 if (err < 0)
3753 status = MGMT_STATUS_FAILED;
3754 else
3755 status = MGMT_STATUS_SUCCESS;
3756
3757 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3758 status, &cp->addr, sizeof(cp->addr));
3759 } else {
3760 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3761 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3762 MGMT_STATUS_INVALID_PARAMS);
3763 }
2763eda6 3764
c19a495c 3765unlock:
09fd0de5 3766 hci_dev_unlock(hdev);
2763eda6
SJ		 3767 return err;
3768}
3769
bdb6d971 3770static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3771 void *data, u16 len)
2763eda6 3772{
650f726d 3773 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3774 u8 status;
2763eda6
SJ		 3775 int err;
3776
bdb6d971 3777 BT_DBG("%s", hdev->name);
2763eda6 3778
c19a495c
JH		 3779 if (cp->addr.type != BDADDR_BREDR)
3780 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3781 MGMT_STATUS_INVALID_PARAMS,
3782 &cp->addr, sizeof(cp->addr));
3783
09fd0de5 3784 hci_dev_lock(hdev);
2763eda6 3785
eedbd581
JH		 3786 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3787 hci_remote_oob_data_clear(hdev);
3788 status = MGMT_STATUS_SUCCESS;
3789 goto done;
3790 }
3791
6928a924 3792 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 3793 if (err < 0)
bf1e3541 3794 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3795 else
a6785be2 3796 status = MGMT_STATUS_SUCCESS;
bf1e3541 3797
eedbd581 3798done:
bdb6d971 3799 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
04124681 3800 status, &cp->addr, sizeof(cp->addr));
2763eda6 3801
09fd0de5 3802 hci_dev_unlock(hdev);
2763eda6
SJ		 3803 return err;
3804}
3805
8019044d 3806static bool trigger_discovery(struct hci_request *req, u8 *status)
41dc2bd6 3807{
8019044d
MH		 3808 struct hci_dev *hdev = req->hdev;
3809 struct hci_cp_le_set_scan_param param_cp;
3810 struct hci_cp_le_set_scan_enable enable_cp;
3811 struct hci_cp_inquiry inq_cp;
3812 /* General inquiry access code (GIAC) */
3813 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3814 u8 own_addr_type;
41dc2bd6
AG		 3815 int err;
3816
8019044d
MH		 3817 switch (hdev->discovery.type) {
3818 case DISCOV_TYPE_BREDR:
3819 *status = mgmt_bredr_support(hdev);
3820 if (*status)
3821 return false;
41dc2bd6 3822
8019044d
MH		 3823 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3824 *status = MGMT_STATUS_BUSY;
3825 return false;
3826 }
41dc2bd6 3827
8019044d 3828 hci_inquiry_cache_flush(hdev);
41dc2bd6 3829
8019044d
MH		 3830 memset(&inq_cp, 0, sizeof(inq_cp));
3831 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3832 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3833 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3834 break;
41dc2bd6 3835
8019044d
MH		 3836 case DISCOV_TYPE_LE:
3837 case DISCOV_TYPE_INTERLEAVED:
3838 *status = mgmt_le_support(hdev);
3839 if (*status)
3840 return false;
3841
3842 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3843 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3844 *status = MGMT_STATUS_NOT_SUPPORTED;
3845 return false;
3846 }
3847
3848 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3849 /* Don't let discovery abort an outgoing
3850 * connection attempt that's using directed
3851 * advertising.
3852 */
3853 if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3854 BT_CONNECT)) {
3855 *status = MGMT_STATUS_REJECTED;
3856 return false;
3857 }
3858
3859 disable_advertising(req);
3860 }
3861
3862 /* If controller is scanning, it means the background scanning
3863 * is running. Thus, we should temporarily stop it in order to
3864 * set the discovery scanning parameters.
3865 */
3866 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3867 hci_req_add_le_scan_disable(req);
3868
3869 memset(&param_cp, 0, sizeof(param_cp));
3870
3871 /* All active scans will be done with either a resolvable
3872 * private address (when privacy feature has been enabled)
9437d2ed 3873 * or non-resolvable private address.
8019044d
MH		 3874 */
3875 err = hci_update_random_address(req, true, &own_addr_type);
3876 if (err < 0) {
3877 *status = MGMT_STATUS_FAILED;
3878 return false;
3879 }
3880
3881 param_cp.type = LE_SCAN_ACTIVE;
3882 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3883 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3884 param_cp.own_address_type = own_addr_type;
3885 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3886 &param_cp);
3887
3888 memset(&enable_cp, 0, sizeof(enable_cp));
3889 enable_cp.enable = LE_SCAN_ENABLE;
3890 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3891 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3892 &enable_cp);
3893 break;
3894
3895 default:
3896 *status = MGMT_STATUS_INVALID_PARAMS;
3897 return false;
3898 }
3899
3900 return true;
41dc2bd6
AG		 3901}
3902
1904a853
MH		 3903static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3904 u16 opcode)
7c307720 3905{
41dc2bd6 3906 struct pending_cmd *cmd;
11e6e25d 3907 unsigned long timeout;
ae55f598 3908
7c307720
AG		 3909 BT_DBG("status %d", status);
3910
11e6e25d 3911 hci_dev_lock(hdev);
41dc2bd6 3912
11e6e25d 3913 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427
JP		 3914 if (!cmd)
3915 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3916
11e6e25d 3917 if (cmd) {
2922a94f 3918 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 3919 mgmt_pending_remove(cmd);
3920 }
7c307720
AG		 3921
3922 if (status) {
11e6e25d
MH		 3923 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3924 goto unlock;
7c307720
AG		 3925 }
3926
7c307720 3927 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 3928
2d28cfe7
JP		 3929 /* If the scan involves LE scan, pick proper timeout to schedule
3930 * hdev->le_scan_disable that will stop it.
3931 */
7c307720
AG		 3932 switch (hdev->discovery.type) {
3933 case DISCOV_TYPE_LE:
3d5a76f0 3934 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 3935 break;
7c307720 3936 case DISCOV_TYPE_INTERLEAVED:
b9a7a61e 3937 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 3938 break;
7c307720 3939 case DISCOV_TYPE_BREDR:
11e6e25d 3940 timeout = 0;
7c307720 3941 break;
7c307720
AG		 3942 default:
3943 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 3944 timeout = 0;
3945 break;
7c307720 3946 }
ae55f598 3947
2d28cfe7
JP		 3948 if (timeout) {
3949 /* When service discovery is used and the controller has
3950 * a strict duplicate filter, it is important to remember
3951 * the start and duration of the scan. This is required
3952 * for restarting scanning during the discovery phase.
3953 */
3954 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
3955 &hdev->quirks) &&
82f8b651 3956 hdev->discovery.result_filtering) {
2d28cfe7
JP		 3957 hdev->discovery.scan_start = jiffies;
3958 hdev->discovery.scan_duration = timeout;
3959 }
3960
11e6e25d
MH		 3961 queue_delayed_work(hdev->workqueue,
3962 &hdev->le_scan_disable, timeout);
2d28cfe7 3963 }
ae55f598 3964
11e6e25d
MH		 3965unlock:
3966 hci_dev_unlock(hdev);
7c307720
AG		 3967}
3968
bdb6d971 3969static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 3970 void *data, u16 len)
14a53664 3971{
650f726d 3972 struct mgmt_cp_start_discovery *cp = data;
14a53664 3973 struct pending_cmd *cmd;
7c307720 3974 struct hci_request req;
8019044d 3975 u8 status;
14a53664
JH		 3976 int err;
3977
bdb6d971 3978 BT_DBG("%s", hdev->name);
14a53664 3979
09fd0de5 3980 hci_dev_lock(hdev);
14a53664 3981
4b34ee78 3982 if (!hdev_is_powered(hdev)) {
a736abc1
SJ		 3983 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3984 MGMT_STATUS_NOT_POWERED,
3985 &cp->type, sizeof(cp->type));
bd2d1334
JH		 3986 goto failed;
3987 }
3988
f5a969f2
MH		 3989 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3990 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
a736abc1
SJ		 3991 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3992 MGMT_STATUS_BUSY, &cp->type,
3993 sizeof(cp->type));
642be6c7
AG		 3994 goto failed;
3995 }
3996
2922a94f 3997 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 3998 if (!cmd) {
3999 err = -ENOMEM;
4000 goto failed;
4001 }
4002
2922a94f
JH		 4003 cmd->cmd_complete = generic_cmd_complete;
4004
22078800
MH		 4005 /* Clear the discovery filter first to free any previously
4006 * allocated memory for the UUID list.
4007 */
4008 hci_discovery_filter_clear(hdev);
4009
4aab14e5 4010 hdev->discovery.type = cp->type;
da25cf6a 4011 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4012
7c307720
AG		 4013 hci_req_init(&req, hdev);
4014
8019044d 4015 if (!trigger_discovery(&req, &status)) {
a736abc1 4016 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
8019044d 4017 status, &cp->type, sizeof(cp->type));
04106755
JH		 4018 mgmt_pending_remove(cmd);
4019 goto failed;
f39799f5 4020 }
04106755 4021
7c307720 4022 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4023 if (err < 0) {
14a53664 4024 mgmt_pending_remove(cmd);
f5a969f2
MH		 4025 goto failed;
4026 }
7c307720 4027
f5a969f2 4028 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4029
14a53664 4030failed:
09fd0de5 4031 hci_dev_unlock(hdev);
14a53664
JH		 4032 return err;
4033}
f39799f5 4034
9df74653 4035static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
2922a94f 4036{
9df74653
JH		 4037 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4038 cmd->param, 1);
2922a94f 4039}
04106755 4040
66ea9427
JP		 4041static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4042 void *data, u16 len)
4043{
4044 struct mgmt_cp_start_service_discovery *cp = data;
4045 struct pending_cmd *cmd;
4046 struct hci_request req;
4047 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4048 u16 uuid_count, expected_len;
4049 u8 status;
4050 int err;
04106755 4051
66ea9427 4052 BT_DBG("%s", hdev->name);
e8bb6b97 4053
66ea9427 4054 hci_dev_lock(hdev);
7c307720 4055
66ea9427
JP		 4056 if (!hdev_is_powered(hdev)) {
4057 err = cmd_complete(sk, hdev->id,
4058 MGMT_OP_START_SERVICE_DISCOVERY,
4059 MGMT_STATUS_NOT_POWERED,
4060 &cp->type, sizeof(cp->type));
4061 goto failed;
4062 }
7c307720 4063
66ea9427
JP		 4064 if (hdev->discovery.state != DISCOVERY_STOPPED ||
4065 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4066 err = cmd_complete(sk, hdev->id,
4067 MGMT_OP_START_SERVICE_DISCOVERY,
4068 MGMT_STATUS_BUSY, &cp->type,
4069 sizeof(cp->type));
4070 goto failed;
4071 }
d9483943 4072
66ea9427
JP		 4073 uuid_count = __le16_to_cpu(cp->uuid_count);
4074 if (uuid_count > max_uuid_count) {
4075 BT_ERR("service_discovery: too big uuid_count value %u",
4076 uuid_count);
4077 err = cmd_complete(sk, hdev->id,
4078 MGMT_OP_START_SERVICE_DISCOVERY,
4079 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4080 sizeof(cp->type));
4081 goto failed;
4082 }
4083
4084 expected_len = sizeof(*cp) + uuid_count * 16;
4085 if (expected_len != len) {
4086 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4087 expected_len, len);
4088 err = cmd_complete(sk, hdev->id,
4089 MGMT_OP_START_SERVICE_DISCOVERY,
4090 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4091 sizeof(cp->type));
4092 goto failed;
4093 }
4094
4095 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4096 hdev, data, len);
66ea9427
JP		 4097 if (!cmd) {
4098 err = -ENOMEM;
4099 goto failed;
4100 }
4101
2922a94f
JH		 4102 cmd->cmd_complete = service_discovery_cmd_complete;
4103
22078800
MH		 4104 /* Clear the discovery filter first to free any previously
4105 * allocated memory for the UUID list.
4106 */
4107 hci_discovery_filter_clear(hdev);
4108
82f8b651 4109 hdev->discovery.result_filtering = true;
66ea9427
JP		 4110 hdev->discovery.type = cp->type;
4111 hdev->discovery.rssi = cp->rssi;
4112 hdev->discovery.uuid_count = uuid_count;
4113
4114 if (uuid_count > 0) {
4115 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4116 GFP_KERNEL);
4117 if (!hdev->discovery.uuids) {
a736abc1 4118 err = cmd_complete(sk, hdev->id,
66ea9427 4119 MGMT_OP_START_SERVICE_DISCOVERY,
a736abc1
SJ		 4120 MGMT_STATUS_FAILED,
4121 &cp->type, sizeof(cp->type));
d9483943
JH		 4122 mgmt_pending_remove(cmd);
4123 goto failed;
4124 }
66ea9427 4125 }
d9483943 4126
66ea9427 4127 hci_req_init(&req, hdev);
5e0452c0 4128
66ea9427
JP		 4129 if (!trigger_discovery(&req, &status)) {
4130 err = cmd_complete(sk, hdev->id,
4131 MGMT_OP_START_SERVICE_DISCOVERY,
4132 status, &cp->type, sizeof(cp->type));
04106755
JH		 4133 mgmt_pending_remove(cmd);
4134 goto failed;
f39799f5 4135 }
3fd24153 4136
7c307720 4137 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4138 if (err < 0) {
14a53664 4139 mgmt_pending_remove(cmd);
66ea9427
JP		 4140 goto failed;
4141 }
4142
4143 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4144
4145failed:
09fd0de5 4146 hci_dev_unlock(hdev);
14a53664
JH		 4147 return err;
4148}
4149
1904a853 4150static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca
AG		 4151{
4152 struct pending_cmd *cmd;
1183fdca 4153
0e05bba6
AG		 4154 BT_DBG("status %d", status);
4155
4156 hci_dev_lock(hdev);
4157
11e6e25d
MH		 4158 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4159 if (cmd) {
2922a94f 4160 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4161 mgmt_pending_remove(cmd);
0e05bba6
AG		 4162 }
4163
11e6e25d
MH		 4164 if (!status)
4165 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4166
0e05bba6
AG		 4167 hci_dev_unlock(hdev);
4168}
4169
bdb6d971 4170static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4171 u16 len)
14a53664 4172{
d930650b 4173 struct mgmt_cp_stop_discovery *mgmt_cp = data;
14a53664 4174 struct pending_cmd *cmd;
0e05bba6 4175 struct hci_request req;
14a53664
JH		 4176 int err;
4177
bdb6d971 4178 BT_DBG("%s", hdev->name);
14a53664 4179
09fd0de5 4180 hci_dev_lock(hdev);
14a53664 4181
30dc78e1 4182 if (!hci_discovery_active(hdev)) {
bdb6d971 4183 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 4184 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4185 sizeof(mgmt_cp->type));
d930650b
JH		 4186 goto unlock;
4187 }
4188
4189 if (hdev->discovery.type != mgmt_cp->type) {
bdb6d971 4190 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 4191 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4192 sizeof(mgmt_cp->type));
30dc78e1 4193 goto unlock;
ff9ef578
JH		 4194 }
4195
2922a94f 4196 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4197 if (!cmd) {
4198 err = -ENOMEM;
30dc78e1
JH		 4199 goto unlock;
4200 }
4201
2922a94f
JH		 4202 cmd->cmd_complete = generic_cmd_complete;
4203
0e05bba6
AG		 4204 hci_req_init(&req, hdev);
4205
21a60d30 4206 hci_stop_discovery(&req);
e0d9727e 4207
21a60d30
JH		 4208 err = hci_req_run(&req, stop_discovery_complete);
4209 if (!err) {
4210 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4211 goto unlock;
14a53664
JH		 4212 }
4213
21a60d30
JH		 4214 mgmt_pending_remove(cmd);
4215
4216 /* If no HCI commands were sent we're done */
4217 if (err == -ENODATA) {
4218 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4219 &mgmt_cp->type, sizeof(mgmt_cp->type));
4220 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4221 }
14a53664 4222
30dc78e1 4223unlock:
09fd0de5 4224 hci_dev_unlock(hdev);
14a53664
JH		 4225 return err;
4226}
4227
bdb6d971 4228static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4229 u16 len)
561aafbc 4230{
650f726d 4231 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4232 struct inquiry_entry *e;
561aafbc
JH		 4233 int err;
4234
bdb6d971 4235 BT_DBG("%s", hdev->name);
561aafbc 4236
561aafbc
JH		 4237 hci_dev_lock(hdev);
4238
30dc78e1 4239 if (!hci_discovery_active(hdev)) {
d3a2541d
LR		 4240 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4241 MGMT_STATUS_FAILED, &cp->addr,
4242 sizeof(cp->addr));
30dc78e1
JH		 4243 goto failed;
4244 }
4245
a198e7b1 4246 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4247 if (!e) {
d3a2541d
LR		 4248 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4249 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4250 sizeof(cp->addr));
561aafbc
JH		 4251 goto failed;
4252 }
4253
4254 if (cp->name_known) {
4255 e->name_state = NAME_KNOWN;
4256 list_del(&e->list);
4257 } else {
4258 e->name_state = NAME_NEEDED;
a3d4e20a 4259 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4260 }
4261
e384662b
JH		 4262 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4263 sizeof(cp->addr));
561aafbc
JH		 4264
4265failed:
4266 hci_dev_unlock(hdev);
561aafbc
JH		 4267 return err;
4268}
4269
bdb6d971 4270static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4271 u16 len)
7fbec224 4272{
650f726d 4273 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4274 u8 status;
7fbec224
AJ		 4275 int err;
4276
bdb6d971 4277 BT_DBG("%s", hdev->name);
7fbec224 4278
4ee71b20 4279 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 4280 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4281 MGMT_STATUS_INVALID_PARAMS,
4282 &cp->addr, sizeof(cp->addr));
4ee71b20 4283
09fd0de5 4284 hci_dev_lock(hdev);
5e762444 4285
dcc36c16
JH		 4286 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4287 cp->addr.type);
2a8357f2 4288 if (err < 0) {
f0eeea8b 4289 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4290 goto done;
4291 }
4292
4293 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4294 sk);
4295 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4296
2a8357f2 4297done:
bdb6d971 4298 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
04124681 4299 &cp->addr, sizeof(cp->addr));
5e762444 4300
09fd0de5 4301 hci_dev_unlock(hdev);
7fbec224
AJ		 4302
4303 return err;
4304}
4305
bdb6d971 4306static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4307 u16 len)
7fbec224 4308{
650f726d 4309 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4310 u8 status;
7fbec224
AJ		 4311 int err;
4312
bdb6d971 4313 BT_DBG("%s", hdev->name);
7fbec224 4314
4ee71b20 4315 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 4316 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4317 MGMT_STATUS_INVALID_PARAMS,
4318 &cp->addr, sizeof(cp->addr));
4ee71b20 4319
09fd0de5 4320 hci_dev_lock(hdev);
5e762444 4321
dcc36c16
JH		 4322 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4323 cp->addr.type);
2a8357f2 4324 if (err < 0) {
f0eeea8b 4325 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4326 goto done;
4327 }
4328
4329 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4330 sk);
4331 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4332
2a8357f2 4333done:
bdb6d971 4334 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
04124681 4335 &cp->addr, sizeof(cp->addr));
5e762444 4336
09fd0de5 4337 hci_dev_unlock(hdev);
7fbec224
AJ		 4338
4339 return err;
4340}
4341
cdbaccca
MH		 4342static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4343 u16 len)
4344{
4345 struct mgmt_cp_set_device_id *cp = data;
890ea898 4346 struct hci_request req;
cdbaccca 4347 int err;
c72d4b8a 4348 __u16 source;
cdbaccca
MH		 4349
4350 BT_DBG("%s", hdev->name);
4351
c72d4b8a
SJ		 4352 source = __le16_to_cpu(cp->source);
4353
4354 if (source > 0x0002)
4355 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4356 MGMT_STATUS_INVALID_PARAMS);
4357
cdbaccca
MH		 4358 hci_dev_lock(hdev);
4359
c72d4b8a 4360 hdev->devid_source = source;
cdbaccca
MH		 4361 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4362 hdev->devid_product = __le16_to_cpu(cp->product);
4363 hdev->devid_version = __le16_to_cpu(cp->version);
4364
4365 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4366
890ea898
JH		 4367 hci_req_init(&req, hdev);
4368 update_eir(&req);
4369 hci_req_run(&req, NULL);
cdbaccca
MH		 4370
4371 hci_dev_unlock(hdev);
4372
4373 return err;
4374}
4375
1904a853
MH		 4376static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4377 u16 opcode)
4375f103
JH		 4378{
4379 struct cmd_lookup match = { NULL, hdev };
4380
3ad67582
JK		 4381 hci_dev_lock(hdev);
4382
4375f103
JH		 4383 if (status) {
4384 u8 mgmt_err = mgmt_status(status);
4385
4386 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4387 cmd_status_rsp, &mgmt_err);
3ad67582 4388 goto unlock;
4375f103
JH		 4389 }
4390
c93bd150
JH		 4391 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4392 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4393 else
4394 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4395
4375f103
JH		 4396 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4397 &match);
4398
4399 new_settings(hdev, match.sk);
4400
4401 if (match.sk)
4402 sock_put(match.sk);
3ad67582
JK		 4403
4404unlock:
4405 hci_dev_unlock(hdev);
4375f103
JH		 4406}
4407
21b5187f
MH		 4408static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4409 u16 len)
4375f103
JH		 4410{
4411 struct mgmt_mode *cp = data;
4412 struct pending_cmd *cmd;
4413 struct hci_request req;
e6fe7986 4414 u8 val, enabled, status;
4375f103
JH		 4415 int err;
4416
4417 BT_DBG("request for %s", hdev->name);
4418
e6fe7986
JH		 4419 status = mgmt_le_support(hdev);
4420 if (status)
4375f103 4421 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
e6fe7986 4422 status);
4375f103
JH		 4423
4424 if (cp->val != 0x00 && cp->val != 0x01)
4425 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4426 MGMT_STATUS_INVALID_PARAMS);
4427
4428 hci_dev_lock(hdev);
4429
4430 val = !!cp->val;
f3d3444a 4431 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103 4432
f74ca9b8
JH		 4433 /* The following conditions are ones which mean that we should
4434 * not do any HCI communication but directly send a mgmt
4435 * response to user space (after toggling the flag if
4436 * necessary).
4437 */
4438 if (!hdev_is_powered(hdev) || val == enabled ||
e8bb6b97
JH		 4439 hci_conn_num(hdev, LE_LINK) > 0 ||
4440 (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4441 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4375f103
JH		 4442 bool changed = false;
4443
f3d3444a
JH		 4444 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4445 change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103
JH		 4446 changed = true;
4447 }
4448
4449 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4450 if (err < 0)
4451 goto unlock;
4452
4453 if (changed)
4454 err = new_settings(hdev, sk);
4455
4456 goto unlock;
4457 }
4458
4459 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4460 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4461 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4462 MGMT_STATUS_BUSY);
4463 goto unlock;
4464 }
4465
4466 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4467 if (!cmd) {
4468 err = -ENOMEM;
4469 goto unlock;
4470 }
4471
4472 hci_req_init(&req, hdev);
4473
bba3aa55
MH		 4474 if (val)
4475 enable_advertising(&req);
4476 else
4477 disable_advertising(&req);
4375f103
JH		 4478
4479 err = hci_req_run(&req, set_advertising_complete);
4480 if (err < 0)
4481 mgmt_pending_remove(cmd);
4482
4483unlock:
4484 hci_dev_unlock(hdev);
4485 return err;
4486}
4487
d13eafce
MH		 4488static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4489 void *data, u16 len)
4490{
4491 struct mgmt_cp_set_static_address *cp = data;
4492 int err;
4493
4494 BT_DBG("%s", hdev->name);
4495
62af4443 4496 if (!lmp_le_capable(hdev))
d13eafce 4497 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
62af4443 4498 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4499
4500 if (hdev_is_powered(hdev))
4501 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4502 MGMT_STATUS_REJECTED);
4503
4504 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4505 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4506 return cmd_status(sk, hdev->id,
4507 MGMT_OP_SET_STATIC_ADDRESS,
4508 MGMT_STATUS_INVALID_PARAMS);
4509
4510 /* Two most significant bits shall be set */
4511 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4512 return cmd_status(sk, hdev->id,
4513 MGMT_OP_SET_STATIC_ADDRESS,
4514 MGMT_STATUS_INVALID_PARAMS);
4515 }
4516
4517 hci_dev_lock(hdev);
4518
4519 bacpy(&hdev->static_addr, &cp->bdaddr);
4520
93690c22
MH		 4521 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4522 if (err < 0)
4523 goto unlock;
4524
4525 err = new_settings(hdev, sk);
d13eafce 4526
93690c22 4527unlock:
d13eafce 4528 hci_dev_unlock(hdev);
d13eafce
MH		 4529 return err;
4530}
4531
14b49b9a
MH		 4532static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4533 void *data, u16 len)
4534{
4535 struct mgmt_cp_set_scan_params *cp = data;
4536 __u16 interval, window;
4537 int err;
4538
4539 BT_DBG("%s", hdev->name);
4540
4541 if (!lmp_le_capable(hdev))
4542 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4543 MGMT_STATUS_NOT_SUPPORTED);
4544
4545 interval = __le16_to_cpu(cp->interval);
4546
4547 if (interval < 0x0004 || interval > 0x4000)
4548 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4549 MGMT_STATUS_INVALID_PARAMS);
4550
4551 window = __le16_to_cpu(cp->window);
4552
4553 if (window < 0x0004 || window > 0x4000)
4554 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4555 MGMT_STATUS_INVALID_PARAMS);
4556
899e1075
MH		 4557 if (window > interval)
4558 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4559 MGMT_STATUS_INVALID_PARAMS);
4560
14b49b9a
MH		 4561 hci_dev_lock(hdev);
4562
4563 hdev->le_scan_interval = interval;
4564 hdev->le_scan_window = window;
4565
4566 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4567
dd2ef8e2
AG		 4568 /* If background scan is running, restart it so new parameters are
4569 * loaded.
4570 */
4571 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4572 hdev->discovery.state == DISCOVERY_STOPPED) {
4573 struct hci_request req;
4574
4575 hci_req_init(&req, hdev);
4576
4577 hci_req_add_le_scan_disable(&req);
4578 hci_req_add_le_passive_scan(&req);
4579
4580 hci_req_run(&req, NULL);
4581 }
4582
14b49b9a
MH		 4583 hci_dev_unlock(hdev);
4584
4585 return err;
4586}
4587
1904a853
MH		 4588static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4589 u16 opcode)
33e38b3e
JH		 4590{
4591 struct pending_cmd *cmd;
4592
4593 BT_DBG("status 0x%02x", status);
4594
4595 hci_dev_lock(hdev);
4596
4597 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4598 if (!cmd)
4599 goto unlock;
4600
4601 if (status) {
4602 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4603 mgmt_status(status));
4604 } else {
1a4d3c4b
JH		 4605 struct mgmt_mode *cp = cmd->param;
4606
4607 if (cp->val)
4608 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4609 else
4610 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4611
33e38b3e
JH		 4612 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4613 new_settings(hdev, cmd->sk);
4614 }
4615
4616 mgmt_pending_remove(cmd);
4617
4618unlock:
4619 hci_dev_unlock(hdev);
4620}
4621
bdb6d971 4622static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 4623 void *data, u16 len)
f6422ec6 4624{
650f726d 4625 struct mgmt_mode *cp = data;
33e38b3e
JH		 4626 struct pending_cmd *cmd;
4627 struct hci_request req;
f6422ec6
AJ		 4628 int err;
4629
bdb6d971 4630 BT_DBG("%s", hdev->name);
f6422ec6 4631
56f87901
JH		 4632 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4633 hdev->hci_ver < BLUETOOTH_VER_1_2)
33c525c0
JH		 4634 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4635 MGMT_STATUS_NOT_SUPPORTED);
4636
a7e80f25
JH		 4637 if (cp->val != 0x00 && cp->val != 0x01)
4638 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4639 MGMT_STATUS_INVALID_PARAMS);
4640
5400c044 4641 if (!hdev_is_powered(hdev))
bdb6d971 4642 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4643 MGMT_STATUS_NOT_POWERED);
5400c044
JH		 4644
4645 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
bdb6d971 4646 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4647 MGMT_STATUS_REJECTED);
f6422ec6
AJ		 4648
4649 hci_dev_lock(hdev);
4650
05cbf29f
JH		 4651 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4652 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4653 MGMT_STATUS_BUSY);
4654 goto unlock;
4655 }
4656
1a4d3c4b
JH		 4657 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4658 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4659 hdev);
4660 goto unlock;
4661 }
4662
33e38b3e
JH		 4663 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4664 data, len);
4665 if (!cmd) {
4666 err = -ENOMEM;
4667 goto unlock;
f6422ec6
AJ		 4668 }
4669
33e38b3e
JH		 4670 hci_req_init(&req, hdev);
4671
406d7804 4672 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 4673
4674 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 4675 if (err < 0) {
bdb6d971 4676 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4677 MGMT_STATUS_FAILED);
33e38b3e 4678 mgmt_pending_remove(cmd);
f6422ec6
AJ		 4679 }
4680
33e38b3e 4681unlock:
f6422ec6 4682 hci_dev_unlock(hdev);
33e38b3e 4683
f6422ec6
AJ		 4684 return err;
4685}
4686
1904a853 4687static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a
JH		 4688{
4689 struct pending_cmd *cmd;
4690
4691 BT_DBG("status 0x%02x", status);
4692
4693 hci_dev_lock(hdev);
4694
4695 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4696 if (!cmd)
4697 goto unlock;
4698
4699 if (status) {
4700 u8 mgmt_err = mgmt_status(status);
4701
4702 /* We need to restore the flag if related HCI commands
4703 * failed.
4704 */
4705 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4706
4707 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4708 } else {
4709 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4710 new_settings(hdev, cmd->sk);
4711 }
4712
4713 mgmt_pending_remove(cmd);
4714
4715unlock:
4716 hci_dev_unlock(hdev);
4717}
4718
4719static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4720{
4721 struct mgmt_mode *cp = data;
4722 struct pending_cmd *cmd;
4723 struct hci_request req;
4724 int err;
4725
4726 BT_DBG("request for %s", hdev->name);
4727
4728 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4729 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4730 MGMT_STATUS_NOT_SUPPORTED);
4731
4732 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4733 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4734 MGMT_STATUS_REJECTED);
4735
4736 if (cp->val != 0x00 && cp->val != 0x01)
4737 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4738 MGMT_STATUS_INVALID_PARAMS);
4739
4740 hci_dev_lock(hdev);
4741
4742 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4743 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4744 goto unlock;
4745 }
4746
4747 if (!hdev_is_powered(hdev)) {
4748 if (!cp->val) {
0663ca2a
JH		 4749 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4750 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4751 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4752 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4753 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4754 }
4755
4756 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4757
4758 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4759 if (err < 0)
4760 goto unlock;
4761
4762 err = new_settings(hdev, sk);
4763 goto unlock;
4764 }
4765
4766 /* Reject disabling when powered on */
4767 if (!cp->val) {
4768 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4769 MGMT_STATUS_REJECTED);
4770 goto unlock;
111e4bcc
MH		 4771 } else {
4772 /* When configuring a dual-mode controller to operate
4773 * with LE only and using a static address, then switching
4774 * BR/EDR back on is not allowed.
4775 *
4776 * Dual-mode controllers shall operate with the public
4777 * address as its identity address for BR/EDR and LE. So
4778 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 4779 *
4780 * The same restrictions applies when secure connections
4781 * has been enabled. For BR/EDR this is a controller feature
4782 * while for LE it is a host stack feature. This means that
4783 * switching BR/EDR back on when secure connections has been
4784 * enabled is not a supported transaction.
111e4bcc
MH		 4785 */
4786 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
3a5486e1
MH		 4787 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4788 test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
111e4bcc
MH		 4789 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4790 MGMT_STATUS_REJECTED);
4791 goto unlock;
4792 }
0663ca2a
JH		 4793 }
4794
4795 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4796 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4797 MGMT_STATUS_BUSY);
4798 goto unlock;
4799 }
4800
4801 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4802 if (!cmd) {
4803 err = -ENOMEM;
4804 goto unlock;
4805 }
4806
5947f4bc 4807 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 4808 * generates the correct flags.
4809 */
4810 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4811
4812 hci_req_init(&req, hdev);
aa8af46e 4813
432df05e 4814 write_fast_connectable(&req, false);
1d2dc5b7 4815 __hci_update_page_scan(&req);
aa8af46e 4816
f14d8f64
MH		 4817 /* Since only the advertising data flags will change, there
4818 * is no need to update the scan response data.
4819 */
5947f4bc 4820 update_adv_data(&req);
aa8af46e 4821
0663ca2a
JH		 4822 err = hci_req_run(&req, set_bredr_complete);
4823 if (err < 0)
4824 mgmt_pending_remove(cmd);
4825
4826unlock:
4827 hci_dev_unlock(hdev);
4828 return err;
4829}
4830
a1443f5a
JH		 4831static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4832{
4833 struct pending_cmd *cmd;
4834 struct mgmt_mode *cp;
4835
4836 BT_DBG("%s status %u", hdev->name, status);
4837
4838 hci_dev_lock(hdev);
4839
4840 cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4841 if (!cmd)
4842 goto unlock;
4843
4844 if (status) {
4845 cmd_status(cmd->sk, cmd->index, cmd->opcode,
4846 mgmt_status(status));
4847 goto remove;
4848 }
4849
4850 cp = cmd->param;
4851
4852 switch (cp->val) {
4853 case 0x00:
4854 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4855 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4856 break;
4857 case 0x01:
4858 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4859 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4860 break;
4861 case 0x02:
4862 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4863 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4864 break;
4865 }
4866
4867 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4868 new_settings(hdev, cmd->sk);
4869
4870remove:
4871 mgmt_pending_remove(cmd);
4872unlock:
4873 hci_dev_unlock(hdev);
4874}
4875
eac83dc6
MH		 4876static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4877 void *data, u16 len)
4878{
4879 struct mgmt_mode *cp = data;
4880 struct pending_cmd *cmd;
a1443f5a 4881 struct hci_request req;
a3209694 4882 u8 val;
eac83dc6
MH		 4883 int err;
4884
4885 BT_DBG("request for %s", hdev->name);
4886
05b3c3e7
MH		 4887 if (!lmp_sc_capable(hdev) &&
4888 !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
eac83dc6
MH		 4889 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4890 MGMT_STATUS_NOT_SUPPORTED);
4891
ed93ec69 4892 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
59200286 4893 lmp_sc_capable(hdev) &&
ed93ec69
MH		 4894 !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4895 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4896 MGMT_STATUS_REJECTED);
4897
0ab04a9c 4898 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
eac83dc6
MH		 4899 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4900 MGMT_STATUS_INVALID_PARAMS);
4901
4902 hci_dev_lock(hdev);
4903
05b3c3e7 4904 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
a3209694 4905 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
eac83dc6
MH		 4906 bool changed;
4907
0ab04a9c 4908 if (cp->val) {
eac83dc6
MH		 4909 changed = !test_and_set_bit(HCI_SC_ENABLED,
4910 &hdev->dev_flags);
0ab04a9c
MH		 4911 if (cp->val == 0x02)
4912 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4913 else
4914 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4915 } else {
eac83dc6
MH		 4916 changed = test_and_clear_bit(HCI_SC_ENABLED,
4917 &hdev->dev_flags);
0ab04a9c
MH		 4918 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4919 }
eac83dc6
MH		 4920
4921 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4922 if (err < 0)
4923 goto failed;
4924
4925 if (changed)
4926 err = new_settings(hdev, sk);
4927
4928 goto failed;
4929 }
4930
4931 if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4932 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4933 MGMT_STATUS_BUSY);
4934 goto failed;
4935 }
4936
0ab04a9c
MH		 4937 val = !!cp->val;
4938
4939 if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4940 (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
eac83dc6
MH		 4941 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4942 goto failed;
4943 }
4944
4945 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4946 if (!cmd) {
4947 err = -ENOMEM;
4948 goto failed;
4949 }
4950
a1443f5a
JH		 4951 hci_req_init(&req, hdev);
4952 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4953 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 4954 if (err < 0) {
4955 mgmt_pending_remove(cmd);
4956 goto failed;
4957 }
4958
4959failed:
4960 hci_dev_unlock(hdev);
4961 return err;
4962}
4963
4e39ac81
MH		 4964static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4965 void *data, u16 len)
4966{
4967 struct mgmt_mode *cp = data;
b9710979 4968 bool changed, use_changed;
4e39ac81
MH		 4969 int err;
4970
4971 BT_DBG("request for %s", hdev->name);
4972
b9710979 4973 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4e39ac81
MH		 4974 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4975 MGMT_STATUS_INVALID_PARAMS);
4976
4977 hci_dev_lock(hdev);
4978
4979 if (cp->val)
0663b297
JH		 4980 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4981 &hdev->dev_flags);
4e39ac81 4982 else
0663b297
JH		 4983 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4984 &hdev->dev_flags);
4e39ac81 4985
b9710979
JH		 4986 if (cp->val == 0x02)
4987 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4988 &hdev->dev_flags);
4989 else
4990 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4991 &hdev->dev_flags);
4992
4993 if (hdev_is_powered(hdev) && use_changed &&
4994 test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4995 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4996 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4997 sizeof(mode), &mode);
4998 }
4999
4e39ac81
MH		 5000 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5001 if (err < 0)
5002 goto unlock;
5003
5004 if (changed)
5005 err = new_settings(hdev, sk);
5006
5007unlock:
5008 hci_dev_unlock(hdev);
5009 return err;
5010}
5011
62b04cd1
JH		 5012static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5013 u16 len)
5014{
5015 struct mgmt_cp_set_privacy *cp = cp_data;
5016 bool changed;
5017 int err;
5018
5019 BT_DBG("request for %s", hdev->name);
5020
5021 if (!lmp_le_capable(hdev))
5022 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5023 MGMT_STATUS_NOT_SUPPORTED);
5024
5025 if (cp->privacy != 0x00 && cp->privacy != 0x01)
5026 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5027 MGMT_STATUS_INVALID_PARAMS);
5028
5029 if (hdev_is_powered(hdev))
5030 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5031 MGMT_STATUS_REJECTED);
5032
5033 hci_dev_lock(hdev);
5034
c21c0ea0
JH		 5035 /* If user space supports this command it is also expected to
5036 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5037 */
5038 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5039
62b04cd1
JH		 5040 if (cp->privacy) {
5041 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
5042 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5043 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5044 } else {
5045 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
5046 memset(hdev->irk, 0, sizeof(hdev->irk));
5047 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5048 }
5049
5050 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5051 if (err < 0)
5052 goto unlock;
5053
5054 if (changed)
5055 err = new_settings(hdev, sk);
5056
5057unlock:
5058 hci_dev_unlock(hdev);
5059 return err;
5060}
5061
41edf160
JH		 5062static bool irk_is_valid(struct mgmt_irk_info *irk)
5063{
5064 switch (irk->addr.type) {
5065 case BDADDR_LE_PUBLIC:
5066 return true;
5067
5068 case BDADDR_LE_RANDOM:
5069 /* Two most significant bits shall be set */
5070 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5071 return false;
5072 return true;
5073 }
5074
5075 return false;
5076}
5077
5078static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5079 u16 len)
5080{
5081 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5082 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5083 sizeof(struct mgmt_irk_info));
41edf160
JH		 5084 u16 irk_count, expected_len;
5085 int i, err;
5086
5087 BT_DBG("request for %s", hdev->name);
5088
5089 if (!lmp_le_capable(hdev))
5090 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5091 MGMT_STATUS_NOT_SUPPORTED);
5092
5093 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5094 if (irk_count > max_irk_count) {
5095 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5096 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5097 MGMT_STATUS_INVALID_PARAMS);
5098 }
41edf160
JH		 5099
5100 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5101 if (expected_len != len) {
5102 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5103 expected_len, len);
41edf160
JH		 5104 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5105 MGMT_STATUS_INVALID_PARAMS);
5106 }
5107
5108 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5109
5110 for (i = 0; i < irk_count; i++) {
5111 struct mgmt_irk_info *key = &cp->irks[i];
5112
5113 if (!irk_is_valid(key))
5114 return cmd_status(sk, hdev->id,
5115 MGMT_OP_LOAD_IRKS,
5116 MGMT_STATUS_INVALID_PARAMS);
5117 }
5118
5119 hci_dev_lock(hdev);
5120
5121 hci_smp_irks_clear(hdev);
5122
5123 for (i = 0; i < irk_count; i++) {
5124 struct mgmt_irk_info *irk = &cp->irks[i];
5125 u8 addr_type;
5126
5127 if (irk->addr.type == BDADDR_LE_PUBLIC)
5128 addr_type = ADDR_LE_DEV_PUBLIC;
5129 else
5130 addr_type = ADDR_LE_DEV_RANDOM;
5131
5132 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5133 BDADDR_ANY);
5134 }
5135
5136 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5137
5138 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5139
5140 hci_dev_unlock(hdev);
5141
5142 return err;
5143}
5144
3f706b72
JH		 5145static bool ltk_is_valid(struct mgmt_ltk_info *key)
5146{
5147 if (key->master != 0x00 && key->master != 0x01)
5148 return false;
490cb0b3
MH		 5149
5150 switch (key->addr.type) {
5151 case BDADDR_LE_PUBLIC:
5152 return true;
5153
5154 case BDADDR_LE_RANDOM:
5155 /* Two most significant bits shall be set */
5156 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5157 return false;
5158 return true;
5159 }
5160
5161 return false;
3f706b72
JH		 5162}
5163
bdb6d971 5164static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5165 void *cp_data, u16 len)
346af67b 5166{
346af67b 5167 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5168 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5169 sizeof(struct mgmt_ltk_info));
346af67b 5170 u16 key_count, expected_len;
715a5bf2 5171 int i, err;
346af67b 5172
cf99ba13
MH		 5173 BT_DBG("request for %s", hdev->name);
5174
5175 if (!lmp_le_capable(hdev))
5176 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5177 MGMT_STATUS_NOT_SUPPORTED);
5178
1f350c87 5179 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5180 if (key_count > max_key_count) {
5181 BT_ERR("load_ltks: too big key_count value %u", key_count);
5182 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5183 MGMT_STATUS_INVALID_PARAMS);
5184 }
346af67b
VCG		 5185
5186 expected_len = sizeof(*cp) + key_count *
5187 sizeof(struct mgmt_ltk_info);
5188 if (expected_len != len) {
5189 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5190 expected_len, len);
bdb6d971 5191 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
e57e619f 5192 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5193 }
5194
bdb6d971 5195 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5196
54ad6d8a
JH		 5197 for (i = 0; i < key_count; i++) {
5198 struct mgmt_ltk_info *key = &cp->keys[i];
5199
3f706b72 5200 if (!ltk_is_valid(key))
54ad6d8a
JH		 5201 return cmd_status(sk, hdev->id,
5202 MGMT_OP_LOAD_LONG_TERM_KEYS,
5203 MGMT_STATUS_INVALID_PARAMS);
5204 }
5205
346af67b
VCG		 5206 hci_dev_lock(hdev);
5207
5208 hci_smp_ltks_clear(hdev);
5209
5210 for (i = 0; i < key_count; i++) {
5211 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5212 u8 type, addr_type, authenticated;
79d95a19
MH		 5213
5214 if (key->addr.type == BDADDR_LE_PUBLIC)
5215 addr_type = ADDR_LE_DEV_PUBLIC;
5216 else
5217 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5218
61b43357
JH		 5219 switch (key->type) {
5220 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5221 authenticated = 0x00;
23fb8de3 5222 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5223 break;
5224 case MGMT_LTK_AUTHENTICATED:
d7b25450 5225 authenticated = 0x01;
23fb8de3
JH		 5226 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5227 break;
5228 case MGMT_LTK_P256_UNAUTH:
5229 authenticated = 0x00;
5230 type = SMP_LTK_P256;
61b43357 5231 break;
23fb8de3
JH		 5232 case MGMT_LTK_P256_AUTH:
5233 authenticated = 0x01;
5234 type = SMP_LTK_P256;
61b43357 5235 break;
23fb8de3
JH		 5236 case MGMT_LTK_P256_DEBUG:
5237 authenticated = 0x00;
5238 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5239 default:
5240 continue;
5241 }
d7b25450 5242
35d70271 5243 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5244 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5245 key->rand);
346af67b
VCG		 5246 }
5247
715a5bf2
JH		 5248 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5249 NULL, 0);
5250
346af67b 5251 hci_dev_unlock(hdev);
346af67b 5252
715a5bf2 5253 return err;
346af67b
VCG		 5254}
5255
9df74653 5256static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
dd983808 5257{
dd983808 5258 struct hci_conn *conn = cmd->user_data;
9981bdb0 5259 struct mgmt_rp_get_conn_info rp;
9df74653 5260 int err;
dd983808 5261
9981bdb0 5262 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5263
9981bdb0 5264 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5265 rp.rssi = conn->rssi;
9981bdb0
JH		 5266 rp.tx_power = conn->tx_power;
5267 rp.max_tx_power = conn->max_tx_power;
5268 } else {
5269 rp.rssi = HCI_RSSI_INVALID;
5270 rp.tx_power = HCI_TX_POWER_INVALID;
5271 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5272 }
5273
9df74653
JH		 5274 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5275 &rp, sizeof(rp));
dd983808
AK		 5276
5277 hci_conn_drop(conn);
f8aaf9b6 5278 hci_conn_put(conn);
9df74653
JH		 5279
5280 return err;
dd983808
AK		 5281}
5282
1904a853
MH		 5283static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5284 u16 opcode)
dd983808
AK		 5285{
5286 struct hci_cp_read_rssi *cp;
9981bdb0 5287 struct pending_cmd *cmd;
dd983808 5288 struct hci_conn *conn;
dd983808 5289 u16 handle;
9981bdb0 5290 u8 status;
dd983808 5291
9981bdb0 5292 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5293
5294 hci_dev_lock(hdev);
5295
dd983808
AK		 5296 /* Commands sent in request are either Read RSSI or Read Transmit Power
5297 * Level so we check which one was last sent to retrieve connection
5298 * handle. Both commands have handle as first parameter so it's safe to
5299 * cast data on the same command struct.
5300 *
5301 * First command sent is always Read RSSI and we fail only if it fails.
5302 * In other case we simply override error to indicate success as we
5303 * already remembered if TX power value is actually valid.
5304 */
5305 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5306 if (!cp) {
5307 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5308 status = MGMT_STATUS_SUCCESS;
5309 } else {
5310 status = mgmt_status(hci_status);
dd983808
AK		 5311 }
5312
5313 if (!cp) {
9981bdb0 5314 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5315 goto unlock;
5316 }
5317
5318 handle = __le16_to_cpu(cp->handle);
5319 conn = hci_conn_hash_lookup_handle(hdev, handle);
5320 if (!conn) {
9981bdb0 5321 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5322 goto unlock;
5323 }
5324
9981bdb0
JH		 5325 cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5326 if (!cmd)
5327 goto unlock;
dd983808 5328
9981bdb0
JH		 5329 cmd->cmd_complete(cmd, status);
5330 mgmt_pending_remove(cmd);
dd983808
AK		 5331
5332unlock:
5333 hci_dev_unlock(hdev);
5334}
5335
5336static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5337 u16 len)
5338{
5339 struct mgmt_cp_get_conn_info *cp = data;
5340 struct mgmt_rp_get_conn_info rp;
5341 struct hci_conn *conn;
5342 unsigned long conn_info_age;
5343 int err = 0;
5344
5345 BT_DBG("%s", hdev->name);
5346
5347 memset(&rp, 0, sizeof(rp));
5348 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5349 rp.addr.type = cp->addr.type;
5350
5351 if (!bdaddr_type_is_valid(cp->addr.type))
5352 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5353 MGMT_STATUS_INVALID_PARAMS,
5354 &rp, sizeof(rp));
5355
5356 hci_dev_lock(hdev);
5357
5358 if (!hdev_is_powered(hdev)) {
5359 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5360 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5361 goto unlock;
5362 }
5363
5364 if (cp->addr.type == BDADDR_BREDR)
5365 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5366 &cp->addr.bdaddr);
5367 else
5368 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5369
5370 if (!conn || conn->state != BT_CONNECTED) {
5371 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5372 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5373 goto unlock;
5374 }
5375
9981bdb0
JH		 5376 if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5377 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5378 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5379 goto unlock;
5380 }
5381
dd983808
AK		 5382 /* To avoid client trying to guess when to poll again for information we
5383 * calculate conn info age as random value between min/max set in hdev.
5384 */
5385 conn_info_age = hdev->conn_info_min_age +
5386 prandom_u32_max(hdev->conn_info_max_age -
5387 hdev->conn_info_min_age);
5388
5389 /* Query controller to refresh cached values if they are too old or were
5390 * never read.
5391 */
f4e2dd53
AK		 5392 if (time_after(jiffies, conn->conn_info_timestamp +
5393 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5394 !conn->conn_info_timestamp) {
5395 struct hci_request req;
5396 struct hci_cp_read_tx_power req_txp_cp;
5397 struct hci_cp_read_rssi req_rssi_cp;
5398 struct pending_cmd *cmd;
5399
5400 hci_req_init(&req, hdev);
5401 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5402 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5403 &req_rssi_cp);
5404
f7faab0c
AK		 5405 /* For LE links TX power does not change thus we don't need to
5406 * query for it once value is known.
5407 */
5408 if (!bdaddr_type_is_le(cp->addr.type) ||
5409 conn->tx_power == HCI_TX_POWER_INVALID) {
5410 req_txp_cp.handle = cpu_to_le16(conn->handle);
5411 req_txp_cp.type = 0x00;
5412 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5413 sizeof(req_txp_cp), &req_txp_cp);
5414 }
dd983808 5415
eed5daf3
AK		 5416 /* Max TX power needs to be read only once per connection */
5417 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5418 req_txp_cp.handle = cpu_to_le16(conn->handle);
5419 req_txp_cp.type = 0x01;
5420 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5421 sizeof(req_txp_cp), &req_txp_cp);
5422 }
5423
dd983808
AK		 5424 err = hci_req_run(&req, conn_info_refresh_complete);
5425 if (err < 0)
5426 goto unlock;
5427
5428 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5429 data, len);
5430 if (!cmd) {
5431 err = -ENOMEM;
5432 goto unlock;
5433 }
5434
5435 hci_conn_hold(conn);
f8aaf9b6 5436 cmd->user_data = hci_conn_get(conn);
9981bdb0 5437 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5438
5439 conn->conn_info_timestamp = jiffies;
5440 } else {
5441 /* Cache is valid, just reply with values cached in hci_conn */
5442 rp.rssi = conn->rssi;
5443 rp.tx_power = conn->tx_power;
eed5daf3 5444 rp.max_tx_power = conn->max_tx_power;
dd983808
AK		 5445
5446 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5447 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5448 }
5449
5450unlock:
5451 hci_dev_unlock(hdev);
5452 return err;
5453}
5454
9df74653 5455static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
95868426 5456{
69487371 5457 struct hci_conn *conn = cmd->user_data;
95868426 5458 struct mgmt_rp_get_clock_info rp;
69487371 5459 struct hci_dev *hdev;
9df74653 5460 int err;
69487371
JH		 5461
5462 memset(&rp, 0, sizeof(rp));
5463 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5464
5465 if (status)
5466 goto complete;
5467
5468 hdev = hci_dev_get(cmd->index);
5469 if (hdev) {
5470 rp.local_clock = cpu_to_le32(hdev->clock);
5471 hci_dev_put(hdev);
5472 }
5473
5474 if (conn) {
5475 rp.piconet_clock = cpu_to_le32(conn->clock);
5476 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5477 }
5478
5479complete:
9df74653
JH		 5480 err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5481 sizeof(rp));
69487371
JH		 5482
5483 if (conn) {
5484 hci_conn_drop(conn);
5485 hci_conn_put(conn);
5486 }
9df74653
JH		 5487
5488 return err;
69487371
JH		 5489}
5490
1904a853 5491static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5492{
95868426
JH		 5493 struct hci_cp_read_clock *hci_cp;
5494 struct pending_cmd *cmd;
5495 struct hci_conn *conn;
5496
5497 BT_DBG("%s status %u", hdev->name, status);
5498
5499 hci_dev_lock(hdev);
5500
5501 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5502 if (!hci_cp)
5503 goto unlock;
5504
5505 if (hci_cp->which) {
5506 u16 handle = __le16_to_cpu(hci_cp->handle);
5507 conn = hci_conn_hash_lookup_handle(hdev, handle);
5508 } else {
5509 conn = NULL;
5510 }
5511
5512 cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5513 if (!cmd)
5514 goto unlock;
5515
69487371 5516 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5517 mgmt_pending_remove(cmd);
95868426
JH		 5518
5519unlock:
5520 hci_dev_unlock(hdev);
5521}
5522
5523static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5524 u16 len)
5525{
5526 struct mgmt_cp_get_clock_info *cp = data;
5527 struct mgmt_rp_get_clock_info rp;
5528 struct hci_cp_read_clock hci_cp;
5529 struct pending_cmd *cmd;
5530 struct hci_request req;
5531 struct hci_conn *conn;
5532 int err;
5533
5534 BT_DBG("%s", hdev->name);
5535
5536 memset(&rp, 0, sizeof(rp));
5537 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5538 rp.addr.type = cp->addr.type;
5539
5540 if (cp->addr.type != BDADDR_BREDR)
5541 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5542 MGMT_STATUS_INVALID_PARAMS,
5543 &rp, sizeof(rp));
5544
5545 hci_dev_lock(hdev);
5546
5547 if (!hdev_is_powered(hdev)) {
5548 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5549 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5550 goto unlock;
5551 }
5552
5553 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5554 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5555 &cp->addr.bdaddr);
5556 if (!conn || conn->state != BT_CONNECTED) {
5557 err = cmd_complete(sk, hdev->id,
5558 MGMT_OP_GET_CLOCK_INFO,
5559 MGMT_STATUS_NOT_CONNECTED,
5560 &rp, sizeof(rp));
5561 goto unlock;
5562 }
5563 } else {
5564 conn = NULL;
5565 }
5566
5567 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5568 if (!cmd) {
5569 err = -ENOMEM;
5570 goto unlock;
5571 }
5572
69487371
JH		 5573 cmd->cmd_complete = clock_info_cmd_complete;
5574
95868426
JH		 5575 hci_req_init(&req, hdev);
5576
5577 memset(&hci_cp, 0, sizeof(hci_cp));
5578 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5579
5580 if (conn) {
5581 hci_conn_hold(conn);
f8aaf9b6 5582 cmd->user_data = hci_conn_get(conn);
95868426
JH		 5583
5584 hci_cp.handle = cpu_to_le16(conn->handle);
5585 hci_cp.which = 0x01; /* Piconet clock */
5586 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5587 }
5588
5589 err = hci_req_run(&req, get_clock_info_complete);
5590 if (err < 0)
5591 mgmt_pending_remove(cmd);
5592
5593unlock:
5594 hci_dev_unlock(hdev);
5595 return err;
5596}
5597
5a154e6f
JH		 5598static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5599{
5600 struct hci_conn *conn;
5601
5602 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5603 if (!conn)
5604 return false;
5605
5606 if (conn->dst_type != type)
5607 return false;
5608
5609 if (conn->state != BT_CONNECTED)
5610 return false;
5611
5612 return true;
5613}
5614
5615/* This function requires the caller holds hdev->lock */
5616static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5617 u8 addr_type, u8 auto_connect)
5618{
5619 struct hci_dev *hdev = req->hdev;
5620 struct hci_conn_params *params;
5621
5622 params = hci_conn_params_add(hdev, addr, addr_type);
5623 if (!params)
5624 return -EIO;
5625
5626 if (params->auto_connect == auto_connect)
5627 return 0;
5628
5629 list_del_init(&params->action);
5630
5631 switch (auto_connect) {
5632 case HCI_AUTO_CONN_DISABLED:
5633 case HCI_AUTO_CONN_LINK_LOSS:
5634 __hci_update_background_scan(req);
5635 break;
5636 case HCI_AUTO_CONN_REPORT:
5637 list_add(&params->action, &hdev->pend_le_reports);
5638 __hci_update_background_scan(req);
5639 break;
5640 case HCI_AUTO_CONN_DIRECT:
5641 case HCI_AUTO_CONN_ALWAYS:
5642 if (!is_connected(hdev, addr, addr_type)) {
5643 list_add(&params->action, &hdev->pend_le_conns);
5644 __hci_update_background_scan(req);
5645 }
5646 break;
5647 }
5648
5649 params->auto_connect = auto_connect;
5650
5651 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5652 auto_connect);
5653
5654 return 0;
5655}
5656
8afef092
MH		 5657static void device_added(struct sock *sk, struct hci_dev *hdev,
5658 bdaddr_t *bdaddr, u8 type, u8 action)
5659{
5660 struct mgmt_ev_device_added ev;
5661
5662 bacpy(&ev.addr.bdaddr, bdaddr);
5663 ev.addr.type = type;
5664 ev.action = action;
5665
5666 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5667}
5668
1904a853 5669static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f
JH		 5670{
5671 struct pending_cmd *cmd;
5672
5673 BT_DBG("status 0x%02x", status);
5674
5675 hci_dev_lock(hdev);
5676
5677 cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5678 if (!cmd)
5679 goto unlock;
5680
5681 cmd->cmd_complete(cmd, mgmt_status(status));
5682 mgmt_pending_remove(cmd);
5683
5684unlock:
5685 hci_dev_unlock(hdev);
5686}
5687
2faade53
MH		 5688static int add_device(struct sock *sk, struct hci_dev *hdev,
5689 void *data, u16 len)
5690{
5691 struct mgmt_cp_add_device *cp = data;
5a154e6f
JH		 5692 struct pending_cmd *cmd;
5693 struct hci_request req;
2faade53
MH		 5694 u8 auto_conn, addr_type;
5695 int err;
5696
5697 BT_DBG("%s", hdev->name);
5698
6659358e 5699 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53
MH		 5700 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5701 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5702 MGMT_STATUS_INVALID_PARAMS,
5703 &cp->addr, sizeof(cp->addr));
5704
4b9e7e75 5705 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2faade53
MH		 5706 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5707 MGMT_STATUS_INVALID_PARAMS,
5708 &cp->addr, sizeof(cp->addr));
5709
5a154e6f
JH		 5710 hci_req_init(&req, hdev);
5711
2faade53
MH		 5712 hci_dev_lock(hdev);
5713
5a154e6f
JH		 5714 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5715 if (!cmd) {
5716 err = -ENOMEM;
5717 goto unlock;
5718 }
5719
5720 cmd->cmd_complete = addr_cmd_complete;
5721
6659358e 5722 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 5723 /* Only incoming connections action is supported for now */
6659358e 5724 if (cp->action != 0x01) {
9df74653
JH		 5725 err = cmd->cmd_complete(cmd,
5726 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 5727 mgmt_pending_remove(cmd);
6659358e
JH		 5728 goto unlock;
5729 }
5730
5731 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5732 cp->addr.type);
5733 if (err)
5734 goto unlock;
a397407f 5735
5a154e6f 5736 __hci_update_page_scan(&req);
a397407f 5737
6659358e
JH		 5738 goto added;
5739 }
5740
2faade53
MH		 5741 if (cp->addr.type == BDADDR_LE_PUBLIC)
5742 addr_type = ADDR_LE_DEV_PUBLIC;
5743 else
5744 addr_type = ADDR_LE_DEV_RANDOM;
5745
4b9e7e75 5746 if (cp->action == 0x02)
2faade53 5747 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 5748 else if (cp->action == 0x01)
5749 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 5750 else
a3451d27 5751 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 5752
bf5b3c8b
MH		 5753 /* If the connection parameters don't exist for this device,
5754 * they will be created and configured with defaults.
5755 */
5a154e6f 5756 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 5757 auto_conn) < 0) {
9df74653 5758 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 5759 mgmt_pending_remove(cmd);
2faade53
MH		 5760 goto unlock;
5761 }
5762
6659358e 5763added:
8afef092
MH		 5764 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5765
5a154e6f
JH		 5766 err = hci_req_run(&req, add_device_complete);
5767 if (err < 0) {
5768 /* ENODATA means no HCI commands were needed (e.g. if
5769 * the adapter is powered off).
5770 */
9df74653
JH		 5771 if (err == -ENODATA)
5772 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 5773 mgmt_pending_remove(cmd);
5774 }
2faade53
MH		 5775
5776unlock:
5777 hci_dev_unlock(hdev);
5778 return err;
5779}
5780
8afef092
MH		 5781static void device_removed(struct sock *sk, struct hci_dev *hdev,
5782 bdaddr_t *bdaddr, u8 type)
5783{
5784 struct mgmt_ev_device_removed ev;
5785
5786 bacpy(&ev.addr.bdaddr, bdaddr);
5787 ev.addr.type = type;
5788
5789 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5790}
5791
1904a853 5792static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe
JH		 5793{
5794 struct pending_cmd *cmd;
5795
5796 BT_DBG("status 0x%02x", status);
5797
5798 hci_dev_lock(hdev);
5799
5800 cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5801 if (!cmd)
5802 goto unlock;
5803
5804 cmd->cmd_complete(cmd, mgmt_status(status));
5805 mgmt_pending_remove(cmd);
5806
5807unlock:
5808 hci_dev_unlock(hdev);
5809}
5810
2faade53
MH		 5811static int remove_device(struct sock *sk, struct hci_dev *hdev,
5812 void *data, u16 len)
5813{
5814 struct mgmt_cp_remove_device *cp = data;
51ef3ebe
JH		 5815 struct pending_cmd *cmd;
5816 struct hci_request req;
2faade53
MH		 5817 int err;
5818
5819 BT_DBG("%s", hdev->name);
5820
51ef3ebe
JH		 5821 hci_req_init(&req, hdev);
5822
2faade53
MH		 5823 hci_dev_lock(hdev);
5824
51ef3ebe
JH		 5825 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5826 if (!cmd) {
5827 err = -ENOMEM;
5828 goto unlock;
5829 }
5830
5831 cmd->cmd_complete = addr_cmd_complete;
5832
2faade53 5833 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 5834 struct hci_conn_params *params;
2faade53
MH		 5835 u8 addr_type;
5836
6659358e 5837 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 5838 err = cmd->cmd_complete(cmd,
5839 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5840 mgmt_pending_remove(cmd);
2faade53
MH		 5841 goto unlock;
5842 }
5843
6659358e
JH		 5844 if (cp->addr.type == BDADDR_BREDR) {
5845 err = hci_bdaddr_list_del(&hdev->whitelist,
5846 &cp->addr.bdaddr,
5847 cp->addr.type);
5848 if (err) {
9df74653
JH		 5849 err = cmd->cmd_complete(cmd,
5850 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5851 mgmt_pending_remove(cmd);
6659358e
JH		 5852 goto unlock;
5853 }
5854
51ef3ebe 5855 __hci_update_page_scan(&req);
a397407f 5856
6659358e
JH		 5857 device_removed(sk, hdev, &cp->addr.bdaddr,
5858 cp->addr.type);
5859 goto complete;
5860 }
5861
2faade53
MH		 5862 if (cp->addr.type == BDADDR_LE_PUBLIC)
5863 addr_type = ADDR_LE_DEV_PUBLIC;
5864 else
5865 addr_type = ADDR_LE_DEV_RANDOM;
5866
c71593dd
JH		 5867 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5868 addr_type);
5869 if (!params) {
9df74653
JH		 5870 err = cmd->cmd_complete(cmd,
5871 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5872 mgmt_pending_remove(cmd);
c71593dd
JH		 5873 goto unlock;
5874 }
5875
5876 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 5877 err = cmd->cmd_complete(cmd,
5878 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5879 mgmt_pending_remove(cmd);
c71593dd
JH		 5880 goto unlock;
5881 }
5882
d1dbf12e 5883 list_del(&params->action);
c71593dd
JH		 5884 list_del(&params->list);
5885 kfree(params);
51ef3ebe 5886 __hci_update_background_scan(&req);
8afef092
MH		 5887
5888 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 5889 } else {
19de0825 5890 struct hci_conn_params *p, *tmp;
6659358e 5891 struct bdaddr_list *b, *btmp;
19de0825 5892
2faade53 5893 if (cp->addr.type) {
9df74653
JH		 5894 err = cmd->cmd_complete(cmd,
5895 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5896 mgmt_pending_remove(cmd);
2faade53
MH		 5897 goto unlock;
5898 }
5899
6659358e
JH		 5900 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5901 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5902 list_del(&b->list);
5903 kfree(b);
5904 }
5905
51ef3ebe 5906 __hci_update_page_scan(&req);
a397407f 5907
19de0825
JH		 5908 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5909 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5910 continue;
5911 device_removed(sk, hdev, &p->addr, p->addr_type);
5912 list_del(&p->action);
5913 list_del(&p->list);
5914 kfree(p);
5915 }
5916
5917 BT_DBG("All LE connection parameters were removed");
5918
51ef3ebe 5919 __hci_update_background_scan(&req);
2faade53
MH		 5920 }
5921
6659358e 5922complete:
51ef3ebe
JH		 5923 err = hci_req_run(&req, remove_device_complete);
5924 if (err < 0) {
5925 /* ENODATA means no HCI commands were needed (e.g. if
5926 * the adapter is powered off).
5927 */
9df74653
JH		 5928 if (err == -ENODATA)
5929 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 5930 mgmt_pending_remove(cmd);
5931 }
2faade53
MH		 5932
5933unlock:
5934 hci_dev_unlock(hdev);
5935 return err;
5936}
5937
a26f3dcf
JH		 5938static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5939 u16 len)
5940{
5941 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 5942 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5943 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 5944 u16 param_count, expected_len;
5945 int i;
5946
5947 if (!lmp_le_capable(hdev))
5948 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5949 MGMT_STATUS_NOT_SUPPORTED);
5950
5951 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 5952 if (param_count > max_param_count) {
5953 BT_ERR("load_conn_param: too big param_count value %u",
5954 param_count);
5955 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5956 MGMT_STATUS_INVALID_PARAMS);
5957 }
a26f3dcf
JH		 5958
5959 expected_len = sizeof(*cp) + param_count *
5960 sizeof(struct mgmt_conn_param);
5961 if (expected_len != len) {
5962 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5963 expected_len, len);
5964 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5965 MGMT_STATUS_INVALID_PARAMS);
5966 }
5967
5968 BT_DBG("%s param_count %u", hdev->name, param_count);
5969
5970 hci_dev_lock(hdev);
5971
5972 hci_conn_params_clear_disabled(hdev);
5973
5974 for (i = 0; i < param_count; i++) {
5975 struct mgmt_conn_param *param = &cp->params[i];
5976 struct hci_conn_params *hci_param;
5977 u16 min, max, latency, timeout;
5978 u8 addr_type;
5979
5980 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5981 param->addr.type);
5982
5983 if (param->addr.type == BDADDR_LE_PUBLIC) {
5984 addr_type = ADDR_LE_DEV_PUBLIC;
5985 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5986 addr_type = ADDR_LE_DEV_RANDOM;
5987 } else {
5988 BT_ERR("Ignoring invalid connection parameters");
5989 continue;
5990 }
5991
5992 min = le16_to_cpu(param->min_interval);
5993 max = le16_to_cpu(param->max_interval);
5994 latency = le16_to_cpu(param->latency);
5995 timeout = le16_to_cpu(param->timeout);
5996
5997 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5998 min, max, latency, timeout);
5999
6000 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6001 BT_ERR("Ignoring invalid connection parameters");
6002 continue;
6003 }
6004
6005 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6006 addr_type);
6007 if (!hci_param) {
6008 BT_ERR("Failed to add connection parameters");
6009 continue;
6010 }
6011
6012 hci_param->conn_min_interval = min;
6013 hci_param->conn_max_interval = max;
6014 hci_param->conn_latency = latency;
6015 hci_param->supervision_timeout = timeout;
6016 }
6017
6018 hci_dev_unlock(hdev);
6019
6020 return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
6021}
6022
dbece37a
MH		 6023static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6024 void *data, u16 len)
6025{
6026 struct mgmt_cp_set_external_config *cp = data;
6027 bool changed;
6028 int err;
6029
6030 BT_DBG("%s", hdev->name);
6031
6032 if (hdev_is_powered(hdev))
6033 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6034 MGMT_STATUS_REJECTED);
6035
6036 if (cp->config != 0x00 && cp->config != 0x01)
6037 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6038 MGMT_STATUS_INVALID_PARAMS);
6039
6040 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6041 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6042 MGMT_STATUS_NOT_SUPPORTED);
6043
6044 hci_dev_lock(hdev);
6045
6046 if (cp->config)
6047 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
6048 &hdev->dev_flags);
6049 else
6050 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
6051 &hdev->dev_flags);
6052
6053 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6054 if (err < 0)
6055 goto unlock;
6056
6057 if (!changed)
6058 goto unlock;
6059
f4537c04
MH		 6060 err = new_options(hdev, sk);
6061
dbece37a
MH		 6062 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
6063 mgmt_index_removed(hdev);
d603b76b
MH		 6064
6065 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
6066 set_bit(HCI_CONFIG, &hdev->dev_flags);
6067 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6068
6069 queue_work(hdev->req_workqueue, &hdev->power_on);
6070 } else {
5ea234d3 6071 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6072 mgmt_index_added(hdev);
6073 }
dbece37a
MH		 6074 }
6075
6076unlock:
6077 hci_dev_unlock(hdev);
6078 return err;
6079}
6080
9713c17b
MH		 6081static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6082 void *data, u16 len)
6083{
6084 struct mgmt_cp_set_public_address *cp = data;
6085 bool changed;
6086 int err;
6087
6088 BT_DBG("%s", hdev->name);
6089
6090 if (hdev_is_powered(hdev))
6091 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6092 MGMT_STATUS_REJECTED);
6093
6094 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6095 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6096 MGMT_STATUS_INVALID_PARAMS);
6097
6098 if (!hdev->set_bdaddr)
6099 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6100 MGMT_STATUS_NOT_SUPPORTED);
6101
6102 hci_dev_lock(hdev);
6103
6104 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6105 bacpy(&hdev->public_addr, &cp->bdaddr);
6106
6107 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6108 if (err < 0)
6109 goto unlock;
6110
6111 if (!changed)
6112 goto unlock;
6113
6114 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6115 err = new_options(hdev, sk);
6116
6117 if (is_configured(hdev)) {
6118 mgmt_index_removed(hdev);
6119
6120 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
6121
6122 set_bit(HCI_CONFIG, &hdev->dev_flags);
6123 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6124
6125 queue_work(hdev->req_workqueue, &hdev->power_on);
6126 }
6127
6128unlock:
6129 hci_dev_unlock(hdev);
6130 return err;
6131}
6132
6d785aa3 6133static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 6134 { NULL }, /* 0x0000 (no command) */
b9a245fb
JH		 6135 { read_version, MGMT_READ_VERSION_SIZE,
6136 HCI_MGMT_NO_HDEV },
6137 { read_commands, MGMT_READ_COMMANDS_SIZE,
6138 HCI_MGMT_NO_HDEV },
6139 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
6140 HCI_MGMT_NO_HDEV },
6141 { read_controller_info, MGMT_READ_INFO_SIZE, 0 },
6142 { set_powered, MGMT_SETTING_SIZE, 0 },
6143 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE, 0 },
6144 { set_connectable, MGMT_SETTING_SIZE, 0 },
6145 { set_fast_connectable, MGMT_SETTING_SIZE, 0 },
6146 { set_bondable, MGMT_SETTING_SIZE, 0 },
6147 { set_link_security, MGMT_SETTING_SIZE, 0 },
6148 { set_ssp, MGMT_SETTING_SIZE, 0 },
6149 { set_hs, MGMT_SETTING_SIZE, 0 },
6150 { set_le, MGMT_SETTING_SIZE, 0 },
6151 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE, 0 },
6152 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE, 0 },
6153 { add_uuid, MGMT_ADD_UUID_SIZE, 0 },
6154 { remove_uuid, MGMT_REMOVE_UUID_SIZE, 0 },
6155 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
6156 HCI_MGMT_VAR_LEN },
6157 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
6158 HCI_MGMT_VAR_LEN },
6159 { disconnect, MGMT_DISCONNECT_SIZE, 0 },
6160 { get_connections, MGMT_GET_CONNECTIONS_SIZE, 0 },
6161 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE, 0 },
6162 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE, 0 },
6163 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE, 0 },
6164 { pair_device, MGMT_PAIR_DEVICE_SIZE, 0 },
6165 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE, 0 },
6166 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE, 0 },
6167 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE, 0 },
6168 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE, 0 },
6169 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE, 0 },
6170 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE, 0 },
6171 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
6172 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
6173 HCI_MGMT_VAR_LEN },
6174 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE, 0 },
6175 { start_discovery, MGMT_START_DISCOVERY_SIZE, 0 },
6176 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE, 0 },
6177 { confirm_name, MGMT_CONFIRM_NAME_SIZE, 0 },
6178 { block_device, MGMT_BLOCK_DEVICE_SIZE, 0 },
6179 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE, 0 },
6180 { set_device_id, MGMT_SET_DEVICE_ID_SIZE, 0 },
6181 { set_advertising, MGMT_SETTING_SIZE, 0 },
6182 { set_bredr, MGMT_SETTING_SIZE, 0 },
6183 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE, 0 },
6184 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE, 0 },
6185 { set_secure_conn, MGMT_SETTING_SIZE, 0 },
6186 { set_debug_keys, MGMT_SETTING_SIZE, 0 },
6187 { set_privacy, MGMT_SET_PRIVACY_SIZE, 0 },
6188 { load_irks, MGMT_LOAD_IRKS_SIZE,
6189 HCI_MGMT_VAR_LEN },
6190 { get_conn_info, MGMT_GET_CONN_INFO_SIZE, 0 },
6191 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE, 0 },
6192 { add_device, MGMT_ADD_DEVICE_SIZE, 0 },
6193 { remove_device, MGMT_REMOVE_DEVICE_SIZE, 0 },
6194 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
6195 HCI_MGMT_VAR_LEN },
6196 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
6197 HCI_MGMT_NO_HDEV },
6198 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
6199 HCI_MGMT_UNCONFIGURED },
6200 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
6201 HCI_MGMT_UNCONFIGURED },
6202 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
6203 HCI_MGMT_UNCONFIGURED },
6204 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
6205 HCI_MGMT_VAR_LEN },
0f4e68cf
JH		 6206};
6207
6d785aa3
JH		 6208int mgmt_control(struct hci_mgmt_chan *chan, struct sock *sk,
6209 struct msghdr *msg, size_t msglen)
0381101f 6210{
650f726d
VCG		 6211 void *buf;
6212 u8 *cp;
0381101f 6213 struct mgmt_hdr *hdr;
4e51eae9 6214 u16 opcode, index, len;
bdb6d971 6215 struct hci_dev *hdev = NULL;
6d785aa3 6216 const struct hci_mgmt_handler *handler;
b9a245fb 6217 bool var_len, no_hdev;
0381101f
JH		 6218 int err;
6219
6220 BT_DBG("got %zu bytes", msglen);
6221
6222 if (msglen < sizeof(*hdr))
6223 return -EINVAL;
6224
e63a15ec 6225 buf = kmalloc(msglen, GFP_KERNEL);
0381101f
JH		 6226 if (!buf)
6227 return -ENOMEM;
6228
6ce8e9ce 6229 if (memcpy_from_msg(buf, msg, msglen)) {
0381101f
JH		 6230 err = -EFAULT;
6231 goto done;
6232 }
6233
650f726d 6234 hdr = buf;
1f350c87
MH		 6235 opcode = __le16_to_cpu(hdr->opcode);
6236 index = __le16_to_cpu(hdr->index);
6237 len = __le16_to_cpu(hdr->len);
0381101f
JH		 6238
6239 if (len != msglen - sizeof(*hdr)) {
6240 err = -EINVAL;
6241 goto done;
6242 }
6243
b9a245fb
JH		 6244 if (opcode >= chan->handler_count ||
6245 chan->handlers[opcode].func == NULL) {
6246 BT_DBG("Unknown op %u", opcode);
6247 err = cmd_status(sk, index, opcode,
6248 MGMT_STATUS_UNKNOWN_COMMAND);
6249 goto done;
6250 }
6251
6252 handler = &chan->handlers[opcode];
6253
0f4e68cf 6254 if (index != MGMT_INDEX_NONE) {
bdb6d971
JH		 6255 hdev = hci_dev_get(index);
6256 if (!hdev) {
6257 err = cmd_status(sk, index, opcode,
04124681 6258 MGMT_STATUS_INVALID_INDEX);
bdb6d971
JH		 6259 goto done;
6260 }
0736cfa8 6261
cebf4cfd 6262 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
d603b76b 6263 test_bit(HCI_CONFIG, &hdev->dev_flags) ||
4a964404 6264 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
0736cfa8
MH		 6265 err = cmd_status(sk, index, opcode,
6266 MGMT_STATUS_INVALID_INDEX);
6267 goto done;
6268 }
42a9bc14
MH		 6269
6270 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
b9a245fb 6271 !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
42a9bc14
MH		 6272 err = cmd_status(sk, index, opcode,
6273 MGMT_STATUS_INVALID_INDEX);
6274 goto done;
6275 }
bdb6d971
JH		 6276 }
6277
b9a245fb
JH		 6278 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
6279 if (no_hdev != !hdev) {
0f4e68cf 6280 err = cmd_status(sk, index, opcode,
04124681 6281 MGMT_STATUS_INVALID_INDEX);
0f4e68cf 6282 goto done;
0381101f
JH		 6283 }
6284
b9a245fb
JH		 6285 var_len = (handler->flags & HCI_MGMT_VAR_LEN);
6286 if ((var_len && len < handler->data_len) ||
6287 (!var_len && len != handler->data_len)) {
be22b54e 6288 err = cmd_status(sk, index, opcode,
04124681 6289 MGMT_STATUS_INVALID_PARAMS);
be22b54e
JH		 6290 goto done;
6291 }
6292
0f4e68cf
JH		 6293 if (hdev)
6294 mgmt_init_hdev(sk, hdev);
6295
6296 cp = buf + sizeof(*hdr);
6297
be22b54e 6298 err = handler->func(sk, hdev, cp, len);
e41d8b4e
JH		 6299 if (err < 0)
6300 goto done;
6301
0381101f
JH		 6302 err = msglen;
6303
6304done:
bdb6d971
JH		 6305 if (hdev)
6306 hci_dev_put(hdev);
6307
0381101f
JH		 6308 kfree(buf);
6309 return err;
6310}
c71e97bf 6311
bf6b56db 6312void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 6313{
1514b892 6314 if (hdev->dev_type != HCI_BREDR)
bf6b56db 6315 return;
bb4b2a9a 6316
0602a8ad
MH		 6317 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6318 return;
6319
6320 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6321 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6322 else
6323 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
c71e97bf
JH		 6324}
6325
bf6b56db 6326void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 6327{
5f159032 6328 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 6329
1514b892 6330 if (hdev->dev_type != HCI_BREDR)
bf6b56db 6331 return;
bb4b2a9a 6332
0602a8ad
MH		 6333 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6334 return;
6335
1b9b5ee5 6336 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 6337
edd3896b
MH		 6338 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6339 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6340 else
6341 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
eec8d2bc
JH		 6342}
6343
6046dc3e 6344/* This function requires the caller holds hdev->lock */
2cf22218 6345static void restart_le_actions(struct hci_request *req)
6046dc3e 6346{
2cf22218 6347 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 6348 struct hci_conn_params *p;
6349
6350 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 6351 /* Needed for AUTO_OFF case where might not "really"
6352 * have been powered off.
6353 */
6354 list_del_init(&p->action);
6355
6356 switch (p->auto_connect) {
4b9e7e75 6357 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 6358 case HCI_AUTO_CONN_ALWAYS:
6359 list_add(&p->action, &hdev->pend_le_conns);
6360 break;
6361 case HCI_AUTO_CONN_REPORT:
6362 list_add(&p->action, &hdev->pend_le_reports);
6363 break;
6364 default:
6365 break;
c83ed19d 6366 }
6046dc3e 6367 }
c83ed19d 6368
2cf22218 6369 __hci_update_background_scan(req);
6046dc3e
AG		 6370}
6371
1904a853 6372static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 6373{
6374 struct cmd_lookup match = { NULL, hdev };
6375
6376 BT_DBG("status 0x%02x", status);
6377
162a3bac
MH		 6378 if (!status) {
6379 /* Register the available SMP channels (BR/EDR and LE) only
6380 * when successfully powering on the controller. This late
6381 * registration is required so that LE SMP can clearly
6382 * decide if the public address or static address is used.
6383 */
6384 smp_register(hdev);
6385 }
6386
229ab39c
JH		 6387 hci_dev_lock(hdev);
6388
6389 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6390
6391 new_settings(hdev, match.sk);
6392
6393 hci_dev_unlock(hdev);
6394
6395 if (match.sk)
6396 sock_put(match.sk);
6397}
6398
70da6243 6399static int powered_update_hci(struct hci_dev *hdev)
5add6af8 6400{
890ea898 6401 struct hci_request req;
70da6243 6402 u8 link_sec;
5add6af8 6403
890ea898
JH		 6404 hci_req_init(&req, hdev);
6405
70da6243
JH		 6406 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6407 !lmp_host_ssp_capable(hdev)) {
574ea3c7 6408 u8 mode = 0x01;
5e5282bb 6409
574ea3c7
MH		 6410 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6411
6412 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6413 u8 support = 0x01;
5add6af8 6414
574ea3c7
MH		 6415 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6416 sizeof(support), &support);
6417 }
ec6f99b8
JH		 6418 }
6419
c73eee91
JH		 6420 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6421 lmp_bredr_capable(hdev)) {
70da6243 6422 struct hci_cp_write_le_host_supported cp;
f0ff92fb 6423
32226e4f
MH		 6424 cp.le = 0x01;
6425 cp.simul = 0x00;
3d1cbdd6 6426
70da6243
JH		 6427 /* Check first if we already have the right
6428 * host state (host features set)
6429 */
6430 if (cp.le != lmp_host_le_capable(hdev) ||
6431 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 6432 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6433 sizeof(cp), &cp);
70da6243 6434 }
3d1cbdd6 6435
d13eafce 6436 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 6437 /* Make sure the controller has a good default for
6438 * advertising data. This also applies to the case
6439 * where BR/EDR was toggled during the AUTO_OFF phase.
6440 */
f14d8f64 6441 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5947f4bc 6442 update_adv_data(&req);
f14d8f64
MH		 6443 update_scan_rsp_data(&req);
6444 }
441ad2d0 6445
bba3aa55
MH		 6446 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6447 enable_advertising(&req);
2cf22218
JH		 6448
6449 restart_le_actions(&req);
eeca6f89
JH		 6450 }
6451
70da6243
JH		 6452 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6453 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 6454 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6455 sizeof(link_sec), &link_sec);
562fcc24 6456
70da6243 6457 if (lmp_bredr_capable(hdev)) {
432df05e 6458 write_fast_connectable(&req, false);
1d2dc5b7 6459 __hci_update_page_scan(&req);
890ea898 6460 update_class(&req);
13928971 6461 update_name(&req);
890ea898 6462 update_eir(&req);
70da6243 6463 }
562fcc24 6464
229ab39c 6465 return hci_req_run(&req, powered_complete);
70da6243 6466}
562fcc24 6467
70da6243
JH		 6468int mgmt_powered(struct hci_dev *hdev, u8 powered)
6469{
6470 struct cmd_lookup match = { NULL, hdev };
9845904f 6471 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 6472 int err;
f0ff92fb 6473
70da6243
JH		 6474 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6475 return 0;
6476
70da6243 6477 if (powered) {
229ab39c
JH		 6478 if (powered_update_hci(hdev) == 0)
6479 return 0;
fe038884 6480
229ab39c
JH		 6481 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6482 &match);
6483 goto new_settings;
b24752fe
JH		 6484 }
6485
229ab39c 6486 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 6487
6488 /* If the power off is because of hdev unregistration let
6489 * use the appropriate INVALID_INDEX status. Otherwise use
6490 * NOT_POWERED. We cover both scenarios here since later in
6491 * mgmt_index_removed() any hci_conn callbacks will have already
6492 * been triggered, potentially causing misleading DISCONNECTED
6493 * status responses.
6494 */
6495 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6496 status = MGMT_STATUS_INVALID_INDEX;
6497 else
6498 status = MGMT_STATUS_NOT_POWERED;
6499
6500 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 6501
6502 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6503 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6504 zero_cod, sizeof(zero_cod), NULL);
6505
6506new_settings:
beadb2bd 6507 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 6508
6509 if (match.sk)
6510 sock_put(match.sk);
6511
7bb895d6 6512 return err;
5add6af8 6513}
73f22f62 6514
3eec705e 6515void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc
JH		 6516{
6517 struct pending_cmd *cmd;
6518 u8 status;
6519
6520 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6521 if (!cmd)
3eec705e 6522 return;
96570ffc
JH		 6523
6524 if (err == -ERFKILL)
6525 status = MGMT_STATUS_RFKILLED;
6526 else
6527 status = MGMT_STATUS_FAILED;
6528
3eec705e 6529 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 6530
6531 mgmt_pending_remove(cmd);
96570ffc
JH		 6532}
6533
d1967ff8
MH		 6534void mgmt_discoverable_timeout(struct hci_dev *hdev)
6535{
6536 struct hci_request req;
d1967ff8
MH		 6537
6538 hci_dev_lock(hdev);
6539
6540 /* When discoverable timeout triggers, then just make sure
6541 * the limited discoverable flag is cleared. Even in the case
6542 * of a timeout triggered from general discoverable, it is
6543 * safe to unconditionally clear the flag.
6544 */
6545 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
9a43e25f 6546 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
d1967ff8
MH		 6547
6548 hci_req_init(&req, hdev);
4b580614
JH		 6549 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6550 u8 scan = SCAN_PAGE;
6551 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6552 sizeof(scan), &scan);
6553 }
d1967ff8 6554 update_class(&req);
9a43e25f 6555 update_adv_data(&req);
d1967ff8
MH		 6556 hci_req_run(&req, NULL);
6557
6558 hdev->discov_timeout = 0;
6559
9a43e25f
JH		 6560 new_settings(hdev, NULL);
6561
d1967ff8
MH		 6562 hci_dev_unlock(hdev);
6563}
6564
dc4a5ee2
MH		 6565void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6566 bool persistent)
55ed8ca1 6567{
86742e1e 6568 struct mgmt_ev_new_link_key ev;
55ed8ca1 6569
a492cd52 6570 memset(&ev, 0, sizeof(ev));
55ed8ca1 6571
a492cd52 6572 ev.store_hint = persistent;
d753fdc4 6573 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 6574 ev.key.addr.type = BDADDR_BREDR;
a492cd52 6575 ev.key.type = key->type;
9b3b4460 6576 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 6577 ev.key.pin_len = key->pin_len;
55ed8ca1 6578
dc4a5ee2 6579 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 6580}
f7520543 6581
d7b25450
JH		 6582static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6583{
23fb8de3
JH		 6584 switch (ltk->type) {
6585 case SMP_LTK:
6586 case SMP_LTK_SLAVE:
6587 if (ltk->authenticated)
6588 return MGMT_LTK_AUTHENTICATED;
6589 return MGMT_LTK_UNAUTHENTICATED;
6590 case SMP_LTK_P256:
6591 if (ltk->authenticated)
6592 return MGMT_LTK_P256_AUTH;
6593 return MGMT_LTK_P256_UNAUTH;
6594 case SMP_LTK_P256_DEBUG:
6595 return MGMT_LTK_P256_DEBUG;
6596 }
d7b25450
JH		 6597
6598 return MGMT_LTK_UNAUTHENTICATED;
6599}
6600
53ac6ab6 6601void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 6602{
6603 struct mgmt_ev_new_long_term_key ev;
6604
6605 memset(&ev, 0, sizeof(ev));
6606
5192d301
MH		 6607 /* Devices using resolvable or non-resolvable random addresses
6608 * without providing an indentity resolving key don't require
6609 * to store long term keys. Their addresses will change the
6610 * next time around.
6611 *
6612 * Only when a remote device provides an identity address
6613 * make sure the long term key is stored. If the remote
6614 * identity is known, the long term keys are internally
6615 * mapped to the identity address. So allow static random
6616 * and public addresses here.
6617 */
ba74b666
JH		 6618 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6619 (key->bdaddr.b[5] & 0xc0) != 0xc0)
6620 ev.store_hint = 0x00;
6621 else
53ac6ab6 6622 ev.store_hint = persistent;
ba74b666 6623
346af67b 6624 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 6625 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 6626 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 6627 ev.key.enc_size = key->enc_size;
6628 ev.key.ediv = key->ediv;
fe39c7b2 6629 ev.key.rand = key->rand;
346af67b 6630
2ceba539 6631 if (key->type == SMP_LTK)
346af67b
VCG		 6632 ev.key.master = 1;
6633
346af67b
VCG		 6634 memcpy(ev.key.val, key->val, sizeof(key->val));
6635
083368f7 6636 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 6637}
6638
95fbac8a
JH		 6639void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6640{
6641 struct mgmt_ev_new_irk ev;
6642
6643 memset(&ev, 0, sizeof(ev));
6644
bab6d1e5
MH		 6645 /* For identity resolving keys from devices that are already
6646 * using a public address or static random address, do not
6647 * ask for storing this key. The identity resolving key really
6648 * is only mandatory for devices using resovlable random
6649 * addresses.
6650 *
6651 * Storing all identity resolving keys has the downside that
6652 * they will be also loaded on next boot of they system. More
6653 * identity resolving keys, means more time during scanning is
6654 * needed to actually resolve these addresses.
6655 */
6656 if (bacmp(&irk->rpa, BDADDR_ANY))
6657 ev.store_hint = 0x01;
6658 else
6659 ev.store_hint = 0x00;
6660
95fbac8a
JH		 6661 bacpy(&ev.rpa, &irk->rpa);
6662 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6663 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6664 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6665
6666 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6667}
6668
53ac6ab6
MH		 6669void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6670 bool persistent)
7ee4ea36
MH		 6671{
6672 struct mgmt_ev_new_csrk ev;
6673
6674 memset(&ev, 0, sizeof(ev));
6675
6676 /* Devices using resolvable or non-resolvable random addresses
6677 * without providing an indentity resolving key don't require
6678 * to store signature resolving keys. Their addresses will change
6679 * the next time around.
6680 *
6681 * Only when a remote device provides an identity address
6682 * make sure the signature resolving key is stored. So allow
6683 * static random and public addresses here.
6684 */
6685 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6686 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6687 ev.store_hint = 0x00;
6688 else
53ac6ab6 6689 ev.store_hint = persistent;
7ee4ea36
MH		 6690
6691 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6692 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 6693 ev.key.type = csrk->type;
7ee4ea36
MH		 6694 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6695
6696 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6697}
6698
ffb5a827 6699void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 6700 u8 bdaddr_type, u8 store_hint, u16 min_interval,
6701 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 6702{
6703 struct mgmt_ev_new_conn_param ev;
6704
c103aea6
JH		 6705 if (!hci_is_identity_address(bdaddr, bdaddr_type))
6706 return;
6707
ffb5a827
AG		 6708 memset(&ev, 0, sizeof(ev));
6709 bacpy(&ev.addr.bdaddr, bdaddr);
6710 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 6711 ev.store_hint = store_hint;
ffb5a827
AG		 6712 ev.min_interval = cpu_to_le16(min_interval);
6713 ev.max_interval = cpu_to_le16(max_interval);
6714 ev.latency = cpu_to_le16(latency);
6715 ev.timeout = cpu_to_le16(timeout);
6716
6717 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6718}
6719
94933991
MH		 6720static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6721 u8 data_len)
6722{
6723 eir[eir_len++] = sizeof(type) + data_len;
6724 eir[eir_len++] = type;
6725 memcpy(&eir[eir_len], data, data_len);
6726 eir_len += data_len;
6727
6728 return eir_len;
6729}
6730
48ec92fa
AA		 6731void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6732 u32 flags, u8 *name, u8 name_len)
f7520543 6733{
b644ba33
JH		 6734 char buf[512];
6735 struct mgmt_ev_device_connected *ev = (void *) buf;
6736 u16 eir_len = 0;
f7520543 6737
48ec92fa
AA		 6738 bacpy(&ev->addr.bdaddr, &conn->dst);
6739 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 6740
c95f0ba7 6741 ev->flags = __cpu_to_le32(flags);
08c79b61 6742
fd45ada9
AA		 6743 /* We must ensure that the EIR Data fields are ordered and
6744 * unique. Keep it simple for now and avoid the problem by not
6745 * adding any BR/EDR data to the LE adv.
6746 */
6747 if (conn->le_adv_data_len > 0) {
6748 memcpy(&ev->eir[eir_len],
6749 conn->le_adv_data, conn->le_adv_data_len);
6750 eir_len = conn->le_adv_data_len;
6751 } else {
6752 if (name_len > 0)
6753 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6754 name, name_len);
b644ba33 6755
ddbea5cf 6756 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 6757 eir_len = eir_append_data(ev->eir, eir_len,
6758 EIR_CLASS_OF_DEV,
6759 conn->dev_class, 3);
6760 }
b644ba33 6761
eb55ef07 6762 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 6763
ecd90ae7
MH		 6764 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6765 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 6766}
6767
8962ee74
JH		 6768static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6769{
8962ee74 6770 struct sock **sk = data;
8962ee74 6771
f5818c22 6772 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 6773
6774 *sk = cmd->sk;
6775 sock_hold(*sk);
6776
a664b5bc 6777 mgmt_pending_remove(cmd);
8962ee74
JH		 6778}
6779
124f6e35 6780static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
a8a1d19e 6781{
b1078ad0 6782 struct hci_dev *hdev = data;
124f6e35 6783 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 6784
b1078ad0
JH		 6785 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6786
d8b7b1e4 6787 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 6788 mgmt_pending_remove(cmd);
6789}
6790
84c61d92
JH		 6791bool mgmt_powering_down(struct hci_dev *hdev)
6792{
6793 struct pending_cmd *cmd;
6794 struct mgmt_mode *cp;
6795
6796 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6797 if (!cmd)
6798 return false;
6799
6800 cp = cmd->param;
6801 if (!cp->val)
6802 return true;
6803
6804 return false;
6805}
6806
9b80ec5e 6807void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 6808 u8 link_type, u8 addr_type, u8 reason,
6809 bool mgmt_connected)
f7520543 6810{
f0d6a0ea 6811 struct mgmt_ev_device_disconnected ev;
8962ee74 6812 struct sock *sk = NULL;
8962ee74 6813
84c61d92
JH		 6814 /* The connection is still in hci_conn_hash so test for 1
6815 * instead of 0 to know if this is the last one.
6816 */
6817 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6818 cancel_delayed_work(&hdev->power_off);
6819 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 6820 }
6821
12d4a3b2
JH		 6822 if (!mgmt_connected)
6823 return;
6824
57eb776f
AG		 6825 if (link_type != ACL_LINK && link_type != LE_LINK)
6826 return;
6827
744cf19e 6828 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 6829
f0d6a0ea
MA		 6830 bacpy(&ev.addr.bdaddr, bdaddr);
6831 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6832 ev.reason = reason;
f7520543 6833
9b80ec5e 6834 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 6835
6836 if (sk)
d97dcb66 6837 sock_put(sk);
8962ee74 6838
124f6e35 6839 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 6840 hdev);
8962ee74
JH		 6841}
6842
7892924c
MH		 6843void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6844 u8 link_type, u8 addr_type, u8 status)
8962ee74 6845{
3655bba8
AG		 6846 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6847 struct mgmt_cp_disconnect *cp;
8962ee74 6848 struct pending_cmd *cmd;
8962ee74 6849
36a75f1b
JD		 6850 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6851 hdev);
6852
2e58ef3e 6853 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 6854 if (!cmd)
7892924c 6855 return;
8962ee74 6856
3655bba8
AG		 6857 cp = cmd->param;
6858
6859 if (bacmp(bdaddr, &cp->addr.bdaddr))
6860 return;
6861
6862 if (cp->addr.type != bdaddr_type)
6863 return;
6864
f5818c22 6865 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6866 mgmt_pending_remove(cmd);
f7520543 6867}
17d5c04c 6868
445608d0
MH		 6869void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6870 u8 addr_type, u8 status)
17d5c04c
JH		 6871{
6872 struct mgmt_ev_connect_failed ev;
c9910d0f 6873
84c61d92
JH		 6874 /* The connection is still in hci_conn_hash so test for 1
6875 * instead of 0 to know if this is the last one.
6876 */
6877 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6878 cancel_delayed_work(&hdev->power_off);
6879 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 6880 }
17d5c04c 6881
4c659c39 6882 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6883 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 6884 ev.status = mgmt_status(status);
17d5c04c 6885
445608d0 6886 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 6887}
980e1a53 6888
ce0e4a0d 6889void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 6890{
6891 struct mgmt_ev_pin_code_request ev;
6892
d8457698 6893 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 6894 ev.addr.type = BDADDR_BREDR;
a770bb5a 6895 ev.secure = secure;
980e1a53 6896
ce0e4a0d 6897 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 6898}
6899
e669cf80
MH		 6900void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6901 u8 status)
980e1a53
JH		 6902{
6903 struct pending_cmd *cmd;
980e1a53 6904
2e58ef3e 6905 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 6906 if (!cmd)
e669cf80 6907 return;
980e1a53 6908
7776d1d8 6909 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6910 mgmt_pending_remove(cmd);
980e1a53
JH		 6911}
6912
3eb38528
MH		 6913void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6914 u8 status)
980e1a53
JH		 6915{
6916 struct pending_cmd *cmd;
980e1a53 6917
2e58ef3e 6918 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 6919 if (!cmd)
3eb38528 6920 return;
980e1a53 6921
7776d1d8 6922 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6923 mgmt_pending_remove(cmd);
980e1a53 6924}
a5c29683 6925
744cf19e 6926int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 6927 u8 link_type, u8 addr_type, u32 value,
04124681 6928 u8 confirm_hint)
a5c29683
JH		 6929{
6930 struct mgmt_ev_user_confirm_request ev;
6931
744cf19e 6932 BT_DBG("%s", hdev->name);
a5c29683 6933
272d90df 6934 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6935 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 6936 ev.confirm_hint = confirm_hint;
39adbffe 6937 ev.value = cpu_to_le32(value);
a5c29683 6938
744cf19e 6939 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 6940 NULL);
a5c29683
JH		 6941}
6942
272d90df 6943int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 6944 u8 link_type, u8 addr_type)
604086b7
BG		 6945{
6946 struct mgmt_ev_user_passkey_request ev;
6947
6948 BT_DBG("%s", hdev->name);
6949
272d90df 6950 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6951 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 6952
6953 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 6954 NULL);
604086b7
BG		 6955}
6956
0df4c185 6957static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 6958 u8 link_type, u8 addr_type, u8 status,
6959 u8 opcode)
a5c29683
JH		 6960{
6961 struct pending_cmd *cmd;
a5c29683 6962
2e58ef3e 6963 cmd = mgmt_pending_find(opcode, hdev);
a5c29683
JH		 6964 if (!cmd)
6965 return -ENOENT;
6966
7776d1d8 6967 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6968 mgmt_pending_remove(cmd);
a5c29683 6969
7776d1d8 6970 return 0;
a5c29683
JH		 6971}
6972
744cf19e 6973int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6974 u8 link_type, u8 addr_type, u8 status)
a5c29683 6975{
272d90df 6976 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 6977 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 6978}
6979
272d90df 6980int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6981 u8 link_type, u8 addr_type, u8 status)
a5c29683 6982{
272d90df 6983 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 6984 status,
6985 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 6986}
2a611692 6987
604086b7 6988int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6989 u8 link_type, u8 addr_type, u8 status)
604086b7 6990{
272d90df 6991 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 6992 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 6993}
6994
272d90df 6995int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6996 u8 link_type, u8 addr_type, u8 status)
604086b7 6997{
272d90df 6998 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 6999 status,
7000 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 7001}
7002
92a25256
JH		 7003int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
7004 u8 link_type, u8 addr_type, u32 passkey,
7005 u8 entered)
7006{
7007 struct mgmt_ev_passkey_notify ev;
7008
7009 BT_DBG("%s", hdev->name);
7010
7011 bacpy(&ev.addr.bdaddr, bdaddr);
7012 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7013 ev.passkey = __cpu_to_le32(passkey);
7014 ev.entered = entered;
7015
7016 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
7017}
7018
e1e930f5 7019void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 7020{
7021 struct mgmt_ev_auth_failed ev;
e1e930f5
JH		 7022 struct pending_cmd *cmd;
7023 u8 status = mgmt_status(hci_status);
2a611692 7024
e1e930f5
JH		 7025 bacpy(&ev.addr.bdaddr, &conn->dst);
7026 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7027 ev.status = status;
2a611692 7028
e1e930f5
JH		 7029 cmd = find_pairing(conn);
7030
7031 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7032 cmd ? cmd->sk : NULL);
7033
a511b35b
JH		 7034 if (cmd) {
7035 cmd->cmd_complete(cmd, status);
7036 mgmt_pending_remove(cmd);
7037 }
2a611692 7038}
b312b161 7039
464996ae 7040void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 7041{
7042 struct cmd_lookup match = { NULL, hdev };
464996ae 7043 bool changed;
33ef95ed
JH		 7044
7045 if (status) {
7046 u8 mgmt_err = mgmt_status(status);
7047 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 7048 cmd_status_rsp, &mgmt_err);
464996ae 7049 return;
33ef95ed
JH		 7050 }
7051
464996ae
MH		 7052 if (test_bit(HCI_AUTH, &hdev->flags))
7053 changed = !test_and_set_bit(HCI_LINK_SECURITY,
7054 &hdev->dev_flags);
7055 else
7056 changed = test_and_clear_bit(HCI_LINK_SECURITY,
7057 &hdev->dev_flags);
47990ea0 7058
33ef95ed 7059 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 7060 &match);
33ef95ed 7061
47990ea0 7062 if (changed)
464996ae 7063 new_settings(hdev, match.sk);
33ef95ed
JH		 7064
7065 if (match.sk)
7066 sock_put(match.sk);
33ef95ed
JH		 7067}
7068
890ea898 7069static void clear_eir(struct hci_request *req)
cacaf52f 7070{
890ea898 7071 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 7072 struct hci_cp_write_eir cp;
7073
976eb20e 7074 if (!lmp_ext_inq_capable(hdev))
890ea898 7075 return;
cacaf52f 7076
c80da27e
JH		 7077 memset(hdev->eir, 0, sizeof(hdev->eir));
7078
cacaf52f
JH		 7079 memset(&cp, 0, sizeof(cp));
7080
890ea898 7081 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 7082}
7083
3e248560 7084void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 7085{
7086 struct cmd_lookup match = { NULL, hdev };
890ea898 7087 struct hci_request req;
c0ecddc2 7088 bool changed = false;
ed2c4ee3
JH		 7089
7090 if (status) {
7091 u8 mgmt_err = mgmt_status(status);
c0ecddc2
JH		 7092
7093 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
9ecb3e24
MH		 7094 &hdev->dev_flags)) {
7095 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3e248560 7096 new_settings(hdev, NULL);
9ecb3e24 7097 }
c0ecddc2 7098
04124681
GP		 7099 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7100 &mgmt_err);
3e248560 7101 return;
c0ecddc2
JH		 7102 }
7103
7104 if (enable) {
9ecb3e24 7105 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
c0ecddc2 7106 } else {
9ecb3e24
MH		 7107 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
7108 if (!changed)
7109 changed = test_and_clear_bit(HCI_HS_ENABLED,
7110 &hdev->dev_flags);
7111 else
7112 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
ed2c4ee3
JH		 7113 }
7114
7115 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7116
c0ecddc2 7117 if (changed)
3e248560 7118 new_settings(hdev, match.sk);
ed2c4ee3 7119
5fc6ebb1 7120 if (match.sk)
ed2c4ee3
JH		 7121 sock_put(match.sk);
7122
890ea898
JH		 7123 hci_req_init(&req, hdev);
7124
3769972b
JH		 7125 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
7126 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
7127 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7128 sizeof(enable), &enable);
890ea898 7129 update_eir(&req);
3769972b 7130 } else {
890ea898 7131 clear_eir(&req);
3769972b 7132 }
890ea898
JH		 7133
7134 hci_req_run(&req, NULL);
ed2c4ee3
JH		 7135}
7136
92da6097 7137static void sk_lookup(struct pending_cmd *cmd, void *data)
90e70454
JH		 7138{
7139 struct cmd_lookup *match = data;
7140
90e70454
JH		 7141 if (match->sk == NULL) {
7142 match->sk = cmd->sk;
7143 sock_hold(match->sk);
7144 }
90e70454
JH		 7145}
7146
4e1b0245
MH		 7147void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7148 u8 status)
7f9a903c 7149{
90e70454 7150 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 7151
92da6097
JH		 7152 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7153 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7154 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 7155
7156 if (!status)
4e1b0245
MH		 7157 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7158 NULL);
90e70454
JH		 7159
7160 if (match.sk)
7161 sock_put(match.sk);
7f9a903c
MH		 7162}
7163
7667da34 7164void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 7165{
b312b161 7166 struct mgmt_cp_set_local_name ev;
13928971 7167 struct pending_cmd *cmd;
28cc7bde 7168
13928971 7169 if (status)
7667da34 7170 return;
b312b161
JH		 7171
7172 memset(&ev, 0, sizeof(ev));
7173 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 7174 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 7175
2e58ef3e 7176 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 7177 if (!cmd) {
7178 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 7179
13928971
JH		 7180 /* If this is a HCI command related to powering on the
7181 * HCI dev don't send any mgmt signals.
7182 */
7183 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 7184 return;
890ea898 7185 }
b312b161 7186
7667da34
MH		 7187 mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7188 cmd ? cmd->sk : NULL);
b312b161 7189}
c35938b2 7190
4d2d2796 7191void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
38da1703
JH		 7192 u8 *rand192, u8 *hash256, u8 *rand256,
7193 u8 status)
c35938b2
SJ		 7194{
7195 struct pending_cmd *cmd;
c35938b2 7196
744cf19e 7197 BT_DBG("%s status %u", hdev->name, status);
c35938b2 7198
2e58ef3e 7199 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 7200 if (!cmd)
3edaf092 7201 return;
c35938b2
SJ		 7202
7203 if (status) {
3edaf092
MH		 7204 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7205 mgmt_status(status));
c35938b2 7206 } else {
66f096f7
JH		 7207 struct mgmt_rp_read_local_oob_data rp;
7208 size_t rp_size = sizeof(rp);
4d2d2796 7209
66f096f7
JH		 7210 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7211 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
c35938b2 7212
66f096f7 7213 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
4d2d2796 7214 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
38da1703 7215 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
4d2d2796 7216 } else {
66f096f7 7217 rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
4d2d2796 7218 }
66f096f7
JH		 7219
7220 cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7221 &rp, rp_size);
c35938b2
SJ		 7222 }
7223
7224 mgmt_pending_remove(cmd);
c35938b2 7225}
e17acd40 7226
799ce93d
JP		 7227static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7228{
7229 int i;
7230
7231 for (i = 0; i < uuid_count; i++) {
7232 if (!memcmp(uuid, uuids[i], 16))
7233 return true;
7234 }
7235
7236 return false;
7237}
7238
b487b9ce
MH		 7239static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7240{
799ce93d
JP		 7241 u16 parsed = 0;
7242
7243 while (parsed < eir_len) {
7244 u8 field_len = eir[0];
7245 u8 uuid[16];
7246 int i;
7247
7248 if (field_len == 0)
7249 break;
7250
7251 if (eir_len - parsed < field_len + 1)
7252 break;
7253
7254 switch (eir[1]) {
7255 case EIR_UUID16_ALL:
7256 case EIR_UUID16_SOME:
7257 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 7258 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7259 uuid[13] = eir[i + 3];
7260 uuid[12] = eir[i + 2];
7261 if (has_uuid(uuid, uuid_count, uuids))
7262 return true;
7263 }
7264 break;
7265 case EIR_UUID32_ALL:
7266 case EIR_UUID32_SOME:
7267 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 7268 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7269 uuid[15] = eir[i + 5];
7270 uuid[14] = eir[i + 4];
7271 uuid[13] = eir[i + 3];
7272 uuid[12] = eir[i + 2];
7273 if (has_uuid(uuid, uuid_count, uuids))
7274 return true;
7275 }
7276 break;
7277 case EIR_UUID128_ALL:
7278 case EIR_UUID128_SOME:
7279 for (i = 0; i + 17 <= field_len; i += 16) {
7280 memcpy(uuid, eir + i + 2, 16);
7281 if (has_uuid(uuid, uuid_count, uuids))
7282 return true;
7283 }
7284 break;
7285 }
7286
7287 parsed += field_len + 1;
7288 eir += field_len + 1;
7289 }
7290
b487b9ce
MH		 7291 return false;
7292}
7293
4b0e0ced
JP		 7294static void restart_le_scan(struct hci_dev *hdev)
7295{
7296 /* If controller is not scanning we are done. */
7297 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
7298 return;
7299
7300 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7301 hdev->discovery.scan_start +
7302 hdev->discovery.scan_duration))
7303 return;
7304
7305 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7306 DISCOV_LE_RESTART_DELAY);
7307}
7308
48f86b7f
JP		 7309static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
7310 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 7311{
48f86b7f
JP		 7312 /* If a RSSI threshold has been specified, and
7313 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
7314 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
7315 * is set, let it through for further processing, as we might need to
7316 * restart the scan.
efb2513f
MH		 7317 *
7318 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7319 * the results are also dropped.
bda157a4
MH		 7320 */
7321 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 7322 (rssi == HCI_RSSI_INVALID ||
7323 (rssi < hdev->discovery.rssi &&
7324 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 7325 return false;
efb2513f 7326
2976cdeb
JP		 7327 if (hdev->discovery.uuid_count != 0) {
7328 /* If a list of UUIDs is provided in filter, results with no
7329 * matching UUID should be dropped.
b487b9ce 7330 */
2976cdeb
JP		 7331 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
7332 hdev->discovery.uuids) &&
7333 !eir_has_uuids(scan_rsp, scan_rsp_len,
7334 hdev->discovery.uuid_count,
7335 hdev->discovery.uuids))
7336 return false;
b487b9ce 7337 }
5d2e9fad 7338
2976cdeb
JP		 7339 /* If duplicate filtering does not report RSSI changes, then restart
7340 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 7341 */
2976cdeb
JP		 7342 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
7343 restart_le_scan(hdev);
7344
7345 /* Validate RSSI value against the RSSI threshold once more. */
7346 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7347 rssi < hdev->discovery.rssi)
7348 return false;
7349 }
48f86b7f
JP		 7350
7351 return true;
7352}
7353
7354void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7355 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7356 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
7357{
7358 char buf[512];
7359 struct mgmt_ev_device_found *ev = (void *)buf;
7360 size_t ev_size;
7361
7362 /* Don't send events for a non-kernel initiated discovery. With
7363 * LE one exception is if we have pend_le_reports > 0 in which
7364 * case we're doing passive scanning and want these events.
7365 */
7366 if (!hci_discovery_active(hdev)) {
7367 if (link_type == ACL_LINK)
7368 return;
7369 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
7370 return;
7371 }
7372
82f8b651 7373 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 7374 /* We are using service discovery */
7375 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
7376 scan_rsp_len))
7377 return;
7378 }
7379
7380 /* Make sure that the buffer is big enough. The 5 extra bytes
7381 * are for the potential CoD field.
7382 */
7383 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 7384 return;
7385
48f86b7f
JP		 7386 memset(buf, 0, sizeof(buf));
7387
7388 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7389 * RSSI value was reported as 0 when not available. This behavior
7390 * is kept when using device discovery. This is required for full
7391 * backwards compatibility with the API.
7392 *
7393 * However when using service discovery, the value 127 will be
7394 * returned when the RSSI is not available.
7395 */
7396 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7397 link_type == ACL_LINK)
7398 rssi = 0;
7399
7400 bacpy(&ev->addr.bdaddr, bdaddr);
7401 ev->addr.type = link_to_bdaddr(link_type, addr_type);
7402 ev->rssi = rssi;
7403 ev->flags = cpu_to_le32(flags);
7404
7405 if (eir_len > 0)
7406 /* Copy EIR or advertising data into event */
7407 memcpy(ev->eir, eir, eir_len);
7408
7409 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7410 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
7411 dev_class, 3);
7412
7413 if (scan_rsp_len > 0)
7414 /* Append scan response data to event */
7415 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
7416
5d2e9fad
JH		 7417 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7418 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 7419
901801b9 7420 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 7421}
a88a9652 7422
9cf12aee
MH		 7423void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7424 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 7425{
b644ba33
JH		 7426 struct mgmt_ev_device_found *ev;
7427 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7428 u16 eir_len;
a88a9652 7429
b644ba33 7430 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 7431
b644ba33
JH		 7432 memset(buf, 0, sizeof(buf));
7433
7434 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 7435 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 7436 ev->rssi = rssi;
7437
7438 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 7439 name_len);
b644ba33 7440
eb55ef07 7441 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 7442
9cf12aee 7443 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 7444}
314b2381 7445
2f1e063b 7446void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 7447{
f963e8e9 7448 struct mgmt_ev_discovering ev;
164a6e78 7449
343fb145
AG		 7450 BT_DBG("%s discovering %u", hdev->name, discovering);
7451
f963e8e9
JH		 7452 memset(&ev, 0, sizeof(ev));
7453 ev.type = hdev->discovery.type;
7454 ev.discovering = discovering;
7455
2f1e063b 7456 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 7457}
5e762444 7458
1904a853 7459static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 7460{
7461 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 7462}
7463
7464void mgmt_reenable_advertising(struct hci_dev *hdev)
7465{
7466 struct hci_request req;
7467
5976e608
MH		 7468 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7469 return;
7470
7471 hci_req_init(&req, hdev);
7472 enable_advertising(&req);
0ec5ae84 7473 hci_req_run(&req, adv_enable_complete);
5976e608 7474}
6d785aa3
JH		 7475
7476static struct hci_mgmt_chan chan = {
7477 .channel = HCI_CHANNEL_CONTROL,
7478 .handler_count = ARRAY_SIZE(mgmt_handlers),
7479 .handlers = mgmt_handlers,
7480};
7481
7482int mgmt_init(void)
7483{
7484 return hci_mgmt_chan_register(&chan);
7485}
7486
7487void mgmt_exit(void)
7488{
7489 hci_mgmt_chan_unregister(&chan);
7490}
Linux kernel - Deliverables
This page took 0.851071 seconds and 5 git commands to generate.