projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: 6lowpan: Use hci_conn_hash_lookup_le() when possible
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
e58627d1 41#define MGMT_REVISION 10
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 103 MGMT_OP_ADD_ADVERTISING,
da929335 104 MGMT_OP_REMOVE_ADVERTISING,
e70bb2e8
JH		 105};
106
107static const u16 mgmt_events[] = {
108 MGMT_EV_CONTROLLER_ERROR,
109 MGMT_EV_INDEX_ADDED,
110 MGMT_EV_INDEX_REMOVED,
111 MGMT_EV_NEW_SETTINGS,
112 MGMT_EV_CLASS_OF_DEV_CHANGED,
113 MGMT_EV_LOCAL_NAME_CHANGED,
114 MGMT_EV_NEW_LINK_KEY,
115 MGMT_EV_NEW_LONG_TERM_KEY,
116 MGMT_EV_DEVICE_CONNECTED,
117 MGMT_EV_DEVICE_DISCONNECTED,
118 MGMT_EV_CONNECT_FAILED,
119 MGMT_EV_PIN_CODE_REQUEST,
120 MGMT_EV_USER_CONFIRM_REQUEST,
121 MGMT_EV_USER_PASSKEY_REQUEST,
122 MGMT_EV_AUTH_FAILED,
123 MGMT_EV_DEVICE_FOUND,
124 MGMT_EV_DISCOVERING,
125 MGMT_EV_DEVICE_BLOCKED,
126 MGMT_EV_DEVICE_UNBLOCKED,
127 MGMT_EV_DEVICE_UNPAIRED,
92a25256 128 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 129 MGMT_EV_NEW_IRK,
7ee4ea36 130 MGMT_EV_NEW_CSRK,
8afef092
MH		 131 MGMT_EV_DEVICE_ADDED,
132 MGMT_EV_DEVICE_REMOVED,
ffb5a827 133 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 134 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 135 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 136 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 137 MGMT_EV_EXT_INDEX_ADDED,
138 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 139 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 140 MGMT_EV_ADVERTISING_ADDED,
141 MGMT_EV_ADVERTISING_REMOVED,
e70bb2e8
JH		 142};
143
99c679ac
MH		 144static const u16 mgmt_untrusted_commands[] = {
145 MGMT_OP_READ_INDEX_LIST,
146 MGMT_OP_READ_INFO,
147 MGMT_OP_READ_UNCONF_INDEX_LIST,
148 MGMT_OP_READ_CONFIG_INFO,
149 MGMT_OP_READ_EXT_INDEX_LIST,
150};
151
152static const u16 mgmt_untrusted_events[] = {
153 MGMT_EV_INDEX_ADDED,
154 MGMT_EV_INDEX_REMOVED,
155 MGMT_EV_NEW_SETTINGS,
156 MGMT_EV_CLASS_OF_DEV_CHANGED,
157 MGMT_EV_LOCAL_NAME_CHANGED,
158 MGMT_EV_UNCONF_INDEX_ADDED,
159 MGMT_EV_UNCONF_INDEX_REMOVED,
160 MGMT_EV_NEW_CONFIG_OPTIONS,
161 MGMT_EV_EXT_INDEX_ADDED,
162 MGMT_EV_EXT_INDEX_REMOVED,
163};
164
17b02e62 165#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 166
d25b78e2
JH		 167#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
168 "\x00\x00\x00\x00\x00\x00\x00\x00"
169
ca69b795
JH		 170/* HCI to MGMT error code conversion table */
171static u8 mgmt_status_table[] = {
172 MGMT_STATUS_SUCCESS,
173 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
174 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
175 MGMT_STATUS_FAILED, /* Hardware Failure */
176 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
177 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 178 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 179 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
180 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
181 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
182 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
183 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
184 MGMT_STATUS_BUSY, /* Command Disallowed */
185 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
186 MGMT_STATUS_REJECTED, /* Rejected Security */
187 MGMT_STATUS_REJECTED, /* Rejected Personal */
188 MGMT_STATUS_TIMEOUT, /* Host Timeout */
189 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
190 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
191 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
192 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
193 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
194 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
195 MGMT_STATUS_BUSY, /* Repeated Attempts */
196 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
197 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
199 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
200 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
201 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
202 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
203 MGMT_STATUS_FAILED, /* Unspecified Error */
204 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
205 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
206 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
207 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
208 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
209 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
210 MGMT_STATUS_FAILED, /* Unit Link Key Used */
211 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
212 MGMT_STATUS_TIMEOUT, /* Instant Passed */
213 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
214 MGMT_STATUS_FAILED, /* Transaction Collision */
215 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
216 MGMT_STATUS_REJECTED, /* QoS Rejected */
217 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
218 MGMT_STATUS_REJECTED, /* Insufficient Security */
219 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
220 MGMT_STATUS_BUSY, /* Role Switch Pending */
221 MGMT_STATUS_FAILED, /* Slot Violation */
222 MGMT_STATUS_FAILED, /* Role Switch Failed */
223 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
224 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
225 MGMT_STATUS_BUSY, /* Host Busy Pairing */
226 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
227 MGMT_STATUS_BUSY, /* Controller Busy */
228 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
229 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
230 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
231 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
232 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
233};
234
235static u8 mgmt_status(u8 hci_status)
236{
237 if (hci_status < ARRAY_SIZE(mgmt_status_table))
238 return mgmt_status_table[hci_status];
239
240 return MGMT_STATUS_FAILED;
241}
242
c08b1a1d
MH		 243static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
244 u16 len, int flag)
f9207338 245{
c08b1a1d
MH		 246 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
247 flag, NULL);
f9207338
MH		 248}
249
72000df2
MH		 250static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag, struct sock *skip_sk)
252{
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, skip_sk);
255}
256
f6b7712e
MH		 257static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, struct sock *skip_sk)
259{
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 HCI_MGMT_GENERIC_EVENTS, skip_sk);
262}
263
7a00ff44
JH		 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266{
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 268 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 269}
270
85813a7e
JH		 271static u8 le_addr_type(u8 mgmt_addr_type)
272{
273 if (mgmt_addr_type == BDADDR_LE_PUBLIC)
274 return ADDR_LE_DEV_PUBLIC;
275 else
276 return ADDR_LE_DEV_RANDOM;
277}
278
04124681
GP		 279static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
280 u16 data_len)
a38528f1
JH		 281{
282 struct mgmt_rp_read_version rp;
283
284 BT_DBG("sock %p", sk);
285
286 rp.version = MGMT_VERSION;
dcf4adbf 287 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 288
2a1afb5a
JH		 289 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
290 &rp, sizeof(rp));
a38528f1
JH		 291}
292
04124681
GP		 293static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
294 u16 data_len)
e70bb2e8
JH		 295{
296 struct mgmt_rp_read_commands *rp;
99c679ac 297 u16 num_commands, num_events;
e70bb2e8
JH		 298 size_t rp_size;
299 int i, err;
300
301 BT_DBG("sock %p", sk);
302
99c679ac
MH		 303 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
304 num_commands = ARRAY_SIZE(mgmt_commands);
305 num_events = ARRAY_SIZE(mgmt_events);
306 } else {
307 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
308 num_events = ARRAY_SIZE(mgmt_untrusted_events);
309 }
310
e70bb2e8
JH		 311 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
312
313 rp = kmalloc(rp_size, GFP_KERNEL);
314 if (!rp)
315 return -ENOMEM;
316
dcf4adbf
JP		 317 rp->num_commands = cpu_to_le16(num_commands);
318 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 319
99c679ac
MH		 320 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
321 __le16 *opcode = rp->opcodes;
322
323 for (i = 0; i < num_commands; i++, opcode++)
324 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 325
99c679ac
MH		 326 for (i = 0; i < num_events; i++, opcode++)
327 put_unaligned_le16(mgmt_events[i], opcode);
328 } else {
329 __le16 *opcode = rp->opcodes;
330
331 for (i = 0; i < num_commands; i++, opcode++)
332 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
333
334 for (i = 0; i < num_events; i++, opcode++)
335 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
336 }
e70bb2e8 337
2a1afb5a
JH		 338 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
339 rp, rp_size);
e70bb2e8
JH		 340 kfree(rp);
341
342 return err;
343}
344
04124681
GP		 345static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
346 u16 data_len)
faba42eb 347{
faba42eb 348 struct mgmt_rp_read_index_list *rp;
8035ded4 349 struct hci_dev *d;
a38528f1 350 size_t rp_len;
faba42eb 351 u16 count;
476e44cb 352 int err;
faba42eb
JH		 353
354 BT_DBG("sock %p", sk);
355
356 read_lock(&hci_dev_list_lock);
357
358 count = 0;
bb4b2a9a 359 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 360 if (d->dev_type == HCI_BREDR &&
d7a5a11d 361 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 362 count++;
faba42eb
JH		 363 }
364
a38528f1
JH		 365 rp_len = sizeof(*rp) + (2 * count);
366 rp = kmalloc(rp_len, GFP_ATOMIC);
367 if (!rp) {
b2c60d42 368 read_unlock(&hci_dev_list_lock);
faba42eb 369 return -ENOMEM;
b2c60d42 370 }
faba42eb 371
476e44cb 372 count = 0;
8035ded4 373 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 374 if (hci_dev_test_flag(d, HCI_SETUP) ||
375 hci_dev_test_flag(d, HCI_CONFIG) ||
376 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 377 continue;
378
73d1df2a
MH		 379 /* Devices marked as raw-only are neither configured
380 * nor unconfigured controllers.
381 */
382 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 383 continue;
384
73d1df2a 385 if (d->dev_type == HCI_BREDR &&
d7a5a11d 386 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 387 rp->index[count++] = cpu_to_le16(d->id);
388 BT_DBG("Added hci%u", d->id);
389 }
faba42eb
JH		 390 }
391
476e44cb
JH		 392 rp->num_controllers = cpu_to_le16(count);
393 rp_len = sizeof(*rp) + (2 * count);
394
faba42eb
JH		 395 read_unlock(&hci_dev_list_lock);
396
2a1afb5a
JH		 397 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
398 0, rp, rp_len);
faba42eb 399
a38528f1
JH		 400 kfree(rp);
401
402 return err;
faba42eb
JH		 403}
404
73d1df2a
MH		 405static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
406 void *data, u16 data_len)
407{
408 struct mgmt_rp_read_unconf_index_list *rp;
409 struct hci_dev *d;
410 size_t rp_len;
411 u16 count;
412 int err;
413
414 BT_DBG("sock %p", sk);
415
416 read_lock(&hci_dev_list_lock);
417
418 count = 0;
419 list_for_each_entry(d, &hci_dev_list, list) {
420 if (d->dev_type == HCI_BREDR &&
d7a5a11d 421 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 422 count++;
423 }
424
425 rp_len = sizeof(*rp) + (2 * count);
426 rp = kmalloc(rp_len, GFP_ATOMIC);
427 if (!rp) {
428 read_unlock(&hci_dev_list_lock);
429 return -ENOMEM;
430 }
431
432 count = 0;
433 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 434 if (hci_dev_test_flag(d, HCI_SETUP) ||
435 hci_dev_test_flag(d, HCI_CONFIG) ||
436 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 437 continue;
438
439 /* Devices marked as raw-only are neither configured
440 * nor unconfigured controllers.
441 */
442 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
443 continue;
444
445 if (d->dev_type == HCI_BREDR &&
d7a5a11d 446 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 447 rp->index[count++] = cpu_to_le16(d->id);
448 BT_DBG("Added hci%u", d->id);
449 }
450 }
451
452 rp->num_controllers = cpu_to_le16(count);
453 rp_len = sizeof(*rp) + (2 * count);
454
455 read_unlock(&hci_dev_list_lock);
456
2a1afb5a
JH		 457 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
458 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 459
460 kfree(rp);
461
462 return err;
463}
464
96f1474a
MH		 465static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
466 void *data, u16 data_len)
467{
468 struct mgmt_rp_read_ext_index_list *rp;
469 struct hci_dev *d;
470 size_t rp_len;
471 u16 count;
472 int err;
473
474 BT_DBG("sock %p", sk);
475
476 read_lock(&hci_dev_list_lock);
477
478 count = 0;
479 list_for_each_entry(d, &hci_dev_list, list) {
480 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
481 count++;
482 }
483
484 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
485 rp = kmalloc(rp_len, GFP_ATOMIC);
486 if (!rp) {
487 read_unlock(&hci_dev_list_lock);
488 return -ENOMEM;
489 }
490
491 count = 0;
492 list_for_each_entry(d, &hci_dev_list, list) {
493 if (hci_dev_test_flag(d, HCI_SETUP) ||
494 hci_dev_test_flag(d, HCI_CONFIG) ||
495 hci_dev_test_flag(d, HCI_USER_CHANNEL))
496 continue;
497
498 /* Devices marked as raw-only are neither configured
499 * nor unconfigured controllers.
500 */
501 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
502 continue;
503
504 if (d->dev_type == HCI_BREDR) {
505 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
506 rp->entry[count].type = 0x01;
507 else
508 rp->entry[count].type = 0x00;
509 } else if (d->dev_type == HCI_AMP) {
510 rp->entry[count].type = 0x02;
511 } else {
512 continue;
513 }
514
515 rp->entry[count].bus = d->bus;
516 rp->entry[count++].index = cpu_to_le16(d->id);
517 BT_DBG("Added hci%u", d->id);
518 }
519
520 rp->num_controllers = cpu_to_le16(count);
521 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
522
523 read_unlock(&hci_dev_list_lock);
524
525 /* If this command is called at least once, then all the
526 * default index and unconfigured index events are disabled
527 * and from now on only extended index events are used.
528 */
529 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
530 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
531 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
532
533 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
534 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
535
536 kfree(rp);
537
538 return err;
539}
540
dbece37a
MH		 541static bool is_configured(struct hci_dev *hdev)
542{
543 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 544 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 545 return false;
546
547 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
548 !bacmp(&hdev->public_addr, BDADDR_ANY))
549 return false;
550
551 return true;
552}
553
89bc22d2
MH		 554static __le32 get_missing_options(struct hci_dev *hdev)
555{
556 u32 options = 0;
557
dbece37a 558 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 559 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 560 options |= MGMT_OPTION_EXTERNAL_CONFIG;
561
89bc22d2
MH		 562 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
563 !bacmp(&hdev->public_addr, BDADDR_ANY))
564 options |= MGMT_OPTION_PUBLIC_ADDRESS;
565
566 return cpu_to_le32(options);
567}
568
f4537c04
MH		 569static int new_options(struct hci_dev *hdev, struct sock *skip)
570{
571 __le32 options = get_missing_options(hdev);
572
f6b7712e
MH		 573 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
574 sizeof(options), skip);
f4537c04
MH		 575}
576
dbece37a
MH		 577static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
578{
579 __le32 options = get_missing_options(hdev);
580
2a1afb5a
JH		 581 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
582 sizeof(options));
dbece37a
MH		 583}
584
9fc3bfb6
MH		 585static int read_config_info(struct sock *sk, struct hci_dev *hdev,
586 void *data, u16 data_len)
587{
588 struct mgmt_rp_read_config_info rp;
89bc22d2 589 u32 options = 0;
9fc3bfb6
MH		 590
591 BT_DBG("sock %p %s", sk, hdev->name);
592
593 hci_dev_lock(hdev);
594
595 memset(&rp, 0, sizeof(rp));
596 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 597
eb1904f4
MH		 598 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
599 options |= MGMT_OPTION_EXTERNAL_CONFIG;
600
9fc3bfb6 601 if (hdev->set_bdaddr)
89bc22d2
MH		 602 options |= MGMT_OPTION_PUBLIC_ADDRESS;
603
604 rp.supported_options = cpu_to_le32(options);
605 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 606
607 hci_dev_unlock(hdev);
608
2a1afb5a
JH		 609 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
610 &rp, sizeof(rp));
9fc3bfb6
MH		 611}
612
69ab39ea
JH		 613static u32 get_supported_settings(struct hci_dev *hdev)
614{
615 u32 settings = 0;
616
617 settings |= MGMT_SETTING_POWERED;
b2939475 618 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 619 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 620 settings |= MGMT_SETTING_CONNECTABLE;
621 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 622
ed3fa31f 623 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 624 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
625 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 626 settings |= MGMT_SETTING_BREDR;
627 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 628
629 if (lmp_ssp_capable(hdev)) {
630 settings |= MGMT_SETTING_SSP;
631 settings |= MGMT_SETTING_HS;
632 }
e98d2ce2 633
05b3c3e7 634 if (lmp_sc_capable(hdev))
e98d2ce2 635 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 636 }
d7b7e796 637
eeca6f89 638 if (lmp_le_capable(hdev)) {
9d42820f 639 settings |= MGMT_SETTING_LE;
eeca6f89 640 settings |= MGMT_SETTING_ADVERTISING;
a3209694 641 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 642 settings |= MGMT_SETTING_PRIVACY;
93690c22 643 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 644 }
69ab39ea 645
eb1904f4
MH		 646 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
647 hdev->set_bdaddr)
9fc3bfb6
MH		 648 settings |= MGMT_SETTING_CONFIGURATION;
649
69ab39ea
JH		 650 return settings;
651}
652
653static u32 get_current_settings(struct hci_dev *hdev)
654{
655 u32 settings = 0;
656
f1f0eb02 657 if (hdev_is_powered(hdev))
f0d4b78a
MH		 658 settings |= MGMT_SETTING_POWERED;
659
d7a5a11d 660 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 661 settings |= MGMT_SETTING_CONNECTABLE;
662
d7a5a11d 663 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 664 settings |= MGMT_SETTING_FAST_CONNECTABLE;
665
d7a5a11d 666 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 667 settings |= MGMT_SETTING_DISCOVERABLE;
668
d7a5a11d 669 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 670 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 671
d7a5a11d 672 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 673 settings |= MGMT_SETTING_BREDR;
674
d7a5a11d 675 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 676 settings |= MGMT_SETTING_LE;
677
d7a5a11d 678 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 679 settings |= MGMT_SETTING_LINK_SECURITY;
680
d7a5a11d 681 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 682 settings |= MGMT_SETTING_SSP;
683
d7a5a11d 684 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 685 settings |= MGMT_SETTING_HS;
686
d7a5a11d 687 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 688 settings |= MGMT_SETTING_ADVERTISING;
689
d7a5a11d 690 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 691 settings |= MGMT_SETTING_SECURE_CONN;
692
d7a5a11d 693 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 694 settings |= MGMT_SETTING_DEBUG_KEYS;
695
d7a5a11d 696 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 697 settings |= MGMT_SETTING_PRIVACY;
698
93690c22
MH		 699 /* The current setting for static address has two purposes. The
700 * first is to indicate if the static address will be used and
701 * the second is to indicate if it is actually set.
702 *
703 * This means if the static address is not configured, this flag
08dc0e98 704 * will never be set. If the address is configured, then if the
93690c22
MH		 705 * address is actually used decides if the flag is set or not.
706 *
707 * For single mode LE only controllers and dual-mode controllers
708 * with BR/EDR disabled, the existence of the static address will
709 * be evaluated.
710 */
b7cb93e5 711 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 712 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 713 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
714 if (bacmp(&hdev->static_addr, BDADDR_ANY))
715 settings |= MGMT_SETTING_STATIC_ADDRESS;
716 }
717
69ab39ea
JH		 718 return settings;
719}
720
ef580372
JH		 721#define PNP_INFO_SVCLASS_ID 0x1200
722
213202ed
JH		 723static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
724{
725 u8 *ptr = data, *uuids_start = NULL;
726 struct bt_uuid *uuid;
727
728 if (len < 4)
729 return ptr;
730
731 list_for_each_entry(uuid, &hdev->uuids, list) {
732 u16 uuid16;
733
734 if (uuid->size != 16)
735 continue;
736
737 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
738 if (uuid16 < 0x1100)
739 continue;
740
741 if (uuid16 == PNP_INFO_SVCLASS_ID)
742 continue;
743
744 if (!uuids_start) {
745 uuids_start = ptr;
746 uuids_start[0] = 1;
747 uuids_start[1] = EIR_UUID16_ALL;
748 ptr += 2;
749 }
750
751 /* Stop if not enough space to put next UUID */
752 if ((ptr - data) + sizeof(u16) > len) {
753 uuids_start[1] = EIR_UUID16_SOME;
754 break;
755 }
756
757 *ptr++ = (uuid16 & 0x00ff);
758 *ptr++ = (uuid16 & 0xff00) >> 8;
759 uuids_start[0] += sizeof(uuid16);
760 }
761
762 return ptr;
763}
764
cdf1963f
JH		 765static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
766{
767 u8 *ptr = data, *uuids_start = NULL;
768 struct bt_uuid *uuid;
769
770 if (len < 6)
771 return ptr;
772
773 list_for_each_entry(uuid, &hdev->uuids, list) {
774 if (uuid->size != 32)
775 continue;
776
777 if (!uuids_start) {
778 uuids_start = ptr;
779 uuids_start[0] = 1;
780 uuids_start[1] = EIR_UUID32_ALL;
781 ptr += 2;
782 }
783
784 /* Stop if not enough space to put next UUID */
785 if ((ptr - data) + sizeof(u32) > len) {
786 uuids_start[1] = EIR_UUID32_SOME;
787 break;
788 }
789
790 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
791 ptr += sizeof(u32);
792 uuids_start[0] += sizeof(u32);
793 }
794
795 return ptr;
796}
797
c00d575b
JH		 798static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
799{
800 u8 *ptr = data, *uuids_start = NULL;
801 struct bt_uuid *uuid;
802
803 if (len < 18)
804 return ptr;
805
806 list_for_each_entry(uuid, &hdev->uuids, list) {
807 if (uuid->size != 128)
808 continue;
809
810 if (!uuids_start) {
811 uuids_start = ptr;
812 uuids_start[0] = 1;
813 uuids_start[1] = EIR_UUID128_ALL;
814 ptr += 2;
815 }
816
817 /* Stop if not enough space to put next UUID */
818 if ((ptr - data) + 16 > len) {
819 uuids_start[1] = EIR_UUID128_SOME;
820 break;
821 }
822
823 memcpy(ptr, uuid->uuid, 16);
824 ptr += 16;
825 uuids_start[0] += 16;
826 }
827
828 return ptr;
829}
830
333ae95d
JH		 831static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
832{
833 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
834}
835
333ae95d
JH		 836static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
837 struct hci_dev *hdev,
838 const void *data)
839{
840 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
841}
842
91aa9bb2
FG		 843static u8 get_current_adv_instance(struct hci_dev *hdev)
844{
845 /* The "Set Advertising" setting supersedes the "Add Advertising"
846 * setting. Here we set the advertising data based on which
847 * setting was set. When neither apply, default to the global settings,
848 * represented by instance "0".
849 */
850 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
851 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
3ff37e6b 852 return hdev->cur_adv_instance;
91aa9bb2
FG		 853
854 return 0x00;
855}
856
4117ed70 857static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
f14d8f64 858{
7a5f4990
MH		 859 u8 ad_len = 0;
860 size_t name_len;
861
862 name_len = strlen(hdev->dev_name);
863 if (name_len > 0) {
864 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
865
866 if (name_len > max_len) {
867 name_len = max_len;
868 ptr[1] = EIR_NAME_SHORT;
869 } else
870 ptr[1] = EIR_NAME_COMPLETE;
871
872 ptr[0] = name_len + 1;
873
874 memcpy(ptr + 2, hdev->dev_name, name_len);
875
876 ad_len += (name_len + 2);
877 ptr += (name_len + 2);
878 }
879
880 return ad_len;
f14d8f64
MH		 881}
882
ca21fbe9
FG		 883static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
884 u8 *ptr)
4117ed70 885{
ca21fbe9
FG		 886 struct adv_info *adv_instance;
887
888 adv_instance = hci_find_adv_instance(hdev, instance);
889 if (!adv_instance)
890 return 0;
891
4117ed70
AU		 892 /* TODO: Set the appropriate entries based on advertising instance flags
893 * here once flags other than 0 are supported.
894 */
ca21fbe9
FG		 895 memcpy(ptr, adv_instance->scan_rsp_data,
896 adv_instance->scan_rsp_len);
4117ed70 897
ca21fbe9 898 return adv_instance->scan_rsp_len;
4117ed70
AU		 899}
900
efae002c 901static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
f14d8f64
MH		 902{
903 struct hci_dev *hdev = req->hdev;
904 struct hci_cp_le_set_scan_rsp_data cp;
905 u8 len;
906
d7a5a11d 907 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 908 return;
909
910 memset(&cp, 0, sizeof(cp));
911
4117ed70 912 if (instance)
ca21fbe9 913 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
4117ed70
AU		 914 else
915 len = create_default_scan_rsp_data(hdev, cp.data);
f14d8f64 916
eb438b5f 917 if (hdev->scan_rsp_data_len == len &&
4117ed70 918 !memcmp(cp.data, hdev->scan_rsp_data, len))
f14d8f64
MH		 919 return;
920
eb438b5f
JH		 921 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
922 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 923
924 cp.length = len;
925
926 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
927}
928
4117ed70
AU		 929static void update_scan_rsp_data(struct hci_request *req)
930{
efae002c 931 update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
4117ed70
AU		 932}
933
9a43e25f
JH		 934static u8 get_adv_discov_flags(struct hci_dev *hdev)
935{
3b0602cd 936 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 937
938 /* If there's a pending mgmt command the flags will not yet have
939 * their final values, so check for this first.
940 */
333ae95d 941 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 942 if (cmd) {
943 struct mgmt_mode *cp = cmd->param;
944 if (cp->val == 0x01)
945 return LE_AD_GENERAL;
946 else if (cp->val == 0x02)
947 return LE_AD_LIMITED;
948 } else {
d7a5a11d 949 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 950 return LE_AD_LIMITED;
d7a5a11d 951 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 952 return LE_AD_GENERAL;
953 }
954
955 return 0;
956}
957
fdf51784
AU		 958static bool get_connectable(struct hci_dev *hdev)
959{
960 struct mgmt_pending_cmd *cmd;
441ad2d0 961
fdf51784
AU		 962 /* If there's a pending mgmt command the flag will not yet have
963 * it's final value, so check for this first.
964 */
965 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
966 if (cmd) {
967 struct mgmt_mode *cp = cmd->param;
441ad2d0 968
fdf51784 969 return cp->val;
441ad2d0
MH		 970 }
971
fdf51784
AU		 972 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
973}
441ad2d0 974
fdf51784
AU		 975static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
976{
977 u32 flags;
411b4121 978 struct adv_info *adv_instance;
441ad2d0 979
bea28e65
FG		 980 if (instance == 0x00) {
981 /* Instance 0 always manages the "Tx Power" and "Flags"
982 * fields
983 */
984 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
411b4121 985
bea28e65
FG		 986 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
987 * corresponds to the "connectable" instance flag.
988 */
989 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
990 flags |= MGMT_ADV_FLAG_CONNECTABLE;
fdf51784 991
bea28e65 992 return flags;
411b4121 993 }
fdf51784 994
bea28e65 995 adv_instance = hci_find_adv_instance(hdev, instance);
fdf51784 996
bea28e65
FG		 997 /* Return 0 when we got an invalid instance identifier. */
998 if (!adv_instance)
999 return 0;
fdf51784 1000
bea28e65 1001 return adv_instance->flags;
441ad2d0
MH		 1002}
1003
7b683b74 1004static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
c7d4883b 1005{
7b683b74
FG		 1006 u8 instance = get_current_adv_instance(hdev);
1007 struct adv_info *adv_instance;
1008
1009 /* Ignore instance 0 */
1010 if (instance == 0x00)
1011 return 0;
1012
1013 adv_instance = hci_find_adv_instance(hdev, instance);
1014 if (!adv_instance)
c7d4883b
AU		 1015 return 0;
1016
1017 /* TODO: Take into account the "appearance" and "local-name" flags here.
1018 * These are currently being ignored as they are not supported.
1019 */
7b683b74 1020 return adv_instance->scan_rsp_len;
c7d4883b
AU		 1021}
1022
fdf51784 1023static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
24b4f38f 1024{
f63ba24b 1025 struct adv_info *adv_instance = NULL;
b44133ff 1026 u8 ad_len = 0, flags = 0;
f63ba24b
FG		 1027 u32 instance_flags;
1028
1029 /* Return 0 when the current instance identifier is invalid. */
1030 if (instance) {
1031 adv_instance = hci_find_adv_instance(hdev, instance);
1032 if (!adv_instance)
1033 return 0;
1034 }
1035
1036 instance_flags = get_adv_instance_flags(hdev, instance);
b44133ff 1037
807ec772
AU		 1038 /* The Add Advertising command allows userspace to set both the general
1039 * and limited discoverable flags.
1040 */
fdf51784 1041 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
b44133ff
AU		 1042 flags |= LE_AD_GENERAL;
1043
fdf51784 1044 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
807ec772
AU		 1045 flags |= LE_AD_LIMITED;
1046
fdf51784 1047 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
67e0c0cd
AU		 1048 /* If a discovery flag wasn't provided, simply use the global
1049 * settings.
1050 */
1051 if (!flags)
1052 flags |= get_adv_discov_flags(hdev);
1053
b44133ff
AU		 1054 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1055 flags |= LE_AD_NO_BREDR;
1056
fdf51784
AU		 1057 /* If flags would still be empty, then there is no need to
1058 * include the "Flags" AD field".
1059 */
1060 if (flags) {
1061 ptr[0] = 0x02;
1062 ptr[1] = EIR_FLAGS;
1063 ptr[2] = flags;
b44133ff 1064
fdf51784
AU		 1065 ad_len += 3;
1066 ptr += 3;
1067 }
b44133ff
AU		 1068 }
1069
f63ba24b
FG		 1070 if (adv_instance) {
1071 memcpy(ptr, adv_instance->adv_data,
1072 adv_instance->adv_data_len);
1073 ad_len += adv_instance->adv_data_len;
1074 ptr += adv_instance->adv_data_len;
38c8af60
MH		 1075 }
1076
fdf51784 1077 /* Provide Tx Power only if we can provide a valid value for it */
5507e358 1078 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
fdf51784 1079 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
5507e358
AU		 1080 ptr[0] = 0x02;
1081 ptr[1] = EIR_TX_POWER;
1082 ptr[2] = (u8)hdev->adv_tx_power;
1083
1084 ad_len += 3;
1085 ptr += 3;
1086 }
1087
b44133ff 1088 return ad_len;
24b4f38f
AU		 1089}
1090
efae002c 1091static void update_inst_adv_data(struct hci_request *req, u8 instance)
441ad2d0
MH		 1092{
1093 struct hci_dev *hdev = req->hdev;
1094 struct hci_cp_le_set_adv_data cp;
1095 u8 len;
1096
d7a5a11d 1097 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 1098 return;
1099
1100 memset(&cp, 0, sizeof(cp));
1101
fdf51784 1102 len = create_instance_adv_data(hdev, instance, cp.data);
441ad2d0 1103
24b4f38f 1104 /* There's nothing to do if the data hasn't changed */
441ad2d0
MH		 1105 if (hdev->adv_data_len == len &&
1106 memcmp(cp.data, hdev->adv_data, len) == 0)
1107 return;
1108
1109 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1110 hdev->adv_data_len = len;
1111
1112 cp.length = len;
1113
1114 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1115}
1116
e7a685d3
AU		 1117static void update_adv_data(struct hci_request *req)
1118{
efae002c 1119 update_inst_adv_data(req, get_current_adv_instance(req->hdev));
24b4f38f
AU		 1120}
1121
bc6d2d04
JH		 1122int mgmt_update_adv_data(struct hci_dev *hdev)
1123{
1124 struct hci_request req;
1125
1126 hci_req_init(&req, hdev);
1127 update_adv_data(&req);
1128
1129 return hci_req_run(&req, NULL);
1130}
1131
ef580372
JH		 1132static void create_eir(struct hci_dev *hdev, u8 *data)
1133{
1134 u8 *ptr = data;
ef580372
JH		 1135 size_t name_len;
1136
1137 name_len = strlen(hdev->dev_name);
1138
1139 if (name_len > 0) {
1140 /* EIR Data type */
1141 if (name_len > 48) {
1142 name_len = 48;
1143 ptr[1] = EIR_NAME_SHORT;
1144 } else
1145 ptr[1] = EIR_NAME_COMPLETE;
1146
1147 /* EIR Data length */
1148 ptr[0] = name_len + 1;
1149
1150 memcpy(ptr + 2, hdev->dev_name, name_len);
1151
ef580372
JH		 1152 ptr += (name_len + 2);
1153 }
1154
bbaf444a 1155 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 1156 ptr[0] = 2;
1157 ptr[1] = EIR_TX_POWER;
1158 ptr[2] = (u8) hdev->inq_tx_power;
1159
91c4e9b1
MH		 1160 ptr += 3;
1161 }
1162
2b9be137
MH		 1163 if (hdev->devid_source > 0) {
1164 ptr[0] = 9;
1165 ptr[1] = EIR_DEVICE_ID;
1166
1167 put_unaligned_le16(hdev->devid_source, ptr + 2);
1168 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1169 put_unaligned_le16(hdev->devid_product, ptr + 6);
1170 put_unaligned_le16(hdev->devid_version, ptr + 8);
1171
2b9be137
MH		 1172 ptr += 10;
1173 }
1174
213202ed 1175 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 1176 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 1177 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 1178}
1179
890ea898 1180static void update_eir(struct hci_request *req)
ef580372 1181{
890ea898 1182 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1183 struct hci_cp_write_eir cp;
1184
504c8dcd 1185 if (!hdev_is_powered(hdev))
890ea898 1186 return;
7770c4aa 1187
976eb20e 1188 if (!lmp_ext_inq_capable(hdev))
890ea898 1189 return;
ef580372 1190
d7a5a11d 1191 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 1192 return;
ef580372 1193
d7a5a11d 1194 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1195 return;
ef580372
JH		 1196
1197 memset(&cp, 0, sizeof(cp));
1198
1199 create_eir(hdev, cp.data);
1200
1201 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1202 return;
ef580372
JH		 1203
1204 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1205
890ea898 1206 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1207}
1208
1209static u8 get_service_classes(struct hci_dev *hdev)
1210{
1211 struct bt_uuid *uuid;
1212 u8 val = 0;
1213
1214 list_for_each_entry(uuid, &hdev->uuids, list)
1215 val |= uuid->svc_hint;
1216
1217 return val;
1218}
1219
890ea898 1220static void update_class(struct hci_request *req)
ef580372 1221{
890ea898 1222 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1223 u8 cod[3];
1224
1225 BT_DBG("%s", hdev->name);
1226
504c8dcd 1227 if (!hdev_is_powered(hdev))
890ea898 1228 return;
7770c4aa 1229
d7a5a11d 1230 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1231 return;
1232
d7a5a11d 1233 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1234 return;
ef580372
JH		 1235
1236 cod[0] = hdev->minor_class;
1237 cod[1] = hdev->major_class;
1238 cod[2] = get_service_classes(hdev);
1239
d7a5a11d 1240 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1241 cod[1] |= 0x20;
1242
ef580372 1243 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1244 return;
ef580372 1245
890ea898 1246 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1247}
1248
0ec5ae84
JH		 1249static void disable_advertising(struct hci_request *req)
1250{
1251 u8 enable = 0x00;
1252
1253 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1254}
1255
199a2fb1
JH		 1256static void enable_advertising(struct hci_request *req)
1257{
1258 struct hci_dev *hdev = req->hdev;
1259 struct hci_cp_le_set_adv_param cp;
8f2a0601 1260 u8 own_addr_type, enable = 0x01;
a4858cb9 1261 bool connectable;
e7a685d3
AU		 1262 u8 instance;
1263 u32 flags;
199a2fb1 1264
0ec5ae84
JH		 1265 if (hci_conn_num(hdev, LE_LINK) > 0)
1266 return;
1267
d7a5a11d 1268 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1269 disable_advertising(req);
1270
5ce194c4 1271 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1272 * hci_update_random_address knows that it's safe to go ahead
1273 * and write a new random address. The flag will be set back on
1274 * as soon as the SET_ADV_ENABLE HCI command completes.
1275 */
a358dc11 1276 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1277
e7a685d3
AU		 1278 instance = get_current_adv_instance(hdev);
1279 flags = get_adv_instance_flags(hdev, instance);
faccb950
AU		 1280
1281 /* If the "connectable" instance flag was not set, then choose between
1282 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1283 */
1284 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1285 get_connectable(hdev);
8f2a0601 1286
a4858cb9
JH		 1287 /* Set require_privacy to true only when non-connectable
1288 * advertising is used. In that case it is fine to use a
1289 * non-resolvable private address.
1290 */
1291 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1292 return;
1293
41c90c18 1294 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1295 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1296 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
c7d4883b
AU		 1297
1298 if (connectable)
1299 cp.type = LE_ADV_IND;
7b683b74 1300 else if (get_cur_adv_instance_scan_rsp_len(hdev))
c7d4883b
AU		 1301 cp.type = LE_ADV_SCAN_IND;
1302 else
1303 cp.type = LE_ADV_NONCONN_IND;
1304
8f2a0601 1305 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1306 cp.channel_map = hdev->le_adv_channel_map;
1307
1308 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1309
1310 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1311}
1312
7d78525d
JH		 1313static void service_cache_off(struct work_struct *work)
1314{
1315 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1316 service_cache.work);
890ea898 1317 struct hci_request req;
7d78525d 1318
a69d8927 1319 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1320 return;
1321
890ea898
JH		 1322 hci_req_init(&req, hdev);
1323
7d78525d
JH		 1324 hci_dev_lock(hdev);
1325
890ea898
JH		 1326 update_eir(&req);
1327 update_class(&req);
7d78525d
JH		 1328
1329 hci_dev_unlock(hdev);
890ea898
JH		 1330
1331 hci_req_run(&req, NULL);
7d78525d
JH		 1332}
1333
d6bfd59c
JH		 1334static void rpa_expired(struct work_struct *work)
1335{
1336 struct hci_dev *hdev = container_of(work, struct hci_dev,
1337 rpa_expired.work);
1338 struct hci_request req;
1339
1340 BT_DBG("");
1341
a1536da2 1342 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1343
d7a5a11d 1344 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1345 return;
1346
1347 /* The generation of a new RPA and programming it into the
1348 * controller happens in the enable_advertising() function.
1349 */
d6bfd59c 1350 hci_req_init(&req, hdev);
d6bfd59c 1351 enable_advertising(&req);
d6bfd59c
JH		 1352 hci_req_run(&req, NULL);
1353}
1354
6a919082 1355static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1356{
238be788 1357 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1358 return;
1359
4f87da80 1360 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1361 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1362
4f87da80
JH		 1363 /* Non-mgmt controlled devices get this bit set
1364 * implicitly so that pairing works for them, however
1365 * for mgmt we require user-space to explicitly enable
1366 * it
1367 */
a358dc11 1368 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1369}
1370
0f4e68cf 1371static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1372 void *data, u16 data_len)
0381101f 1373{
a38528f1 1374 struct mgmt_rp_read_info rp;
f7b64e69 1375
bdb6d971 1376 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1377
09fd0de5 1378 hci_dev_lock(hdev);
f7b64e69 1379
dc4fe30b
JH		 1380 memset(&rp, 0, sizeof(rp));
1381
69ab39ea 1382 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1383
69ab39ea 1384 rp.version = hdev->hci_ver;
eb55ef07 1385 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1386
1387 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1388 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1389
a38528f1 1390 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1391
dc4fe30b 1392 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1393 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1394
09fd0de5 1395 hci_dev_unlock(hdev);
0381101f 1396
2a1afb5a
JH		 1397 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1398 sizeof(rp));
0381101f
JH		 1399}
1400
69ab39ea 1401static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1402{
69ab39ea 1403 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1404
2a1afb5a
JH		 1405 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1406 sizeof(settings));
8680570b
JH		 1407}
1408
1904a853 1409static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1410{
1411 BT_DBG("%s status 0x%02x", hdev->name, status);
1412
a3172b7e
JH		 1413 if (hci_conn_count(hdev) == 0) {
1414 cancel_delayed_work(&hdev->power_off);
8b064a3a 1415 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1416 }
8b064a3a
JH		 1417}
1418
23a48093 1419static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1420{
1421 struct hci_dev *hdev = req->hdev;
1422 struct hci_cp_remote_name_req_cancel cp;
1423 struct inquiry_entry *e;
1424
1425 switch (hdev->discovery.state) {
1426 case DISCOVERY_FINDING:
07d2334a 1427 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1428 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1429
1430 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1431 cancel_delayed_work(&hdev->le_scan_disable);
1432 hci_req_add_le_scan_disable(req);
1433 }
1434
23a48093 1435 return true;
21a60d30
JH		 1436
1437 case DISCOVERY_RESOLVING:
1438 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1439 NAME_PENDING);
1440 if (!e)
23a48093 1441 break;
21a60d30
JH		 1442
1443 bacpy(&cp.bdaddr, &e->data.bdaddr);
1444 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1445 &cp);
1446
23a48093 1447 return true;
21a60d30
JH		 1448
1449 default:
1450 /* Passive scanning */
d7a5a11d 1451 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1452 hci_req_add_le_scan_disable(req);
23a48093
JH		 1453 return true;
1454 }
1455
21a60d30
JH		 1456 break;
1457 }
23a48093
JH		 1458
1459 return false;
21a60d30
JH		 1460}
1461
912098a6
AU		 1462static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1463 u8 instance)
1464{
1465 struct mgmt_ev_advertising_added ev;
1466
1467 ev.instance = instance;
1468
1469 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1470}
1471
1472static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1473 u8 instance)
1474{
1475 struct mgmt_ev_advertising_removed ev;
1476
1477 ev.instance = instance;
1478
1479 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1480}
1481
7816b820
FG		 1482static int schedule_adv_instance(struct hci_request *req, u8 instance,
1483 bool force) {
1484 struct hci_dev *hdev = req->hdev;
1485 struct adv_info *adv_instance = NULL;
1486 u16 timeout;
1487
1488 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1489 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1490 return -EPERM;
1491
1492 if (hdev->adv_instance_timeout)
1493 return -EBUSY;
1494
1495 adv_instance = hci_find_adv_instance(hdev, instance);
1496 if (!adv_instance)
1497 return -ENOENT;
1498
1499 /* A zero timeout means unlimited advertising. As long as there is
1500 * only one instance, duration should be ignored. We still set a timeout
1501 * in case further instances are being added later on.
1502 *
1503 * If the remaining lifetime of the instance is more than the duration
1504 * then the timeout corresponds to the duration, otherwise it will be
1505 * reduced to the remaining instance lifetime.
1506 */
1507 if (adv_instance->timeout == 0 ||
1508 adv_instance->duration <= adv_instance->remaining_time)
1509 timeout = adv_instance->duration;
1510 else
1511 timeout = adv_instance->remaining_time;
1512
1513 /* The remaining time is being reduced unless the instance is being
1514 * advertised without time limit.
1515 */
1516 if (adv_instance->timeout)
1517 adv_instance->remaining_time =
1518 adv_instance->remaining_time - timeout;
1519
1520 hdev->adv_instance_timeout = timeout;
1521 queue_delayed_work(hdev->workqueue,
1522 &hdev->adv_instance_expire,
1523 msecs_to_jiffies(timeout * 1000));
1524
1525 /* If we're just re-scheduling the same instance again then do not
1526 * execute any HCI commands. This happens when a single instance is
1527 * being advertised.
1528 */
1529 if (!force && hdev->cur_adv_instance == instance &&
1530 hci_dev_test_flag(hdev, HCI_LE_ADV))
1531 return 0;
1532
1533 hdev->cur_adv_instance = instance;
1534 update_adv_data(req);
1535 update_scan_rsp_data(req);
1536 enable_advertising(req);
1537
1538 return 0;
1539}
1540
1541static void cancel_adv_timeout(struct hci_dev *hdev)
1542{
1543 if (hdev->adv_instance_timeout) {
1544 hdev->adv_instance_timeout = 0;
1545 cancel_delayed_work(&hdev->adv_instance_expire);
1546 }
1547}
1548
847818d9
FG		 1549/* For a single instance:
1550 * - force == true: The instance will be removed even when its remaining
1551 * lifetime is not zero.
1552 * - force == false: the instance will be deactivated but kept stored unless
1553 * the remaining lifetime is zero.
1554 *
1555 * For instance == 0x00:
1556 * - force == true: All instances will be removed regardless of their timeout
1557 * setting.
1558 * - force == false: Only instances that have a timeout will be removed.
1559 */
1560static void clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1561 u8 instance, bool force)
912098a6 1562{
847818d9
FG		 1563 struct adv_info *adv_instance, *n, *next_instance = NULL;
1564 int err;
1565 u8 rem_inst;
912098a6 1566
847818d9
FG		 1567 /* Cancel any timeout concerning the removed instance(s). */
1568 if (!instance || hdev->cur_adv_instance == instance)
1569 cancel_adv_timeout(hdev);
912098a6 1570
847818d9
FG		 1571 /* Get the next instance to advertise BEFORE we remove
1572 * the current one. This can be the same instance again
1573 * if there is only one instance.
1574 */
1575 if (instance && hdev->cur_adv_instance == instance)
1576 next_instance = hci_get_next_instance(hdev, instance);
912098a6 1577
847818d9
FG		 1578 if (instance == 0x00) {
1579 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1580 list) {
1581 if (!(force || adv_instance->timeout))
1582 continue;
912098a6 1583
847818d9
FG		 1584 rem_inst = adv_instance->instance;
1585 err = hci_remove_adv_instance(hdev, rem_inst);
1586 if (!err)
1587 advertising_removed(NULL, hdev, rem_inst);
1588 }
1589 hdev->cur_adv_instance = 0x00;
1590 } else {
1591 adv_instance = hci_find_adv_instance(hdev, instance);
1592
1593 if (force || (adv_instance && adv_instance->timeout &&
1594 !adv_instance->remaining_time)) {
1595 /* Don't advertise a removed instance. */
1596 if (next_instance &&
1597 next_instance->instance == instance)
1598 next_instance = NULL;
1599
1600 err = hci_remove_adv_instance(hdev, instance);
1601 if (!err)
1602 advertising_removed(NULL, hdev, instance);
1603 }
1604 }
1605
1606 if (list_empty(&hdev->adv_instances)) {
1607 hdev->cur_adv_instance = 0x00;
1608 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1609 }
1610
1611 if (!req || !hdev_is_powered(hdev) ||
912098a6
AU		 1612 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1613 return;
1614
847818d9
FG		 1615 if (next_instance)
1616 schedule_adv_instance(req, next_instance->instance, false);
912098a6
AU		 1617}
1618
8b064a3a
JH		 1619static int clean_up_hci_state(struct hci_dev *hdev)
1620{
1621 struct hci_request req;
1622 struct hci_conn *conn;
23a48093
JH		 1623 bool discov_stopped;
1624 int err;
8b064a3a
JH		 1625
1626 hci_req_init(&req, hdev);
1627
1628 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1629 test_bit(HCI_PSCAN, &hdev->flags)) {
1630 u8 scan = 0x00;
1631 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1632 }
1633
847818d9 1634 clear_adv_instance(hdev, NULL, 0x00, false);
912098a6 1635
d7a5a11d 1636 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1637 disable_advertising(&req);
1638
23a48093 1639 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1640
1641 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1642 struct hci_cp_disconnect dc;
c9910d0f
JH		 1643 struct hci_cp_reject_conn_req rej;
1644
1645 switch (conn->state) {
1646 case BT_CONNECTED:
1647 case BT_CONFIG:
1648 dc.handle = cpu_to_le16(conn->handle);
1649 dc.reason = 0x15; /* Terminated due to Power Off */
1650 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1651 break;
1652 case BT_CONNECT:
1653 if (conn->type == LE_LINK)
1654 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1655 0, NULL);
1656 else if (conn->type == ACL_LINK)
1657 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1658 6, &conn->dst);
1659 break;
1660 case BT_CONNECT2:
1661 bacpy(&rej.bdaddr, &conn->dst);
1662 rej.reason = 0x15; /* Terminated due to Power Off */
1663 if (conn->type == ACL_LINK)
1664 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1665 sizeof(rej), &rej);
1666 else if (conn->type == SCO_LINK)
1667 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1668 sizeof(rej), &rej);
1669 break;
1670 }
8b064a3a
JH		 1671 }
1672
23a48093
JH		 1673 err = hci_req_run(&req, clean_up_hci_complete);
1674 if (!err && discov_stopped)
1675 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1676
1677 return err;
8b064a3a
JH		 1678}
1679
bdb6d971 1680static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1681 u16 len)
eec8d2bc 1682{
650f726d 1683 struct mgmt_mode *cp = data;
3b0602cd 1684 struct mgmt_pending_cmd *cmd;
4b34ee78 1685 int err;
eec8d2bc 1686
bdb6d971 1687 BT_DBG("request for %s", hdev->name);
eec8d2bc 1688
a7e80f25 1689 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1690 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1691 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1692
09fd0de5 1693 hci_dev_lock(hdev);
eec8d2bc 1694
333ae95d 1695 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1696 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1697 MGMT_STATUS_BUSY);
87b95ba6
JH		 1698 goto failed;
1699 }
1700
a69d8927 1701 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1702 cancel_delayed_work(&hdev->power_off);
1703
1704 if (cp->val) {
a1d70450
JH		 1705 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1706 data, len);
1707 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1708 goto failed;
1709 }
1710 }
1711
4b34ee78 1712 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1713 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1714 goto failed;
1715 }
1716
2e58ef3e 1717 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1718 if (!cmd) {
1719 err = -ENOMEM;
eec8d2bc 1720 goto failed;
366a0336 1721 }
eec8d2bc 1722
8b064a3a 1723 if (cp->val) {
19202573 1724 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1725 err = 0;
1726 } else {
1727 /* Disconnect connections, stop scans, etc */
1728 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1729 if (!err)
1730 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1731 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1732
8b064a3a
JH		 1733 /* ENODATA means there were no HCI commands queued */
1734 if (err == -ENODATA) {
a3172b7e 1735 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1736 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1737 err = 0;
1738 }
1739 }
eec8d2bc
JH		 1740
1741failed:
09fd0de5 1742 hci_dev_unlock(hdev);
366a0336 1743 return err;
eec8d2bc
JH		 1744}
1745
beadb2bd
JH		 1746static int new_settings(struct hci_dev *hdev, struct sock *skip)
1747{
f6b7712e 1748 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1749
f6b7712e
MH		 1750 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1751 sizeof(ev), skip);
beadb2bd
JH		 1752}
1753
91a668b0
JH		 1754int mgmt_new_settings(struct hci_dev *hdev)
1755{
1756 return new_settings(hdev, NULL);
1757}
1758
bd99abdd
JH		 1759struct cmd_lookup {
1760 struct sock *sk;
1761 struct hci_dev *hdev;
1762 u8 mgmt_status;
1763};
1764
3b0602cd 1765static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1766{
1767 struct cmd_lookup *match = data;
1768
1769 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1770
1771 list_del(&cmd->list);
1772
1773 if (match->sk == NULL) {
1774 match->sk = cmd->sk;
1775 sock_hold(match->sk);
1776 }
1777
1778 mgmt_pending_free(cmd);
1779}
1780
3b0602cd 1781static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1782{
1783 u8 *status = data;
1784
a69e8375 1785 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1786 mgmt_pending_remove(cmd);
1787}
1788
3b0602cd 1789static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1790{
1791 if (cmd->cmd_complete) {
1792 u8 *status = data;
1793
1794 cmd->cmd_complete(cmd, *status);
1795 mgmt_pending_remove(cmd);
1796
1797 return;
1798 }
1799
1800 cmd_status_rsp(cmd, data);
1801}
1802
3b0602cd 1803static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1804{
2a1afb5a
JH		 1805 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1806 cmd->param, cmd->param_len);
f5818c22
JH		 1807}
1808
3b0602cd 1809static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1810{
2a1afb5a
JH		 1811 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1812 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1813}
1814
e6fe7986
JH		 1815static u8 mgmt_bredr_support(struct hci_dev *hdev)
1816{
1817 if (!lmp_bredr_capable(hdev))
1818 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1819 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1820 return MGMT_STATUS_REJECTED;
1821 else
1822 return MGMT_STATUS_SUCCESS;
1823}
1824
1825static u8 mgmt_le_support(struct hci_dev *hdev)
1826{
1827 if (!lmp_le_capable(hdev))
1828 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1829 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1830 return MGMT_STATUS_REJECTED;
1831 else
1832 return MGMT_STATUS_SUCCESS;
1833}
1834
1904a853
MH		 1835static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1836 u16 opcode)
bfaf8c9f 1837{
3b0602cd 1838 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1839 struct mgmt_mode *cp;
970ba524 1840 struct hci_request req;
bfaf8c9f
JH		 1841 bool changed;
1842
1843 BT_DBG("status 0x%02x", status);
1844
1845 hci_dev_lock(hdev);
1846
333ae95d 1847 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1848 if (!cmd)
1849 goto unlock;
1850
1851 if (status) {
1852 u8 mgmt_err = mgmt_status(status);
a69e8375 1853 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1854 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1855 goto remove_cmd;
1856 }
1857
1858 cp = cmd->param;
d4462a07 1859 if (cp->val) {
238be788 1860 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1861
1862 if (hdev->discov_timeout > 0) {
1863 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1864 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1865 to);
1866 }
1867 } else {
a69d8927 1868 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1869 }
bfaf8c9f
JH		 1870
1871 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1872
1873 if (changed)
1874 new_settings(hdev, cmd->sk);
1875
970ba524
MH		 1876 /* When the discoverable mode gets changed, make sure
1877 * that class of device has the limited discoverable
432df05e
JH		 1878 * bit correctly set. Also update page scan based on whitelist
1879 * entries.
970ba524
MH		 1880 */
1881 hci_req_init(&req, hdev);
1d2dc5b7 1882 __hci_update_page_scan(&req);
970ba524
MH		 1883 update_class(&req);
1884 hci_req_run(&req, NULL);
1885
bfaf8c9f
JH		 1886remove_cmd:
1887 mgmt_pending_remove(cmd);
1888
1889unlock:
1890 hci_dev_unlock(hdev);
1891}
1892
bdb6d971 1893static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1894 u16 len)
73f22f62 1895{
650f726d 1896 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1897 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1898 struct hci_request req;
5e5282bb 1899 u16 timeout;
9a43e25f 1900 u8 scan;
73f22f62
JH		 1901 int err;
1902
bdb6d971 1903 BT_DBG("request for %s", hdev->name);
73f22f62 1904
d7a5a11d
MH		 1905 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1906 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1907 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1908 MGMT_STATUS_REJECTED);
33c525c0 1909
310a3d48 1910 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1911 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1912 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1913
1f350c87 1914 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1915
1916 /* Disabling discoverable requires that no timeout is set,
1917 * and enabling limited discoverable requires a timeout.
1918 */
1919 if ((cp->val == 0x00 && timeout > 0) ||
1920 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1921 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1922 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1923
09fd0de5 1924 hci_dev_lock(hdev);
73f22f62 1925
5e5282bb 1926 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1927 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1928 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1929 goto failed;
1930 }
1931
333ae95d
JH		 1932 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1933 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1934 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1935 MGMT_STATUS_BUSY);
73f22f62
JH		 1936 goto failed;
1937 }
1938
d7a5a11d 1939 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1940 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1941 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1942 goto failed;
1943 }
1944
1945 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1946 bool changed = false;
1947
310a3d48
MH		 1948 /* Setting limited discoverable when powered off is
1949 * not a valid operation since it requires a timeout
1950 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1951 */
d7a5a11d 1952 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1953 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1954 changed = true;
1955 }
1956
5e5282bb 1957 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1958 if (err < 0)
1959 goto failed;
1960
1961 if (changed)
1962 err = new_settings(hdev, sk);
1963
5e5282bb
JH		 1964 goto failed;
1965 }
1966
310a3d48
MH		 1967 /* If the current mode is the same, then just update the timeout
1968 * value with the new value. And if only the timeout gets updated,
1969 * then no need for any HCI transactions.
1970 */
d7a5a11d
MH		 1971 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1972 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1973 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1974 cancel_delayed_work(&hdev->discov_off);
1975 hdev->discov_timeout = timeout;
955638ec 1976
36261547
MH		 1977 if (cp->val && hdev->discov_timeout > 0) {
1978 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1979 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1980 to);
955638ec
MH		 1981 }
1982
69ab39ea 1983 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1984 goto failed;
1985 }
1986
2e58ef3e 1987 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1988 if (!cmd) {
1989 err = -ENOMEM;
73f22f62 1990 goto failed;
366a0336 1991 }
73f22f62 1992
310a3d48
MH		 1993 /* Cancel any potential discoverable timeout that might be
1994 * still active and store new timeout value. The arming of
1995 * the timeout happens in the complete handler.
1996 */
1997 cancel_delayed_work(&hdev->discov_off);
1998 hdev->discov_timeout = timeout;
1999
b456f87c
JH		 2000 /* Limited discoverable mode */
2001 if (cp->val == 0x02)
a1536da2 2002 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 2003 else
a358dc11 2004 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 2005
bfaf8c9f
JH		 2006 hci_req_init(&req, hdev);
2007
9a43e25f
JH		 2008 /* The procedure for LE-only controllers is much simpler - just
2009 * update the advertising data.
2010 */
d7a5a11d 2011 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 2012 goto update_ad;
2013
73f22f62
JH		 2014 scan = SCAN_PAGE;
2015
310a3d48
MH		 2016 if (cp->val) {
2017 struct hci_cp_write_current_iac_lap hci_cp;
2018
2019 if (cp->val == 0x02) {
2020 /* Limited discoverable mode */
33337dcb 2021 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 2022 hci_cp.iac_lap[0] = 0x00; /* LIAC */
2023 hci_cp.iac_lap[1] = 0x8b;
2024 hci_cp.iac_lap[2] = 0x9e;
2025 hci_cp.iac_lap[3] = 0x33; /* GIAC */
2026 hci_cp.iac_lap[4] = 0x8b;
2027 hci_cp.iac_lap[5] = 0x9e;
2028 } else {
2029 /* General discoverable mode */
310a3d48
MH		 2030 hci_cp.num_iac = 1;
2031 hci_cp.iac_lap[0] = 0x33; /* GIAC */
2032 hci_cp.iac_lap[1] = 0x8b;
2033 hci_cp.iac_lap[2] = 0x9e;
2034 }
2035
2036 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
2037 (hci_cp.num_iac * 3) + 1, &hci_cp);
2038
73f22f62 2039 scan |= SCAN_INQUIRY;
310a3d48 2040 } else {
a358dc11 2041 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 2042 }
73f22f62 2043
310a3d48 2044 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 2045
9a43e25f
JH		 2046update_ad:
2047 update_adv_data(&req);
2048
bfaf8c9f 2049 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 2050 if (err < 0)
a664b5bc 2051 mgmt_pending_remove(cmd);
73f22f62
JH		 2052
2053failed:
09fd0de5 2054 hci_dev_unlock(hdev);
73f22f62
JH		 2055 return err;
2056}
2057
406d7804
JH		 2058static void write_fast_connectable(struct hci_request *req, bool enable)
2059{
bd98b996 2060 struct hci_dev *hdev = req->hdev;
406d7804
JH		 2061 struct hci_cp_write_page_scan_activity acp;
2062 u8 type;
2063
d7a5a11d 2064 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 2065 return;
2066
4c01f8b8
JH		 2067 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
2068 return;
2069
406d7804
JH		 2070 if (enable) {
2071 type = PAGE_SCAN_TYPE_INTERLACED;
2072
2073 /* 160 msec page scan interval */
dcf4adbf 2074 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 2075 } else {
2076 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2077
2078 /* default 1.28 sec page scan */
dcf4adbf 2079 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 2080 }
2081
dcf4adbf 2082 acp.window = cpu_to_le16(0x0012);
406d7804 2083
bd98b996
JH		 2084 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
2085 __cpu_to_le16(hdev->page_scan_window) != acp.window)
2086 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2087 sizeof(acp), &acp);
2088
2089 if (hdev->page_scan_type != type)
2090 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 2091}
2092
1904a853
MH		 2093static void set_connectable_complete(struct hci_dev *hdev, u8 status,
2094 u16 opcode)
2b76f453 2095{
3b0602cd 2096 struct mgmt_pending_cmd *cmd;
d7b856f9 2097 struct mgmt_mode *cp;
bc6d2d04 2098 bool conn_changed, discov_changed;
2b76f453
JH		 2099
2100 BT_DBG("status 0x%02x", status);
2101
2102 hci_dev_lock(hdev);
2103
333ae95d 2104 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 2105 if (!cmd)
2106 goto unlock;
2107
37438c1f
JH		 2108 if (status) {
2109 u8 mgmt_err = mgmt_status(status);
a69e8375 2110 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 2111 goto remove_cmd;
2112 }
2113
d7b856f9 2114 cp = cmd->param;
bc6d2d04 2115 if (cp->val) {
238be788
MH		 2116 conn_changed = !hci_dev_test_and_set_flag(hdev,
2117 HCI_CONNECTABLE);
bc6d2d04
JH		 2118 discov_changed = false;
2119 } else {
a69d8927
MH		 2120 conn_changed = hci_dev_test_and_clear_flag(hdev,
2121 HCI_CONNECTABLE);
2122 discov_changed = hci_dev_test_and_clear_flag(hdev,
2123 HCI_DISCOVERABLE);
bc6d2d04 2124 }
d7b856f9 2125
2b76f453
JH		 2126 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
2127
bc6d2d04 2128 if (conn_changed || discov_changed) {
d7b856f9 2129 new_settings(hdev, cmd->sk);
1d2dc5b7 2130 hci_update_page_scan(hdev);
bc6d2d04
JH		 2131 if (discov_changed)
2132 mgmt_update_adv_data(hdev);
2b7be33e
JH		 2133 hci_update_background_scan(hdev);
2134 }
d7b856f9 2135
37438c1f 2136remove_cmd:
2b76f453
JH		 2137 mgmt_pending_remove(cmd);
2138
2139unlock:
2140 hci_dev_unlock(hdev);
2141}
2142
e8ba3a1f
JH		 2143static int set_connectable_update_settings(struct hci_dev *hdev,
2144 struct sock *sk, u8 val)
2145{
2146 bool changed = false;
2147 int err;
2148
d7a5a11d 2149 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 2150 changed = true;
2151
2152 if (val) {
a1536da2 2153 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 2154 } else {
a358dc11
MH		 2155 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2156 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 2157 }
2158
2159 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2160 if (err < 0)
2161 return err;
2162
562064e6 2163 if (changed) {
1d2dc5b7 2164 hci_update_page_scan(hdev);
562064e6 2165 hci_update_background_scan(hdev);
e8ba3a1f 2166 return new_settings(hdev, sk);
562064e6 2167 }
e8ba3a1f
JH		 2168
2169 return 0;
2170}
2171
bdb6d971 2172static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2173 u16 len)
9fbcbb45 2174{
650f726d 2175 struct mgmt_mode *cp = data;
3b0602cd 2176 struct mgmt_pending_cmd *cmd;
2b76f453 2177 struct hci_request req;
1987fdc7 2178 u8 scan;
9fbcbb45
JH		 2179 int err;
2180
bdb6d971 2181 BT_DBG("request for %s", hdev->name);
9fbcbb45 2182
d7a5a11d
MH		 2183 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2184 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2185 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2186 MGMT_STATUS_REJECTED);
33c525c0 2187
a7e80f25 2188 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2189 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2190 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2191
09fd0de5 2192 hci_dev_lock(hdev);
9fbcbb45 2193
4b34ee78 2194 if (!hdev_is_powered(hdev)) {
e8ba3a1f 2195 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 2196 goto failed;
2197 }
2198
333ae95d
JH		 2199 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2200 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 2201 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2202 MGMT_STATUS_BUSY);
9fbcbb45
JH		 2203 goto failed;
2204 }
2205
2e58ef3e 2206 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 2207 if (!cmd) {
2208 err = -ENOMEM;
9fbcbb45 2209 goto failed;
366a0336 2210 }
9fbcbb45 2211
9b74246f 2212 hci_req_init(&req, hdev);
9fbcbb45 2213
9a43e25f
JH		 2214 /* If BR/EDR is not enabled and we disable advertising as a
2215 * by-product of disabling connectable, we need to update the
2216 * advertising flags.
2217 */
d7a5a11d 2218 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 2219 if (!cp->val) {
a358dc11
MH		 2220 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2221 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 2222 }
2223 update_adv_data(&req);
2224 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 2225 if (cp->val) {
2226 scan = SCAN_PAGE;
2227 } else {
3bd27240
JH		 2228 /* If we don't have any whitelist entries just
2229 * disable all scanning. If there are entries
2230 * and we had both page and inquiry scanning
2231 * enabled then fall back to only page scanning.
2232 * Otherwise no changes are needed.
2233 */
2234 if (list_empty(&hdev->whitelist))
2235 scan = SCAN_DISABLED;
2236 else if (test_bit(HCI_ISCAN, &hdev->flags))
2237 scan = SCAN_PAGE;
2238 else
2239 goto no_scan_update;
9b74246f
JH		 2240
2241 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 2242 hdev->discov_timeout > 0)
9b74246f
JH		 2243 cancel_delayed_work(&hdev->discov_off);
2244 }
2b76f453 2245
9b74246f
JH		 2246 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2247 }
2b76f453 2248
3bd27240 2249no_scan_update:
e8b1202c 2250 /* Update the advertising parameters if necessary */
880897d4
AU		 2251 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2252 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1987fdc7 2253 enable_advertising(&req);
1987fdc7 2254
2b76f453 2255 err = hci_req_run(&req, set_connectable_complete);
9b74246f 2256 if (err < 0) {
a664b5bc 2257 mgmt_pending_remove(cmd);
9b74246f 2258 if (err == -ENODATA)
a81070ba
JH		 2259 err = set_connectable_update_settings(hdev, sk,
2260 cp->val);
9b74246f
JH		 2261 goto failed;
2262 }
9fbcbb45
JH		 2263
2264failed:
09fd0de5 2265 hci_dev_unlock(hdev);
9fbcbb45
JH		 2266 return err;
2267}
2268
b2939475 2269static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2270 u16 len)
c542a06c 2271{
650f726d 2272 struct mgmt_mode *cp = data;
55594356 2273 bool changed;
c542a06c
JH		 2274 int err;
2275
bdb6d971 2276 BT_DBG("request for %s", hdev->name);
c542a06c 2277
a7e80f25 2278 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2279 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2280 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2281
09fd0de5 2282 hci_dev_lock(hdev);
c542a06c
JH		 2283
2284 if (cp->val)
238be788 2285 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 2286 else
a69d8927 2287 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 2288
b2939475 2289 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2290 if (err < 0)
55594356 2291 goto unlock;
c542a06c 2292
55594356
MH		 2293 if (changed)
2294 err = new_settings(hdev, sk);
c542a06c 2295
55594356 2296unlock:
09fd0de5 2297 hci_dev_unlock(hdev);
c542a06c
JH		 2298 return err;
2299}
2300
04124681
GP		 2301static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2302 u16 len)
33ef95ed
JH		 2303{
2304 struct mgmt_mode *cp = data;
3b0602cd 2305 struct mgmt_pending_cmd *cmd;
e6fe7986 2306 u8 val, status;
33ef95ed
JH		 2307 int err;
2308
bdb6d971 2309 BT_DBG("request for %s", hdev->name);
33ef95ed 2310
e6fe7986
JH		 2311 status = mgmt_bredr_support(hdev);
2312 if (status)
a69e8375
JH		 2313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2314 status);
33c525c0 2315
a7e80f25 2316 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2317 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2318 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2319
33ef95ed
JH		 2320 hci_dev_lock(hdev);
2321
4b34ee78 2322 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2323 bool changed = false;
2324
d7a5a11d 2325 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 2326 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 2327 changed = true;
2328 }
2329
2330 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2331 if (err < 0)
2332 goto failed;
2333
2334 if (changed)
2335 err = new_settings(hdev, sk);
2336
33ef95ed
JH		 2337 goto failed;
2338 }
2339
333ae95d 2340 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 2341 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2342 MGMT_STATUS_BUSY);
33ef95ed
JH		 2343 goto failed;
2344 }
2345
2346 val = !!cp->val;
2347
2348 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2349 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2350 goto failed;
2351 }
2352
2353 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2354 if (!cmd) {
2355 err = -ENOMEM;
2356 goto failed;
2357 }
2358
2359 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2360 if (err < 0) {
2361 mgmt_pending_remove(cmd);
2362 goto failed;
2363 }
2364
2365failed:
2366 hci_dev_unlock(hdev);
33ef95ed
JH		 2367 return err;
2368}
2369
bdb6d971 2370static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2371{
2372 struct mgmt_mode *cp = data;
3b0602cd 2373 struct mgmt_pending_cmd *cmd;
72ef0c1a 2374 u8 status;
ed2c4ee3
JH		 2375 int err;
2376
bdb6d971 2377 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2378
cdba5281
MH		 2379 status = mgmt_bredr_support(hdev);
2380 if (status)
a69e8375 2381 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2382
13ecd8b6 2383 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2384 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2385 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2386
a7e80f25 2387 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2388 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2389 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2390
13ecd8b6 2391 hci_dev_lock(hdev);
6c8f12c1 2392
4b34ee78 2393 if (!hdev_is_powered(hdev)) {
9ecb3e24 2394 bool changed;
c0ecddc2 2395
9ecb3e24 2396 if (cp->val) {
238be788
MH		 2397 changed = !hci_dev_test_and_set_flag(hdev,
2398 HCI_SSP_ENABLED);
9ecb3e24 2399 } else {
a69d8927
MH		 2400 changed = hci_dev_test_and_clear_flag(hdev,
2401 HCI_SSP_ENABLED);
9ecb3e24 2402 if (!changed)
a69d8927
MH		 2403 changed = hci_dev_test_and_clear_flag(hdev,
2404 HCI_HS_ENABLED);
9ecb3e24 2405 else
a358dc11 2406 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2407 }
2408
2409 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2410 if (err < 0)
2411 goto failed;
2412
2413 if (changed)
2414 err = new_settings(hdev, sk);
2415
ed2c4ee3
JH		 2416 goto failed;
2417 }
2418
333ae95d 2419 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2420 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2421 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2422 goto failed;
2423 }
2424
d7a5a11d 2425 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2426 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2427 goto failed;
2428 }
2429
2430 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2431 if (!cmd) {
2432 err = -ENOMEM;
2433 goto failed;
2434 }
2435
d7a5a11d 2436 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2437 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2438 sizeof(cp->val), &cp->val);
2439
72ef0c1a 2440 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2441 if (err < 0) {
2442 mgmt_pending_remove(cmd);
2443 goto failed;
2444 }
2445
2446failed:
2447 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2448 return err;
2449}
2450
bdb6d971 2451static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2452{
2453 struct mgmt_mode *cp = data;
ee392693 2454 bool changed;
e6fe7986 2455 u8 status;
ee392693 2456 int err;
6d80dfd0 2457
bdb6d971 2458 BT_DBG("request for %s", hdev->name);
6d80dfd0 2459
e6fe7986
JH		 2460 status = mgmt_bredr_support(hdev);
2461 if (status)
a69e8375 2462 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2463
9ecb3e24 2464 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2465 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2466 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2467
d7a5a11d 2468 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2469 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2470 MGMT_STATUS_REJECTED);
9ecb3e24 2471
a7e80f25 2472 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2473 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2474 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2475
ee392693
MH		 2476 hci_dev_lock(hdev);
2477
333ae95d 2478 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2479 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2480 MGMT_STATUS_BUSY);
a2cb01de
JH		 2481 goto unlock;
2482 }
2483
a0cdf960 2484 if (cp->val) {
238be788 2485 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2486 } else {
2487 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2488 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2489 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2490 goto unlock;
2491 }
2492
a69d8927 2493 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2494 }
ee392693
MH		 2495
2496 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2497 if (err < 0)
2498 goto unlock;
2499
2500 if (changed)
2501 err = new_settings(hdev, sk);
6d80dfd0 2502
ee392693
MH		 2503unlock:
2504 hci_dev_unlock(hdev);
2505 return err;
6d80dfd0
JH		 2506}
2507
1904a853 2508static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2509{
2510 struct cmd_lookup match = { NULL, hdev };
2511
3ad67582
JK		 2512 hci_dev_lock(hdev);
2513
416a4ae5
JH		 2514 if (status) {
2515 u8 mgmt_err = mgmt_status(status);
2516
2517 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2518 &mgmt_err);
3ad67582 2519 goto unlock;
416a4ae5
JH		 2520 }
2521
2522 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2523
2524 new_settings(hdev, match.sk);
2525
2526 if (match.sk)
2527 sock_put(match.sk);
441ad2d0
MH		 2528
2529 /* Make sure the controller has a good default for
2530 * advertising data. Restrict the update to when LE
2531 * has actually been enabled. During power on, the
2532 * update in powered_update_hci will take care of it.
2533 */
d7a5a11d 2534 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2535 struct hci_request req;
2536
441ad2d0 2537 hci_req_init(&req, hdev);
5947f4bc 2538 update_adv_data(&req);
f14d8f64 2539 update_scan_rsp_data(&req);
2cf22218 2540 __hci_update_background_scan(&req);
441ad2d0 2541 hci_req_run(&req, NULL);
441ad2d0 2542 }
3ad67582
JK		 2543
2544unlock:
2545 hci_dev_unlock(hdev);
416a4ae5
JH		 2546}
2547
bdb6d971 2548static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2549{
2550 struct mgmt_mode *cp = data;
2551 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2552 struct mgmt_pending_cmd *cmd;
416a4ae5 2553 struct hci_request req;
06199cf8 2554 int err;
0b60eba1 2555 u8 val, enabled;
06199cf8 2556
bdb6d971 2557 BT_DBG("request for %s", hdev->name);
06199cf8 2558
13ecd8b6 2559 if (!lmp_le_capable(hdev))
a69e8375
JH		 2560 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2561 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2562
a7e80f25 2563 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2564 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2565 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2566
e7844ee5
MH		 2567 /* Bluetooth single mode LE only controllers or dual-mode
2568 * controllers configured as LE only devices, do not allow
2569 * switching LE off. These have either LE enabled explicitly
2570 * or BR/EDR has been previously switched off.
2571 *
2572 * When trying to enable an already enabled LE, then gracefully
2573 * send a positive response. Trying to disable it however will
2574 * result into rejection.
2575 */
2576 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2577 if (cp->val == 0x01)
2578 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2579
a69e8375
JH		 2580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2581 MGMT_STATUS_REJECTED);
e7844ee5 2582 }
c73eee91 2583
13ecd8b6 2584 hci_dev_lock(hdev);
06199cf8
JH		 2585
2586 val = !!cp->val;
ffa88e02 2587 enabled = lmp_host_le_capable(hdev);
06199cf8 2588
847818d9
FG		 2589 if (!val)
2590 clear_adv_instance(hdev, NULL, 0x00, true);
2591
0b60eba1 2592 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2593 bool changed = false;
2594
d7a5a11d 2595 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2596 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2597 changed = true;
2598 }
2599
d7a5a11d 2600 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2601 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2602 changed = true;
2603 }
2604
06199cf8
JH		 2605 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2606 if (err < 0)
1de028ce 2607 goto unlock;
06199cf8
JH		 2608
2609 if (changed)
2610 err = new_settings(hdev, sk);
2611
1de028ce 2612 goto unlock;
06199cf8
JH		 2613 }
2614
333ae95d
JH		 2615 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2616 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2618 MGMT_STATUS_BUSY);
1de028ce 2619 goto unlock;
06199cf8
JH		 2620 }
2621
2622 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2623 if (!cmd) {
2624 err = -ENOMEM;
1de028ce 2625 goto unlock;
06199cf8
JH		 2626 }
2627
441ad2d0
MH		 2628 hci_req_init(&req, hdev);
2629
06199cf8
JH		 2630 memset(&hci_cp, 0, sizeof(hci_cp));
2631
2632 if (val) {
2633 hci_cp.le = val;
32226e4f 2634 hci_cp.simul = 0x00;
441ad2d0 2635 } else {
d7a5a11d 2636 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2637 disable_advertising(&req);
06199cf8
JH		 2638 }
2639
416a4ae5
JH		 2640 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2641 &hci_cp);
2642
2643 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2644 if (err < 0)
06199cf8 2645 mgmt_pending_remove(cmd);
06199cf8 2646
1de028ce
JH		 2647unlock:
2648 hci_dev_unlock(hdev);
06199cf8
JH		 2649 return err;
2650}
2651
0cab9c80
JH		 2652/* This is a helper function to test for pending mgmt commands that can
2653 * cause CoD or EIR HCI commands. We can only allow one such pending
2654 * mgmt command at a time since otherwise we cannot easily track what
2655 * the current values are, will be, and based on that calculate if a new
2656 * HCI command needs to be sent and if yes with what value.
2657 */
2658static bool pending_eir_or_class(struct hci_dev *hdev)
2659{
3b0602cd 2660 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2661
2662 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2663 switch (cmd->opcode) {
2664 case MGMT_OP_ADD_UUID:
2665 case MGMT_OP_REMOVE_UUID:
2666 case MGMT_OP_SET_DEV_CLASS:
2667 case MGMT_OP_SET_POWERED:
2668 return true;
2669 }
2670 }
2671
2672 return false;
2673}
2674
83be8eca
JH		 2675static const u8 bluetooth_base_uuid[] = {
2676 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2677 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2678};
2679
2680static u8 get_uuid_size(const u8 *uuid)
2681{
2682 u32 val;
2683
2684 if (memcmp(uuid, bluetooth_base_uuid, 12))
2685 return 128;
2686
2687 val = get_unaligned_le32(&uuid[12]);
2688 if (val > 0xffff)
2689 return 32;
2690
2691 return 16;
2692}
2693
92da6097
JH		 2694static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2695{
3b0602cd 2696 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2697
2698 hci_dev_lock(hdev);
2699
333ae95d 2700 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2701 if (!cmd)
2702 goto unlock;
2703
2a1afb5a
JH		 2704 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2705 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2706
2707 mgmt_pending_remove(cmd);
2708
2709unlock:
2710 hci_dev_unlock(hdev);
2711}
2712
1904a853 2713static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2714{
2715 BT_DBG("status 0x%02x", status);
2716
2717 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2718}
2719
bdb6d971 2720static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2721{
650f726d 2722 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2723 struct mgmt_pending_cmd *cmd;
890ea898 2724 struct hci_request req;
2aeb9a1a 2725 struct bt_uuid *uuid;
2aeb9a1a
JH		 2726 int err;
2727
bdb6d971 2728 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2729
09fd0de5 2730 hci_dev_lock(hdev);
2aeb9a1a 2731
0cab9c80 2732 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2733 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2734 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2735 goto failed;
2736 }
2737
92c4c204 2738 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2739 if (!uuid) {
2740 err = -ENOMEM;
2741 goto failed;
2742 }
2743
2744 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2745 uuid->svc_hint = cp->svc_hint;
83be8eca 2746 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2747
de66aa63 2748 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2749
890ea898 2750 hci_req_init(&req, hdev);
1aff6f09 2751
890ea898
JH		 2752 update_class(&req);
2753 update_eir(&req);
2754
92da6097
JH		 2755 err = hci_req_run(&req, add_uuid_complete);
2756 if (err < 0) {
2757 if (err != -ENODATA)
2758 goto failed;
80a1e1db 2759
2a1afb5a
JH		 2760 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2761 hdev->dev_class, 3);
90e70454
JH		 2762 goto failed;
2763 }
2764
2765 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2766 if (!cmd) {
90e70454 2767 err = -ENOMEM;
890ea898
JH		 2768 goto failed;
2769 }
2770
2771 err = 0;
2aeb9a1a
JH		 2772
2773failed:
09fd0de5 2774 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2775 return err;
2776}
2777
24b78d0f
JH		 2778static bool enable_service_cache(struct hci_dev *hdev)
2779{
2780 if (!hdev_is_powered(hdev))
2781 return false;
2782
238be788 2783 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2784 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2785 CACHE_TIMEOUT);
24b78d0f
JH		 2786 return true;
2787 }
2788
2789 return false;
2790}
2791
1904a853 2792static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2793{
2794 BT_DBG("status 0x%02x", status);
2795
2796 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2797}
2798
bdb6d971 2799static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2800 u16 len)
2aeb9a1a 2801{
650f726d 2802 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2803 struct mgmt_pending_cmd *cmd;
056341c8 2804 struct bt_uuid *match, *tmp;
2aeb9a1a 2805 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2806 struct hci_request req;
2aeb9a1a
JH		 2807 int err, found;
2808
bdb6d971 2809 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2810
09fd0de5 2811 hci_dev_lock(hdev);
2aeb9a1a 2812
0cab9c80 2813 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2814 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2815 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2816 goto unlock;
2817 }
2818
2aeb9a1a 2819 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2820 hci_uuids_clear(hdev);
4004b6d9 2821
24b78d0f 2822 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2823 err = mgmt_cmd_complete(sk, hdev->id,
2824 MGMT_OP_REMOVE_UUID,
2825 0, hdev->dev_class, 3);
24b78d0f
JH		 2826 goto unlock;
2827 }
4004b6d9 2828
9246a869 2829 goto update_class;
2aeb9a1a
JH		 2830 }
2831
2832 found = 0;
2833
056341c8 2834 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2835 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2836 continue;
2837
2838 list_del(&match->list);
482049f7 2839 kfree(match);
2aeb9a1a
JH		 2840 found++;
2841 }
2842
2843 if (found == 0) {
a69e8375
JH		 2844 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2845 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2846 goto unlock;
2847 }
2848
9246a869 2849update_class:
890ea898 2850 hci_req_init(&req, hdev);
1aff6f09 2851
890ea898
JH		 2852 update_class(&req);
2853 update_eir(&req);
2854
92da6097
JH		 2855 err = hci_req_run(&req, remove_uuid_complete);
2856 if (err < 0) {
2857 if (err != -ENODATA)
2858 goto unlock;
80a1e1db 2859
2a1afb5a
JH		 2860 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2861 hdev->dev_class, 3);
90e70454
JH		 2862 goto unlock;
2863 }
2864
2865 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2866 if (!cmd) {
90e70454 2867 err = -ENOMEM;
890ea898
JH		 2868 goto unlock;
2869 }
2870
2871 err = 0;
2aeb9a1a
JH		 2872
2873unlock:
09fd0de5 2874 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2875 return err;
2876}
2877
1904a853 2878static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2879{
2880 BT_DBG("status 0x%02x", status);
2881
2882 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2883}
2884
bdb6d971 2885static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2886 u16 len)
1aff6f09 2887{
650f726d 2888 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2889 struct mgmt_pending_cmd *cmd;
890ea898 2890 struct hci_request req;
1aff6f09
JH		 2891 int err;
2892
bdb6d971 2893 BT_DBG("request for %s", hdev->name);
1aff6f09 2894
6203fc98 2895 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2896 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2897 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2898
0cab9c80 2899 hci_dev_lock(hdev);
ee98f473 2900
0cab9c80 2901 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2902 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2903 MGMT_STATUS_BUSY);
0cab9c80
JH		 2904 goto unlock;
2905 }
c95f0ba7 2906
0cab9c80 2907 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2908 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2909 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2910 goto unlock;
2911 }
575b3a02 2912
932f5ff5
JH		 2913 hdev->major_class = cp->major;
2914 hdev->minor_class = cp->minor;
2915
b5235a65 2916 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2917 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2918 hdev->dev_class, 3);
b5235a65
JH		 2919 goto unlock;
2920 }
2921
890ea898
JH		 2922 hci_req_init(&req, hdev);
2923
a69d8927 2924 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2925 hci_dev_unlock(hdev);
2926 cancel_delayed_work_sync(&hdev->service_cache);
2927 hci_dev_lock(hdev);
890ea898 2928 update_eir(&req);
7d78525d 2929 }
14c0b608 2930
890ea898
JH		 2931 update_class(&req);
2932
92da6097
JH		 2933 err = hci_req_run(&req, set_class_complete);
2934 if (err < 0) {
2935 if (err != -ENODATA)
2936 goto unlock;
1aff6f09 2937
2a1afb5a
JH		 2938 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2939 hdev->dev_class, 3);
90e70454
JH		 2940 goto unlock;
2941 }
2942
2943 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2944 if (!cmd) {
90e70454 2945 err = -ENOMEM;
890ea898
JH		 2946 goto unlock;
2947 }
2948
2949 err = 0;
1aff6f09 2950
b5235a65 2951unlock:
09fd0de5 2952 hci_dev_unlock(hdev);
1aff6f09
JH		 2953 return err;
2954}
2955
bdb6d971 2956static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2957 u16 len)
55ed8ca1 2958{
650f726d 2959 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2960 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2961 sizeof(struct mgmt_link_key_info));
4e51eae9 2962 u16 key_count, expected_len;
b1de97d8 2963 bool changed;
a492cd52 2964 int i;
55ed8ca1 2965
9060d5cf
MH		 2966 BT_DBG("request for %s", hdev->name);
2967
2968 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2970 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2971
1f350c87 2972 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2973 if (key_count > max_key_count) {
2974 BT_ERR("load_link_keys: too big key_count value %u",
2975 key_count);
a69e8375
JH		 2976 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2977 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2978 }
55ed8ca1 2979
86742e1e
JH		 2980 expected_len = sizeof(*cp) + key_count *
2981 sizeof(struct mgmt_link_key_info);
a492cd52 2982 if (expected_len != len) {
86742e1e 2983 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2984 expected_len, len);
a69e8375
JH		 2985 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2986 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2987 }
2988
4ae14301 2989 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2990 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2991 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2992
bdb6d971 2993 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2994 key_count);
55ed8ca1 2995
4ee71b20
JH		 2996 for (i = 0; i < key_count; i++) {
2997 struct mgmt_link_key_info *key = &cp->keys[i];
2998
8e991132 2999 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 3000 return mgmt_cmd_status(sk, hdev->id,
3001 MGMT_OP_LOAD_LINK_KEYS,
3002 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 3003 }
3004
09fd0de5 3005 hci_dev_lock(hdev);
55ed8ca1
JH		 3006
3007 hci_link_keys_clear(hdev);
3008
55ed8ca1 3009 if (cp->debug_keys)
238be788 3010 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 3011 else
a69d8927
MH		 3012 changed = hci_dev_test_and_clear_flag(hdev,
3013 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 3014
3015 if (changed)
3016 new_settings(hdev, NULL);
55ed8ca1 3017
a492cd52 3018 for (i = 0; i < key_count; i++) {
86742e1e 3019 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 3020
58e9293c
JH		 3021 /* Always ignore debug keys and require a new pairing if
3022 * the user wants to use them.
3023 */
3024 if (key->type == HCI_LK_DEBUG_COMBINATION)
3025 continue;
3026
7652ff6a
JH		 3027 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
3028 key->type, key->pin_len, NULL);
55ed8ca1
JH		 3029 }
3030
2a1afb5a 3031 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 3032
09fd0de5 3033 hci_dev_unlock(hdev);
55ed8ca1 3034
a492cd52 3035 return 0;
55ed8ca1
JH		 3036}
3037
b1078ad0 3038static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 3039 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 3040{
3041 struct mgmt_ev_device_unpaired ev;
3042
3043 bacpy(&ev.addr.bdaddr, bdaddr);
3044 ev.addr.type = addr_type;
3045
3046 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 3047 skip_sk);
b1078ad0
JH		 3048}
3049
bdb6d971 3050static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3051 u16 len)
55ed8ca1 3052{
124f6e35
JH		 3053 struct mgmt_cp_unpair_device *cp = data;
3054 struct mgmt_rp_unpair_device rp;
a8a1d19e 3055 struct hci_cp_disconnect dc;
3b0602cd 3056 struct mgmt_pending_cmd *cmd;
55ed8ca1 3057 struct hci_conn *conn;
55ed8ca1
JH		 3058 int err;
3059
a8a1d19e 3060 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 3061 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3062 rp.addr.type = cp->addr.type;
a8a1d19e 3063
4ee71b20 3064 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3065 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3066 MGMT_STATUS_INVALID_PARAMS,
3067 &rp, sizeof(rp));
4ee71b20 3068
118da70b 3069 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 3070 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3071 MGMT_STATUS_INVALID_PARAMS,
3072 &rp, sizeof(rp));
118da70b 3073
4ee71b20
JH		 3074 hci_dev_lock(hdev);
3075
86a8cfc6 3076 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3077 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3078 MGMT_STATUS_NOT_POWERED, &rp,
3079 sizeof(rp));
86a8cfc6
JH		 3080 goto unlock;
3081 }
3082
e0b2b27e 3083 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 3084 /* If disconnection is requested, then look up the
3085 * connection. If the remote device is connected, it
3086 * will be later used to terminate the link.
3087 *
3088 * Setting it to NULL explicitly will cause no
3089 * termination of the link.
3090 */
3091 if (cp->disconnect)
3092 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3093 &cp->addr.bdaddr);
3094 else
3095 conn = NULL;
3096
124f6e35 3097 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e 3098 } else {
85813a7e 3099 u8 addr_type = le_addr_type(cp->addr.type);
a6ad2a6b 3100
9d4c1cc1
JH		 3101 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3102 addr_type);
89cbb063
AA		 3103 if (conn) {
3104 /* Defer clearing up the connection parameters
3105 * until closing to give a chance of keeping
3106 * them if a repairing happens.
3107 */
3108 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3109
3110 /* If disconnection is not requested, then
3111 * clear the connection variable so that the
3112 * link is not terminated.
3113 */
3114 if (!cp->disconnect)
3115 conn = NULL;
a6ad2a6b
JH		 3116 } else {
3117 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type);
89cbb063
AA		 3118 }
3119
a7ec7338
JH		 3120 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
3121
e0b2b27e
JH		 3122 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
3123 }
b0dbfb46 3124
55ed8ca1 3125 if (err < 0) {
2a1afb5a
JH		 3126 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3127 MGMT_STATUS_NOT_PAIRED, &rp,
3128 sizeof(rp));
55ed8ca1
JH		 3129 goto unlock;
3130 }
3131
89cbb063
AA		 3132 /* If the connection variable is set, then termination of the
3133 * link is requested.
3134 */
a8a1d19e 3135 if (!conn) {
2a1afb5a
JH		 3136 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3137 &rp, sizeof(rp));
b1078ad0 3138 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3139 goto unlock;
3140 }
55ed8ca1 3141
124f6e35 3142 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3143 sizeof(*cp));
a8a1d19e
JH		 3144 if (!cmd) {
3145 err = -ENOMEM;
3146 goto unlock;
55ed8ca1
JH		 3147 }
3148
d8b7b1e4
JH		 3149 cmd->cmd_complete = addr_cmd_complete;
3150
eb55ef07 3151 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 3152 dc.reason = 0x13; /* Remote User Terminated Connection */
3153 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3154 if (err < 0)
3155 mgmt_pending_remove(cmd);
3156
55ed8ca1 3157unlock:
09fd0de5 3158 hci_dev_unlock(hdev);
55ed8ca1
JH		 3159 return err;
3160}
3161
bdb6d971 3162static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3163 u16 len)
8962ee74 3164{
650f726d 3165 struct mgmt_cp_disconnect *cp = data;
06a63b19 3166 struct mgmt_rp_disconnect rp;
3b0602cd 3167 struct mgmt_pending_cmd *cmd;
8962ee74 3168 struct hci_conn *conn;
8962ee74
JH		 3169 int err;
3170
3171 BT_DBG("");
3172
06a63b19
JH		 3173 memset(&rp, 0, sizeof(rp));
3174 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3175 rp.addr.type = cp->addr.type;
3176
4ee71b20 3177 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3178 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3179 MGMT_STATUS_INVALID_PARAMS,
3180 &rp, sizeof(rp));
4ee71b20 3181
09fd0de5 3182 hci_dev_lock(hdev);
8962ee74
JH		 3183
3184 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3185 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3186 MGMT_STATUS_NOT_POWERED, &rp,
3187 sizeof(rp));
8962ee74
JH		 3188 goto failed;
3189 }
3190
333ae95d 3191 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3192 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3193 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3194 goto failed;
3195 }
3196
591f47f3 3197 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3198 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3199 &cp->addr.bdaddr);
88c3df13 3200 else
9d4c1cc1
JH		 3201 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr,
3202 le_addr_type(cp->addr.type));
365227e5 3203
f960727e 3204 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3205 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3206 MGMT_STATUS_NOT_CONNECTED, &rp,
3207 sizeof(rp));
8962ee74
JH		 3208 goto failed;
3209 }
3210
2e58ef3e 3211 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3212 if (!cmd) {
3213 err = -ENOMEM;
8962ee74 3214 goto failed;
366a0336 3215 }
8962ee74 3216
f5818c22
JH		 3217 cmd->cmd_complete = generic_cmd_complete;
3218
e3f2f92a 3219 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3220 if (err < 0)
a664b5bc 3221 mgmt_pending_remove(cmd);
8962ee74
JH		 3222
3223failed:
09fd0de5 3224 hci_dev_unlock(hdev);
8962ee74
JH		 3225 return err;
3226}
3227
57c1477c 3228static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3229{
3230 switch (link_type) {
3231 case LE_LINK:
48264f06
JH		 3232 switch (addr_type) {
3233 case ADDR_LE_DEV_PUBLIC:
591f47f3 3234 return BDADDR_LE_PUBLIC;
0ed09148 3235
48264f06 3236 default:
0ed09148 3237 /* Fallback to LE Random address type */
591f47f3 3238 return BDADDR_LE_RANDOM;
48264f06 3239 }
0ed09148 3240
4c659c39 3241 default:
0ed09148 3242 /* Fallback to BR/EDR type */
591f47f3 3243 return BDADDR_BREDR;
4c659c39
JH		 3244 }
3245}
3246
04124681
GP		 3247static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3248 u16 data_len)
2784eb41 3249{
2784eb41 3250 struct mgmt_rp_get_connections *rp;
8035ded4 3251 struct hci_conn *c;
a38528f1 3252 size_t rp_len;
60fc5fb6
JH		 3253 int err;
3254 u16 i;
2784eb41
JH		 3255
3256 BT_DBG("");
3257
09fd0de5 3258 hci_dev_lock(hdev);
2784eb41 3259
5f97c1df 3260 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3261 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3262 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3263 goto unlock;
3264 }
3265
60fc5fb6 3266 i = 0;
b644ba33
JH		 3267 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3268 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3269 i++;
2784eb41
JH		 3270 }
3271
60fc5fb6 3272 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 3273 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 3274 if (!rp) {
2784eb41
JH		 3275 err = -ENOMEM;
3276 goto unlock;
3277 }
3278
2784eb41 3279 i = 0;
4c659c39 3280 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3281 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3282 continue;
4c659c39 3283 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3284 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3285 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3286 continue;
3287 i++;
3288 }
3289
eb55ef07 3290 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3291
4c659c39
JH		 3292 /* Recalculate length in case of filtered SCO connections, etc */
3293 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 3294
2a1afb5a
JH		 3295 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3296 rp_len);
2784eb41 3297
a38528f1 3298 kfree(rp);
5f97c1df
JH		 3299
3300unlock:
09fd0de5 3301 hci_dev_unlock(hdev);
2784eb41
JH		 3302 return err;
3303}
3304
bdb6d971 3305static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3306 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3307{
3b0602cd 3308 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3309 int err;
3310
2e58ef3e 3311 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3312 sizeof(*cp));
96d97a67
WR		 3313 if (!cmd)
3314 return -ENOMEM;
3315
d8457698 3316 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3317 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3318 if (err < 0)
3319 mgmt_pending_remove(cmd);
3320
3321 return err;
3322}
3323
bdb6d971 3324static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3325 u16 len)
980e1a53 3326{
96d97a67 3327 struct hci_conn *conn;
650f726d 3328 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3329 struct hci_cp_pin_code_reply reply;
3b0602cd 3330 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3331 int err;
3332
3333 BT_DBG("");
3334
09fd0de5 3335 hci_dev_lock(hdev);
980e1a53 3336
4b34ee78 3337 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3338 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3339 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3340 goto failed;
3341 }
3342
d8457698 3343 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3344 if (!conn) {
a69e8375
JH		 3345 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3346 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3347 goto failed;
3348 }
3349
3350 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3351 struct mgmt_cp_pin_code_neg_reply ncp;
3352
3353 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3354
3355 BT_ERR("PIN code is not 16 bytes long");
3356
bdb6d971 3357 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3358 if (err >= 0)
a69e8375
JH		 3359 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3360 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3361
3362 goto failed;
3363 }
3364
00abfe44 3365 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3366 if (!cmd) {
3367 err = -ENOMEM;
980e1a53 3368 goto failed;
366a0336 3369 }
980e1a53 3370
7776d1d8
JH		 3371 cmd->cmd_complete = addr_cmd_complete;
3372
d8457698 3373 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3374 reply.pin_len = cp->pin_len;
24718ca5 3375 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3376
3377 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3378 if (err < 0)
a664b5bc 3379 mgmt_pending_remove(cmd);
980e1a53
JH		 3380
3381failed:
09fd0de5 3382 hci_dev_unlock(hdev);
980e1a53
JH		 3383 return err;
3384}
3385
04124681
GP		 3386static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3387 u16 len)
17fa4b9d 3388{
650f726d 3389 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3390
3391 BT_DBG("");
3392
4ec86d4c 3393 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3394 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3395 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3396
09fd0de5 3397 hci_dev_lock(hdev);
17fa4b9d
JH		 3398
3399 hdev->io_capability = cp->io_capability;
3400
3401 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3402 hdev->io_capability);
17fa4b9d 3403
09fd0de5 3404 hci_dev_unlock(hdev);
17fa4b9d 3405
2a1afb5a
JH		 3406 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3407 NULL, 0);
17fa4b9d
JH		 3408}
3409
3b0602cd 3410static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3411{
3412 struct hci_dev *hdev = conn->hdev;
3b0602cd 3413 struct mgmt_pending_cmd *cmd;
e9a416b5 3414
2e58ef3e 3415 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3416 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3417 continue;
3418
e9a416b5
JH		 3419 if (cmd->user_data != conn)
3420 continue;
3421
3422 return cmd;
3423 }
3424
3425 return NULL;
3426}
3427
3b0602cd 3428static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3429{
3430 struct mgmt_rp_pair_device rp;
3431 struct hci_conn *conn = cmd->user_data;
9df74653 3432 int err;
e9a416b5 3433
61b1a7fb
JH		 3434 bacpy(&rp.addr.bdaddr, &conn->dst);
3435 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3436
2a1afb5a
JH		 3437 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3438 status, &rp, sizeof(rp));
e9a416b5
JH		 3439
3440 /* So we don't get further callbacks for this connection */
3441 conn->connect_cfm_cb = NULL;
3442 conn->security_cfm_cb = NULL;
3443 conn->disconn_cfm_cb = NULL;
3444
76a68ba0 3445 hci_conn_drop(conn);
89cbb063
AA		 3446
3447 /* The device is paired so there is no need to remove
3448 * its connection parameters anymore.
3449 */
3450 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3451
3452 hci_conn_put(conn);
9df74653
JH		 3453
3454 return err;
e9a416b5
JH		 3455}
3456
f4a407be
JH		 3457void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3458{
3459 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3460 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3461
3462 cmd = find_pairing(conn);
a511b35b 3463 if (cmd) {
04ab2749 3464 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3465 mgmt_pending_remove(cmd);
3466 }
f4a407be
JH		 3467}
3468
e9a416b5
JH		 3469static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3470{
3b0602cd 3471 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3472
3473 BT_DBG("status %u", status);
3474
3475 cmd = find_pairing(conn);
a511b35b 3476 if (!cmd) {
e9a416b5 3477 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3478 return;
3479 }
3480
3481 cmd->cmd_complete(cmd, mgmt_status(status));
3482 mgmt_pending_remove(cmd);
e9a416b5
JH		 3483}
3484
f4a407be 3485static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3486{
3b0602cd 3487 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3488
3489 BT_DBG("status %u", status);
3490
3491 if (!status)
3492 return;
3493
3494 cmd = find_pairing(conn);
a511b35b 3495 if (!cmd) {
4c47d739 3496 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3497 return;
3498 }
3499
3500 cmd->cmd_complete(cmd, mgmt_status(status));
3501 mgmt_pending_remove(cmd);
4c47d739
VA		 3502}
3503
bdb6d971 3504static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3505 u16 len)
e9a416b5 3506{
650f726d 3507 struct mgmt_cp_pair_device *cp = data;
1425acb7 3508 struct mgmt_rp_pair_device rp;
3b0602cd 3509 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3510 u8 sec_level, auth_type;
3511 struct hci_conn *conn;
e9a416b5
JH		 3512 int err;
3513
3514 BT_DBG("");
3515
f950a30e
SJ		 3516 memset(&rp, 0, sizeof(rp));
3517 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3518 rp.addr.type = cp->addr.type;
3519
4ee71b20 3520 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3521 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3522 MGMT_STATUS_INVALID_PARAMS,
3523 &rp, sizeof(rp));
4ee71b20 3524
4ec86d4c 3525 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3526 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3527 MGMT_STATUS_INVALID_PARAMS,
3528 &rp, sizeof(rp));
4ec86d4c 3529
09fd0de5 3530 hci_dev_lock(hdev);
e9a416b5 3531
5f97c1df 3532 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3533 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3534 MGMT_STATUS_NOT_POWERED, &rp,
3535 sizeof(rp));
5f97c1df
JH		 3536 goto unlock;
3537 }
3538
55e76b38
JH		 3539 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3540 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3541 MGMT_STATUS_ALREADY_PAIRED, &rp,
3542 sizeof(rp));
3543 goto unlock;
3544 }
3545
c908df36 3546 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3547 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3548
6f77d8c7 3549 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3550 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3551 auth_type);
6f77d8c7 3552 } else {
85813a7e 3553 u8 addr_type = le_addr_type(cp->addr.type);
5157b8a5 3554 struct hci_conn_params *p;
6f77d8c7 3555
7c264b10
MH		 3556 /* When pairing a new device, it is expected to remember
3557 * this device for future connections. Adding the connection
3558 * parameter information ahead of time allows tracking
3559 * of the slave preferred values and will speed up any
3560 * further connection establishment.
3561 *
3562 * If connection parameters already exist, then they
3563 * will be kept and this function does nothing.
3564 */
5157b8a5
JP		 3565 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3566
3567 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
3568 p->auto_connect = HCI_AUTO_CONN_DISABLED;
7c264b10 3569
fa142220
JP		 3570 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr,
3571 addr_type, sec_level,
3572 HCI_LE_CONN_TIMEOUT,
3573 HCI_ROLE_MASTER);
6f77d8c7 3574 }
7a512d01 3575
30e76272 3576 if (IS_ERR(conn)) {
489dc48e
AK		 3577 int status;
3578
3579 if (PTR_ERR(conn) == -EBUSY)
3580 status = MGMT_STATUS_BUSY;
faa81030
LR		 3581 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3582 status = MGMT_STATUS_NOT_SUPPORTED;
3583 else if (PTR_ERR(conn) == -ECONNREFUSED)
3584 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3585 else
3586 status = MGMT_STATUS_CONNECT_FAILED;
3587
2a1afb5a
JH		 3588 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3589 status, &rp, sizeof(rp));
e9a416b5
JH		 3590 goto unlock;
3591 }
3592
3593 if (conn->connect_cfm_cb) {
76a68ba0 3594 hci_conn_drop(conn);
2a1afb5a
JH		 3595 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3596 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3597 goto unlock;
3598 }
3599
2e58ef3e 3600 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3601 if (!cmd) {
3602 err = -ENOMEM;
76a68ba0 3603 hci_conn_drop(conn);
e9a416b5
JH		 3604 goto unlock;
3605 }
3606
04ab2749
JH		 3607 cmd->cmd_complete = pairing_complete;
3608
7a512d01 3609 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3610 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3611 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3612 conn->security_cfm_cb = pairing_complete_cb;
3613 conn->disconn_cfm_cb = pairing_complete_cb;
3614 } else {
3615 conn->connect_cfm_cb = le_pairing_complete_cb;
3616 conn->security_cfm_cb = le_pairing_complete_cb;
3617 conn->disconn_cfm_cb = le_pairing_complete_cb;
3618 }
7a512d01 3619
e9a416b5 3620 conn->io_capability = cp->io_cap;
f8aaf9b6 3621 cmd->user_data = hci_conn_get(conn);
e9a416b5 3622
6f78fd4b 3623 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3624 hci_conn_security(conn, sec_level, auth_type, true)) {
3625 cmd->cmd_complete(cmd, 0);
3626 mgmt_pending_remove(cmd);
3627 }
e9a416b5
JH		 3628
3629 err = 0;
3630
3631unlock:
09fd0de5 3632 hci_dev_unlock(hdev);
e9a416b5
JH		 3633 return err;
3634}
3635
04124681
GP		 3636static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3637 u16 len)
28424707 3638{
0f4e68cf 3639 struct mgmt_addr_info *addr = data;
3b0602cd 3640 struct mgmt_pending_cmd *cmd;
28424707
JH		 3641 struct hci_conn *conn;
3642 int err;
3643
3644 BT_DBG("");
3645
28424707
JH		 3646 hci_dev_lock(hdev);
3647
5f97c1df 3648 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3649 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3650 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3651 goto unlock;
3652 }
3653
333ae95d 3654 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3655 if (!cmd) {
a69e8375
JH		 3656 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3657 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3658 goto unlock;
3659 }
3660
3661 conn = cmd->user_data;
3662
3663 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3664 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3665 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3666 goto unlock;
3667 }
3668
a511b35b
JH		 3669 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3670 mgmt_pending_remove(cmd);
28424707 3671
2a1afb5a
JH		 3672 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3673 addr, sizeof(*addr));
28424707
JH		 3674unlock:
3675 hci_dev_unlock(hdev);
28424707
JH		 3676 return err;
3677}
3678
bdb6d971 3679static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3680 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3681 u16 hci_op, __le32 passkey)
a5c29683 3682{
3b0602cd 3683 struct mgmt_pending_cmd *cmd;
0df4c185 3684 struct hci_conn *conn;
a5c29683
JH		 3685 int err;
3686
09fd0de5 3687 hci_dev_lock(hdev);
08ba5382 3688
4b34ee78 3689 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3690 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3691 MGMT_STATUS_NOT_POWERED, addr,
3692 sizeof(*addr));
0df4c185 3693 goto done;
a5c29683
JH		 3694 }
3695
1707c60e
JH		 3696 if (addr->type == BDADDR_BREDR)
3697 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3698 else
9d4c1cc1
JH		 3699 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr,
3700 le_addr_type(addr->type));
272d90df
JH		 3701
3702 if (!conn) {
2a1afb5a
JH		 3703 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3704 MGMT_STATUS_NOT_CONNECTED, addr,
3705 sizeof(*addr));
272d90df
JH		 3706 goto done;
3707 }
47c15e2b 3708
1707c60e 3709 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3710 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3711 if (!err)
2a1afb5a
JH		 3712 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3713 MGMT_STATUS_SUCCESS, addr,
3714 sizeof(*addr));
5fe57d9e 3715 else
2a1afb5a
JH		 3716 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3717 MGMT_STATUS_FAILED, addr,
3718 sizeof(*addr));
47c15e2b 3719
47c15e2b
BG		 3720 goto done;
3721 }
3722
1707c60e 3723 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3724 if (!cmd) {
3725 err = -ENOMEM;
0df4c185 3726 goto done;
a5c29683
JH		 3727 }
3728
7776d1d8
JH		 3729 cmd->cmd_complete = addr_cmd_complete;
3730
0df4c185 3731 /* Continue with pairing via HCI */
604086b7
BG		 3732 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3733 struct hci_cp_user_passkey_reply cp;
3734
1707c60e 3735 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3736 cp.passkey = passkey;
3737 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3738 } else
1707c60e
JH		 3739 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3740 &addr->bdaddr);
604086b7 3741
a664b5bc
JH		 3742 if (err < 0)
3743 mgmt_pending_remove(cmd);
a5c29683 3744
0df4c185 3745done:
09fd0de5 3746 hci_dev_unlock(hdev);
a5c29683
JH		 3747 return err;
3748}
3749
afeb019d
JK		 3750static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3751 void *data, u16 len)
3752{
3753 struct mgmt_cp_pin_code_neg_reply *cp = data;
3754
3755 BT_DBG("");
3756
1707c60e 3757 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3758 MGMT_OP_PIN_CODE_NEG_REPLY,
3759 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3760}
3761
04124681
GP		 3762static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3763 u16 len)
0df4c185 3764{
650f726d 3765 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3766
3767 BT_DBG("");
3768
3769 if (len != sizeof(*cp))
a69e8375
JH		 3770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3771 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3772
1707c60e 3773 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3774 MGMT_OP_USER_CONFIRM_REPLY,
3775 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3776}
3777
bdb6d971 3778static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3779 void *data, u16 len)
0df4c185 3780{
c9c2659f 3781 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3782
3783 BT_DBG("");
3784
1707c60e 3785 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3786 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3787 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3788}
3789
04124681
GP		 3790static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3791 u16 len)
604086b7 3792{
650f726d 3793 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3794
3795 BT_DBG("");
3796
1707c60e 3797 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3798 MGMT_OP_USER_PASSKEY_REPLY,
3799 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3800}
3801
bdb6d971 3802static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3803 void *data, u16 len)
604086b7 3804{
650f726d 3805 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3806
3807 BT_DBG("");
3808
1707c60e 3809 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3810 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3811 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3812}
3813
13928971 3814static void update_name(struct hci_request *req)
2b4bf397 3815{
13928971 3816 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3817 struct hci_cp_write_local_name cp;
3818
13928971 3819 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3820
890ea898 3821 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3822}
3823
1904a853 3824static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3825{
3826 struct mgmt_cp_set_local_name *cp;
3b0602cd 3827 struct mgmt_pending_cmd *cmd;
13928971
JH		 3828
3829 BT_DBG("status 0x%02x", status);
3830
3831 hci_dev_lock(hdev);
3832
333ae95d 3833 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3834 if (!cmd)
3835 goto unlock;
3836
3837 cp = cmd->param;
3838
3839 if (status)
a69e8375
JH		 3840 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3841 mgmt_status(status));
13928971 3842 else
2a1afb5a
JH		 3843 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3844 cp, sizeof(*cp));
13928971
JH		 3845
3846 mgmt_pending_remove(cmd);
3847
3848unlock:
3849 hci_dev_unlock(hdev);
3850}
3851
bdb6d971 3852static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3853 u16 len)
b312b161 3854{
2b4bf397 3855 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3856 struct mgmt_pending_cmd *cmd;
890ea898 3857 struct hci_request req;
b312b161
JH		 3858 int err;
3859
3860 BT_DBG("");
3861
09fd0de5 3862 hci_dev_lock(hdev);
b312b161 3863
b3f2ca94
JH		 3864 /* If the old values are the same as the new ones just return a
3865 * direct command complete event.
3866 */
3867 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3868 !memcmp(hdev->short_name, cp->short_name,
3869 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3870 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3871 data, len);
b3f2ca94
JH		 3872 goto failed;
3873 }
3874
2b4bf397 3875 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3876
b5235a65 3877 if (!hdev_is_powered(hdev)) {
2b4bf397 3878 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3879
2a1afb5a
JH		 3880 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3881 data, len);
28cc7bde
JH		 3882 if (err < 0)
3883 goto failed;
3884
f6b7712e
MH		 3885 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3886 data, len, sk);
28cc7bde 3887
b5235a65
JH		 3888 goto failed;
3889 }
3890
28cc7bde 3891 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3892 if (!cmd) {
3893 err = -ENOMEM;
3894 goto failed;
3895 }
3896
13928971
JH		 3897 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3898
890ea898 3899 hci_req_init(&req, hdev);
3f985050
JH		 3900
3901 if (lmp_bredr_capable(hdev)) {
3902 update_name(&req);
3903 update_eir(&req);
3904 }
3905
7a5f4990
MH		 3906 /* The name is stored in the scan response data and so
3907 * no need to udpate the advertising data here.
3908 */
3f985050 3909 if (lmp_le_capable(hdev))
7a5f4990 3910 update_scan_rsp_data(&req);
3f985050 3911
13928971 3912 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3913 if (err < 0)
3914 mgmt_pending_remove(cmd);
3915
3916failed:
09fd0de5 3917 hci_dev_unlock(hdev);
b312b161
JH		 3918 return err;
3919}
3920
1b9441f8
JH		 3921static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3922 u16 opcode, struct sk_buff *skb)
3923{
3924 struct mgmt_rp_read_local_oob_data mgmt_rp;
3925 size_t rp_size = sizeof(mgmt_rp);
3926 struct mgmt_pending_cmd *cmd;
3927
3928 BT_DBG("%s status %u", hdev->name, status);
3929
3930 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3931 if (!cmd)
3932 return;
3933
3934 if (status || !skb) {
3935 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3936 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3937 goto remove;
3938 }
3939
3940 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3941
3942 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3943 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3944
3945 if (skb->len < sizeof(*rp)) {
3946 mgmt_cmd_status(cmd->sk, hdev->id,
3947 MGMT_OP_READ_LOCAL_OOB_DATA,
3948 MGMT_STATUS_FAILED);
3949 goto remove;
3950 }
3951
3952 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3953 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3954
3955 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3956 } else {
3957 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3958
3959 if (skb->len < sizeof(*rp)) {
3960 mgmt_cmd_status(cmd->sk, hdev->id,
3961 MGMT_OP_READ_LOCAL_OOB_DATA,
3962 MGMT_STATUS_FAILED);
3963 goto remove;
3964 }
3965
3966 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3967 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3968
3969 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3970 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3971 }
3972
3973 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3974 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3975
3976remove:
3977 mgmt_pending_remove(cmd);
3978}
3979
0f4e68cf 3980static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3981 void *data, u16 data_len)
c35938b2 3982{
3b0602cd 3983 struct mgmt_pending_cmd *cmd;
1b9441f8 3984 struct hci_request req;
c35938b2
SJ		 3985 int err;
3986
bdb6d971 3987 BT_DBG("%s", hdev->name);
c35938b2 3988
09fd0de5 3989 hci_dev_lock(hdev);
c35938b2 3990
4b34ee78 3991 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3992 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3993 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3994 goto unlock;
3995 }
3996
9a1a1996 3997 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3998 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3999 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 4000 goto unlock;
4001 }
4002
333ae95d 4003 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 4004 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
4005 MGMT_STATUS_BUSY);
c35938b2
SJ		 4006 goto unlock;
4007 }
4008
2e58ef3e 4009 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 4010 if (!cmd) {
4011 err = -ENOMEM;
4012 goto unlock;
4013 }
4014
1b9441f8
JH		 4015 hci_req_init(&req, hdev);
4016
710f11c0 4017 if (bredr_sc_enabled(hdev))
1b9441f8 4018 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4d2d2796 4019 else
1b9441f8 4020 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4d2d2796 4021
1b9441f8 4022 err = hci_req_run_skb(&req, read_local_oob_data_complete);
c35938b2
SJ		 4023 if (err < 0)
4024 mgmt_pending_remove(cmd);
4025
4026unlock:
09fd0de5 4027 hci_dev_unlock(hdev);
c35938b2
SJ		 4028 return err;
4029}
4030
bdb6d971 4031static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 4032 void *data, u16 len)
2763eda6 4033{
5d57e796 4034 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 4035 int err;
4036
bdb6d971 4037 BT_DBG("%s ", hdev->name);
2763eda6 4038
5d57e796 4039 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 4040 return mgmt_cmd_complete(sk, hdev->id,
4041 MGMT_OP_ADD_REMOTE_OOB_DATA,
4042 MGMT_STATUS_INVALID_PARAMS,
4043 addr, sizeof(*addr));
5d57e796 4044
09fd0de5 4045 hci_dev_lock(hdev);
2763eda6 4046
ec109113
MH		 4047 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
4048 struct mgmt_cp_add_remote_oob_data *cp = data;
4049 u8 status;
bf1e3541 4050
c19a495c 4051 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 4052 err = mgmt_cmd_complete(sk, hdev->id,
4053 MGMT_OP_ADD_REMOTE_OOB_DATA,
4054 MGMT_STATUS_INVALID_PARAMS,
4055 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 4056 goto unlock;
4057 }
4058
ec109113 4059 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 4060 cp->addr.type, cp->hash,
4061 cp->rand, NULL, NULL);
ec109113
MH		 4062 if (err < 0)
4063 status = MGMT_STATUS_FAILED;
4064 else
4065 status = MGMT_STATUS_SUCCESS;
4066
2a1afb5a
JH		 4067 err = mgmt_cmd_complete(sk, hdev->id,
4068 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4069 &cp->addr, sizeof(cp->addr));
ec109113
MH		 4070 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4071 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 4072 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 4073 u8 status;
4074
86df9200 4075 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 4076 /* Enforce zero-valued 192-bit parameters as
4077 * long as legacy SMP OOB isn't implemented.
4078 */
4079 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4080 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 4081 err = mgmt_cmd_complete(sk, hdev->id,
4082 MGMT_OP_ADD_REMOTE_OOB_DATA,
4083 MGMT_STATUS_INVALID_PARAMS,
4084 addr, sizeof(*addr));
d25b78e2
JH		 4085 goto unlock;
4086 }
4087
86df9200
JH		 4088 rand192 = NULL;
4089 hash192 = NULL;
4090 } else {
41bcfd50
MH		 4091 /* In case one of the P-192 values is set to zero,
4092 * then just disable OOB data for P-192.
4093 */
4094 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4095 !memcmp(cp->hash192, ZERO_KEY, 16)) {
4096 rand192 = NULL;
4097 hash192 = NULL;
4098 } else {
4099 rand192 = cp->rand192;
4100 hash192 = cp->hash192;
4101 }
4102 }
4103
4104 /* In case one of the P-256 values is set to zero, then just
4105 * disable OOB data for P-256.
4106 */
4107 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4108 !memcmp(cp->hash256, ZERO_KEY, 16)) {
4109 rand256 = NULL;
4110 hash256 = NULL;
4111 } else {
4112 rand256 = cp->rand256;
4113 hash256 = cp->hash256;
86df9200
JH		 4114 }
4115
81328d5c 4116 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 4117 cp->addr.type, hash192, rand192,
41bcfd50 4118 hash256, rand256);
ec109113
MH		 4119 if (err < 0)
4120 status = MGMT_STATUS_FAILED;
4121 else
4122 status = MGMT_STATUS_SUCCESS;
4123
2a1afb5a
JH		 4124 err = mgmt_cmd_complete(sk, hdev->id,
4125 MGMT_OP_ADD_REMOTE_OOB_DATA,
4126 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 4127 } else {
4128 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 4129 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4130 MGMT_STATUS_INVALID_PARAMS);
ec109113 4131 }
2763eda6 4132
c19a495c 4133unlock:
09fd0de5 4134 hci_dev_unlock(hdev);
2763eda6
SJ		 4135 return err;
4136}
4137
bdb6d971 4138static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 4139 void *data, u16 len)
2763eda6 4140{
650f726d 4141 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 4142 u8 status;
2763eda6
SJ		 4143 int err;
4144
bdb6d971 4145 BT_DBG("%s", hdev->name);
2763eda6 4146
c19a495c 4147 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 4148 return mgmt_cmd_complete(sk, hdev->id,
4149 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4150 MGMT_STATUS_INVALID_PARAMS,
4151 &cp->addr, sizeof(cp->addr));
c19a495c 4152
09fd0de5 4153 hci_dev_lock(hdev);
2763eda6 4154
eedbd581
JH		 4155 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4156 hci_remote_oob_data_clear(hdev);
4157 status = MGMT_STATUS_SUCCESS;
4158 goto done;
4159 }
4160
6928a924 4161 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 4162 if (err < 0)
bf1e3541 4163 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 4164 else
a6785be2 4165 status = MGMT_STATUS_SUCCESS;
bf1e3541 4166
eedbd581 4167done:
2a1afb5a
JH		 4168 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4169 status, &cp->addr, sizeof(cp->addr));
2763eda6 4170
09fd0de5 4171 hci_dev_unlock(hdev);
2763eda6
SJ		 4172 return err;
4173}
4174
812abb13 4175static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 4176{
8019044d 4177 struct hci_dev *hdev = req->hdev;
812abb13 4178 struct hci_cp_inquiry cp;
8019044d
MH		 4179 /* General inquiry access code (GIAC) */
4180 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 4181
4182 *status = mgmt_bredr_support(hdev);
4183 if (*status)
4184 return false;
4185
4186 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4187 *status = MGMT_STATUS_BUSY;
4188 return false;
4189 }
4190
4191 hci_inquiry_cache_flush(hdev);
4192
4193 memset(&cp, 0, sizeof(cp));
4194 memcpy(&cp.lap, lap, sizeof(cp.lap));
4195 cp.length = DISCOV_BREDR_INQUIRY_LEN;
4196
4197 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4198
4199 return true;
4200}
4201
4202static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4203{
4204 struct hci_dev *hdev = req->hdev;
4205 struct hci_cp_le_set_scan_param param_cp;
4206 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 4207 u8 own_addr_type;
41dc2bd6
AG		 4208 int err;
4209
812abb13
JP		 4210 *status = mgmt_le_support(hdev);
4211 if (*status)
4212 return false;
41dc2bd6 4213
812abb13
JP		 4214 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4215 /* Don't let discovery abort an outgoing connection attempt
4216 * that's using directed advertising.
4217 */
e7d9ab73 4218 if (hci_lookup_le_connect(hdev)) {
812abb13 4219 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 4220 return false;
4221 }
41dc2bd6 4222
9d5fc2f2 4223 cancel_adv_timeout(hdev);
812abb13
JP		 4224 disable_advertising(req);
4225 }
41dc2bd6 4226
812abb13
JP		 4227 /* If controller is scanning, it means the background scanning is
4228 * running. Thus, we should temporarily stop it in order to set the
4229 * discovery scanning parameters.
4230 */
4231 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4232 hci_req_add_le_scan_disable(req);
41dc2bd6 4233
812abb13
JP		 4234 /* All active scans will be done with either a resolvable private
4235 * address (when privacy feature has been enabled) or non-resolvable
4236 * private address.
4237 */
4238 err = hci_update_random_address(req, true, &own_addr_type);
4239 if (err < 0) {
4240 *status = MGMT_STATUS_FAILED;
4241 return false;
4242 }
8019044d 4243
812abb13
JP		 4244 memset(&param_cp, 0, sizeof(param_cp));
4245 param_cp.type = LE_SCAN_ACTIVE;
4246 param_cp.interval = cpu_to_le16(interval);
4247 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4248 param_cp.own_address_type = own_addr_type;
8019044d 4249
812abb13
JP		 4250 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4251 &param_cp);
8019044d 4252
812abb13
JP		 4253 memset(&enable_cp, 0, sizeof(enable_cp));
4254 enable_cp.enable = LE_SCAN_ENABLE;
4255 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 4256
812abb13
JP		 4257 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4258 &enable_cp);
4259
4260 return true;
4261}
8019044d 4262
812abb13
JP		 4263static bool trigger_discovery(struct hci_request *req, u8 *status)
4264{
4265 struct hci_dev *hdev = req->hdev;
8019044d 4266
812abb13
JP		 4267 switch (hdev->discovery.type) {
4268 case DISCOV_TYPE_BREDR:
4269 if (!trigger_bredr_inquiry(req, status))
4270 return false;
4271 break;
4272
4273 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4274 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4275 &hdev->quirks)) {
4276 /* During simultaneous discovery, we double LE scan
4277 * interval. We must leave some time for the controller
4278 * to do BR/EDR inquiry.
4279 */
4280 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4281 status))
4282 return false;
4283
4284 if (!trigger_bredr_inquiry(req, status))
4285 return false;
4286
4287 return true;
4288 }
4289
812abb13
JP		 4290 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4291 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 4292 return false;
4293 }
812abb13 4294 /* fall through */
8019044d 4295
812abb13
JP		 4296 case DISCOV_TYPE_LE:
4297 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4298 return false;
8019044d
MH		 4299 break;
4300
4301 default:
4302 *status = MGMT_STATUS_INVALID_PARAMS;
4303 return false;
4304 }
4305
4306 return true;
41dc2bd6
AG		 4307}
4308
1904a853
MH		 4309static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4310 u16 opcode)
7c307720 4311{
3b0602cd 4312 struct mgmt_pending_cmd *cmd;
11e6e25d 4313 unsigned long timeout;
ae55f598 4314
7c307720
AG		 4315 BT_DBG("status %d", status);
4316
11e6e25d 4317 hci_dev_lock(hdev);
41dc2bd6 4318
333ae95d 4319 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 4320 if (!cmd)
333ae95d 4321 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 4322
11e6e25d 4323 if (cmd) {
2922a94f 4324 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 4325 mgmt_pending_remove(cmd);
4326 }
7c307720
AG		 4327
4328 if (status) {
11e6e25d
MH		 4329 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4330 goto unlock;
7c307720
AG		 4331 }
4332
7c307720 4333 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 4334
2d28cfe7
JP		 4335 /* If the scan involves LE scan, pick proper timeout to schedule
4336 * hdev->le_scan_disable that will stop it.
4337 */
7c307720
AG		 4338 switch (hdev->discovery.type) {
4339 case DISCOV_TYPE_LE:
3d5a76f0 4340 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 4341 break;
7c307720 4342 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4343 /* When running simultaneous discovery, the LE scanning time
4344 * should occupy the whole discovery time sine BR/EDR inquiry
4345 * and LE scanning are scheduled by the controller.
4346 *
4347 * For interleaving discovery in comparison, BR/EDR inquiry
4348 * and LE scanning are done sequentially with separate
4349 * timeouts.
4350 */
4351 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4352 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4353 else
4354 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 4355 break;
7c307720 4356 case DISCOV_TYPE_BREDR:
11e6e25d 4357 timeout = 0;
7c307720 4358 break;
7c307720
AG		 4359 default:
4360 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 4361 timeout = 0;
4362 break;
7c307720 4363 }
ae55f598 4364
2d28cfe7
JP		 4365 if (timeout) {
4366 /* When service discovery is used and the controller has
4367 * a strict duplicate filter, it is important to remember
4368 * the start and duration of the scan. This is required
4369 * for restarting scanning during the discovery phase.
4370 */
4371 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4372 &hdev->quirks) &&
82f8b651 4373 hdev->discovery.result_filtering) {
2d28cfe7
JP		 4374 hdev->discovery.scan_start = jiffies;
4375 hdev->discovery.scan_duration = timeout;
4376 }
4377
11e6e25d
MH		 4378 queue_delayed_work(hdev->workqueue,
4379 &hdev->le_scan_disable, timeout);
2d28cfe7 4380 }
ae55f598 4381
11e6e25d
MH		 4382unlock:
4383 hci_dev_unlock(hdev);
7c307720
AG		 4384}
4385
bdb6d971 4386static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 4387 void *data, u16 len)
14a53664 4388{
650f726d 4389 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 4390 struct mgmt_pending_cmd *cmd;
7c307720 4391 struct hci_request req;
8019044d 4392 u8 status;
14a53664
JH		 4393 int err;
4394
bdb6d971 4395 BT_DBG("%s", hdev->name);
14a53664 4396
09fd0de5 4397 hci_dev_lock(hdev);
14a53664 4398
4b34ee78 4399 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4400 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4401 MGMT_STATUS_NOT_POWERED,
4402 &cp->type, sizeof(cp->type));
bd2d1334
JH		 4403 goto failed;
4404 }
4405
f5a969f2 4406 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4407 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4408 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4409 MGMT_STATUS_BUSY, &cp->type,
4410 sizeof(cp->type));
642be6c7
AG		 4411 goto failed;
4412 }
4413
2922a94f 4414 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 4415 if (!cmd) {
4416 err = -ENOMEM;
4417 goto failed;
4418 }
4419
2922a94f
JH		 4420 cmd->cmd_complete = generic_cmd_complete;
4421
22078800
MH		 4422 /* Clear the discovery filter first to free any previously
4423 * allocated memory for the UUID list.
4424 */
4425 hci_discovery_filter_clear(hdev);
4426
4aab14e5 4427 hdev->discovery.type = cp->type;
da25cf6a 4428 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4429
7c307720
AG		 4430 hci_req_init(&req, hdev);
4431
8019044d 4432 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4434 status, &cp->type, sizeof(cp->type));
04106755
JH		 4435 mgmt_pending_remove(cmd);
4436 goto failed;
f39799f5 4437 }
04106755 4438
7c307720 4439 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4440 if (err < 0) {
14a53664 4441 mgmt_pending_remove(cmd);
f5a969f2
MH		 4442 goto failed;
4443 }
7c307720 4444
f5a969f2 4445 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4446
14a53664 4447failed:
09fd0de5 4448 hci_dev_unlock(hdev);
14a53664
JH		 4449 return err;
4450}
f39799f5 4451
3b0602cd
JH		 4452static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4453 u8 status)
2922a94f 4454{
2a1afb5a
JH		 4455 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4456 cmd->param, 1);
2922a94f 4457}
04106755 4458
66ea9427
JP		 4459static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4460 void *data, u16 len)
4461{
4462 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4463 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4464 struct hci_request req;
4465 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4466 u16 uuid_count, expected_len;
4467 u8 status;
4468 int err;
04106755 4469
66ea9427 4470 BT_DBG("%s", hdev->name);
e8bb6b97 4471
66ea9427 4472 hci_dev_lock(hdev);
7c307720 4473
66ea9427 4474 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4475 err = mgmt_cmd_complete(sk, hdev->id,
4476 MGMT_OP_START_SERVICE_DISCOVERY,
4477 MGMT_STATUS_NOT_POWERED,
4478 &cp->type, sizeof(cp->type));
66ea9427
JP		 4479 goto failed;
4480 }
7c307720 4481
66ea9427 4482 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4483 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4484 err = mgmt_cmd_complete(sk, hdev->id,
4485 MGMT_OP_START_SERVICE_DISCOVERY,
4486 MGMT_STATUS_BUSY, &cp->type,
4487 sizeof(cp->type));
66ea9427
JP		 4488 goto failed;
4489 }
d9483943 4490
66ea9427
JP		 4491 uuid_count = __le16_to_cpu(cp->uuid_count);
4492 if (uuid_count > max_uuid_count) {
4493 BT_ERR("service_discovery: too big uuid_count value %u",
4494 uuid_count);
2a1afb5a
JH		 4495 err = mgmt_cmd_complete(sk, hdev->id,
4496 MGMT_OP_START_SERVICE_DISCOVERY,
4497 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4498 sizeof(cp->type));
66ea9427
JP		 4499 goto failed;
4500 }
4501
4502 expected_len = sizeof(*cp) + uuid_count * 16;
4503 if (expected_len != len) {
4504 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4505 expected_len, len);
2a1afb5a
JH		 4506 err = mgmt_cmd_complete(sk, hdev->id,
4507 MGMT_OP_START_SERVICE_DISCOVERY,
4508 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4509 sizeof(cp->type));
66ea9427
JP		 4510 goto failed;
4511 }
4512
4513 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4514 hdev, data, len);
66ea9427
JP		 4515 if (!cmd) {
4516 err = -ENOMEM;
4517 goto failed;
4518 }
4519
2922a94f
JH		 4520 cmd->cmd_complete = service_discovery_cmd_complete;
4521
22078800
MH		 4522 /* Clear the discovery filter first to free any previously
4523 * allocated memory for the UUID list.
4524 */
4525 hci_discovery_filter_clear(hdev);
4526
82f8b651 4527 hdev->discovery.result_filtering = true;
66ea9427
JP		 4528 hdev->discovery.type = cp->type;
4529 hdev->discovery.rssi = cp->rssi;
4530 hdev->discovery.uuid_count = uuid_count;
4531
4532 if (uuid_count > 0) {
4533 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4534 GFP_KERNEL);
4535 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4536 err = mgmt_cmd_complete(sk, hdev->id,
4537 MGMT_OP_START_SERVICE_DISCOVERY,
4538 MGMT_STATUS_FAILED,
4539 &cp->type, sizeof(cp->type));
d9483943
JH		 4540 mgmt_pending_remove(cmd);
4541 goto failed;
4542 }
66ea9427 4543 }
d9483943 4544
66ea9427 4545 hci_req_init(&req, hdev);
5e0452c0 4546
66ea9427 4547 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4548 err = mgmt_cmd_complete(sk, hdev->id,
4549 MGMT_OP_START_SERVICE_DISCOVERY,
4550 status, &cp->type, sizeof(cp->type));
04106755
JH		 4551 mgmt_pending_remove(cmd);
4552 goto failed;
f39799f5 4553 }
3fd24153 4554
7c307720 4555 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4556 if (err < 0) {
14a53664 4557 mgmt_pending_remove(cmd);
66ea9427
JP		 4558 goto failed;
4559 }
4560
4561 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4562
4563failed:
09fd0de5 4564 hci_dev_unlock(hdev);
14a53664
JH		 4565 return err;
4566}
4567
1904a853 4568static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4569{
3b0602cd 4570 struct mgmt_pending_cmd *cmd;
1183fdca 4571
0e05bba6
AG		 4572 BT_DBG("status %d", status);
4573
4574 hci_dev_lock(hdev);
4575
333ae95d 4576 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4577 if (cmd) {
2922a94f 4578 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4579 mgmt_pending_remove(cmd);
0e05bba6
AG		 4580 }
4581
11e6e25d
MH		 4582 if (!status)
4583 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4584
0e05bba6
AG		 4585 hci_dev_unlock(hdev);
4586}
4587
bdb6d971 4588static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4589 u16 len)
14a53664 4590{
d930650b 4591 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4592 struct mgmt_pending_cmd *cmd;
0e05bba6 4593 struct hci_request req;
14a53664
JH		 4594 int err;
4595
bdb6d971 4596 BT_DBG("%s", hdev->name);
14a53664 4597
09fd0de5 4598 hci_dev_lock(hdev);
14a53664 4599
30dc78e1 4600 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4601 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4602 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4603 sizeof(mgmt_cp->type));
d930650b
JH		 4604 goto unlock;
4605 }
4606
4607 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4608 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4609 MGMT_STATUS_INVALID_PARAMS,
4610 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4611 goto unlock;
ff9ef578
JH		 4612 }
4613
2922a94f 4614 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4615 if (!cmd) {
4616 err = -ENOMEM;
30dc78e1
JH		 4617 goto unlock;
4618 }
4619
2922a94f
JH		 4620 cmd->cmd_complete = generic_cmd_complete;
4621
0e05bba6
AG		 4622 hci_req_init(&req, hdev);
4623
21a60d30 4624 hci_stop_discovery(&req);
e0d9727e 4625
21a60d30
JH		 4626 err = hci_req_run(&req, stop_discovery_complete);
4627 if (!err) {
4628 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4629 goto unlock;
14a53664
JH		 4630 }
4631
21a60d30
JH		 4632 mgmt_pending_remove(cmd);
4633
4634 /* If no HCI commands were sent we're done */
4635 if (err == -ENODATA) {
2a1afb5a
JH		 4636 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4637 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4638 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4639 }
14a53664 4640
30dc78e1 4641unlock:
09fd0de5 4642 hci_dev_unlock(hdev);
14a53664
JH		 4643 return err;
4644}
4645
bdb6d971 4646static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4647 u16 len)
561aafbc 4648{
650f726d 4649 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4650 struct inquiry_entry *e;
561aafbc
JH		 4651 int err;
4652
bdb6d971 4653 BT_DBG("%s", hdev->name);
561aafbc 4654
561aafbc
JH		 4655 hci_dev_lock(hdev);
4656
30dc78e1 4657 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4658 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4659 MGMT_STATUS_FAILED, &cp->addr,
4660 sizeof(cp->addr));
30dc78e1
JH		 4661 goto failed;
4662 }
4663
a198e7b1 4664 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4665 if (!e) {
2a1afb5a
JH		 4666 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4667 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4668 sizeof(cp->addr));
561aafbc
JH		 4669 goto failed;
4670 }
4671
4672 if (cp->name_known) {
4673 e->name_state = NAME_KNOWN;
4674 list_del(&e->list);
4675 } else {
4676 e->name_state = NAME_NEEDED;
a3d4e20a 4677 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4678 }
4679
2a1afb5a
JH		 4680 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4681 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4682
4683failed:
4684 hci_dev_unlock(hdev);
561aafbc
JH		 4685 return err;
4686}
4687
bdb6d971 4688static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4689 u16 len)
7fbec224 4690{
650f726d 4691 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4692 u8 status;
7fbec224
AJ		 4693 int err;
4694
bdb6d971 4695 BT_DBG("%s", hdev->name);
7fbec224 4696
4ee71b20 4697 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4698 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4699 MGMT_STATUS_INVALID_PARAMS,
4700 &cp->addr, sizeof(cp->addr));
4ee71b20 4701
09fd0de5 4702 hci_dev_lock(hdev);
5e762444 4703
dcc36c16
JH		 4704 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4705 cp->addr.type);
2a8357f2 4706 if (err < 0) {
f0eeea8b 4707 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4708 goto done;
4709 }
4710
4711 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4712 sk);
4713 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4714
2a8357f2 4715done:
2a1afb5a
JH		 4716 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4717 &cp->addr, sizeof(cp->addr));
5e762444 4718
09fd0de5 4719 hci_dev_unlock(hdev);
7fbec224
AJ		 4720
4721 return err;
4722}
4723
bdb6d971 4724static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4725 u16 len)
7fbec224 4726{
650f726d 4727 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4728 u8 status;
7fbec224
AJ		 4729 int err;
4730
bdb6d971 4731 BT_DBG("%s", hdev->name);
7fbec224 4732
4ee71b20 4733 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4734 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4735 MGMT_STATUS_INVALID_PARAMS,
4736 &cp->addr, sizeof(cp->addr));
4ee71b20 4737
09fd0de5 4738 hci_dev_lock(hdev);
5e762444 4739
dcc36c16
JH		 4740 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4741 cp->addr.type);
2a8357f2 4742 if (err < 0) {
f0eeea8b 4743 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4744 goto done;
4745 }
4746
4747 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4748 sk);
4749 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4750
2a8357f2 4751done:
2a1afb5a
JH		 4752 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4753 &cp->addr, sizeof(cp->addr));
5e762444 4754
09fd0de5 4755 hci_dev_unlock(hdev);
7fbec224
AJ		 4756
4757 return err;
4758}
4759
cdbaccca
MH		 4760static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4761 u16 len)
4762{
4763 struct mgmt_cp_set_device_id *cp = data;
890ea898 4764 struct hci_request req;
cdbaccca 4765 int err;
c72d4b8a 4766 __u16 source;
cdbaccca
MH		 4767
4768 BT_DBG("%s", hdev->name);
4769
c72d4b8a
SJ		 4770 source = __le16_to_cpu(cp->source);
4771
4772 if (source > 0x0002)
a69e8375
JH		 4773 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4774 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4775
cdbaccca
MH		 4776 hci_dev_lock(hdev);
4777
c72d4b8a 4778 hdev->devid_source = source;
cdbaccca
MH		 4779 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4780 hdev->devid_product = __le16_to_cpu(cp->product);
4781 hdev->devid_version = __le16_to_cpu(cp->version);
4782
2a1afb5a
JH		 4783 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4784 NULL, 0);
cdbaccca 4785
890ea898
JH		 4786 hci_req_init(&req, hdev);
4787 update_eir(&req);
4788 hci_req_run(&req, NULL);
cdbaccca
MH		 4789
4790 hci_dev_unlock(hdev);
4791
4792 return err;
4793}
4794
24b4f38f
AU		 4795static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4796 u16 opcode)
4797{
4798 BT_DBG("status %d", status);
4799}
4800
1904a853
MH		 4801static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4802 u16 opcode)
4375f103
JH		 4803{
4804 struct cmd_lookup match = { NULL, hdev };
24b4f38f 4805 struct hci_request req;
7816b820
FG		 4806 u8 instance;
4807 struct adv_info *adv_instance;
4808 int err;
4375f103 4809
3ad67582
JK		 4810 hci_dev_lock(hdev);
4811
4375f103
JH		 4812 if (status) {
4813 u8 mgmt_err = mgmt_status(status);
4814
4815 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4816 cmd_status_rsp, &mgmt_err);
3ad67582 4817 goto unlock;
4375f103
JH		 4818 }
4819
d7a5a11d 4820 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4821 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4822 else
a358dc11 4823 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4824
4375f103
JH		 4825 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4826 &match);
4827
4828 new_settings(hdev, match.sk);
4829
4830 if (match.sk)
4831 sock_put(match.sk);
3ad67582 4832
24b4f38f 4833 /* If "Set Advertising" was just disabled and instance advertising was
7816b820 4834 * set up earlier, then re-enable multi-instance advertising.
24b4f38f
AU		 4835 */
4836 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7816b820
FG		 4837 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) ||
4838 list_empty(&hdev->adv_instances))
24b4f38f
AU		 4839 goto unlock;
4840
7816b820
FG		 4841 instance = hdev->cur_adv_instance;
4842 if (!instance) {
4843 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4844 struct adv_info, list);
4845 if (!adv_instance)
4846 goto unlock;
4847
4848 instance = adv_instance->instance;
4849 }
4850
24b4f38f
AU		 4851 hci_req_init(&req, hdev);
4852
7816b820
FG		 4853 err = schedule_adv_instance(&req, instance, true);
4854
4855 if (!err)
4856 err = hci_req_run(&req, enable_advertising_instance);
24b4f38f 4857
7816b820 4858 if (err)
24b4f38f
AU		 4859 BT_ERR("Failed to re-configure advertising");
4860
3ad67582
JK		 4861unlock:
4862 hci_dev_unlock(hdev);
4375f103
JH		 4863}
4864
21b5187f
MH		 4865static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4866 u16 len)
4375f103
JH		 4867{
4868 struct mgmt_mode *cp = data;
3b0602cd 4869 struct mgmt_pending_cmd *cmd;
4375f103 4870 struct hci_request req;
cc91cb04 4871 u8 val, status;
4375f103
JH		 4872 int err;
4873
4874 BT_DBG("request for %s", hdev->name);
4875
e6fe7986
JH		 4876 status = mgmt_le_support(hdev);
4877 if (status)
a69e8375
JH		 4878 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4879 status);
4375f103 4880
cc91cb04 4881 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4882 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4883 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4884
4885 hci_dev_lock(hdev);
4886
4887 val = !!cp->val;
4375f103 4888
f74ca9b8
JH		 4889 /* The following conditions are ones which mean that we should
4890 * not do any HCI communication but directly send a mgmt
4891 * response to user space (after toggling the flag if
4892 * necessary).
4893 */
cc91cb04 4894 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4895 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4896 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4897 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4898 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4899 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4900 bool changed;
4375f103 4901
cc91cb04 4902 if (cp->val) {
238be788 4903 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4904 if (cp->val == 0x02)
a1536da2 4905 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4906 else
a358dc11 4907 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4908 } else {
a69d8927 4909 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4910 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4911 }
4912
4913 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4914 if (err < 0)
4915 goto unlock;
4916
4917 if (changed)
4918 err = new_settings(hdev, sk);
4919
4920 goto unlock;
4921 }
4922
333ae95d
JH		 4923 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4924 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4925 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4926 MGMT_STATUS_BUSY);
4375f103
JH		 4927 goto unlock;
4928 }
4929
4930 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4931 if (!cmd) {
4932 err = -ENOMEM;
4933 goto unlock;
4934 }
4935
4936 hci_req_init(&req, hdev);
4937
cc91cb04 4938 if (cp->val == 0x02)
a1536da2 4939 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4940 else
a358dc11 4941 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4942
7816b820
FG		 4943 cancel_adv_timeout(hdev);
4944
24b4f38f 4945 if (val) {
7816b820
FG		 4946 /* Switch to instance "0" for the Set Advertising setting.
4947 * We cannot use update_[adv|scan_rsp]_data() here as the
4948 * HCI_ADVERTISING flag is not yet set.
4949 */
efae002c
FG		 4950 update_inst_adv_data(&req, 0x00);
4951 update_inst_scan_rsp_data(&req, 0x00);
bba3aa55 4952 enable_advertising(&req);
24b4f38f 4953 } else {
bba3aa55 4954 disable_advertising(&req);
24b4f38f 4955 }
4375f103
JH		 4956
4957 err = hci_req_run(&req, set_advertising_complete);
4958 if (err < 0)
4959 mgmt_pending_remove(cmd);
4960
4961unlock:
4962 hci_dev_unlock(hdev);
4963 return err;
4964}
4965
d13eafce
MH		 4966static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4967 void *data, u16 len)
4968{
4969 struct mgmt_cp_set_static_address *cp = data;
4970 int err;
4971
4972 BT_DBG("%s", hdev->name);
4973
62af4443 4974 if (!lmp_le_capable(hdev))
a69e8375
JH		 4975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4976 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4977
4978 if (hdev_is_powered(hdev))
a69e8375
JH		 4979 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4980 MGMT_STATUS_REJECTED);
d13eafce
MH		 4981
4982 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4983 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4984 return mgmt_cmd_status(sk, hdev->id,
4985 MGMT_OP_SET_STATIC_ADDRESS,
4986 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4987
4988 /* Two most significant bits shall be set */
4989 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4990 return mgmt_cmd_status(sk, hdev->id,
4991 MGMT_OP_SET_STATIC_ADDRESS,
4992 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4993 }
4994
4995 hci_dev_lock(hdev);
4996
4997 bacpy(&hdev->static_addr, &cp->bdaddr);
4998
93690c22
MH		 4999 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
5000 if (err < 0)
5001 goto unlock;
5002
5003 err = new_settings(hdev, sk);
d13eafce 5004
93690c22 5005unlock:
d13eafce 5006 hci_dev_unlock(hdev);
d13eafce
MH		 5007 return err;
5008}
5009
14b49b9a
MH		 5010static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
5011 void *data, u16 len)
5012{
5013 struct mgmt_cp_set_scan_params *cp = data;
5014 __u16 interval, window;
5015 int err;
5016
5017 BT_DBG("%s", hdev->name);
5018
5019 if (!lmp_le_capable(hdev))
a69e8375
JH		 5020 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5021 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 5022
5023 interval = __le16_to_cpu(cp->interval);
5024
5025 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 5026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5027 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 5028
5029 window = __le16_to_cpu(cp->window);
5030
5031 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 5032 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5033 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 5034
899e1075 5035 if (window > interval)
a69e8375
JH		 5036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
5037 MGMT_STATUS_INVALID_PARAMS);
899e1075 5038
14b49b9a
MH		 5039 hci_dev_lock(hdev);
5040
5041 hdev->le_scan_interval = interval;
5042 hdev->le_scan_window = window;
5043
2a1afb5a
JH		 5044 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
5045 NULL, 0);
14b49b9a 5046
dd2ef8e2
AG		 5047 /* If background scan is running, restart it so new parameters are
5048 * loaded.
5049 */
d7a5a11d 5050 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 5051 hdev->discovery.state == DISCOVERY_STOPPED) {
5052 struct hci_request req;
5053
5054 hci_req_init(&req, hdev);
5055
5056 hci_req_add_le_scan_disable(&req);
5057 hci_req_add_le_passive_scan(&req);
5058
5059 hci_req_run(&req, NULL);
5060 }
5061
14b49b9a
MH		 5062 hci_dev_unlock(hdev);
5063
5064 return err;
5065}
5066
1904a853
MH		 5067static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5068 u16 opcode)
33e38b3e 5069{
3b0602cd 5070 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 5071
5072 BT_DBG("status 0x%02x", status);
5073
5074 hci_dev_lock(hdev);
5075
333ae95d 5076 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 5077 if (!cmd)
5078 goto unlock;
5079
5080 if (status) {
a69e8375
JH		 5081 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5082 mgmt_status(status));
33e38b3e 5083 } else {
1a4d3c4b
JH		 5084 struct mgmt_mode *cp = cmd->param;
5085
5086 if (cp->val)
a1536da2 5087 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5088 else
a358dc11 5089 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5090
33e38b3e
JH		 5091 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5092 new_settings(hdev, cmd->sk);
5093 }
5094
5095 mgmt_pending_remove(cmd);
5096
5097unlock:
5098 hci_dev_unlock(hdev);
5099}
5100
bdb6d971 5101static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 5102 void *data, u16 len)
f6422ec6 5103{
650f726d 5104 struct mgmt_mode *cp = data;
3b0602cd 5105 struct mgmt_pending_cmd *cmd;
33e38b3e 5106 struct hci_request req;
f6422ec6
AJ		 5107 int err;
5108
bdb6d971 5109 BT_DBG("%s", hdev->name);
f6422ec6 5110
d7a5a11d 5111 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 5112 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 5113 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5114 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 5115
a7e80f25 5116 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5117 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5118 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 5119
f6422ec6
AJ		 5120 hci_dev_lock(hdev);
5121
333ae95d 5122 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 5123 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5124 MGMT_STATUS_BUSY);
05cbf29f
JH		 5125 goto unlock;
5126 }
5127
d7a5a11d 5128 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 5129 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5130 hdev);
5131 goto unlock;
5132 }
5133
406ef2a6 5134 if (!hdev_is_powered(hdev)) {
ce05d603 5135 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 5136 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5137 hdev);
5138 new_settings(hdev, sk);
5139 goto unlock;
5140 }
5141
33e38b3e
JH		 5142 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5143 data, len);
5144 if (!cmd) {
5145 err = -ENOMEM;
5146 goto unlock;
f6422ec6
AJ		 5147 }
5148
33e38b3e
JH		 5149 hci_req_init(&req, hdev);
5150
406d7804 5151 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 5152
5153 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 5154 if (err < 0) {
a69e8375
JH		 5155 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5156 MGMT_STATUS_FAILED);
33e38b3e 5157 mgmt_pending_remove(cmd);
f6422ec6
AJ		 5158 }
5159
33e38b3e 5160unlock:
f6422ec6 5161 hci_dev_unlock(hdev);
33e38b3e 5162
f6422ec6
AJ		 5163 return err;
5164}
5165
1904a853 5166static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 5167{
3b0602cd 5168 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5169
5170 BT_DBG("status 0x%02x", status);
5171
5172 hci_dev_lock(hdev);
5173
333ae95d 5174 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 5175 if (!cmd)
5176 goto unlock;
5177
5178 if (status) {
5179 u8 mgmt_err = mgmt_status(status);
5180
5181 /* We need to restore the flag if related HCI commands
5182 * failed.
5183 */
a358dc11 5184 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 5185
a69e8375 5186 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 5187 } else {
5188 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5189 new_settings(hdev, cmd->sk);
5190 }
5191
5192 mgmt_pending_remove(cmd);
5193
5194unlock:
5195 hci_dev_unlock(hdev);
5196}
5197
5198static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5199{
5200 struct mgmt_mode *cp = data;
3b0602cd 5201 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5202 struct hci_request req;
5203 int err;
5204
5205 BT_DBG("request for %s", hdev->name);
5206
5207 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 5208 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5209 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 5210
d7a5a11d 5211 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5212 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5213 MGMT_STATUS_REJECTED);
0663ca2a
JH		 5214
5215 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5216 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5217 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 5218
5219 hci_dev_lock(hdev);
5220
d7a5a11d 5221 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 5222 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5223 goto unlock;
5224 }
5225
5226 if (!hdev_is_powered(hdev)) {
5227 if (!cp->val) {
a358dc11
MH		 5228 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5229 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5230 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5231 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5232 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 5233 }
5234
ce05d603 5235 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5236
5237 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5238 if (err < 0)
5239 goto unlock;
5240
5241 err = new_settings(hdev, sk);
5242 goto unlock;
5243 }
5244
5245 /* Reject disabling when powered on */
5246 if (!cp->val) {
a69e8375
JH		 5247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5248 MGMT_STATUS_REJECTED);
0663ca2a 5249 goto unlock;
111e4bcc
MH		 5250 } else {
5251 /* When configuring a dual-mode controller to operate
5252 * with LE only and using a static address, then switching
5253 * BR/EDR back on is not allowed.
5254 *
5255 * Dual-mode controllers shall operate with the public
5256 * address as its identity address for BR/EDR and LE. So
5257 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 5258 *
5259 * The same restrictions applies when secure connections
5260 * has been enabled. For BR/EDR this is a controller feature
5261 * while for LE it is a host stack feature. This means that
5262 * switching BR/EDR back on when secure connections has been
5263 * enabled is not a supported transaction.
111e4bcc 5264 */
d7a5a11d 5265 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 5266 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 5267 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 5268 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5269 MGMT_STATUS_REJECTED);
111e4bcc
MH		 5270 goto unlock;
5271 }
0663ca2a
JH		 5272 }
5273
333ae95d 5274 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 5275 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5276 MGMT_STATUS_BUSY);
0663ca2a
JH		 5277 goto unlock;
5278 }
5279
5280 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5281 if (!cmd) {
5282 err = -ENOMEM;
5283 goto unlock;
5284 }
5285
5947f4bc 5286 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 5287 * generates the correct flags.
5288 */
a1536da2 5289 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5290
5291 hci_req_init(&req, hdev);
aa8af46e 5292
432df05e 5293 write_fast_connectable(&req, false);
1d2dc5b7 5294 __hci_update_page_scan(&req);
aa8af46e 5295
f14d8f64
MH		 5296 /* Since only the advertising data flags will change, there
5297 * is no need to update the scan response data.
5298 */
5947f4bc 5299 update_adv_data(&req);
aa8af46e 5300
0663ca2a
JH		 5301 err = hci_req_run(&req, set_bredr_complete);
5302 if (err < 0)
5303 mgmt_pending_remove(cmd);
5304
5305unlock:
5306 hci_dev_unlock(hdev);
5307 return err;
5308}
5309
a1443f5a
JH		 5310static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5311{
3b0602cd 5312 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 5313 struct mgmt_mode *cp;
5314
5315 BT_DBG("%s status %u", hdev->name, status);
5316
5317 hci_dev_lock(hdev);
5318
333ae95d 5319 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 5320 if (!cmd)
5321 goto unlock;
5322
5323 if (status) {
a69e8375
JH		 5324 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5325 mgmt_status(status));
a1443f5a
JH		 5326 goto remove;
5327 }
5328
5329 cp = cmd->param;
5330
5331 switch (cp->val) {
5332 case 0x00:
a358dc11
MH		 5333 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5334 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5335 break;
5336 case 0x01:
a1536da2 5337 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 5338 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5339 break;
5340 case 0x02:
a1536da2
MH		 5341 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5342 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5343 break;
5344 }
5345
5346 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5347 new_settings(hdev, cmd->sk);
5348
5349remove:
5350 mgmt_pending_remove(cmd);
5351unlock:
5352 hci_dev_unlock(hdev);
5353}
5354
eac83dc6
MH		 5355static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5356 void *data, u16 len)
5357{
5358 struct mgmt_mode *cp = data;
3b0602cd 5359 struct mgmt_pending_cmd *cmd;
a1443f5a 5360 struct hci_request req;
a3209694 5361 u8 val;
eac83dc6
MH		 5362 int err;
5363
5364 BT_DBG("request for %s", hdev->name);
5365
05b3c3e7 5366 if (!lmp_sc_capable(hdev) &&
d7a5a11d 5367 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5368 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5369 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 5370
d7a5a11d 5371 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 5372 lmp_sc_capable(hdev) &&
d7a5a11d 5373 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 5374 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5375 MGMT_STATUS_REJECTED);
ed93ec69 5376
0ab04a9c 5377 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 5378 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 5379 MGMT_STATUS_INVALID_PARAMS);
5380
5381 hci_dev_lock(hdev);
5382
05b3c3e7 5383 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 5384 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 5385 bool changed;
5386
0ab04a9c 5387 if (cp->val) {
238be788
MH		 5388 changed = !hci_dev_test_and_set_flag(hdev,
5389 HCI_SC_ENABLED);
0ab04a9c 5390 if (cp->val == 0x02)
a1536da2 5391 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5392 else
a358dc11 5393 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5394 } else {
a69d8927
MH		 5395 changed = hci_dev_test_and_clear_flag(hdev,
5396 HCI_SC_ENABLED);
a358dc11 5397 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5398 }
eac83dc6
MH		 5399
5400 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5401 if (err < 0)
5402 goto failed;
5403
5404 if (changed)
5405 err = new_settings(hdev, sk);
5406
5407 goto failed;
5408 }
5409
333ae95d 5410 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 5411 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5412 MGMT_STATUS_BUSY);
eac83dc6
MH		 5413 goto failed;
5414 }
5415
0ab04a9c
MH		 5416 val = !!cp->val;
5417
d7a5a11d
MH		 5418 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5419 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 5420 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5421 goto failed;
5422 }
5423
5424 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5425 if (!cmd) {
5426 err = -ENOMEM;
5427 goto failed;
5428 }
5429
a1443f5a
JH		 5430 hci_req_init(&req, hdev);
5431 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5432 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 5433 if (err < 0) {
5434 mgmt_pending_remove(cmd);
5435 goto failed;
5436 }
5437
5438failed:
5439 hci_dev_unlock(hdev);
5440 return err;
5441}
5442
4e39ac81
MH		 5443static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5444 void *data, u16 len)
5445{
5446 struct mgmt_mode *cp = data;
b9710979 5447 bool changed, use_changed;
4e39ac81
MH		 5448 int err;
5449
5450 BT_DBG("request for %s", hdev->name);
5451
b9710979 5452 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 5453 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5454 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 5455
5456 hci_dev_lock(hdev);
5457
5458 if (cp->val)
238be788 5459 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 5460 else
a69d8927
MH		 5461 changed = hci_dev_test_and_clear_flag(hdev,
5462 HCI_KEEP_DEBUG_KEYS);
4e39ac81 5463
b9710979 5464 if (cp->val == 0x02)
238be788
MH		 5465 use_changed = !hci_dev_test_and_set_flag(hdev,
5466 HCI_USE_DEBUG_KEYS);
b9710979 5467 else
a69d8927
MH		 5468 use_changed = hci_dev_test_and_clear_flag(hdev,
5469 HCI_USE_DEBUG_KEYS);
b9710979
JH		 5470
5471 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 5472 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 5473 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5474 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5475 sizeof(mode), &mode);
5476 }
5477
4e39ac81
MH		 5478 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5479 if (err < 0)
5480 goto unlock;
5481
5482 if (changed)
5483 err = new_settings(hdev, sk);
5484
5485unlock:
5486 hci_dev_unlock(hdev);
5487 return err;
5488}
5489
62b04cd1
JH		 5490static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5491 u16 len)
5492{
5493 struct mgmt_cp_set_privacy *cp = cp_data;
5494 bool changed;
5495 int err;
5496
5497 BT_DBG("request for %s", hdev->name);
5498
5499 if (!lmp_le_capable(hdev))
a69e8375
JH		 5500 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5501 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5502
5503 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5504 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5505 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5506
5507 if (hdev_is_powered(hdev))
a69e8375
JH		 5508 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5509 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5510
5511 hci_dev_lock(hdev);
5512
c21c0ea0
JH		 5513 /* If user space supports this command it is also expected to
5514 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5515 */
a1536da2 5516 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5517
62b04cd1 5518 if (cp->privacy) {
238be788 5519 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5520 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5521 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5522 } else {
a69d8927 5523 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5524 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5525 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5526 }
5527
5528 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5529 if (err < 0)
5530 goto unlock;
5531
5532 if (changed)
5533 err = new_settings(hdev, sk);
5534
5535unlock:
5536 hci_dev_unlock(hdev);
5537 return err;
5538}
5539
41edf160
JH		 5540static bool irk_is_valid(struct mgmt_irk_info *irk)
5541{
5542 switch (irk->addr.type) {
5543 case BDADDR_LE_PUBLIC:
5544 return true;
5545
5546 case BDADDR_LE_RANDOM:
5547 /* Two most significant bits shall be set */
5548 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5549 return false;
5550 return true;
5551 }
5552
5553 return false;
5554}
5555
5556static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5557 u16 len)
5558{
5559 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5560 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5561 sizeof(struct mgmt_irk_info));
41edf160
JH		 5562 u16 irk_count, expected_len;
5563 int i, err;
5564
5565 BT_DBG("request for %s", hdev->name);
5566
5567 if (!lmp_le_capable(hdev))
a69e8375
JH		 5568 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5569 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5570
5571 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5572 if (irk_count > max_irk_count) {
5573 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5574 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5575 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5576 }
41edf160
JH		 5577
5578 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5579 if (expected_len != len) {
5580 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5581 expected_len, len);
a69e8375
JH		 5582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5583 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5584 }
5585
5586 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5587
5588 for (i = 0; i < irk_count; i++) {
5589 struct mgmt_irk_info *key = &cp->irks[i];
5590
5591 if (!irk_is_valid(key))
a69e8375
JH		 5592 return mgmt_cmd_status(sk, hdev->id,
5593 MGMT_OP_LOAD_IRKS,
5594 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5595 }
5596
5597 hci_dev_lock(hdev);
5598
5599 hci_smp_irks_clear(hdev);
5600
5601 for (i = 0; i < irk_count; i++) {
5602 struct mgmt_irk_info *irk = &cp->irks[i];
41edf160 5603
85813a7e
JH		 5604 hci_add_irk(hdev, &irk->addr.bdaddr,
5605 le_addr_type(irk->addr.type), irk->val,
41edf160
JH		 5606 BDADDR_ANY);
5607 }
5608
a1536da2 5609 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5610
2a1afb5a 5611 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5612
5613 hci_dev_unlock(hdev);
5614
5615 return err;
5616}
5617
3f706b72
JH		 5618static bool ltk_is_valid(struct mgmt_ltk_info *key)
5619{
5620 if (key->master != 0x00 && key->master != 0x01)
5621 return false;
490cb0b3
MH		 5622
5623 switch (key->addr.type) {
5624 case BDADDR_LE_PUBLIC:
5625 return true;
5626
5627 case BDADDR_LE_RANDOM:
5628 /* Two most significant bits shall be set */
5629 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5630 return false;
5631 return true;
5632 }
5633
5634 return false;
3f706b72
JH		 5635}
5636
bdb6d971 5637static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5638 void *cp_data, u16 len)
346af67b 5639{
346af67b 5640 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5641 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5642 sizeof(struct mgmt_ltk_info));
346af67b 5643 u16 key_count, expected_len;
715a5bf2 5644 int i, err;
346af67b 5645
cf99ba13
MH		 5646 BT_DBG("request for %s", hdev->name);
5647
5648 if (!lmp_le_capable(hdev))
a69e8375
JH		 5649 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5650 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5651
1f350c87 5652 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5653 if (key_count > max_key_count) {
5654 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5655 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5656 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5657 }
346af67b
VCG		 5658
5659 expected_len = sizeof(*cp) + key_count *
5660 sizeof(struct mgmt_ltk_info);
5661 if (expected_len != len) {
5662 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5663 expected_len, len);
a69e8375
JH		 5664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5665 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5666 }
5667
bdb6d971 5668 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5669
54ad6d8a
JH		 5670 for (i = 0; i < key_count; i++) {
5671 struct mgmt_ltk_info *key = &cp->keys[i];
5672
3f706b72 5673 if (!ltk_is_valid(key))
a69e8375
JH		 5674 return mgmt_cmd_status(sk, hdev->id,
5675 MGMT_OP_LOAD_LONG_TERM_KEYS,
5676 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5677 }
5678
346af67b
VCG		 5679 hci_dev_lock(hdev);
5680
5681 hci_smp_ltks_clear(hdev);
5682
5683 for (i = 0; i < key_count; i++) {
5684 struct mgmt_ltk_info *key = &cp->keys[i];
85813a7e 5685 u8 type, authenticated;
346af67b 5686
61b43357
JH		 5687 switch (key->type) {
5688 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5689 authenticated = 0x00;
23fb8de3 5690 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5691 break;
5692 case MGMT_LTK_AUTHENTICATED:
d7b25450 5693 authenticated = 0x01;
23fb8de3
JH		 5694 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5695 break;
5696 case MGMT_LTK_P256_UNAUTH:
5697 authenticated = 0x00;
5698 type = SMP_LTK_P256;
61b43357 5699 break;
23fb8de3
JH		 5700 case MGMT_LTK_P256_AUTH:
5701 authenticated = 0x01;
5702 type = SMP_LTK_P256;
61b43357 5703 break;
23fb8de3
JH		 5704 case MGMT_LTK_P256_DEBUG:
5705 authenticated = 0x00;
5706 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5707 default:
5708 continue;
5709 }
d7b25450 5710
85813a7e
JH		 5711 hci_add_ltk(hdev, &key->addr.bdaddr,
5712 le_addr_type(key->addr.type), type, authenticated,
5713 key->val, key->enc_size, key->ediv, key->rand);
346af67b
VCG		 5714 }
5715
2a1afb5a 5716 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5717 NULL, 0);
5718
346af67b 5719 hci_dev_unlock(hdev);
346af67b 5720
715a5bf2 5721 return err;
346af67b
VCG		 5722}
5723
3b0602cd 5724static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5725{
dd983808 5726 struct hci_conn *conn = cmd->user_data;
9981bdb0 5727 struct mgmt_rp_get_conn_info rp;
9df74653 5728 int err;
dd983808 5729
9981bdb0 5730 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5731
9981bdb0 5732 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5733 rp.rssi = conn->rssi;
9981bdb0
JH		 5734 rp.tx_power = conn->tx_power;
5735 rp.max_tx_power = conn->max_tx_power;
5736 } else {
5737 rp.rssi = HCI_RSSI_INVALID;
5738 rp.tx_power = HCI_TX_POWER_INVALID;
5739 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5740 }
5741
2a1afb5a
JH		 5742 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5743 status, &rp, sizeof(rp));
dd983808
AK		 5744
5745 hci_conn_drop(conn);
f8aaf9b6 5746 hci_conn_put(conn);
9df74653
JH		 5747
5748 return err;
dd983808
AK		 5749}
5750
1904a853
MH		 5751static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5752 u16 opcode)
dd983808
AK		 5753{
5754 struct hci_cp_read_rssi *cp;
3b0602cd 5755 struct mgmt_pending_cmd *cmd;
dd983808 5756 struct hci_conn *conn;
dd983808 5757 u16 handle;
9981bdb0 5758 u8 status;
dd983808 5759
9981bdb0 5760 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5761
5762 hci_dev_lock(hdev);
5763
dd983808
AK		 5764 /* Commands sent in request are either Read RSSI or Read Transmit Power
5765 * Level so we check which one was last sent to retrieve connection
5766 * handle. Both commands have handle as first parameter so it's safe to
5767 * cast data on the same command struct.
5768 *
5769 * First command sent is always Read RSSI and we fail only if it fails.
5770 * In other case we simply override error to indicate success as we
5771 * already remembered if TX power value is actually valid.
5772 */
5773 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5774 if (!cp) {
5775 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5776 status = MGMT_STATUS_SUCCESS;
5777 } else {
5778 status = mgmt_status(hci_status);
dd983808
AK		 5779 }
5780
5781 if (!cp) {
9981bdb0 5782 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5783 goto unlock;
5784 }
5785
5786 handle = __le16_to_cpu(cp->handle);
5787 conn = hci_conn_hash_lookup_handle(hdev, handle);
5788 if (!conn) {
9981bdb0 5789 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5790 goto unlock;
5791 }
5792
333ae95d 5793 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5794 if (!cmd)
5795 goto unlock;
dd983808 5796
9981bdb0
JH		 5797 cmd->cmd_complete(cmd, status);
5798 mgmt_pending_remove(cmd);
dd983808
AK		 5799
5800unlock:
5801 hci_dev_unlock(hdev);
5802}
5803
5804static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5805 u16 len)
5806{
5807 struct mgmt_cp_get_conn_info *cp = data;
5808 struct mgmt_rp_get_conn_info rp;
5809 struct hci_conn *conn;
5810 unsigned long conn_info_age;
5811 int err = 0;
5812
5813 BT_DBG("%s", hdev->name);
5814
5815 memset(&rp, 0, sizeof(rp));
5816 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5817 rp.addr.type = cp->addr.type;
5818
5819 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5820 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5821 MGMT_STATUS_INVALID_PARAMS,
5822 &rp, sizeof(rp));
dd983808
AK		 5823
5824 hci_dev_lock(hdev);
5825
5826 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5827 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5828 MGMT_STATUS_NOT_POWERED, &rp,
5829 sizeof(rp));
dd983808
AK		 5830 goto unlock;
5831 }
5832
5833 if (cp->addr.type == BDADDR_BREDR)
5834 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5835 &cp->addr.bdaddr);
5836 else
5837 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5838
5839 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5840 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5841 MGMT_STATUS_NOT_CONNECTED, &rp,
5842 sizeof(rp));
dd983808
AK		 5843 goto unlock;
5844 }
5845
333ae95d 5846 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5847 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5848 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5849 goto unlock;
5850 }
5851
dd983808
AK		 5852 /* To avoid client trying to guess when to poll again for information we
5853 * calculate conn info age as random value between min/max set in hdev.
5854 */
5855 conn_info_age = hdev->conn_info_min_age +
5856 prandom_u32_max(hdev->conn_info_max_age -
5857 hdev->conn_info_min_age);
5858
5859 /* Query controller to refresh cached values if they are too old or were
5860 * never read.
5861 */
f4e2dd53
AK		 5862 if (time_after(jiffies, conn->conn_info_timestamp +
5863 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5864 !conn->conn_info_timestamp) {
5865 struct hci_request req;
5866 struct hci_cp_read_tx_power req_txp_cp;
5867 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5868 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5869
5870 hci_req_init(&req, hdev);
5871 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5872 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5873 &req_rssi_cp);
5874
f7faab0c
AK		 5875 /* For LE links TX power does not change thus we don't need to
5876 * query for it once value is known.
5877 */
5878 if (!bdaddr_type_is_le(cp->addr.type) ||
5879 conn->tx_power == HCI_TX_POWER_INVALID) {
5880 req_txp_cp.handle = cpu_to_le16(conn->handle);
5881 req_txp_cp.type = 0x00;
5882 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5883 sizeof(req_txp_cp), &req_txp_cp);
5884 }
dd983808 5885
eed5daf3
AK		 5886 /* Max TX power needs to be read only once per connection */
5887 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5888 req_txp_cp.handle = cpu_to_le16(conn->handle);
5889 req_txp_cp.type = 0x01;
5890 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5891 sizeof(req_txp_cp), &req_txp_cp);
5892 }
5893
dd983808
AK		 5894 err = hci_req_run(&req, conn_info_refresh_complete);
5895 if (err < 0)
5896 goto unlock;
5897
5898 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5899 data, len);
5900 if (!cmd) {
5901 err = -ENOMEM;
5902 goto unlock;
5903 }
5904
5905 hci_conn_hold(conn);
f8aaf9b6 5906 cmd->user_data = hci_conn_get(conn);
9981bdb0 5907 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5908
5909 conn->conn_info_timestamp = jiffies;
5910 } else {
5911 /* Cache is valid, just reply with values cached in hci_conn */
5912 rp.rssi = conn->rssi;
5913 rp.tx_power = conn->tx_power;
eed5daf3 5914 rp.max_tx_power = conn->max_tx_power;
dd983808 5915
2a1afb5a
JH		 5916 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5917 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5918 }
5919
5920unlock:
5921 hci_dev_unlock(hdev);
5922 return err;
5923}
5924
3b0602cd 5925static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5926{
69487371 5927 struct hci_conn *conn = cmd->user_data;
95868426 5928 struct mgmt_rp_get_clock_info rp;
69487371 5929 struct hci_dev *hdev;
9df74653 5930 int err;
69487371
JH		 5931
5932 memset(&rp, 0, sizeof(rp));
5933 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5934
5935 if (status)
5936 goto complete;
5937
5938 hdev = hci_dev_get(cmd->index);
5939 if (hdev) {
5940 rp.local_clock = cpu_to_le32(hdev->clock);
5941 hci_dev_put(hdev);
5942 }
5943
5944 if (conn) {
5945 rp.piconet_clock = cpu_to_le32(conn->clock);
5946 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5947 }
5948
5949complete:
2a1afb5a
JH		 5950 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5951 sizeof(rp));
69487371
JH		 5952
5953 if (conn) {
5954 hci_conn_drop(conn);
5955 hci_conn_put(conn);
5956 }
9df74653
JH		 5957
5958 return err;
69487371
JH		 5959}
5960
1904a853 5961static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5962{
95868426 5963 struct hci_cp_read_clock *hci_cp;
3b0602cd 5964 struct mgmt_pending_cmd *cmd;
95868426
JH		 5965 struct hci_conn *conn;
5966
5967 BT_DBG("%s status %u", hdev->name, status);
5968
5969 hci_dev_lock(hdev);
5970
5971 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5972 if (!hci_cp)
5973 goto unlock;
5974
5975 if (hci_cp->which) {
5976 u16 handle = __le16_to_cpu(hci_cp->handle);
5977 conn = hci_conn_hash_lookup_handle(hdev, handle);
5978 } else {
5979 conn = NULL;
5980 }
5981
333ae95d 5982 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5983 if (!cmd)
5984 goto unlock;
5985
69487371 5986 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5987 mgmt_pending_remove(cmd);
95868426
JH		 5988
5989unlock:
5990 hci_dev_unlock(hdev);
5991}
5992
5993static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5994 u16 len)
5995{
5996 struct mgmt_cp_get_clock_info *cp = data;
5997 struct mgmt_rp_get_clock_info rp;
5998 struct hci_cp_read_clock hci_cp;
3b0602cd 5999 struct mgmt_pending_cmd *cmd;
95868426
JH		 6000 struct hci_request req;
6001 struct hci_conn *conn;
6002 int err;
6003
6004 BT_DBG("%s", hdev->name);
6005
6006 memset(&rp, 0, sizeof(rp));
6007 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
6008 rp.addr.type = cp->addr.type;
6009
6010 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 6011 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6012 MGMT_STATUS_INVALID_PARAMS,
6013 &rp, sizeof(rp));
95868426
JH		 6014
6015 hci_dev_lock(hdev);
6016
6017 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 6018 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
6019 MGMT_STATUS_NOT_POWERED, &rp,
6020 sizeof(rp));
95868426
JH		 6021 goto unlock;
6022 }
6023
6024 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
6025 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
6026 &cp->addr.bdaddr);
6027 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 6028 err = mgmt_cmd_complete(sk, hdev->id,
6029 MGMT_OP_GET_CLOCK_INFO,
6030 MGMT_STATUS_NOT_CONNECTED,
6031 &rp, sizeof(rp));
95868426
JH		 6032 goto unlock;
6033 }
6034 } else {
6035 conn = NULL;
6036 }
6037
6038 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
6039 if (!cmd) {
6040 err = -ENOMEM;
6041 goto unlock;
6042 }
6043
69487371
JH		 6044 cmd->cmd_complete = clock_info_cmd_complete;
6045
95868426
JH		 6046 hci_req_init(&req, hdev);
6047
6048 memset(&hci_cp, 0, sizeof(hci_cp));
6049 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6050
6051 if (conn) {
6052 hci_conn_hold(conn);
f8aaf9b6 6053 cmd->user_data = hci_conn_get(conn);
95868426
JH		 6054
6055 hci_cp.handle = cpu_to_le16(conn->handle);
6056 hci_cp.which = 0x01; /* Piconet clock */
6057 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6058 }
6059
6060 err = hci_req_run(&req, get_clock_info_complete);
6061 if (err < 0)
6062 mgmt_pending_remove(cmd);
6063
6064unlock:
6065 hci_dev_unlock(hdev);
6066 return err;
6067}
6068
5a154e6f
JH		 6069static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6070{
6071 struct hci_conn *conn;
6072
6073 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6074 if (!conn)
6075 return false;
6076
6077 if (conn->dst_type != type)
6078 return false;
6079
6080 if (conn->state != BT_CONNECTED)
6081 return false;
6082
6083 return true;
6084}
6085
6086/* This function requires the caller holds hdev->lock */
6087static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
6088 u8 addr_type, u8 auto_connect)
6089{
6090 struct hci_dev *hdev = req->hdev;
6091 struct hci_conn_params *params;
6092
6093 params = hci_conn_params_add(hdev, addr, addr_type);
6094 if (!params)
6095 return -EIO;
6096
6097 if (params->auto_connect == auto_connect)
6098 return 0;
6099
6100 list_del_init(&params->action);
6101
6102 switch (auto_connect) {
6103 case HCI_AUTO_CONN_DISABLED:
6104 case HCI_AUTO_CONN_LINK_LOSS:
28a667c9
JP		 6105 /* If auto connect is being disabled when we're trying to
6106 * connect to device, keep connecting.
6107 */
6108 if (params->explicit_connect)
6109 list_add(&params->action, &hdev->pend_le_conns);
6110
5a154e6f
JH		 6111 __hci_update_background_scan(req);
6112 break;
6113 case HCI_AUTO_CONN_REPORT:
49c50922
JH		 6114 if (params->explicit_connect)
6115 list_add(&params->action, &hdev->pend_le_conns);
6116 else
6117 list_add(&params->action, &hdev->pend_le_reports);
5a154e6f
JH		 6118 __hci_update_background_scan(req);
6119 break;
6120 case HCI_AUTO_CONN_DIRECT:
6121 case HCI_AUTO_CONN_ALWAYS:
6122 if (!is_connected(hdev, addr, addr_type)) {
6123 list_add(&params->action, &hdev->pend_le_conns);
168b8a25
JP		 6124 /* If we are in scan phase of connecting, we were
6125 * already added to pend_le_conns and scanning.
6126 */
6127 if (params->auto_connect != HCI_AUTO_CONN_EXPLICIT)
6128 __hci_update_background_scan(req);
5a154e6f
JH		 6129 }
6130 break;
6131 }
6132
6133 params->auto_connect = auto_connect;
6134
6135 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
6136 auto_connect);
6137
6138 return 0;
6139}
6140
8afef092
MH		 6141static void device_added(struct sock *sk, struct hci_dev *hdev,
6142 bdaddr_t *bdaddr, u8 type, u8 action)
6143{
6144 struct mgmt_ev_device_added ev;
6145
6146 bacpy(&ev.addr.bdaddr, bdaddr);
6147 ev.addr.type = type;
6148 ev.action = action;
6149
6150 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6151}
6152
1904a853 6153static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 6154{
3b0602cd 6155 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 6156
6157 BT_DBG("status 0x%02x", status);
6158
6159 hci_dev_lock(hdev);
6160
333ae95d 6161 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 6162 if (!cmd)
6163 goto unlock;
6164
6165 cmd->cmd_complete(cmd, mgmt_status(status));
6166 mgmt_pending_remove(cmd);
6167
6168unlock:
6169 hci_dev_unlock(hdev);
6170}
6171
2faade53
MH		 6172static int add_device(struct sock *sk, struct hci_dev *hdev,
6173 void *data, u16 len)
6174{
6175 struct mgmt_cp_add_device *cp = data;
3b0602cd 6176 struct mgmt_pending_cmd *cmd;
5a154e6f 6177 struct hci_request req;
2faade53
MH		 6178 u8 auto_conn, addr_type;
6179 int err;
6180
6181 BT_DBG("%s", hdev->name);
6182
6659358e 6183 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 6184 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 6185 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6186 MGMT_STATUS_INVALID_PARAMS,
6187 &cp->addr, sizeof(cp->addr));
2faade53 6188
4b9e7e75 6189 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 6190 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6191 MGMT_STATUS_INVALID_PARAMS,
6192 &cp->addr, sizeof(cp->addr));
2faade53 6193
5a154e6f
JH		 6194 hci_req_init(&req, hdev);
6195
2faade53
MH		 6196 hci_dev_lock(hdev);
6197
5a154e6f
JH		 6198 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6199 if (!cmd) {
6200 err = -ENOMEM;
6201 goto unlock;
6202 }
6203
6204 cmd->cmd_complete = addr_cmd_complete;
6205
6659358e 6206 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 6207 /* Only incoming connections action is supported for now */
6659358e 6208 if (cp->action != 0x01) {
9df74653
JH		 6209 err = cmd->cmd_complete(cmd,
6210 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 6211 mgmt_pending_remove(cmd);
6659358e
JH		 6212 goto unlock;
6213 }
6214
6215 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6216 cp->addr.type);
6217 if (err)
6218 goto unlock;
a397407f 6219
5a154e6f 6220 __hci_update_page_scan(&req);
a397407f 6221
6659358e
JH		 6222 goto added;
6223 }
6224
85813a7e 6225 addr_type = le_addr_type(cp->addr.type);
2faade53 6226
4b9e7e75 6227 if (cp->action == 0x02)
2faade53 6228 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 6229 else if (cp->action == 0x01)
6230 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 6231 else
a3451d27 6232 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 6233
9a0a8a8e
JP		 6234 /* Kernel internally uses conn_params with resolvable private
6235 * address, but Add Device allows only identity addresses.
6236 * Make sure it is enforced before calling
6237 * hci_conn_params_lookup.
6238 */
6239 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6240 err = cmd->cmd_complete(cmd, MGMT_STATUS_INVALID_PARAMS);
6241 mgmt_pending_remove(cmd);
6242 goto unlock;
6243 }
6244
bf5b3c8b
MH		 6245 /* If the connection parameters don't exist for this device,
6246 * they will be created and configured with defaults.
6247 */
5a154e6f 6248 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 6249 auto_conn) < 0) {
9df74653 6250 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 6251 mgmt_pending_remove(cmd);
2faade53
MH		 6252 goto unlock;
6253 }
6254
6659358e 6255added:
8afef092
MH		 6256 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6257
5a154e6f
JH		 6258 err = hci_req_run(&req, add_device_complete);
6259 if (err < 0) {
6260 /* ENODATA means no HCI commands were needed (e.g. if
6261 * the adapter is powered off).
6262 */
9df74653
JH		 6263 if (err == -ENODATA)
6264 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 6265 mgmt_pending_remove(cmd);
6266 }
2faade53
MH		 6267
6268unlock:
6269 hci_dev_unlock(hdev);
6270 return err;
6271}
6272
8afef092
MH		 6273static void device_removed(struct sock *sk, struct hci_dev *hdev,
6274 bdaddr_t *bdaddr, u8 type)
6275{
6276 struct mgmt_ev_device_removed ev;
6277
6278 bacpy(&ev.addr.bdaddr, bdaddr);
6279 ev.addr.type = type;
6280
6281 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6282}
6283
1904a853 6284static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 6285{
3b0602cd 6286 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 6287
6288 BT_DBG("status 0x%02x", status);
6289
6290 hci_dev_lock(hdev);
6291
333ae95d 6292 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 6293 if (!cmd)
6294 goto unlock;
6295
6296 cmd->cmd_complete(cmd, mgmt_status(status));
6297 mgmt_pending_remove(cmd);
6298
6299unlock:
6300 hci_dev_unlock(hdev);
6301}
6302
2faade53
MH		 6303static int remove_device(struct sock *sk, struct hci_dev *hdev,
6304 void *data, u16 len)
6305{
6306 struct mgmt_cp_remove_device *cp = data;
3b0602cd 6307 struct mgmt_pending_cmd *cmd;
51ef3ebe 6308 struct hci_request req;
2faade53
MH		 6309 int err;
6310
6311 BT_DBG("%s", hdev->name);
6312
51ef3ebe
JH		 6313 hci_req_init(&req, hdev);
6314
2faade53
MH		 6315 hci_dev_lock(hdev);
6316
51ef3ebe
JH		 6317 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6318 if (!cmd) {
6319 err = -ENOMEM;
6320 goto unlock;
6321 }
6322
6323 cmd->cmd_complete = addr_cmd_complete;
6324
2faade53 6325 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 6326 struct hci_conn_params *params;
2faade53
MH		 6327 u8 addr_type;
6328
6659358e 6329 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 6330 err = cmd->cmd_complete(cmd,
6331 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6332 mgmt_pending_remove(cmd);
2faade53
MH		 6333 goto unlock;
6334 }
6335
6659358e
JH		 6336 if (cp->addr.type == BDADDR_BREDR) {
6337 err = hci_bdaddr_list_del(&hdev->whitelist,
6338 &cp->addr.bdaddr,
6339 cp->addr.type);
6340 if (err) {
9df74653
JH		 6341 err = cmd->cmd_complete(cmd,
6342 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6343 mgmt_pending_remove(cmd);
6659358e
JH		 6344 goto unlock;
6345 }
6346
51ef3ebe 6347 __hci_update_page_scan(&req);
a397407f 6348
6659358e
JH		 6349 device_removed(sk, hdev, &cp->addr.bdaddr,
6350 cp->addr.type);
6351 goto complete;
6352 }
6353
85813a7e 6354 addr_type = le_addr_type(cp->addr.type);
2faade53 6355
9a0a8a8e
JP		 6356 /* Kernel internally uses conn_params with resolvable private
6357 * address, but Remove Device allows only identity addresses.
6358 * Make sure it is enforced before calling
6359 * hci_conn_params_lookup.
6360 */
6361 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) {
6362 err = cmd->cmd_complete(cmd,
6363 MGMT_STATUS_INVALID_PARAMS);
6364 mgmt_pending_remove(cmd);
6365 goto unlock;
6366 }
6367
c71593dd
JH		 6368 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6369 addr_type);
6370 if (!params) {
9df74653
JH		 6371 err = cmd->cmd_complete(cmd,
6372 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6373 mgmt_pending_remove(cmd);
c71593dd
JH		 6374 goto unlock;
6375 }
6376
679d2b6f
JH		 6377 if (params->auto_connect == HCI_AUTO_CONN_DISABLED ||
6378 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) {
9df74653
JH		 6379 err = cmd->cmd_complete(cmd,
6380 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6381 mgmt_pending_remove(cmd);
c71593dd
JH		 6382 goto unlock;
6383 }
6384
d1dbf12e 6385 list_del(&params->action);
c71593dd
JH		 6386 list_del(&params->list);
6387 kfree(params);
51ef3ebe 6388 __hci_update_background_scan(&req);
8afef092
MH		 6389
6390 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 6391 } else {
19de0825 6392 struct hci_conn_params *p, *tmp;
6659358e 6393 struct bdaddr_list *b, *btmp;
19de0825 6394
2faade53 6395 if (cp->addr.type) {
9df74653
JH		 6396 err = cmd->cmd_complete(cmd,
6397 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6398 mgmt_pending_remove(cmd);
2faade53
MH		 6399 goto unlock;
6400 }
6401
6659358e
JH		 6402 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6403 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6404 list_del(&b->list);
6405 kfree(b);
6406 }
6407
51ef3ebe 6408 __hci_update_page_scan(&req);
a397407f 6409
19de0825
JH		 6410 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6411 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6412 continue;
6413 device_removed(sk, hdev, &p->addr, p->addr_type);
679d2b6f
JH		 6414 if (p->explicit_connect) {
6415 p->auto_connect = HCI_AUTO_CONN_EXPLICIT;
6416 continue;
6417 }
19de0825
JH		 6418 list_del(&p->action);
6419 list_del(&p->list);
6420 kfree(p);
6421 }
6422
6423 BT_DBG("All LE connection parameters were removed");
6424
51ef3ebe 6425 __hci_update_background_scan(&req);
2faade53
MH		 6426 }
6427
6659358e 6428complete:
51ef3ebe
JH		 6429 err = hci_req_run(&req, remove_device_complete);
6430 if (err < 0) {
6431 /* ENODATA means no HCI commands were needed (e.g. if
6432 * the adapter is powered off).
6433 */
9df74653
JH		 6434 if (err == -ENODATA)
6435 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 6436 mgmt_pending_remove(cmd);
6437 }
2faade53
MH		 6438
6439unlock:
6440 hci_dev_unlock(hdev);
6441 return err;
6442}
6443
a26f3dcf
JH		 6444static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6445 u16 len)
6446{
6447 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 6448 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6449 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 6450 u16 param_count, expected_len;
6451 int i;
6452
6453 if (!lmp_le_capable(hdev))
a69e8375
JH		 6454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6455 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 6456
6457 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 6458 if (param_count > max_param_count) {
6459 BT_ERR("load_conn_param: too big param_count value %u",
6460 param_count);
a69e8375
JH		 6461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6462 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 6463 }
a26f3dcf
JH		 6464
6465 expected_len = sizeof(*cp) + param_count *
6466 sizeof(struct mgmt_conn_param);
6467 if (expected_len != len) {
6468 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6469 expected_len, len);
a69e8375
JH		 6470 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6471 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 6472 }
6473
6474 BT_DBG("%s param_count %u", hdev->name, param_count);
6475
6476 hci_dev_lock(hdev);
6477
6478 hci_conn_params_clear_disabled(hdev);
6479
6480 for (i = 0; i < param_count; i++) {
6481 struct mgmt_conn_param *param = &cp->params[i];
6482 struct hci_conn_params *hci_param;
6483 u16 min, max, latency, timeout;
6484 u8 addr_type;
6485
6486 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6487 param->addr.type);
6488
6489 if (param->addr.type == BDADDR_LE_PUBLIC) {
6490 addr_type = ADDR_LE_DEV_PUBLIC;
6491 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6492 addr_type = ADDR_LE_DEV_RANDOM;
6493 } else {
6494 BT_ERR("Ignoring invalid connection parameters");
6495 continue;
6496 }
6497
6498 min = le16_to_cpu(param->min_interval);
6499 max = le16_to_cpu(param->max_interval);
6500 latency = le16_to_cpu(param->latency);
6501 timeout = le16_to_cpu(param->timeout);
6502
6503 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6504 min, max, latency, timeout);
6505
6506 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6507 BT_ERR("Ignoring invalid connection parameters");
6508 continue;
6509 }
6510
6511 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6512 addr_type);
6513 if (!hci_param) {
6514 BT_ERR("Failed to add connection parameters");
6515 continue;
6516 }
6517
6518 hci_param->conn_min_interval = min;
6519 hci_param->conn_max_interval = max;
6520 hci_param->conn_latency = latency;
6521 hci_param->supervision_timeout = timeout;
6522 }
6523
6524 hci_dev_unlock(hdev);
6525
2a1afb5a
JH		 6526 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6527 NULL, 0);
a26f3dcf
JH		 6528}
6529
dbece37a
MH		 6530static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6531 void *data, u16 len)
6532{
6533 struct mgmt_cp_set_external_config *cp = data;
6534 bool changed;
6535 int err;
6536
6537 BT_DBG("%s", hdev->name);
6538
6539 if (hdev_is_powered(hdev))
a69e8375
JH		 6540 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6541 MGMT_STATUS_REJECTED);
dbece37a
MH		 6542
6543 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6544 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6545 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6546
6547 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6548 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6549 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6550
6551 hci_dev_lock(hdev);
6552
6553 if (cp->config)
238be788 6554 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6555 else
a69d8927 6556 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6557
6558 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6559 if (err < 0)
6560 goto unlock;
6561
6562 if (!changed)
6563 goto unlock;
6564
f4537c04
MH		 6565 err = new_options(hdev, sk);
6566
d7a5a11d 6567 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6568 mgmt_index_removed(hdev);
d603b76b 6569
516018a9 6570 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6571 hci_dev_set_flag(hdev, HCI_CONFIG);
6572 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6573
6574 queue_work(hdev->req_workqueue, &hdev->power_on);
6575 } else {
5ea234d3 6576 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6577 mgmt_index_added(hdev);
6578 }
dbece37a
MH		 6579 }
6580
6581unlock:
6582 hci_dev_unlock(hdev);
6583 return err;
6584}
6585
9713c17b
MH		 6586static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6587 void *data, u16 len)
6588{
6589 struct mgmt_cp_set_public_address *cp = data;
6590 bool changed;
6591 int err;
6592
6593 BT_DBG("%s", hdev->name);
6594
6595 if (hdev_is_powered(hdev))
a69e8375
JH		 6596 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6597 MGMT_STATUS_REJECTED);
9713c17b
MH		 6598
6599 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6600 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6601 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6602
6603 if (!hdev->set_bdaddr)
a69e8375
JH		 6604 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6605 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6606
6607 hci_dev_lock(hdev);
6608
6609 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6610 bacpy(&hdev->public_addr, &cp->bdaddr);
6611
6612 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6613 if (err < 0)
6614 goto unlock;
6615
6616 if (!changed)
6617 goto unlock;
6618
d7a5a11d 6619 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6620 err = new_options(hdev, sk);
6621
6622 if (is_configured(hdev)) {
6623 mgmt_index_removed(hdev);
6624
a358dc11 6625 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6626
a1536da2
MH		 6627 hci_dev_set_flag(hdev, HCI_CONFIG);
6628 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6629
6630 queue_work(hdev->req_workqueue, &hdev->power_on);
6631 }
6632
6633unlock:
6634 hci_dev_unlock(hdev);
6635 return err;
6636}
6637
bea41609
MH		 6638static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6639 u8 data_len)
6640{
6641 eir[eir_len++] = sizeof(type) + data_len;
6642 eir[eir_len++] = type;
6643 memcpy(&eir[eir_len], data, data_len);
6644 eir_len += data_len;
6645
6646 return eir_len;
6647}
6648
40f66c05
JH		 6649static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6650 u16 opcode, struct sk_buff *skb)
6651{
6652 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6653 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6654 u8 *h192, *r192, *h256, *r256;
6655 struct mgmt_pending_cmd *cmd;
6656 u16 eir_len;
6657 int err;
6658
6659 BT_DBG("%s status %u", hdev->name, status);
6660
6661 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6662 if (!cmd)
6663 return;
6664
6665 mgmt_cp = cmd->param;
6666
6667 if (status) {
6668 status = mgmt_status(status);
6669 eir_len = 0;
6670
6671 h192 = NULL;
6672 r192 = NULL;
6673 h256 = NULL;
6674 r256 = NULL;
6675 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6676 struct hci_rp_read_local_oob_data *rp;
6677
6678 if (skb->len != sizeof(*rp)) {
6679 status = MGMT_STATUS_FAILED;
6680 eir_len = 0;
6681 } else {
6682 status = MGMT_STATUS_SUCCESS;
6683 rp = (void *)skb->data;
6684
6685 eir_len = 5 + 18 + 18;
6686 h192 = rp->hash;
6687 r192 = rp->rand;
6688 h256 = NULL;
6689 r256 = NULL;
6690 }
6691 } else {
6692 struct hci_rp_read_local_oob_ext_data *rp;
6693
6694 if (skb->len != sizeof(*rp)) {
6695 status = MGMT_STATUS_FAILED;
6696 eir_len = 0;
6697 } else {
6698 status = MGMT_STATUS_SUCCESS;
6699 rp = (void *)skb->data;
6700
6701 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6702 eir_len = 5 + 18 + 18;
6703 h192 = NULL;
6704 r192 = NULL;
6705 } else {
6706 eir_len = 5 + 18 + 18 + 18 + 18;
6707 h192 = rp->hash192;
6708 r192 = rp->rand192;
6709 }
6710
6711 h256 = rp->hash256;
6712 r256 = rp->rand256;
6713 }
6714 }
6715
6716 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6717 if (!mgmt_rp)
6718 goto done;
6719
6720 if (status)
6721 goto send_rsp;
6722
6723 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6724 hdev->dev_class, 3);
6725
6726 if (h192 && r192) {
6727 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6728 EIR_SSP_HASH_C192, h192, 16);
6729 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6730 EIR_SSP_RAND_R192, r192, 16);
6731 }
6732
6733 if (h256 && r256) {
6734 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6735 EIR_SSP_HASH_C256, h256, 16);
6736 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6737 EIR_SSP_RAND_R256, r256, 16);
6738 }
6739
6740send_rsp:
6741 mgmt_rp->type = mgmt_cp->type;
6742 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6743
6744 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6745 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6746 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6747 if (err < 0 || status)
6748 goto done;
6749
6750 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6751
6752 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6753 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6754 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6755done:
6756 kfree(mgmt_rp);
6757 mgmt_pending_remove(cmd);
6758}
6759
6760static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6761 struct mgmt_cp_read_local_oob_ext_data *cp)
6762{
6763 struct mgmt_pending_cmd *cmd;
6764 struct hci_request req;
6765 int err;
6766
6767 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6768 cp, sizeof(*cp));
6769 if (!cmd)
6770 return -ENOMEM;
6771
6772 hci_req_init(&req, hdev);
6773
6774 if (bredr_sc_enabled(hdev))
6775 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6776 else
6777 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6778
6779 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6780 if (err < 0) {
6781 mgmt_pending_remove(cmd);
6782 return err;
6783 }
6784
6785 return 0;
6786}
6787
4f0f155c
MH		 6788static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6789 void *data, u16 data_len)
6790{
6791 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6792 struct mgmt_rp_read_local_oob_ext_data *rp;
6793 size_t rp_len;
6794 u16 eir_len;
0821a2c5 6795 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6796 int err;
6797
6798 BT_DBG("%s", hdev->name);
6799
57b0d3e8
MH		 6800 if (hdev_is_powered(hdev)) {
6801 switch (cp->type) {
6802 case BIT(BDADDR_BREDR):
6803 status = mgmt_bredr_support(hdev);
6804 if (status)
6805 eir_len = 0;
6806 else
6807 eir_len = 5;
6808 break;
6809 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6810 status = mgmt_le_support(hdev);
6811 if (status)
6812 eir_len = 0;
6813 else
6814 eir_len = 9 + 3 + 18 + 18 + 3;
6815 break;
6816 default:
6817 status = MGMT_STATUS_INVALID_PARAMS;
6818 eir_len = 0;
6819 break;
6820 }
6821 } else {
6822 status = MGMT_STATUS_NOT_POWERED;
6823 eir_len = 0;
4f0f155c
MH		 6824 }
6825
4f0f155c
MH		 6826 rp_len = sizeof(*rp) + eir_len;
6827 rp = kmalloc(rp_len, GFP_ATOMIC);
efcd8c98 6828 if (!rp)
4f0f155c 6829 return -ENOMEM;
efcd8c98 6830
57b0d3e8
MH		 6831 if (status)
6832 goto complete;
6833
efcd8c98 6834 hci_dev_lock(hdev);
4f0f155c
MH		 6835
6836 eir_len = 0;
6837 switch (cp->type) {
6838 case BIT(BDADDR_BREDR):
40f66c05
JH		 6839 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6840 err = read_local_ssp_oob_req(hdev, sk, cp);
6841 hci_dev_unlock(hdev);
6842 if (!err)
6843 goto done;
6844
6845 status = MGMT_STATUS_FAILED;
6846 goto complete;
6847 } else {
6848 eir_len = eir_append_data(rp->eir, eir_len,
6849 EIR_CLASS_OF_DEV,
6850 hdev->dev_class, 3);
6851 }
4f0f155c
MH		 6852 break;
6853 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6854 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6855 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5 6856 hci_dev_unlock(hdev);
57b0d3e8
MH		 6857 status = MGMT_STATUS_FAILED;
6858 goto complete;
0821a2c5
MH		 6859 }
6860
e213568a
MH		 6861 /* This should return the active RPA, but since the RPA
6862 * is only programmed on demand, it is really hard to fill
6863 * this in at the moment. For now disallow retrieving
6864 * local out-of-band data when privacy is in use.
6865 *
6866 * Returning the identity address will not help here since
6867 * pairing happens before the identity resolving key is
6868 * known and thus the connection establishment happens
6869 * based on the RPA and not the identity address.
6870 */
4f0f155c 6871 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
e213568a
MH		 6872 hci_dev_unlock(hdev);
6873 status = MGMT_STATUS_REJECTED;
6874 goto complete;
6875 }
6876
6877 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6878 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6879 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6880 bacmp(&hdev->static_addr, BDADDR_ANY))) {
4f0f155c
MH		 6881 memcpy(addr, &hdev->static_addr, 6);
6882 addr[6] = 0x01;
6883 } else {
6884 memcpy(addr, &hdev->bdaddr, 6);
6885 addr[6] = 0x00;
6886 }
6887
6888 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6889 addr, sizeof(addr));
6890
6891 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6892 role = 0x02;
6893 else
6894 role = 0x01;
6895
6896 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6897 &role, sizeof(role));
6898
5082a599
MH		 6899 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6900 eir_len = eir_append_data(rp->eir, eir_len,
6901 EIR_LE_SC_CONFIRM,
6902 hash, sizeof(hash));
0821a2c5 6903
5082a599
MH		 6904 eir_len = eir_append_data(rp->eir, eir_len,
6905 EIR_LE_SC_RANDOM,
6906 rand, sizeof(rand));
6907 }
0821a2c5 6908
4f0f155c
MH		 6909 flags = get_adv_discov_flags(hdev);
6910
6911 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6912 flags |= LE_AD_NO_BREDR;
6913
6914 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6915 &flags, sizeof(flags));
6916 break;
6917 }
6918
4f0f155c
MH		 6919 hci_dev_unlock(hdev);
6920
72000df2
MH		 6921 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6922
57b0d3e8
MH		 6923 status = MGMT_STATUS_SUCCESS;
6924
6925complete:
efcd8c98
MH		 6926 rp->type = cp->type;
6927 rp->eir_len = cpu_to_le16(eir_len);
6928
4f0f155c 6929 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
57b0d3e8
MH		 6930 status, rp, sizeof(*rp) + eir_len);
6931 if (err < 0 || status)
72000df2
MH		 6932 goto done;
6933
6934 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6935 rp, sizeof(*rp) + eir_len,
6936 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6937
0821a2c5 6938done:
4f0f155c
MH		 6939 kfree(rp);
6940
6941 return err;
6942}
6943
089fa8c0
AU		 6944static u32 get_supported_adv_flags(struct hci_dev *hdev)
6945{
6946 u32 flags = 0;
6947
6948 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6949 flags |= MGMT_ADV_FLAG_DISCOV;
6950 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6951 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6952
6953 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6954 flags |= MGMT_ADV_FLAG_TX_POWER;
6955
6956 return flags;
6957}
6958
d3d5305b
MH		 6959static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6960 void *data, u16 data_len)
6961{
6962 struct mgmt_rp_read_adv_features *rp;
6963 size_t rp_len;
286e0c83 6964 int err, i;
24b4f38f 6965 bool instance;
286e0c83 6966 struct adv_info *adv_instance;
089fa8c0 6967 u32 supported_flags;
d3d5305b
MH		 6968
6969 BT_DBG("%s", hdev->name);
6970
089fa8c0
AU		 6971 if (!lmp_le_capable(hdev))
6972 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6973 MGMT_STATUS_REJECTED);
6974
d3d5305b
MH		 6975 hci_dev_lock(hdev);
6976
6977 rp_len = sizeof(*rp);
24b4f38f 6978
24b4f38f
AU		 6979 instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6980 if (instance)
286e0c83 6981 rp_len += hdev->adv_instance_cnt;
24b4f38f 6982
d3d5305b
MH		 6983 rp = kmalloc(rp_len, GFP_ATOMIC);
6984 if (!rp) {
6985 hci_dev_unlock(hdev);
6986 return -ENOMEM;
6987 }
6988
089fa8c0
AU		 6989 supported_flags = get_supported_adv_flags(hdev);
6990
6991 rp->supported_flags = cpu_to_le32(supported_flags);
dc5d82a9
MH		 6992 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6993 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
d2609b34 6994 rp->max_instances = HCI_MAX_ADV_INSTANCES;
24b4f38f 6995
24b4f38f 6996 if (instance) {
286e0c83
FG		 6997 i = 0;
6998 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6999 if (i >= hdev->adv_instance_cnt)
7000 break;
7001
7002 rp->instance[i] = adv_instance->instance;
7003 i++;
7004 }
7005 rp->num_instances = hdev->adv_instance_cnt;
24b4f38f
AU		 7006 } else {
7007 rp->num_instances = 0;
7008 }
d3d5305b
MH		 7009
7010 hci_dev_unlock(hdev);
7011
7012 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
7013 MGMT_STATUS_SUCCESS, rp, rp_len);
7014
7015 kfree(rp);
7016
7017 return err;
7018}
7019
4117ed70 7020static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
b44133ff 7021 u8 len, bool is_adv_data)
24b4f38f 7022{
4117ed70 7023 u8 max_len = HCI_MAX_AD_LENGTH;
24b4f38f 7024 int i, cur_len;
b44133ff 7025 bool flags_managed = false;
5507e358 7026 bool tx_power_managed = false;
67e0c0cd
AU		 7027 u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
7028 MGMT_ADV_FLAG_MANAGED_FLAGS;
24b4f38f 7029
807ec772 7030 if (is_adv_data && (adv_flags & flags_params)) {
b44133ff
AU		 7031 flags_managed = true;
7032 max_len -= 3;
7033 }
24b4f38f 7034
5507e358
AU		 7035 if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
7036 tx_power_managed = true;
7037 max_len -= 3;
7038 }
7039
4117ed70 7040 if (len > max_len)
24b4f38f
AU		 7041 return false;
7042
4117ed70
AU		 7043 /* Make sure that the data is correctly formatted. */
7044 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
7045 cur_len = data[i];
24b4f38f 7046
b44133ff
AU		 7047 if (flags_managed && data[i + 1] == EIR_FLAGS)
7048 return false;
7049
5507e358
AU		 7050 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
7051 return false;
7052
24b4f38f
AU		 7053 /* If the current field length would exceed the total data
7054 * length, then it's invalid.
7055 */
4117ed70 7056 if (i + cur_len >= len)
24b4f38f
AU		 7057 return false;
7058 }
7059
7060 return true;
7061}
7062
24b4f38f
AU		 7063static void add_advertising_complete(struct hci_dev *hdev, u8 status,
7064 u16 opcode)
7065{
7066 struct mgmt_pending_cmd *cmd;
fffd38bc 7067 struct mgmt_cp_add_advertising *cp;
24b4f38f 7068 struct mgmt_rp_add_advertising rp;
fffd38bc
FG		 7069 struct adv_info *adv_instance, *n;
7070 u8 instance;
24b4f38f
AU		 7071
7072 BT_DBG("status %d", status);
7073
7074 hci_dev_lock(hdev);
7075
7076 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
7077
fffd38bc 7078 if (status)
24b4f38f 7079 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
fffd38bc
FG		 7080
7081 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
7082 if (!adv_instance->pending)
7083 continue;
7084
7085 if (!status) {
7086 adv_instance->pending = false;
7087 continue;
7088 }
7089
7090 instance = adv_instance->instance;
7091
7092 if (hdev->cur_adv_instance == instance)
7093 cancel_adv_timeout(hdev);
7094
7095 hci_remove_adv_instance(hdev, instance);
7096 advertising_removed(cmd ? cmd->sk : NULL, hdev, instance);
24b4f38f
AU		 7097 }
7098
7099 if (!cmd)
7100 goto unlock;
7101
fffd38bc
FG		 7102 cp = cmd->param;
7103 rp.instance = cp->instance;
24b4f38f
AU		 7104
7105 if (status)
7106 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7107 mgmt_status(status));
7108 else
7109 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7110 mgmt_status(status), &rp, sizeof(rp));
7111
7112 mgmt_pending_remove(cmd);
7113
7114unlock:
7115 hci_dev_unlock(hdev);
7116}
7117
5d900e46 7118void mgmt_adv_timeout_expired(struct hci_dev *hdev)
912098a6 7119{
847818d9
FG		 7120 u8 instance;
7121 struct hci_request req;
7122
5d900e46 7123 hdev->adv_instance_timeout = 0;
912098a6 7124
847818d9
FG		 7125 instance = get_current_adv_instance(hdev);
7126 if (instance == 0x00)
7127 return;
7128
912098a6 7129 hci_dev_lock(hdev);
847818d9
FG		 7130 hci_req_init(&req, hdev);
7131
7132 clear_adv_instance(hdev, &req, instance, false);
7133
7134 if (list_empty(&hdev->adv_instances))
7135 disable_advertising(&req);
7136
7137 if (!skb_queue_empty(&req.cmd_q))
7138 hci_req_run(&req, NULL);
7139
912098a6
AU		 7140 hci_dev_unlock(hdev);
7141}
7142
24b4f38f
AU		 7143static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7144 void *data, u16 data_len)
7145{
7146 struct mgmt_cp_add_advertising *cp = data;
7147 struct mgmt_rp_add_advertising rp;
7148 u32 flags;
089fa8c0 7149 u32 supported_flags;
24b4f38f 7150 u8 status;
fffd38bc
FG		 7151 u16 timeout, duration;
7152 unsigned int prev_instance_cnt = hdev->adv_instance_cnt;
7153 u8 schedule_instance = 0;
7154 struct adv_info *next_instance;
24b4f38f
AU		 7155 int err;
7156 struct mgmt_pending_cmd *cmd;
7157 struct hci_request req;
7158
7159 BT_DBG("%s", hdev->name);
7160
7161 status = mgmt_le_support(hdev);
7162 if (status)
7163 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7164 status);
7165
7166 flags = __le32_to_cpu(cp->flags);
912098a6 7167 timeout = __le16_to_cpu(cp->timeout);
fffd38bc 7168 duration = __le16_to_cpu(cp->duration);
24b4f38f 7169
fffd38bc
FG		 7170 /* The current implementation only supports a subset of the specified
7171 * flags.
089fa8c0
AU		 7172 */
7173 supported_flags = get_supported_adv_flags(hdev);
fffd38bc 7174 if (flags & ~supported_flags)
24b4f38f
AU		 7175 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7176 MGMT_STATUS_INVALID_PARAMS);
7177
7178 hci_dev_lock(hdev);
7179
912098a6
AU		 7180 if (timeout && !hdev_is_powered(hdev)) {
7181 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7182 MGMT_STATUS_REJECTED);
7183 goto unlock;
7184 }
7185
24b4f38f 7186 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
da929335 7187 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
24b4f38f
AU		 7188 pending_find(MGMT_OP_SET_LE, hdev)) {
7189 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7190 MGMT_STATUS_BUSY);
7191 goto unlock;
7192 }
7193
b44133ff 7194 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
4117ed70 7195 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 7196 cp->scan_rsp_len, false)) {
24b4f38f
AU		 7197 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7198 MGMT_STATUS_INVALID_PARAMS);
7199 goto unlock;
7200 }
7201
fffd38bc
FG		 7202 err = hci_add_adv_instance(hdev, cp->instance, flags,
7203 cp->adv_data_len, cp->data,
7204 cp->scan_rsp_len,
7205 cp->data + cp->adv_data_len,
7206 timeout, duration);
7207 if (err < 0) {
7208 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7209 MGMT_STATUS_FAILED);
7210 goto unlock;
7211 }
24b4f38f 7212
fffd38bc
FG		 7213 /* Only trigger an advertising added event if a new instance was
7214 * actually added.
7215 */
7216 if (hdev->adv_instance_cnt > prev_instance_cnt)
7217 advertising_added(sk, hdev, cp->instance);
912098a6 7218
fffd38bc 7219 hci_dev_set_flag(hdev, HCI_ADVERTISING_INSTANCE);
912098a6 7220
fffd38bc
FG		 7221 if (hdev->cur_adv_instance == cp->instance) {
7222 /* If the currently advertised instance is being changed then
7223 * cancel the current advertising and schedule the next
7224 * instance. If there is only one instance then the overridden
7225 * advertising data will be visible right away.
7226 */
7227 cancel_adv_timeout(hdev);
912098a6 7228
fffd38bc
FG		 7229 next_instance = hci_get_next_instance(hdev, cp->instance);
7230 if (next_instance)
7231 schedule_instance = next_instance->instance;
7232 } else if (!hdev->adv_instance_timeout) {
7233 /* Immediately advertise the new instance if no other
7234 * instance is currently being advertised.
7235 */
7236 schedule_instance = cp->instance;
7237 }
24b4f38f 7238
fffd38bc
FG		 7239 /* If the HCI_ADVERTISING flag is set or the device isn't powered or
7240 * there is no instance to be advertised then we have no HCI
7241 * communication to make. Simply return.
24b4f38f
AU		 7242 */
7243 if (!hdev_is_powered(hdev) ||
fffd38bc
FG		 7244 hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7245 !schedule_instance) {
7246 rp.instance = cp->instance;
24b4f38f
AU		 7247 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7248 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7249 goto unlock;
7250 }
7251
7252 /* We're good to go, update advertising data, parameters, and start
7253 * advertising.
7254 */
7255 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7256 data_len);
7257 if (!cmd) {
7258 err = -ENOMEM;
7259 goto unlock;
7260 }
7261
7262 hci_req_init(&req, hdev);
7263
fffd38bc
FG		 7264 err = schedule_adv_instance(&req, schedule_instance, true);
7265
7266 if (!err)
7267 err = hci_req_run(&req, add_advertising_complete);
24b4f38f 7268
24b4f38f
AU		 7269 if (err < 0)
7270 mgmt_pending_remove(cmd);
7271
7272unlock:
7273 hci_dev_unlock(hdev);
7274
7275 return err;
7276}
7277
da929335
AU		 7278static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7279 u16 opcode)
7280{
7281 struct mgmt_pending_cmd *cmd;
01948331 7282 struct mgmt_cp_remove_advertising *cp;
da929335
AU		 7283 struct mgmt_rp_remove_advertising rp;
7284
7285 BT_DBG("status %d", status);
7286
7287 hci_dev_lock(hdev);
7288
7289 /* A failure status here only means that we failed to disable
7290 * advertising. Otherwise, the advertising instance has been removed,
7291 * so report success.
7292 */
7293 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7294 if (!cmd)
7295 goto unlock;
7296
01948331
FG		 7297 cp = cmd->param;
7298 rp.instance = cp->instance;
da929335
AU		 7299
7300 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7301 &rp, sizeof(rp));
7302 mgmt_pending_remove(cmd);
7303
7304unlock:
7305 hci_dev_unlock(hdev);
7306}
7307
7308static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7309 void *data, u16 data_len)
7310{
7311 struct mgmt_cp_remove_advertising *cp = data;
7312 struct mgmt_rp_remove_advertising rp;
da929335
AU		 7313 struct mgmt_pending_cmd *cmd;
7314 struct hci_request req;
952497b1 7315 int err;
da929335
AU		 7316
7317 BT_DBG("%s", hdev->name);
7318
da929335
AU		 7319 hci_dev_lock(hdev);
7320
952497b1 7321 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) {
01948331
FG		 7322 err = mgmt_cmd_status(sk, hdev->id,
7323 MGMT_OP_REMOVE_ADVERTISING,
7324 MGMT_STATUS_INVALID_PARAMS);
7325 goto unlock;
7326 }
7327
da929335
AU		 7328 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7329 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7330 pending_find(MGMT_OP_SET_LE, hdev)) {
7331 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7332 MGMT_STATUS_BUSY);
7333 goto unlock;
7334 }
7335
7336 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7337 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7338 MGMT_STATUS_INVALID_PARAMS);
7339 goto unlock;
7340 }
7341
01948331 7342 hci_req_init(&req, hdev);
da929335 7343
01948331 7344 clear_adv_instance(hdev, &req, cp->instance, true);
da929335 7345
01948331
FG		 7346 if (list_empty(&hdev->adv_instances))
7347 disable_advertising(&req);
da929335 7348
01948331
FG		 7349 /* If no HCI commands have been collected so far or the HCI_ADVERTISING
7350 * flag is set or the device isn't powered then we have no HCI
7351 * communication to make. Simply return.
da929335 7352 */
01948331
FG		 7353 if (skb_queue_empty(&req.cmd_q) ||
7354 !hdev_is_powered(hdev) ||
da929335 7355 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
01948331 7356 rp.instance = cp->instance;
da929335
AU		 7357 err = mgmt_cmd_complete(sk, hdev->id,
7358 MGMT_OP_REMOVE_ADVERTISING,
7359 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7360 goto unlock;
7361 }
7362
7363 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7364 data_len);
7365 if (!cmd) {
7366 err = -ENOMEM;
7367 goto unlock;
7368 }
7369
da929335
AU		 7370 err = hci_req_run(&req, remove_advertising_complete);
7371 if (err < 0)
7372 mgmt_pending_remove(cmd);
7373
7374unlock:
7375 hci_dev_unlock(hdev);
7376
7377 return err;
7378}
7379
6d785aa3 7380static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 7381 { NULL }, /* 0x0000 (no command) */
b9a245fb 7382 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 7383 HCI_MGMT_NO_HDEV |
7384 HCI_MGMT_UNTRUSTED },
b9a245fb 7385 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 7386 HCI_MGMT_NO_HDEV |
7387 HCI_MGMT_UNTRUSTED },
b9a245fb 7388 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 7389 HCI_MGMT_NO_HDEV |
7390 HCI_MGMT_UNTRUSTED },
7391 { read_controller_info, MGMT_READ_INFO_SIZE,
7392 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 7393 { set_powered, MGMT_SETTING_SIZE },
7394 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
7395 { set_connectable, MGMT_SETTING_SIZE },
7396 { set_fast_connectable, MGMT_SETTING_SIZE },
7397 { set_bondable, MGMT_SETTING_SIZE },
7398 { set_link_security, MGMT_SETTING_SIZE },
7399 { set_ssp, MGMT_SETTING_SIZE },
7400 { set_hs, MGMT_SETTING_SIZE },
7401 { set_le, MGMT_SETTING_SIZE },
7402 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
7403 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
7404 { add_uuid, MGMT_ADD_UUID_SIZE },
7405 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 7406 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
7407 HCI_MGMT_VAR_LEN },
7408 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7409 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7410 { disconnect, MGMT_DISCONNECT_SIZE },
7411 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
7412 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
7413 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
7414 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
7415 { pair_device, MGMT_PAIR_DEVICE_SIZE },
7416 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
7417 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
7418 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
7419 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7420 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
7421 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 7422 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
7423 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7424 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7425 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7426 { start_discovery, MGMT_START_DISCOVERY_SIZE },
7427 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
7428 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
7429 { block_device, MGMT_BLOCK_DEVICE_SIZE },
7430 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
7431 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
7432 { set_advertising, MGMT_SETTING_SIZE },
7433 { set_bredr, MGMT_SETTING_SIZE },
7434 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
7435 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
7436 { set_secure_conn, MGMT_SETTING_SIZE },
7437 { set_debug_keys, MGMT_SETTING_SIZE },
7438 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 7439 { load_irks, MGMT_LOAD_IRKS_SIZE,
7440 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7441 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
7442 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
7443 { add_device, MGMT_ADD_DEVICE_SIZE },
7444 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 7445 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
7446 HCI_MGMT_VAR_LEN },
7447 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 7448 HCI_MGMT_NO_HDEV |
7449 HCI_MGMT_UNTRUSTED },
b9a245fb 7450 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 7451 HCI_MGMT_UNCONFIGURED |
7452 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 7453 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
7454 HCI_MGMT_UNCONFIGURED },
7455 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
7456 HCI_MGMT_UNCONFIGURED },
7457 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7458 HCI_MGMT_VAR_LEN },
4f0f155c 7459 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 7460 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 7461 HCI_MGMT_NO_HDEV |
7462 HCI_MGMT_UNTRUSTED },
d3d5305b 7463 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 7464 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7465 HCI_MGMT_VAR_LEN },
da929335 7466 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
0f4e68cf
JH		 7467};
7468
bf6b56db 7469void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 7470{
ced85549 7471 struct mgmt_ev_ext_index ev;
bb4b2a9a 7472
0602a8ad
MH		 7473 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7474 return;
7475
f9207338
MH		 7476 switch (hdev->dev_type) {
7477 case HCI_BREDR:
7478 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7479 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7480 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7481 ev.type = 0x01;
f9207338
MH		 7482 } else {
7483 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7484 HCI_MGMT_INDEX_EVENTS);
ced85549 7485 ev.type = 0x00;
f9207338
MH		 7486 }
7487 break;
ced85549
MH		 7488 case HCI_AMP:
7489 ev.type = 0x02;
7490 break;
7491 default:
7492 return;
f9207338 7493 }
ced85549
MH		 7494
7495 ev.bus = hdev->bus;
7496
7497 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7498 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 7499}
7500
bf6b56db 7501void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 7502{
ced85549 7503 struct mgmt_ev_ext_index ev;
5f159032 7504 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 7505
0602a8ad
MH		 7506 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7507 return;
7508
f9207338
MH		 7509 switch (hdev->dev_type) {
7510 case HCI_BREDR:
7511 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 7512
f9207338
MH		 7513 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7514 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7515 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7516 ev.type = 0x01;
f9207338
MH		 7517 } else {
7518 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7519 HCI_MGMT_INDEX_EVENTS);
ced85549 7520 ev.type = 0x00;
f9207338
MH		 7521 }
7522 break;
ced85549
MH		 7523 case HCI_AMP:
7524 ev.type = 0x02;
7525 break;
7526 default:
7527 return;
f9207338 7528 }
ced85549
MH		 7529
7530 ev.bus = hdev->bus;
7531
7532 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7533 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 7534}
7535
6046dc3e 7536/* This function requires the caller holds hdev->lock */
2cf22218 7537static void restart_le_actions(struct hci_request *req)
6046dc3e 7538{
2cf22218 7539 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 7540 struct hci_conn_params *p;
7541
7542 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 7543 /* Needed for AUTO_OFF case where might not "really"
7544 * have been powered off.
7545 */
7546 list_del_init(&p->action);
7547
7548 switch (p->auto_connect) {
4b9e7e75 7549 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 7550 case HCI_AUTO_CONN_ALWAYS:
7551 list_add(&p->action, &hdev->pend_le_conns);
7552 break;
7553 case HCI_AUTO_CONN_REPORT:
7554 list_add(&p->action, &hdev->pend_le_reports);
7555 break;
7556 default:
7557 break;
c83ed19d 7558 }
6046dc3e 7559 }
c83ed19d 7560
2cf22218 7561 __hci_update_background_scan(req);
6046dc3e
AG		 7562}
7563
1904a853 7564static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 7565{
7566 struct cmd_lookup match = { NULL, hdev };
7567
7568 BT_DBG("status 0x%02x", status);
7569
162a3bac
MH		 7570 if (!status) {
7571 /* Register the available SMP channels (BR/EDR and LE) only
7572 * when successfully powering on the controller. This late
7573 * registration is required so that LE SMP can clearly
7574 * decide if the public address or static address is used.
7575 */
7576 smp_register(hdev);
7577 }
7578
229ab39c
JH		 7579 hci_dev_lock(hdev);
7580
7581 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7582
7583 new_settings(hdev, match.sk);
7584
7585 hci_dev_unlock(hdev);
7586
7587 if (match.sk)
7588 sock_put(match.sk);
7589}
7590
70da6243 7591static int powered_update_hci(struct hci_dev *hdev)
5add6af8 7592{
890ea898 7593 struct hci_request req;
320b3bf7 7594 struct adv_info *adv_instance;
70da6243 7595 u8 link_sec;
5add6af8 7596
890ea898
JH		 7597 hci_req_init(&req, hdev);
7598
d7a5a11d 7599 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 7600 !lmp_host_ssp_capable(hdev)) {
574ea3c7 7601 u8 mode = 0x01;
5e5282bb 7602
574ea3c7
MH		 7603 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7604
7605 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7606 u8 support = 0x01;
5add6af8 7607
574ea3c7
MH		 7608 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7609 sizeof(support), &support);
7610 }
ec6f99b8
JH		 7611 }
7612
d7a5a11d 7613 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 7614 lmp_bredr_capable(hdev)) {
70da6243 7615 struct hci_cp_write_le_host_supported cp;
f0ff92fb 7616
32226e4f
MH		 7617 cp.le = 0x01;
7618 cp.simul = 0x00;
3d1cbdd6 7619
70da6243
JH		 7620 /* Check first if we already have the right
7621 * host state (host features set)
7622 */
7623 if (cp.le != lmp_host_le_capable(hdev) ||
7624 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 7625 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7626 sizeof(cp), &cp);
70da6243 7627 }
3d1cbdd6 7628
d13eafce 7629 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 7630 /* Make sure the controller has a good default for
7631 * advertising data. This also applies to the case
7632 * where BR/EDR was toggled during the AUTO_OFF phase.
7633 */
320b3bf7
FG		 7634 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
7635 (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7636 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))) {
5947f4bc 7637 update_adv_data(&req);
f14d8f64
MH		 7638 update_scan_rsp_data(&req);
7639 }
441ad2d0 7640
320b3bf7
FG		 7641 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7642 hdev->cur_adv_instance == 0x00 &&
7643 !list_empty(&hdev->adv_instances)) {
7644 adv_instance = list_first_entry(&hdev->adv_instances,
7645 struct adv_info, list);
7646 hdev->cur_adv_instance = adv_instance->instance;
7647 }
7648
7649 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
bba3aa55 7650 enable_advertising(&req);
320b3bf7
FG		 7651 else if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
7652 hdev->cur_adv_instance)
7653 schedule_adv_instance(&req, hdev->cur_adv_instance,
7654 true);
2cf22218
JH		 7655
7656 restart_le_actions(&req);
eeca6f89
JH		 7657 }
7658
d7a5a11d 7659 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 7660 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 7661 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7662 sizeof(link_sec), &link_sec);
562fcc24 7663
70da6243 7664 if (lmp_bredr_capable(hdev)) {
d7a5a11d 7665 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 7666 write_fast_connectable(&req, true);
7667 else
7668 write_fast_connectable(&req, false);
1d2dc5b7 7669 __hci_update_page_scan(&req);
890ea898 7670 update_class(&req);
13928971 7671 update_name(&req);
890ea898 7672 update_eir(&req);
70da6243 7673 }
562fcc24 7674
229ab39c 7675 return hci_req_run(&req, powered_complete);
70da6243 7676}
562fcc24 7677
70da6243
JH		 7678int mgmt_powered(struct hci_dev *hdev, u8 powered)
7679{
7680 struct cmd_lookup match = { NULL, hdev };
9845904f 7681 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 7682 int err;
f0ff92fb 7683
d7a5a11d 7684 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 7685 return 0;
7686
70da6243 7687 if (powered) {
229ab39c
JH		 7688 if (powered_update_hci(hdev) == 0)
7689 return 0;
fe038884 7690
229ab39c
JH		 7691 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7692 &match);
7693 goto new_settings;
b24752fe
JH		 7694 }
7695
229ab39c 7696 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 7697
7698 /* If the power off is because of hdev unregistration let
7699 * use the appropriate INVALID_INDEX status. Otherwise use
7700 * NOT_POWERED. We cover both scenarios here since later in
7701 * mgmt_index_removed() any hci_conn callbacks will have already
7702 * been triggered, potentially causing misleading DISCONNECTED
7703 * status responses.
7704 */
d7a5a11d 7705 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 7706 status = MGMT_STATUS_INVALID_INDEX;
7707 else
7708 status = MGMT_STATUS_NOT_POWERED;
7709
7710 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 7711
7712 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 7713 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7714 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 7715
7716new_settings:
beadb2bd 7717 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 7718
7719 if (match.sk)
7720 sock_put(match.sk);
7721
7bb895d6 7722 return err;
5add6af8 7723}
73f22f62 7724
3eec705e 7725void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 7726{
3b0602cd 7727 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 7728 u8 status;
7729
333ae95d 7730 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 7731 if (!cmd)
3eec705e 7732 return;
96570ffc
JH		 7733
7734 if (err == -ERFKILL)
7735 status = MGMT_STATUS_RFKILLED;
7736 else
7737 status = MGMT_STATUS_FAILED;
7738
a69e8375 7739 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 7740
7741 mgmt_pending_remove(cmd);
96570ffc
JH		 7742}
7743
d1967ff8
MH		 7744void mgmt_discoverable_timeout(struct hci_dev *hdev)
7745{
7746 struct hci_request req;
d1967ff8
MH		 7747
7748 hci_dev_lock(hdev);
7749
7750 /* When discoverable timeout triggers, then just make sure
7751 * the limited discoverable flag is cleared. Even in the case
7752 * of a timeout triggered from general discoverable, it is
7753 * safe to unconditionally clear the flag.
7754 */
a358dc11
MH		 7755 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7756 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 7757
7758 hci_req_init(&req, hdev);
d7a5a11d 7759 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 7760 u8 scan = SCAN_PAGE;
7761 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7762 sizeof(scan), &scan);
7763 }
d1967ff8 7764 update_class(&req);
24b4f38f
AU		 7765
7766 /* Advertising instances don't use the global discoverable setting, so
7767 * only update AD if advertising was enabled using Set Advertising.
7768 */
7769 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7770 update_adv_data(&req);
7771
d1967ff8
MH		 7772 hci_req_run(&req, NULL);
7773
7774 hdev->discov_timeout = 0;
7775
9a43e25f
JH		 7776 new_settings(hdev, NULL);
7777
d1967ff8
MH		 7778 hci_dev_unlock(hdev);
7779}
7780
dc4a5ee2
MH		 7781void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7782 bool persistent)
55ed8ca1 7783{
86742e1e 7784 struct mgmt_ev_new_link_key ev;
55ed8ca1 7785
a492cd52 7786 memset(&ev, 0, sizeof(ev));
55ed8ca1 7787
a492cd52 7788 ev.store_hint = persistent;
d753fdc4 7789 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 7790 ev.key.addr.type = BDADDR_BREDR;
a492cd52 7791 ev.key.type = key->type;
9b3b4460 7792 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 7793 ev.key.pin_len = key->pin_len;
55ed8ca1 7794
dc4a5ee2 7795 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 7796}
f7520543 7797
d7b25450
JH		 7798static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7799{
23fb8de3
JH		 7800 switch (ltk->type) {
7801 case SMP_LTK:
7802 case SMP_LTK_SLAVE:
7803 if (ltk->authenticated)
7804 return MGMT_LTK_AUTHENTICATED;
7805 return MGMT_LTK_UNAUTHENTICATED;
7806 case SMP_LTK_P256:
7807 if (ltk->authenticated)
7808 return MGMT_LTK_P256_AUTH;
7809 return MGMT_LTK_P256_UNAUTH;
7810 case SMP_LTK_P256_DEBUG:
7811 return MGMT_LTK_P256_DEBUG;
7812 }
d7b25450
JH		 7813
7814 return MGMT_LTK_UNAUTHENTICATED;
7815}
7816
53ac6ab6 7817void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 7818{
7819 struct mgmt_ev_new_long_term_key ev;
7820
7821 memset(&ev, 0, sizeof(ev));
7822
5192d301 7823 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7824 * without providing an identity resolving key don't require
5192d301
MH		 7825 * to store long term keys. Their addresses will change the
7826 * next time around.
7827 *
7828 * Only when a remote device provides an identity address
7829 * make sure the long term key is stored. If the remote
7830 * identity is known, the long term keys are internally
7831 * mapped to the identity address. So allow static random
7832 * and public addresses here.
7833 */
ba74b666
JH		 7834 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7835 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7836 ev.store_hint = 0x00;
7837 else
53ac6ab6 7838 ev.store_hint = persistent;
ba74b666 7839
346af67b 7840 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 7841 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 7842 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 7843 ev.key.enc_size = key->enc_size;
7844 ev.key.ediv = key->ediv;
fe39c7b2 7845 ev.key.rand = key->rand;
346af67b 7846
2ceba539 7847 if (key->type == SMP_LTK)
346af67b
VCG		 7848 ev.key.master = 1;
7849
1fc62c52
JH		 7850 /* Make sure we copy only the significant bytes based on the
7851 * encryption key size, and set the rest of the value to zeroes.
7852 */
cb92205b 7853 memcpy(ev.key.val, key->val, key->enc_size);
1fc62c52
JH		 7854 memset(ev.key.val + key->enc_size, 0,
7855 sizeof(ev.key.val) - key->enc_size);
346af67b 7856
083368f7 7857 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 7858}
7859
cad20c27 7860void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent)
95fbac8a
JH		 7861{
7862 struct mgmt_ev_new_irk ev;
7863
7864 memset(&ev, 0, sizeof(ev));
7865
cad20c27 7866 ev.store_hint = persistent;
bab6d1e5 7867
95fbac8a
JH		 7868 bacpy(&ev.rpa, &irk->rpa);
7869 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7870 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7871 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7872
7873 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7874}
7875
53ac6ab6
MH		 7876void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7877 bool persistent)
7ee4ea36
MH		 7878{
7879 struct mgmt_ev_new_csrk ev;
7880
7881 memset(&ev, 0, sizeof(ev));
7882
7883 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7884 * without providing an identity resolving key don't require
7ee4ea36
MH		 7885 * to store signature resolving keys. Their addresses will change
7886 * the next time around.
7887 *
7888 * Only when a remote device provides an identity address
7889 * make sure the signature resolving key is stored. So allow
7890 * static random and public addresses here.
7891 */
7892 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7893 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7894 ev.store_hint = 0x00;
7895 else
53ac6ab6 7896 ev.store_hint = persistent;
7ee4ea36
MH		 7897
7898 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7899 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 7900 ev.key.type = csrk->type;
7ee4ea36
MH		 7901 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7902
7903 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7904}
7905
ffb5a827 7906void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 7907 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7908 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 7909{
7910 struct mgmt_ev_new_conn_param ev;
7911
c103aea6
JH		 7912 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7913 return;
7914
ffb5a827
AG		 7915 memset(&ev, 0, sizeof(ev));
7916 bacpy(&ev.addr.bdaddr, bdaddr);
7917 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 7918 ev.store_hint = store_hint;
ffb5a827
AG		 7919 ev.min_interval = cpu_to_le16(min_interval);
7920 ev.max_interval = cpu_to_le16(max_interval);
7921 ev.latency = cpu_to_le16(latency);
7922 ev.timeout = cpu_to_le16(timeout);
7923
7924 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7925}
7926
48ec92fa
AA		 7927void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7928 u32 flags, u8 *name, u8 name_len)
f7520543 7929{
b644ba33
JH		 7930 char buf[512];
7931 struct mgmt_ev_device_connected *ev = (void *) buf;
7932 u16 eir_len = 0;
f7520543 7933
48ec92fa
AA		 7934 bacpy(&ev->addr.bdaddr, &conn->dst);
7935 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 7936
c95f0ba7 7937 ev->flags = __cpu_to_le32(flags);
08c79b61 7938
fd45ada9
AA		 7939 /* We must ensure that the EIR Data fields are ordered and
7940 * unique. Keep it simple for now and avoid the problem by not
7941 * adding any BR/EDR data to the LE adv.
7942 */
7943 if (conn->le_adv_data_len > 0) {
7944 memcpy(&ev->eir[eir_len],
7945 conn->le_adv_data, conn->le_adv_data_len);
7946 eir_len = conn->le_adv_data_len;
7947 } else {
7948 if (name_len > 0)
7949 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7950 name, name_len);
b644ba33 7951
ddbea5cf 7952 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 7953 eir_len = eir_append_data(ev->eir, eir_len,
7954 EIR_CLASS_OF_DEV,
7955 conn->dev_class, 3);
7956 }
b644ba33 7957
eb55ef07 7958 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 7959
ecd90ae7
MH		 7960 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7961 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 7962}
7963
3b0602cd 7964static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 7965{
8962ee74 7966 struct sock **sk = data;
8962ee74 7967
f5818c22 7968 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7969
7970 *sk = cmd->sk;
7971 sock_hold(*sk);
7972
a664b5bc 7973 mgmt_pending_remove(cmd);
8962ee74
JH		 7974}
7975
3b0602cd 7976static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7977{
b1078ad0 7978 struct hci_dev *hdev = data;
124f6e35 7979 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7980
b1078ad0
JH		 7981 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7982
d8b7b1e4 7983 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7984 mgmt_pending_remove(cmd);
7985}
7986
84c61d92
JH		 7987bool mgmt_powering_down(struct hci_dev *hdev)
7988{
3b0602cd 7989 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 7990 struct mgmt_mode *cp;
7991
333ae95d 7992 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 7993 if (!cmd)
7994 return false;
7995
7996 cp = cmd->param;
7997 if (!cp->val)
7998 return true;
7999
8000 return false;
8001}
8002
9b80ec5e 8003void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 8004 u8 link_type, u8 addr_type, u8 reason,
8005 bool mgmt_connected)
f7520543 8006{
f0d6a0ea 8007 struct mgmt_ev_device_disconnected ev;
8962ee74 8008 struct sock *sk = NULL;
8962ee74 8009
84c61d92
JH		 8010 /* The connection is still in hci_conn_hash so test for 1
8011 * instead of 0 to know if this is the last one.
8012 */
8013 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8014 cancel_delayed_work(&hdev->power_off);
8015 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 8016 }
8017
12d4a3b2
JH		 8018 if (!mgmt_connected)
8019 return;
8020
57eb776f
AG		 8021 if (link_type != ACL_LINK && link_type != LE_LINK)
8022 return;
8023
744cf19e 8024 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 8025
f0d6a0ea
MA		 8026 bacpy(&ev.addr.bdaddr, bdaddr);
8027 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8028 ev.reason = reason;
f7520543 8029
9b80ec5e 8030 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 8031
8032 if (sk)
d97dcb66 8033 sock_put(sk);
8962ee74 8034
124f6e35 8035 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 8036 hdev);
8962ee74
JH		 8037}
8038
7892924c
MH		 8039void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
8040 u8 link_type, u8 addr_type, u8 status)
8962ee74 8041{
3655bba8
AG		 8042 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
8043 struct mgmt_cp_disconnect *cp;
3b0602cd 8044 struct mgmt_pending_cmd *cmd;
8962ee74 8045
36a75f1b
JD		 8046 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
8047 hdev);
8048
333ae95d 8049 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 8050 if (!cmd)
7892924c 8051 return;
8962ee74 8052
3655bba8
AG		 8053 cp = cmd->param;
8054
8055 if (bacmp(bdaddr, &cp->addr.bdaddr))
8056 return;
8057
8058 if (cp->addr.type != bdaddr_type)
8059 return;
8060
f5818c22 8061 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8062 mgmt_pending_remove(cmd);
f7520543 8063}
17d5c04c 8064
445608d0
MH		 8065void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8066 u8 addr_type, u8 status)
17d5c04c
JH		 8067{
8068 struct mgmt_ev_connect_failed ev;
c9910d0f 8069
84c61d92
JH		 8070 /* The connection is still in hci_conn_hash so test for 1
8071 * instead of 0 to know if this is the last one.
8072 */
8073 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
8074 cancel_delayed_work(&hdev->power_off);
8075 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 8076 }
17d5c04c 8077
4c659c39 8078 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8079 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 8080 ev.status = mgmt_status(status);
17d5c04c 8081
445608d0 8082 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 8083}
980e1a53 8084
ce0e4a0d 8085void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 8086{
8087 struct mgmt_ev_pin_code_request ev;
8088
d8457698 8089 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 8090 ev.addr.type = BDADDR_BREDR;
a770bb5a 8091 ev.secure = secure;
980e1a53 8092
ce0e4a0d 8093 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 8094}
8095
e669cf80
MH		 8096void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8097 u8 status)
980e1a53 8098{
3b0602cd 8099 struct mgmt_pending_cmd *cmd;
980e1a53 8100
333ae95d 8101 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 8102 if (!cmd)
e669cf80 8103 return;
980e1a53 8104
7776d1d8 8105 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8106 mgmt_pending_remove(cmd);
980e1a53
JH		 8107}
8108
3eb38528
MH		 8109void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8110 u8 status)
980e1a53 8111{
3b0602cd 8112 struct mgmt_pending_cmd *cmd;
980e1a53 8113
333ae95d 8114 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 8115 if (!cmd)
3eb38528 8116 return;
980e1a53 8117
7776d1d8 8118 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8119 mgmt_pending_remove(cmd);
980e1a53 8120}
a5c29683 8121
744cf19e 8122int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 8123 u8 link_type, u8 addr_type, u32 value,
04124681 8124 u8 confirm_hint)
a5c29683
JH		 8125{
8126 struct mgmt_ev_user_confirm_request ev;
8127
744cf19e 8128 BT_DBG("%s", hdev->name);
a5c29683 8129
272d90df 8130 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8131 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 8132 ev.confirm_hint = confirm_hint;
39adbffe 8133 ev.value = cpu_to_le32(value);
a5c29683 8134
744cf19e 8135 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 8136 NULL);
a5c29683
JH		 8137}
8138
272d90df 8139int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 8140 u8 link_type, u8 addr_type)
604086b7
BG		 8141{
8142 struct mgmt_ev_user_passkey_request ev;
8143
8144 BT_DBG("%s", hdev->name);
8145
272d90df 8146 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8147 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 8148
8149 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 8150 NULL);
604086b7
BG		 8151}
8152
0df4c185 8153static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 8154 u8 link_type, u8 addr_type, u8 status,
8155 u8 opcode)
a5c29683 8156{
3b0602cd 8157 struct mgmt_pending_cmd *cmd;
a5c29683 8158
333ae95d 8159 cmd = pending_find(opcode, hdev);
a5c29683
JH		 8160 if (!cmd)
8161 return -ENOENT;
8162
7776d1d8 8163 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8164 mgmt_pending_remove(cmd);
a5c29683 8165
7776d1d8 8166 return 0;
a5c29683
JH		 8167}
8168
744cf19e 8169int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8170 u8 link_type, u8 addr_type, u8 status)
a5c29683 8171{
272d90df 8172 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8173 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 8174}
8175
272d90df 8176int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8177 u8 link_type, u8 addr_type, u8 status)
a5c29683 8178{
272d90df 8179 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8180 status,
8181 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 8182}
2a611692 8183
604086b7 8184int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8185 u8 link_type, u8 addr_type, u8 status)
604086b7 8186{
272d90df 8187 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8188 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 8189}
8190
272d90df 8191int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8192 u8 link_type, u8 addr_type, u8 status)
604086b7 8193{
272d90df 8194 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8195 status,
8196 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 8197}
8198
92a25256
JH		 8199int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8200 u8 link_type, u8 addr_type, u32 passkey,
8201 u8 entered)
8202{
8203 struct mgmt_ev_passkey_notify ev;
8204
8205 BT_DBG("%s", hdev->name);
8206
8207 bacpy(&ev.addr.bdaddr, bdaddr);
8208 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8209 ev.passkey = __cpu_to_le32(passkey);
8210 ev.entered = entered;
8211
8212 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8213}
8214
e1e930f5 8215void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 8216{
8217 struct mgmt_ev_auth_failed ev;
3b0602cd 8218 struct mgmt_pending_cmd *cmd;
e1e930f5 8219 u8 status = mgmt_status(hci_status);
2a611692 8220
e1e930f5
JH		 8221 bacpy(&ev.addr.bdaddr, &conn->dst);
8222 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8223 ev.status = status;
2a611692 8224
e1e930f5
JH		 8225 cmd = find_pairing(conn);
8226
8227 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8228 cmd ? cmd->sk : NULL);
8229
a511b35b
JH		 8230 if (cmd) {
8231 cmd->cmd_complete(cmd, status);
8232 mgmt_pending_remove(cmd);
8233 }
2a611692 8234}
b312b161 8235
464996ae 8236void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 8237{
8238 struct cmd_lookup match = { NULL, hdev };
464996ae 8239 bool changed;
33ef95ed
JH		 8240
8241 if (status) {
8242 u8 mgmt_err = mgmt_status(status);
8243 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 8244 cmd_status_rsp, &mgmt_err);
464996ae 8245 return;
33ef95ed
JH		 8246 }
8247
464996ae 8248 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 8249 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 8250 else
a69d8927 8251 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 8252
33ef95ed 8253 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 8254 &match);
33ef95ed 8255
47990ea0 8256 if (changed)
464996ae 8257 new_settings(hdev, match.sk);
33ef95ed
JH		 8258
8259 if (match.sk)
8260 sock_put(match.sk);
33ef95ed
JH		 8261}
8262
890ea898 8263static void clear_eir(struct hci_request *req)
cacaf52f 8264{
890ea898 8265 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 8266 struct hci_cp_write_eir cp;
8267
976eb20e 8268 if (!lmp_ext_inq_capable(hdev))
890ea898 8269 return;
cacaf52f 8270
c80da27e
JH		 8271 memset(hdev->eir, 0, sizeof(hdev->eir));
8272
cacaf52f
JH		 8273 memset(&cp, 0, sizeof(cp));
8274
890ea898 8275 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 8276}
8277
3e248560 8278void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 8279{
8280 struct cmd_lookup match = { NULL, hdev };
890ea898 8281 struct hci_request req;
c0ecddc2 8282 bool changed = false;
ed2c4ee3
JH		 8283
8284 if (status) {
8285 u8 mgmt_err = mgmt_status(status);
c0ecddc2 8286
a69d8927
MH		 8287 if (enable && hci_dev_test_and_clear_flag(hdev,
8288 HCI_SSP_ENABLED)) {
a358dc11 8289 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 8290 new_settings(hdev, NULL);
9ecb3e24 8291 }
c0ecddc2 8292
04124681
GP		 8293 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8294 &mgmt_err);
3e248560 8295 return;
c0ecddc2
JH		 8296 }
8297
8298 if (enable) {
238be788 8299 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 8300 } else {
a69d8927 8301 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 8302 if (!changed)
a69d8927
MH		 8303 changed = hci_dev_test_and_clear_flag(hdev,
8304 HCI_HS_ENABLED);
9ecb3e24 8305 else
a358dc11 8306 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 8307 }
8308
8309 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8310
c0ecddc2 8311 if (changed)
3e248560 8312 new_settings(hdev, match.sk);
ed2c4ee3 8313
5fc6ebb1 8314 if (match.sk)
ed2c4ee3
JH		 8315 sock_put(match.sk);
8316
890ea898
JH		 8317 hci_req_init(&req, hdev);
8318
d7a5a11d
MH		 8319 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8320 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 8321 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8322 sizeof(enable), &enable);
890ea898 8323 update_eir(&req);
3769972b 8324 } else {
890ea898 8325 clear_eir(&req);
3769972b 8326 }
890ea898
JH		 8327
8328 hci_req_run(&req, NULL);
ed2c4ee3
JH		 8329}
8330
3b0602cd 8331static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 8332{
8333 struct cmd_lookup *match = data;
8334
90e70454
JH		 8335 if (match->sk == NULL) {
8336 match->sk = cmd->sk;
8337 sock_hold(match->sk);
8338 }
90e70454
JH		 8339}
8340
4e1b0245
MH		 8341void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8342 u8 status)
7f9a903c 8343{
90e70454 8344 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 8345
92da6097
JH		 8346 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8347 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8348 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 8349
8350 if (!status)
f6b7712e
MH		 8351 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8352 dev_class, 3, NULL);
90e70454
JH		 8353
8354 if (match.sk)
8355 sock_put(match.sk);
7f9a903c
MH		 8356}
8357
7667da34 8358void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 8359{
b312b161 8360 struct mgmt_cp_set_local_name ev;
3b0602cd 8361 struct mgmt_pending_cmd *cmd;
28cc7bde 8362
13928971 8363 if (status)
7667da34 8364 return;
b312b161
JH		 8365
8366 memset(&ev, 0, sizeof(ev));
8367 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 8368 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 8369
333ae95d 8370 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 8371 if (!cmd) {
8372 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 8373
13928971
JH		 8374 /* If this is a HCI command related to powering on the
8375 * HCI dev don't send any mgmt signals.
8376 */
333ae95d 8377 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 8378 return;
890ea898 8379 }
b312b161 8380
f6b7712e
MH		 8381 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8382 cmd ? cmd->sk : NULL);
b312b161 8383}
c35938b2 8384
799ce93d
JP		 8385static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8386{
8387 int i;
8388
8389 for (i = 0; i < uuid_count; i++) {
8390 if (!memcmp(uuid, uuids[i], 16))
8391 return true;
8392 }
8393
8394 return false;
8395}
8396
b487b9ce
MH		 8397static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8398{
799ce93d
JP		 8399 u16 parsed = 0;
8400
8401 while (parsed < eir_len) {
8402 u8 field_len = eir[0];
8403 u8 uuid[16];
8404 int i;
8405
8406 if (field_len == 0)
8407 break;
8408
8409 if (eir_len - parsed < field_len + 1)
8410 break;
8411
8412 switch (eir[1]) {
8413 case EIR_UUID16_ALL:
8414 case EIR_UUID16_SOME:
8415 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 8416 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8417 uuid[13] = eir[i + 3];
8418 uuid[12] = eir[i + 2];
8419 if (has_uuid(uuid, uuid_count, uuids))
8420 return true;
8421 }
8422 break;
8423 case EIR_UUID32_ALL:
8424 case EIR_UUID32_SOME:
8425 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 8426 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8427 uuid[15] = eir[i + 5];
8428 uuid[14] = eir[i + 4];
8429 uuid[13] = eir[i + 3];
8430 uuid[12] = eir[i + 2];
8431 if (has_uuid(uuid, uuid_count, uuids))
8432 return true;
8433 }
8434 break;
8435 case EIR_UUID128_ALL:
8436 case EIR_UUID128_SOME:
8437 for (i = 0; i + 17 <= field_len; i += 16) {
8438 memcpy(uuid, eir + i + 2, 16);
8439 if (has_uuid(uuid, uuid_count, uuids))
8440 return true;
8441 }
8442 break;
8443 }
8444
8445 parsed += field_len + 1;
8446 eir += field_len + 1;
8447 }
8448
b487b9ce
MH		 8449 return false;
8450}
8451
4b0e0ced
JP		 8452static void restart_le_scan(struct hci_dev *hdev)
8453{
8454 /* If controller is not scanning we are done. */
d7a5a11d 8455 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 8456 return;
8457
8458 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8459 hdev->discovery.scan_start +
8460 hdev->discovery.scan_duration))
8461 return;
8462
8463 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8464 DISCOV_LE_RESTART_DELAY);
8465}
8466
48f86b7f
JP		 8467static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8468 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 8469{
48f86b7f
JP		 8470 /* If a RSSI threshold has been specified, and
8471 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8472 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8473 * is set, let it through for further processing, as we might need to
8474 * restart the scan.
efb2513f
MH		 8475 *
8476 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8477 * the results are also dropped.
bda157a4
MH		 8478 */
8479 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 8480 (rssi == HCI_RSSI_INVALID ||
8481 (rssi < hdev->discovery.rssi &&
8482 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 8483 return false;
efb2513f 8484
2976cdeb
JP		 8485 if (hdev->discovery.uuid_count != 0) {
8486 /* If a list of UUIDs is provided in filter, results with no
8487 * matching UUID should be dropped.
b487b9ce 8488 */
2976cdeb
JP		 8489 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8490 hdev->discovery.uuids) &&
8491 !eir_has_uuids(scan_rsp, scan_rsp_len,
8492 hdev->discovery.uuid_count,
8493 hdev->discovery.uuids))
8494 return false;
b487b9ce 8495 }
5d2e9fad 8496
2976cdeb
JP		 8497 /* If duplicate filtering does not report RSSI changes, then restart
8498 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 8499 */
2976cdeb
JP		 8500 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8501 restart_le_scan(hdev);
8502
8503 /* Validate RSSI value against the RSSI threshold once more. */
8504 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8505 rssi < hdev->discovery.rssi)
8506 return false;
8507 }
48f86b7f
JP		 8508
8509 return true;
8510}
8511
8512void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8513 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8514 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8515{
8516 char buf[512];
8517 struct mgmt_ev_device_found *ev = (void *)buf;
8518 size_t ev_size;
8519
8520 /* Don't send events for a non-kernel initiated discovery. With
8521 * LE one exception is if we have pend_le_reports > 0 in which
8522 * case we're doing passive scanning and want these events.
8523 */
8524 if (!hci_discovery_active(hdev)) {
8525 if (link_type == ACL_LINK)
8526 return;
8527 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8528 return;
8529 }
8530
82f8b651 8531 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 8532 /* We are using service discovery */
8533 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8534 scan_rsp_len))
8535 return;
8536 }
8537
8538 /* Make sure that the buffer is big enough. The 5 extra bytes
8539 * are for the potential CoD field.
8540 */
8541 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 8542 return;
8543
48f86b7f
JP		 8544 memset(buf, 0, sizeof(buf));
8545
8546 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8547 * RSSI value was reported as 0 when not available. This behavior
8548 * is kept when using device discovery. This is required for full
8549 * backwards compatibility with the API.
8550 *
8551 * However when using service discovery, the value 127 will be
8552 * returned when the RSSI is not available.
8553 */
8554 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8555 link_type == ACL_LINK)
8556 rssi = 0;
8557
8558 bacpy(&ev->addr.bdaddr, bdaddr);
8559 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8560 ev->rssi = rssi;
8561 ev->flags = cpu_to_le32(flags);
8562
8563 if (eir_len > 0)
8564 /* Copy EIR or advertising data into event */
8565 memcpy(ev->eir, eir, eir_len);
8566
8567 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8568 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8569 dev_class, 3);
8570
8571 if (scan_rsp_len > 0)
8572 /* Append scan response data to event */
8573 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8574
5d2e9fad
JH		 8575 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8576 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 8577
901801b9 8578 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 8579}
a88a9652 8580
9cf12aee
MH		 8581void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8582 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 8583{
b644ba33
JH		 8584 struct mgmt_ev_device_found *ev;
8585 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8586 u16 eir_len;
a88a9652 8587
b644ba33 8588 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 8589
b644ba33
JH		 8590 memset(buf, 0, sizeof(buf));
8591
8592 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 8593 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 8594 ev->rssi = rssi;
8595
8596 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 8597 name_len);
b644ba33 8598
eb55ef07 8599 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 8600
9cf12aee 8601 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 8602}
314b2381 8603
2f1e063b 8604void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 8605{
f963e8e9 8606 struct mgmt_ev_discovering ev;
164a6e78 8607
343fb145
AG		 8608 BT_DBG("%s discovering %u", hdev->name, discovering);
8609
f963e8e9
JH		 8610 memset(&ev, 0, sizeof(ev));
8611 ev.type = hdev->discovery.type;
8612 ev.discovering = discovering;
8613
2f1e063b 8614 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 8615}
5e762444 8616
1904a853 8617static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 8618{
8619 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 8620}
8621
8622void mgmt_reenable_advertising(struct hci_dev *hdev)
8623{
8624 struct hci_request req;
eb6f95f9 8625 u8 instance;
5976e608 8626
24b4f38f
AU		 8627 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8628 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
5976e608
MH		 8629 return;
8630
eb6f95f9
FG		 8631 instance = get_current_adv_instance(hdev);
8632
5976e608 8633 hci_req_init(&req, hdev);
eb6f95f9
FG		 8634
8635 if (instance) {
8636 schedule_adv_instance(&req, instance, true);
8637 } else {
8638 update_adv_data(&req);
8639 update_scan_rsp_data(&req);
8640 enable_advertising(&req);
8641 }
8642
0ec5ae84 8643 hci_req_run(&req, adv_enable_complete);
5976e608 8644}
6d785aa3
JH		 8645
8646static struct hci_mgmt_chan chan = {
8647 .channel = HCI_CHANNEL_CONTROL,
8648 .handler_count = ARRAY_SIZE(mgmt_handlers),
8649 .handlers = mgmt_handlers,
88b94ce9 8650 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 8651};
8652
8653int mgmt_init(void)
8654{
8655 return hci_mgmt_chan_register(&chan);
8656}
8657
8658void mgmt_exit(void)
8659{
8660 hci_mgmt_chan_unregister(&chan);
8661}
Linux kernel - Deliverables
This page took 0.977583 seconds and 5 git commands to generate.