projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Use hci_copy_identity_addr() helper for SMP chan creation
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
4bc58f51 32#include <net/bluetooth/l2cap.h>
0381101f 33#include <net/bluetooth/mgmt.h>
ac4b7236 34
0857dd3b 35#include "hci_request.h"
ac4b7236 36#include "smp.h"
0381101f 37
2da9c55c 38#define MGMT_VERSION 1
854bda19 39#define MGMT_REVISION 8
02d98129 40
e70bb2e8
JH		 41static const u16 mgmt_commands[] = {
42 MGMT_OP_READ_INDEX_LIST,
43 MGMT_OP_READ_INFO,
44 MGMT_OP_SET_POWERED,
45 MGMT_OP_SET_DISCOVERABLE,
46 MGMT_OP_SET_CONNECTABLE,
47 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 48 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 49 MGMT_OP_SET_LINK_SECURITY,
50 MGMT_OP_SET_SSP,
51 MGMT_OP_SET_HS,
52 MGMT_OP_SET_LE,
53 MGMT_OP_SET_DEV_CLASS,
54 MGMT_OP_SET_LOCAL_NAME,
55 MGMT_OP_ADD_UUID,
56 MGMT_OP_REMOVE_UUID,
57 MGMT_OP_LOAD_LINK_KEYS,
58 MGMT_OP_LOAD_LONG_TERM_KEYS,
59 MGMT_OP_DISCONNECT,
60 MGMT_OP_GET_CONNECTIONS,
61 MGMT_OP_PIN_CODE_REPLY,
62 MGMT_OP_PIN_CODE_NEG_REPLY,
63 MGMT_OP_SET_IO_CAPABILITY,
64 MGMT_OP_PAIR_DEVICE,
65 MGMT_OP_CANCEL_PAIR_DEVICE,
66 MGMT_OP_UNPAIR_DEVICE,
67 MGMT_OP_USER_CONFIRM_REPLY,
68 MGMT_OP_USER_CONFIRM_NEG_REPLY,
69 MGMT_OP_USER_PASSKEY_REPLY,
70 MGMT_OP_USER_PASSKEY_NEG_REPLY,
71 MGMT_OP_READ_LOCAL_OOB_DATA,
72 MGMT_OP_ADD_REMOTE_OOB_DATA,
73 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
74 MGMT_OP_START_DISCOVERY,
75 MGMT_OP_STOP_DISCOVERY,
76 MGMT_OP_CONFIRM_NAME,
77 MGMT_OP_BLOCK_DEVICE,
78 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 79 MGMT_OP_SET_DEVICE_ID,
4375f103 80 MGMT_OP_SET_ADVERTISING,
0663ca2a 81 MGMT_OP_SET_BREDR,
d13eafce 82 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 83 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 84 MGMT_OP_SET_SECURE_CONN,
4e39ac81 85 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 86 MGMT_OP_SET_PRIVACY,
41edf160 87 MGMT_OP_LOAD_IRKS,
dd983808 88 MGMT_OP_GET_CONN_INFO,
95868426 89 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 90 MGMT_OP_ADD_DEVICE,
91 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 92 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 93 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 94 MGMT_OP_READ_CONFIG_INFO,
dbece37a 95 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 96 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 97 MGMT_OP_START_SERVICE_DISCOVERY,
e70bb2e8
JH		 98};
99
100static const u16 mgmt_events[] = {
101 MGMT_EV_CONTROLLER_ERROR,
102 MGMT_EV_INDEX_ADDED,
103 MGMT_EV_INDEX_REMOVED,
104 MGMT_EV_NEW_SETTINGS,
105 MGMT_EV_CLASS_OF_DEV_CHANGED,
106 MGMT_EV_LOCAL_NAME_CHANGED,
107 MGMT_EV_NEW_LINK_KEY,
108 MGMT_EV_NEW_LONG_TERM_KEY,
109 MGMT_EV_DEVICE_CONNECTED,
110 MGMT_EV_DEVICE_DISCONNECTED,
111 MGMT_EV_CONNECT_FAILED,
112 MGMT_EV_PIN_CODE_REQUEST,
113 MGMT_EV_USER_CONFIRM_REQUEST,
114 MGMT_EV_USER_PASSKEY_REQUEST,
115 MGMT_EV_AUTH_FAILED,
116 MGMT_EV_DEVICE_FOUND,
117 MGMT_EV_DISCOVERING,
118 MGMT_EV_DEVICE_BLOCKED,
119 MGMT_EV_DEVICE_UNBLOCKED,
120 MGMT_EV_DEVICE_UNPAIRED,
92a25256 121 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 122 MGMT_EV_NEW_IRK,
7ee4ea36 123 MGMT_EV_NEW_CSRK,
8afef092
MH		 124 MGMT_EV_DEVICE_ADDED,
125 MGMT_EV_DEVICE_REMOVED,
ffb5a827 126 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 127 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 128 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 129 MGMT_EV_NEW_CONFIG_OPTIONS,
e70bb2e8
JH		 130};
131
17b02e62 132#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 133
d25b78e2
JH		 134#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
135 "\x00\x00\x00\x00\x00\x00\x00\x00"
136
eec8d2bc
JH		 137struct pending_cmd {
138 struct list_head list;
fc2f4b13 139 u16 opcode;
eec8d2bc 140 int index;
c68fb7ff 141 void *param;
323b0b88 142 size_t param_len;
eec8d2bc 143 struct sock *sk;
e9a416b5 144 void *user_data;
9df74653 145 int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
eec8d2bc
JH		 146};
147
ca69b795
JH		 148/* HCI to MGMT error code conversion table */
149static u8 mgmt_status_table[] = {
150 MGMT_STATUS_SUCCESS,
151 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
152 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
153 MGMT_STATUS_FAILED, /* Hardware Failure */
154 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
155 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 156 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 157 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
158 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
159 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
160 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
161 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
162 MGMT_STATUS_BUSY, /* Command Disallowed */
163 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
164 MGMT_STATUS_REJECTED, /* Rejected Security */
165 MGMT_STATUS_REJECTED, /* Rejected Personal */
166 MGMT_STATUS_TIMEOUT, /* Host Timeout */
167 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
168 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
169 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
170 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
171 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
172 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
173 MGMT_STATUS_BUSY, /* Repeated Attempts */
174 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
175 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
176 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
177 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
178 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
179 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
180 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
181 MGMT_STATUS_FAILED, /* Unspecified Error */
182 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
183 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
184 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
185 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
186 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
187 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
188 MGMT_STATUS_FAILED, /* Unit Link Key Used */
189 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
190 MGMT_STATUS_TIMEOUT, /* Instant Passed */
191 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
192 MGMT_STATUS_FAILED, /* Transaction Collision */
193 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
194 MGMT_STATUS_REJECTED, /* QoS Rejected */
195 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
196 MGMT_STATUS_REJECTED, /* Insufficient Security */
197 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
198 MGMT_STATUS_BUSY, /* Role Switch Pending */
199 MGMT_STATUS_FAILED, /* Slot Violation */
200 MGMT_STATUS_FAILED, /* Role Switch Failed */
201 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
202 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
203 MGMT_STATUS_BUSY, /* Host Busy Pairing */
204 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
205 MGMT_STATUS_BUSY, /* Controller Busy */
206 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
207 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
208 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
209 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
210 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
211};
212
213static u8 mgmt_status(u8 hci_status)
214{
215 if (hci_status < ARRAY_SIZE(mgmt_status_table))
216 return mgmt_status_table[hci_status];
217
218 return MGMT_STATUS_FAILED;
219}
220
04c60f05
MH		 221static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
222 struct sock *skip_sk)
223{
224 struct sk_buff *skb;
225 struct mgmt_hdr *hdr;
226
227 skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
228 if (!skb)
229 return -ENOMEM;
230
231 hdr = (void *) skb_put(skb, sizeof(*hdr));
232 hdr->opcode = cpu_to_le16(event);
233 if (hdev)
234 hdr->index = cpu_to_le16(hdev->id);
235 else
236 hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
237 hdr->len = cpu_to_le16(data_len);
238
239 if (data)
240 memcpy(skb_put(skb, data_len), data, data_len);
241
242 /* Time stamp */
243 __net_timestamp(skb);
244
245 hci_send_to_control(skb, skip_sk);
246 kfree_skb(skb);
247
248 return 0;
249}
250
4e51eae9 251static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
f7b64e69
JH		 252{
253 struct sk_buff *skb;
254 struct mgmt_hdr *hdr;
255 struct mgmt_ev_cmd_status *ev;
56b7d137 256 int err;
f7b64e69 257
34eb525c 258 BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
f7b64e69 259
790eff44 260 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
f7b64e69
JH		 261 if (!skb)
262 return -ENOMEM;
263
264 hdr = (void *) skb_put(skb, sizeof(*hdr));
265
dcf4adbf 266 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
4e51eae9 267 hdr->index = cpu_to_le16(index);
f7b64e69
JH		 268 hdr->len = cpu_to_le16(sizeof(*ev));
269
270 ev = (void *) skb_put(skb, sizeof(*ev));
271 ev->status = status;
eb55ef07 272 ev->opcode = cpu_to_le16(cmd);
f7b64e69 273
56b7d137
GP		 274 err = sock_queue_rcv_skb(sk, skb);
275 if (err < 0)
f7b64e69
JH		 276 kfree_skb(skb);
277
56b7d137 278 return err;
f7b64e69
JH		 279}
280
aee9b218 281static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
04124681 282 void *rp, size_t rp_len)
02d98129
JH		 283{
284 struct sk_buff *skb;
285 struct mgmt_hdr *hdr;
286 struct mgmt_ev_cmd_complete *ev;
56b7d137 287 int err;
02d98129
JH		 288
289 BT_DBG("sock %p", sk);
290
790eff44 291 skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
02d98129
JH		 292 if (!skb)
293 return -ENOMEM;
294
295 hdr = (void *) skb_put(skb, sizeof(*hdr));
02d98129 296
dcf4adbf 297 hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
4e51eae9 298 hdr->index = cpu_to_le16(index);
a38528f1 299 hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
02d98129 300
a38528f1 301 ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
eb55ef07 302 ev->opcode = cpu_to_le16(cmd);
aee9b218 303 ev->status = status;
8020c16a
SJ		 304
305 if (rp)
306 memcpy(ev->data, rp, rp_len);
02d98129 307
56b7d137
GP		 308 err = sock_queue_rcv_skb(sk, skb);
309 if (err < 0)
02d98129
JH		 310 kfree_skb(skb);
311
e5f0e151 312 return err;
02d98129
JH		 313}
314
04124681
GP		 315static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
316 u16 data_len)
a38528f1
JH		 317{
318 struct mgmt_rp_read_version rp;
319
320 BT_DBG("sock %p", sk);
321
322 rp.version = MGMT_VERSION;
dcf4adbf 323 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 324
aee9b218 325 return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
04124681 326 sizeof(rp));
a38528f1
JH		 327}
328
04124681
GP		 329static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
330 u16 data_len)
e70bb2e8
JH		 331{
332 struct mgmt_rp_read_commands *rp;
eb55ef07
MH		 333 const u16 num_commands = ARRAY_SIZE(mgmt_commands);
334 const u16 num_events = ARRAY_SIZE(mgmt_events);
2e3c35ea 335 __le16 *opcode;
e70bb2e8
JH		 336 size_t rp_size;
337 int i, err;
338
339 BT_DBG("sock %p", sk);
340
341 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
342
343 rp = kmalloc(rp_size, GFP_KERNEL);
344 if (!rp)
345 return -ENOMEM;
346
dcf4adbf
JP		 347 rp->num_commands = cpu_to_le16(num_commands);
348 rp->num_events = cpu_to_le16(num_events);
e70bb2e8
JH		 349
350 for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
351 put_unaligned_le16(mgmt_commands[i], opcode);
352
353 for (i = 0; i < num_events; i++, opcode++)
354 put_unaligned_le16(mgmt_events[i], opcode);
355
aee9b218 356 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
04124681 357 rp_size);
e70bb2e8
JH		 358 kfree(rp);
359
360 return err;
361}
362
04124681
GP		 363static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
364 u16 data_len)
faba42eb 365{
faba42eb 366 struct mgmt_rp_read_index_list *rp;
8035ded4 367 struct hci_dev *d;
a38528f1 368 size_t rp_len;
faba42eb 369 u16 count;
476e44cb 370 int err;
faba42eb
JH		 371
372 BT_DBG("sock %p", sk);
373
374 read_lock(&hci_dev_list_lock);
375
376 count = 0;
bb4b2a9a 377 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a
MH		 378 if (d->dev_type == HCI_BREDR &&
379 !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
1514b892 380 count++;
faba42eb
JH		 381 }
382
a38528f1
JH		 383 rp_len = sizeof(*rp) + (2 * count);
384 rp = kmalloc(rp_len, GFP_ATOMIC);
385 if (!rp) {
b2c60d42 386 read_unlock(&hci_dev_list_lock);
faba42eb 387 return -ENOMEM;
b2c60d42 388 }
faba42eb 389
476e44cb 390 count = 0;
8035ded4 391 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 392 if (test_bit(HCI_SETUP, &d->dev_flags) ||
d603b76b 393 test_bit(HCI_CONFIG, &d->dev_flags) ||
73d1df2a 394 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
ab81cbf9
JH		 395 continue;
396
73d1df2a
MH		 397 /* Devices marked as raw-only are neither configured
398 * nor unconfigured controllers.
399 */
400 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 401 continue;
402
73d1df2a
MH		 403 if (d->dev_type == HCI_BREDR &&
404 !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
1514b892
MH		 405 rp->index[count++] = cpu_to_le16(d->id);
406 BT_DBG("Added hci%u", d->id);
407 }
faba42eb
JH		 408 }
409
476e44cb
JH		 410 rp->num_controllers = cpu_to_le16(count);
411 rp_len = sizeof(*rp) + (2 * count);
412
faba42eb
JH		 413 read_unlock(&hci_dev_list_lock);
414
aee9b218 415 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
04124681 416 rp_len);
faba42eb 417
a38528f1
JH		 418 kfree(rp);
419
420 return err;
faba42eb
JH		 421}
422
73d1df2a
MH		 423static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
424 void *data, u16 data_len)
425{
426 struct mgmt_rp_read_unconf_index_list *rp;
427 struct hci_dev *d;
428 size_t rp_len;
429 u16 count;
430 int err;
431
432 BT_DBG("sock %p", sk);
433
434 read_lock(&hci_dev_list_lock);
435
436 count = 0;
437 list_for_each_entry(d, &hci_dev_list, list) {
438 if (d->dev_type == HCI_BREDR &&
439 test_bit(HCI_UNCONFIGURED, &d->dev_flags))
440 count++;
441 }
442
443 rp_len = sizeof(*rp) + (2 * count);
444 rp = kmalloc(rp_len, GFP_ATOMIC);
445 if (!rp) {
446 read_unlock(&hci_dev_list_lock);
447 return -ENOMEM;
448 }
449
450 count = 0;
451 list_for_each_entry(d, &hci_dev_list, list) {
452 if (test_bit(HCI_SETUP, &d->dev_flags) ||
d603b76b 453 test_bit(HCI_CONFIG, &d->dev_flags) ||
73d1df2a
MH		 454 test_bit(HCI_USER_CHANNEL, &d->dev_flags))
455 continue;
456
457 /* Devices marked as raw-only are neither configured
458 * nor unconfigured controllers.
459 */
460 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
461 continue;
462
463 if (d->dev_type == HCI_BREDR &&
464 test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
465 rp->index[count++] = cpu_to_le16(d->id);
466 BT_DBG("Added hci%u", d->id);
467 }
468 }
469
470 rp->num_controllers = cpu_to_le16(count);
471 rp_len = sizeof(*rp) + (2 * count);
472
473 read_unlock(&hci_dev_list_lock);
474
475 err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
476 0, rp, rp_len);
477
478 kfree(rp);
479
480 return err;
481}
482
dbece37a
MH		 483static bool is_configured(struct hci_dev *hdev)
484{
485 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
486 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
487 return false;
488
489 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
490 !bacmp(&hdev->public_addr, BDADDR_ANY))
491 return false;
492
493 return true;
494}
495
89bc22d2
MH		 496static __le32 get_missing_options(struct hci_dev *hdev)
497{
498 u32 options = 0;
499
dbece37a
MH		 500 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
501 !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
eb1904f4
MH		 502 options |= MGMT_OPTION_EXTERNAL_CONFIG;
503
89bc22d2
MH		 504 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
505 !bacmp(&hdev->public_addr, BDADDR_ANY))
506 options |= MGMT_OPTION_PUBLIC_ADDRESS;
507
508 return cpu_to_le32(options);
509}
510
f4537c04
MH		 511static int new_options(struct hci_dev *hdev, struct sock *skip)
512{
513 __le32 options = get_missing_options(hdev);
514
515 return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
516 sizeof(options), skip);
517}
518
dbece37a
MH		 519static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
520{
521 __le32 options = get_missing_options(hdev);
522
523 return cmd_complete(sk, hdev->id, opcode, 0, &options,
524 sizeof(options));
525}
526
9fc3bfb6
MH		 527static int read_config_info(struct sock *sk, struct hci_dev *hdev,
528 void *data, u16 data_len)
529{
530 struct mgmt_rp_read_config_info rp;
89bc22d2 531 u32 options = 0;
9fc3bfb6
MH		 532
533 BT_DBG("sock %p %s", sk, hdev->name);
534
535 hci_dev_lock(hdev);
536
537 memset(&rp, 0, sizeof(rp));
538 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 539
eb1904f4
MH		 540 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
541 options |= MGMT_OPTION_EXTERNAL_CONFIG;
542
9fc3bfb6 543 if (hdev->set_bdaddr)
89bc22d2
MH		 544 options |= MGMT_OPTION_PUBLIC_ADDRESS;
545
546 rp.supported_options = cpu_to_le32(options);
547 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 548
549 hci_dev_unlock(hdev);
550
551 return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
552 sizeof(rp));
553}
554
69ab39ea
JH		 555static u32 get_supported_settings(struct hci_dev *hdev)
556{
557 u32 settings = 0;
558
559 settings |= MGMT_SETTING_POWERED;
b2939475 560 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 561 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 562 settings |= MGMT_SETTING_CONNECTABLE;
563 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 564
ed3fa31f 565 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 566 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
567 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 568 settings |= MGMT_SETTING_BREDR;
569 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 570
571 if (lmp_ssp_capable(hdev)) {
572 settings |= MGMT_SETTING_SSP;
573 settings |= MGMT_SETTING_HS;
574 }
e98d2ce2 575
05b3c3e7 576 if (lmp_sc_capable(hdev))
e98d2ce2 577 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 578 }
d7b7e796 579
eeca6f89 580 if (lmp_le_capable(hdev)) {
9d42820f 581 settings |= MGMT_SETTING_LE;
eeca6f89 582 settings |= MGMT_SETTING_ADVERTISING;
a3209694 583 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 584 settings |= MGMT_SETTING_PRIVACY;
eeca6f89 585 }
69ab39ea 586
eb1904f4
MH		 587 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
588 hdev->set_bdaddr)
9fc3bfb6
MH		 589 settings |= MGMT_SETTING_CONFIGURATION;
590
69ab39ea
JH		 591 return settings;
592}
593
594static u32 get_current_settings(struct hci_dev *hdev)
595{
596 u32 settings = 0;
597
f1f0eb02 598 if (hdev_is_powered(hdev))
f0d4b78a
MH		 599 settings |= MGMT_SETTING_POWERED;
600
5e5282bb 601 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
69ab39ea
JH		 602 settings |= MGMT_SETTING_CONNECTABLE;
603
1a4d3c4b
JH		 604 if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
605 settings |= MGMT_SETTING_FAST_CONNECTABLE;
606
5e5282bb 607 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
69ab39ea
JH		 608 settings |= MGMT_SETTING_DISCOVERABLE;
609
b6ae8457 610 if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
b2939475 611 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 612
56f87901 613 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 614 settings |= MGMT_SETTING_BREDR;
615
06199cf8 616 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 617 settings |= MGMT_SETTING_LE;
618
47990ea0 619 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
69ab39ea
JH		 620 settings |= MGMT_SETTING_LINK_SECURITY;
621
84bde9d6 622 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
69ab39ea
JH		 623 settings |= MGMT_SETTING_SSP;
624
6d80dfd0
JH		 625 if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
626 settings |= MGMT_SETTING_HS;
627
f3d3444a 628 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
eeca6f89
JH		 629 settings |= MGMT_SETTING_ADVERTISING;
630
e98d2ce2
MH		 631 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
632 settings |= MGMT_SETTING_SECURE_CONN;
633
0663b297 634 if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
b1de97d8
MH		 635 settings |= MGMT_SETTING_DEBUG_KEYS;
636
0f4bd942
JH		 637 if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
638 settings |= MGMT_SETTING_PRIVACY;
639
69ab39ea
JH		 640 return settings;
641}
642
ef580372
JH		 643#define PNP_INFO_SVCLASS_ID 0x1200
644
213202ed
JH		 645static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
646{
647 u8 *ptr = data, *uuids_start = NULL;
648 struct bt_uuid *uuid;
649
650 if (len < 4)
651 return ptr;
652
653 list_for_each_entry(uuid, &hdev->uuids, list) {
654 u16 uuid16;
655
656 if (uuid->size != 16)
657 continue;
658
659 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
660 if (uuid16 < 0x1100)
661 continue;
662
663 if (uuid16 == PNP_INFO_SVCLASS_ID)
664 continue;
665
666 if (!uuids_start) {
667 uuids_start = ptr;
668 uuids_start[0] = 1;
669 uuids_start[1] = EIR_UUID16_ALL;
670 ptr += 2;
671 }
672
673 /* Stop if not enough space to put next UUID */
674 if ((ptr - data) + sizeof(u16) > len) {
675 uuids_start[1] = EIR_UUID16_SOME;
676 break;
677 }
678
679 *ptr++ = (uuid16 & 0x00ff);
680 *ptr++ = (uuid16 & 0xff00) >> 8;
681 uuids_start[0] += sizeof(uuid16);
682 }
683
684 return ptr;
685}
686
cdf1963f
JH		 687static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
688{
689 u8 *ptr = data, *uuids_start = NULL;
690 struct bt_uuid *uuid;
691
692 if (len < 6)
693 return ptr;
694
695 list_for_each_entry(uuid, &hdev->uuids, list) {
696 if (uuid->size != 32)
697 continue;
698
699 if (!uuids_start) {
700 uuids_start = ptr;
701 uuids_start[0] = 1;
702 uuids_start[1] = EIR_UUID32_ALL;
703 ptr += 2;
704 }
705
706 /* Stop if not enough space to put next UUID */
707 if ((ptr - data) + sizeof(u32) > len) {
708 uuids_start[1] = EIR_UUID32_SOME;
709 break;
710 }
711
712 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
713 ptr += sizeof(u32);
714 uuids_start[0] += sizeof(u32);
715 }
716
717 return ptr;
718}
719
c00d575b
JH		 720static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
721{
722 u8 *ptr = data, *uuids_start = NULL;
723 struct bt_uuid *uuid;
724
725 if (len < 18)
726 return ptr;
727
728 list_for_each_entry(uuid, &hdev->uuids, list) {
729 if (uuid->size != 128)
730 continue;
731
732 if (!uuids_start) {
733 uuids_start = ptr;
734 uuids_start[0] = 1;
735 uuids_start[1] = EIR_UUID128_ALL;
736 ptr += 2;
737 }
738
739 /* Stop if not enough space to put next UUID */
740 if ((ptr - data) + 16 > len) {
741 uuids_start[1] = EIR_UUID128_SOME;
742 break;
743 }
744
745 memcpy(ptr, uuid->uuid, 16);
746 ptr += 16;
747 uuids_start[0] += 16;
748 }
749
750 return ptr;
751}
752
eb2a8d20
JH		 753static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
754{
755 struct pending_cmd *cmd;
756
757 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
758 if (cmd->opcode == opcode)
759 return cmd;
760 }
761
762 return NULL;
763}
764
95868426
JH		 765static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
766 struct hci_dev *hdev,
767 const void *data)
768{
769 struct pending_cmd *cmd;
770
771 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
772 if (cmd->user_data != data)
773 continue;
774 if (cmd->opcode == opcode)
775 return cmd;
776 }
777
778 return NULL;
779}
780
f14d8f64
MH		 781static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
782{
7a5f4990
MH		 783 u8 ad_len = 0;
784 size_t name_len;
785
786 name_len = strlen(hdev->dev_name);
787 if (name_len > 0) {
788 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
789
790 if (name_len > max_len) {
791 name_len = max_len;
792 ptr[1] = EIR_NAME_SHORT;
793 } else
794 ptr[1] = EIR_NAME_COMPLETE;
795
796 ptr[0] = name_len + 1;
797
798 memcpy(ptr + 2, hdev->dev_name, name_len);
799
800 ad_len += (name_len + 2);
801 ptr += (name_len + 2);
802 }
803
804 return ad_len;
f14d8f64
MH		 805}
806
807static void update_scan_rsp_data(struct hci_request *req)
808{
809 struct hci_dev *hdev = req->hdev;
810 struct hci_cp_le_set_scan_rsp_data cp;
811 u8 len;
812
7751ef1b 813 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
f14d8f64
MH		 814 return;
815
816 memset(&cp, 0, sizeof(cp));
817
818 len = create_scan_rsp_data(hdev, cp.data);
819
eb438b5f
JH		 820 if (hdev->scan_rsp_data_len == len &&
821 memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
f14d8f64
MH		 822 return;
823
eb438b5f
JH		 824 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
825 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 826
827 cp.length = len;
828
829 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
830}
831
9a43e25f
JH		 832static u8 get_adv_discov_flags(struct hci_dev *hdev)
833{
834 struct pending_cmd *cmd;
835
836 /* If there's a pending mgmt command the flags will not yet have
837 * their final values, so check for this first.
838 */
839 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
840 if (cmd) {
841 struct mgmt_mode *cp = cmd->param;
842 if (cp->val == 0x01)
843 return LE_AD_GENERAL;
844 else if (cp->val == 0x02)
845 return LE_AD_LIMITED;
846 } else {
847 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
848 return LE_AD_LIMITED;
849 else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
850 return LE_AD_GENERAL;
851 }
852
853 return 0;
854}
855
46cad2ed 856static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
441ad2d0
MH		 857{
858 u8 ad_len = 0, flags = 0;
441ad2d0 859
9a43e25f 860 flags |= get_adv_discov_flags(hdev);
441ad2d0 861
e834004b 862 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
441ad2d0 863 flags |= LE_AD_NO_BREDR;
441ad2d0
MH		 864
865 if (flags) {
866 BT_DBG("adv flags 0x%02x", flags);
867
868 ptr[0] = 2;
869 ptr[1] = EIR_FLAGS;
870 ptr[2] = flags;
871
872 ad_len += 3;
873 ptr += 3;
874 }
875
876 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
877 ptr[0] = 2;
878 ptr[1] = EIR_TX_POWER;
879 ptr[2] = (u8) hdev->adv_tx_power;
880
881 ad_len += 3;
882 ptr += 3;
883 }
884
441ad2d0
MH		 885 return ad_len;
886}
887
5947f4bc 888static void update_adv_data(struct hci_request *req)
441ad2d0
MH		 889{
890 struct hci_dev *hdev = req->hdev;
891 struct hci_cp_le_set_adv_data cp;
892 u8 len;
893
10994ce6 894 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
441ad2d0
MH		 895 return;
896
897 memset(&cp, 0, sizeof(cp));
898
46cad2ed 899 len = create_adv_data(hdev, cp.data);
441ad2d0
MH		 900
901 if (hdev->adv_data_len == len &&
902 memcmp(cp.data, hdev->adv_data, len) == 0)
903 return;
904
905 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
906 hdev->adv_data_len = len;
907
908 cp.length = len;
909
910 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
911}
912
bc6d2d04
JH		 913int mgmt_update_adv_data(struct hci_dev *hdev)
914{
915 struct hci_request req;
916
917 hci_req_init(&req, hdev);
918 update_adv_data(&req);
919
920 return hci_req_run(&req, NULL);
921}
922
ef580372
JH		 923static void create_eir(struct hci_dev *hdev, u8 *data)
924{
925 u8 *ptr = data;
ef580372
JH		 926 size_t name_len;
927
928 name_len = strlen(hdev->dev_name);
929
930 if (name_len > 0) {
931 /* EIR Data type */
932 if (name_len > 48) {
933 name_len = 48;
934 ptr[1] = EIR_NAME_SHORT;
935 } else
936 ptr[1] = EIR_NAME_COMPLETE;
937
938 /* EIR Data length */
939 ptr[0] = name_len + 1;
940
941 memcpy(ptr + 2, hdev->dev_name, name_len);
942
ef580372
JH		 943 ptr += (name_len + 2);
944 }
945
bbaf444a 946 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 947 ptr[0] = 2;
948 ptr[1] = EIR_TX_POWER;
949 ptr[2] = (u8) hdev->inq_tx_power;
950
91c4e9b1
MH		 951 ptr += 3;
952 }
953
2b9be137
MH		 954 if (hdev->devid_source > 0) {
955 ptr[0] = 9;
956 ptr[1] = EIR_DEVICE_ID;
957
958 put_unaligned_le16(hdev->devid_source, ptr + 2);
959 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
960 put_unaligned_le16(hdev->devid_product, ptr + 6);
961 put_unaligned_le16(hdev->devid_version, ptr + 8);
962
2b9be137
MH		 963 ptr += 10;
964 }
965
213202ed 966 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 967 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 968 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 969}
970
890ea898 971static void update_eir(struct hci_request *req)
ef580372 972{
890ea898 973 struct hci_dev *hdev = req->hdev;
ef580372
JH		 974 struct hci_cp_write_eir cp;
975
504c8dcd 976 if (!hdev_is_powered(hdev))
890ea898 977 return;
7770c4aa 978
976eb20e 979 if (!lmp_ext_inq_capable(hdev))
890ea898 980 return;
ef580372 981
84bde9d6 982 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
890ea898 983 return;
ef580372 984
a8b2d5c2 985 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 986 return;
ef580372
JH		 987
988 memset(&cp, 0, sizeof(cp));
989
990 create_eir(hdev, cp.data);
991
992 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 993 return;
ef580372
JH		 994
995 memcpy(hdev->eir, cp.data, sizeof(cp.data));
996
890ea898 997 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 998}
999
1000static u8 get_service_classes(struct hci_dev *hdev)
1001{
1002 struct bt_uuid *uuid;
1003 u8 val = 0;
1004
1005 list_for_each_entry(uuid, &hdev->uuids, list)
1006 val |= uuid->svc_hint;
1007
1008 return val;
1009}
1010
890ea898 1011static void update_class(struct hci_request *req)
ef580372 1012{
890ea898 1013 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1014 u8 cod[3];
1015
1016 BT_DBG("%s", hdev->name);
1017
504c8dcd 1018 if (!hdev_is_powered(hdev))
890ea898 1019 return;
7770c4aa 1020
f87ea1da
JH		 1021 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1022 return;
1023
a8b2d5c2 1024 if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
890ea898 1025 return;
ef580372
JH		 1026
1027 cod[0] = hdev->minor_class;
1028 cod[1] = hdev->major_class;
1029 cod[2] = get_service_classes(hdev);
1030
6acd7db4
MH		 1031 if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
1032 cod[1] |= 0x20;
1033
ef580372 1034 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1035 return;
ef580372 1036
890ea898 1037 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1038}
1039
a4858cb9 1040static bool get_connectable(struct hci_dev *hdev)
199a2fb1
JH		 1041{
1042 struct pending_cmd *cmd;
199a2fb1
JH		 1043
1044 /* If there's a pending mgmt command the flag will not yet have
1045 * it's final value, so check for this first.
1046 */
1047 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1048 if (cmd) {
1049 struct mgmt_mode *cp = cmd->param;
a4858cb9 1050 return cp->val;
199a2fb1
JH		 1051 }
1052
a4858cb9 1053 return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
199a2fb1
JH		 1054}
1055
0ec5ae84
JH		 1056static void disable_advertising(struct hci_request *req)
1057{
1058 u8 enable = 0x00;
1059
1060 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1061}
1062
199a2fb1
JH		 1063static void enable_advertising(struct hci_request *req)
1064{
1065 struct hci_dev *hdev = req->hdev;
1066 struct hci_cp_le_set_adv_param cp;
8f2a0601 1067 u8 own_addr_type, enable = 0x01;
a4858cb9 1068 bool connectable;
199a2fb1 1069
0ec5ae84
JH		 1070 if (hci_conn_num(hdev, LE_LINK) > 0)
1071 return;
1072
1073 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
1074 disable_advertising(req);
1075
5ce194c4 1076 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1077 * hci_update_random_address knows that it's safe to go ahead
1078 * and write a new random address. The flag will be set back on
1079 * as soon as the SET_ADV_ENABLE HCI command completes.
1080 */
5ce194c4 1081 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
8d97250e 1082
a4858cb9 1083 connectable = get_connectable(hdev);
8f2a0601 1084
a4858cb9
JH		 1085 /* Set require_privacy to true only when non-connectable
1086 * advertising is used. In that case it is fine to use a
1087 * non-resolvable private address.
1088 */
1089 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1090 return;
1091
41c90c18 1092 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1093 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1094 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
a4858cb9 1095 cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
8f2a0601 1096 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1097 cp.channel_map = hdev->le_adv_channel_map;
1098
1099 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1100
1101 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1102}
1103
7d78525d
JH		 1104static void service_cache_off(struct work_struct *work)
1105{
1106 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1107 service_cache.work);
890ea898 1108 struct hci_request req;
7d78525d 1109
a8b2d5c2 1110 if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1111 return;
1112
890ea898
JH		 1113 hci_req_init(&req, hdev);
1114
7d78525d
JH		 1115 hci_dev_lock(hdev);
1116
890ea898
JH		 1117 update_eir(&req);
1118 update_class(&req);
7d78525d
JH		 1119
1120 hci_dev_unlock(hdev);
890ea898
JH		 1121
1122 hci_req_run(&req, NULL);
7d78525d
JH		 1123}
1124
d6bfd59c
JH		 1125static void rpa_expired(struct work_struct *work)
1126{
1127 struct hci_dev *hdev = container_of(work, struct hci_dev,
1128 rpa_expired.work);
1129 struct hci_request req;
1130
1131 BT_DBG("");
1132
1133 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1134
0ec5ae84 1135 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
d6bfd59c
JH		 1136 return;
1137
1138 /* The generation of a new RPA and programming it into the
1139 * controller happens in the enable_advertising() function.
1140 */
d6bfd59c 1141 hci_req_init(&req, hdev);
d6bfd59c 1142 enable_advertising(&req);
d6bfd59c
JH		 1143 hci_req_run(&req, NULL);
1144}
1145
6a919082 1146static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1147{
4f87da80 1148 if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
6a919082
JH		 1149 return;
1150
4f87da80 1151 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1152 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1153
4f87da80
JH		 1154 /* Non-mgmt controlled devices get this bit set
1155 * implicitly so that pairing works for them, however
1156 * for mgmt we require user-space to explicitly enable
1157 * it
1158 */
b6ae8457 1159 clear_bit(HCI_BONDABLE, &hdev->dev_flags);
7d78525d
JH		 1160}
1161
0f4e68cf 1162static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1163 void *data, u16 data_len)
0381101f 1164{
a38528f1 1165 struct mgmt_rp_read_info rp;
f7b64e69 1166
bdb6d971 1167 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1168
09fd0de5 1169 hci_dev_lock(hdev);
f7b64e69 1170
dc4fe30b
JH		 1171 memset(&rp, 0, sizeof(rp));
1172
69ab39ea 1173 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1174
69ab39ea 1175 rp.version = hdev->hci_ver;
eb55ef07 1176 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1177
1178 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1179 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1180
a38528f1 1181 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1182
dc4fe30b 1183 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1184 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1185
09fd0de5 1186 hci_dev_unlock(hdev);
0381101f 1187
bdb6d971 1188 return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
04124681 1189 sizeof(rp));
0381101f
JH		 1190}
1191
eec8d2bc
JH		 1192static void mgmt_pending_free(struct pending_cmd *cmd)
1193{
1194 sock_put(cmd->sk);
c68fb7ff 1195 kfree(cmd->param);
eec8d2bc
JH		 1196 kfree(cmd);
1197}
1198
366a0336 1199static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
04124681
GP		 1200 struct hci_dev *hdev, void *data,
1201 u16 len)
eec8d2bc
JH		 1202{
1203 struct pending_cmd *cmd;
1204
fca20018 1205 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
eec8d2bc 1206 if (!cmd)
366a0336 1207 return NULL;
eec8d2bc
JH		 1208
1209 cmd->opcode = opcode;
2e58ef3e 1210 cmd->index = hdev->id;
eec8d2bc 1211
323b0b88 1212 cmd->param = kmemdup(data, len, GFP_KERNEL);
c68fb7ff 1213 if (!cmd->param) {
eec8d2bc 1214 kfree(cmd);
366a0336 1215 return NULL;
eec8d2bc
JH		 1216 }
1217
323b0b88 1218 cmd->param_len = len;
eec8d2bc
JH		 1219
1220 cmd->sk = sk;
1221 sock_hold(sk);
1222
2e58ef3e 1223 list_add(&cmd->list, &hdev->mgmt_pending);
eec8d2bc 1224
366a0336 1225 return cmd;
eec8d2bc
JH		 1226}
1227
744cf19e 1228static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
8fc9ced3
GP		 1229 void (*cb)(struct pending_cmd *cmd,
1230 void *data),
04124681 1231 void *data)
eec8d2bc 1232{
a3d09356 1233 struct pending_cmd *cmd, *tmp;
eec8d2bc 1234
a3d09356 1235 list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
b24752fe 1236 if (opcode > 0 && cmd->opcode != opcode)
eec8d2bc
JH		 1237 continue;
1238
eec8d2bc
JH		 1239 cb(cmd, data);
1240 }
1241}
1242
a664b5bc 1243static void mgmt_pending_remove(struct pending_cmd *cmd)
73f22f62 1244{
73f22f62
JH		 1245 list_del(&cmd->list);
1246 mgmt_pending_free(cmd);
1247}
1248
69ab39ea 1249static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1250{
69ab39ea 1251 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1252
aee9b218 1253 return cmd_complete(sk, hdev->id, opcode, 0, &settings,
04124681 1254 sizeof(settings));
8680570b
JH		 1255}
1256
1904a853 1257static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1258{
1259 BT_DBG("%s status 0x%02x", hdev->name, status);
1260
a3172b7e
JH		 1261 if (hci_conn_count(hdev) == 0) {
1262 cancel_delayed_work(&hdev->power_off);
8b064a3a 1263 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1264 }
8b064a3a
JH		 1265}
1266
23a48093 1267static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1268{
1269 struct hci_dev *hdev = req->hdev;
1270 struct hci_cp_remote_name_req_cancel cp;
1271 struct inquiry_entry *e;
1272
1273 switch (hdev->discovery.state) {
1274 case DISCOVERY_FINDING:
1275 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
1276 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
1277 } else {
1278 cancel_delayed_work(&hdev->le_scan_disable);
1279 hci_req_add_le_scan_disable(req);
1280 }
1281
23a48093 1282 return true;
21a60d30
JH		 1283
1284 case DISCOVERY_RESOLVING:
1285 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1286 NAME_PENDING);
1287 if (!e)
23a48093 1288 break;
21a60d30
JH		 1289
1290 bacpy(&cp.bdaddr, &e->data.bdaddr);
1291 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1292 &cp);
1293
23a48093 1294 return true;
21a60d30
JH		 1295
1296 default:
1297 /* Passive scanning */
23a48093 1298 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
21a60d30 1299 hci_req_add_le_scan_disable(req);
23a48093
JH		 1300 return true;
1301 }
1302
21a60d30
JH		 1303 break;
1304 }
23a48093
JH		 1305
1306 return false;
21a60d30
JH		 1307}
1308
8b064a3a
JH		 1309static int clean_up_hci_state(struct hci_dev *hdev)
1310{
1311 struct hci_request req;
1312 struct hci_conn *conn;
23a48093
JH		 1313 bool discov_stopped;
1314 int err;
8b064a3a
JH		 1315
1316 hci_req_init(&req, hdev);
1317
1318 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1319 test_bit(HCI_PSCAN, &hdev->flags)) {
1320 u8 scan = 0x00;
1321 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1322 }
1323
73e082f8 1324 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
8b064a3a
JH		 1325 disable_advertising(&req);
1326
23a48093 1327 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1328
1329 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1330 struct hci_cp_disconnect dc;
c9910d0f
JH		 1331 struct hci_cp_reject_conn_req rej;
1332
1333 switch (conn->state) {
1334 case BT_CONNECTED:
1335 case BT_CONFIG:
1336 dc.handle = cpu_to_le16(conn->handle);
1337 dc.reason = 0x15; /* Terminated due to Power Off */
1338 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1339 break;
1340 case BT_CONNECT:
1341 if (conn->type == LE_LINK)
1342 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1343 0, NULL);
1344 else if (conn->type == ACL_LINK)
1345 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1346 6, &conn->dst);
1347 break;
1348 case BT_CONNECT2:
1349 bacpy(&rej.bdaddr, &conn->dst);
1350 rej.reason = 0x15; /* Terminated due to Power Off */
1351 if (conn->type == ACL_LINK)
1352 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1353 sizeof(rej), &rej);
1354 else if (conn->type == SCO_LINK)
1355 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1356 sizeof(rej), &rej);
1357 break;
1358 }
8b064a3a
JH		 1359 }
1360
23a48093
JH		 1361 err = hci_req_run(&req, clean_up_hci_complete);
1362 if (!err && discov_stopped)
1363 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1364
1365 return err;
8b064a3a
JH		 1366}
1367
bdb6d971 1368static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1369 u16 len)
eec8d2bc 1370{
650f726d 1371 struct mgmt_mode *cp = data;
366a0336 1372 struct pending_cmd *cmd;
4b34ee78 1373 int err;
eec8d2bc 1374
bdb6d971 1375 BT_DBG("request for %s", hdev->name);
eec8d2bc 1376
a7e80f25
JH		 1377 if (cp->val != 0x00 && cp->val != 0x01)
1378 return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1379 MGMT_STATUS_INVALID_PARAMS);
1380
09fd0de5 1381 hci_dev_lock(hdev);
eec8d2bc 1382
87b95ba6
JH		 1383 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
1384 err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1385 MGMT_STATUS_BUSY);
1386 goto failed;
1387 }
1388
f0d4b78a
MH		 1389 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1390 cancel_delayed_work(&hdev->power_off);
1391
1392 if (cp->val) {
a1d70450
JH		 1393 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1394 data, len);
1395 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1396 goto failed;
1397 }
1398 }
1399
4b34ee78 1400 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1401 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1402 goto failed;
1403 }
1404
2e58ef3e 1405 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1406 if (!cmd) {
1407 err = -ENOMEM;
eec8d2bc 1408 goto failed;
366a0336 1409 }
eec8d2bc 1410
8b064a3a 1411 if (cp->val) {
19202573 1412 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1413 err = 0;
1414 } else {
1415 /* Disconnect connections, stop scans, etc */
1416 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1417 if (!err)
1418 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1419 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1420
8b064a3a
JH		 1421 /* ENODATA means there were no HCI commands queued */
1422 if (err == -ENODATA) {
a3172b7e 1423 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1424 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1425 err = 0;
1426 }
1427 }
eec8d2bc
JH		 1428
1429failed:
09fd0de5 1430 hci_dev_unlock(hdev);
366a0336 1431 return err;
eec8d2bc
JH		 1432}
1433
beadb2bd
JH		 1434static int new_settings(struct hci_dev *hdev, struct sock *skip)
1435{
1436 __le32 ev;
1437
1438 ev = cpu_to_le32(get_current_settings(hdev));
1439
1440 return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
1441}
1442
91a668b0
JH		 1443int mgmt_new_settings(struct hci_dev *hdev)
1444{
1445 return new_settings(hdev, NULL);
1446}
1447
bd99abdd
JH		 1448struct cmd_lookup {
1449 struct sock *sk;
1450 struct hci_dev *hdev;
1451 u8 mgmt_status;
1452};
1453
1454static void settings_rsp(struct pending_cmd *cmd, void *data)
1455{
1456 struct cmd_lookup *match = data;
1457
1458 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1459
1460 list_del(&cmd->list);
1461
1462 if (match->sk == NULL) {
1463 match->sk = cmd->sk;
1464 sock_hold(match->sk);
1465 }
1466
1467 mgmt_pending_free(cmd);
1468}
1469
1470static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
1471{
1472 u8 *status = data;
1473
1474 cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
1475 mgmt_pending_remove(cmd);
1476}
1477
1b9b5ee5
JH		 1478static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
1479{
1480 if (cmd->cmd_complete) {
1481 u8 *status = data;
1482
1483 cmd->cmd_complete(cmd, *status);
1484 mgmt_pending_remove(cmd);
1485
1486 return;
1487 }
1488
1489 cmd_status_rsp(cmd, data);
1490}
1491
9df74653 1492static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
f5818c22 1493{
9df74653
JH		 1494 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1495 cmd->param, cmd->param_len);
f5818c22
JH		 1496}
1497
9df74653 1498static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
7776d1d8 1499{
9df74653
JH		 1500 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
1501 sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1502}
1503
e6fe7986
JH		 1504static u8 mgmt_bredr_support(struct hci_dev *hdev)
1505{
1506 if (!lmp_bredr_capable(hdev))
1507 return MGMT_STATUS_NOT_SUPPORTED;
1508 else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1509 return MGMT_STATUS_REJECTED;
1510 else
1511 return MGMT_STATUS_SUCCESS;
1512}
1513
1514static u8 mgmt_le_support(struct hci_dev *hdev)
1515{
1516 if (!lmp_le_capable(hdev))
1517 return MGMT_STATUS_NOT_SUPPORTED;
1518 else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1519 return MGMT_STATUS_REJECTED;
1520 else
1521 return MGMT_STATUS_SUCCESS;
1522}
1523
1904a853
MH		 1524static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1525 u16 opcode)
bfaf8c9f
JH		 1526{
1527 struct pending_cmd *cmd;
1528 struct mgmt_mode *cp;
970ba524 1529 struct hci_request req;
bfaf8c9f
JH		 1530 bool changed;
1531
1532 BT_DBG("status 0x%02x", status);
1533
1534 hci_dev_lock(hdev);
1535
1536 cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
1537 if (!cmd)
1538 goto unlock;
1539
1540 if (status) {
1541 u8 mgmt_err = mgmt_status(status);
1542 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
310a3d48 1543 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
bfaf8c9f
JH		 1544 goto remove_cmd;
1545 }
1546
1547 cp = cmd->param;
d4462a07 1548 if (cp->val) {
bfaf8c9f
JH		 1549 changed = !test_and_set_bit(HCI_DISCOVERABLE,
1550 &hdev->dev_flags);
d4462a07
MH		 1551
1552 if (hdev->discov_timeout > 0) {
1553 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1554 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1555 to);
1556 }
1557 } else {
bfaf8c9f
JH		 1558 changed = test_and_clear_bit(HCI_DISCOVERABLE,
1559 &hdev->dev_flags);
d4462a07 1560 }
bfaf8c9f
JH		 1561
1562 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1563
1564 if (changed)
1565 new_settings(hdev, cmd->sk);
1566
970ba524
MH		 1567 /* When the discoverable mode gets changed, make sure
1568 * that class of device has the limited discoverable
432df05e
JH		 1569 * bit correctly set. Also update page scan based on whitelist
1570 * entries.
970ba524
MH		 1571 */
1572 hci_req_init(&req, hdev);
1d2dc5b7 1573 __hci_update_page_scan(&req);
970ba524
MH		 1574 update_class(&req);
1575 hci_req_run(&req, NULL);
1576
bfaf8c9f
JH		 1577remove_cmd:
1578 mgmt_pending_remove(cmd);
1579
1580unlock:
1581 hci_dev_unlock(hdev);
1582}
1583
bdb6d971 1584static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1585 u16 len)
73f22f62 1586{
650f726d 1587 struct mgmt_cp_set_discoverable *cp = data;
366a0336 1588 struct pending_cmd *cmd;
bfaf8c9f 1589 struct hci_request req;
5e5282bb 1590 u16 timeout;
9a43e25f 1591 u8 scan;
73f22f62
JH		 1592 int err;
1593
bdb6d971 1594 BT_DBG("request for %s", hdev->name);
73f22f62 1595
9a43e25f
JH		 1596 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1597 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1598 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
9a43e25f 1599 MGMT_STATUS_REJECTED);
33c525c0 1600
310a3d48 1601 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a7e80f25
JH		 1602 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1603 MGMT_STATUS_INVALID_PARAMS);
1604
1f350c87 1605 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1606
1607 /* Disabling discoverable requires that no timeout is set,
1608 * and enabling limited discoverable requires a timeout.
1609 */
1610 if ((cp->val == 0x00 && timeout > 0) ||
1611 (cp->val == 0x02 && timeout == 0))
bdb6d971 1612 return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1613 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1614
09fd0de5 1615 hci_dev_lock(hdev);
73f22f62 1616
5e5282bb 1617 if (!hdev_is_powered(hdev) && timeout > 0) {
bdb6d971 1618 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1619 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1620 goto failed;
1621 }
1622
2e58ef3e 1623 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1624 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1625 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1626 MGMT_STATUS_BUSY);
73f22f62
JH		 1627 goto failed;
1628 }
1629
5e5282bb 1630 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
bdb6d971 1631 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
04124681 1632 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1633 goto failed;
1634 }
1635
1636 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1637 bool changed = false;
1638
310a3d48
MH		 1639 /* Setting limited discoverable when powered off is
1640 * not a valid operation since it requires a timeout
1641 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1642 */
0224d2fa
JH		 1643 if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
1644 change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1645 changed = true;
1646 }
1647
5e5282bb 1648 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1649 if (err < 0)
1650 goto failed;
1651
1652 if (changed)
1653 err = new_settings(hdev, sk);
1654
5e5282bb
JH		 1655 goto failed;
1656 }
1657
310a3d48
MH		 1658 /* If the current mode is the same, then just update the timeout
1659 * value with the new value. And if only the timeout gets updated,
1660 * then no need for any HCI transactions.
1661 */
1662 if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
1663 (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
1664 &hdev->dev_flags)) {
36261547
MH		 1665 cancel_delayed_work(&hdev->discov_off);
1666 hdev->discov_timeout = timeout;
955638ec 1667
36261547
MH		 1668 if (cp->val && hdev->discov_timeout > 0) {
1669 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1670 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1671 to);
955638ec
MH		 1672 }
1673
69ab39ea 1674 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1675 goto failed;
1676 }
1677
2e58ef3e 1678 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1679 if (!cmd) {
1680 err = -ENOMEM;
73f22f62 1681 goto failed;
366a0336 1682 }
73f22f62 1683
310a3d48
MH		 1684 /* Cancel any potential discoverable timeout that might be
1685 * still active and store new timeout value. The arming of
1686 * the timeout happens in the complete handler.
1687 */
1688 cancel_delayed_work(&hdev->discov_off);
1689 hdev->discov_timeout = timeout;
1690
b456f87c
JH		 1691 /* Limited discoverable mode */
1692 if (cp->val == 0x02)
1693 set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1694 else
1695 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1696
bfaf8c9f
JH		 1697 hci_req_init(&req, hdev);
1698
9a43e25f
JH		 1699 /* The procedure for LE-only controllers is much simpler - just
1700 * update the advertising data.
1701 */
1702 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1703 goto update_ad;
1704
73f22f62
JH		 1705 scan = SCAN_PAGE;
1706
310a3d48
MH		 1707 if (cp->val) {
1708 struct hci_cp_write_current_iac_lap hci_cp;
1709
1710 if (cp->val == 0x02) {
1711 /* Limited discoverable mode */
33337dcb 1712 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1713 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1714 hci_cp.iac_lap[1] = 0x8b;
1715 hci_cp.iac_lap[2] = 0x9e;
1716 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1717 hci_cp.iac_lap[4] = 0x8b;
1718 hci_cp.iac_lap[5] = 0x9e;
1719 } else {
1720 /* General discoverable mode */
310a3d48
MH		 1721 hci_cp.num_iac = 1;
1722 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1723 hci_cp.iac_lap[1] = 0x8b;
1724 hci_cp.iac_lap[2] = 0x9e;
1725 }
1726
1727 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1728 (hci_cp.num_iac * 3) + 1, &hci_cp);
1729
73f22f62 1730 scan |= SCAN_INQUIRY;
310a3d48
MH		 1731 } else {
1732 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1733 }
73f22f62 1734
310a3d48 1735 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1736
9a43e25f
JH		 1737update_ad:
1738 update_adv_data(&req);
1739
bfaf8c9f 1740 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1741 if (err < 0)
a664b5bc 1742 mgmt_pending_remove(cmd);
73f22f62
JH		 1743
1744failed:
09fd0de5 1745 hci_dev_unlock(hdev);
73f22f62
JH		 1746 return err;
1747}
1748
406d7804
JH		 1749static void write_fast_connectable(struct hci_request *req, bool enable)
1750{
bd98b996 1751 struct hci_dev *hdev = req->hdev;
406d7804
JH		 1752 struct hci_cp_write_page_scan_activity acp;
1753 u8 type;
1754
547003b1
JH		 1755 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
1756 return;
1757
4c01f8b8
JH		 1758 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1759 return;
1760
406d7804
JH		 1761 if (enable) {
1762 type = PAGE_SCAN_TYPE_INTERLACED;
1763
1764 /* 160 msec page scan interval */
dcf4adbf 1765 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 1766 } else {
1767 type = PAGE_SCAN_TYPE_STANDARD; /* default */
1768
1769 /* default 1.28 sec page scan */
dcf4adbf 1770 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 1771 }
1772
dcf4adbf 1773 acp.window = cpu_to_le16(0x0012);
406d7804 1774
bd98b996
JH		 1775 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
1776 __cpu_to_le16(hdev->page_scan_window) != acp.window)
1777 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
1778 sizeof(acp), &acp);
1779
1780 if (hdev->page_scan_type != type)
1781 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 1782}
1783
1904a853
MH		 1784static void set_connectable_complete(struct hci_dev *hdev, u8 status,
1785 u16 opcode)
2b76f453
JH		 1786{
1787 struct pending_cmd *cmd;
d7b856f9 1788 struct mgmt_mode *cp;
bc6d2d04 1789 bool conn_changed, discov_changed;
2b76f453
JH		 1790
1791 BT_DBG("status 0x%02x", status);
1792
1793 hci_dev_lock(hdev);
1794
1795 cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
1796 if (!cmd)
1797 goto unlock;
1798
37438c1f
JH		 1799 if (status) {
1800 u8 mgmt_err = mgmt_status(status);
1801 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
1802 goto remove_cmd;
1803 }
1804
d7b856f9 1805 cp = cmd->param;
bc6d2d04
JH		 1806 if (cp->val) {
1807 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1808 &hdev->dev_flags);
1809 discov_changed = false;
1810 } else {
1811 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1812 &hdev->dev_flags);
1813 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1814 &hdev->dev_flags);
1815 }
d7b856f9 1816
2b76f453
JH		 1817 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
1818
bc6d2d04 1819 if (conn_changed || discov_changed) {
d7b856f9 1820 new_settings(hdev, cmd->sk);
1d2dc5b7 1821 hci_update_page_scan(hdev);
bc6d2d04
JH		 1822 if (discov_changed)
1823 mgmt_update_adv_data(hdev);
2b7be33e
JH		 1824 hci_update_background_scan(hdev);
1825 }
d7b856f9 1826
37438c1f 1827remove_cmd:
2b76f453
JH		 1828 mgmt_pending_remove(cmd);
1829
1830unlock:
1831 hci_dev_unlock(hdev);
1832}
1833
e8ba3a1f
JH		 1834static int set_connectable_update_settings(struct hci_dev *hdev,
1835 struct sock *sk, u8 val)
1836{
1837 bool changed = false;
1838 int err;
1839
1840 if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
1841 changed = true;
1842
1843 if (val) {
1844 set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1845 } else {
1846 clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
1847 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1848 }
1849
1850 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
1851 if (err < 0)
1852 return err;
1853
562064e6 1854 if (changed) {
1d2dc5b7 1855 hci_update_page_scan(hdev);
562064e6 1856 hci_update_background_scan(hdev);
e8ba3a1f 1857 return new_settings(hdev, sk);
562064e6 1858 }
e8ba3a1f
JH		 1859
1860 return 0;
1861}
1862
bdb6d971 1863static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1864 u16 len)
9fbcbb45 1865{
650f726d 1866 struct mgmt_mode *cp = data;
366a0336 1867 struct pending_cmd *cmd;
2b76f453 1868 struct hci_request req;
1987fdc7 1869 u8 scan;
9fbcbb45
JH		 1870 int err;
1871
bdb6d971 1872 BT_DBG("request for %s", hdev->name);
9fbcbb45 1873
1987fdc7
JH		 1874 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
1875 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
33c525c0 1876 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1987fdc7 1877 MGMT_STATUS_REJECTED);
33c525c0 1878
a7e80f25
JH		 1879 if (cp->val != 0x00 && cp->val != 0x01)
1880 return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
1881 MGMT_STATUS_INVALID_PARAMS);
1882
09fd0de5 1883 hci_dev_lock(hdev);
9fbcbb45 1884
4b34ee78 1885 if (!hdev_is_powered(hdev)) {
e8ba3a1f 1886 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 1887 goto failed;
1888 }
1889
2e58ef3e 1890 if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
8ce8e2b5 1891 mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
bdb6d971 1892 err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
04124681 1893 MGMT_STATUS_BUSY);
9fbcbb45
JH		 1894 goto failed;
1895 }
1896
2e58ef3e 1897 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 1898 if (!cmd) {
1899 err = -ENOMEM;
9fbcbb45 1900 goto failed;
366a0336 1901 }
9fbcbb45 1902
9b74246f 1903 hci_req_init(&req, hdev);
9fbcbb45 1904
9a43e25f
JH		 1905 /* If BR/EDR is not enabled and we disable advertising as a
1906 * by-product of disabling connectable, we need to update the
1907 * advertising flags.
1908 */
1909 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1910 if (!cp->val) {
1911 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1912 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1913 }
1914 update_adv_data(&req);
1915 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 1916 if (cp->val) {
1917 scan = SCAN_PAGE;
1918 } else {
3bd27240
JH		 1919 /* If we don't have any whitelist entries just
1920 * disable all scanning. If there are entries
1921 * and we had both page and inquiry scanning
1922 * enabled then fall back to only page scanning.
1923 * Otherwise no changes are needed.
1924 */
1925 if (list_empty(&hdev->whitelist))
1926 scan = SCAN_DISABLED;
1927 else if (test_bit(HCI_ISCAN, &hdev->flags))
1928 scan = SCAN_PAGE;
1929 else
1930 goto no_scan_update;
9b74246f
JH		 1931
1932 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 1933 hdev->discov_timeout > 0)
9b74246f
JH		 1934 cancel_delayed_work(&hdev->discov_off);
1935 }
2b76f453 1936
9b74246f
JH		 1937 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1938 }
2b76f453 1939
3bd27240 1940no_scan_update:
4c01f8b8
JH		 1941 /* If we're going from non-connectable to connectable or
1942 * vice-versa when fast connectable is enabled ensure that fast
1943 * connectable gets disabled. write_fast_connectable won't do
1944 * anything if the page scan parameters are already what they
1945 * should be.
1946 */
1947 if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
e36a3769
JH		 1948 write_fast_connectable(&req, false);
1949
e8b1202c
JH		 1950 /* Update the advertising parameters if necessary */
1951 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
1987fdc7 1952 enable_advertising(&req);
1987fdc7 1953
2b76f453 1954 err = hci_req_run(&req, set_connectable_complete);
9b74246f 1955 if (err < 0) {
a664b5bc 1956 mgmt_pending_remove(cmd);
9b74246f 1957 if (err == -ENODATA)
a81070ba
JH		 1958 err = set_connectable_update_settings(hdev, sk,
1959 cp->val);
9b74246f
JH		 1960 goto failed;
1961 }
9fbcbb45
JH		 1962
1963failed:
09fd0de5 1964 hci_dev_unlock(hdev);
9fbcbb45
JH		 1965 return err;
1966}
1967
b2939475 1968static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1969 u16 len)
c542a06c 1970{
650f726d 1971 struct mgmt_mode *cp = data;
55594356 1972 bool changed;
c542a06c
JH		 1973 int err;
1974
bdb6d971 1975 BT_DBG("request for %s", hdev->name);
c542a06c 1976
a7e80f25 1977 if (cp->val != 0x00 && cp->val != 0x01)
b2939475 1978 return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
a7e80f25
JH		 1979 MGMT_STATUS_INVALID_PARAMS);
1980
09fd0de5 1981 hci_dev_lock(hdev);
c542a06c
JH		 1982
1983 if (cp->val)
b6ae8457 1984 changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
c542a06c 1985 else
b6ae8457 1986 changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
c542a06c 1987
b2939475 1988 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 1989 if (err < 0)
55594356 1990 goto unlock;
c542a06c 1991
55594356
MH		 1992 if (changed)
1993 err = new_settings(hdev, sk);
c542a06c 1994
55594356 1995unlock:
09fd0de5 1996 hci_dev_unlock(hdev);
c542a06c
JH		 1997 return err;
1998}
1999
04124681
GP		 2000static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2001 u16 len)
33ef95ed
JH		 2002{
2003 struct mgmt_mode *cp = data;
2004 struct pending_cmd *cmd;
e6fe7986 2005 u8 val, status;
33ef95ed
JH		 2006 int err;
2007
bdb6d971 2008 BT_DBG("request for %s", hdev->name);
33ef95ed 2009
e6fe7986
JH		 2010 status = mgmt_bredr_support(hdev);
2011 if (status)
33c525c0 2012 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
e6fe7986 2013 status);
33c525c0 2014
a7e80f25
JH		 2015 if (cp->val != 0x00 && cp->val != 0x01)
2016 return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2017 MGMT_STATUS_INVALID_PARAMS);
2018
33ef95ed
JH		 2019 hci_dev_lock(hdev);
2020
4b34ee78 2021 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2022 bool changed = false;
2023
2024 if (!!cp->val != test_bit(HCI_LINK_SECURITY,
8ce8e2b5 2025 &hdev->dev_flags)) {
47990ea0
JH		 2026 change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
2027 changed = true;
2028 }
2029
2030 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2031 if (err < 0)
2032 goto failed;
2033
2034 if (changed)
2035 err = new_settings(hdev, sk);
2036
33ef95ed
JH		 2037 goto failed;
2038 }
2039
2040 if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
bdb6d971 2041 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
04124681 2042 MGMT_STATUS_BUSY);
33ef95ed
JH		 2043 goto failed;
2044 }
2045
2046 val = !!cp->val;
2047
2048 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2049 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2050 goto failed;
2051 }
2052
2053 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2054 if (!cmd) {
2055 err = -ENOMEM;
2056 goto failed;
2057 }
2058
2059 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2060 if (err < 0) {
2061 mgmt_pending_remove(cmd);
2062 goto failed;
2063 }
2064
2065failed:
2066 hci_dev_unlock(hdev);
33ef95ed
JH		 2067 return err;
2068}
2069
bdb6d971 2070static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2071{
2072 struct mgmt_mode *cp = data;
2073 struct pending_cmd *cmd;
72ef0c1a 2074 u8 status;
ed2c4ee3
JH		 2075 int err;
2076
bdb6d971 2077 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2078
cdba5281
MH		 2079 status = mgmt_bredr_support(hdev);
2080 if (status)
2081 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
2082
13ecd8b6
JH		 2083 if (!lmp_ssp_capable(hdev))
2084 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2085 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2086
a7e80f25
JH		 2087 if (cp->val != 0x00 && cp->val != 0x01)
2088 return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2089 MGMT_STATUS_INVALID_PARAMS);
2090
13ecd8b6 2091 hci_dev_lock(hdev);
6c8f12c1 2092
4b34ee78 2093 if (!hdev_is_powered(hdev)) {
9ecb3e24 2094 bool changed;
c0ecddc2 2095
9ecb3e24
MH		 2096 if (cp->val) {
2097 changed = !test_and_set_bit(HCI_SSP_ENABLED,
2098 &hdev->dev_flags);
2099 } else {
2100 changed = test_and_clear_bit(HCI_SSP_ENABLED,
2101 &hdev->dev_flags);
2102 if (!changed)
2103 changed = test_and_clear_bit(HCI_HS_ENABLED,
2104 &hdev->dev_flags);
2105 else
2106 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
c0ecddc2
JH		 2107 }
2108
2109 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2110 if (err < 0)
2111 goto failed;
2112
2113 if (changed)
2114 err = new_settings(hdev, sk);
2115
ed2c4ee3
JH		 2116 goto failed;
2117 }
2118
94d52dad 2119 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
d97dcb66
SJ		 2120 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2121 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2122 goto failed;
2123 }
2124
72ef0c1a 2125 if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
ed2c4ee3
JH		 2126 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2127 goto failed;
2128 }
2129
2130 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2131 if (!cmd) {
2132 err = -ENOMEM;
2133 goto failed;
2134 }
2135
3769972b
JH		 2136 if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
2137 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2138 sizeof(cp->val), &cp->val);
2139
72ef0c1a 2140 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2141 if (err < 0) {
2142 mgmt_pending_remove(cmd);
2143 goto failed;
2144 }
2145
2146failed:
2147 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2148 return err;
2149}
2150
bdb6d971 2151static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2152{
2153 struct mgmt_mode *cp = data;
ee392693 2154 bool changed;
e6fe7986 2155 u8 status;
ee392693 2156 int err;
6d80dfd0 2157
bdb6d971 2158 BT_DBG("request for %s", hdev->name);
6d80dfd0 2159
e6fe7986
JH		 2160 status = mgmt_bredr_support(hdev);
2161 if (status)
2162 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2163
9ecb3e24
MH		 2164 if (!lmp_ssp_capable(hdev))
2165 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2166 MGMT_STATUS_NOT_SUPPORTED);
2167
2168 if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
2169 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2170 MGMT_STATUS_REJECTED);
2171
a7e80f25
JH		 2172 if (cp->val != 0x00 && cp->val != 0x01)
2173 return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2174 MGMT_STATUS_INVALID_PARAMS);
2175
ee392693
MH		 2176 hci_dev_lock(hdev);
2177
a2cb01de
JH		 2178 if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
2179 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2180 MGMT_STATUS_BUSY);
2181 goto unlock;
2182 }
2183
a0cdf960 2184 if (cp->val) {
ee392693 2185 changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960
MH		 2186 } else {
2187 if (hdev_is_powered(hdev)) {
2188 err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2189 MGMT_STATUS_REJECTED);
2190 goto unlock;
2191 }
2192
ee392693 2193 changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
a0cdf960 2194 }
ee392693
MH		 2195
2196 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2197 if (err < 0)
2198 goto unlock;
2199
2200 if (changed)
2201 err = new_settings(hdev, sk);
6d80dfd0 2202
ee392693
MH		 2203unlock:
2204 hci_dev_unlock(hdev);
2205 return err;
6d80dfd0
JH		 2206}
2207
1904a853 2208static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2209{
2210 struct cmd_lookup match = { NULL, hdev };
2211
3ad67582
JK		 2212 hci_dev_lock(hdev);
2213
416a4ae5
JH		 2214 if (status) {
2215 u8 mgmt_err = mgmt_status(status);
2216
2217 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2218 &mgmt_err);
3ad67582 2219 goto unlock;
416a4ae5
JH		 2220 }
2221
2222 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2223
2224 new_settings(hdev, match.sk);
2225
2226 if (match.sk)
2227 sock_put(match.sk);
441ad2d0
MH		 2228
2229 /* Make sure the controller has a good default for
2230 * advertising data. Restrict the update to when LE
2231 * has actually been enabled. During power on, the
2232 * update in powered_update_hci will take care of it.
2233 */
2234 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2235 struct hci_request req;
2236
441ad2d0 2237 hci_req_init(&req, hdev);
5947f4bc 2238 update_adv_data(&req);
f14d8f64 2239 update_scan_rsp_data(&req);
2cf22218 2240 __hci_update_background_scan(&req);
441ad2d0 2241 hci_req_run(&req, NULL);
441ad2d0 2242 }
3ad67582
JK		 2243
2244unlock:
2245 hci_dev_unlock(hdev);
416a4ae5
JH		 2246}
2247
bdb6d971 2248static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2249{
2250 struct mgmt_mode *cp = data;
2251 struct hci_cp_write_le_host_supported hci_cp;
2252 struct pending_cmd *cmd;
416a4ae5 2253 struct hci_request req;
06199cf8 2254 int err;
0b60eba1 2255 u8 val, enabled;
06199cf8 2256
bdb6d971 2257 BT_DBG("request for %s", hdev->name);
06199cf8 2258
13ecd8b6
JH		 2259 if (!lmp_le_capable(hdev))
2260 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2261 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2262
a7e80f25
JH		 2263 if (cp->val != 0x00 && cp->val != 0x01)
2264 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2265 MGMT_STATUS_INVALID_PARAMS);
2266
c73eee91 2267 /* LE-only devices do not allow toggling LE on/off */
56f87901 2268 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
c73eee91
JH		 2269 return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2270 MGMT_STATUS_REJECTED);
2271
13ecd8b6 2272 hci_dev_lock(hdev);
06199cf8
JH		 2273
2274 val = !!cp->val;
ffa88e02 2275 enabled = lmp_host_le_capable(hdev);
06199cf8 2276
0b60eba1 2277 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2278 bool changed = false;
2279
2280 if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
2281 change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2282 changed = true;
2283 }
2284
f3d3444a
JH		 2285 if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
2286 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
eeca6f89
JH		 2287 changed = true;
2288 }
2289
06199cf8
JH		 2290 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2291 if (err < 0)
1de028ce 2292 goto unlock;
06199cf8
JH		 2293
2294 if (changed)
2295 err = new_settings(hdev, sk);
2296
1de028ce 2297 goto unlock;
06199cf8
JH		 2298 }
2299
4375f103
JH		 2300 if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
2301 mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
bdb6d971 2302 err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
04124681 2303 MGMT_STATUS_BUSY);
1de028ce 2304 goto unlock;
06199cf8
JH		 2305 }
2306
2307 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2308 if (!cmd) {
2309 err = -ENOMEM;
1de028ce 2310 goto unlock;
06199cf8
JH		 2311 }
2312
441ad2d0
MH		 2313 hci_req_init(&req, hdev);
2314
06199cf8
JH		 2315 memset(&hci_cp, 0, sizeof(hci_cp));
2316
2317 if (val) {
2318 hci_cp.le = val;
32226e4f 2319 hci_cp.simul = 0x00;
441ad2d0 2320 } else {
73e082f8 2321 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
441ad2d0 2322 disable_advertising(&req);
06199cf8
JH		 2323 }
2324
416a4ae5
JH		 2325 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2326 &hci_cp);
2327
2328 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2329 if (err < 0)
06199cf8 2330 mgmt_pending_remove(cmd);
06199cf8 2331
1de028ce
JH		 2332unlock:
2333 hci_dev_unlock(hdev);
06199cf8
JH		 2334 return err;
2335}
2336
0cab9c80
JH		 2337/* This is a helper function to test for pending mgmt commands that can
2338 * cause CoD or EIR HCI commands. We can only allow one such pending
2339 * mgmt command at a time since otherwise we cannot easily track what
2340 * the current values are, will be, and based on that calculate if a new
2341 * HCI command needs to be sent and if yes with what value.
2342 */
2343static bool pending_eir_or_class(struct hci_dev *hdev)
2344{
2345 struct pending_cmd *cmd;
2346
2347 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2348 switch (cmd->opcode) {
2349 case MGMT_OP_ADD_UUID:
2350 case MGMT_OP_REMOVE_UUID:
2351 case MGMT_OP_SET_DEV_CLASS:
2352 case MGMT_OP_SET_POWERED:
2353 return true;
2354 }
2355 }
2356
2357 return false;
2358}
2359
83be8eca
JH		 2360static const u8 bluetooth_base_uuid[] = {
2361 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2362 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2363};
2364
2365static u8 get_uuid_size(const u8 *uuid)
2366{
2367 u32 val;
2368
2369 if (memcmp(uuid, bluetooth_base_uuid, 12))
2370 return 128;
2371
2372 val = get_unaligned_le32(&uuid[12]);
2373 if (val > 0xffff)
2374 return 32;
2375
2376 return 16;
2377}
2378
92da6097
JH		 2379static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2380{
2381 struct pending_cmd *cmd;
2382
2383 hci_dev_lock(hdev);
2384
2385 cmd = mgmt_pending_find(mgmt_op, hdev);
2386 if (!cmd)
2387 goto unlock;
2388
2389 cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
2390 hdev->dev_class, 3);
2391
2392 mgmt_pending_remove(cmd);
2393
2394unlock:
2395 hci_dev_unlock(hdev);
2396}
2397
1904a853 2398static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2399{
2400 BT_DBG("status 0x%02x", status);
2401
2402 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2403}
2404
bdb6d971 2405static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2406{
650f726d 2407 struct mgmt_cp_add_uuid *cp = data;
90e70454 2408 struct pending_cmd *cmd;
890ea898 2409 struct hci_request req;
2aeb9a1a 2410 struct bt_uuid *uuid;
2aeb9a1a
JH		 2411 int err;
2412
bdb6d971 2413 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2414
09fd0de5 2415 hci_dev_lock(hdev);
2aeb9a1a 2416
0cab9c80 2417 if (pending_eir_or_class(hdev)) {
bdb6d971 2418 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
04124681 2419 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2420 goto failed;
2421 }
2422
92c4c204 2423 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2424 if (!uuid) {
2425 err = -ENOMEM;
2426 goto failed;
2427 }
2428
2429 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2430 uuid->svc_hint = cp->svc_hint;
83be8eca 2431 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2432
de66aa63 2433 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2434
890ea898 2435 hci_req_init(&req, hdev);
1aff6f09 2436
890ea898
JH		 2437 update_class(&req);
2438 update_eir(&req);
2439
92da6097
JH		 2440 err = hci_req_run(&req, add_uuid_complete);
2441 if (err < 0) {
2442 if (err != -ENODATA)
2443 goto failed;
80a1e1db 2444
bdb6d971 2445 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
04124681 2446 hdev->dev_class, 3);
90e70454
JH		 2447 goto failed;
2448 }
2449
2450 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2451 if (!cmd) {
90e70454 2452 err = -ENOMEM;
890ea898
JH		 2453 goto failed;
2454 }
2455
2456 err = 0;
2aeb9a1a
JH		 2457
2458failed:
09fd0de5 2459 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2460 return err;
2461}
2462
24b78d0f
JH		 2463static bool enable_service_cache(struct hci_dev *hdev)
2464{
2465 if (!hdev_is_powered(hdev))
2466 return false;
2467
2468 if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
46818ed5
JH		 2469 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2470 CACHE_TIMEOUT);
24b78d0f
JH		 2471 return true;
2472 }
2473
2474 return false;
2475}
2476
1904a853 2477static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2478{
2479 BT_DBG("status 0x%02x", status);
2480
2481 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2482}
2483
bdb6d971 2484static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2485 u16 len)
2aeb9a1a 2486{
650f726d 2487 struct mgmt_cp_remove_uuid *cp = data;
90e70454 2488 struct pending_cmd *cmd;
056341c8 2489 struct bt_uuid *match, *tmp;
2aeb9a1a 2490 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2491 struct hci_request req;
2aeb9a1a
JH		 2492 int err, found;
2493
bdb6d971 2494 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2495
09fd0de5 2496 hci_dev_lock(hdev);
2aeb9a1a 2497
0cab9c80 2498 if (pending_eir_or_class(hdev)) {
bdb6d971 2499 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2500 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2501 goto unlock;
2502 }
2503
2aeb9a1a 2504 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2505 hci_uuids_clear(hdev);
4004b6d9 2506
24b78d0f 2507 if (enable_service_cache(hdev)) {
bdb6d971 2508 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2509 0, hdev->dev_class, 3);
24b78d0f
JH		 2510 goto unlock;
2511 }
4004b6d9 2512
9246a869 2513 goto update_class;
2aeb9a1a
JH		 2514 }
2515
2516 found = 0;
2517
056341c8 2518 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2519 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2520 continue;
2521
2522 list_del(&match->list);
482049f7 2523 kfree(match);
2aeb9a1a
JH		 2524 found++;
2525 }
2526
2527 if (found == 0) {
bdb6d971 2528 err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
04124681 2529 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2530 goto unlock;
2531 }
2532
9246a869 2533update_class:
890ea898 2534 hci_req_init(&req, hdev);
1aff6f09 2535
890ea898
JH		 2536 update_class(&req);
2537 update_eir(&req);
2538
92da6097
JH		 2539 err = hci_req_run(&req, remove_uuid_complete);
2540 if (err < 0) {
2541 if (err != -ENODATA)
2542 goto unlock;
80a1e1db 2543
bdb6d971 2544 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
04124681 2545 hdev->dev_class, 3);
90e70454
JH		 2546 goto unlock;
2547 }
2548
2549 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2550 if (!cmd) {
90e70454 2551 err = -ENOMEM;
890ea898
JH		 2552 goto unlock;
2553 }
2554
2555 err = 0;
2aeb9a1a
JH		 2556
2557unlock:
09fd0de5 2558 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2559 return err;
2560}
2561
1904a853 2562static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2563{
2564 BT_DBG("status 0x%02x", status);
2565
2566 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2567}
2568
bdb6d971 2569static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2570 u16 len)
1aff6f09 2571{
650f726d 2572 struct mgmt_cp_set_dev_class *cp = data;
90e70454 2573 struct pending_cmd *cmd;
890ea898 2574 struct hci_request req;
1aff6f09
JH		 2575 int err;
2576
bdb6d971 2577 BT_DBG("request for %s", hdev->name);
1aff6f09 2578
6203fc98 2579 if (!lmp_bredr_capable(hdev))
13ecd8b6
JH		 2580 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2581 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2582
0cab9c80 2583 hci_dev_lock(hdev);
ee98f473 2584
0cab9c80
JH		 2585 if (pending_eir_or_class(hdev)) {
2586 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2587 MGMT_STATUS_BUSY);
2588 goto unlock;
2589 }
c95f0ba7 2590
0cab9c80
JH		 2591 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
2592 err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2593 MGMT_STATUS_INVALID_PARAMS);
2594 goto unlock;
2595 }
575b3a02 2596
932f5ff5
JH		 2597 hdev->major_class = cp->major;
2598 hdev->minor_class = cp->minor;
2599
b5235a65 2600 if (!hdev_is_powered(hdev)) {
bdb6d971 2601 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2602 hdev->dev_class, 3);
b5235a65
JH		 2603 goto unlock;
2604 }
2605
890ea898
JH		 2606 hci_req_init(&req, hdev);
2607
a8b2d5c2 2608 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
7d78525d
JH		 2609 hci_dev_unlock(hdev);
2610 cancel_delayed_work_sync(&hdev->service_cache);
2611 hci_dev_lock(hdev);
890ea898 2612 update_eir(&req);
7d78525d 2613 }
14c0b608 2614
890ea898
JH		 2615 update_class(&req);
2616
92da6097
JH		 2617 err = hci_req_run(&req, set_class_complete);
2618 if (err < 0) {
2619 if (err != -ENODATA)
2620 goto unlock;
1aff6f09 2621
bdb6d971 2622 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
04124681 2623 hdev->dev_class, 3);
90e70454
JH		 2624 goto unlock;
2625 }
2626
2627 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2628 if (!cmd) {
90e70454 2629 err = -ENOMEM;
890ea898
JH		 2630 goto unlock;
2631 }
2632
2633 err = 0;
1aff6f09 2634
b5235a65 2635unlock:
09fd0de5 2636 hci_dev_unlock(hdev);
1aff6f09
JH		 2637 return err;
2638}
2639
bdb6d971 2640static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2641 u16 len)
55ed8ca1 2642{
650f726d 2643 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2644 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2645 sizeof(struct mgmt_link_key_info));
4e51eae9 2646 u16 key_count, expected_len;
b1de97d8 2647 bool changed;
a492cd52 2648 int i;
55ed8ca1 2649
9060d5cf
MH		 2650 BT_DBG("request for %s", hdev->name);
2651
2652 if (!lmp_bredr_capable(hdev))
2653 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2654 MGMT_STATUS_NOT_SUPPORTED);
2655
1f350c87 2656 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2657 if (key_count > max_key_count) {
2658 BT_ERR("load_link_keys: too big key_count value %u",
2659 key_count);
2660 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2661 MGMT_STATUS_INVALID_PARAMS);
2662 }
55ed8ca1 2663
86742e1e
JH		 2664 expected_len = sizeof(*cp) + key_count *
2665 sizeof(struct mgmt_link_key_info);
a492cd52 2666 if (expected_len != len) {
86742e1e 2667 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2668 expected_len, len);
bdb6d971 2669 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
04124681 2670 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2671 }
2672
4ae14301
JH		 2673 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
2674 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2675 MGMT_STATUS_INVALID_PARAMS);
2676
bdb6d971 2677 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2678 key_count);
55ed8ca1 2679
4ee71b20
JH		 2680 for (i = 0; i < key_count; i++) {
2681 struct mgmt_link_key_info *key = &cp->keys[i];
2682
8e991132 2683 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
4ee71b20
JH		 2684 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2685 MGMT_STATUS_INVALID_PARAMS);
2686 }
2687
09fd0de5 2688 hci_dev_lock(hdev);
55ed8ca1
JH		 2689
2690 hci_link_keys_clear(hdev);
2691
55ed8ca1 2692 if (cp->debug_keys)
0663b297
JH		 2693 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
2694 &hdev->dev_flags);
55ed8ca1 2695 else
0663b297
JH		 2696 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
2697 &hdev->dev_flags);
b1de97d8
MH		 2698
2699 if (changed)
2700 new_settings(hdev, NULL);
55ed8ca1 2701
a492cd52 2702 for (i = 0; i < key_count; i++) {
86742e1e 2703 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2704
58e9293c
JH		 2705 /* Always ignore debug keys and require a new pairing if
2706 * the user wants to use them.
2707 */
2708 if (key->type == HCI_LK_DEBUG_COMBINATION)
2709 continue;
2710
7652ff6a
JH		 2711 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2712 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2713 }
2714
bdb6d971 2715 cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2716
09fd0de5 2717 hci_dev_unlock(hdev);
55ed8ca1 2718
a492cd52 2719 return 0;
55ed8ca1
JH		 2720}
2721
b1078ad0 2722static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2723 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2724{
2725 struct mgmt_ev_device_unpaired ev;
2726
2727 bacpy(&ev.addr.bdaddr, bdaddr);
2728 ev.addr.type = addr_type;
2729
2730 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2731 skip_sk);
b1078ad0
JH		 2732}
2733
bdb6d971 2734static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2735 u16 len)
55ed8ca1 2736{
124f6e35
JH		 2737 struct mgmt_cp_unpair_device *cp = data;
2738 struct mgmt_rp_unpair_device rp;
a8a1d19e
JH		 2739 struct hci_cp_disconnect dc;
2740 struct pending_cmd *cmd;
55ed8ca1 2741 struct hci_conn *conn;
55ed8ca1
JH		 2742 int err;
2743
a8a1d19e 2744 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 2745 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2746 rp.addr.type = cp->addr.type;
a8a1d19e 2747
4ee71b20
JH		 2748 if (!bdaddr_type_is_valid(cp->addr.type))
2749 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2750 MGMT_STATUS_INVALID_PARAMS,
2751 &rp, sizeof(rp));
2752
118da70b
JH		 2753 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2754 return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
2755 MGMT_STATUS_INVALID_PARAMS,
2756 &rp, sizeof(rp));
2757
4ee71b20
JH		 2758 hci_dev_lock(hdev);
2759
86a8cfc6 2760 if (!hdev_is_powered(hdev)) {
bdb6d971 2761 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2762 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
86a8cfc6
JH		 2763 goto unlock;
2764 }
2765
e0b2b27e 2766 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 2767 /* If disconnection is requested, then look up the
2768 * connection. If the remote device is connected, it
2769 * will be later used to terminate the link.
2770 *
2771 * Setting it to NULL explicitly will cause no
2772 * termination of the link.
2773 */
2774 if (cp->disconnect)
2775 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2776 &cp->addr.bdaddr);
2777 else
2778 conn = NULL;
2779
124f6e35 2780 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 2781 } else {
2782 u8 addr_type;
2783
89cbb063
AA		 2784 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
2785 &cp->addr.bdaddr);
2786 if (conn) {
2787 /* Defer clearing up the connection parameters
2788 * until closing to give a chance of keeping
2789 * them if a repairing happens.
2790 */
2791 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
2792
2793 /* If disconnection is not requested, then
2794 * clear the connection variable so that the
2795 * link is not terminated.
2796 */
2797 if (!cp->disconnect)
2798 conn = NULL;
2799 }
2800
e0b2b27e
JH		 2801 if (cp->addr.type == BDADDR_LE_PUBLIC)
2802 addr_type = ADDR_LE_DEV_PUBLIC;
2803 else
2804 addr_type = ADDR_LE_DEV_RANDOM;
2805
a7ec7338
JH		 2806 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
2807
e0b2b27e
JH		 2808 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
2809 }
b0dbfb46 2810
55ed8ca1 2811 if (err < 0) {
bdb6d971 2812 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
04124681 2813 MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
55ed8ca1
JH		 2814 goto unlock;
2815 }
2816
89cbb063
AA		 2817 /* If the connection variable is set, then termination of the
2818 * link is requested.
2819 */
a8a1d19e 2820 if (!conn) {
bdb6d971 2821 err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
04124681 2822 &rp, sizeof(rp));
b1078ad0 2823 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 2824 goto unlock;
2825 }
55ed8ca1 2826
124f6e35 2827 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 2828 sizeof(*cp));
a8a1d19e
JH		 2829 if (!cmd) {
2830 err = -ENOMEM;
2831 goto unlock;
55ed8ca1
JH		 2832 }
2833
d8b7b1e4
JH		 2834 cmd->cmd_complete = addr_cmd_complete;
2835
eb55ef07 2836 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 2837 dc.reason = 0x13; /* Remote User Terminated Connection */
2838 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2839 if (err < 0)
2840 mgmt_pending_remove(cmd);
2841
55ed8ca1 2842unlock:
09fd0de5 2843 hci_dev_unlock(hdev);
55ed8ca1
JH		 2844 return err;
2845}
2846
bdb6d971 2847static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2848 u16 len)
8962ee74 2849{
650f726d 2850 struct mgmt_cp_disconnect *cp = data;
06a63b19 2851 struct mgmt_rp_disconnect rp;
366a0336 2852 struct pending_cmd *cmd;
8962ee74 2853 struct hci_conn *conn;
8962ee74
JH		 2854 int err;
2855
2856 BT_DBG("");
2857
06a63b19
JH		 2858 memset(&rp, 0, sizeof(rp));
2859 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
2860 rp.addr.type = cp->addr.type;
2861
4ee71b20 2862 if (!bdaddr_type_is_valid(cp->addr.type))
06a63b19
JH		 2863 return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2864 MGMT_STATUS_INVALID_PARAMS,
2865 &rp, sizeof(rp));
4ee71b20 2866
09fd0de5 2867 hci_dev_lock(hdev);
8962ee74
JH		 2868
2869 if (!test_bit(HCI_UP, &hdev->flags)) {
06a63b19
JH		 2870 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2871 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
8962ee74
JH		 2872 goto failed;
2873 }
2874
2e58ef3e 2875 if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
06a63b19
JH		 2876 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2877 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 2878 goto failed;
2879 }
2880
591f47f3 2881 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 2882 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
2883 &cp->addr.bdaddr);
88c3df13
JH		 2884 else
2885 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 2886
f960727e 2887 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
06a63b19
JH		 2888 err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
2889 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
8962ee74
JH		 2890 goto failed;
2891 }
2892
2e58ef3e 2893 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 2894 if (!cmd) {
2895 err = -ENOMEM;
8962ee74 2896 goto failed;
366a0336 2897 }
8962ee74 2898
f5818c22
JH		 2899 cmd->cmd_complete = generic_cmd_complete;
2900
e3f2f92a 2901 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 2902 if (err < 0)
a664b5bc 2903 mgmt_pending_remove(cmd);
8962ee74
JH		 2904
2905failed:
09fd0de5 2906 hci_dev_unlock(hdev);
8962ee74
JH		 2907 return err;
2908}
2909
57c1477c 2910static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 2911{
2912 switch (link_type) {
2913 case LE_LINK:
48264f06
JH		 2914 switch (addr_type) {
2915 case ADDR_LE_DEV_PUBLIC:
591f47f3 2916 return BDADDR_LE_PUBLIC;
0ed09148 2917
48264f06 2918 default:
0ed09148 2919 /* Fallback to LE Random address type */
591f47f3 2920 return BDADDR_LE_RANDOM;
48264f06 2921 }
0ed09148 2922
4c659c39 2923 default:
0ed09148 2924 /* Fallback to BR/EDR type */
591f47f3 2925 return BDADDR_BREDR;
4c659c39
JH		 2926 }
2927}
2928
04124681
GP		 2929static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
2930 u16 data_len)
2784eb41 2931{
2784eb41 2932 struct mgmt_rp_get_connections *rp;
8035ded4 2933 struct hci_conn *c;
a38528f1 2934 size_t rp_len;
60fc5fb6
JH		 2935 int err;
2936 u16 i;
2784eb41
JH		 2937
2938 BT_DBG("");
2939
09fd0de5 2940 hci_dev_lock(hdev);
2784eb41 2941
5f97c1df 2942 if (!hdev_is_powered(hdev)) {
bdb6d971 2943 err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
04124681 2944 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 2945 goto unlock;
2946 }
2947
60fc5fb6 2948 i = 0;
b644ba33
JH		 2949 list_for_each_entry(c, &hdev->conn_hash.list, list) {
2950 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 2951 i++;
2784eb41
JH		 2952 }
2953
60fc5fb6 2954 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 2955 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 2956 if (!rp) {
2784eb41
JH		 2957 err = -ENOMEM;
2958 goto unlock;
2959 }
2960
2784eb41 2961 i = 0;
4c659c39 2962 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 2963 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
2964 continue;
4c659c39 2965 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 2966 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 2967 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 2968 continue;
2969 i++;
2970 }
2971
eb55ef07 2972 rp->conn_count = cpu_to_le16(i);
60fc5fb6 2973
4c659c39
JH		 2974 /* Recalculate length in case of filtered SCO connections, etc */
2975 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 2976
bdb6d971 2977 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
04124681 2978 rp_len);
2784eb41 2979
a38528f1 2980 kfree(rp);
5f97c1df
JH		 2981
2982unlock:
09fd0de5 2983 hci_dev_unlock(hdev);
2784eb41
JH		 2984 return err;
2985}
2986
bdb6d971 2987static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 2988 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67
WR		 2989{
2990 struct pending_cmd *cmd;
2991 int err;
2992
2e58ef3e 2993 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 2994 sizeof(*cp));
96d97a67
WR		 2995 if (!cmd)
2996 return -ENOMEM;
2997
d8457698 2998 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 2999 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3000 if (err < 0)
3001 mgmt_pending_remove(cmd);
3002
3003 return err;
3004}
3005
bdb6d971 3006static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3007 u16 len)
980e1a53 3008{
96d97a67 3009 struct hci_conn *conn;
650f726d 3010 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3011 struct hci_cp_pin_code_reply reply;
366a0336 3012 struct pending_cmd *cmd;
980e1a53
JH		 3013 int err;
3014
3015 BT_DBG("");
3016
09fd0de5 3017 hci_dev_lock(hdev);
980e1a53 3018
4b34ee78 3019 if (!hdev_is_powered(hdev)) {
bdb6d971 3020 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3021 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3022 goto failed;
3023 }
3024
d8457698 3025 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3026 if (!conn) {
bdb6d971 3027 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3028 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3029 goto failed;
3030 }
3031
3032 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3033 struct mgmt_cp_pin_code_neg_reply ncp;
3034
3035 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3036
3037 BT_ERR("PIN code is not 16 bytes long");
3038
bdb6d971 3039 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3040 if (err >= 0)
bdb6d971 3041 err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
04124681 3042 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3043
3044 goto failed;
3045 }
3046
00abfe44 3047 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3048 if (!cmd) {
3049 err = -ENOMEM;
980e1a53 3050 goto failed;
366a0336 3051 }
980e1a53 3052
7776d1d8
JH		 3053 cmd->cmd_complete = addr_cmd_complete;
3054
d8457698 3055 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3056 reply.pin_len = cp->pin_len;
24718ca5 3057 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3058
3059 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3060 if (err < 0)
a664b5bc 3061 mgmt_pending_remove(cmd);
980e1a53
JH		 3062
3063failed:
09fd0de5 3064 hci_dev_unlock(hdev);
980e1a53
JH		 3065 return err;
3066}
3067
04124681
GP		 3068static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3069 u16 len)
17fa4b9d 3070{
650f726d 3071 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3072
3073 BT_DBG("");
3074
4ec86d4c
JH		 3075 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
3076 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3077 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
3078
09fd0de5 3079 hci_dev_lock(hdev);
17fa4b9d
JH		 3080
3081 hdev->io_capability = cp->io_capability;
3082
3083 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3084 hdev->io_capability);
17fa4b9d 3085
09fd0de5 3086 hci_dev_unlock(hdev);
17fa4b9d 3087
04124681
GP		 3088 return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
3089 0);
17fa4b9d
JH		 3090}
3091
6039aa73 3092static struct pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3093{
3094 struct hci_dev *hdev = conn->hdev;
8035ded4 3095 struct pending_cmd *cmd;
e9a416b5 3096
2e58ef3e 3097 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3098 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3099 continue;
3100
e9a416b5
JH		 3101 if (cmd->user_data != conn)
3102 continue;
3103
3104 return cmd;
3105 }
3106
3107 return NULL;
3108}
3109
9df74653 3110static int pairing_complete(struct pending_cmd *cmd, u8 status)
e9a416b5
JH		 3111{
3112 struct mgmt_rp_pair_device rp;
3113 struct hci_conn *conn = cmd->user_data;
9df74653 3114 int err;
e9a416b5 3115
61b1a7fb
JH		 3116 bacpy(&rp.addr.bdaddr, &conn->dst);
3117 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3118
9df74653
JH		 3119 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
3120 &rp, sizeof(rp));
e9a416b5
JH		 3121
3122 /* So we don't get further callbacks for this connection */
3123 conn->connect_cfm_cb = NULL;
3124 conn->security_cfm_cb = NULL;
3125 conn->disconn_cfm_cb = NULL;
3126
76a68ba0 3127 hci_conn_drop(conn);
89cbb063
AA		 3128
3129 /* The device is paired so there is no need to remove
3130 * its connection parameters anymore.
3131 */
3132 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3133
3134 hci_conn_put(conn);
9df74653
JH		 3135
3136 return err;
e9a416b5
JH		 3137}
3138
f4a407be
JH		 3139void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3140{
3141 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3142 struct pending_cmd *cmd;
3143
3144 cmd = find_pairing(conn);
a511b35b 3145 if (cmd) {
04ab2749 3146 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3147 mgmt_pending_remove(cmd);
3148 }
f4a407be
JH		 3149}
3150
e9a416b5
JH		 3151static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3152{
3153 struct pending_cmd *cmd;
3154
3155 BT_DBG("status %u", status);
3156
3157 cmd = find_pairing(conn);
a511b35b 3158 if (!cmd) {
e9a416b5 3159 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3160 return;
3161 }
3162
3163 cmd->cmd_complete(cmd, mgmt_status(status));
3164 mgmt_pending_remove(cmd);
e9a416b5
JH		 3165}
3166
f4a407be 3167static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739
VA		 3168{
3169 struct pending_cmd *cmd;
3170
3171 BT_DBG("status %u", status);
3172
3173 if (!status)
3174 return;
3175
3176 cmd = find_pairing(conn);
a511b35b 3177 if (!cmd) {
4c47d739 3178 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3179 return;
3180 }
3181
3182 cmd->cmd_complete(cmd, mgmt_status(status));
3183 mgmt_pending_remove(cmd);
4c47d739
VA		 3184}
3185
bdb6d971 3186static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3187 u16 len)
e9a416b5 3188{
650f726d 3189 struct mgmt_cp_pair_device *cp = data;
1425acb7 3190 struct mgmt_rp_pair_device rp;
e9a416b5
JH		 3191 struct pending_cmd *cmd;
3192 u8 sec_level, auth_type;
3193 struct hci_conn *conn;
e9a416b5
JH		 3194 int err;
3195
3196 BT_DBG("");
3197
f950a30e
SJ		 3198 memset(&rp, 0, sizeof(rp));
3199 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3200 rp.addr.type = cp->addr.type;
3201
4ee71b20
JH		 3202 if (!bdaddr_type_is_valid(cp->addr.type))
3203 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3204 MGMT_STATUS_INVALID_PARAMS,
3205 &rp, sizeof(rp));
3206
4ec86d4c
JH		 3207 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
3208 return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3209 MGMT_STATUS_INVALID_PARAMS,
3210 &rp, sizeof(rp));
3211
09fd0de5 3212 hci_dev_lock(hdev);
e9a416b5 3213
5f97c1df 3214 if (!hdev_is_powered(hdev)) {
f950a30e
SJ		 3215 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3216 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5f97c1df
JH		 3217 goto unlock;
3218 }
3219
c908df36 3220 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3221 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3222
6f77d8c7 3223 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3224 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3225 auth_type);
6f77d8c7
AG		 3226 } else {
3227 u8 addr_type;
3228
3229 /* Convert from L2CAP channel address type to HCI address type
3230 */
3231 if (cp->addr.type == BDADDR_LE_PUBLIC)
3232 addr_type = ADDR_LE_DEV_PUBLIC;
3233 else
3234 addr_type = ADDR_LE_DEV_RANDOM;
3235
7c264b10
MH		 3236 /* When pairing a new device, it is expected to remember
3237 * this device for future connections. Adding the connection
3238 * parameter information ahead of time allows tracking
3239 * of the slave preferred values and will speed up any
3240 * further connection establishment.
3241 *
3242 * If connection parameters already exist, then they
3243 * will be kept and this function does nothing.
3244 */
3245 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3246
6f77d8c7 3247 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3248 sec_level, HCI_LE_CONN_TIMEOUT,
3249 HCI_ROLE_MASTER);
6f77d8c7 3250 }
7a512d01 3251
30e76272 3252 if (IS_ERR(conn)) {
489dc48e
AK		 3253 int status;
3254
3255 if (PTR_ERR(conn) == -EBUSY)
3256 status = MGMT_STATUS_BUSY;
faa81030
LR		 3257 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3258 status = MGMT_STATUS_NOT_SUPPORTED;
3259 else if (PTR_ERR(conn) == -ECONNREFUSED)
3260 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3261 else
3262 status = MGMT_STATUS_CONNECT_FAILED;
3263
bdb6d971 3264 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
489dc48e 3265 status, &rp,
04124681 3266 sizeof(rp));
e9a416b5
JH		 3267 goto unlock;
3268 }
3269
3270 if (conn->connect_cfm_cb) {
76a68ba0 3271 hci_conn_drop(conn);
bdb6d971 3272 err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
04124681 3273 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3274 goto unlock;
3275 }
3276
2e58ef3e 3277 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3278 if (!cmd) {
3279 err = -ENOMEM;
76a68ba0 3280 hci_conn_drop(conn);
e9a416b5
JH		 3281 goto unlock;
3282 }
3283
04ab2749
JH		 3284 cmd->cmd_complete = pairing_complete;
3285
7a512d01 3286 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3287 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3288 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3289 conn->security_cfm_cb = pairing_complete_cb;
3290 conn->disconn_cfm_cb = pairing_complete_cb;
3291 } else {
3292 conn->connect_cfm_cb = le_pairing_complete_cb;
3293 conn->security_cfm_cb = le_pairing_complete_cb;
3294 conn->disconn_cfm_cb = le_pairing_complete_cb;
3295 }
7a512d01 3296
e9a416b5 3297 conn->io_capability = cp->io_cap;
f8aaf9b6 3298 cmd->user_data = hci_conn_get(conn);
e9a416b5 3299
6f78fd4b 3300 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3301 hci_conn_security(conn, sec_level, auth_type, true)) {
3302 cmd->cmd_complete(cmd, 0);
3303 mgmt_pending_remove(cmd);
3304 }
e9a416b5
JH		 3305
3306 err = 0;
3307
3308unlock:
09fd0de5 3309 hci_dev_unlock(hdev);
e9a416b5
JH		 3310 return err;
3311}
3312
04124681
GP		 3313static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3314 u16 len)
28424707 3315{
0f4e68cf 3316 struct mgmt_addr_info *addr = data;
28424707
JH		 3317 struct pending_cmd *cmd;
3318 struct hci_conn *conn;
3319 int err;
3320
3321 BT_DBG("");
3322
28424707
JH		 3323 hci_dev_lock(hdev);
3324
5f97c1df 3325 if (!hdev_is_powered(hdev)) {
bdb6d971 3326 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3327 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3328 goto unlock;
3329 }
3330
28424707
JH		 3331 cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
3332 if (!cmd) {
bdb6d971 3333 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3334 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3335 goto unlock;
3336 }
3337
3338 conn = cmd->user_data;
3339
3340 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
bdb6d971 3341 err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
04124681 3342 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3343 goto unlock;
3344 }
3345
a511b35b
JH		 3346 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3347 mgmt_pending_remove(cmd);
28424707 3348
bdb6d971 3349 err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
04124681 3350 addr, sizeof(*addr));
28424707
JH		 3351unlock:
3352 hci_dev_unlock(hdev);
28424707
JH		 3353 return err;
3354}
3355
bdb6d971 3356static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3357 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3358 u16 hci_op, __le32 passkey)
a5c29683 3359{
a5c29683 3360 struct pending_cmd *cmd;
0df4c185 3361 struct hci_conn *conn;
a5c29683
JH		 3362 int err;
3363
09fd0de5 3364 hci_dev_lock(hdev);
08ba5382 3365
4b34ee78 3366 if (!hdev_is_powered(hdev)) {
feb94d3d
JH		 3367 err = cmd_complete(sk, hdev->id, mgmt_op,
3368 MGMT_STATUS_NOT_POWERED, addr,
3369 sizeof(*addr));
0df4c185 3370 goto done;
a5c29683
JH		 3371 }
3372
1707c60e
JH		 3373 if (addr->type == BDADDR_BREDR)
3374 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3375 else
1707c60e 3376 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3377
3378 if (!conn) {
feb94d3d
JH		 3379 err = cmd_complete(sk, hdev->id, mgmt_op,
3380 MGMT_STATUS_NOT_CONNECTED, addr,
3381 sizeof(*addr));
272d90df
JH		 3382 goto done;
3383 }
47c15e2b 3384
1707c60e 3385 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3386 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3387 if (!err)
feb94d3d
JH		 3388 err = cmd_complete(sk, hdev->id, mgmt_op,
3389 MGMT_STATUS_SUCCESS, addr,
3390 sizeof(*addr));
5fe57d9e 3391 else
feb94d3d
JH		 3392 err = cmd_complete(sk, hdev->id, mgmt_op,
3393 MGMT_STATUS_FAILED, addr,
3394 sizeof(*addr));
47c15e2b 3395
47c15e2b
BG		 3396 goto done;
3397 }
3398
1707c60e 3399 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3400 if (!cmd) {
3401 err = -ENOMEM;
0df4c185 3402 goto done;
a5c29683
JH		 3403 }
3404
7776d1d8
JH		 3405 cmd->cmd_complete = addr_cmd_complete;
3406
0df4c185 3407 /* Continue with pairing via HCI */
604086b7
BG		 3408 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3409 struct hci_cp_user_passkey_reply cp;
3410
1707c60e 3411 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3412 cp.passkey = passkey;
3413 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3414 } else
1707c60e
JH		 3415 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3416 &addr->bdaddr);
604086b7 3417
a664b5bc
JH		 3418 if (err < 0)
3419 mgmt_pending_remove(cmd);
a5c29683 3420
0df4c185 3421done:
09fd0de5 3422 hci_dev_unlock(hdev);
a5c29683
JH		 3423 return err;
3424}
3425
afeb019d
JK		 3426static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3427 void *data, u16 len)
3428{
3429 struct mgmt_cp_pin_code_neg_reply *cp = data;
3430
3431 BT_DBG("");
3432
1707c60e 3433 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3434 MGMT_OP_PIN_CODE_NEG_REPLY,
3435 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3436}
3437
04124681
GP		 3438static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3439 u16 len)
0df4c185 3440{
650f726d 3441 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3442
3443 BT_DBG("");
3444
3445 if (len != sizeof(*cp))
bdb6d971 3446 return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
04124681 3447 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3448
1707c60e 3449 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3450 MGMT_OP_USER_CONFIRM_REPLY,
3451 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3452}
3453
bdb6d971 3454static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3455 void *data, u16 len)
0df4c185 3456{
c9c2659f 3457 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3458
3459 BT_DBG("");
3460
1707c60e 3461 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3462 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3463 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3464}
3465
04124681
GP		 3466static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3467 u16 len)
604086b7 3468{
650f726d 3469 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3470
3471 BT_DBG("");
3472
1707c60e 3473 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3474 MGMT_OP_USER_PASSKEY_REPLY,
3475 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3476}
3477
bdb6d971 3478static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3479 void *data, u16 len)
604086b7 3480{
650f726d 3481 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3482
3483 BT_DBG("");
3484
1707c60e 3485 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3486 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3487 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3488}
3489
13928971 3490static void update_name(struct hci_request *req)
2b4bf397 3491{
13928971 3492 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3493 struct hci_cp_write_local_name cp;
3494
13928971 3495 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3496
890ea898 3497 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3498}
3499
1904a853 3500static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3501{
3502 struct mgmt_cp_set_local_name *cp;
3503 struct pending_cmd *cmd;
3504
3505 BT_DBG("status 0x%02x", status);
3506
3507 hci_dev_lock(hdev);
3508
3509 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
3510 if (!cmd)
3511 goto unlock;
3512
3513 cp = cmd->param;
3514
3515 if (status)
3516 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3517 mgmt_status(status));
3518 else
3519 cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3520 cp, sizeof(*cp));
3521
3522 mgmt_pending_remove(cmd);
3523
3524unlock:
3525 hci_dev_unlock(hdev);
3526}
3527
bdb6d971 3528static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3529 u16 len)
b312b161 3530{
2b4bf397 3531 struct mgmt_cp_set_local_name *cp = data;
b312b161 3532 struct pending_cmd *cmd;
890ea898 3533 struct hci_request req;
b312b161
JH		 3534 int err;
3535
3536 BT_DBG("");
3537
09fd0de5 3538 hci_dev_lock(hdev);
b312b161 3539
b3f2ca94
JH		 3540 /* If the old values are the same as the new ones just return a
3541 * direct command complete event.
3542 */
3543 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3544 !memcmp(hdev->short_name, cp->short_name,
3545 sizeof(hdev->short_name))) {
3546 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3547 data, len);
3548 goto failed;
3549 }
3550
2b4bf397 3551 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3552
b5235a65 3553 if (!hdev_is_powered(hdev)) {
2b4bf397 3554 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde
JH		 3555
3556 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
04124681 3557 data, len);
28cc7bde
JH		 3558 if (err < 0)
3559 goto failed;
3560
3561 err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
04124681 3562 sk);
28cc7bde 3563
b5235a65
JH		 3564 goto failed;
3565 }
3566
28cc7bde 3567 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3568 if (!cmd) {
3569 err = -ENOMEM;
3570 goto failed;
3571 }
3572
13928971
JH		 3573 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3574
890ea898 3575 hci_req_init(&req, hdev);
3f985050
JH		 3576
3577 if (lmp_bredr_capable(hdev)) {
3578 update_name(&req);
3579 update_eir(&req);
3580 }
3581
7a5f4990
MH		 3582 /* The name is stored in the scan response data and so
3583 * no need to udpate the advertising data here.
3584 */
3f985050 3585 if (lmp_le_capable(hdev))
7a5f4990 3586 update_scan_rsp_data(&req);
3f985050 3587
13928971 3588 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3589 if (err < 0)
3590 mgmt_pending_remove(cmd);
3591
3592failed:
09fd0de5 3593 hci_dev_unlock(hdev);
b312b161
JH		 3594 return err;
3595}
3596
0f4e68cf 3597static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3598 void *data, u16 data_len)
c35938b2 3599{
c35938b2
SJ		 3600 struct pending_cmd *cmd;
3601 int err;
3602
bdb6d971 3603 BT_DBG("%s", hdev->name);
c35938b2 3604
09fd0de5 3605 hci_dev_lock(hdev);
c35938b2 3606
4b34ee78 3607 if (!hdev_is_powered(hdev)) {
bdb6d971 3608 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3609 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3610 goto unlock;
3611 }
3612
9a1a1996 3613 if (!lmp_ssp_capable(hdev)) {
bdb6d971 3614 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3615 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3616 goto unlock;
3617 }
3618
2e58ef3e 3619 if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
bdb6d971 3620 err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
04124681 3621 MGMT_STATUS_BUSY);
c35938b2
SJ		 3622 goto unlock;
3623 }
3624
2e58ef3e 3625 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3626 if (!cmd) {
3627 err = -ENOMEM;
3628 goto unlock;
3629 }
3630
710f11c0 3631 if (bredr_sc_enabled(hdev))
4d2d2796
MH		 3632 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
3633 0, NULL);
3634 else
3635 err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
3636
c35938b2
SJ		 3637 if (err < 0)
3638 mgmt_pending_remove(cmd);
3639
3640unlock:
09fd0de5 3641 hci_dev_unlock(hdev);
c35938b2
SJ		 3642 return err;
3643}
3644
bdb6d971 3645static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3646 void *data, u16 len)
2763eda6 3647{
5d57e796 3648 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3649 int err;
3650
bdb6d971 3651 BT_DBG("%s ", hdev->name);
2763eda6 3652
5d57e796
JH		 3653 if (!bdaddr_type_is_valid(addr->type))
3654 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3655 MGMT_STATUS_INVALID_PARAMS, addr,
3656 sizeof(*addr));
3657
09fd0de5 3658 hci_dev_lock(hdev);
2763eda6 3659
ec109113
MH		 3660 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3661 struct mgmt_cp_add_remote_oob_data *cp = data;
3662 u8 status;
bf1e3541 3663
c19a495c
JH		 3664 if (cp->addr.type != BDADDR_BREDR) {
3665 err = cmd_complete(sk, hdev->id,
3666 MGMT_OP_ADD_REMOTE_OOB_DATA,
3667 MGMT_STATUS_INVALID_PARAMS,
3668 &cp->addr, sizeof(cp->addr));
3669 goto unlock;
3670 }
3671
ec109113 3672 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 3673 cp->addr.type, cp->hash,
3674 cp->rand, NULL, NULL);
ec109113
MH		 3675 if (err < 0)
3676 status = MGMT_STATUS_FAILED;
3677 else
3678 status = MGMT_STATUS_SUCCESS;
3679
3680 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3681 status, &cp->addr, sizeof(cp->addr));
3682 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
3683 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 3684 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 3685 u8 status;
3686
86df9200 3687 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 3688 /* Enforce zero-valued 192-bit parameters as
3689 * long as legacy SMP OOB isn't implemented.
3690 */
3691 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
3692 memcmp(cp->hash192, ZERO_KEY, 16)) {
3693 err = cmd_complete(sk, hdev->id,
3694 MGMT_OP_ADD_REMOTE_OOB_DATA,
3695 MGMT_STATUS_INVALID_PARAMS,
3696 addr, sizeof(*addr));
3697 goto unlock;
3698 }
3699
86df9200
JH		 3700 rand192 = NULL;
3701 hash192 = NULL;
3702 } else {
41bcfd50
MH		 3703 /* In case one of the P-192 values is set to zero,
3704 * then just disable OOB data for P-192.
3705 */
3706 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
3707 !memcmp(cp->hash192, ZERO_KEY, 16)) {
3708 rand192 = NULL;
3709 hash192 = NULL;
3710 } else {
3711 rand192 = cp->rand192;
3712 hash192 = cp->hash192;
3713 }
3714 }
3715
3716 /* In case one of the P-256 values is set to zero, then just
3717 * disable OOB data for P-256.
3718 */
3719 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
3720 !memcmp(cp->hash256, ZERO_KEY, 16)) {
3721 rand256 = NULL;
3722 hash256 = NULL;
3723 } else {
3724 rand256 = cp->rand256;
3725 hash256 = cp->hash256;
86df9200
JH		 3726 }
3727
81328d5c 3728 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 3729 cp->addr.type, hash192, rand192,
41bcfd50 3730 hash256, rand256);
ec109113
MH		 3731 if (err < 0)
3732 status = MGMT_STATUS_FAILED;
3733 else
3734 status = MGMT_STATUS_SUCCESS;
3735
3736 err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3737 status, &cp->addr, sizeof(cp->addr));
3738 } else {
3739 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
3740 err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
3741 MGMT_STATUS_INVALID_PARAMS);
3742 }
2763eda6 3743
c19a495c 3744unlock:
09fd0de5 3745 hci_dev_unlock(hdev);
2763eda6
SJ		 3746 return err;
3747}
3748
bdb6d971 3749static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 3750 void *data, u16 len)
2763eda6 3751{
650f726d 3752 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 3753 u8 status;
2763eda6
SJ		 3754 int err;
3755
bdb6d971 3756 BT_DBG("%s", hdev->name);
2763eda6 3757
c19a495c
JH		 3758 if (cp->addr.type != BDADDR_BREDR)
3759 return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
3760 MGMT_STATUS_INVALID_PARAMS,
3761 &cp->addr, sizeof(cp->addr));
3762
09fd0de5 3763 hci_dev_lock(hdev);
2763eda6 3764
eedbd581
JH		 3765 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
3766 hci_remote_oob_data_clear(hdev);
3767 status = MGMT_STATUS_SUCCESS;
3768 goto done;
3769 }
3770
6928a924 3771 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 3772 if (err < 0)
bf1e3541 3773 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 3774 else
a6785be2 3775 status = MGMT_STATUS_SUCCESS;
bf1e3541 3776
eedbd581 3777done:
bdb6d971 3778 err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
04124681 3779 status, &cp->addr, sizeof(cp->addr));
2763eda6 3780
09fd0de5 3781 hci_dev_unlock(hdev);
2763eda6
SJ		 3782 return err;
3783}
3784
8019044d 3785static bool trigger_discovery(struct hci_request *req, u8 *status)
41dc2bd6 3786{
8019044d
MH		 3787 struct hci_dev *hdev = req->hdev;
3788 struct hci_cp_le_set_scan_param param_cp;
3789 struct hci_cp_le_set_scan_enable enable_cp;
3790 struct hci_cp_inquiry inq_cp;
3791 /* General inquiry access code (GIAC) */
3792 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3793 u8 own_addr_type;
41dc2bd6
AG		 3794 int err;
3795
8019044d
MH		 3796 switch (hdev->discovery.type) {
3797 case DISCOV_TYPE_BREDR:
3798 *status = mgmt_bredr_support(hdev);
3799 if (*status)
3800 return false;
41dc2bd6 3801
8019044d
MH		 3802 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
3803 *status = MGMT_STATUS_BUSY;
3804 return false;
3805 }
41dc2bd6 3806
8019044d 3807 hci_inquiry_cache_flush(hdev);
41dc2bd6 3808
8019044d
MH		 3809 memset(&inq_cp, 0, sizeof(inq_cp));
3810 memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
3811 inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
3812 hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
3813 break;
41dc2bd6 3814
8019044d
MH		 3815 case DISCOV_TYPE_LE:
3816 case DISCOV_TYPE_INTERLEAVED:
3817 *status = mgmt_le_support(hdev);
3818 if (*status)
3819 return false;
3820
3821 if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
3822 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
3823 *status = MGMT_STATUS_NOT_SUPPORTED;
3824 return false;
3825 }
3826
3827 if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
3828 /* Don't let discovery abort an outgoing
3829 * connection attempt that's using directed
3830 * advertising.
3831 */
3832 if (hci_conn_hash_lookup_state(hdev, LE_LINK,
3833 BT_CONNECT)) {
3834 *status = MGMT_STATUS_REJECTED;
3835 return false;
3836 }
3837
3838 disable_advertising(req);
3839 }
3840
3841 /* If controller is scanning, it means the background scanning
3842 * is running. Thus, we should temporarily stop it in order to
3843 * set the discovery scanning parameters.
3844 */
3845 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
3846 hci_req_add_le_scan_disable(req);
3847
3848 memset(&param_cp, 0, sizeof(param_cp));
3849
3850 /* All active scans will be done with either a resolvable
3851 * private address (when privacy feature has been enabled)
9437d2ed 3852 * or non-resolvable private address.
8019044d
MH		 3853 */
3854 err = hci_update_random_address(req, true, &own_addr_type);
3855 if (err < 0) {
3856 *status = MGMT_STATUS_FAILED;
3857 return false;
3858 }
3859
3860 param_cp.type = LE_SCAN_ACTIVE;
3861 param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
3862 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
3863 param_cp.own_address_type = own_addr_type;
3864 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
3865 &param_cp);
3866
3867 memset(&enable_cp, 0, sizeof(enable_cp));
3868 enable_cp.enable = LE_SCAN_ENABLE;
3869 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3870 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
3871 &enable_cp);
3872 break;
3873
3874 default:
3875 *status = MGMT_STATUS_INVALID_PARAMS;
3876 return false;
3877 }
3878
3879 return true;
41dc2bd6
AG		 3880}
3881
1904a853
MH		 3882static void start_discovery_complete(struct hci_dev *hdev, u8 status,
3883 u16 opcode)
7c307720 3884{
41dc2bd6 3885 struct pending_cmd *cmd;
11e6e25d 3886 unsigned long timeout;
ae55f598 3887
7c307720
AG		 3888 BT_DBG("status %d", status);
3889
11e6e25d 3890 hci_dev_lock(hdev);
41dc2bd6 3891
11e6e25d 3892 cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427
JP		 3893 if (!cmd)
3894 cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
3895
11e6e25d 3896 if (cmd) {
2922a94f 3897 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 3898 mgmt_pending_remove(cmd);
3899 }
7c307720
AG		 3900
3901 if (status) {
11e6e25d
MH		 3902 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3903 goto unlock;
7c307720
AG		 3904 }
3905
7c307720 3906 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 3907
2d28cfe7
JP		 3908 /* If the scan involves LE scan, pick proper timeout to schedule
3909 * hdev->le_scan_disable that will stop it.
3910 */
7c307720
AG		 3911 switch (hdev->discovery.type) {
3912 case DISCOV_TYPE_LE:
3d5a76f0 3913 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 3914 break;
7c307720 3915 case DISCOV_TYPE_INTERLEAVED:
b9a7a61e 3916 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 3917 break;
7c307720 3918 case DISCOV_TYPE_BREDR:
11e6e25d 3919 timeout = 0;
7c307720 3920 break;
7c307720
AG		 3921 default:
3922 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 3923 timeout = 0;
3924 break;
7c307720 3925 }
ae55f598 3926
2d28cfe7
JP		 3927 if (timeout) {
3928 /* When service discovery is used and the controller has
3929 * a strict duplicate filter, it is important to remember
3930 * the start and duration of the scan. This is required
3931 * for restarting scanning during the discovery phase.
3932 */
3933 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
3934 &hdev->quirks) &&
3935 (hdev->discovery.uuid_count > 0 ||
3936 hdev->discovery.rssi != HCI_RSSI_INVALID)) {
3937 hdev->discovery.scan_start = jiffies;
3938 hdev->discovery.scan_duration = timeout;
3939 }
3940
11e6e25d
MH		 3941 queue_delayed_work(hdev->workqueue,
3942 &hdev->le_scan_disable, timeout);
2d28cfe7 3943 }
ae55f598 3944
11e6e25d
MH		 3945unlock:
3946 hci_dev_unlock(hdev);
7c307720
AG		 3947}
3948
bdb6d971 3949static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 3950 void *data, u16 len)
14a53664 3951{
650f726d 3952 struct mgmt_cp_start_discovery *cp = data;
14a53664 3953 struct pending_cmd *cmd;
7c307720 3954 struct hci_request req;
8019044d 3955 u8 status;
14a53664
JH		 3956 int err;
3957
bdb6d971 3958 BT_DBG("%s", hdev->name);
14a53664 3959
09fd0de5 3960 hci_dev_lock(hdev);
14a53664 3961
4b34ee78 3962 if (!hdev_is_powered(hdev)) {
a736abc1
SJ		 3963 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3964 MGMT_STATUS_NOT_POWERED,
3965 &cp->type, sizeof(cp->type));
bd2d1334
JH		 3966 goto failed;
3967 }
3968
f5a969f2
MH		 3969 if (hdev->discovery.state != DISCOVERY_STOPPED ||
3970 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
a736abc1
SJ		 3971 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
3972 MGMT_STATUS_BUSY, &cp->type,
3973 sizeof(cp->type));
642be6c7
AG		 3974 goto failed;
3975 }
3976
2922a94f 3977 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 3978 if (!cmd) {
3979 err = -ENOMEM;
3980 goto failed;
3981 }
3982
2922a94f
JH		 3983 cmd->cmd_complete = generic_cmd_complete;
3984
22078800
MH		 3985 /* Clear the discovery filter first to free any previously
3986 * allocated memory for the UUID list.
3987 */
3988 hci_discovery_filter_clear(hdev);
3989
4aab14e5 3990 hdev->discovery.type = cp->type;
da25cf6a 3991 hdev->discovery.report_invalid_rssi = false;
4aab14e5 3992
7c307720
AG		 3993 hci_req_init(&req, hdev);
3994
8019044d 3995 if (!trigger_discovery(&req, &status)) {
a736abc1 3996 err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
8019044d 3997 status, &cp->type, sizeof(cp->type));
04106755
JH		 3998 mgmt_pending_remove(cmd);
3999 goto failed;
f39799f5 4000 }
04106755 4001
7c307720 4002 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4003 if (err < 0) {
14a53664 4004 mgmt_pending_remove(cmd);
f5a969f2
MH		 4005 goto failed;
4006 }
7c307720 4007
f5a969f2 4008 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4009
14a53664 4010failed:
09fd0de5 4011 hci_dev_unlock(hdev);
14a53664
JH		 4012 return err;
4013}
f39799f5 4014
9df74653 4015static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
2922a94f 4016{
9df74653
JH		 4017 return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4018 cmd->param, 1);
2922a94f 4019}
04106755 4020
66ea9427
JP		 4021static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4022 void *data, u16 len)
4023{
4024 struct mgmt_cp_start_service_discovery *cp = data;
4025 struct pending_cmd *cmd;
4026 struct hci_request req;
4027 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4028 u16 uuid_count, expected_len;
4029 u8 status;
4030 int err;
04106755 4031
66ea9427 4032 BT_DBG("%s", hdev->name);
e8bb6b97 4033
66ea9427 4034 hci_dev_lock(hdev);
7c307720 4035
66ea9427
JP		 4036 if (!hdev_is_powered(hdev)) {
4037 err = cmd_complete(sk, hdev->id,
4038 MGMT_OP_START_SERVICE_DISCOVERY,
4039 MGMT_STATUS_NOT_POWERED,
4040 &cp->type, sizeof(cp->type));
4041 goto failed;
4042 }
7c307720 4043
66ea9427
JP		 4044 if (hdev->discovery.state != DISCOVERY_STOPPED ||
4045 test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
4046 err = cmd_complete(sk, hdev->id,
4047 MGMT_OP_START_SERVICE_DISCOVERY,
4048 MGMT_STATUS_BUSY, &cp->type,
4049 sizeof(cp->type));
4050 goto failed;
4051 }
d9483943 4052
66ea9427
JP		 4053 uuid_count = __le16_to_cpu(cp->uuid_count);
4054 if (uuid_count > max_uuid_count) {
4055 BT_ERR("service_discovery: too big uuid_count value %u",
4056 uuid_count);
4057 err = cmd_complete(sk, hdev->id,
4058 MGMT_OP_START_SERVICE_DISCOVERY,
4059 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4060 sizeof(cp->type));
4061 goto failed;
4062 }
4063
4064 expected_len = sizeof(*cp) + uuid_count * 16;
4065 if (expected_len != len) {
4066 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4067 expected_len, len);
4068 err = cmd_complete(sk, hdev->id,
4069 MGMT_OP_START_SERVICE_DISCOVERY,
4070 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4071 sizeof(cp->type));
4072 goto failed;
4073 }
4074
4075 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4076 hdev, data, len);
66ea9427
JP		 4077 if (!cmd) {
4078 err = -ENOMEM;
4079 goto failed;
4080 }
4081
2922a94f
JH		 4082 cmd->cmd_complete = service_discovery_cmd_complete;
4083
22078800
MH		 4084 /* Clear the discovery filter first to free any previously
4085 * allocated memory for the UUID list.
4086 */
4087 hci_discovery_filter_clear(hdev);
4088
66ea9427
JP		 4089 hdev->discovery.type = cp->type;
4090 hdev->discovery.rssi = cp->rssi;
4091 hdev->discovery.uuid_count = uuid_count;
4092
4093 if (uuid_count > 0) {
4094 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4095 GFP_KERNEL);
4096 if (!hdev->discovery.uuids) {
a736abc1 4097 err = cmd_complete(sk, hdev->id,
66ea9427 4098 MGMT_OP_START_SERVICE_DISCOVERY,
a736abc1
SJ		 4099 MGMT_STATUS_FAILED,
4100 &cp->type, sizeof(cp->type));
d9483943
JH		 4101 mgmt_pending_remove(cmd);
4102 goto failed;
4103 }
66ea9427 4104 }
d9483943 4105
66ea9427 4106 hci_req_init(&req, hdev);
5e0452c0 4107
66ea9427
JP		 4108 if (!trigger_discovery(&req, &status)) {
4109 err = cmd_complete(sk, hdev->id,
4110 MGMT_OP_START_SERVICE_DISCOVERY,
4111 status, &cp->type, sizeof(cp->type));
04106755
JH		 4112 mgmt_pending_remove(cmd);
4113 goto failed;
f39799f5 4114 }
3fd24153 4115
7c307720 4116 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4117 if (err < 0) {
14a53664 4118 mgmt_pending_remove(cmd);
66ea9427
JP		 4119 goto failed;
4120 }
4121
4122 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4123
4124failed:
09fd0de5 4125 hci_dev_unlock(hdev);
14a53664
JH		 4126 return err;
4127}
4128
1904a853 4129static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca
AG		 4130{
4131 struct pending_cmd *cmd;
1183fdca 4132
0e05bba6
AG		 4133 BT_DBG("status %d", status);
4134
4135 hci_dev_lock(hdev);
4136
11e6e25d
MH		 4137 cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
4138 if (cmd) {
2922a94f 4139 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4140 mgmt_pending_remove(cmd);
0e05bba6
AG		 4141 }
4142
11e6e25d
MH		 4143 if (!status)
4144 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4145
0e05bba6
AG		 4146 hci_dev_unlock(hdev);
4147}
4148
bdb6d971 4149static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4150 u16 len)
14a53664 4151{
d930650b 4152 struct mgmt_cp_stop_discovery *mgmt_cp = data;
14a53664 4153 struct pending_cmd *cmd;
0e05bba6 4154 struct hci_request req;
14a53664
JH		 4155 int err;
4156
bdb6d971 4157 BT_DBG("%s", hdev->name);
14a53664 4158
09fd0de5 4159 hci_dev_lock(hdev);
14a53664 4160
30dc78e1 4161 if (!hci_discovery_active(hdev)) {
bdb6d971 4162 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 4163 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4164 sizeof(mgmt_cp->type));
d930650b
JH		 4165 goto unlock;
4166 }
4167
4168 if (hdev->discovery.type != mgmt_cp->type) {
bdb6d971 4169 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
04124681
GP		 4170 MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
4171 sizeof(mgmt_cp->type));
30dc78e1 4172 goto unlock;
ff9ef578
JH		 4173 }
4174
2922a94f 4175 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4176 if (!cmd) {
4177 err = -ENOMEM;
30dc78e1
JH		 4178 goto unlock;
4179 }
4180
2922a94f
JH		 4181 cmd->cmd_complete = generic_cmd_complete;
4182
0e05bba6
AG		 4183 hci_req_init(&req, hdev);
4184
21a60d30 4185 hci_stop_discovery(&req);
e0d9727e 4186
21a60d30
JH		 4187 err = hci_req_run(&req, stop_discovery_complete);
4188 if (!err) {
4189 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4190 goto unlock;
14a53664
JH		 4191 }
4192
21a60d30
JH		 4193 mgmt_pending_remove(cmd);
4194
4195 /* If no HCI commands were sent we're done */
4196 if (err == -ENODATA) {
4197 err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4198 &mgmt_cp->type, sizeof(mgmt_cp->type));
4199 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4200 }
14a53664 4201
30dc78e1 4202unlock:
09fd0de5 4203 hci_dev_unlock(hdev);
14a53664
JH		 4204 return err;
4205}
4206
bdb6d971 4207static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4208 u16 len)
561aafbc 4209{
650f726d 4210 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4211 struct inquiry_entry *e;
561aafbc
JH		 4212 int err;
4213
bdb6d971 4214 BT_DBG("%s", hdev->name);
561aafbc 4215
561aafbc
JH		 4216 hci_dev_lock(hdev);
4217
30dc78e1 4218 if (!hci_discovery_active(hdev)) {
d3a2541d
LR		 4219 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4220 MGMT_STATUS_FAILED, &cp->addr,
4221 sizeof(cp->addr));
30dc78e1
JH		 4222 goto failed;
4223 }
4224
a198e7b1 4225 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4226 if (!e) {
d3a2541d
LR		 4227 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4228 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4229 sizeof(cp->addr));
561aafbc
JH		 4230 goto failed;
4231 }
4232
4233 if (cp->name_known) {
4234 e->name_state = NAME_KNOWN;
4235 list_del(&e->list);
4236 } else {
4237 e->name_state = NAME_NEEDED;
a3d4e20a 4238 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4239 }
4240
e384662b
JH		 4241 err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
4242 sizeof(cp->addr));
561aafbc
JH		 4243
4244failed:
4245 hci_dev_unlock(hdev);
561aafbc
JH		 4246 return err;
4247}
4248
bdb6d971 4249static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4250 u16 len)
7fbec224 4251{
650f726d 4252 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4253 u8 status;
7fbec224
AJ		 4254 int err;
4255
bdb6d971 4256 BT_DBG("%s", hdev->name);
7fbec224 4257
4ee71b20 4258 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 4259 return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4260 MGMT_STATUS_INVALID_PARAMS,
4261 &cp->addr, sizeof(cp->addr));
4ee71b20 4262
09fd0de5 4263 hci_dev_lock(hdev);
5e762444 4264
dcc36c16
JH		 4265 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4266 cp->addr.type);
2a8357f2 4267 if (err < 0) {
f0eeea8b 4268 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4269 goto done;
4270 }
4271
4272 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4273 sk);
4274 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4275
2a8357f2 4276done:
bdb6d971 4277 err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
04124681 4278 &cp->addr, sizeof(cp->addr));
5e762444 4279
09fd0de5 4280 hci_dev_unlock(hdev);
7fbec224
AJ		 4281
4282 return err;
4283}
4284
bdb6d971 4285static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4286 u16 len)
7fbec224 4287{
650f726d 4288 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4289 u8 status;
7fbec224
AJ		 4290 int err;
4291
bdb6d971 4292 BT_DBG("%s", hdev->name);
7fbec224 4293
4ee71b20 4294 if (!bdaddr_type_is_valid(cp->addr.type))
5d0846d4
JH		 4295 return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4296 MGMT_STATUS_INVALID_PARAMS,
4297 &cp->addr, sizeof(cp->addr));
4ee71b20 4298
09fd0de5 4299 hci_dev_lock(hdev);
5e762444 4300
dcc36c16
JH		 4301 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4302 cp->addr.type);
2a8357f2 4303 if (err < 0) {
f0eeea8b 4304 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4305 goto done;
4306 }
4307
4308 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4309 sk);
4310 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4311
2a8357f2 4312done:
bdb6d971 4313 err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
04124681 4314 &cp->addr, sizeof(cp->addr));
5e762444 4315
09fd0de5 4316 hci_dev_unlock(hdev);
7fbec224
AJ		 4317
4318 return err;
4319}
4320
cdbaccca
MH		 4321static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4322 u16 len)
4323{
4324 struct mgmt_cp_set_device_id *cp = data;
890ea898 4325 struct hci_request req;
cdbaccca 4326 int err;
c72d4b8a 4327 __u16 source;
cdbaccca
MH		 4328
4329 BT_DBG("%s", hdev->name);
4330
c72d4b8a
SJ		 4331 source = __le16_to_cpu(cp->source);
4332
4333 if (source > 0x0002)
4334 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4335 MGMT_STATUS_INVALID_PARAMS);
4336
cdbaccca
MH		 4337 hci_dev_lock(hdev);
4338
c72d4b8a 4339 hdev->devid_source = source;
cdbaccca
MH		 4340 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4341 hdev->devid_product = __le16_to_cpu(cp->product);
4342 hdev->devid_version = __le16_to_cpu(cp->version);
4343
4344 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
4345
890ea898
JH		 4346 hci_req_init(&req, hdev);
4347 update_eir(&req);
4348 hci_req_run(&req, NULL);
cdbaccca
MH		 4349
4350 hci_dev_unlock(hdev);
4351
4352 return err;
4353}
4354
1904a853
MH		 4355static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4356 u16 opcode)
4375f103
JH		 4357{
4358 struct cmd_lookup match = { NULL, hdev };
4359
3ad67582
JK		 4360 hci_dev_lock(hdev);
4361
4375f103
JH		 4362 if (status) {
4363 u8 mgmt_err = mgmt_status(status);
4364
4365 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4366 cmd_status_rsp, &mgmt_err);
3ad67582 4367 goto unlock;
4375f103
JH		 4368 }
4369
c93bd150
JH		 4370 if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
4371 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
4372 else
4373 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
4374
4375f103
JH		 4375 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4376 &match);
4377
4378 new_settings(hdev, match.sk);
4379
4380 if (match.sk)
4381 sock_put(match.sk);
3ad67582
JK		 4382
4383unlock:
4384 hci_dev_unlock(hdev);
4375f103
JH		 4385}
4386
21b5187f
MH		 4387static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4388 u16 len)
4375f103
JH		 4389{
4390 struct mgmt_mode *cp = data;
4391 struct pending_cmd *cmd;
4392 struct hci_request req;
e6fe7986 4393 u8 val, enabled, status;
4375f103
JH		 4394 int err;
4395
4396 BT_DBG("request for %s", hdev->name);
4397
e6fe7986
JH		 4398 status = mgmt_le_support(hdev);
4399 if (status)
4375f103 4400 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
e6fe7986 4401 status);
4375f103
JH		 4402
4403 if (cp->val != 0x00 && cp->val != 0x01)
4404 return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4405 MGMT_STATUS_INVALID_PARAMS);
4406
4407 hci_dev_lock(hdev);
4408
4409 val = !!cp->val;
f3d3444a 4410 enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103 4411
f74ca9b8
JH		 4412 /* The following conditions are ones which mean that we should
4413 * not do any HCI communication but directly send a mgmt
4414 * response to user space (after toggling the flag if
4415 * necessary).
4416 */
4417 if (!hdev_is_powered(hdev) || val == enabled ||
e8bb6b97
JH		 4418 hci_conn_num(hdev, LE_LINK) > 0 ||
4419 (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4420 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
4375f103
JH		 4421 bool changed = false;
4422
f3d3444a
JH		 4423 if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
4424 change_bit(HCI_ADVERTISING, &hdev->dev_flags);
4375f103
JH		 4425 changed = true;
4426 }
4427
4428 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4429 if (err < 0)
4430 goto unlock;
4431
4432 if (changed)
4433 err = new_settings(hdev, sk);
4434
4435 goto unlock;
4436 }
4437
4438 if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4439 mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
4440 err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4441 MGMT_STATUS_BUSY);
4442 goto unlock;
4443 }
4444
4445 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4446 if (!cmd) {
4447 err = -ENOMEM;
4448 goto unlock;
4449 }
4450
4451 hci_req_init(&req, hdev);
4452
bba3aa55
MH		 4453 if (val)
4454 enable_advertising(&req);
4455 else
4456 disable_advertising(&req);
4375f103
JH		 4457
4458 err = hci_req_run(&req, set_advertising_complete);
4459 if (err < 0)
4460 mgmt_pending_remove(cmd);
4461
4462unlock:
4463 hci_dev_unlock(hdev);
4464 return err;
4465}
4466
d13eafce
MH		 4467static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4468 void *data, u16 len)
4469{
4470 struct mgmt_cp_set_static_address *cp = data;
4471 int err;
4472
4473 BT_DBG("%s", hdev->name);
4474
62af4443 4475 if (!lmp_le_capable(hdev))
d13eafce 4476 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
62af4443 4477 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4478
4479 if (hdev_is_powered(hdev))
4480 return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4481 MGMT_STATUS_REJECTED);
4482
4483 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4484 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
4485 return cmd_status(sk, hdev->id,
4486 MGMT_OP_SET_STATIC_ADDRESS,
4487 MGMT_STATUS_INVALID_PARAMS);
4488
4489 /* Two most significant bits shall be set */
4490 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
4491 return cmd_status(sk, hdev->id,
4492 MGMT_OP_SET_STATIC_ADDRESS,
4493 MGMT_STATUS_INVALID_PARAMS);
4494 }
4495
4496 hci_dev_lock(hdev);
4497
4498 bacpy(&hdev->static_addr, &cp->bdaddr);
4499
4500 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
4501
4502 hci_dev_unlock(hdev);
4503
4504 return err;
4505}
4506
14b49b9a
MH		 4507static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4508 void *data, u16 len)
4509{
4510 struct mgmt_cp_set_scan_params *cp = data;
4511 __u16 interval, window;
4512 int err;
4513
4514 BT_DBG("%s", hdev->name);
4515
4516 if (!lmp_le_capable(hdev))
4517 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4518 MGMT_STATUS_NOT_SUPPORTED);
4519
4520 interval = __le16_to_cpu(cp->interval);
4521
4522 if (interval < 0x0004 || interval > 0x4000)
4523 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4524 MGMT_STATUS_INVALID_PARAMS);
4525
4526 window = __le16_to_cpu(cp->window);
4527
4528 if (window < 0x0004 || window > 0x4000)
4529 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4530 MGMT_STATUS_INVALID_PARAMS);
4531
899e1075
MH		 4532 if (window > interval)
4533 return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4534 MGMT_STATUS_INVALID_PARAMS);
4535
14b49b9a
MH		 4536 hci_dev_lock(hdev);
4537
4538 hdev->le_scan_interval = interval;
4539 hdev->le_scan_window = window;
4540
4541 err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
4542
dd2ef8e2
AG		 4543 /* If background scan is running, restart it so new parameters are
4544 * loaded.
4545 */
4546 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
4547 hdev->discovery.state == DISCOVERY_STOPPED) {
4548 struct hci_request req;
4549
4550 hci_req_init(&req, hdev);
4551
4552 hci_req_add_le_scan_disable(&req);
4553 hci_req_add_le_passive_scan(&req);
4554
4555 hci_req_run(&req, NULL);
4556 }
4557
14b49b9a
MH		 4558 hci_dev_unlock(hdev);
4559
4560 return err;
4561}
4562
1904a853
MH		 4563static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
4564 u16 opcode)
33e38b3e
JH		 4565{
4566 struct pending_cmd *cmd;
4567
4568 BT_DBG("status 0x%02x", status);
4569
4570 hci_dev_lock(hdev);
4571
4572 cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4573 if (!cmd)
4574 goto unlock;
4575
4576 if (status) {
4577 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4578 mgmt_status(status));
4579 } else {
1a4d3c4b
JH		 4580 struct mgmt_mode *cp = cmd->param;
4581
4582 if (cp->val)
4583 set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4584 else
4585 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4586
33e38b3e
JH		 4587 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
4588 new_settings(hdev, cmd->sk);
4589 }
4590
4591 mgmt_pending_remove(cmd);
4592
4593unlock:
4594 hci_dev_unlock(hdev);
4595}
4596
bdb6d971 4597static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 4598 void *data, u16 len)
f6422ec6 4599{
650f726d 4600 struct mgmt_mode *cp = data;
33e38b3e
JH		 4601 struct pending_cmd *cmd;
4602 struct hci_request req;
f6422ec6
AJ		 4603 int err;
4604
bdb6d971 4605 BT_DBG("%s", hdev->name);
f6422ec6 4606
56f87901
JH		 4607 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
4608 hdev->hci_ver < BLUETOOTH_VER_1_2)
33c525c0
JH		 4609 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4610 MGMT_STATUS_NOT_SUPPORTED);
4611
a7e80f25
JH		 4612 if (cp->val != 0x00 && cp->val != 0x01)
4613 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4614 MGMT_STATUS_INVALID_PARAMS);
4615
5400c044 4616 if (!hdev_is_powered(hdev))
bdb6d971 4617 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4618 MGMT_STATUS_NOT_POWERED);
5400c044
JH		 4619
4620 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
bdb6d971 4621 return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4622 MGMT_STATUS_REJECTED);
f6422ec6
AJ		 4623
4624 hci_dev_lock(hdev);
4625
05cbf29f
JH		 4626 if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
4627 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
4628 MGMT_STATUS_BUSY);
4629 goto unlock;
4630 }
4631
1a4d3c4b
JH		 4632 if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
4633 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
4634 hdev);
4635 goto unlock;
4636 }
4637
33e38b3e
JH		 4638 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
4639 data, len);
4640 if (!cmd) {
4641 err = -ENOMEM;
4642 goto unlock;
f6422ec6
AJ		 4643 }
4644
33e38b3e
JH		 4645 hci_req_init(&req, hdev);
4646
406d7804 4647 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 4648
4649 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 4650 if (err < 0) {
bdb6d971 4651 err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
04124681 4652 MGMT_STATUS_FAILED);
33e38b3e 4653 mgmt_pending_remove(cmd);
f6422ec6
AJ		 4654 }
4655
33e38b3e 4656unlock:
f6422ec6 4657 hci_dev_unlock(hdev);
33e38b3e 4658
f6422ec6
AJ		 4659 return err;
4660}
4661
1904a853 4662static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a
JH		 4663{
4664 struct pending_cmd *cmd;
4665
4666 BT_DBG("status 0x%02x", status);
4667
4668 hci_dev_lock(hdev);
4669
4670 cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
4671 if (!cmd)
4672 goto unlock;
4673
4674 if (status) {
4675 u8 mgmt_err = mgmt_status(status);
4676
4677 /* We need to restore the flag if related HCI commands
4678 * failed.
4679 */
4680 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4681
4682 cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
4683 } else {
4684 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
4685 new_settings(hdev, cmd->sk);
4686 }
4687
4688 mgmt_pending_remove(cmd);
4689
4690unlock:
4691 hci_dev_unlock(hdev);
4692}
4693
4694static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
4695{
4696 struct mgmt_mode *cp = data;
4697 struct pending_cmd *cmd;
4698 struct hci_request req;
4699 int err;
4700
4701 BT_DBG("request for %s", hdev->name);
4702
4703 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
4704 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4705 MGMT_STATUS_NOT_SUPPORTED);
4706
4707 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
4708 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4709 MGMT_STATUS_REJECTED);
4710
4711 if (cp->val != 0x00 && cp->val != 0x01)
4712 return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4713 MGMT_STATUS_INVALID_PARAMS);
4714
4715 hci_dev_lock(hdev);
4716
4717 if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
4718 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4719 goto unlock;
4720 }
4721
4722 if (!hdev_is_powered(hdev)) {
4723 if (!cp->val) {
0663ca2a
JH		 4724 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
4725 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
4726 clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
4727 clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
4728 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
4729 }
4730
4731 change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4732
4733 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
4734 if (err < 0)
4735 goto unlock;
4736
4737 err = new_settings(hdev, sk);
4738 goto unlock;
4739 }
4740
4741 /* Reject disabling when powered on */
4742 if (!cp->val) {
4743 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4744 MGMT_STATUS_REJECTED);
4745 goto unlock;
111e4bcc
MH		 4746 } else {
4747 /* When configuring a dual-mode controller to operate
4748 * with LE only and using a static address, then switching
4749 * BR/EDR back on is not allowed.
4750 *
4751 * Dual-mode controllers shall operate with the public
4752 * address as its identity address for BR/EDR and LE. So
4753 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 4754 *
4755 * The same restrictions applies when secure connections
4756 * has been enabled. For BR/EDR this is a controller feature
4757 * while for LE it is a host stack feature. This means that
4758 * switching BR/EDR back on when secure connections has been
4759 * enabled is not a supported transaction.
111e4bcc
MH		 4760 */
4761 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
3a5486e1
MH		 4762 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
4763 test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
111e4bcc
MH		 4764 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4765 MGMT_STATUS_REJECTED);
4766 goto unlock;
4767 }
0663ca2a
JH		 4768 }
4769
4770 if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
4771 err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
4772 MGMT_STATUS_BUSY);
4773 goto unlock;
4774 }
4775
4776 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
4777 if (!cmd) {
4778 err = -ENOMEM;
4779 goto unlock;
4780 }
4781
5947f4bc 4782 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 4783 * generates the correct flags.
4784 */
4785 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4786
4787 hci_req_init(&req, hdev);
aa8af46e 4788
432df05e 4789 write_fast_connectable(&req, false);
1d2dc5b7 4790 __hci_update_page_scan(&req);
aa8af46e 4791
f14d8f64
MH		 4792 /* Since only the advertising data flags will change, there
4793 * is no need to update the scan response data.
4794 */
5947f4bc 4795 update_adv_data(&req);
aa8af46e 4796
0663ca2a
JH		 4797 err = hci_req_run(&req, set_bredr_complete);
4798 if (err < 0)
4799 mgmt_pending_remove(cmd);
4800
4801unlock:
4802 hci_dev_unlock(hdev);
4803 return err;
4804}
4805
a1443f5a
JH		 4806static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
4807{
4808 struct pending_cmd *cmd;
4809 struct mgmt_mode *cp;
4810
4811 BT_DBG("%s status %u", hdev->name, status);
4812
4813 hci_dev_lock(hdev);
4814
4815 cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
4816 if (!cmd)
4817 goto unlock;
4818
4819 if (status) {
4820 cmd_status(cmd->sk, cmd->index, cmd->opcode,
4821 mgmt_status(status));
4822 goto remove;
4823 }
4824
4825 cp = cmd->param;
4826
4827 switch (cp->val) {
4828 case 0x00:
4829 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4830 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4831 break;
4832 case 0x01:
4833 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4834 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4835 break;
4836 case 0x02:
4837 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
4838 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4839 break;
4840 }
4841
4842 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
4843 new_settings(hdev, cmd->sk);
4844
4845remove:
4846 mgmt_pending_remove(cmd);
4847unlock:
4848 hci_dev_unlock(hdev);
4849}
4850
eac83dc6
MH		 4851static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
4852 void *data, u16 len)
4853{
4854 struct mgmt_mode *cp = data;
4855 struct pending_cmd *cmd;
a1443f5a 4856 struct hci_request req;
a3209694 4857 u8 val;
eac83dc6
MH		 4858 int err;
4859
4860 BT_DBG("request for %s", hdev->name);
4861
05b3c3e7
MH		 4862 if (!lmp_sc_capable(hdev) &&
4863 !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
eac83dc6
MH		 4864 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4865 MGMT_STATUS_NOT_SUPPORTED);
4866
ed93ec69 4867 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
59200286 4868 lmp_sc_capable(hdev) &&
ed93ec69
MH		 4869 !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
4870 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4871 MGMT_STATUS_REJECTED);
4872
0ab04a9c 4873 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
eac83dc6
MH		 4874 return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4875 MGMT_STATUS_INVALID_PARAMS);
4876
4877 hci_dev_lock(hdev);
4878
05b3c3e7 4879 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
a3209694 4880 !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
eac83dc6
MH		 4881 bool changed;
4882
0ab04a9c 4883 if (cp->val) {
eac83dc6
MH		 4884 changed = !test_and_set_bit(HCI_SC_ENABLED,
4885 &hdev->dev_flags);
0ab04a9c
MH		 4886 if (cp->val == 0x02)
4887 set_bit(HCI_SC_ONLY, &hdev->dev_flags);
4888 else
4889 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4890 } else {
eac83dc6
MH		 4891 changed = test_and_clear_bit(HCI_SC_ENABLED,
4892 &hdev->dev_flags);
0ab04a9c
MH		 4893 clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
4894 }
eac83dc6
MH		 4895
4896 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4897 if (err < 0)
4898 goto failed;
4899
4900 if (changed)
4901 err = new_settings(hdev, sk);
4902
4903 goto failed;
4904 }
4905
4906 if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
4907 err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
4908 MGMT_STATUS_BUSY);
4909 goto failed;
4910 }
4911
0ab04a9c
MH		 4912 val = !!cp->val;
4913
4914 if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
4915 (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
eac83dc6
MH		 4916 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
4917 goto failed;
4918 }
4919
4920 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
4921 if (!cmd) {
4922 err = -ENOMEM;
4923 goto failed;
4924 }
4925
a1443f5a
JH		 4926 hci_req_init(&req, hdev);
4927 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
4928 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 4929 if (err < 0) {
4930 mgmt_pending_remove(cmd);
4931 goto failed;
4932 }
4933
4934failed:
4935 hci_dev_unlock(hdev);
4936 return err;
4937}
4938
4e39ac81
MH		 4939static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
4940 void *data, u16 len)
4941{
4942 struct mgmt_mode *cp = data;
b9710979 4943 bool changed, use_changed;
4e39ac81
MH		 4944 int err;
4945
4946 BT_DBG("request for %s", hdev->name);
4947
b9710979 4948 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
4e39ac81
MH		 4949 return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
4950 MGMT_STATUS_INVALID_PARAMS);
4951
4952 hci_dev_lock(hdev);
4953
4954 if (cp->val)
0663b297
JH		 4955 changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
4956 &hdev->dev_flags);
4e39ac81 4957 else
0663b297
JH		 4958 changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
4959 &hdev->dev_flags);
4e39ac81 4960
b9710979
JH		 4961 if (cp->val == 0x02)
4962 use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
4963 &hdev->dev_flags);
4964 else
4965 use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
4966 &hdev->dev_flags);
4967
4968 if (hdev_is_powered(hdev) && use_changed &&
4969 test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
4970 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
4971 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
4972 sizeof(mode), &mode);
4973 }
4974
4e39ac81
MH		 4975 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
4976 if (err < 0)
4977 goto unlock;
4978
4979 if (changed)
4980 err = new_settings(hdev, sk);
4981
4982unlock:
4983 hci_dev_unlock(hdev);
4984 return err;
4985}
4986
62b04cd1
JH		 4987static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
4988 u16 len)
4989{
4990 struct mgmt_cp_set_privacy *cp = cp_data;
4991 bool changed;
4992 int err;
4993
4994 BT_DBG("request for %s", hdev->name);
4995
4996 if (!lmp_le_capable(hdev))
4997 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
4998 MGMT_STATUS_NOT_SUPPORTED);
4999
5000 if (cp->privacy != 0x00 && cp->privacy != 0x01)
5001 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5002 MGMT_STATUS_INVALID_PARAMS);
5003
5004 if (hdev_is_powered(hdev))
5005 return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5006 MGMT_STATUS_REJECTED);
5007
5008 hci_dev_lock(hdev);
5009
c21c0ea0
JH		 5010 /* If user space supports this command it is also expected to
5011 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5012 */
5013 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5014
62b04cd1
JH		 5015 if (cp->privacy) {
5016 changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
5017 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
5018 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5019 } else {
5020 changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
5021 memset(hdev->irk, 0, sizeof(hdev->irk));
5022 clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
5023 }
5024
5025 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5026 if (err < 0)
5027 goto unlock;
5028
5029 if (changed)
5030 err = new_settings(hdev, sk);
5031
5032unlock:
5033 hci_dev_unlock(hdev);
5034 return err;
5035}
5036
41edf160
JH		 5037static bool irk_is_valid(struct mgmt_irk_info *irk)
5038{
5039 switch (irk->addr.type) {
5040 case BDADDR_LE_PUBLIC:
5041 return true;
5042
5043 case BDADDR_LE_RANDOM:
5044 /* Two most significant bits shall be set */
5045 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5046 return false;
5047 return true;
5048 }
5049
5050 return false;
5051}
5052
5053static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5054 u16 len)
5055{
5056 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5057 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5058 sizeof(struct mgmt_irk_info));
41edf160
JH		 5059 u16 irk_count, expected_len;
5060 int i, err;
5061
5062 BT_DBG("request for %s", hdev->name);
5063
5064 if (!lmp_le_capable(hdev))
5065 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5066 MGMT_STATUS_NOT_SUPPORTED);
5067
5068 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5069 if (irk_count > max_irk_count) {
5070 BT_ERR("load_irks: too big irk_count value %u", irk_count);
5071 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5072 MGMT_STATUS_INVALID_PARAMS);
5073 }
41edf160
JH		 5074
5075 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5076 if (expected_len != len) {
5077 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5078 expected_len, len);
41edf160
JH		 5079 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5080 MGMT_STATUS_INVALID_PARAMS);
5081 }
5082
5083 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5084
5085 for (i = 0; i < irk_count; i++) {
5086 struct mgmt_irk_info *key = &cp->irks[i];
5087
5088 if (!irk_is_valid(key))
5089 return cmd_status(sk, hdev->id,
5090 MGMT_OP_LOAD_IRKS,
5091 MGMT_STATUS_INVALID_PARAMS);
5092 }
5093
5094 hci_dev_lock(hdev);
5095
5096 hci_smp_irks_clear(hdev);
5097
5098 for (i = 0; i < irk_count; i++) {
5099 struct mgmt_irk_info *irk = &cp->irks[i];
5100 u8 addr_type;
5101
5102 if (irk->addr.type == BDADDR_LE_PUBLIC)
5103 addr_type = ADDR_LE_DEV_PUBLIC;
5104 else
5105 addr_type = ADDR_LE_DEV_RANDOM;
5106
5107 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5108 BDADDR_ANY);
5109 }
5110
5111 set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
5112
5113 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
5114
5115 hci_dev_unlock(hdev);
5116
5117 return err;
5118}
5119
3f706b72
JH		 5120static bool ltk_is_valid(struct mgmt_ltk_info *key)
5121{
5122 if (key->master != 0x00 && key->master != 0x01)
5123 return false;
490cb0b3
MH		 5124
5125 switch (key->addr.type) {
5126 case BDADDR_LE_PUBLIC:
5127 return true;
5128
5129 case BDADDR_LE_RANDOM:
5130 /* Two most significant bits shall be set */
5131 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5132 return false;
5133 return true;
5134 }
5135
5136 return false;
3f706b72
JH		 5137}
5138
bdb6d971 5139static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5140 void *cp_data, u16 len)
346af67b 5141{
346af67b 5142 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5143 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5144 sizeof(struct mgmt_ltk_info));
346af67b 5145 u16 key_count, expected_len;
715a5bf2 5146 int i, err;
346af67b 5147
cf99ba13
MH		 5148 BT_DBG("request for %s", hdev->name);
5149
5150 if (!lmp_le_capable(hdev))
5151 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5152 MGMT_STATUS_NOT_SUPPORTED);
5153
1f350c87 5154 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5155 if (key_count > max_key_count) {
5156 BT_ERR("load_ltks: too big key_count value %u", key_count);
5157 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5158 MGMT_STATUS_INVALID_PARAMS);
5159 }
346af67b
VCG		 5160
5161 expected_len = sizeof(*cp) + key_count *
5162 sizeof(struct mgmt_ltk_info);
5163 if (expected_len != len) {
5164 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5165 expected_len, len);
bdb6d971 5166 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
e57e619f 5167 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5168 }
5169
bdb6d971 5170 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5171
54ad6d8a
JH		 5172 for (i = 0; i < key_count; i++) {
5173 struct mgmt_ltk_info *key = &cp->keys[i];
5174
3f706b72 5175 if (!ltk_is_valid(key))
54ad6d8a
JH		 5176 return cmd_status(sk, hdev->id,
5177 MGMT_OP_LOAD_LONG_TERM_KEYS,
5178 MGMT_STATUS_INVALID_PARAMS);
5179 }
5180
346af67b
VCG		 5181 hci_dev_lock(hdev);
5182
5183 hci_smp_ltks_clear(hdev);
5184
5185 for (i = 0; i < key_count; i++) {
5186 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5187 u8 type, addr_type, authenticated;
79d95a19
MH		 5188
5189 if (key->addr.type == BDADDR_LE_PUBLIC)
5190 addr_type = ADDR_LE_DEV_PUBLIC;
5191 else
5192 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5193
61b43357
JH		 5194 switch (key->type) {
5195 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5196 authenticated = 0x00;
23fb8de3 5197 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5198 break;
5199 case MGMT_LTK_AUTHENTICATED:
d7b25450 5200 authenticated = 0x01;
23fb8de3
JH		 5201 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5202 break;
5203 case MGMT_LTK_P256_UNAUTH:
5204 authenticated = 0x00;
5205 type = SMP_LTK_P256;
61b43357 5206 break;
23fb8de3
JH		 5207 case MGMT_LTK_P256_AUTH:
5208 authenticated = 0x01;
5209 type = SMP_LTK_P256;
61b43357 5210 break;
23fb8de3
JH		 5211 case MGMT_LTK_P256_DEBUG:
5212 authenticated = 0x00;
5213 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5214 default:
5215 continue;
5216 }
d7b25450 5217
35d70271 5218 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5219 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5220 key->rand);
346af67b
VCG		 5221 }
5222
715a5bf2
JH		 5223 err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
5224 NULL, 0);
5225
346af67b 5226 hci_dev_unlock(hdev);
346af67b 5227
715a5bf2 5228 return err;
346af67b
VCG		 5229}
5230
9df74653 5231static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
dd983808 5232{
dd983808 5233 struct hci_conn *conn = cmd->user_data;
9981bdb0 5234 struct mgmt_rp_get_conn_info rp;
9df74653 5235 int err;
dd983808 5236
9981bdb0 5237 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5238
9981bdb0 5239 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5240 rp.rssi = conn->rssi;
9981bdb0
JH		 5241 rp.tx_power = conn->tx_power;
5242 rp.max_tx_power = conn->max_tx_power;
5243 } else {
5244 rp.rssi = HCI_RSSI_INVALID;
5245 rp.tx_power = HCI_TX_POWER_INVALID;
5246 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5247 }
5248
9df74653
JH		 5249 err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
5250 &rp, sizeof(rp));
dd983808
AK		 5251
5252 hci_conn_drop(conn);
f8aaf9b6 5253 hci_conn_put(conn);
9df74653
JH		 5254
5255 return err;
dd983808
AK		 5256}
5257
1904a853
MH		 5258static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5259 u16 opcode)
dd983808
AK		 5260{
5261 struct hci_cp_read_rssi *cp;
9981bdb0 5262 struct pending_cmd *cmd;
dd983808 5263 struct hci_conn *conn;
dd983808 5264 u16 handle;
9981bdb0 5265 u8 status;
dd983808 5266
9981bdb0 5267 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5268
5269 hci_dev_lock(hdev);
5270
dd983808
AK		 5271 /* Commands sent in request are either Read RSSI or Read Transmit Power
5272 * Level so we check which one was last sent to retrieve connection
5273 * handle. Both commands have handle as first parameter so it's safe to
5274 * cast data on the same command struct.
5275 *
5276 * First command sent is always Read RSSI and we fail only if it fails.
5277 * In other case we simply override error to indicate success as we
5278 * already remembered if TX power value is actually valid.
5279 */
5280 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5281 if (!cp) {
5282 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5283 status = MGMT_STATUS_SUCCESS;
5284 } else {
5285 status = mgmt_status(hci_status);
dd983808
AK		 5286 }
5287
5288 if (!cp) {
9981bdb0 5289 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5290 goto unlock;
5291 }
5292
5293 handle = __le16_to_cpu(cp->handle);
5294 conn = hci_conn_hash_lookup_handle(hdev, handle);
5295 if (!conn) {
9981bdb0 5296 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5297 goto unlock;
5298 }
5299
9981bdb0
JH		 5300 cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
5301 if (!cmd)
5302 goto unlock;
dd983808 5303
9981bdb0
JH		 5304 cmd->cmd_complete(cmd, status);
5305 mgmt_pending_remove(cmd);
dd983808
AK		 5306
5307unlock:
5308 hci_dev_unlock(hdev);
5309}
5310
5311static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5312 u16 len)
5313{
5314 struct mgmt_cp_get_conn_info *cp = data;
5315 struct mgmt_rp_get_conn_info rp;
5316 struct hci_conn *conn;
5317 unsigned long conn_info_age;
5318 int err = 0;
5319
5320 BT_DBG("%s", hdev->name);
5321
5322 memset(&rp, 0, sizeof(rp));
5323 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5324 rp.addr.type = cp->addr.type;
5325
5326 if (!bdaddr_type_is_valid(cp->addr.type))
5327 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5328 MGMT_STATUS_INVALID_PARAMS,
5329 &rp, sizeof(rp));
5330
5331 hci_dev_lock(hdev);
5332
5333 if (!hdev_is_powered(hdev)) {
5334 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5335 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5336 goto unlock;
5337 }
5338
5339 if (cp->addr.type == BDADDR_BREDR)
5340 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5341 &cp->addr.bdaddr);
5342 else
5343 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5344
5345 if (!conn || conn->state != BT_CONNECTED) {
5346 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5347 MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
5348 goto unlock;
5349 }
5350
9981bdb0
JH		 5351 if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
5352 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5353 MGMT_STATUS_BUSY, &rp, sizeof(rp));
5354 goto unlock;
5355 }
5356
dd983808
AK		 5357 /* To avoid client trying to guess when to poll again for information we
5358 * calculate conn info age as random value between min/max set in hdev.
5359 */
5360 conn_info_age = hdev->conn_info_min_age +
5361 prandom_u32_max(hdev->conn_info_max_age -
5362 hdev->conn_info_min_age);
5363
5364 /* Query controller to refresh cached values if they are too old or were
5365 * never read.
5366 */
f4e2dd53
AK		 5367 if (time_after(jiffies, conn->conn_info_timestamp +
5368 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5369 !conn->conn_info_timestamp) {
5370 struct hci_request req;
5371 struct hci_cp_read_tx_power req_txp_cp;
5372 struct hci_cp_read_rssi req_rssi_cp;
5373 struct pending_cmd *cmd;
5374
5375 hci_req_init(&req, hdev);
5376 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5377 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5378 &req_rssi_cp);
5379
f7faab0c
AK		 5380 /* For LE links TX power does not change thus we don't need to
5381 * query for it once value is known.
5382 */
5383 if (!bdaddr_type_is_le(cp->addr.type) ||
5384 conn->tx_power == HCI_TX_POWER_INVALID) {
5385 req_txp_cp.handle = cpu_to_le16(conn->handle);
5386 req_txp_cp.type = 0x00;
5387 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5388 sizeof(req_txp_cp), &req_txp_cp);
5389 }
dd983808 5390
eed5daf3
AK		 5391 /* Max TX power needs to be read only once per connection */
5392 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5393 req_txp_cp.handle = cpu_to_le16(conn->handle);
5394 req_txp_cp.type = 0x01;
5395 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5396 sizeof(req_txp_cp), &req_txp_cp);
5397 }
5398
dd983808
AK		 5399 err = hci_req_run(&req, conn_info_refresh_complete);
5400 if (err < 0)
5401 goto unlock;
5402
5403 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5404 data, len);
5405 if (!cmd) {
5406 err = -ENOMEM;
5407 goto unlock;
5408 }
5409
5410 hci_conn_hold(conn);
f8aaf9b6 5411 cmd->user_data = hci_conn_get(conn);
9981bdb0 5412 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5413
5414 conn->conn_info_timestamp = jiffies;
5415 } else {
5416 /* Cache is valid, just reply with values cached in hci_conn */
5417 rp.rssi = conn->rssi;
5418 rp.tx_power = conn->tx_power;
eed5daf3 5419 rp.max_tx_power = conn->max_tx_power;
dd983808
AK		 5420
5421 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5422 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
5423 }
5424
5425unlock:
5426 hci_dev_unlock(hdev);
5427 return err;
5428}
5429
9df74653 5430static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
95868426 5431{
69487371 5432 struct hci_conn *conn = cmd->user_data;
95868426 5433 struct mgmt_rp_get_clock_info rp;
69487371 5434 struct hci_dev *hdev;
9df74653 5435 int err;
69487371
JH		 5436
5437 memset(&rp, 0, sizeof(rp));
5438 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5439
5440 if (status)
5441 goto complete;
5442
5443 hdev = hci_dev_get(cmd->index);
5444 if (hdev) {
5445 rp.local_clock = cpu_to_le32(hdev->clock);
5446 hci_dev_put(hdev);
5447 }
5448
5449 if (conn) {
5450 rp.piconet_clock = cpu_to_le32(conn->clock);
5451 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5452 }
5453
5454complete:
9df74653
JH		 5455 err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5456 sizeof(rp));
69487371
JH		 5457
5458 if (conn) {
5459 hci_conn_drop(conn);
5460 hci_conn_put(conn);
5461 }
9df74653
JH		 5462
5463 return err;
69487371
JH		 5464}
5465
1904a853 5466static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5467{
95868426
JH		 5468 struct hci_cp_read_clock *hci_cp;
5469 struct pending_cmd *cmd;
5470 struct hci_conn *conn;
5471
5472 BT_DBG("%s status %u", hdev->name, status);
5473
5474 hci_dev_lock(hdev);
5475
5476 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5477 if (!hci_cp)
5478 goto unlock;
5479
5480 if (hci_cp->which) {
5481 u16 handle = __le16_to_cpu(hci_cp->handle);
5482 conn = hci_conn_hash_lookup_handle(hdev, handle);
5483 } else {
5484 conn = NULL;
5485 }
5486
5487 cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
5488 if (!cmd)
5489 goto unlock;
5490
69487371 5491 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5492 mgmt_pending_remove(cmd);
95868426
JH		 5493
5494unlock:
5495 hci_dev_unlock(hdev);
5496}
5497
5498static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5499 u16 len)
5500{
5501 struct mgmt_cp_get_clock_info *cp = data;
5502 struct mgmt_rp_get_clock_info rp;
5503 struct hci_cp_read_clock hci_cp;
5504 struct pending_cmd *cmd;
5505 struct hci_request req;
5506 struct hci_conn *conn;
5507 int err;
5508
5509 BT_DBG("%s", hdev->name);
5510
5511 memset(&rp, 0, sizeof(rp));
5512 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5513 rp.addr.type = cp->addr.type;
5514
5515 if (cp->addr.type != BDADDR_BREDR)
5516 return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5517 MGMT_STATUS_INVALID_PARAMS,
5518 &rp, sizeof(rp));
5519
5520 hci_dev_lock(hdev);
5521
5522 if (!hdev_is_powered(hdev)) {
5523 err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5524 MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
5525 goto unlock;
5526 }
5527
5528 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5529 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5530 &cp->addr.bdaddr);
5531 if (!conn || conn->state != BT_CONNECTED) {
5532 err = cmd_complete(sk, hdev->id,
5533 MGMT_OP_GET_CLOCK_INFO,
5534 MGMT_STATUS_NOT_CONNECTED,
5535 &rp, sizeof(rp));
5536 goto unlock;
5537 }
5538 } else {
5539 conn = NULL;
5540 }
5541
5542 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5543 if (!cmd) {
5544 err = -ENOMEM;
5545 goto unlock;
5546 }
5547
69487371
JH		 5548 cmd->cmd_complete = clock_info_cmd_complete;
5549
95868426
JH		 5550 hci_req_init(&req, hdev);
5551
5552 memset(&hci_cp, 0, sizeof(hci_cp));
5553 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5554
5555 if (conn) {
5556 hci_conn_hold(conn);
f8aaf9b6 5557 cmd->user_data = hci_conn_get(conn);
95868426
JH		 5558
5559 hci_cp.handle = cpu_to_le16(conn->handle);
5560 hci_cp.which = 0x01; /* Piconet clock */
5561 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
5562 }
5563
5564 err = hci_req_run(&req, get_clock_info_complete);
5565 if (err < 0)
5566 mgmt_pending_remove(cmd);
5567
5568unlock:
5569 hci_dev_unlock(hdev);
5570 return err;
5571}
5572
5a154e6f
JH		 5573static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
5574{
5575 struct hci_conn *conn;
5576
5577 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
5578 if (!conn)
5579 return false;
5580
5581 if (conn->dst_type != type)
5582 return false;
5583
5584 if (conn->state != BT_CONNECTED)
5585 return false;
5586
5587 return true;
5588}
5589
5590/* This function requires the caller holds hdev->lock */
5591static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
5592 u8 addr_type, u8 auto_connect)
5593{
5594 struct hci_dev *hdev = req->hdev;
5595 struct hci_conn_params *params;
5596
5597 params = hci_conn_params_add(hdev, addr, addr_type);
5598 if (!params)
5599 return -EIO;
5600
5601 if (params->auto_connect == auto_connect)
5602 return 0;
5603
5604 list_del_init(&params->action);
5605
5606 switch (auto_connect) {
5607 case HCI_AUTO_CONN_DISABLED:
5608 case HCI_AUTO_CONN_LINK_LOSS:
5609 __hci_update_background_scan(req);
5610 break;
5611 case HCI_AUTO_CONN_REPORT:
5612 list_add(&params->action, &hdev->pend_le_reports);
5613 __hci_update_background_scan(req);
5614 break;
5615 case HCI_AUTO_CONN_DIRECT:
5616 case HCI_AUTO_CONN_ALWAYS:
5617 if (!is_connected(hdev, addr, addr_type)) {
5618 list_add(&params->action, &hdev->pend_le_conns);
5619 __hci_update_background_scan(req);
5620 }
5621 break;
5622 }
5623
5624 params->auto_connect = auto_connect;
5625
5626 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
5627 auto_connect);
5628
5629 return 0;
5630}
5631
8afef092
MH		 5632static void device_added(struct sock *sk, struct hci_dev *hdev,
5633 bdaddr_t *bdaddr, u8 type, u8 action)
5634{
5635 struct mgmt_ev_device_added ev;
5636
5637 bacpy(&ev.addr.bdaddr, bdaddr);
5638 ev.addr.type = type;
5639 ev.action = action;
5640
5641 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
5642}
5643
1904a853 5644static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f
JH		 5645{
5646 struct pending_cmd *cmd;
5647
5648 BT_DBG("status 0x%02x", status);
5649
5650 hci_dev_lock(hdev);
5651
5652 cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
5653 if (!cmd)
5654 goto unlock;
5655
5656 cmd->cmd_complete(cmd, mgmt_status(status));
5657 mgmt_pending_remove(cmd);
5658
5659unlock:
5660 hci_dev_unlock(hdev);
5661}
5662
2faade53
MH		 5663static int add_device(struct sock *sk, struct hci_dev *hdev,
5664 void *data, u16 len)
5665{
5666 struct mgmt_cp_add_device *cp = data;
5a154e6f
JH		 5667 struct pending_cmd *cmd;
5668 struct hci_request req;
2faade53
MH		 5669 u8 auto_conn, addr_type;
5670 int err;
5671
5672 BT_DBG("%s", hdev->name);
5673
6659358e 5674 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53
MH		 5675 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
5676 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5677 MGMT_STATUS_INVALID_PARAMS,
5678 &cp->addr, sizeof(cp->addr));
5679
4b9e7e75 5680 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2faade53
MH		 5681 return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
5682 MGMT_STATUS_INVALID_PARAMS,
5683 &cp->addr, sizeof(cp->addr));
5684
5a154e6f
JH		 5685 hci_req_init(&req, hdev);
5686
2faade53
MH		 5687 hci_dev_lock(hdev);
5688
5a154e6f
JH		 5689 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
5690 if (!cmd) {
5691 err = -ENOMEM;
5692 goto unlock;
5693 }
5694
5695 cmd->cmd_complete = addr_cmd_complete;
5696
6659358e 5697 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 5698 /* Only incoming connections action is supported for now */
6659358e 5699 if (cp->action != 0x01) {
9df74653
JH		 5700 err = cmd->cmd_complete(cmd,
5701 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 5702 mgmt_pending_remove(cmd);
6659358e
JH		 5703 goto unlock;
5704 }
5705
5706 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
5707 cp->addr.type);
5708 if (err)
5709 goto unlock;
a397407f 5710
5a154e6f 5711 __hci_update_page_scan(&req);
a397407f 5712
6659358e
JH		 5713 goto added;
5714 }
5715
2faade53
MH		 5716 if (cp->addr.type == BDADDR_LE_PUBLIC)
5717 addr_type = ADDR_LE_DEV_PUBLIC;
5718 else
5719 addr_type = ADDR_LE_DEV_RANDOM;
5720
4b9e7e75 5721 if (cp->action == 0x02)
2faade53 5722 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 5723 else if (cp->action == 0x01)
5724 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 5725 else
a3451d27 5726 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 5727
bf5b3c8b
MH		 5728 /* If the connection parameters don't exist for this device,
5729 * they will be created and configured with defaults.
5730 */
5a154e6f 5731 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 5732 auto_conn) < 0) {
9df74653 5733 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 5734 mgmt_pending_remove(cmd);
2faade53
MH		 5735 goto unlock;
5736 }
5737
6659358e 5738added:
8afef092
MH		 5739 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
5740
5a154e6f
JH		 5741 err = hci_req_run(&req, add_device_complete);
5742 if (err < 0) {
5743 /* ENODATA means no HCI commands were needed (e.g. if
5744 * the adapter is powered off).
5745 */
9df74653
JH		 5746 if (err == -ENODATA)
5747 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 5748 mgmt_pending_remove(cmd);
5749 }
2faade53
MH		 5750
5751unlock:
5752 hci_dev_unlock(hdev);
5753 return err;
5754}
5755
8afef092
MH		 5756static void device_removed(struct sock *sk, struct hci_dev *hdev,
5757 bdaddr_t *bdaddr, u8 type)
5758{
5759 struct mgmt_ev_device_removed ev;
5760
5761 bacpy(&ev.addr.bdaddr, bdaddr);
5762 ev.addr.type = type;
5763
5764 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
5765}
5766
1904a853 5767static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe
JH		 5768{
5769 struct pending_cmd *cmd;
5770
5771 BT_DBG("status 0x%02x", status);
5772
5773 hci_dev_lock(hdev);
5774
5775 cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
5776 if (!cmd)
5777 goto unlock;
5778
5779 cmd->cmd_complete(cmd, mgmt_status(status));
5780 mgmt_pending_remove(cmd);
5781
5782unlock:
5783 hci_dev_unlock(hdev);
5784}
5785
2faade53
MH		 5786static int remove_device(struct sock *sk, struct hci_dev *hdev,
5787 void *data, u16 len)
5788{
5789 struct mgmt_cp_remove_device *cp = data;
51ef3ebe
JH		 5790 struct pending_cmd *cmd;
5791 struct hci_request req;
2faade53
MH		 5792 int err;
5793
5794 BT_DBG("%s", hdev->name);
5795
51ef3ebe
JH		 5796 hci_req_init(&req, hdev);
5797
2faade53
MH		 5798 hci_dev_lock(hdev);
5799
51ef3ebe
JH		 5800 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
5801 if (!cmd) {
5802 err = -ENOMEM;
5803 goto unlock;
5804 }
5805
5806 cmd->cmd_complete = addr_cmd_complete;
5807
2faade53 5808 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 5809 struct hci_conn_params *params;
2faade53
MH		 5810 u8 addr_type;
5811
6659358e 5812 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 5813 err = cmd->cmd_complete(cmd,
5814 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5815 mgmt_pending_remove(cmd);
2faade53
MH		 5816 goto unlock;
5817 }
5818
6659358e
JH		 5819 if (cp->addr.type == BDADDR_BREDR) {
5820 err = hci_bdaddr_list_del(&hdev->whitelist,
5821 &cp->addr.bdaddr,
5822 cp->addr.type);
5823 if (err) {
9df74653
JH		 5824 err = cmd->cmd_complete(cmd,
5825 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5826 mgmt_pending_remove(cmd);
6659358e
JH		 5827 goto unlock;
5828 }
5829
51ef3ebe 5830 __hci_update_page_scan(&req);
a397407f 5831
6659358e
JH		 5832 device_removed(sk, hdev, &cp->addr.bdaddr,
5833 cp->addr.type);
5834 goto complete;
5835 }
5836
2faade53
MH		 5837 if (cp->addr.type == BDADDR_LE_PUBLIC)
5838 addr_type = ADDR_LE_DEV_PUBLIC;
5839 else
5840 addr_type = ADDR_LE_DEV_RANDOM;
5841
c71593dd
JH		 5842 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
5843 addr_type);
5844 if (!params) {
9df74653
JH		 5845 err = cmd->cmd_complete(cmd,
5846 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5847 mgmt_pending_remove(cmd);
c71593dd
JH		 5848 goto unlock;
5849 }
5850
5851 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 5852 err = cmd->cmd_complete(cmd,
5853 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5854 mgmt_pending_remove(cmd);
c71593dd
JH		 5855 goto unlock;
5856 }
5857
d1dbf12e 5858 list_del(&params->action);
c71593dd
JH		 5859 list_del(&params->list);
5860 kfree(params);
51ef3ebe 5861 __hci_update_background_scan(&req);
8afef092
MH		 5862
5863 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 5864 } else {
19de0825 5865 struct hci_conn_params *p, *tmp;
6659358e 5866 struct bdaddr_list *b, *btmp;
19de0825 5867
2faade53 5868 if (cp->addr.type) {
9df74653
JH		 5869 err = cmd->cmd_complete(cmd,
5870 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 5871 mgmt_pending_remove(cmd);
2faade53
MH		 5872 goto unlock;
5873 }
5874
6659358e
JH		 5875 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
5876 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
5877 list_del(&b->list);
5878 kfree(b);
5879 }
5880
51ef3ebe 5881 __hci_update_page_scan(&req);
a397407f 5882
19de0825
JH		 5883 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
5884 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
5885 continue;
5886 device_removed(sk, hdev, &p->addr, p->addr_type);
5887 list_del(&p->action);
5888 list_del(&p->list);
5889 kfree(p);
5890 }
5891
5892 BT_DBG("All LE connection parameters were removed");
5893
51ef3ebe 5894 __hci_update_background_scan(&req);
2faade53
MH		 5895 }
5896
6659358e 5897complete:
51ef3ebe
JH		 5898 err = hci_req_run(&req, remove_device_complete);
5899 if (err < 0) {
5900 /* ENODATA means no HCI commands were needed (e.g. if
5901 * the adapter is powered off).
5902 */
9df74653
JH		 5903 if (err == -ENODATA)
5904 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 5905 mgmt_pending_remove(cmd);
5906 }
2faade53
MH		 5907
5908unlock:
5909 hci_dev_unlock(hdev);
5910 return err;
5911}
5912
a26f3dcf
JH		 5913static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
5914 u16 len)
5915{
5916 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 5917 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
5918 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 5919 u16 param_count, expected_len;
5920 int i;
5921
5922 if (!lmp_le_capable(hdev))
5923 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5924 MGMT_STATUS_NOT_SUPPORTED);
5925
5926 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 5927 if (param_count > max_param_count) {
5928 BT_ERR("load_conn_param: too big param_count value %u",
5929 param_count);
5930 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5931 MGMT_STATUS_INVALID_PARAMS);
5932 }
a26f3dcf
JH		 5933
5934 expected_len = sizeof(*cp) + param_count *
5935 sizeof(struct mgmt_conn_param);
5936 if (expected_len != len) {
5937 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
5938 expected_len, len);
5939 return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
5940 MGMT_STATUS_INVALID_PARAMS);
5941 }
5942
5943 BT_DBG("%s param_count %u", hdev->name, param_count);
5944
5945 hci_dev_lock(hdev);
5946
5947 hci_conn_params_clear_disabled(hdev);
5948
5949 for (i = 0; i < param_count; i++) {
5950 struct mgmt_conn_param *param = &cp->params[i];
5951 struct hci_conn_params *hci_param;
5952 u16 min, max, latency, timeout;
5953 u8 addr_type;
5954
5955 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
5956 param->addr.type);
5957
5958 if (param->addr.type == BDADDR_LE_PUBLIC) {
5959 addr_type = ADDR_LE_DEV_PUBLIC;
5960 } else if (param->addr.type == BDADDR_LE_RANDOM) {
5961 addr_type = ADDR_LE_DEV_RANDOM;
5962 } else {
5963 BT_ERR("Ignoring invalid connection parameters");
5964 continue;
5965 }
5966
5967 min = le16_to_cpu(param->min_interval);
5968 max = le16_to_cpu(param->max_interval);
5969 latency = le16_to_cpu(param->latency);
5970 timeout = le16_to_cpu(param->timeout);
5971
5972 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
5973 min, max, latency, timeout);
5974
5975 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
5976 BT_ERR("Ignoring invalid connection parameters");
5977 continue;
5978 }
5979
5980 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
5981 addr_type);
5982 if (!hci_param) {
5983 BT_ERR("Failed to add connection parameters");
5984 continue;
5985 }
5986
5987 hci_param->conn_min_interval = min;
5988 hci_param->conn_max_interval = max;
5989 hci_param->conn_latency = latency;
5990 hci_param->supervision_timeout = timeout;
5991 }
5992
5993 hci_dev_unlock(hdev);
5994
5995 return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
5996}
5997
dbece37a
MH		 5998static int set_external_config(struct sock *sk, struct hci_dev *hdev,
5999 void *data, u16 len)
6000{
6001 struct mgmt_cp_set_external_config *cp = data;
6002 bool changed;
6003 int err;
6004
6005 BT_DBG("%s", hdev->name);
6006
6007 if (hdev_is_powered(hdev))
6008 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6009 MGMT_STATUS_REJECTED);
6010
6011 if (cp->config != 0x00 && cp->config != 0x01)
6012 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6013 MGMT_STATUS_INVALID_PARAMS);
6014
6015 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
6016 return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6017 MGMT_STATUS_NOT_SUPPORTED);
6018
6019 hci_dev_lock(hdev);
6020
6021 if (cp->config)
6022 changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
6023 &hdev->dev_flags);
6024 else
6025 changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
6026 &hdev->dev_flags);
6027
6028 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6029 if (err < 0)
6030 goto unlock;
6031
6032 if (!changed)
6033 goto unlock;
6034
f4537c04
MH		 6035 err = new_options(hdev, sk);
6036
dbece37a
MH		 6037 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
6038 mgmt_index_removed(hdev);
d603b76b
MH		 6039
6040 if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
6041 set_bit(HCI_CONFIG, &hdev->dev_flags);
6042 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6043
6044 queue_work(hdev->req_workqueue, &hdev->power_on);
6045 } else {
5ea234d3 6046 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6047 mgmt_index_added(hdev);
6048 }
dbece37a
MH		 6049 }
6050
6051unlock:
6052 hci_dev_unlock(hdev);
6053 return err;
6054}
6055
9713c17b
MH		 6056static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6057 void *data, u16 len)
6058{
6059 struct mgmt_cp_set_public_address *cp = data;
6060 bool changed;
6061 int err;
6062
6063 BT_DBG("%s", hdev->name);
6064
6065 if (hdev_is_powered(hdev))
6066 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6067 MGMT_STATUS_REJECTED);
6068
6069 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
6070 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6071 MGMT_STATUS_INVALID_PARAMS);
6072
6073 if (!hdev->set_bdaddr)
6074 return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6075 MGMT_STATUS_NOT_SUPPORTED);
6076
6077 hci_dev_lock(hdev);
6078
6079 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6080 bacpy(&hdev->public_addr, &cp->bdaddr);
6081
6082 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6083 if (err < 0)
6084 goto unlock;
6085
6086 if (!changed)
6087 goto unlock;
6088
6089 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6090 err = new_options(hdev, sk);
6091
6092 if (is_configured(hdev)) {
6093 mgmt_index_removed(hdev);
6094
6095 clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
6096
6097 set_bit(HCI_CONFIG, &hdev->dev_flags);
6098 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
6099
6100 queue_work(hdev->req_workqueue, &hdev->power_on);
6101 }
6102
6103unlock:
6104 hci_dev_unlock(hdev);
6105 return err;
6106}
6107
2e3c35ea 6108static const struct mgmt_handler {
04124681
GP		 6109 int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
6110 u16 data_len);
be22b54e
JH		 6111 bool var_len;
6112 size_t data_len;
0f4e68cf
JH		 6113} mgmt_handlers[] = {
6114 { NULL }, /* 0x0000 (no command) */
be22b54e
JH		 6115 { read_version, false, MGMT_READ_VERSION_SIZE },
6116 { read_commands, false, MGMT_READ_COMMANDS_SIZE },
6117 { read_index_list, false, MGMT_READ_INDEX_LIST_SIZE },
6118 { read_controller_info, false, MGMT_READ_INFO_SIZE },
6119 { set_powered, false, MGMT_SETTING_SIZE },
6120 { set_discoverable, false, MGMT_SET_DISCOVERABLE_SIZE },
6121 { set_connectable, false, MGMT_SETTING_SIZE },
6122 { set_fast_connectable, false, MGMT_SETTING_SIZE },
b2939475 6123 { set_bondable, false, MGMT_SETTING_SIZE },
be22b54e
JH		 6124 { set_link_security, false, MGMT_SETTING_SIZE },
6125 { set_ssp, false, MGMT_SETTING_SIZE },
6126 { set_hs, false, MGMT_SETTING_SIZE },
6127 { set_le, false, MGMT_SETTING_SIZE },
6128 { set_dev_class, false, MGMT_SET_DEV_CLASS_SIZE },
6129 { set_local_name, false, MGMT_SET_LOCAL_NAME_SIZE },
6130 { add_uuid, false, MGMT_ADD_UUID_SIZE },
6131 { remove_uuid, false, MGMT_REMOVE_UUID_SIZE },
6132 { load_link_keys, true, MGMT_LOAD_LINK_KEYS_SIZE },
6133 { load_long_term_keys, true, MGMT_LOAD_LONG_TERM_KEYS_SIZE },
6134 { disconnect, false, MGMT_DISCONNECT_SIZE },
6135 { get_connections, false, MGMT_GET_CONNECTIONS_SIZE },
6136 { pin_code_reply, false, MGMT_PIN_CODE_REPLY_SIZE },
6137 { pin_code_neg_reply, false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
6138 { set_io_capability, false, MGMT_SET_IO_CAPABILITY_SIZE },
6139 { pair_device, false, MGMT_PAIR_DEVICE_SIZE },
6140 { cancel_pair_device, false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
6141 { unpair_device, false, MGMT_UNPAIR_DEVICE_SIZE },
6142 { user_confirm_reply, false, MGMT_USER_CONFIRM_REPLY_SIZE },
6143 { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
6144 { user_passkey_reply, false, MGMT_USER_PASSKEY_REPLY_SIZE },
6145 { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
6146 { read_local_oob_data, false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
ec109113 6147 { add_remote_oob_data, true, MGMT_ADD_REMOTE_OOB_DATA_SIZE },
be22b54e
JH		 6148 { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
6149 { start_discovery, false, MGMT_START_DISCOVERY_SIZE },
6150 { stop_discovery, false, MGMT_STOP_DISCOVERY_SIZE },
6151 { confirm_name, false, MGMT_CONFIRM_NAME_SIZE },
6152 { block_device, false, MGMT_BLOCK_DEVICE_SIZE },
6153 { unblock_device, false, MGMT_UNBLOCK_DEVICE_SIZE },
cdbaccca 6154 { set_device_id, false, MGMT_SET_DEVICE_ID_SIZE },
4375f103 6155 { set_advertising, false, MGMT_SETTING_SIZE },
0663ca2a 6156 { set_bredr, false, MGMT_SETTING_SIZE },
d13eafce 6157 { set_static_address, false, MGMT_SET_STATIC_ADDRESS_SIZE },
14b49b9a 6158 { set_scan_params, false, MGMT_SET_SCAN_PARAMS_SIZE },
eac83dc6 6159 { set_secure_conn, false, MGMT_SETTING_SIZE },
4e39ac81 6160 { set_debug_keys, false, MGMT_SETTING_SIZE },
62b04cd1 6161 { set_privacy, false, MGMT_SET_PRIVACY_SIZE },
41edf160 6162 { load_irks, true, MGMT_LOAD_IRKS_SIZE },
dd983808 6163 { get_conn_info, false, MGMT_GET_CONN_INFO_SIZE },
95868426 6164 { get_clock_info, false, MGMT_GET_CLOCK_INFO_SIZE },
2faade53
MH		 6165 { add_device, false, MGMT_ADD_DEVICE_SIZE },
6166 { remove_device, false, MGMT_REMOVE_DEVICE_SIZE },
73d1df2a
MH		 6167 { load_conn_param, true, MGMT_LOAD_CONN_PARAM_SIZE },
6168 { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
9fc3bfb6 6169 { read_config_info, false, MGMT_READ_CONFIG_INFO_SIZE },
dbece37a 6170 { set_external_config, false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
9713c17b 6171 { set_public_address, false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
66ea9427 6172 { start_service_discovery,true, MGMT_START_SERVICE_DISCOVERY_SIZE },
0f4e68cf
JH		 6173};
6174
0381101f
JH		 6175int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
6176{
650f726d
VCG		 6177 void *buf;
6178 u8 *cp;
0381101f 6179 struct mgmt_hdr *hdr;
4e51eae9 6180 u16 opcode, index, len;
bdb6d971 6181 struct hci_dev *hdev = NULL;
2e3c35ea 6182 const struct mgmt_handler *handler;
0381101f
JH		 6183 int err;
6184
6185 BT_DBG("got %zu bytes", msglen);
6186
6187 if (msglen < sizeof(*hdr))
6188 return -EINVAL;
6189
e63a15ec 6190 buf = kmalloc(msglen, GFP_KERNEL);
0381101f
JH		 6191 if (!buf)
6192 return -ENOMEM;
6193
6ce8e9ce 6194 if (memcpy_from_msg(buf, msg, msglen)) {
0381101f
JH		 6195 err = -EFAULT;
6196 goto done;
6197 }
6198
650f726d 6199 hdr = buf;
1f350c87
MH		 6200 opcode = __le16_to_cpu(hdr->opcode);
6201 index = __le16_to_cpu(hdr->index);
6202 len = __le16_to_cpu(hdr->len);
0381101f
JH		 6203
6204 if (len != msglen - sizeof(*hdr)) {
6205 err = -EINVAL;
6206 goto done;
6207 }
6208
0f4e68cf 6209 if (index != MGMT_INDEX_NONE) {
bdb6d971
JH		 6210 hdev = hci_dev_get(index);
6211 if (!hdev) {
6212 err = cmd_status(sk, index, opcode,
04124681 6213 MGMT_STATUS_INVALID_INDEX);
bdb6d971
JH		 6214 goto done;
6215 }
0736cfa8 6216
cebf4cfd 6217 if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
d603b76b 6218 test_bit(HCI_CONFIG, &hdev->dev_flags) ||
4a964404 6219 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
0736cfa8
MH		 6220 err = cmd_status(sk, index, opcode,
6221 MGMT_STATUS_INVALID_INDEX);
6222 goto done;
6223 }
42a9bc14
MH		 6224
6225 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
dbece37a 6226 opcode != MGMT_OP_READ_CONFIG_INFO &&
9713c17b
MH		 6227 opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
6228 opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
42a9bc14
MH		 6229 err = cmd_status(sk, index, opcode,
6230 MGMT_STATUS_INVALID_INDEX);
6231 goto done;
6232 }
bdb6d971
JH		 6233 }
6234
0f4e68cf 6235 if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
8ce8e2b5 6236 mgmt_handlers[opcode].func == NULL) {
0381101f 6237 BT_DBG("Unknown op %u", opcode);
ca69b795 6238 err = cmd_status(sk, index, opcode,
04124681 6239 MGMT_STATUS_UNKNOWN_COMMAND);
0f4e68cf
JH		 6240 goto done;
6241 }
6242
73d1df2a
MH		 6243 if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
6244 opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
6245 err = cmd_status(sk, index, opcode,
6246 MGMT_STATUS_INVALID_INDEX);
6247 goto done;
6248 }
6249
6250 if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
6251 opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
0f4e68cf 6252 err = cmd_status(sk, index, opcode,
04124681 6253 MGMT_STATUS_INVALID_INDEX);
0f4e68cf 6254 goto done;
0381101f
JH		 6255 }
6256
be22b54e
JH		 6257 handler = &mgmt_handlers[opcode];
6258
6259 if ((handler->var_len && len < handler->data_len) ||
8ce8e2b5 6260 (!handler->var_len && len != handler->data_len)) {
be22b54e 6261 err = cmd_status(sk, index, opcode,
04124681 6262 MGMT_STATUS_INVALID_PARAMS);
be22b54e
JH		 6263 goto done;
6264 }
6265
0f4e68cf
JH		 6266 if (hdev)
6267 mgmt_init_hdev(sk, hdev);
6268
6269 cp = buf + sizeof(*hdr);
6270
be22b54e 6271 err = handler->func(sk, hdev, cp, len);
e41d8b4e
JH		 6272 if (err < 0)
6273 goto done;
6274
0381101f
JH		 6275 err = msglen;
6276
6277done:
bdb6d971
JH		 6278 if (hdev)
6279 hci_dev_put(hdev);
6280
0381101f
JH		 6281 kfree(buf);
6282 return err;
6283}
c71e97bf 6284
bf6b56db 6285void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 6286{
1514b892 6287 if (hdev->dev_type != HCI_BREDR)
bf6b56db 6288 return;
bb4b2a9a 6289
0602a8ad
MH		 6290 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6291 return;
6292
6293 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6294 mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
6295 else
6296 mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
c71e97bf
JH		 6297}
6298
bf6b56db 6299void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 6300{
5f159032 6301 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 6302
1514b892 6303 if (hdev->dev_type != HCI_BREDR)
bf6b56db 6304 return;
bb4b2a9a 6305
0602a8ad
MH		 6306 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
6307 return;
6308
1b9b5ee5 6309 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 6310
edd3896b
MH		 6311 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
6312 mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
6313 else
6314 mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
eec8d2bc
JH		 6315}
6316
6046dc3e 6317/* This function requires the caller holds hdev->lock */
2cf22218 6318static void restart_le_actions(struct hci_request *req)
6046dc3e 6319{
2cf22218 6320 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 6321 struct hci_conn_params *p;
6322
6323 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 6324 /* Needed for AUTO_OFF case where might not "really"
6325 * have been powered off.
6326 */
6327 list_del_init(&p->action);
6328
6329 switch (p->auto_connect) {
4b9e7e75 6330 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 6331 case HCI_AUTO_CONN_ALWAYS:
6332 list_add(&p->action, &hdev->pend_le_conns);
6333 break;
6334 case HCI_AUTO_CONN_REPORT:
6335 list_add(&p->action, &hdev->pend_le_reports);
6336 break;
6337 default:
6338 break;
c83ed19d 6339 }
6046dc3e 6340 }
c83ed19d 6341
2cf22218 6342 __hci_update_background_scan(req);
6046dc3e
AG		 6343}
6344
1904a853 6345static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 6346{
6347 struct cmd_lookup match = { NULL, hdev };
6348
6349 BT_DBG("status 0x%02x", status);
6350
162a3bac
MH		 6351 if (!status) {
6352 /* Register the available SMP channels (BR/EDR and LE) only
6353 * when successfully powering on the controller. This late
6354 * registration is required so that LE SMP can clearly
6355 * decide if the public address or static address is used.
6356 */
6357 smp_register(hdev);
6358 }
6359
229ab39c
JH		 6360 hci_dev_lock(hdev);
6361
6362 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
6363
6364 new_settings(hdev, match.sk);
6365
6366 hci_dev_unlock(hdev);
6367
6368 if (match.sk)
6369 sock_put(match.sk);
6370}
6371
70da6243 6372static int powered_update_hci(struct hci_dev *hdev)
5add6af8 6373{
890ea898 6374 struct hci_request req;
70da6243 6375 u8 link_sec;
5add6af8 6376
890ea898
JH		 6377 hci_req_init(&req, hdev);
6378
70da6243
JH		 6379 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
6380 !lmp_host_ssp_capable(hdev)) {
574ea3c7 6381 u8 mode = 0x01;
5e5282bb 6382
574ea3c7
MH		 6383 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
6384
6385 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
6386 u8 support = 0x01;
5add6af8 6387
574ea3c7
MH		 6388 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
6389 sizeof(support), &support);
6390 }
ec6f99b8
JH		 6391 }
6392
c73eee91
JH		 6393 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
6394 lmp_bredr_capable(hdev)) {
70da6243 6395 struct hci_cp_write_le_host_supported cp;
f0ff92fb 6396
32226e4f
MH		 6397 cp.le = 0x01;
6398 cp.simul = 0x00;
3d1cbdd6 6399
70da6243
JH		 6400 /* Check first if we already have the right
6401 * host state (host features set)
6402 */
6403 if (cp.le != lmp_host_le_capable(hdev) ||
6404 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 6405 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
6406 sizeof(cp), &cp);
70da6243 6407 }
3d1cbdd6 6408
d13eafce 6409 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 6410 /* Make sure the controller has a good default for
6411 * advertising data. This also applies to the case
6412 * where BR/EDR was toggled during the AUTO_OFF phase.
6413 */
f14d8f64 6414 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
5947f4bc 6415 update_adv_data(&req);
f14d8f64
MH		 6416 update_scan_rsp_data(&req);
6417 }
441ad2d0 6418
bba3aa55
MH		 6419 if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
6420 enable_advertising(&req);
2cf22218
JH		 6421
6422 restart_le_actions(&req);
eeca6f89
JH		 6423 }
6424
70da6243
JH		 6425 link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
6426 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 6427 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
6428 sizeof(link_sec), &link_sec);
562fcc24 6429
70da6243 6430 if (lmp_bredr_capable(hdev)) {
432df05e 6431 write_fast_connectable(&req, false);
1d2dc5b7 6432 __hci_update_page_scan(&req);
890ea898 6433 update_class(&req);
13928971 6434 update_name(&req);
890ea898 6435 update_eir(&req);
70da6243 6436 }
562fcc24 6437
229ab39c 6438 return hci_req_run(&req, powered_complete);
70da6243 6439}
562fcc24 6440
70da6243
JH		 6441int mgmt_powered(struct hci_dev *hdev, u8 powered)
6442{
6443 struct cmd_lookup match = { NULL, hdev };
9845904f 6444 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 6445 int err;
f0ff92fb 6446
70da6243
JH		 6447 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
6448 return 0;
6449
70da6243 6450 if (powered) {
229ab39c
JH		 6451 if (powered_update_hci(hdev) == 0)
6452 return 0;
fe038884 6453
229ab39c
JH		 6454 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
6455 &match);
6456 goto new_settings;
b24752fe
JH		 6457 }
6458
229ab39c 6459 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 6460
6461 /* If the power off is because of hdev unregistration let
6462 * use the appropriate INVALID_INDEX status. Otherwise use
6463 * NOT_POWERED. We cover both scenarios here since later in
6464 * mgmt_index_removed() any hci_conn callbacks will have already
6465 * been triggered, potentially causing misleading DISCONNECTED
6466 * status responses.
6467 */
6468 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
6469 status = MGMT_STATUS_INVALID_INDEX;
6470 else
6471 status = MGMT_STATUS_NOT_POWERED;
6472
6473 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 6474
6475 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
6476 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
6477 zero_cod, sizeof(zero_cod), NULL);
6478
6479new_settings:
beadb2bd 6480 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 6481
6482 if (match.sk)
6483 sock_put(match.sk);
6484
7bb895d6 6485 return err;
5add6af8 6486}
73f22f62 6487
3eec705e 6488void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc
JH		 6489{
6490 struct pending_cmd *cmd;
6491 u8 status;
6492
6493 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6494 if (!cmd)
3eec705e 6495 return;
96570ffc
JH		 6496
6497 if (err == -ERFKILL)
6498 status = MGMT_STATUS_RFKILLED;
6499 else
6500 status = MGMT_STATUS_FAILED;
6501
3eec705e 6502 cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 6503
6504 mgmt_pending_remove(cmd);
96570ffc
JH		 6505}
6506
d1967ff8
MH		 6507void mgmt_discoverable_timeout(struct hci_dev *hdev)
6508{
6509 struct hci_request req;
d1967ff8
MH		 6510
6511 hci_dev_lock(hdev);
6512
6513 /* When discoverable timeout triggers, then just make sure
6514 * the limited discoverable flag is cleared. Even in the case
6515 * of a timeout triggered from general discoverable, it is
6516 * safe to unconditionally clear the flag.
6517 */
6518 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
9a43e25f 6519 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
d1967ff8
MH		 6520
6521 hci_req_init(&req, hdev);
4b580614
JH		 6522 if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
6523 u8 scan = SCAN_PAGE;
6524 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
6525 sizeof(scan), &scan);
6526 }
d1967ff8 6527 update_class(&req);
9a43e25f 6528 update_adv_data(&req);
d1967ff8
MH		 6529 hci_req_run(&req, NULL);
6530
6531 hdev->discov_timeout = 0;
6532
9a43e25f
JH		 6533 new_settings(hdev, NULL);
6534
d1967ff8
MH		 6535 hci_dev_unlock(hdev);
6536}
6537
dc4a5ee2
MH		 6538void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
6539 bool persistent)
55ed8ca1 6540{
86742e1e 6541 struct mgmt_ev_new_link_key ev;
55ed8ca1 6542
a492cd52 6543 memset(&ev, 0, sizeof(ev));
55ed8ca1 6544
a492cd52 6545 ev.store_hint = persistent;
d753fdc4 6546 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 6547 ev.key.addr.type = BDADDR_BREDR;
a492cd52 6548 ev.key.type = key->type;
9b3b4460 6549 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 6550 ev.key.pin_len = key->pin_len;
55ed8ca1 6551
dc4a5ee2 6552 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 6553}
f7520543 6554
d7b25450
JH		 6555static u8 mgmt_ltk_type(struct smp_ltk *ltk)
6556{
23fb8de3
JH		 6557 switch (ltk->type) {
6558 case SMP_LTK:
6559 case SMP_LTK_SLAVE:
6560 if (ltk->authenticated)
6561 return MGMT_LTK_AUTHENTICATED;
6562 return MGMT_LTK_UNAUTHENTICATED;
6563 case SMP_LTK_P256:
6564 if (ltk->authenticated)
6565 return MGMT_LTK_P256_AUTH;
6566 return MGMT_LTK_P256_UNAUTH;
6567 case SMP_LTK_P256_DEBUG:
6568 return MGMT_LTK_P256_DEBUG;
6569 }
d7b25450
JH		 6570
6571 return MGMT_LTK_UNAUTHENTICATED;
6572}
6573
53ac6ab6 6574void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 6575{
6576 struct mgmt_ev_new_long_term_key ev;
6577
6578 memset(&ev, 0, sizeof(ev));
6579
5192d301
MH		 6580 /* Devices using resolvable or non-resolvable random addresses
6581 * without providing an indentity resolving key don't require
6582 * to store long term keys. Their addresses will change the
6583 * next time around.
6584 *
6585 * Only when a remote device provides an identity address
6586 * make sure the long term key is stored. If the remote
6587 * identity is known, the long term keys are internally
6588 * mapped to the identity address. So allow static random
6589 * and public addresses here.
6590 */
ba74b666
JH		 6591 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6592 (key->bdaddr.b[5] & 0xc0) != 0xc0)
6593 ev.store_hint = 0x00;
6594 else
53ac6ab6 6595 ev.store_hint = persistent;
ba74b666 6596
346af67b 6597 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 6598 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 6599 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 6600 ev.key.enc_size = key->enc_size;
6601 ev.key.ediv = key->ediv;
fe39c7b2 6602 ev.key.rand = key->rand;
346af67b 6603
2ceba539 6604 if (key->type == SMP_LTK)
346af67b
VCG		 6605 ev.key.master = 1;
6606
346af67b
VCG		 6607 memcpy(ev.key.val, key->val, sizeof(key->val));
6608
083368f7 6609 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 6610}
6611
95fbac8a
JH		 6612void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
6613{
6614 struct mgmt_ev_new_irk ev;
6615
6616 memset(&ev, 0, sizeof(ev));
6617
bab6d1e5
MH		 6618 /* For identity resolving keys from devices that are already
6619 * using a public address or static random address, do not
6620 * ask for storing this key. The identity resolving key really
6621 * is only mandatory for devices using resovlable random
6622 * addresses.
6623 *
6624 * Storing all identity resolving keys has the downside that
6625 * they will be also loaded on next boot of they system. More
6626 * identity resolving keys, means more time during scanning is
6627 * needed to actually resolve these addresses.
6628 */
6629 if (bacmp(&irk->rpa, BDADDR_ANY))
6630 ev.store_hint = 0x01;
6631 else
6632 ev.store_hint = 0x00;
6633
95fbac8a
JH		 6634 bacpy(&ev.rpa, &irk->rpa);
6635 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
6636 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
6637 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
6638
6639 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
6640}
6641
53ac6ab6
MH		 6642void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
6643 bool persistent)
7ee4ea36
MH		 6644{
6645 struct mgmt_ev_new_csrk ev;
6646
6647 memset(&ev, 0, sizeof(ev));
6648
6649 /* Devices using resolvable or non-resolvable random addresses
6650 * without providing an indentity resolving key don't require
6651 * to store signature resolving keys. Their addresses will change
6652 * the next time around.
6653 *
6654 * Only when a remote device provides an identity address
6655 * make sure the signature resolving key is stored. So allow
6656 * static random and public addresses here.
6657 */
6658 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
6659 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
6660 ev.store_hint = 0x00;
6661 else
53ac6ab6 6662 ev.store_hint = persistent;
7ee4ea36
MH		 6663
6664 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
6665 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
6666 ev.key.master = csrk->master;
6667 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
6668
6669 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
6670}
6671
ffb5a827 6672void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 6673 u8 bdaddr_type, u8 store_hint, u16 min_interval,
6674 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 6675{
6676 struct mgmt_ev_new_conn_param ev;
6677
c103aea6
JH		 6678 if (!hci_is_identity_address(bdaddr, bdaddr_type))
6679 return;
6680
ffb5a827
AG		 6681 memset(&ev, 0, sizeof(ev));
6682 bacpy(&ev.addr.bdaddr, bdaddr);
6683 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 6684 ev.store_hint = store_hint;
ffb5a827
AG		 6685 ev.min_interval = cpu_to_le16(min_interval);
6686 ev.max_interval = cpu_to_le16(max_interval);
6687 ev.latency = cpu_to_le16(latency);
6688 ev.timeout = cpu_to_le16(timeout);
6689
6690 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
6691}
6692
94933991
MH		 6693static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6694 u8 data_len)
6695{
6696 eir[eir_len++] = sizeof(type) + data_len;
6697 eir[eir_len++] = type;
6698 memcpy(&eir[eir_len], data, data_len);
6699 eir_len += data_len;
6700
6701 return eir_len;
6702}
6703
48ec92fa
AA		 6704void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
6705 u32 flags, u8 *name, u8 name_len)
f7520543 6706{
b644ba33
JH		 6707 char buf[512];
6708 struct mgmt_ev_device_connected *ev = (void *) buf;
6709 u16 eir_len = 0;
f7520543 6710
48ec92fa
AA		 6711 bacpy(&ev->addr.bdaddr, &conn->dst);
6712 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 6713
c95f0ba7 6714 ev->flags = __cpu_to_le32(flags);
08c79b61 6715
fd45ada9
AA		 6716 /* We must ensure that the EIR Data fields are ordered and
6717 * unique. Keep it simple for now and avoid the problem by not
6718 * adding any BR/EDR data to the LE adv.
6719 */
6720 if (conn->le_adv_data_len > 0) {
6721 memcpy(&ev->eir[eir_len],
6722 conn->le_adv_data, conn->le_adv_data_len);
6723 eir_len = conn->le_adv_data_len;
6724 } else {
6725 if (name_len > 0)
6726 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
6727 name, name_len);
b644ba33 6728
ddbea5cf 6729 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 6730 eir_len = eir_append_data(ev->eir, eir_len,
6731 EIR_CLASS_OF_DEV,
6732 conn->dev_class, 3);
6733 }
b644ba33 6734
eb55ef07 6735 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 6736
ecd90ae7
MH		 6737 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
6738 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 6739}
6740
8962ee74
JH		 6741static void disconnect_rsp(struct pending_cmd *cmd, void *data)
6742{
8962ee74 6743 struct sock **sk = data;
8962ee74 6744
f5818c22 6745 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 6746
6747 *sk = cmd->sk;
6748 sock_hold(*sk);
6749
a664b5bc 6750 mgmt_pending_remove(cmd);
8962ee74
JH		 6751}
6752
124f6e35 6753static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
a8a1d19e 6754{
b1078ad0 6755 struct hci_dev *hdev = data;
124f6e35 6756 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 6757
b1078ad0
JH		 6758 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
6759
d8b7b1e4 6760 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 6761 mgmt_pending_remove(cmd);
6762}
6763
84c61d92
JH		 6764bool mgmt_powering_down(struct hci_dev *hdev)
6765{
6766 struct pending_cmd *cmd;
6767 struct mgmt_mode *cp;
6768
6769 cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
6770 if (!cmd)
6771 return false;
6772
6773 cp = cmd->param;
6774 if (!cp->val)
6775 return true;
6776
6777 return false;
6778}
6779
9b80ec5e 6780void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 6781 u8 link_type, u8 addr_type, u8 reason,
6782 bool mgmt_connected)
f7520543 6783{
f0d6a0ea 6784 struct mgmt_ev_device_disconnected ev;
8962ee74 6785 struct sock *sk = NULL;
8962ee74 6786
84c61d92
JH		 6787 /* The connection is still in hci_conn_hash so test for 1
6788 * instead of 0 to know if this is the last one.
6789 */
6790 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6791 cancel_delayed_work(&hdev->power_off);
6792 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 6793 }
6794
12d4a3b2
JH		 6795 if (!mgmt_connected)
6796 return;
6797
57eb776f
AG		 6798 if (link_type != ACL_LINK && link_type != LE_LINK)
6799 return;
6800
744cf19e 6801 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 6802
f0d6a0ea
MA		 6803 bacpy(&ev.addr.bdaddr, bdaddr);
6804 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6805 ev.reason = reason;
f7520543 6806
9b80ec5e 6807 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 6808
6809 if (sk)
d97dcb66 6810 sock_put(sk);
8962ee74 6811
124f6e35 6812 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 6813 hdev);
8962ee74
JH		 6814}
6815
7892924c
MH		 6816void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
6817 u8 link_type, u8 addr_type, u8 status)
8962ee74 6818{
3655bba8
AG		 6819 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
6820 struct mgmt_cp_disconnect *cp;
8962ee74 6821 struct pending_cmd *cmd;
8962ee74 6822
36a75f1b
JD		 6823 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
6824 hdev);
6825
2e58ef3e 6826 cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 6827 if (!cmd)
7892924c 6828 return;
8962ee74 6829
3655bba8
AG		 6830 cp = cmd->param;
6831
6832 if (bacmp(bdaddr, &cp->addr.bdaddr))
6833 return;
6834
6835 if (cp->addr.type != bdaddr_type)
6836 return;
6837
f5818c22 6838 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6839 mgmt_pending_remove(cmd);
f7520543 6840}
17d5c04c 6841
445608d0
MH		 6842void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
6843 u8 addr_type, u8 status)
17d5c04c
JH		 6844{
6845 struct mgmt_ev_connect_failed ev;
c9910d0f 6846
84c61d92
JH		 6847 /* The connection is still in hci_conn_hash so test for 1
6848 * instead of 0 to know if this is the last one.
6849 */
6850 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
6851 cancel_delayed_work(&hdev->power_off);
6852 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 6853 }
17d5c04c 6854
4c659c39 6855 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6856 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 6857 ev.status = mgmt_status(status);
17d5c04c 6858
445608d0 6859 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 6860}
980e1a53 6861
ce0e4a0d 6862void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 6863{
6864 struct mgmt_ev_pin_code_request ev;
6865
d8457698 6866 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 6867 ev.addr.type = BDADDR_BREDR;
a770bb5a 6868 ev.secure = secure;
980e1a53 6869
ce0e4a0d 6870 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 6871}
6872
e669cf80
MH		 6873void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6874 u8 status)
980e1a53
JH		 6875{
6876 struct pending_cmd *cmd;
980e1a53 6877
2e58ef3e 6878 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 6879 if (!cmd)
e669cf80 6880 return;
980e1a53 6881
7776d1d8 6882 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6883 mgmt_pending_remove(cmd);
980e1a53
JH		 6884}
6885
3eb38528
MH		 6886void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
6887 u8 status)
980e1a53
JH		 6888{
6889 struct pending_cmd *cmd;
980e1a53 6890
2e58ef3e 6891 cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 6892 if (!cmd)
3eb38528 6893 return;
980e1a53 6894
7776d1d8 6895 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6896 mgmt_pending_remove(cmd);
980e1a53 6897}
a5c29683 6898
744cf19e 6899int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 6900 u8 link_type, u8 addr_type, u32 value,
04124681 6901 u8 confirm_hint)
a5c29683
JH		 6902{
6903 struct mgmt_ev_user_confirm_request ev;
6904
744cf19e 6905 BT_DBG("%s", hdev->name);
a5c29683 6906
272d90df 6907 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6908 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 6909 ev.confirm_hint = confirm_hint;
39adbffe 6910 ev.value = cpu_to_le32(value);
a5c29683 6911
744cf19e 6912 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 6913 NULL);
a5c29683
JH		 6914}
6915
272d90df 6916int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 6917 u8 link_type, u8 addr_type)
604086b7
BG		 6918{
6919 struct mgmt_ev_user_passkey_request ev;
6920
6921 BT_DBG("%s", hdev->name);
6922
272d90df 6923 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 6924 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 6925
6926 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 6927 NULL);
604086b7
BG		 6928}
6929
0df4c185 6930static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 6931 u8 link_type, u8 addr_type, u8 status,
6932 u8 opcode)
a5c29683
JH		 6933{
6934 struct pending_cmd *cmd;
a5c29683 6935
2e58ef3e 6936 cmd = mgmt_pending_find(opcode, hdev);
a5c29683
JH		 6937 if (!cmd)
6938 return -ENOENT;
6939
7776d1d8 6940 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 6941 mgmt_pending_remove(cmd);
a5c29683 6942
7776d1d8 6943 return 0;
a5c29683
JH		 6944}
6945
744cf19e 6946int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6947 u8 link_type, u8 addr_type, u8 status)
a5c29683 6948{
272d90df 6949 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 6950 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 6951}
6952
272d90df 6953int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6954 u8 link_type, u8 addr_type, u8 status)
a5c29683 6955{
272d90df 6956 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 6957 status,
6958 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 6959}
2a611692 6960
604086b7 6961int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6962 u8 link_type, u8 addr_type, u8 status)
604086b7 6963{
272d90df 6964 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 6965 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 6966}
6967
272d90df 6968int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 6969 u8 link_type, u8 addr_type, u8 status)
604086b7 6970{
272d90df 6971 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 6972 status,
6973 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 6974}
6975
92a25256
JH		 6976int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
6977 u8 link_type, u8 addr_type, u32 passkey,
6978 u8 entered)
6979{
6980 struct mgmt_ev_passkey_notify ev;
6981
6982 BT_DBG("%s", hdev->name);
6983
6984 bacpy(&ev.addr.bdaddr, bdaddr);
6985 ev.addr.type = link_to_bdaddr(link_type, addr_type);
6986 ev.passkey = __cpu_to_le32(passkey);
6987 ev.entered = entered;
6988
6989 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
6990}
6991
e1e930f5 6992void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 6993{
6994 struct mgmt_ev_auth_failed ev;
e1e930f5
JH		 6995 struct pending_cmd *cmd;
6996 u8 status = mgmt_status(hci_status);
2a611692 6997
e1e930f5
JH		 6998 bacpy(&ev.addr.bdaddr, &conn->dst);
6999 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
7000 ev.status = status;
2a611692 7001
e1e930f5
JH		 7002 cmd = find_pairing(conn);
7003
7004 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
7005 cmd ? cmd->sk : NULL);
7006
a511b35b
JH		 7007 if (cmd) {
7008 cmd->cmd_complete(cmd, status);
7009 mgmt_pending_remove(cmd);
7010 }
2a611692 7011}
b312b161 7012
464996ae 7013void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 7014{
7015 struct cmd_lookup match = { NULL, hdev };
464996ae 7016 bool changed;
33ef95ed
JH		 7017
7018 if (status) {
7019 u8 mgmt_err = mgmt_status(status);
7020 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 7021 cmd_status_rsp, &mgmt_err);
464996ae 7022 return;
33ef95ed
JH		 7023 }
7024
464996ae
MH		 7025 if (test_bit(HCI_AUTH, &hdev->flags))
7026 changed = !test_and_set_bit(HCI_LINK_SECURITY,
7027 &hdev->dev_flags);
7028 else
7029 changed = test_and_clear_bit(HCI_LINK_SECURITY,
7030 &hdev->dev_flags);
47990ea0 7031
33ef95ed 7032 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 7033 &match);
33ef95ed 7034
47990ea0 7035 if (changed)
464996ae 7036 new_settings(hdev, match.sk);
33ef95ed
JH		 7037
7038 if (match.sk)
7039 sock_put(match.sk);
33ef95ed
JH		 7040}
7041
890ea898 7042static void clear_eir(struct hci_request *req)
cacaf52f 7043{
890ea898 7044 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 7045 struct hci_cp_write_eir cp;
7046
976eb20e 7047 if (!lmp_ext_inq_capable(hdev))
890ea898 7048 return;
cacaf52f 7049
c80da27e
JH		 7050 memset(hdev->eir, 0, sizeof(hdev->eir));
7051
cacaf52f
JH		 7052 memset(&cp, 0, sizeof(cp));
7053
890ea898 7054 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 7055}
7056
3e248560 7057void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 7058{
7059 struct cmd_lookup match = { NULL, hdev };
890ea898 7060 struct hci_request req;
c0ecddc2 7061 bool changed = false;
ed2c4ee3
JH		 7062
7063 if (status) {
7064 u8 mgmt_err = mgmt_status(status);
c0ecddc2
JH		 7065
7066 if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
9ecb3e24
MH		 7067 &hdev->dev_flags)) {
7068 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
3e248560 7069 new_settings(hdev, NULL);
9ecb3e24 7070 }
c0ecddc2 7071
04124681
GP		 7072 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
7073 &mgmt_err);
3e248560 7074 return;
c0ecddc2
JH		 7075 }
7076
7077 if (enable) {
9ecb3e24 7078 changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
c0ecddc2 7079 } else {
9ecb3e24
MH		 7080 changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
7081 if (!changed)
7082 changed = test_and_clear_bit(HCI_HS_ENABLED,
7083 &hdev->dev_flags);
7084 else
7085 clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
ed2c4ee3
JH		 7086 }
7087
7088 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
7089
c0ecddc2 7090 if (changed)
3e248560 7091 new_settings(hdev, match.sk);
ed2c4ee3 7092
5fc6ebb1 7093 if (match.sk)
ed2c4ee3
JH		 7094 sock_put(match.sk);
7095
890ea898
JH		 7096 hci_req_init(&req, hdev);
7097
3769972b
JH		 7098 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
7099 if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
7100 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
7101 sizeof(enable), &enable);
890ea898 7102 update_eir(&req);
3769972b 7103 } else {
890ea898 7104 clear_eir(&req);
3769972b 7105 }
890ea898
JH		 7106
7107 hci_req_run(&req, NULL);
ed2c4ee3
JH		 7108}
7109
92da6097 7110static void sk_lookup(struct pending_cmd *cmd, void *data)
90e70454
JH		 7111{
7112 struct cmd_lookup *match = data;
7113
90e70454
JH		 7114 if (match->sk == NULL) {
7115 match->sk = cmd->sk;
7116 sock_hold(match->sk);
7117 }
90e70454
JH		 7118}
7119
4e1b0245
MH		 7120void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
7121 u8 status)
7f9a903c 7122{
90e70454 7123 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 7124
92da6097
JH		 7125 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
7126 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
7127 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 7128
7129 if (!status)
4e1b0245
MH		 7130 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
7131 NULL);
90e70454
JH		 7132
7133 if (match.sk)
7134 sock_put(match.sk);
7f9a903c
MH		 7135}
7136
7667da34 7137void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 7138{
b312b161 7139 struct mgmt_cp_set_local_name ev;
13928971 7140 struct pending_cmd *cmd;
28cc7bde 7141
13928971 7142 if (status)
7667da34 7143 return;
b312b161
JH		 7144
7145 memset(&ev, 0, sizeof(ev));
7146 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 7147 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 7148
2e58ef3e 7149 cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 7150 if (!cmd) {
7151 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 7152
13928971
JH		 7153 /* If this is a HCI command related to powering on the
7154 * HCI dev don't send any mgmt signals.
7155 */
7156 if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 7157 return;
890ea898 7158 }
b312b161 7159
7667da34
MH		 7160 mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
7161 cmd ? cmd->sk : NULL);
b312b161 7162}
c35938b2 7163
4d2d2796 7164void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
38da1703
JH		 7165 u8 *rand192, u8 *hash256, u8 *rand256,
7166 u8 status)
c35938b2
SJ		 7167{
7168 struct pending_cmd *cmd;
c35938b2 7169
744cf19e 7170 BT_DBG("%s status %u", hdev->name, status);
c35938b2 7171
2e58ef3e 7172 cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
c35938b2 7173 if (!cmd)
3edaf092 7174 return;
c35938b2
SJ		 7175
7176 if (status) {
3edaf092
MH		 7177 cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
7178 mgmt_status(status));
c35938b2 7179 } else {
66f096f7
JH		 7180 struct mgmt_rp_read_local_oob_data rp;
7181 size_t rp_size = sizeof(rp);
4d2d2796 7182
66f096f7
JH		 7183 memcpy(rp.hash192, hash192, sizeof(rp.hash192));
7184 memcpy(rp.rand192, rand192, sizeof(rp.rand192));
c35938b2 7185
66f096f7 7186 if (bredr_sc_enabled(hdev) && hash256 && rand256) {
4d2d2796 7187 memcpy(rp.hash256, hash256, sizeof(rp.hash256));
38da1703 7188 memcpy(rp.rand256, rand256, sizeof(rp.rand256));
4d2d2796 7189 } else {
66f096f7 7190 rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
4d2d2796 7191 }
66f096f7
JH		 7192
7193 cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 0,
7194 &rp, rp_size);
c35938b2
SJ		 7195 }
7196
7197 mgmt_pending_remove(cmd);
c35938b2 7198}
e17acd40 7199
799ce93d
JP		 7200static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
7201{
7202 int i;
7203
7204 for (i = 0; i < uuid_count; i++) {
7205 if (!memcmp(uuid, uuids[i], 16))
7206 return true;
7207 }
7208
7209 return false;
7210}
7211
b487b9ce
MH		 7212static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
7213{
799ce93d
JP		 7214 u16 parsed = 0;
7215
7216 while (parsed < eir_len) {
7217 u8 field_len = eir[0];
7218 u8 uuid[16];
7219 int i;
7220
7221 if (field_len == 0)
7222 break;
7223
7224 if (eir_len - parsed < field_len + 1)
7225 break;
7226
7227 switch (eir[1]) {
7228 case EIR_UUID16_ALL:
7229 case EIR_UUID16_SOME:
7230 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 7231 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7232 uuid[13] = eir[i + 3];
7233 uuid[12] = eir[i + 2];
7234 if (has_uuid(uuid, uuid_count, uuids))
7235 return true;
7236 }
7237 break;
7238 case EIR_UUID32_ALL:
7239 case EIR_UUID32_SOME:
7240 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 7241 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 7242 uuid[15] = eir[i + 5];
7243 uuid[14] = eir[i + 4];
7244 uuid[13] = eir[i + 3];
7245 uuid[12] = eir[i + 2];
7246 if (has_uuid(uuid, uuid_count, uuids))
7247 return true;
7248 }
7249 break;
7250 case EIR_UUID128_ALL:
7251 case EIR_UUID128_SOME:
7252 for (i = 0; i + 17 <= field_len; i += 16) {
7253 memcpy(uuid, eir + i + 2, 16);
7254 if (has_uuid(uuid, uuid_count, uuids))
7255 return true;
7256 }
7257 break;
7258 }
7259
7260 parsed += field_len + 1;
7261 eir += field_len + 1;
7262 }
7263
b487b9ce
MH		 7264 return false;
7265}
7266
4b0e0ced
JP		 7267static void restart_le_scan(struct hci_dev *hdev)
7268{
7269 /* If controller is not scanning we are done. */
7270 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
7271 return;
7272
7273 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
7274 hdev->discovery.scan_start +
7275 hdev->discovery.scan_duration))
7276 return;
7277
7278 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
7279 DISCOV_LE_RESTART_DELAY);
7280}
7281
901801b9 7282void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
af58925c
MH		 7283 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
7284 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 7285{
e319d2e7
JH		 7286 char buf[512];
7287 struct mgmt_ev_device_found *ev = (void *) buf;
1dc06093 7288 size_t ev_size;
b487b9ce 7289 bool match;
e17acd40 7290
75ce208c
JH		 7291 /* Don't send events for a non-kernel initiated discovery. With
7292 * LE one exception is if we have pend_le_reports > 0 in which
7293 * case we're doing passive scanning and want these events.
7294 */
7295 if (!hci_discovery_active(hdev)) {
7296 if (link_type == ACL_LINK)
7297 return;
66f8455a 7298 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
75ce208c
JH		 7299 return;
7300 }
12602d0c 7301
bda157a4
MH		 7302 /* When using service discovery with a RSSI threshold, then check
7303 * if such a RSSI threshold is specified. If a RSSI threshold has
4b0e0ced
JP		 7304 * been specified, and HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set,
7305 * then all results with a RSSI smaller than the RSSI threshold will be
7306 * dropped. If the quirk is set, let it through for further processing,
7307 * as we might need to restart the scan.
efb2513f
MH		 7308 *
7309 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
7310 * the results are also dropped.
bda157a4
MH		 7311 */
7312 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 7313 (rssi == HCI_RSSI_INVALID ||
7314 (rssi < hdev->discovery.rssi &&
7315 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
bda157a4
MH		 7316 return;
7317
5d2e9fad
JH		 7318 /* Make sure that the buffer is big enough. The 5 extra bytes
7319 * are for the potential CoD field.
7320 */
7321 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
901801b9 7322 return;
7d262f86 7323
1dc06093
JH		 7324 memset(buf, 0, sizeof(buf));
7325
da25cf6a
MH		 7326 /* In case of device discovery with BR/EDR devices (pre 1.2), the
7327 * RSSI value was reported as 0 when not available. This behavior
7328 * is kept when using device discovery. This is required for full
7329 * backwards compatibility with the API.
7330 *
7331 * However when using service discovery, the value 127 will be
7332 * returned when the RSSI is not available.
7333 */
91200e9f
SJ		 7334 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
7335 link_type == ACL_LINK)
efb2513f
MH		 7336 rssi = 0;
7337
841c5644
JH		 7338 bacpy(&ev->addr.bdaddr, bdaddr);
7339 ev->addr.type = link_to_bdaddr(link_type, addr_type);
e319d2e7 7340 ev->rssi = rssi;
af58925c 7341 ev->flags = cpu_to_le32(flags);
e17acd40 7342
b487b9ce
MH		 7343 if (eir_len > 0) {
7344 /* When using service discovery and a list of UUID is
7345 * provided, results with no matching UUID should be
7346 * dropped. In case there is a match the result is
7347 * kept and checking possible scan response data
7348 * will be skipped.
7349 */
4b0e0ced 7350 if (hdev->discovery.uuid_count > 0) {
b487b9ce
MH		 7351 match = eir_has_uuids(eir, eir_len,
7352 hdev->discovery.uuid_count,
7353 hdev->discovery.uuids);
4b0e0ced
JP		 7354 /* If duplicate filtering does not report RSSI changes,
7355 * then restart scanning to ensure updated result with
7356 * updated RSSI values.
7357 */
7358 if (match && test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
7359 &hdev->quirks))
7360 restart_le_scan(hdev);
7361 } else {
ea8ae251 7362 match = true;
4b0e0ced 7363 }
ea8ae251
MH		 7364
7365 if (!match && !scan_rsp_len)
7366 return;
b487b9ce
MH		 7367
7368 /* Copy EIR or advertising data into event */
e319d2e7 7369 memcpy(ev->eir, eir, eir_len);
b487b9ce
MH		 7370 } else {
7371 /* When using service discovery and a list of UUID is
7372 * provided, results with empty EIR or advertising data
7373 * should be dropped since they do not match any UUID.
7374 */
ea8ae251 7375 if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
b487b9ce 7376 return;
ea8ae251
MH		 7377
7378 match = false;
b487b9ce 7379 }
e17acd40 7380
1dc06093
JH		 7381 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
7382 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
04124681 7383 dev_class, 3);
1dc06093 7384
b487b9ce
MH		 7385 if (scan_rsp_len > 0) {
7386 /* When using service discovery and a list of UUID is
7387 * provided, results with no matching UUID should be
7388 * dropped if there is no previous match from the
7389 * advertising data.
7390 */
7391 if (hdev->discovery.uuid_count > 0) {
7392 if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
7393 hdev->discovery.uuid_count,
7394 hdev->discovery.uuids))
7395 return;
4b0e0ced
JP		 7396
7397 /* If duplicate filtering does not report RSSI changes,
7398 * then restart scanning to ensure updated result with
7399 * updated RSSI values.
7400 */
7401 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
7402 &hdev->quirks))
7403 restart_le_scan(hdev);
b487b9ce
MH		 7404 }
7405
7406 /* Append scan response data to event */
5d2e9fad 7407 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
b487b9ce
MH		 7408 } else {
7409 /* When using service discovery and a list of UUID is
7410 * provided, results with empty scan response and no
7411 * previous matched advertising data should be dropped.
7412 */
7413 if (hdev->discovery.uuid_count > 0 && !match)
7414 return;
7415 }
5d2e9fad 7416
4b0e0ced
JP		 7417 /* Validate the reported RSSI value against the RSSI threshold once more
7418 * incase HCI_QUIRK_STRICT_DUPLICATE_FILTER forced a restart of LE
7419 * scanning.
7420 */
7421 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
7422 rssi < hdev->discovery.rssi)
7423 return;
7424
5d2e9fad
JH		 7425 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
7426 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 7427
901801b9 7428 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 7429}
a88a9652 7430
9cf12aee
MH		 7431void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7432 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 7433{
b644ba33
JH		 7434 struct mgmt_ev_device_found *ev;
7435 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
7436 u16 eir_len;
a88a9652 7437
b644ba33 7438 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 7439
b644ba33
JH		 7440 memset(buf, 0, sizeof(buf));
7441
7442 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 7443 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 7444 ev->rssi = rssi;
7445
7446 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 7447 name_len);
b644ba33 7448
eb55ef07 7449 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 7450
9cf12aee 7451 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 7452}
314b2381 7453
2f1e063b 7454void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 7455{
f963e8e9 7456 struct mgmt_ev_discovering ev;
164a6e78 7457
343fb145
AG		 7458 BT_DBG("%s discovering %u", hdev->name, discovering);
7459
f963e8e9
JH		 7460 memset(&ev, 0, sizeof(ev));
7461 ev.type = hdev->discovery.type;
7462 ev.discovering = discovering;
7463
2f1e063b 7464 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 7465}
5e762444 7466
1904a853 7467static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 7468{
7469 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 7470}
7471
7472void mgmt_reenable_advertising(struct hci_dev *hdev)
7473{
7474 struct hci_request req;
7475
5976e608
MH		 7476 if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
7477 return;
7478
7479 hci_req_init(&req, hdev);
7480 enable_advertising(&req);
0ec5ae84 7481 hci_req_run(&req, adv_enable_complete);
5976e608 7482}
Linux kernel - Deliverables
This page took 1.376964 seconds and 5 git commands to generate.