projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: mgmt: multi adv for set_advertising*()
[deliverable/linux.git] / net / bluetooth / mgmt.c
CommitLineData
0381101f
JH		 1/*
2 BlueZ - Bluetooth protocol stack for Linux
ea585ab5 3
0381101f 4 Copyright (C) 2010 Nokia Corporation
ea585ab5 5 Copyright (C) 2011-2012 Intel Corporation
0381101f
JH		 6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI Management interface */
26
3a9a231d 27#include <linux/module.h>
0381101f
JH		 28#include <asm/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
7129069e 32#include <net/bluetooth/hci_sock.h>
4bc58f51 33#include <net/bluetooth/l2cap.h>
0381101f 34#include <net/bluetooth/mgmt.h>
ac4b7236 35
0857dd3b 36#include "hci_request.h"
ac4b7236 37#include "smp.h"
a380b6cf 38#include "mgmt_util.h"
0381101f 39
2da9c55c 40#define MGMT_VERSION 1
beb1c21b 41#define MGMT_REVISION 9
02d98129 42
e70bb2e8
JH		 43static const u16 mgmt_commands[] = {
44 MGMT_OP_READ_INDEX_LIST,
45 MGMT_OP_READ_INFO,
46 MGMT_OP_SET_POWERED,
47 MGMT_OP_SET_DISCOVERABLE,
48 MGMT_OP_SET_CONNECTABLE,
49 MGMT_OP_SET_FAST_CONNECTABLE,
b2939475 50 MGMT_OP_SET_BONDABLE,
e70bb2e8
JH		 51 MGMT_OP_SET_LINK_SECURITY,
52 MGMT_OP_SET_SSP,
53 MGMT_OP_SET_HS,
54 MGMT_OP_SET_LE,
55 MGMT_OP_SET_DEV_CLASS,
56 MGMT_OP_SET_LOCAL_NAME,
57 MGMT_OP_ADD_UUID,
58 MGMT_OP_REMOVE_UUID,
59 MGMT_OP_LOAD_LINK_KEYS,
60 MGMT_OP_LOAD_LONG_TERM_KEYS,
61 MGMT_OP_DISCONNECT,
62 MGMT_OP_GET_CONNECTIONS,
63 MGMT_OP_PIN_CODE_REPLY,
64 MGMT_OP_PIN_CODE_NEG_REPLY,
65 MGMT_OP_SET_IO_CAPABILITY,
66 MGMT_OP_PAIR_DEVICE,
67 MGMT_OP_CANCEL_PAIR_DEVICE,
68 MGMT_OP_UNPAIR_DEVICE,
69 MGMT_OP_USER_CONFIRM_REPLY,
70 MGMT_OP_USER_CONFIRM_NEG_REPLY,
71 MGMT_OP_USER_PASSKEY_REPLY,
72 MGMT_OP_USER_PASSKEY_NEG_REPLY,
73 MGMT_OP_READ_LOCAL_OOB_DATA,
74 MGMT_OP_ADD_REMOTE_OOB_DATA,
75 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
76 MGMT_OP_START_DISCOVERY,
77 MGMT_OP_STOP_DISCOVERY,
78 MGMT_OP_CONFIRM_NAME,
79 MGMT_OP_BLOCK_DEVICE,
80 MGMT_OP_UNBLOCK_DEVICE,
cdbaccca 81 MGMT_OP_SET_DEVICE_ID,
4375f103 82 MGMT_OP_SET_ADVERTISING,
0663ca2a 83 MGMT_OP_SET_BREDR,
d13eafce 84 MGMT_OP_SET_STATIC_ADDRESS,
7f72134e 85 MGMT_OP_SET_SCAN_PARAMS,
e98d2ce2 86 MGMT_OP_SET_SECURE_CONN,
4e39ac81 87 MGMT_OP_SET_DEBUG_KEYS,
62b04cd1 88 MGMT_OP_SET_PRIVACY,
41edf160 89 MGMT_OP_LOAD_IRKS,
dd983808 90 MGMT_OP_GET_CONN_INFO,
95868426 91 MGMT_OP_GET_CLOCK_INFO,
2faade53
MH		 92 MGMT_OP_ADD_DEVICE,
93 MGMT_OP_REMOVE_DEVICE,
a26f3dcf 94 MGMT_OP_LOAD_CONN_PARAM,
73d1df2a 95 MGMT_OP_READ_UNCONF_INDEX_LIST,
9fc3bfb6 96 MGMT_OP_READ_CONFIG_INFO,
dbece37a 97 MGMT_OP_SET_EXTERNAL_CONFIG,
9713c17b 98 MGMT_OP_SET_PUBLIC_ADDRESS,
66ea9427 99 MGMT_OP_START_SERVICE_DISCOVERY,
4f0f155c 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
96f1474a 101 MGMT_OP_READ_EXT_INDEX_LIST,
d3d5305b 102 MGMT_OP_READ_ADV_FEATURES,
24b4f38f 103 MGMT_OP_ADD_ADVERTISING,
da929335 104 MGMT_OP_REMOVE_ADVERTISING,
e70bb2e8
JH		 105};
106
107static const u16 mgmt_events[] = {
108 MGMT_EV_CONTROLLER_ERROR,
109 MGMT_EV_INDEX_ADDED,
110 MGMT_EV_INDEX_REMOVED,
111 MGMT_EV_NEW_SETTINGS,
112 MGMT_EV_CLASS_OF_DEV_CHANGED,
113 MGMT_EV_LOCAL_NAME_CHANGED,
114 MGMT_EV_NEW_LINK_KEY,
115 MGMT_EV_NEW_LONG_TERM_KEY,
116 MGMT_EV_DEVICE_CONNECTED,
117 MGMT_EV_DEVICE_DISCONNECTED,
118 MGMT_EV_CONNECT_FAILED,
119 MGMT_EV_PIN_CODE_REQUEST,
120 MGMT_EV_USER_CONFIRM_REQUEST,
121 MGMT_EV_USER_PASSKEY_REQUEST,
122 MGMT_EV_AUTH_FAILED,
123 MGMT_EV_DEVICE_FOUND,
124 MGMT_EV_DISCOVERING,
125 MGMT_EV_DEVICE_BLOCKED,
126 MGMT_EV_DEVICE_UNBLOCKED,
127 MGMT_EV_DEVICE_UNPAIRED,
92a25256 128 MGMT_EV_PASSKEY_NOTIFY,
1b60ef21 129 MGMT_EV_NEW_IRK,
7ee4ea36 130 MGMT_EV_NEW_CSRK,
8afef092
MH		 131 MGMT_EV_DEVICE_ADDED,
132 MGMT_EV_DEVICE_REMOVED,
ffb5a827 133 MGMT_EV_NEW_CONN_PARAM,
0602a8ad 134 MGMT_EV_UNCONF_INDEX_ADDED,
edd3896b 135 MGMT_EV_UNCONF_INDEX_REMOVED,
f4537c04 136 MGMT_EV_NEW_CONFIG_OPTIONS,
ced85549
MH		 137 MGMT_EV_EXT_INDEX_ADDED,
138 MGMT_EV_EXT_INDEX_REMOVED,
72000df2 139 MGMT_EV_LOCAL_OOB_DATA_UPDATED,
24b4f38f
AU		 140 MGMT_EV_ADVERTISING_ADDED,
141 MGMT_EV_ADVERTISING_REMOVED,
e70bb2e8
JH		 142};
143
99c679ac
MH		 144static const u16 mgmt_untrusted_commands[] = {
145 MGMT_OP_READ_INDEX_LIST,
146 MGMT_OP_READ_INFO,
147 MGMT_OP_READ_UNCONF_INDEX_LIST,
148 MGMT_OP_READ_CONFIG_INFO,
149 MGMT_OP_READ_EXT_INDEX_LIST,
150};
151
152static const u16 mgmt_untrusted_events[] = {
153 MGMT_EV_INDEX_ADDED,
154 MGMT_EV_INDEX_REMOVED,
155 MGMT_EV_NEW_SETTINGS,
156 MGMT_EV_CLASS_OF_DEV_CHANGED,
157 MGMT_EV_LOCAL_NAME_CHANGED,
158 MGMT_EV_UNCONF_INDEX_ADDED,
159 MGMT_EV_UNCONF_INDEX_REMOVED,
160 MGMT_EV_NEW_CONFIG_OPTIONS,
161 MGMT_EV_EXT_INDEX_ADDED,
162 MGMT_EV_EXT_INDEX_REMOVED,
163};
164
17b02e62 165#define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000)
7d78525d 166
d25b78e2
JH		 167#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
168 "\x00\x00\x00\x00\x00\x00\x00\x00"
169
ca69b795
JH		 170/* HCI to MGMT error code conversion table */
171static u8 mgmt_status_table[] = {
172 MGMT_STATUS_SUCCESS,
173 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */
174 MGMT_STATUS_NOT_CONNECTED, /* No Connection */
175 MGMT_STATUS_FAILED, /* Hardware Failure */
176 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */
177 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */
eadd663a 178 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */
ca69b795
JH		 179 MGMT_STATUS_NO_RESOURCES, /* Memory Full */
180 MGMT_STATUS_TIMEOUT, /* Connection Timeout */
181 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */
182 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */
183 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */
184 MGMT_STATUS_BUSY, /* Command Disallowed */
185 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */
186 MGMT_STATUS_REJECTED, /* Rejected Security */
187 MGMT_STATUS_REJECTED, /* Rejected Personal */
188 MGMT_STATUS_TIMEOUT, /* Host Timeout */
189 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */
190 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */
191 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */
192 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */
193 MGMT_STATUS_DISCONNECTED, /* OE Power Off */
194 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */
195 MGMT_STATUS_BUSY, /* Repeated Attempts */
196 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */
197 MGMT_STATUS_FAILED, /* Unknown LMP PDU */
198 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */
199 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */
200 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */
201 MGMT_STATUS_REJECTED, /* Air Mode Rejected */
202 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */
203 MGMT_STATUS_FAILED, /* Unspecified Error */
204 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */
205 MGMT_STATUS_FAILED, /* Role Change Not Allowed */
206 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */
207 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */
208 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */
209 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */
210 MGMT_STATUS_FAILED, /* Unit Link Key Used */
211 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */
212 MGMT_STATUS_TIMEOUT, /* Instant Passed */
213 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */
214 MGMT_STATUS_FAILED, /* Transaction Collision */
215 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */
216 MGMT_STATUS_REJECTED, /* QoS Rejected */
217 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */
218 MGMT_STATUS_REJECTED, /* Insufficient Security */
219 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */
220 MGMT_STATUS_BUSY, /* Role Switch Pending */
221 MGMT_STATUS_FAILED, /* Slot Violation */
222 MGMT_STATUS_FAILED, /* Role Switch Failed */
223 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */
224 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */
225 MGMT_STATUS_BUSY, /* Host Busy Pairing */
226 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */
227 MGMT_STATUS_BUSY, /* Controller Busy */
228 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */
229 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */
230 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */
231 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */
232 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */
233};
234
235static u8 mgmt_status(u8 hci_status)
236{
237 if (hci_status < ARRAY_SIZE(mgmt_status_table))
238 return mgmt_status_table[hci_status];
239
240 return MGMT_STATUS_FAILED;
241}
242
c08b1a1d
MH		 243static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
244 u16 len, int flag)
f9207338 245{
c08b1a1d
MH		 246 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
247 flag, NULL);
f9207338
MH		 248}
249
72000df2
MH		 250static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
251 u16 len, int flag, struct sock *skip_sk)
252{
253 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
254 flag, skip_sk);
255}
256
f6b7712e
MH		 257static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
258 u16 len, struct sock *skip_sk)
259{
260 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
261 HCI_MGMT_GENERIC_EVENTS, skip_sk);
262}
263
7a00ff44
JH		 264static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
265 struct sock *skip_sk)
266{
267 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
c08b1a1d 268 HCI_SOCK_TRUSTED, skip_sk);
7a00ff44
JH		 269}
270
04124681
GP		 271static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
272 u16 data_len)
a38528f1
JH		 273{
274 struct mgmt_rp_read_version rp;
275
276 BT_DBG("sock %p", sk);
277
278 rp.version = MGMT_VERSION;
dcf4adbf 279 rp.revision = cpu_to_le16(MGMT_REVISION);
a38528f1 280
2a1afb5a
JH		 281 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
282 &rp, sizeof(rp));
a38528f1
JH		 283}
284
04124681
GP		 285static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
286 u16 data_len)
e70bb2e8
JH		 287{
288 struct mgmt_rp_read_commands *rp;
99c679ac 289 u16 num_commands, num_events;
e70bb2e8
JH		 290 size_t rp_size;
291 int i, err;
292
293 BT_DBG("sock %p", sk);
294
99c679ac
MH		 295 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
296 num_commands = ARRAY_SIZE(mgmt_commands);
297 num_events = ARRAY_SIZE(mgmt_events);
298 } else {
299 num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
300 num_events = ARRAY_SIZE(mgmt_untrusted_events);
301 }
302
e70bb2e8
JH		 303 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
304
305 rp = kmalloc(rp_size, GFP_KERNEL);
306 if (!rp)
307 return -ENOMEM;
308
dcf4adbf
JP		 309 rp->num_commands = cpu_to_le16(num_commands);
310 rp->num_events = cpu_to_le16(num_events);
e70bb2e8 311
99c679ac
MH		 312 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
313 __le16 *opcode = rp->opcodes;
314
315 for (i = 0; i < num_commands; i++, opcode++)
316 put_unaligned_le16(mgmt_commands[i], opcode);
e70bb2e8 317
99c679ac
MH		 318 for (i = 0; i < num_events; i++, opcode++)
319 put_unaligned_le16(mgmt_events[i], opcode);
320 } else {
321 __le16 *opcode = rp->opcodes;
322
323 for (i = 0; i < num_commands; i++, opcode++)
324 put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
325
326 for (i = 0; i < num_events; i++, opcode++)
327 put_unaligned_le16(mgmt_untrusted_events[i], opcode);
328 }
e70bb2e8 329
2a1afb5a
JH		 330 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
331 rp, rp_size);
e70bb2e8
JH		 332 kfree(rp);
333
334 return err;
335}
336
04124681
GP		 337static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
338 u16 data_len)
faba42eb 339{
faba42eb 340 struct mgmt_rp_read_index_list *rp;
8035ded4 341 struct hci_dev *d;
a38528f1 342 size_t rp_len;
faba42eb 343 u16 count;
476e44cb 344 int err;
faba42eb
JH		 345
346 BT_DBG("sock %p", sk);
347
348 read_lock(&hci_dev_list_lock);
349
350 count = 0;
bb4b2a9a 351 list_for_each_entry(d, &hci_dev_list, list) {
73d1df2a 352 if (d->dev_type == HCI_BREDR &&
d7a5a11d 353 !hci_dev_test_flag(d, HCI_UNCONFIGURED))
1514b892 354 count++;
faba42eb
JH		 355 }
356
a38528f1
JH		 357 rp_len = sizeof(*rp) + (2 * count);
358 rp = kmalloc(rp_len, GFP_ATOMIC);
359 if (!rp) {
b2c60d42 360 read_unlock(&hci_dev_list_lock);
faba42eb 361 return -ENOMEM;
b2c60d42 362 }
faba42eb 363
476e44cb 364 count = 0;
8035ded4 365 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 366 if (hci_dev_test_flag(d, HCI_SETUP) ||
367 hci_dev_test_flag(d, HCI_CONFIG) ||
368 hci_dev_test_flag(d, HCI_USER_CHANNEL))
ab81cbf9
JH		 369 continue;
370
73d1df2a
MH		 371 /* Devices marked as raw-only are neither configured
372 * nor unconfigured controllers.
373 */
374 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
fee746b0
MH		 375 continue;
376
73d1df2a 377 if (d->dev_type == HCI_BREDR &&
d7a5a11d 378 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
1514b892
MH		 379 rp->index[count++] = cpu_to_le16(d->id);
380 BT_DBG("Added hci%u", d->id);
381 }
faba42eb
JH		 382 }
383
476e44cb
JH		 384 rp->num_controllers = cpu_to_le16(count);
385 rp_len = sizeof(*rp) + (2 * count);
386
faba42eb
JH		 387 read_unlock(&hci_dev_list_lock);
388
2a1afb5a
JH		 389 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
390 0, rp, rp_len);
faba42eb 391
a38528f1
JH		 392 kfree(rp);
393
394 return err;
faba42eb
JH		 395}
396
73d1df2a
MH		 397static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
398 void *data, u16 data_len)
399{
400 struct mgmt_rp_read_unconf_index_list *rp;
401 struct hci_dev *d;
402 size_t rp_len;
403 u16 count;
404 int err;
405
406 BT_DBG("sock %p", sk);
407
408 read_lock(&hci_dev_list_lock);
409
410 count = 0;
411 list_for_each_entry(d, &hci_dev_list, list) {
412 if (d->dev_type == HCI_BREDR &&
d7a5a11d 413 hci_dev_test_flag(d, HCI_UNCONFIGURED))
73d1df2a
MH		 414 count++;
415 }
416
417 rp_len = sizeof(*rp) + (2 * count);
418 rp = kmalloc(rp_len, GFP_ATOMIC);
419 if (!rp) {
420 read_unlock(&hci_dev_list_lock);
421 return -ENOMEM;
422 }
423
424 count = 0;
425 list_for_each_entry(d, &hci_dev_list, list) {
d7a5a11d
MH		 426 if (hci_dev_test_flag(d, HCI_SETUP) ||
427 hci_dev_test_flag(d, HCI_CONFIG) ||
428 hci_dev_test_flag(d, HCI_USER_CHANNEL))
73d1df2a
MH		 429 continue;
430
431 /* Devices marked as raw-only are neither configured
432 * nor unconfigured controllers.
433 */
434 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
435 continue;
436
437 if (d->dev_type == HCI_BREDR &&
d7a5a11d 438 hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
73d1df2a
MH		 439 rp->index[count++] = cpu_to_le16(d->id);
440 BT_DBG("Added hci%u", d->id);
441 }
442 }
443
444 rp->num_controllers = cpu_to_le16(count);
445 rp_len = sizeof(*rp) + (2 * count);
446
447 read_unlock(&hci_dev_list_lock);
448
2a1afb5a
JH		 449 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
450 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
73d1df2a
MH		 451
452 kfree(rp);
453
454 return err;
455}
456
96f1474a
MH		 457static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
458 void *data, u16 data_len)
459{
460 struct mgmt_rp_read_ext_index_list *rp;
461 struct hci_dev *d;
462 size_t rp_len;
463 u16 count;
464 int err;
465
466 BT_DBG("sock %p", sk);
467
468 read_lock(&hci_dev_list_lock);
469
470 count = 0;
471 list_for_each_entry(d, &hci_dev_list, list) {
472 if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
473 count++;
474 }
475
476 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
477 rp = kmalloc(rp_len, GFP_ATOMIC);
478 if (!rp) {
479 read_unlock(&hci_dev_list_lock);
480 return -ENOMEM;
481 }
482
483 count = 0;
484 list_for_each_entry(d, &hci_dev_list, list) {
485 if (hci_dev_test_flag(d, HCI_SETUP) ||
486 hci_dev_test_flag(d, HCI_CONFIG) ||
487 hci_dev_test_flag(d, HCI_USER_CHANNEL))
488 continue;
489
490 /* Devices marked as raw-only are neither configured
491 * nor unconfigured controllers.
492 */
493 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
494 continue;
495
496 if (d->dev_type == HCI_BREDR) {
497 if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
498 rp->entry[count].type = 0x01;
499 else
500 rp->entry[count].type = 0x00;
501 } else if (d->dev_type == HCI_AMP) {
502 rp->entry[count].type = 0x02;
503 } else {
504 continue;
505 }
506
507 rp->entry[count].bus = d->bus;
508 rp->entry[count++].index = cpu_to_le16(d->id);
509 BT_DBG("Added hci%u", d->id);
510 }
511
512 rp->num_controllers = cpu_to_le16(count);
513 rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
514
515 read_unlock(&hci_dev_list_lock);
516
517 /* If this command is called at least once, then all the
518 * default index and unconfigured index events are disabled
519 * and from now on only extended index events are used.
520 */
521 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
522 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
523 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
524
525 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
526 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
527
528 kfree(rp);
529
530 return err;
531}
532
dbece37a
MH		 533static bool is_configured(struct hci_dev *hdev)
534{
535 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 536 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
dbece37a
MH		 537 return false;
538
539 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
540 !bacmp(&hdev->public_addr, BDADDR_ANY))
541 return false;
542
543 return true;
544}
545
89bc22d2
MH		 546static __le32 get_missing_options(struct hci_dev *hdev)
547{
548 u32 options = 0;
549
dbece37a 550 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
d7a5a11d 551 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
eb1904f4
MH		 552 options |= MGMT_OPTION_EXTERNAL_CONFIG;
553
89bc22d2
MH		 554 if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
555 !bacmp(&hdev->public_addr, BDADDR_ANY))
556 options |= MGMT_OPTION_PUBLIC_ADDRESS;
557
558 return cpu_to_le32(options);
559}
560
f4537c04
MH		 561static int new_options(struct hci_dev *hdev, struct sock *skip)
562{
563 __le32 options = get_missing_options(hdev);
564
f6b7712e
MH		 565 return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
566 sizeof(options), skip);
f4537c04
MH		 567}
568
dbece37a
MH		 569static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
570{
571 __le32 options = get_missing_options(hdev);
572
2a1afb5a
JH		 573 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
574 sizeof(options));
dbece37a
MH		 575}
576
9fc3bfb6
MH		 577static int read_config_info(struct sock *sk, struct hci_dev *hdev,
578 void *data, u16 data_len)
579{
580 struct mgmt_rp_read_config_info rp;
89bc22d2 581 u32 options = 0;
9fc3bfb6
MH		 582
583 BT_DBG("sock %p %s", sk, hdev->name);
584
585 hci_dev_lock(hdev);
586
587 memset(&rp, 0, sizeof(rp));
588 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
89bc22d2 589
eb1904f4
MH		 590 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
591 options |= MGMT_OPTION_EXTERNAL_CONFIG;
592
9fc3bfb6 593 if (hdev->set_bdaddr)
89bc22d2
MH		 594 options |= MGMT_OPTION_PUBLIC_ADDRESS;
595
596 rp.supported_options = cpu_to_le32(options);
597 rp.missing_options = get_missing_options(hdev);
9fc3bfb6
MH		 598
599 hci_dev_unlock(hdev);
600
2a1afb5a
JH		 601 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
602 &rp, sizeof(rp));
9fc3bfb6
MH		 603}
604
69ab39ea
JH		 605static u32 get_supported_settings(struct hci_dev *hdev)
606{
607 u32 settings = 0;
608
609 settings |= MGMT_SETTING_POWERED;
b2939475 610 settings |= MGMT_SETTING_BONDABLE;
b1de97d8 611 settings |= MGMT_SETTING_DEBUG_KEYS;
3742abfc
JH		 612 settings |= MGMT_SETTING_CONNECTABLE;
613 settings |= MGMT_SETTING_DISCOVERABLE;
69ab39ea 614
ed3fa31f 615 if (lmp_bredr_capable(hdev)) {
1a47aee8
JH		 616 if (hdev->hci_ver >= BLUETOOTH_VER_1_2)
617 settings |= MGMT_SETTING_FAST_CONNECTABLE;
69ab39ea
JH		 618 settings |= MGMT_SETTING_BREDR;
619 settings |= MGMT_SETTING_LINK_SECURITY;
a82974c9
MH		 620
621 if (lmp_ssp_capable(hdev)) {
622 settings |= MGMT_SETTING_SSP;
623 settings |= MGMT_SETTING_HS;
624 }
e98d2ce2 625
05b3c3e7 626 if (lmp_sc_capable(hdev))
e98d2ce2 627 settings |= MGMT_SETTING_SECURE_CONN;
848566b3 628 }
d7b7e796 629
eeca6f89 630 if (lmp_le_capable(hdev)) {
9d42820f 631 settings |= MGMT_SETTING_LE;
eeca6f89 632 settings |= MGMT_SETTING_ADVERTISING;
a3209694 633 settings |= MGMT_SETTING_SECURE_CONN;
0f4bd942 634 settings |= MGMT_SETTING_PRIVACY;
93690c22 635 settings |= MGMT_SETTING_STATIC_ADDRESS;
eeca6f89 636 }
69ab39ea 637
eb1904f4
MH		 638 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
639 hdev->set_bdaddr)
9fc3bfb6
MH		 640 settings |= MGMT_SETTING_CONFIGURATION;
641
69ab39ea
JH		 642 return settings;
643}
644
645static u32 get_current_settings(struct hci_dev *hdev)
646{
647 u32 settings = 0;
648
f1f0eb02 649 if (hdev_is_powered(hdev))
f0d4b78a
MH		 650 settings |= MGMT_SETTING_POWERED;
651
d7a5a11d 652 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
69ab39ea
JH		 653 settings |= MGMT_SETTING_CONNECTABLE;
654
d7a5a11d 655 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
1a4d3c4b
JH		 656 settings |= MGMT_SETTING_FAST_CONNECTABLE;
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
69ab39ea
JH		 659 settings |= MGMT_SETTING_DISCOVERABLE;
660
d7a5a11d 661 if (hci_dev_test_flag(hdev, HCI_BONDABLE))
b2939475 662 settings |= MGMT_SETTING_BONDABLE;
69ab39ea 663
d7a5a11d 664 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
69ab39ea
JH		 665 settings |= MGMT_SETTING_BREDR;
666
d7a5a11d 667 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
69ab39ea
JH		 668 settings |= MGMT_SETTING_LE;
669
d7a5a11d 670 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
69ab39ea
JH		 671 settings |= MGMT_SETTING_LINK_SECURITY;
672
d7a5a11d 673 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
69ab39ea
JH		 674 settings |= MGMT_SETTING_SSP;
675
d7a5a11d 676 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
6d80dfd0
JH		 677 settings |= MGMT_SETTING_HS;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
eeca6f89
JH		 680 settings |= MGMT_SETTING_ADVERTISING;
681
d7a5a11d 682 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
e98d2ce2
MH		 683 settings |= MGMT_SETTING_SECURE_CONN;
684
d7a5a11d 685 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
b1de97d8
MH		 686 settings |= MGMT_SETTING_DEBUG_KEYS;
687
d7a5a11d 688 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
0f4bd942
JH		 689 settings |= MGMT_SETTING_PRIVACY;
690
93690c22
MH		 691 /* The current setting for static address has two purposes. The
692 * first is to indicate if the static address will be used and
693 * the second is to indicate if it is actually set.
694 *
695 * This means if the static address is not configured, this flag
08dc0e98 696 * will never be set. If the address is configured, then if the
93690c22
MH		 697 * address is actually used decides if the flag is set or not.
698 *
699 * For single mode LE only controllers and dual-mode controllers
700 * with BR/EDR disabled, the existence of the static address will
701 * be evaluated.
702 */
b7cb93e5 703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
d7a5a11d 704 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
93690c22
MH		 705 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
706 if (bacmp(&hdev->static_addr, BDADDR_ANY))
707 settings |= MGMT_SETTING_STATIC_ADDRESS;
708 }
709
69ab39ea
JH		 710 return settings;
711}
712
ef580372
JH		 713#define PNP_INFO_SVCLASS_ID 0x1200
714
213202ed
JH		 715static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
716{
717 u8 *ptr = data, *uuids_start = NULL;
718 struct bt_uuid *uuid;
719
720 if (len < 4)
721 return ptr;
722
723 list_for_each_entry(uuid, &hdev->uuids, list) {
724 u16 uuid16;
725
726 if (uuid->size != 16)
727 continue;
728
729 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
730 if (uuid16 < 0x1100)
731 continue;
732
733 if (uuid16 == PNP_INFO_SVCLASS_ID)
734 continue;
735
736 if (!uuids_start) {
737 uuids_start = ptr;
738 uuids_start[0] = 1;
739 uuids_start[1] = EIR_UUID16_ALL;
740 ptr += 2;
741 }
742
743 /* Stop if not enough space to put next UUID */
744 if ((ptr - data) + sizeof(u16) > len) {
745 uuids_start[1] = EIR_UUID16_SOME;
746 break;
747 }
748
749 *ptr++ = (uuid16 & 0x00ff);
750 *ptr++ = (uuid16 & 0xff00) >> 8;
751 uuids_start[0] += sizeof(uuid16);
752 }
753
754 return ptr;
755}
756
cdf1963f
JH		 757static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
758{
759 u8 *ptr = data, *uuids_start = NULL;
760 struct bt_uuid *uuid;
761
762 if (len < 6)
763 return ptr;
764
765 list_for_each_entry(uuid, &hdev->uuids, list) {
766 if (uuid->size != 32)
767 continue;
768
769 if (!uuids_start) {
770 uuids_start = ptr;
771 uuids_start[0] = 1;
772 uuids_start[1] = EIR_UUID32_ALL;
773 ptr += 2;
774 }
775
776 /* Stop if not enough space to put next UUID */
777 if ((ptr - data) + sizeof(u32) > len) {
778 uuids_start[1] = EIR_UUID32_SOME;
779 break;
780 }
781
782 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
783 ptr += sizeof(u32);
784 uuids_start[0] += sizeof(u32);
785 }
786
787 return ptr;
788}
789
c00d575b
JH		 790static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
791{
792 u8 *ptr = data, *uuids_start = NULL;
793 struct bt_uuid *uuid;
794
795 if (len < 18)
796 return ptr;
797
798 list_for_each_entry(uuid, &hdev->uuids, list) {
799 if (uuid->size != 128)
800 continue;
801
802 if (!uuids_start) {
803 uuids_start = ptr;
804 uuids_start[0] = 1;
805 uuids_start[1] = EIR_UUID128_ALL;
806 ptr += 2;
807 }
808
809 /* Stop if not enough space to put next UUID */
810 if ((ptr - data) + 16 > len) {
811 uuids_start[1] = EIR_UUID128_SOME;
812 break;
813 }
814
815 memcpy(ptr, uuid->uuid, 16);
816 ptr += 16;
817 uuids_start[0] += 16;
818 }
819
820 return ptr;
821}
822
333ae95d
JH		 823static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
824{
825 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
826}
827
333ae95d
JH		 828static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
829 struct hci_dev *hdev,
830 const void *data)
831{
832 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
833}
834
91aa9bb2
FG		 835static u8 get_current_adv_instance(struct hci_dev *hdev)
836{
837 /* The "Set Advertising" setting supersedes the "Add Advertising"
838 * setting. Here we set the advertising data based on which
839 * setting was set. When neither apply, default to the global settings,
840 * represented by instance "0".
841 */
842 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
843 !hci_dev_test_flag(hdev, HCI_ADVERTISING))
3ff37e6b 844 return hdev->cur_adv_instance;
91aa9bb2
FG		 845
846 return 0x00;
847}
848
4117ed70 849static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
f14d8f64 850{
7a5f4990
MH		 851 u8 ad_len = 0;
852 size_t name_len;
853
854 name_len = strlen(hdev->dev_name);
855 if (name_len > 0) {
856 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
857
858 if (name_len > max_len) {
859 name_len = max_len;
860 ptr[1] = EIR_NAME_SHORT;
861 } else
862 ptr[1] = EIR_NAME_COMPLETE;
863
864 ptr[0] = name_len + 1;
865
866 memcpy(ptr + 2, hdev->dev_name, name_len);
867
868 ad_len += (name_len + 2);
869 ptr += (name_len + 2);
870 }
871
872 return ad_len;
f14d8f64
MH		 873}
874
ca21fbe9
FG		 875static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
876 u8 *ptr)
4117ed70 877{
ca21fbe9
FG		 878 struct adv_info *adv_instance;
879
880 adv_instance = hci_find_adv_instance(hdev, instance);
881 if (!adv_instance)
882 return 0;
883
4117ed70
AU		 884 /* TODO: Set the appropriate entries based on advertising instance flags
885 * here once flags other than 0 are supported.
886 */
ca21fbe9
FG		 887 memcpy(ptr, adv_instance->scan_rsp_data,
888 adv_instance->scan_rsp_len);
4117ed70 889
ca21fbe9 890 return adv_instance->scan_rsp_len;
4117ed70
AU		 891}
892
efae002c 893static void update_inst_scan_rsp_data(struct hci_request *req, u8 instance)
f14d8f64
MH		 894{
895 struct hci_dev *hdev = req->hdev;
896 struct hci_cp_le_set_scan_rsp_data cp;
897 u8 len;
898
d7a5a11d 899 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
f14d8f64
MH		 900 return;
901
902 memset(&cp, 0, sizeof(cp));
903
4117ed70 904 if (instance)
ca21fbe9 905 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
4117ed70
AU		 906 else
907 len = create_default_scan_rsp_data(hdev, cp.data);
f14d8f64 908
eb438b5f 909 if (hdev->scan_rsp_data_len == len &&
4117ed70 910 !memcmp(cp.data, hdev->scan_rsp_data, len))
f14d8f64
MH		 911 return;
912
eb438b5f
JH		 913 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
914 hdev->scan_rsp_data_len = len;
f14d8f64
MH		 915
916 cp.length = len;
917
918 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
919}
920
4117ed70
AU		 921static void update_scan_rsp_data(struct hci_request *req)
922{
efae002c 923 update_inst_scan_rsp_data(req, get_current_adv_instance(req->hdev));
4117ed70
AU		 924}
925
9a43e25f
JH		 926static u8 get_adv_discov_flags(struct hci_dev *hdev)
927{
3b0602cd 928 struct mgmt_pending_cmd *cmd;
9a43e25f
JH		 929
930 /* If there's a pending mgmt command the flags will not yet have
931 * their final values, so check for this first.
932 */
333ae95d 933 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
9a43e25f
JH		 934 if (cmd) {
935 struct mgmt_mode *cp = cmd->param;
936 if (cp->val == 0x01)
937 return LE_AD_GENERAL;
938 else if (cp->val == 0x02)
939 return LE_AD_LIMITED;
940 } else {
d7a5a11d 941 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
9a43e25f 942 return LE_AD_LIMITED;
d7a5a11d 943 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
9a43e25f
JH		 944 return LE_AD_GENERAL;
945 }
946
947 return 0;
948}
949
fdf51784
AU		 950static bool get_connectable(struct hci_dev *hdev)
951{
952 struct mgmt_pending_cmd *cmd;
441ad2d0 953
fdf51784
AU		 954 /* If there's a pending mgmt command the flag will not yet have
955 * it's final value, so check for this first.
956 */
957 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
958 if (cmd) {
959 struct mgmt_mode *cp = cmd->param;
441ad2d0 960
fdf51784 961 return cp->val;
441ad2d0
MH		 962 }
963
fdf51784
AU		 964 return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
965}
441ad2d0 966
fdf51784
AU		 967static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
968{
969 u32 flags;
411b4121 970 struct adv_info *adv_instance;
441ad2d0 971
bea28e65
FG		 972 if (instance == 0x00) {
973 /* Instance 0 always manages the "Tx Power" and "Flags"
974 * fields
975 */
976 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
411b4121 977
bea28e65
FG		 978 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
979 * corresponds to the "connectable" instance flag.
980 */
981 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
982 flags |= MGMT_ADV_FLAG_CONNECTABLE;
fdf51784 983
bea28e65 984 return flags;
411b4121 985 }
fdf51784 986
bea28e65 987 adv_instance = hci_find_adv_instance(hdev, instance);
fdf51784 988
bea28e65
FG		 989 /* Return 0 when we got an invalid instance identifier. */
990 if (!adv_instance)
991 return 0;
fdf51784 992
bea28e65 993 return adv_instance->flags;
441ad2d0
MH		 994}
995
7b683b74 996static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
c7d4883b 997{
7b683b74
FG		 998 u8 instance = get_current_adv_instance(hdev);
999 struct adv_info *adv_instance;
1000
1001 /* Ignore instance 0 */
1002 if (instance == 0x00)
1003 return 0;
1004
1005 adv_instance = hci_find_adv_instance(hdev, instance);
1006 if (!adv_instance)
c7d4883b
AU		 1007 return 0;
1008
1009 /* TODO: Take into account the "appearance" and "local-name" flags here.
1010 * These are currently being ignored as they are not supported.
1011 */
7b683b74 1012 return adv_instance->scan_rsp_len;
c7d4883b
AU		 1013}
1014
fdf51784 1015static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
24b4f38f 1016{
f63ba24b 1017 struct adv_info *adv_instance = NULL;
b44133ff 1018 u8 ad_len = 0, flags = 0;
f63ba24b
FG		 1019 u32 instance_flags;
1020
1021 /* Return 0 when the current instance identifier is invalid. */
1022 if (instance) {
1023 adv_instance = hci_find_adv_instance(hdev, instance);
1024 if (!adv_instance)
1025 return 0;
1026 }
1027
1028 instance_flags = get_adv_instance_flags(hdev, instance);
b44133ff 1029
807ec772
AU		 1030 /* The Add Advertising command allows userspace to set both the general
1031 * and limited discoverable flags.
1032 */
fdf51784 1033 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
b44133ff
AU		 1034 flags |= LE_AD_GENERAL;
1035
fdf51784 1036 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
807ec772
AU		 1037 flags |= LE_AD_LIMITED;
1038
fdf51784 1039 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
67e0c0cd
AU		 1040 /* If a discovery flag wasn't provided, simply use the global
1041 * settings.
1042 */
1043 if (!flags)
1044 flags |= get_adv_discov_flags(hdev);
1045
b44133ff
AU		 1046 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1047 flags |= LE_AD_NO_BREDR;
1048
fdf51784
AU		 1049 /* If flags would still be empty, then there is no need to
1050 * include the "Flags" AD field".
1051 */
1052 if (flags) {
1053 ptr[0] = 0x02;
1054 ptr[1] = EIR_FLAGS;
1055 ptr[2] = flags;
b44133ff 1056
fdf51784
AU		 1057 ad_len += 3;
1058 ptr += 3;
1059 }
b44133ff
AU		 1060 }
1061
f63ba24b
FG		 1062 if (adv_instance) {
1063 memcpy(ptr, adv_instance->adv_data,
1064 adv_instance->adv_data_len);
1065 ad_len += adv_instance->adv_data_len;
1066 ptr += adv_instance->adv_data_len;
38c8af60
MH		 1067 }
1068
fdf51784 1069 /* Provide Tx Power only if we can provide a valid value for it */
5507e358 1070 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
fdf51784 1071 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
5507e358
AU		 1072 ptr[0] = 0x02;
1073 ptr[1] = EIR_TX_POWER;
1074 ptr[2] = (u8)hdev->adv_tx_power;
1075
1076 ad_len += 3;
1077 ptr += 3;
1078 }
1079
b44133ff 1080 return ad_len;
24b4f38f
AU		 1081}
1082
efae002c 1083static void update_inst_adv_data(struct hci_request *req, u8 instance)
441ad2d0
MH		 1084{
1085 struct hci_dev *hdev = req->hdev;
1086 struct hci_cp_le_set_adv_data cp;
1087 u8 len;
1088
d7a5a11d 1089 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
441ad2d0
MH		 1090 return;
1091
1092 memset(&cp, 0, sizeof(cp));
1093
fdf51784 1094 len = create_instance_adv_data(hdev, instance, cp.data);
441ad2d0 1095
24b4f38f 1096 /* There's nothing to do if the data hasn't changed */
441ad2d0
MH		 1097 if (hdev->adv_data_len == len &&
1098 memcmp(cp.data, hdev->adv_data, len) == 0)
1099 return;
1100
1101 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1102 hdev->adv_data_len = len;
1103
1104 cp.length = len;
1105
1106 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1107}
1108
e7a685d3
AU		 1109static void update_adv_data(struct hci_request *req)
1110{
efae002c 1111 update_inst_adv_data(req, get_current_adv_instance(req->hdev));
24b4f38f
AU		 1112}
1113
bc6d2d04
JH		 1114int mgmt_update_adv_data(struct hci_dev *hdev)
1115{
1116 struct hci_request req;
1117
1118 hci_req_init(&req, hdev);
1119 update_adv_data(&req);
1120
1121 return hci_req_run(&req, NULL);
1122}
1123
ef580372
JH		 1124static void create_eir(struct hci_dev *hdev, u8 *data)
1125{
1126 u8 *ptr = data;
ef580372
JH		 1127 size_t name_len;
1128
1129 name_len = strlen(hdev->dev_name);
1130
1131 if (name_len > 0) {
1132 /* EIR Data type */
1133 if (name_len > 48) {
1134 name_len = 48;
1135 ptr[1] = EIR_NAME_SHORT;
1136 } else
1137 ptr[1] = EIR_NAME_COMPLETE;
1138
1139 /* EIR Data length */
1140 ptr[0] = name_len + 1;
1141
1142 memcpy(ptr + 2, hdev->dev_name, name_len);
1143
ef580372
JH		 1144 ptr += (name_len + 2);
1145 }
1146
bbaf444a 1147 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
91c4e9b1
MH		 1148 ptr[0] = 2;
1149 ptr[1] = EIR_TX_POWER;
1150 ptr[2] = (u8) hdev->inq_tx_power;
1151
91c4e9b1
MH		 1152 ptr += 3;
1153 }
1154
2b9be137
MH		 1155 if (hdev->devid_source > 0) {
1156 ptr[0] = 9;
1157 ptr[1] = EIR_DEVICE_ID;
1158
1159 put_unaligned_le16(hdev->devid_source, ptr + 2);
1160 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
1161 put_unaligned_le16(hdev->devid_product, ptr + 6);
1162 put_unaligned_le16(hdev->devid_version, ptr + 8);
1163
2b9be137
MH		 1164 ptr += 10;
1165 }
1166
213202ed 1167 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
cdf1963f 1168 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
c00d575b 1169 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
ef580372
JH		 1170}
1171
890ea898 1172static void update_eir(struct hci_request *req)
ef580372 1173{
890ea898 1174 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1175 struct hci_cp_write_eir cp;
1176
504c8dcd 1177 if (!hdev_is_powered(hdev))
890ea898 1178 return;
7770c4aa 1179
976eb20e 1180 if (!lmp_ext_inq_capable(hdev))
890ea898 1181 return;
ef580372 1182
d7a5a11d 1183 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
890ea898 1184 return;
ef580372 1185
d7a5a11d 1186 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1187 return;
ef580372
JH		 1188
1189 memset(&cp, 0, sizeof(cp));
1190
1191 create_eir(hdev, cp.data);
1192
1193 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
890ea898 1194 return;
ef580372
JH		 1195
1196 memcpy(hdev->eir, cp.data, sizeof(cp.data));
1197
890ea898 1198 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
ef580372
JH		 1199}
1200
1201static u8 get_service_classes(struct hci_dev *hdev)
1202{
1203 struct bt_uuid *uuid;
1204 u8 val = 0;
1205
1206 list_for_each_entry(uuid, &hdev->uuids, list)
1207 val |= uuid->svc_hint;
1208
1209 return val;
1210}
1211
890ea898 1212static void update_class(struct hci_request *req)
ef580372 1213{
890ea898 1214 struct hci_dev *hdev = req->hdev;
ef580372
JH		 1215 u8 cod[3];
1216
1217 BT_DBG("%s", hdev->name);
1218
504c8dcd 1219 if (!hdev_is_powered(hdev))
890ea898 1220 return;
7770c4aa 1221
d7a5a11d 1222 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
f87ea1da
JH		 1223 return;
1224
d7a5a11d 1225 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
890ea898 1226 return;
ef580372
JH		 1227
1228 cod[0] = hdev->minor_class;
1229 cod[1] = hdev->major_class;
1230 cod[2] = get_service_classes(hdev);
1231
d7a5a11d 1232 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
6acd7db4
MH		 1233 cod[1] |= 0x20;
1234
ef580372 1235 if (memcmp(cod, hdev->dev_class, 3) == 0)
890ea898 1236 return;
ef580372 1237
890ea898 1238 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
ef580372
JH		 1239}
1240
0ec5ae84
JH		 1241static void disable_advertising(struct hci_request *req)
1242{
1243 u8 enable = 0x00;
1244
1245 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1246}
1247
199a2fb1
JH		 1248static void enable_advertising(struct hci_request *req)
1249{
1250 struct hci_dev *hdev = req->hdev;
1251 struct hci_cp_le_set_adv_param cp;
8f2a0601 1252 u8 own_addr_type, enable = 0x01;
a4858cb9 1253 bool connectable;
e7a685d3
AU		 1254 u8 instance;
1255 u32 flags;
199a2fb1 1256
0ec5ae84
JH		 1257 if (hci_conn_num(hdev, LE_LINK) > 0)
1258 return;
1259
d7a5a11d 1260 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
0ec5ae84
JH		 1261 disable_advertising(req);
1262
5ce194c4 1263 /* Clear the HCI_LE_ADV bit temporarily so that the
8d97250e
JH		 1264 * hci_update_random_address knows that it's safe to go ahead
1265 * and write a new random address. The flag will be set back on
1266 * as soon as the SET_ADV_ENABLE HCI command completes.
1267 */
a358dc11 1268 hci_dev_clear_flag(hdev, HCI_LE_ADV);
8d97250e 1269
e7a685d3
AU		 1270 instance = get_current_adv_instance(hdev);
1271 flags = get_adv_instance_flags(hdev, instance);
faccb950
AU		 1272
1273 /* If the "connectable" instance flag was not set, then choose between
1274 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1275 */
1276 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1277 get_connectable(hdev);
8f2a0601 1278
a4858cb9
JH		 1279 /* Set require_privacy to true only when non-connectable
1280 * advertising is used. In that case it is fine to use a
1281 * non-resolvable private address.
1282 */
1283 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
8f2a0601
JH		 1284 return;
1285
41c90c18 1286 memset(&cp, 0, sizeof(cp));
628531c9
GL		 1287 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
1288 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
c7d4883b
AU		 1289
1290 if (connectable)
1291 cp.type = LE_ADV_IND;
7b683b74 1292 else if (get_cur_adv_instance_scan_rsp_len(hdev))
c7d4883b
AU		 1293 cp.type = LE_ADV_SCAN_IND;
1294 else
1295 cp.type = LE_ADV_NONCONN_IND;
1296
8f2a0601 1297 cp.own_address_type = own_addr_type;
199a2fb1
JH		 1298 cp.channel_map = hdev->le_adv_channel_map;
1299
1300 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1301
1302 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1303}
1304
7d78525d
JH		 1305static void service_cache_off(struct work_struct *work)
1306{
1307 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1308 service_cache.work);
890ea898 1309 struct hci_request req;
7d78525d 1310
a69d8927 1311 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1312 return;
1313
890ea898
JH		 1314 hci_req_init(&req, hdev);
1315
7d78525d
JH		 1316 hci_dev_lock(hdev);
1317
890ea898
JH		 1318 update_eir(&req);
1319 update_class(&req);
7d78525d
JH		 1320
1321 hci_dev_unlock(hdev);
890ea898
JH		 1322
1323 hci_req_run(&req, NULL);
7d78525d
JH		 1324}
1325
d6bfd59c
JH		 1326static void rpa_expired(struct work_struct *work)
1327{
1328 struct hci_dev *hdev = container_of(work, struct hci_dev,
1329 rpa_expired.work);
1330 struct hci_request req;
1331
1332 BT_DBG("");
1333
a1536da2 1334 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
d6bfd59c 1335
d7a5a11d 1336 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
d6bfd59c
JH		 1337 return;
1338
1339 /* The generation of a new RPA and programming it into the
1340 * controller happens in the enable_advertising() function.
1341 */
d6bfd59c 1342 hci_req_init(&req, hdev);
d6bfd59c 1343 enable_advertising(&req);
d6bfd59c
JH		 1344 hci_req_run(&req, NULL);
1345}
1346
6a919082 1347static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
7d78525d 1348{
238be788 1349 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
6a919082
JH		 1350 return;
1351
4f87da80 1352 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
d6bfd59c 1353 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired);
7d78525d 1354
4f87da80
JH		 1355 /* Non-mgmt controlled devices get this bit set
1356 * implicitly so that pairing works for them, however
1357 * for mgmt we require user-space to explicitly enable
1358 * it
1359 */
a358dc11 1360 hci_dev_clear_flag(hdev, HCI_BONDABLE);
7d78525d
JH		 1361}
1362
0f4e68cf 1363static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
04124681 1364 void *data, u16 data_len)
0381101f 1365{
a38528f1 1366 struct mgmt_rp_read_info rp;
f7b64e69 1367
bdb6d971 1368 BT_DBG("sock %p %s", sk, hdev->name);
f7b64e69 1369
09fd0de5 1370 hci_dev_lock(hdev);
f7b64e69 1371
dc4fe30b
JH		 1372 memset(&rp, 0, sizeof(rp));
1373
69ab39ea 1374 bacpy(&rp.bdaddr, &hdev->bdaddr);
f7b64e69 1375
69ab39ea 1376 rp.version = hdev->hci_ver;
eb55ef07 1377 rp.manufacturer = cpu_to_le16(hdev->manufacturer);
69ab39ea
JH		 1378
1379 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
1380 rp.current_settings = cpu_to_le32(get_current_settings(hdev));
f7b64e69 1381
a38528f1 1382 memcpy(rp.dev_class, hdev->dev_class, 3);
f7b64e69 1383
dc4fe30b 1384 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
27fcc362 1385 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name));
dc4fe30b 1386
09fd0de5 1387 hci_dev_unlock(hdev);
0381101f 1388
2a1afb5a
JH		 1389 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
1390 sizeof(rp));
0381101f
JH		 1391}
1392
69ab39ea 1393static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
8680570b 1394{
69ab39ea 1395 __le32 settings = cpu_to_le32(get_current_settings(hdev));
8680570b 1396
2a1afb5a
JH		 1397 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
1398 sizeof(settings));
8680570b
JH		 1399}
1400
1904a853 1401static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
8b064a3a
JH		 1402{
1403 BT_DBG("%s status 0x%02x", hdev->name, status);
1404
a3172b7e
JH		 1405 if (hci_conn_count(hdev) == 0) {
1406 cancel_delayed_work(&hdev->power_off);
8b064a3a 1407 queue_work(hdev->req_workqueue, &hdev->power_off.work);
a3172b7e 1408 }
8b064a3a
JH		 1409}
1410
23a48093 1411static bool hci_stop_discovery(struct hci_request *req)
21a60d30
JH		 1412{
1413 struct hci_dev *hdev = req->hdev;
1414 struct hci_cp_remote_name_req_cancel cp;
1415 struct inquiry_entry *e;
1416
1417 switch (hdev->discovery.state) {
1418 case DISCOVERY_FINDING:
07d2334a 1419 if (test_bit(HCI_INQUIRY, &hdev->flags))
21a60d30 1420 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
07d2334a
JP		 1421
1422 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30
JH		 1423 cancel_delayed_work(&hdev->le_scan_disable);
1424 hci_req_add_le_scan_disable(req);
1425 }
1426
23a48093 1427 return true;
21a60d30
JH		 1428
1429 case DISCOVERY_RESOLVING:
1430 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
1431 NAME_PENDING);
1432 if (!e)
23a48093 1433 break;
21a60d30
JH		 1434
1435 bacpy(&cp.bdaddr, &e->data.bdaddr);
1436 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
1437 &cp);
1438
23a48093 1439 return true;
21a60d30
JH		 1440
1441 default:
1442 /* Passive scanning */
d7a5a11d 1443 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
21a60d30 1444 hci_req_add_le_scan_disable(req);
23a48093
JH		 1445 return true;
1446 }
1447
21a60d30
JH		 1448 break;
1449 }
23a48093
JH		 1450
1451 return false;
21a60d30
JH		 1452}
1453
912098a6
AU		 1454static void advertising_added(struct sock *sk, struct hci_dev *hdev,
1455 u8 instance)
1456{
1457 struct mgmt_ev_advertising_added ev;
1458
1459 ev.instance = instance;
1460
1461 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
1462}
1463
1464static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
1465 u8 instance)
1466{
1467 struct mgmt_ev_advertising_removed ev;
1468
1469 ev.instance = instance;
1470
1471 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
1472}
1473
7816b820
FG		 1474static int schedule_adv_instance(struct hci_request *req, u8 instance,
1475 bool force) {
1476 struct hci_dev *hdev = req->hdev;
1477 struct adv_info *adv_instance = NULL;
1478 u16 timeout;
1479
1480 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1481 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1482 return -EPERM;
1483
1484 if (hdev->adv_instance_timeout)
1485 return -EBUSY;
1486
1487 adv_instance = hci_find_adv_instance(hdev, instance);
1488 if (!adv_instance)
1489 return -ENOENT;
1490
1491 /* A zero timeout means unlimited advertising. As long as there is
1492 * only one instance, duration should be ignored. We still set a timeout
1493 * in case further instances are being added later on.
1494 *
1495 * If the remaining lifetime of the instance is more than the duration
1496 * then the timeout corresponds to the duration, otherwise it will be
1497 * reduced to the remaining instance lifetime.
1498 */
1499 if (adv_instance->timeout == 0 ||
1500 adv_instance->duration <= adv_instance->remaining_time)
1501 timeout = adv_instance->duration;
1502 else
1503 timeout = adv_instance->remaining_time;
1504
1505 /* The remaining time is being reduced unless the instance is being
1506 * advertised without time limit.
1507 */
1508 if (adv_instance->timeout)
1509 adv_instance->remaining_time =
1510 adv_instance->remaining_time - timeout;
1511
1512 hdev->adv_instance_timeout = timeout;
1513 queue_delayed_work(hdev->workqueue,
1514 &hdev->adv_instance_expire,
1515 msecs_to_jiffies(timeout * 1000));
1516
1517 /* If we're just re-scheduling the same instance again then do not
1518 * execute any HCI commands. This happens when a single instance is
1519 * being advertised.
1520 */
1521 if (!force && hdev->cur_adv_instance == instance &&
1522 hci_dev_test_flag(hdev, HCI_LE_ADV))
1523 return 0;
1524
1525 hdev->cur_adv_instance = instance;
1526 update_adv_data(req);
1527 update_scan_rsp_data(req);
1528 enable_advertising(req);
1529
1530 return 0;
1531}
1532
1533static void cancel_adv_timeout(struct hci_dev *hdev)
1534{
1535 if (hdev->adv_instance_timeout) {
1536 hdev->adv_instance_timeout = 0;
1537 cancel_delayed_work(&hdev->adv_instance_expire);
1538 }
1539}
1540
912098a6
AU		 1541static void clear_adv_instance(struct hci_dev *hdev)
1542{
1543 struct hci_request req;
1544
1545 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1546 return;
1547
5d900e46
FG		 1548 if (hdev->adv_instance_timeout)
1549 cancel_delayed_work(&hdev->adv_instance_expire);
912098a6
AU		 1550
1551 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
1552 advertising_removed(NULL, hdev, 1);
1553 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
1554
1555 if (!hdev_is_powered(hdev) ||
1556 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1557 return;
1558
1559 hci_req_init(&req, hdev);
1560 disable_advertising(&req);
1561 hci_req_run(&req, NULL);
1562}
1563
8b064a3a
JH		 1564static int clean_up_hci_state(struct hci_dev *hdev)
1565{
1566 struct hci_request req;
1567 struct hci_conn *conn;
23a48093
JH		 1568 bool discov_stopped;
1569 int err;
8b064a3a
JH		 1570
1571 hci_req_init(&req, hdev);
1572
1573 if (test_bit(HCI_ISCAN, &hdev->flags) ||
1574 test_bit(HCI_PSCAN, &hdev->flags)) {
1575 u8 scan = 0x00;
1576 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1577 }
1578
5d900e46 1579 if (hdev->adv_instance_timeout)
912098a6
AU		 1580 clear_adv_instance(hdev);
1581
d7a5a11d 1582 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
8b064a3a
JH		 1583 disable_advertising(&req);
1584
23a48093 1585 discov_stopped = hci_stop_discovery(&req);
8b064a3a
JH		 1586
1587 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1588 struct hci_cp_disconnect dc;
c9910d0f
JH		 1589 struct hci_cp_reject_conn_req rej;
1590
1591 switch (conn->state) {
1592 case BT_CONNECTED:
1593 case BT_CONFIG:
1594 dc.handle = cpu_to_le16(conn->handle);
1595 dc.reason = 0x15; /* Terminated due to Power Off */
1596 hci_req_add(&req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1597 break;
1598 case BT_CONNECT:
1599 if (conn->type == LE_LINK)
1600 hci_req_add(&req, HCI_OP_LE_CREATE_CONN_CANCEL,
1601 0, NULL);
1602 else if (conn->type == ACL_LINK)
1603 hci_req_add(&req, HCI_OP_CREATE_CONN_CANCEL,
1604 6, &conn->dst);
1605 break;
1606 case BT_CONNECT2:
1607 bacpy(&rej.bdaddr, &conn->dst);
1608 rej.reason = 0x15; /* Terminated due to Power Off */
1609 if (conn->type == ACL_LINK)
1610 hci_req_add(&req, HCI_OP_REJECT_CONN_REQ,
1611 sizeof(rej), &rej);
1612 else if (conn->type == SCO_LINK)
1613 hci_req_add(&req, HCI_OP_REJECT_SYNC_CONN_REQ,
1614 sizeof(rej), &rej);
1615 break;
1616 }
8b064a3a
JH		 1617 }
1618
23a48093
JH		 1619 err = hci_req_run(&req, clean_up_hci_complete);
1620 if (!err && discov_stopped)
1621 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1622
1623 return err;
8b064a3a
JH		 1624}
1625
bdb6d971 1626static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1627 u16 len)
eec8d2bc 1628{
650f726d 1629 struct mgmt_mode *cp = data;
3b0602cd 1630 struct mgmt_pending_cmd *cmd;
4b34ee78 1631 int err;
eec8d2bc 1632
bdb6d971 1633 BT_DBG("request for %s", hdev->name);
eec8d2bc 1634
a7e80f25 1635 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 1636 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1637 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1638
09fd0de5 1639 hci_dev_lock(hdev);
eec8d2bc 1640
333ae95d 1641 if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
a69e8375
JH		 1642 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
1643 MGMT_STATUS_BUSY);
87b95ba6
JH		 1644 goto failed;
1645 }
1646
a69d8927 1647 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
f0d4b78a
MH		 1648 cancel_delayed_work(&hdev->power_off);
1649
1650 if (cp->val) {
a1d70450
JH		 1651 mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev,
1652 data, len);
1653 err = mgmt_powered(hdev, 1);
f0d4b78a
MH		 1654 goto failed;
1655 }
1656 }
1657
4b34ee78 1658 if (!!cp->val == hdev_is_powered(hdev)) {
69ab39ea 1659 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
eec8d2bc
JH		 1660 goto failed;
1661 }
1662
2e58ef3e 1663 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len);
366a0336
JH		 1664 if (!cmd) {
1665 err = -ENOMEM;
eec8d2bc 1666 goto failed;
366a0336 1667 }
eec8d2bc 1668
8b064a3a 1669 if (cp->val) {
19202573 1670 queue_work(hdev->req_workqueue, &hdev->power_on);
8b064a3a
JH		 1671 err = 0;
1672 } else {
1673 /* Disconnect connections, stop scans, etc */
1674 err = clean_up_hci_state(hdev);
a3172b7e
JH		 1675 if (!err)
1676 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1677 HCI_POWER_OFF_TIMEOUT);
eec8d2bc 1678
8b064a3a
JH		 1679 /* ENODATA means there were no HCI commands queued */
1680 if (err == -ENODATA) {
a3172b7e 1681 cancel_delayed_work(&hdev->power_off);
8b064a3a
JH		 1682 queue_work(hdev->req_workqueue, &hdev->power_off.work);
1683 err = 0;
1684 }
1685 }
eec8d2bc
JH		 1686
1687failed:
09fd0de5 1688 hci_dev_unlock(hdev);
366a0336 1689 return err;
eec8d2bc
JH		 1690}
1691
beadb2bd
JH		 1692static int new_settings(struct hci_dev *hdev, struct sock *skip)
1693{
f6b7712e 1694 __le32 ev = cpu_to_le32(get_current_settings(hdev));
beadb2bd 1695
f6b7712e
MH		 1696 return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
1697 sizeof(ev), skip);
beadb2bd
JH		 1698}
1699
91a668b0
JH		 1700int mgmt_new_settings(struct hci_dev *hdev)
1701{
1702 return new_settings(hdev, NULL);
1703}
1704
bd99abdd
JH		 1705struct cmd_lookup {
1706 struct sock *sk;
1707 struct hci_dev *hdev;
1708 u8 mgmt_status;
1709};
1710
3b0602cd 1711static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1712{
1713 struct cmd_lookup *match = data;
1714
1715 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
1716
1717 list_del(&cmd->list);
1718
1719 if (match->sk == NULL) {
1720 match->sk = cmd->sk;
1721 sock_hold(match->sk);
1722 }
1723
1724 mgmt_pending_free(cmd);
1725}
1726
3b0602cd 1727static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
bd99abdd
JH		 1728{
1729 u8 *status = data;
1730
a69e8375 1731 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
bd99abdd
JH		 1732 mgmt_pending_remove(cmd);
1733}
1734
3b0602cd 1735static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
1b9b5ee5
JH		 1736{
1737 if (cmd->cmd_complete) {
1738 u8 *status = data;
1739
1740 cmd->cmd_complete(cmd, *status);
1741 mgmt_pending_remove(cmd);
1742
1743 return;
1744 }
1745
1746 cmd_status_rsp(cmd, data);
1747}
1748
3b0602cd 1749static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
f5818c22 1750{
2a1afb5a
JH		 1751 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1752 cmd->param, cmd->param_len);
f5818c22
JH		 1753}
1754
3b0602cd 1755static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
7776d1d8 1756{
2a1afb5a
JH		 1757 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
1758 cmd->param, sizeof(struct mgmt_addr_info));
7776d1d8
JH		 1759}
1760
e6fe7986
JH		 1761static u8 mgmt_bredr_support(struct hci_dev *hdev)
1762{
1763 if (!lmp_bredr_capable(hdev))
1764 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1765 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
e6fe7986
JH		 1766 return MGMT_STATUS_REJECTED;
1767 else
1768 return MGMT_STATUS_SUCCESS;
1769}
1770
1771static u8 mgmt_le_support(struct hci_dev *hdev)
1772{
1773 if (!lmp_le_capable(hdev))
1774 return MGMT_STATUS_NOT_SUPPORTED;
d7a5a11d 1775 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
e6fe7986
JH		 1776 return MGMT_STATUS_REJECTED;
1777 else
1778 return MGMT_STATUS_SUCCESS;
1779}
1780
1904a853
MH		 1781static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
1782 u16 opcode)
bfaf8c9f 1783{
3b0602cd 1784 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1785 struct mgmt_mode *cp;
970ba524 1786 struct hci_request req;
bfaf8c9f
JH		 1787 bool changed;
1788
1789 BT_DBG("status 0x%02x", status);
1790
1791 hci_dev_lock(hdev);
1792
333ae95d 1793 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
bfaf8c9f
JH		 1794 if (!cmd)
1795 goto unlock;
1796
1797 if (status) {
1798 u8 mgmt_err = mgmt_status(status);
a69e8375 1799 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
a358dc11 1800 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
bfaf8c9f
JH		 1801 goto remove_cmd;
1802 }
1803
1804 cp = cmd->param;
d4462a07 1805 if (cp->val) {
238be788 1806 changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
d4462a07
MH		 1807
1808 if (hdev->discov_timeout > 0) {
1809 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
1810 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
1811 to);
1812 }
1813 } else {
a69d8927 1814 changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
d4462a07 1815 }
bfaf8c9f
JH		 1816
1817 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
1818
1819 if (changed)
1820 new_settings(hdev, cmd->sk);
1821
970ba524
MH		 1822 /* When the discoverable mode gets changed, make sure
1823 * that class of device has the limited discoverable
432df05e
JH		 1824 * bit correctly set. Also update page scan based on whitelist
1825 * entries.
970ba524
MH		 1826 */
1827 hci_req_init(&req, hdev);
1d2dc5b7 1828 __hci_update_page_scan(&req);
970ba524
MH		 1829 update_class(&req);
1830 hci_req_run(&req, NULL);
1831
bfaf8c9f
JH		 1832remove_cmd:
1833 mgmt_pending_remove(cmd);
1834
1835unlock:
1836 hci_dev_unlock(hdev);
1837}
1838
bdb6d971 1839static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 1840 u16 len)
73f22f62 1841{
650f726d 1842 struct mgmt_cp_set_discoverable *cp = data;
3b0602cd 1843 struct mgmt_pending_cmd *cmd;
bfaf8c9f 1844 struct hci_request req;
5e5282bb 1845 u16 timeout;
9a43e25f 1846 u8 scan;
73f22f62
JH		 1847 int err;
1848
bdb6d971 1849 BT_DBG("request for %s", hdev->name);
73f22f62 1850
d7a5a11d
MH		 1851 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
1852 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 1853 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1854 MGMT_STATUS_REJECTED);
33c525c0 1855
310a3d48 1856 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 1857 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1858 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 1859
1f350c87 1860 timeout = __le16_to_cpu(cp->timeout);
310a3d48
MH		 1861
1862 /* Disabling discoverable requires that no timeout is set,
1863 * and enabling limited discoverable requires a timeout.
1864 */
1865 if ((cp->val == 0x00 && timeout > 0) ||
1866 (cp->val == 0x02 && timeout == 0))
a69e8375
JH		 1867 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1868 MGMT_STATUS_INVALID_PARAMS);
73f22f62 1869
09fd0de5 1870 hci_dev_lock(hdev);
73f22f62 1871
5e5282bb 1872 if (!hdev_is_powered(hdev) && timeout > 0) {
a69e8375
JH		 1873 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1874 MGMT_STATUS_NOT_POWERED);
73f22f62
JH		 1875 goto failed;
1876 }
1877
333ae95d
JH		 1878 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
1879 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 1880 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1881 MGMT_STATUS_BUSY);
73f22f62
JH		 1882 goto failed;
1883 }
1884
d7a5a11d 1885 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
a69e8375
JH		 1886 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
1887 MGMT_STATUS_REJECTED);
5e5282bb
JH		 1888 goto failed;
1889 }
1890
1891 if (!hdev_is_powered(hdev)) {
0224d2fa
JH		 1892 bool changed = false;
1893
310a3d48
MH		 1894 /* Setting limited discoverable when powered off is
1895 * not a valid operation since it requires a timeout
1896 * and so no need to check HCI_LIMITED_DISCOVERABLE.
1897 */
d7a5a11d 1898 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
ce05d603 1899 hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
0224d2fa
JH		 1900 changed = true;
1901 }
1902
5e5282bb 1903 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
0224d2fa
JH		 1904 if (err < 0)
1905 goto failed;
1906
1907 if (changed)
1908 err = new_settings(hdev, sk);
1909
5e5282bb
JH		 1910 goto failed;
1911 }
1912
310a3d48
MH		 1913 /* If the current mode is the same, then just update the timeout
1914 * value with the new value. And if only the timeout gets updated,
1915 * then no need for any HCI transactions.
1916 */
d7a5a11d
MH		 1917 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
1918 (cp->val == 0x02) == hci_dev_test_flag(hdev,
1919 HCI_LIMITED_DISCOVERABLE)) {
36261547
MH		 1920 cancel_delayed_work(&hdev->discov_off);
1921 hdev->discov_timeout = timeout;
955638ec 1922
36261547
MH		 1923 if (cp->val && hdev->discov_timeout > 0) {
1924 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
955638ec 1925 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
36261547 1926 to);
955638ec
MH		 1927 }
1928
69ab39ea 1929 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
73f22f62
JH		 1930 goto failed;
1931 }
1932
2e58ef3e 1933 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len);
366a0336
JH		 1934 if (!cmd) {
1935 err = -ENOMEM;
73f22f62 1936 goto failed;
366a0336 1937 }
73f22f62 1938
310a3d48
MH		 1939 /* Cancel any potential discoverable timeout that might be
1940 * still active and store new timeout value. The arming of
1941 * the timeout happens in the complete handler.
1942 */
1943 cancel_delayed_work(&hdev->discov_off);
1944 hdev->discov_timeout = timeout;
1945
b456f87c
JH		 1946 /* Limited discoverable mode */
1947 if (cp->val == 0x02)
a1536da2 1948 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1949 else
a358dc11 1950 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
b456f87c 1951
bfaf8c9f
JH		 1952 hci_req_init(&req, hdev);
1953
9a43e25f
JH		 1954 /* The procedure for LE-only controllers is much simpler - just
1955 * update the advertising data.
1956 */
d7a5a11d 1957 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
9a43e25f
JH		 1958 goto update_ad;
1959
73f22f62
JH		 1960 scan = SCAN_PAGE;
1961
310a3d48
MH		 1962 if (cp->val) {
1963 struct hci_cp_write_current_iac_lap hci_cp;
1964
1965 if (cp->val == 0x02) {
1966 /* Limited discoverable mode */
33337dcb 1967 hci_cp.num_iac = min_t(u8, hdev->num_iac, 2);
310a3d48
MH		 1968 hci_cp.iac_lap[0] = 0x00; /* LIAC */
1969 hci_cp.iac_lap[1] = 0x8b;
1970 hci_cp.iac_lap[2] = 0x9e;
1971 hci_cp.iac_lap[3] = 0x33; /* GIAC */
1972 hci_cp.iac_lap[4] = 0x8b;
1973 hci_cp.iac_lap[5] = 0x9e;
1974 } else {
1975 /* General discoverable mode */
310a3d48
MH		 1976 hci_cp.num_iac = 1;
1977 hci_cp.iac_lap[0] = 0x33; /* GIAC */
1978 hci_cp.iac_lap[1] = 0x8b;
1979 hci_cp.iac_lap[2] = 0x9e;
1980 }
1981
1982 hci_req_add(&req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1983 (hci_cp.num_iac * 3) + 1, &hci_cp);
1984
73f22f62 1985 scan |= SCAN_INQUIRY;
310a3d48 1986 } else {
a358dc11 1987 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
310a3d48 1988 }
73f22f62 1989
310a3d48 1990 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
bfaf8c9f 1991
9a43e25f
JH		 1992update_ad:
1993 update_adv_data(&req);
1994
bfaf8c9f 1995 err = hci_req_run(&req, set_discoverable_complete);
73f22f62 1996 if (err < 0)
a664b5bc 1997 mgmt_pending_remove(cmd);
73f22f62
JH		 1998
1999failed:
09fd0de5 2000 hci_dev_unlock(hdev);
73f22f62
JH		 2001 return err;
2002}
2003
406d7804
JH		 2004static void write_fast_connectable(struct hci_request *req, bool enable)
2005{
bd98b996 2006 struct hci_dev *hdev = req->hdev;
406d7804
JH		 2007 struct hci_cp_write_page_scan_activity acp;
2008 u8 type;
2009
d7a5a11d 2010 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
547003b1
JH		 2011 return;
2012
4c01f8b8
JH		 2013 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
2014 return;
2015
406d7804
JH		 2016 if (enable) {
2017 type = PAGE_SCAN_TYPE_INTERLACED;
2018
2019 /* 160 msec page scan interval */
dcf4adbf 2020 acp.interval = cpu_to_le16(0x0100);
406d7804
JH		 2021 } else {
2022 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2023
2024 /* default 1.28 sec page scan */
dcf4adbf 2025 acp.interval = cpu_to_le16(0x0800);
406d7804
JH		 2026 }
2027
dcf4adbf 2028 acp.window = cpu_to_le16(0x0012);
406d7804 2029
bd98b996
JH		 2030 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
2031 __cpu_to_le16(hdev->page_scan_window) != acp.window)
2032 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
2033 sizeof(acp), &acp);
2034
2035 if (hdev->page_scan_type != type)
2036 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
406d7804
JH		 2037}
2038
1904a853
MH		 2039static void set_connectable_complete(struct hci_dev *hdev, u8 status,
2040 u16 opcode)
2b76f453 2041{
3b0602cd 2042 struct mgmt_pending_cmd *cmd;
d7b856f9 2043 struct mgmt_mode *cp;
bc6d2d04 2044 bool conn_changed, discov_changed;
2b76f453
JH		 2045
2046 BT_DBG("status 0x%02x", status);
2047
2048 hci_dev_lock(hdev);
2049
333ae95d 2050 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
2b76f453
JH		 2051 if (!cmd)
2052 goto unlock;
2053
37438c1f
JH		 2054 if (status) {
2055 u8 mgmt_err = mgmt_status(status);
a69e8375 2056 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
37438c1f
JH		 2057 goto remove_cmd;
2058 }
2059
d7b856f9 2060 cp = cmd->param;
bc6d2d04 2061 if (cp->val) {
238be788
MH		 2062 conn_changed = !hci_dev_test_and_set_flag(hdev,
2063 HCI_CONNECTABLE);
bc6d2d04
JH		 2064 discov_changed = false;
2065 } else {
a69d8927
MH		 2066 conn_changed = hci_dev_test_and_clear_flag(hdev,
2067 HCI_CONNECTABLE);
2068 discov_changed = hci_dev_test_and_clear_flag(hdev,
2069 HCI_DISCOVERABLE);
bc6d2d04 2070 }
d7b856f9 2071
2b76f453
JH		 2072 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
2073
bc6d2d04 2074 if (conn_changed || discov_changed) {
d7b856f9 2075 new_settings(hdev, cmd->sk);
1d2dc5b7 2076 hci_update_page_scan(hdev);
bc6d2d04
JH		 2077 if (discov_changed)
2078 mgmt_update_adv_data(hdev);
2b7be33e
JH		 2079 hci_update_background_scan(hdev);
2080 }
d7b856f9 2081
37438c1f 2082remove_cmd:
2b76f453
JH		 2083 mgmt_pending_remove(cmd);
2084
2085unlock:
2086 hci_dev_unlock(hdev);
2087}
2088
e8ba3a1f
JH		 2089static int set_connectable_update_settings(struct hci_dev *hdev,
2090 struct sock *sk, u8 val)
2091{
2092 bool changed = false;
2093 int err;
2094
d7a5a11d 2095 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
e8ba3a1f
JH		 2096 changed = true;
2097
2098 if (val) {
a1536da2 2099 hci_dev_set_flag(hdev, HCI_CONNECTABLE);
e8ba3a1f 2100 } else {
a358dc11
MH		 2101 hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
2102 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
e8ba3a1f
JH		 2103 }
2104
2105 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
2106 if (err < 0)
2107 return err;
2108
562064e6 2109 if (changed) {
1d2dc5b7 2110 hci_update_page_scan(hdev);
562064e6 2111 hci_update_background_scan(hdev);
e8ba3a1f 2112 return new_settings(hdev, sk);
562064e6 2113 }
e8ba3a1f
JH		 2114
2115 return 0;
2116}
2117
bdb6d971 2118static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2119 u16 len)
9fbcbb45 2120{
650f726d 2121 struct mgmt_mode *cp = data;
3b0602cd 2122 struct mgmt_pending_cmd *cmd;
2b76f453 2123 struct hci_request req;
1987fdc7 2124 u8 scan;
9fbcbb45
JH		 2125 int err;
2126
bdb6d971 2127 BT_DBG("request for %s", hdev->name);
9fbcbb45 2128
d7a5a11d
MH		 2129 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2130 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
a69e8375
JH		 2131 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2132 MGMT_STATUS_REJECTED);
33c525c0 2133
a7e80f25 2134 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2135 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2136 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2137
09fd0de5 2138 hci_dev_lock(hdev);
9fbcbb45 2139
4b34ee78 2140 if (!hdev_is_powered(hdev)) {
e8ba3a1f 2141 err = set_connectable_update_settings(hdev, sk, cp->val);
9fbcbb45
JH		 2142 goto failed;
2143 }
2144
333ae95d
JH		 2145 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
2146 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
a69e8375
JH		 2147 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
2148 MGMT_STATUS_BUSY);
9fbcbb45
JH		 2149 goto failed;
2150 }
2151
2e58ef3e 2152 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len);
366a0336
JH		 2153 if (!cmd) {
2154 err = -ENOMEM;
9fbcbb45 2155 goto failed;
366a0336 2156 }
9fbcbb45 2157
9b74246f 2158 hci_req_init(&req, hdev);
9fbcbb45 2159
9a43e25f
JH		 2160 /* If BR/EDR is not enabled and we disable advertising as a
2161 * by-product of disabling connectable, we need to update the
2162 * advertising flags.
2163 */
d7a5a11d 2164 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
9a43e25f 2165 if (!cp->val) {
a358dc11
MH		 2166 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2167 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
9a43e25f
JH		 2168 }
2169 update_adv_data(&req);
2170 } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
9b74246f
JH		 2171 if (cp->val) {
2172 scan = SCAN_PAGE;
2173 } else {
3bd27240
JH		 2174 /* If we don't have any whitelist entries just
2175 * disable all scanning. If there are entries
2176 * and we had both page and inquiry scanning
2177 * enabled then fall back to only page scanning.
2178 * Otherwise no changes are needed.
2179 */
2180 if (list_empty(&hdev->whitelist))
2181 scan = SCAN_DISABLED;
2182 else if (test_bit(HCI_ISCAN, &hdev->flags))
2183 scan = SCAN_PAGE;
2184 else
2185 goto no_scan_update;
9b74246f
JH		 2186
2187 if (test_bit(HCI_ISCAN, &hdev->flags) &&
8d6083fe 2188 hdev->discov_timeout > 0)
9b74246f
JH		 2189 cancel_delayed_work(&hdev->discov_off);
2190 }
2b76f453 2191
9b74246f
JH		 2192 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2193 }
2b76f453 2194
3bd27240 2195no_scan_update:
e8b1202c 2196 /* Update the advertising parameters if necessary */
880897d4
AU		 2197 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2198 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
1987fdc7 2199 enable_advertising(&req);
1987fdc7 2200
2b76f453 2201 err = hci_req_run(&req, set_connectable_complete);
9b74246f 2202 if (err < 0) {
a664b5bc 2203 mgmt_pending_remove(cmd);
9b74246f 2204 if (err == -ENODATA)
a81070ba
JH		 2205 err = set_connectable_update_settings(hdev, sk,
2206 cp->val);
9b74246f
JH		 2207 goto failed;
2208 }
9fbcbb45
JH		 2209
2210failed:
09fd0de5 2211 hci_dev_unlock(hdev);
9fbcbb45
JH		 2212 return err;
2213}
2214
b2939475 2215static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2216 u16 len)
c542a06c 2217{
650f726d 2218 struct mgmt_mode *cp = data;
55594356 2219 bool changed;
c542a06c
JH		 2220 int err;
2221
bdb6d971 2222 BT_DBG("request for %s", hdev->name);
c542a06c 2223
a7e80f25 2224 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2225 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
2226 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2227
09fd0de5 2228 hci_dev_lock(hdev);
c542a06c
JH		 2229
2230 if (cp->val)
238be788 2231 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
c542a06c 2232 else
a69d8927 2233 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
c542a06c 2234
b2939475 2235 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
c542a06c 2236 if (err < 0)
55594356 2237 goto unlock;
c542a06c 2238
55594356
MH		 2239 if (changed)
2240 err = new_settings(hdev, sk);
c542a06c 2241
55594356 2242unlock:
09fd0de5 2243 hci_dev_unlock(hdev);
c542a06c
JH		 2244 return err;
2245}
2246
04124681
GP		 2247static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
2248 u16 len)
33ef95ed
JH		 2249{
2250 struct mgmt_mode *cp = data;
3b0602cd 2251 struct mgmt_pending_cmd *cmd;
e6fe7986 2252 u8 val, status;
33ef95ed
JH		 2253 int err;
2254
bdb6d971 2255 BT_DBG("request for %s", hdev->name);
33ef95ed 2256
e6fe7986
JH		 2257 status = mgmt_bredr_support(hdev);
2258 if (status)
a69e8375
JH		 2259 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2260 status);
33c525c0 2261
a7e80f25 2262 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2263 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2264 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2265
33ef95ed
JH		 2266 hci_dev_lock(hdev);
2267
4b34ee78 2268 if (!hdev_is_powered(hdev)) {
47990ea0
JH		 2269 bool changed = false;
2270
d7a5a11d 2271 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
ce05d603 2272 hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
47990ea0
JH		 2273 changed = true;
2274 }
2275
2276 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2277 if (err < 0)
2278 goto failed;
2279
2280 if (changed)
2281 err = new_settings(hdev, sk);
2282
33ef95ed
JH		 2283 goto failed;
2284 }
2285
333ae95d 2286 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
a69e8375
JH		 2287 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
2288 MGMT_STATUS_BUSY);
33ef95ed
JH		 2289 goto failed;
2290 }
2291
2292 val = !!cp->val;
2293
2294 if (test_bit(HCI_AUTH, &hdev->flags) == val) {
2295 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
2296 goto failed;
2297 }
2298
2299 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
2300 if (!cmd) {
2301 err = -ENOMEM;
2302 goto failed;
2303 }
2304
2305 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
2306 if (err < 0) {
2307 mgmt_pending_remove(cmd);
2308 goto failed;
2309 }
2310
2311failed:
2312 hci_dev_unlock(hdev);
33ef95ed
JH		 2313 return err;
2314}
2315
bdb6d971 2316static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
ed2c4ee3
JH		 2317{
2318 struct mgmt_mode *cp = data;
3b0602cd 2319 struct mgmt_pending_cmd *cmd;
72ef0c1a 2320 u8 status;
ed2c4ee3
JH		 2321 int err;
2322
bdb6d971 2323 BT_DBG("request for %s", hdev->name);
ed2c4ee3 2324
cdba5281
MH		 2325 status = mgmt_bredr_support(hdev);
2326 if (status)
a69e8375 2327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
cdba5281 2328
13ecd8b6 2329 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2330 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2331 MGMT_STATUS_NOT_SUPPORTED);
ed2c4ee3 2332
a7e80f25 2333 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2334 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2335 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2336
13ecd8b6 2337 hci_dev_lock(hdev);
6c8f12c1 2338
4b34ee78 2339 if (!hdev_is_powered(hdev)) {
9ecb3e24 2340 bool changed;
c0ecddc2 2341
9ecb3e24 2342 if (cp->val) {
238be788
MH		 2343 changed = !hci_dev_test_and_set_flag(hdev,
2344 HCI_SSP_ENABLED);
9ecb3e24 2345 } else {
a69d8927
MH		 2346 changed = hci_dev_test_and_clear_flag(hdev,
2347 HCI_SSP_ENABLED);
9ecb3e24 2348 if (!changed)
a69d8927
MH		 2349 changed = hci_dev_test_and_clear_flag(hdev,
2350 HCI_HS_ENABLED);
9ecb3e24 2351 else
a358dc11 2352 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
c0ecddc2
JH		 2353 }
2354
2355 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2356 if (err < 0)
2357 goto failed;
2358
2359 if (changed)
2360 err = new_settings(hdev, sk);
2361
ed2c4ee3
JH		 2362 goto failed;
2363 }
2364
333ae95d 2365 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
2367 MGMT_STATUS_BUSY);
ed2c4ee3
JH		 2368 goto failed;
2369 }
2370
d7a5a11d 2371 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
ed2c4ee3
JH		 2372 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
2373 goto failed;
2374 }
2375
2376 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
2377 if (!cmd) {
2378 err = -ENOMEM;
2379 goto failed;
2380 }
2381
d7a5a11d 2382 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 2383 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2384 sizeof(cp->val), &cp->val);
2385
72ef0c1a 2386 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val);
ed2c4ee3
JH		 2387 if (err < 0) {
2388 mgmt_pending_remove(cmd);
2389 goto failed;
2390 }
2391
2392failed:
2393 hci_dev_unlock(hdev);
ed2c4ee3
JH		 2394 return err;
2395}
2396
bdb6d971 2397static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
6d80dfd0
JH		 2398{
2399 struct mgmt_mode *cp = data;
ee392693 2400 bool changed;
e6fe7986 2401 u8 status;
ee392693 2402 int err;
6d80dfd0 2403
bdb6d971 2404 BT_DBG("request for %s", hdev->name);
6d80dfd0 2405
e6fe7986
JH		 2406 status = mgmt_bredr_support(hdev);
2407 if (status)
a69e8375 2408 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
6d80dfd0 2409
9ecb3e24 2410 if (!lmp_ssp_capable(hdev))
a69e8375
JH		 2411 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2412 MGMT_STATUS_NOT_SUPPORTED);
9ecb3e24 2413
d7a5a11d 2414 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 2415 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2416 MGMT_STATUS_REJECTED);
9ecb3e24 2417
a7e80f25 2418 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2419 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2420 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2421
ee392693
MH		 2422 hci_dev_lock(hdev);
2423
333ae95d 2424 if (pending_find(MGMT_OP_SET_SSP, hdev)) {
a69e8375
JH		 2425 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2426 MGMT_STATUS_BUSY);
a2cb01de
JH		 2427 goto unlock;
2428 }
2429
a0cdf960 2430 if (cp->val) {
238be788 2431 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
a0cdf960
MH		 2432 } else {
2433 if (hdev_is_powered(hdev)) {
a69e8375
JH		 2434 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
2435 MGMT_STATUS_REJECTED);
a0cdf960
MH		 2436 goto unlock;
2437 }
2438
a69d8927 2439 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
a0cdf960 2440 }
ee392693
MH		 2441
2442 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
2443 if (err < 0)
2444 goto unlock;
2445
2446 if (changed)
2447 err = new_settings(hdev, sk);
6d80dfd0 2448
ee392693
MH		 2449unlock:
2450 hci_dev_unlock(hdev);
2451 return err;
6d80dfd0
JH		 2452}
2453
1904a853 2454static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
416a4ae5
JH		 2455{
2456 struct cmd_lookup match = { NULL, hdev };
2457
3ad67582
JK		 2458 hci_dev_lock(hdev);
2459
416a4ae5
JH		 2460 if (status) {
2461 u8 mgmt_err = mgmt_status(status);
2462
2463 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
2464 &mgmt_err);
3ad67582 2465 goto unlock;
416a4ae5
JH		 2466 }
2467
2468 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
2469
2470 new_settings(hdev, match.sk);
2471
2472 if (match.sk)
2473 sock_put(match.sk);
441ad2d0
MH		 2474
2475 /* Make sure the controller has a good default for
2476 * advertising data. Restrict the update to when LE
2477 * has actually been enabled. During power on, the
2478 * update in powered_update_hci will take care of it.
2479 */
d7a5a11d 2480 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
441ad2d0
MH		 2481 struct hci_request req;
2482
441ad2d0 2483 hci_req_init(&req, hdev);
5947f4bc 2484 update_adv_data(&req);
f14d8f64 2485 update_scan_rsp_data(&req);
2cf22218 2486 __hci_update_background_scan(&req);
441ad2d0 2487 hci_req_run(&req, NULL);
441ad2d0 2488 }
3ad67582
JK		 2489
2490unlock:
2491 hci_dev_unlock(hdev);
416a4ae5
JH		 2492}
2493
bdb6d971 2494static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
06199cf8
JH		 2495{
2496 struct mgmt_mode *cp = data;
2497 struct hci_cp_write_le_host_supported hci_cp;
3b0602cd 2498 struct mgmt_pending_cmd *cmd;
416a4ae5 2499 struct hci_request req;
06199cf8 2500 int err;
0b60eba1 2501 u8 val, enabled;
06199cf8 2502
bdb6d971 2503 BT_DBG("request for %s", hdev->name);
06199cf8 2504
13ecd8b6 2505 if (!lmp_le_capable(hdev))
a69e8375
JH		 2506 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2507 MGMT_STATUS_NOT_SUPPORTED);
1de028ce 2508
a7e80f25 2509 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 2510 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2511 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 2512
e7844ee5
MH		 2513 /* Bluetooth single mode LE only controllers or dual-mode
2514 * controllers configured as LE only devices, do not allow
2515 * switching LE off. These have either LE enabled explicitly
2516 * or BR/EDR has been previously switched off.
2517 *
2518 * When trying to enable an already enabled LE, then gracefully
2519 * send a positive response. Trying to disable it however will
2520 * result into rejection.
2521 */
2522 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2523 if (cp->val == 0x01)
2524 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2525
a69e8375
JH		 2526 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2527 MGMT_STATUS_REJECTED);
e7844ee5 2528 }
c73eee91 2529
13ecd8b6 2530 hci_dev_lock(hdev);
06199cf8
JH		 2531
2532 val = !!cp->val;
ffa88e02 2533 enabled = lmp_host_le_capable(hdev);
06199cf8 2534
0b60eba1 2535 if (!hdev_is_powered(hdev) || val == enabled) {
06199cf8
JH		 2536 bool changed = false;
2537
d7a5a11d 2538 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
ce05d603 2539 hci_dev_change_flag(hdev, HCI_LE_ENABLED);
06199cf8
JH		 2540 changed = true;
2541 }
2542
d7a5a11d 2543 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
a358dc11 2544 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
eeca6f89
JH		 2545 changed = true;
2546 }
2547
06199cf8
JH		 2548 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
2549 if (err < 0)
1de028ce 2550 goto unlock;
06199cf8
JH		 2551
2552 if (changed)
2553 err = new_settings(hdev, sk);
2554
1de028ce 2555 goto unlock;
06199cf8
JH		 2556 }
2557
333ae95d
JH		 2558 if (pending_find(MGMT_OP_SET_LE, hdev) ||
2559 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
a69e8375
JH		 2560 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
2561 MGMT_STATUS_BUSY);
1de028ce 2562 goto unlock;
06199cf8
JH		 2563 }
2564
2565 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len);
2566 if (!cmd) {
2567 err = -ENOMEM;
1de028ce 2568 goto unlock;
06199cf8
JH		 2569 }
2570
441ad2d0
MH		 2571 hci_req_init(&req, hdev);
2572
06199cf8
JH		 2573 memset(&hci_cp, 0, sizeof(hci_cp));
2574
2575 if (val) {
2576 hci_cp.le = val;
32226e4f 2577 hci_cp.simul = 0x00;
441ad2d0 2578 } else {
d7a5a11d 2579 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
441ad2d0 2580 disable_advertising(&req);
06199cf8
JH		 2581 }
2582
416a4ae5
JH		 2583 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp),
2584 &hci_cp);
2585
2586 err = hci_req_run(&req, le_enable_complete);
0c01bc48 2587 if (err < 0)
06199cf8 2588 mgmt_pending_remove(cmd);
06199cf8 2589
1de028ce
JH		 2590unlock:
2591 hci_dev_unlock(hdev);
06199cf8
JH		 2592 return err;
2593}
2594
0cab9c80
JH		 2595/* This is a helper function to test for pending mgmt commands that can
2596 * cause CoD or EIR HCI commands. We can only allow one such pending
2597 * mgmt command at a time since otherwise we cannot easily track what
2598 * the current values are, will be, and based on that calculate if a new
2599 * HCI command needs to be sent and if yes with what value.
2600 */
2601static bool pending_eir_or_class(struct hci_dev *hdev)
2602{
3b0602cd 2603 struct mgmt_pending_cmd *cmd;
0cab9c80
JH		 2604
2605 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
2606 switch (cmd->opcode) {
2607 case MGMT_OP_ADD_UUID:
2608 case MGMT_OP_REMOVE_UUID:
2609 case MGMT_OP_SET_DEV_CLASS:
2610 case MGMT_OP_SET_POWERED:
2611 return true;
2612 }
2613 }
2614
2615 return false;
2616}
2617
83be8eca
JH		 2618static const u8 bluetooth_base_uuid[] = {
2619 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80,
2620 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
2621};
2622
2623static u8 get_uuid_size(const u8 *uuid)
2624{
2625 u32 val;
2626
2627 if (memcmp(uuid, bluetooth_base_uuid, 12))
2628 return 128;
2629
2630 val = get_unaligned_le32(&uuid[12]);
2631 if (val > 0xffff)
2632 return 32;
2633
2634 return 16;
2635}
2636
92da6097
JH		 2637static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
2638{
3b0602cd 2639 struct mgmt_pending_cmd *cmd;
92da6097
JH		 2640
2641 hci_dev_lock(hdev);
2642
333ae95d 2643 cmd = pending_find(mgmt_op, hdev);
92da6097
JH		 2644 if (!cmd)
2645 goto unlock;
2646
2a1afb5a
JH		 2647 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
2648 mgmt_status(status), hdev->dev_class, 3);
92da6097
JH		 2649
2650 mgmt_pending_remove(cmd);
2651
2652unlock:
2653 hci_dev_unlock(hdev);
2654}
2655
1904a853 2656static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2657{
2658 BT_DBG("status 0x%02x", status);
2659
2660 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status);
2661}
2662
bdb6d971 2663static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
2aeb9a1a 2664{
650f726d 2665 struct mgmt_cp_add_uuid *cp = data;
3b0602cd 2666 struct mgmt_pending_cmd *cmd;
890ea898 2667 struct hci_request req;
2aeb9a1a 2668 struct bt_uuid *uuid;
2aeb9a1a
JH		 2669 int err;
2670
bdb6d971 2671 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2672
09fd0de5 2673 hci_dev_lock(hdev);
2aeb9a1a 2674
0cab9c80 2675 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
2677 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2678 goto failed;
2679 }
2680
92c4c204 2681 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL);
2aeb9a1a
JH		 2682 if (!uuid) {
2683 err = -ENOMEM;
2684 goto failed;
2685 }
2686
2687 memcpy(uuid->uuid, cp->uuid, 16);
1aff6f09 2688 uuid->svc_hint = cp->svc_hint;
83be8eca 2689 uuid->size = get_uuid_size(cp->uuid);
2aeb9a1a 2690
de66aa63 2691 list_add_tail(&uuid->list, &hdev->uuids);
2aeb9a1a 2692
890ea898 2693 hci_req_init(&req, hdev);
1aff6f09 2694
890ea898
JH		 2695 update_class(&req);
2696 update_eir(&req);
2697
92da6097
JH		 2698 err = hci_req_run(&req, add_uuid_complete);
2699 if (err < 0) {
2700 if (err != -ENODATA)
2701 goto failed;
80a1e1db 2702
2a1afb5a
JH		 2703 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
2704 hdev->dev_class, 3);
90e70454
JH		 2705 goto failed;
2706 }
2707
2708 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len);
890ea898 2709 if (!cmd) {
90e70454 2710 err = -ENOMEM;
890ea898
JH		 2711 goto failed;
2712 }
2713
2714 err = 0;
2aeb9a1a
JH		 2715
2716failed:
09fd0de5 2717 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2718 return err;
2719}
2720
24b78d0f
JH		 2721static bool enable_service_cache(struct hci_dev *hdev)
2722{
2723 if (!hdev_is_powered(hdev))
2724 return false;
2725
238be788 2726 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
46818ed5
JH		 2727 queue_delayed_work(hdev->workqueue, &hdev->service_cache,
2728 CACHE_TIMEOUT);
24b78d0f
JH		 2729 return true;
2730 }
2731
2732 return false;
2733}
2734
1904a853 2735static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2736{
2737 BT_DBG("status 0x%02x", status);
2738
2739 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status);
2740}
2741
bdb6d971 2742static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2743 u16 len)
2aeb9a1a 2744{
650f726d 2745 struct mgmt_cp_remove_uuid *cp = data;
3b0602cd 2746 struct mgmt_pending_cmd *cmd;
056341c8 2747 struct bt_uuid *match, *tmp;
2aeb9a1a 2748 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
890ea898 2749 struct hci_request req;
2aeb9a1a
JH		 2750 int err, found;
2751
bdb6d971 2752 BT_DBG("request for %s", hdev->name);
2aeb9a1a 2753
09fd0de5 2754 hci_dev_lock(hdev);
2aeb9a1a 2755
0cab9c80 2756 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2757 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2758 MGMT_STATUS_BUSY);
c95f0ba7
JH		 2759 goto unlock;
2760 }
2761
2aeb9a1a 2762 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
35f7498a 2763 hci_uuids_clear(hdev);
4004b6d9 2764
24b78d0f 2765 if (enable_service_cache(hdev)) {
2a1afb5a
JH		 2766 err = mgmt_cmd_complete(sk, hdev->id,
2767 MGMT_OP_REMOVE_UUID,
2768 0, hdev->dev_class, 3);
24b78d0f
JH		 2769 goto unlock;
2770 }
4004b6d9 2771
9246a869 2772 goto update_class;
2aeb9a1a
JH		 2773 }
2774
2775 found = 0;
2776
056341c8 2777 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) {
2aeb9a1a
JH		 2778 if (memcmp(match->uuid, cp->uuid, 16) != 0)
2779 continue;
2780
2781 list_del(&match->list);
482049f7 2782 kfree(match);
2aeb9a1a
JH		 2783 found++;
2784 }
2785
2786 if (found == 0) {
a69e8375
JH		 2787 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
2788 MGMT_STATUS_INVALID_PARAMS);
2aeb9a1a
JH		 2789 goto unlock;
2790 }
2791
9246a869 2792update_class:
890ea898 2793 hci_req_init(&req, hdev);
1aff6f09 2794
890ea898
JH		 2795 update_class(&req);
2796 update_eir(&req);
2797
92da6097
JH		 2798 err = hci_req_run(&req, remove_uuid_complete);
2799 if (err < 0) {
2800 if (err != -ENODATA)
2801 goto unlock;
80a1e1db 2802
2a1afb5a
JH		 2803 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
2804 hdev->dev_class, 3);
90e70454
JH		 2805 goto unlock;
2806 }
2807
2808 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len);
890ea898 2809 if (!cmd) {
90e70454 2810 err = -ENOMEM;
890ea898
JH		 2811 goto unlock;
2812 }
2813
2814 err = 0;
2aeb9a1a
JH		 2815
2816unlock:
09fd0de5 2817 hci_dev_unlock(hdev);
2aeb9a1a
JH		 2818 return err;
2819}
2820
1904a853 2821static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode)
92da6097
JH		 2822{
2823 BT_DBG("status 0x%02x", status);
2824
2825 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status);
2826}
2827
bdb6d971 2828static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2829 u16 len)
1aff6f09 2830{
650f726d 2831 struct mgmt_cp_set_dev_class *cp = data;
3b0602cd 2832 struct mgmt_pending_cmd *cmd;
890ea898 2833 struct hci_request req;
1aff6f09
JH		 2834 int err;
2835
bdb6d971 2836 BT_DBG("request for %s", hdev->name);
1aff6f09 2837
6203fc98 2838 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2839 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2840 MGMT_STATUS_NOT_SUPPORTED);
1aff6f09 2841
0cab9c80 2842 hci_dev_lock(hdev);
ee98f473 2843
0cab9c80 2844 if (pending_eir_or_class(hdev)) {
a69e8375
JH		 2845 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2846 MGMT_STATUS_BUSY);
0cab9c80
JH		 2847 goto unlock;
2848 }
c95f0ba7 2849
0cab9c80 2850 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
a69e8375
JH		 2851 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
2852 MGMT_STATUS_INVALID_PARAMS);
0cab9c80
JH		 2853 goto unlock;
2854 }
575b3a02 2855
932f5ff5
JH		 2856 hdev->major_class = cp->major;
2857 hdev->minor_class = cp->minor;
2858
b5235a65 2859 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 2860 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2861 hdev->dev_class, 3);
b5235a65
JH		 2862 goto unlock;
2863 }
2864
890ea898
JH		 2865 hci_req_init(&req, hdev);
2866
a69d8927 2867 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
7d78525d
JH		 2868 hci_dev_unlock(hdev);
2869 cancel_delayed_work_sync(&hdev->service_cache);
2870 hci_dev_lock(hdev);
890ea898 2871 update_eir(&req);
7d78525d 2872 }
14c0b608 2873
890ea898
JH		 2874 update_class(&req);
2875
92da6097
JH		 2876 err = hci_req_run(&req, set_class_complete);
2877 if (err < 0) {
2878 if (err != -ENODATA)
2879 goto unlock;
1aff6f09 2880
2a1afb5a
JH		 2881 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
2882 hdev->dev_class, 3);
90e70454
JH		 2883 goto unlock;
2884 }
2885
2886 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len);
890ea898 2887 if (!cmd) {
90e70454 2888 err = -ENOMEM;
890ea898
JH		 2889 goto unlock;
2890 }
2891
2892 err = 0;
1aff6f09 2893
b5235a65 2894unlock:
09fd0de5 2895 hci_dev_unlock(hdev);
1aff6f09
JH		 2896 return err;
2897}
2898
bdb6d971 2899static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
8ce8e2b5 2900 u16 len)
55ed8ca1 2901{
650f726d 2902 struct mgmt_cp_load_link_keys *cp = data;
ba1d6936
JH		 2903 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
2904 sizeof(struct mgmt_link_key_info));
4e51eae9 2905 u16 key_count, expected_len;
b1de97d8 2906 bool changed;
a492cd52 2907 int i;
55ed8ca1 2908
9060d5cf
MH		 2909 BT_DBG("request for %s", hdev->name);
2910
2911 if (!lmp_bredr_capable(hdev))
a69e8375
JH		 2912 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2913 MGMT_STATUS_NOT_SUPPORTED);
9060d5cf 2914
1f350c87 2915 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 2916 if (key_count > max_key_count) {
2917 BT_ERR("load_link_keys: too big key_count value %u",
2918 key_count);
a69e8375
JH		 2919 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2920 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 2921 }
55ed8ca1 2922
86742e1e
JH		 2923 expected_len = sizeof(*cp) + key_count *
2924 sizeof(struct mgmt_link_key_info);
a492cd52 2925 if (expected_len != len) {
86742e1e 2926 BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
2606ecbc 2927 expected_len, len);
a69e8375
JH		 2928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2929 MGMT_STATUS_INVALID_PARAMS);
55ed8ca1
JH		 2930 }
2931
4ae14301 2932 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
a69e8375
JH		 2933 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
2934 MGMT_STATUS_INVALID_PARAMS);
4ae14301 2935
bdb6d971 2936 BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
8ce8e2b5 2937 key_count);
55ed8ca1 2938
4ee71b20
JH		 2939 for (i = 0; i < key_count; i++) {
2940 struct mgmt_link_key_info *key = &cp->keys[i];
2941
8e991132 2942 if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
a69e8375
JH		 2943 return mgmt_cmd_status(sk, hdev->id,
2944 MGMT_OP_LOAD_LINK_KEYS,
2945 MGMT_STATUS_INVALID_PARAMS);
4ee71b20
JH		 2946 }
2947
09fd0de5 2948 hci_dev_lock(hdev);
55ed8ca1
JH		 2949
2950 hci_link_keys_clear(hdev);
2951
55ed8ca1 2952 if (cp->debug_keys)
238be788 2953 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
55ed8ca1 2954 else
a69d8927
MH		 2955 changed = hci_dev_test_and_clear_flag(hdev,
2956 HCI_KEEP_DEBUG_KEYS);
b1de97d8
MH		 2957
2958 if (changed)
2959 new_settings(hdev, NULL);
55ed8ca1 2960
a492cd52 2961 for (i = 0; i < key_count; i++) {
86742e1e 2962 struct mgmt_link_key_info *key = &cp->keys[i];
55ed8ca1 2963
58e9293c
JH		 2964 /* Always ignore debug keys and require a new pairing if
2965 * the user wants to use them.
2966 */
2967 if (key->type == HCI_LK_DEBUG_COMBINATION)
2968 continue;
2969
7652ff6a
JH		 2970 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val,
2971 key->type, key->pin_len, NULL);
55ed8ca1
JH		 2972 }
2973
2a1afb5a 2974 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
0e5f875a 2975
09fd0de5 2976 hci_dev_unlock(hdev);
55ed8ca1 2977
a492cd52 2978 return 0;
55ed8ca1
JH		 2979}
2980
b1078ad0 2981static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2982 u8 addr_type, struct sock *skip_sk)
b1078ad0
JH		 2983{
2984 struct mgmt_ev_device_unpaired ev;
2985
2986 bacpy(&ev.addr.bdaddr, bdaddr);
2987 ev.addr.type = addr_type;
2988
2989 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
04124681 2990 skip_sk);
b1078ad0
JH		 2991}
2992
bdb6d971 2993static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 2994 u16 len)
55ed8ca1 2995{
124f6e35
JH		 2996 struct mgmt_cp_unpair_device *cp = data;
2997 struct mgmt_rp_unpair_device rp;
a8a1d19e 2998 struct hci_cp_disconnect dc;
3b0602cd 2999 struct mgmt_pending_cmd *cmd;
55ed8ca1 3000 struct hci_conn *conn;
55ed8ca1
JH		 3001 int err;
3002
a8a1d19e 3003 memset(&rp, 0, sizeof(rp));
124f6e35
JH		 3004 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3005 rp.addr.type = cp->addr.type;
a8a1d19e 3006
4ee71b20 3007 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3008 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3009 MGMT_STATUS_INVALID_PARAMS,
3010 &rp, sizeof(rp));
4ee71b20 3011
118da70b 3012 if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
2a1afb5a
JH		 3013 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3014 MGMT_STATUS_INVALID_PARAMS,
3015 &rp, sizeof(rp));
118da70b 3016
4ee71b20
JH		 3017 hci_dev_lock(hdev);
3018
86a8cfc6 3019 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3020 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3021 MGMT_STATUS_NOT_POWERED, &rp,
3022 sizeof(rp));
86a8cfc6
JH		 3023 goto unlock;
3024 }
3025
e0b2b27e 3026 if (cp->addr.type == BDADDR_BREDR) {
89cbb063
AA		 3027 /* If disconnection is requested, then look up the
3028 * connection. If the remote device is connected, it
3029 * will be later used to terminate the link.
3030 *
3031 * Setting it to NULL explicitly will cause no
3032 * termination of the link.
3033 */
3034 if (cp->disconnect)
3035 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3036 &cp->addr.bdaddr);
3037 else
3038 conn = NULL;
3039
124f6e35 3040 err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
e0b2b27e
JH		 3041 } else {
3042 u8 addr_type;
3043
89cbb063
AA		 3044 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
3045 &cp->addr.bdaddr);
3046 if (conn) {
3047 /* Defer clearing up the connection parameters
3048 * until closing to give a chance of keeping
3049 * them if a repairing happens.
3050 */
3051 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
3052
3053 /* If disconnection is not requested, then
3054 * clear the connection variable so that the
3055 * link is not terminated.
3056 */
3057 if (!cp->disconnect)
3058 conn = NULL;
3059 }
3060
e0b2b27e
JH		 3061 if (cp->addr.type == BDADDR_LE_PUBLIC)
3062 addr_type = ADDR_LE_DEV_PUBLIC;
3063 else
3064 addr_type = ADDR_LE_DEV_RANDOM;
3065
a7ec7338
JH		 3066 hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
3067
e0b2b27e
JH		 3068 err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
3069 }
b0dbfb46 3070
55ed8ca1 3071 if (err < 0) {
2a1afb5a
JH		 3072 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
3073 MGMT_STATUS_NOT_PAIRED, &rp,
3074 sizeof(rp));
55ed8ca1
JH		 3075 goto unlock;
3076 }
3077
89cbb063
AA		 3078 /* If the connection variable is set, then termination of the
3079 * link is requested.
3080 */
a8a1d19e 3081 if (!conn) {
2a1afb5a
JH		 3082 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
3083 &rp, sizeof(rp));
b1078ad0 3084 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
a8a1d19e
JH		 3085 goto unlock;
3086 }
55ed8ca1 3087
124f6e35 3088 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
04124681 3089 sizeof(*cp));
a8a1d19e
JH		 3090 if (!cmd) {
3091 err = -ENOMEM;
3092 goto unlock;
55ed8ca1
JH		 3093 }
3094
d8b7b1e4
JH		 3095 cmd->cmd_complete = addr_cmd_complete;
3096
eb55ef07 3097 dc.handle = cpu_to_le16(conn->handle);
a8a1d19e
JH		 3098 dc.reason = 0x13; /* Remote User Terminated Connection */
3099 err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
3100 if (err < 0)
3101 mgmt_pending_remove(cmd);
3102
55ed8ca1 3103unlock:
09fd0de5 3104 hci_dev_unlock(hdev);
55ed8ca1
JH		 3105 return err;
3106}
3107
bdb6d971 3108static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3109 u16 len)
8962ee74 3110{
650f726d 3111 struct mgmt_cp_disconnect *cp = data;
06a63b19 3112 struct mgmt_rp_disconnect rp;
3b0602cd 3113 struct mgmt_pending_cmd *cmd;
8962ee74 3114 struct hci_conn *conn;
8962ee74
JH		 3115 int err;
3116
3117 BT_DBG("");
3118
06a63b19
JH		 3119 memset(&rp, 0, sizeof(rp));
3120 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3121 rp.addr.type = cp->addr.type;
3122
4ee71b20 3123 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3124 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3125 MGMT_STATUS_INVALID_PARAMS,
3126 &rp, sizeof(rp));
4ee71b20 3127
09fd0de5 3128 hci_dev_lock(hdev);
8962ee74
JH		 3129
3130 if (!test_bit(HCI_UP, &hdev->flags)) {
2a1afb5a
JH		 3131 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3132 MGMT_STATUS_NOT_POWERED, &rp,
3133 sizeof(rp));
8962ee74
JH		 3134 goto failed;
3135 }
3136
333ae95d 3137 if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
2a1afb5a
JH		 3138 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3139 MGMT_STATUS_BUSY, &rp, sizeof(rp));
8962ee74
JH		 3140 goto failed;
3141 }
3142
591f47f3 3143 if (cp->addr.type == BDADDR_BREDR)
8fc9ced3
GP		 3144 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
3145 &cp->addr.bdaddr);
88c3df13
JH		 3146 else
3147 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
365227e5 3148
f960727e 3149 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
2a1afb5a
JH		 3150 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
3151 MGMT_STATUS_NOT_CONNECTED, &rp,
3152 sizeof(rp));
8962ee74
JH		 3153 goto failed;
3154 }
3155
2e58ef3e 3156 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len);
366a0336
JH		 3157 if (!cmd) {
3158 err = -ENOMEM;
8962ee74 3159 goto failed;
366a0336 3160 }
8962ee74 3161
f5818c22
JH		 3162 cmd->cmd_complete = generic_cmd_complete;
3163
e3f2f92a 3164 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM);
8962ee74 3165 if (err < 0)
a664b5bc 3166 mgmt_pending_remove(cmd);
8962ee74
JH		 3167
3168failed:
09fd0de5 3169 hci_dev_unlock(hdev);
8962ee74
JH		 3170 return err;
3171}
3172
57c1477c 3173static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
4c659c39
JH		 3174{
3175 switch (link_type) {
3176 case LE_LINK:
48264f06
JH		 3177 switch (addr_type) {
3178 case ADDR_LE_DEV_PUBLIC:
591f47f3 3179 return BDADDR_LE_PUBLIC;
0ed09148 3180
48264f06 3181 default:
0ed09148 3182 /* Fallback to LE Random address type */
591f47f3 3183 return BDADDR_LE_RANDOM;
48264f06 3184 }
0ed09148 3185
4c659c39 3186 default:
0ed09148 3187 /* Fallback to BR/EDR type */
591f47f3 3188 return BDADDR_BREDR;
4c659c39
JH		 3189 }
3190}
3191
04124681
GP		 3192static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
3193 u16 data_len)
2784eb41 3194{
2784eb41 3195 struct mgmt_rp_get_connections *rp;
8035ded4 3196 struct hci_conn *c;
a38528f1 3197 size_t rp_len;
60fc5fb6
JH		 3198 int err;
3199 u16 i;
2784eb41
JH		 3200
3201 BT_DBG("");
3202
09fd0de5 3203 hci_dev_lock(hdev);
2784eb41 3204
5f97c1df 3205 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3206 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
3207 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3208 goto unlock;
3209 }
3210
60fc5fb6 3211 i = 0;
b644ba33
JH		 3212 list_for_each_entry(c, &hdev->conn_hash.list, list) {
3213 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
60fc5fb6 3214 i++;
2784eb41
JH		 3215 }
3216
60fc5fb6 3217 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
92c4c204 3218 rp = kmalloc(rp_len, GFP_KERNEL);
a38528f1 3219 if (!rp) {
2784eb41
JH		 3220 err = -ENOMEM;
3221 goto unlock;
3222 }
3223
2784eb41 3224 i = 0;
4c659c39 3225 list_for_each_entry(c, &hdev->conn_hash.list, list) {
b644ba33
JH		 3226 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
3227 continue;
4c659c39 3228 bacpy(&rp->addr[i].bdaddr, &c->dst);
57c1477c 3229 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type);
0ed09148 3230 if (c->type == SCO_LINK || c->type == ESCO_LINK)
4c659c39
JH		 3231 continue;
3232 i++;
3233 }
3234
eb55ef07 3235 rp->conn_count = cpu_to_le16(i);
60fc5fb6 3236
4c659c39
JH		 3237 /* Recalculate length in case of filtered SCO connections, etc */
3238 rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
2784eb41 3239
2a1afb5a
JH		 3240 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
3241 rp_len);
2784eb41 3242
a38528f1 3243 kfree(rp);
5f97c1df
JH		 3244
3245unlock:
09fd0de5 3246 hci_dev_unlock(hdev);
2784eb41
JH		 3247 return err;
3248}
3249
bdb6d971 3250static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3251 struct mgmt_cp_pin_code_neg_reply *cp)
96d97a67 3252{
3b0602cd 3253 struct mgmt_pending_cmd *cmd;
96d97a67
WR		 3254 int err;
3255
2e58ef3e 3256 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
04124681 3257 sizeof(*cp));
96d97a67
WR		 3258 if (!cmd)
3259 return -ENOMEM;
3260
d8457698 3261 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
04124681 3262 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
96d97a67
WR		 3263 if (err < 0)
3264 mgmt_pending_remove(cmd);
3265
3266 return err;
3267}
3268
bdb6d971 3269static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3270 u16 len)
980e1a53 3271{
96d97a67 3272 struct hci_conn *conn;
650f726d 3273 struct mgmt_cp_pin_code_reply *cp = data;
980e1a53 3274 struct hci_cp_pin_code_reply reply;
3b0602cd 3275 struct mgmt_pending_cmd *cmd;
980e1a53
JH		 3276 int err;
3277
3278 BT_DBG("");
3279
09fd0de5 3280 hci_dev_lock(hdev);
980e1a53 3281
4b34ee78 3282 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3283 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3284 MGMT_STATUS_NOT_POWERED);
980e1a53
JH		 3285 goto failed;
3286 }
3287
d8457698 3288 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
96d97a67 3289 if (!conn) {
a69e8375
JH		 3290 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3291 MGMT_STATUS_NOT_CONNECTED);
96d97a67
WR		 3292 goto failed;
3293 }
3294
3295 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
d8457698
JH		 3296 struct mgmt_cp_pin_code_neg_reply ncp;
3297
3298 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
96d97a67
WR		 3299
3300 BT_ERR("PIN code is not 16 bytes long");
3301
bdb6d971 3302 err = send_pin_code_neg_reply(sk, hdev, &ncp);
96d97a67 3303 if (err >= 0)
a69e8375
JH		 3304 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
3305 MGMT_STATUS_INVALID_PARAMS);
96d97a67
WR		 3306
3307 goto failed;
3308 }
3309
00abfe44 3310 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
366a0336
JH		 3311 if (!cmd) {
3312 err = -ENOMEM;
980e1a53 3313 goto failed;
366a0336 3314 }
980e1a53 3315
7776d1d8
JH		 3316 cmd->cmd_complete = addr_cmd_complete;
3317
d8457698 3318 bacpy(&reply.bdaddr, &cp->addr.bdaddr);
980e1a53 3319 reply.pin_len = cp->pin_len;
24718ca5 3320 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
980e1a53
JH		 3321
3322 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
3323 if (err < 0)
a664b5bc 3324 mgmt_pending_remove(cmd);
980e1a53
JH		 3325
3326failed:
09fd0de5 3327 hci_dev_unlock(hdev);
980e1a53
JH		 3328 return err;
3329}
3330
04124681
GP		 3331static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
3332 u16 len)
17fa4b9d 3333{
650f726d 3334 struct mgmt_cp_set_io_capability *cp = data;
17fa4b9d
JH		 3335
3336 BT_DBG("");
3337
4ec86d4c 3338 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3339 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
3340 MGMT_STATUS_INVALID_PARAMS, NULL, 0);
4ec86d4c 3341
09fd0de5 3342 hci_dev_lock(hdev);
17fa4b9d
JH		 3343
3344 hdev->io_capability = cp->io_capability;
3345
3346 BT_DBG("%s IO capability set to 0x%02x", hdev->name,
8ce8e2b5 3347 hdev->io_capability);
17fa4b9d 3348
09fd0de5 3349 hci_dev_unlock(hdev);
17fa4b9d 3350
2a1afb5a
JH		 3351 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
3352 NULL, 0);
17fa4b9d
JH		 3353}
3354
3b0602cd 3355static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
e9a416b5
JH		 3356{
3357 struct hci_dev *hdev = conn->hdev;
3b0602cd 3358 struct mgmt_pending_cmd *cmd;
e9a416b5 3359
2e58ef3e 3360 list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
e9a416b5
JH		 3361 if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
3362 continue;
3363
e9a416b5
JH		 3364 if (cmd->user_data != conn)
3365 continue;
3366
3367 return cmd;
3368 }
3369
3370 return NULL;
3371}
3372
3b0602cd 3373static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
e9a416b5
JH		 3374{
3375 struct mgmt_rp_pair_device rp;
3376 struct hci_conn *conn = cmd->user_data;
9df74653 3377 int err;
e9a416b5 3378
61b1a7fb
JH		 3379 bacpy(&rp.addr.bdaddr, &conn->dst);
3380 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
e9a416b5 3381
2a1afb5a
JH		 3382 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
3383 status, &rp, sizeof(rp));
e9a416b5
JH		 3384
3385 /* So we don't get further callbacks for this connection */
3386 conn->connect_cfm_cb = NULL;
3387 conn->security_cfm_cb = NULL;
3388 conn->disconn_cfm_cb = NULL;
3389
76a68ba0 3390 hci_conn_drop(conn);
89cbb063
AA		 3391
3392 /* The device is paired so there is no need to remove
3393 * its connection parameters anymore.
3394 */
3395 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
15013aeb
JH		 3396
3397 hci_conn_put(conn);
9df74653
JH		 3398
3399 return err;
e9a416b5
JH		 3400}
3401
f4a407be
JH		 3402void mgmt_smp_complete(struct hci_conn *conn, bool complete)
3403{
3404 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
3b0602cd 3405 struct mgmt_pending_cmd *cmd;
f4a407be
JH		 3406
3407 cmd = find_pairing(conn);
a511b35b 3408 if (cmd) {
04ab2749 3409 cmd->cmd_complete(cmd, status);
a511b35b
JH		 3410 mgmt_pending_remove(cmd);
3411 }
f4a407be
JH		 3412}
3413
e9a416b5
JH		 3414static void pairing_complete_cb(struct hci_conn *conn, u8 status)
3415{
3b0602cd 3416 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3417
3418 BT_DBG("status %u", status);
3419
3420 cmd = find_pairing(conn);
a511b35b 3421 if (!cmd) {
e9a416b5 3422 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3423 return;
3424 }
3425
3426 cmd->cmd_complete(cmd, mgmt_status(status));
3427 mgmt_pending_remove(cmd);
e9a416b5
JH		 3428}
3429
f4a407be 3430static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
4c47d739 3431{
3b0602cd 3432 struct mgmt_pending_cmd *cmd;
4c47d739
VA		 3433
3434 BT_DBG("status %u", status);
3435
3436 if (!status)
3437 return;
3438
3439 cmd = find_pairing(conn);
a511b35b 3440 if (!cmd) {
4c47d739 3441 BT_DBG("Unable to find a pending command");
a511b35b
JH		 3442 return;
3443 }
3444
3445 cmd->cmd_complete(cmd, mgmt_status(status));
3446 mgmt_pending_remove(cmd);
4c47d739
VA		 3447}
3448
bdb6d971 3449static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3450 u16 len)
e9a416b5 3451{
650f726d 3452 struct mgmt_cp_pair_device *cp = data;
1425acb7 3453 struct mgmt_rp_pair_device rp;
3b0602cd 3454 struct mgmt_pending_cmd *cmd;
e9a416b5
JH		 3455 u8 sec_level, auth_type;
3456 struct hci_conn *conn;
e9a416b5
JH		 3457 int err;
3458
3459 BT_DBG("");
3460
f950a30e
SJ		 3461 memset(&rp, 0, sizeof(rp));
3462 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
3463 rp.addr.type = cp->addr.type;
3464
4ee71b20 3465 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 3466 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3467 MGMT_STATUS_INVALID_PARAMS,
3468 &rp, sizeof(rp));
4ee71b20 3469
4ec86d4c 3470 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
2a1afb5a
JH		 3471 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3472 MGMT_STATUS_INVALID_PARAMS,
3473 &rp, sizeof(rp));
4ec86d4c 3474
09fd0de5 3475 hci_dev_lock(hdev);
e9a416b5 3476
5f97c1df 3477 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3478 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3479 MGMT_STATUS_NOT_POWERED, &rp,
3480 sizeof(rp));
5f97c1df
JH		 3481 goto unlock;
3482 }
3483
55e76b38
JH		 3484 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
3485 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3486 MGMT_STATUS_ALREADY_PAIRED, &rp,
3487 sizeof(rp));
3488 goto unlock;
3489 }
3490
c908df36 3491 sec_level = BT_SECURITY_MEDIUM;
6fd6b915 3492 auth_type = HCI_AT_DEDICATED_BONDING;
e9a416b5 3493
6f77d8c7 3494 if (cp->addr.type == BDADDR_BREDR) {
04a6c589
AG		 3495 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
3496 auth_type);
6f77d8c7
AG		 3497 } else {
3498 u8 addr_type;
3499
3500 /* Convert from L2CAP channel address type to HCI address type
3501 */
3502 if (cp->addr.type == BDADDR_LE_PUBLIC)
3503 addr_type = ADDR_LE_DEV_PUBLIC;
3504 else
3505 addr_type = ADDR_LE_DEV_RANDOM;
3506
7c264b10
MH		 3507 /* When pairing a new device, it is expected to remember
3508 * this device for future connections. Adding the connection
3509 * parameter information ahead of time allows tracking
3510 * of the slave preferred values and will speed up any
3511 * further connection establishment.
3512 *
3513 * If connection parameters already exist, then they
3514 * will be kept and this function does nothing.
3515 */
3516 hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
3517
6f77d8c7 3518 conn = hci_connect_le(hdev, &cp->addr.bdaddr, addr_type,
e804d25d
JH		 3519 sec_level, HCI_LE_CONN_TIMEOUT,
3520 HCI_ROLE_MASTER);
6f77d8c7 3521 }
7a512d01 3522
30e76272 3523 if (IS_ERR(conn)) {
489dc48e
AK		 3524 int status;
3525
3526 if (PTR_ERR(conn) == -EBUSY)
3527 status = MGMT_STATUS_BUSY;
faa81030
LR		 3528 else if (PTR_ERR(conn) == -EOPNOTSUPP)
3529 status = MGMT_STATUS_NOT_SUPPORTED;
3530 else if (PTR_ERR(conn) == -ECONNREFUSED)
3531 status = MGMT_STATUS_REJECTED;
489dc48e
AK		 3532 else
3533 status = MGMT_STATUS_CONNECT_FAILED;
3534
2a1afb5a
JH		 3535 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3536 status, &rp, sizeof(rp));
e9a416b5
JH		 3537 goto unlock;
3538 }
3539
3540 if (conn->connect_cfm_cb) {
76a68ba0 3541 hci_conn_drop(conn);
2a1afb5a
JH		 3542 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
3543 MGMT_STATUS_BUSY, &rp, sizeof(rp));
e9a416b5
JH		 3544 goto unlock;
3545 }
3546
2e58ef3e 3547 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len);
e9a416b5
JH		 3548 if (!cmd) {
3549 err = -ENOMEM;
76a68ba0 3550 hci_conn_drop(conn);
e9a416b5
JH		 3551 goto unlock;
3552 }
3553
04ab2749
JH		 3554 cmd->cmd_complete = pairing_complete;
3555
7a512d01 3556 /* For LE, just connecting isn't a proof that the pairing finished */
f4a407be 3557 if (cp->addr.type == BDADDR_BREDR) {
7a512d01 3558 conn->connect_cfm_cb = pairing_complete_cb;
f4a407be
JH		 3559 conn->security_cfm_cb = pairing_complete_cb;
3560 conn->disconn_cfm_cb = pairing_complete_cb;
3561 } else {
3562 conn->connect_cfm_cb = le_pairing_complete_cb;
3563 conn->security_cfm_cb = le_pairing_complete_cb;
3564 conn->disconn_cfm_cb = le_pairing_complete_cb;
3565 }
7a512d01 3566
e9a416b5 3567 conn->io_capability = cp->io_cap;
f8aaf9b6 3568 cmd->user_data = hci_conn_get(conn);
e9a416b5 3569
6f78fd4b 3570 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
a511b35b
JH		 3571 hci_conn_security(conn, sec_level, auth_type, true)) {
3572 cmd->cmd_complete(cmd, 0);
3573 mgmt_pending_remove(cmd);
3574 }
e9a416b5
JH		 3575
3576 err = 0;
3577
3578unlock:
09fd0de5 3579 hci_dev_unlock(hdev);
e9a416b5
JH		 3580 return err;
3581}
3582
04124681
GP		 3583static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
3584 u16 len)
28424707 3585{
0f4e68cf 3586 struct mgmt_addr_info *addr = data;
3b0602cd 3587 struct mgmt_pending_cmd *cmd;
28424707
JH		 3588 struct hci_conn *conn;
3589 int err;
3590
3591 BT_DBG("");
3592
28424707
JH		 3593 hci_dev_lock(hdev);
3594
5f97c1df 3595 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3596 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3597 MGMT_STATUS_NOT_POWERED);
5f97c1df
JH		 3598 goto unlock;
3599 }
3600
333ae95d 3601 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
28424707 3602 if (!cmd) {
a69e8375
JH		 3603 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3604 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3605 goto unlock;
3606 }
3607
3608 conn = cmd->user_data;
3609
3610 if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
a69e8375
JH		 3611 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
3612 MGMT_STATUS_INVALID_PARAMS);
28424707
JH		 3613 goto unlock;
3614 }
3615
a511b35b
JH		 3616 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
3617 mgmt_pending_remove(cmd);
28424707 3618
2a1afb5a
JH		 3619 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
3620 addr, sizeof(*addr));
28424707
JH		 3621unlock:
3622 hci_dev_unlock(hdev);
28424707
JH		 3623 return err;
3624}
3625
bdb6d971 3626static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
1707c60e 3627 struct mgmt_addr_info *addr, u16 mgmt_op,
04124681 3628 u16 hci_op, __le32 passkey)
a5c29683 3629{
3b0602cd 3630 struct mgmt_pending_cmd *cmd;
0df4c185 3631 struct hci_conn *conn;
a5c29683
JH		 3632 int err;
3633
09fd0de5 3634 hci_dev_lock(hdev);
08ba5382 3635
4b34ee78 3636 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 3637 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3638 MGMT_STATUS_NOT_POWERED, addr,
3639 sizeof(*addr));
0df4c185 3640 goto done;
a5c29683
JH		 3641 }
3642
1707c60e
JH		 3643 if (addr->type == BDADDR_BREDR)
3644 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr);
272d90df 3645 else
1707c60e 3646 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
272d90df
JH		 3647
3648 if (!conn) {
2a1afb5a
JH		 3649 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3650 MGMT_STATUS_NOT_CONNECTED, addr,
3651 sizeof(*addr));
272d90df
JH		 3652 goto done;
3653 }
47c15e2b 3654
1707c60e 3655 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
5fe57d9e 3656 err = smp_user_confirm_reply(conn, mgmt_op, passkey);
5fe57d9e 3657 if (!err)
2a1afb5a
JH		 3658 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3659 MGMT_STATUS_SUCCESS, addr,
3660 sizeof(*addr));
5fe57d9e 3661 else
2a1afb5a
JH		 3662 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
3663 MGMT_STATUS_FAILED, addr,
3664 sizeof(*addr));
47c15e2b 3665
47c15e2b
BG		 3666 goto done;
3667 }
3668
1707c60e 3669 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr));
a5c29683
JH		 3670 if (!cmd) {
3671 err = -ENOMEM;
0df4c185 3672 goto done;
a5c29683
JH		 3673 }
3674
7776d1d8
JH		 3675 cmd->cmd_complete = addr_cmd_complete;
3676
0df4c185 3677 /* Continue with pairing via HCI */
604086b7
BG		 3678 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
3679 struct hci_cp_user_passkey_reply cp;
3680
1707c60e 3681 bacpy(&cp.bdaddr, &addr->bdaddr);
604086b7
BG		 3682 cp.passkey = passkey;
3683 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
3684 } else
1707c60e
JH		 3685 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr),
3686 &addr->bdaddr);
604086b7 3687
a664b5bc
JH		 3688 if (err < 0)
3689 mgmt_pending_remove(cmd);
a5c29683 3690
0df4c185 3691done:
09fd0de5 3692 hci_dev_unlock(hdev);
a5c29683
JH		 3693 return err;
3694}
3695
afeb019d
JK		 3696static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
3697 void *data, u16 len)
3698{
3699 struct mgmt_cp_pin_code_neg_reply *cp = data;
3700
3701 BT_DBG("");
3702
1707c60e 3703 return user_pairing_resp(sk, hdev, &cp->addr,
afeb019d
JK		 3704 MGMT_OP_PIN_CODE_NEG_REPLY,
3705 HCI_OP_PIN_CODE_NEG_REPLY, 0);
3706}
3707
04124681
GP		 3708static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3709 u16 len)
0df4c185 3710{
650f726d 3711 struct mgmt_cp_user_confirm_reply *cp = data;
0df4c185
BG		 3712
3713 BT_DBG("");
3714
3715 if (len != sizeof(*cp))
a69e8375
JH		 3716 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
3717 MGMT_STATUS_INVALID_PARAMS);
0df4c185 3718
1707c60e 3719 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3720 MGMT_OP_USER_CONFIRM_REPLY,
3721 HCI_OP_USER_CONFIRM_REPLY, 0);
0df4c185
BG		 3722}
3723
bdb6d971 3724static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3725 void *data, u16 len)
0df4c185 3726{
c9c2659f 3727 struct mgmt_cp_user_confirm_neg_reply *cp = data;
0df4c185
BG		 3728
3729 BT_DBG("");
3730
1707c60e 3731 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3732 MGMT_OP_USER_CONFIRM_NEG_REPLY,
3733 HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
0df4c185
BG		 3734}
3735
04124681
GP		 3736static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data,
3737 u16 len)
604086b7 3738{
650f726d 3739 struct mgmt_cp_user_passkey_reply *cp = data;
604086b7
BG		 3740
3741 BT_DBG("");
3742
1707c60e 3743 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3744 MGMT_OP_USER_PASSKEY_REPLY,
3745 HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
604086b7
BG		 3746}
3747
bdb6d971 3748static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev,
04124681 3749 void *data, u16 len)
604086b7 3750{
650f726d 3751 struct mgmt_cp_user_passkey_neg_reply *cp = data;
604086b7
BG		 3752
3753 BT_DBG("");
3754
1707c60e 3755 return user_pairing_resp(sk, hdev, &cp->addr,
04124681
GP		 3756 MGMT_OP_USER_PASSKEY_NEG_REPLY,
3757 HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
604086b7
BG		 3758}
3759
13928971 3760static void update_name(struct hci_request *req)
2b4bf397 3761{
13928971 3762 struct hci_dev *hdev = req->hdev;
2b4bf397
JH		 3763 struct hci_cp_write_local_name cp;
3764
13928971 3765 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
2b4bf397 3766
890ea898 3767 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
2b4bf397
JH		 3768}
3769
1904a853 3770static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
13928971
JH		 3771{
3772 struct mgmt_cp_set_local_name *cp;
3b0602cd 3773 struct mgmt_pending_cmd *cmd;
13928971
JH		 3774
3775 BT_DBG("status 0x%02x", status);
3776
3777 hci_dev_lock(hdev);
3778
333ae95d 3779 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 3780 if (!cmd)
3781 goto unlock;
3782
3783 cp = cmd->param;
3784
3785 if (status)
a69e8375
JH		 3786 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
3787 mgmt_status(status));
13928971 3788 else
2a1afb5a
JH		 3789 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3790 cp, sizeof(*cp));
13928971
JH		 3791
3792 mgmt_pending_remove(cmd);
3793
3794unlock:
3795 hci_dev_unlock(hdev);
3796}
3797
bdb6d971 3798static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 3799 u16 len)
b312b161 3800{
2b4bf397 3801 struct mgmt_cp_set_local_name *cp = data;
3b0602cd 3802 struct mgmt_pending_cmd *cmd;
890ea898 3803 struct hci_request req;
b312b161
JH		 3804 int err;
3805
3806 BT_DBG("");
3807
09fd0de5 3808 hci_dev_lock(hdev);
b312b161 3809
b3f2ca94
JH		 3810 /* If the old values are the same as the new ones just return a
3811 * direct command complete event.
3812 */
3813 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
3814 !memcmp(hdev->short_name, cp->short_name,
3815 sizeof(hdev->short_name))) {
2a1afb5a
JH		 3816 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3817 data, len);
b3f2ca94
JH		 3818 goto failed;
3819 }
3820
2b4bf397 3821 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name));
28cc7bde 3822
b5235a65 3823 if (!hdev_is_powered(hdev)) {
2b4bf397 3824 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
28cc7bde 3825
2a1afb5a
JH		 3826 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
3827 data, len);
28cc7bde
JH		 3828 if (err < 0)
3829 goto failed;
3830
f6b7712e
MH		 3831 err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
3832 data, len, sk);
28cc7bde 3833
b5235a65
JH		 3834 goto failed;
3835 }
3836
28cc7bde 3837 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
b312b161
JH		 3838 if (!cmd) {
3839 err = -ENOMEM;
3840 goto failed;
3841 }
3842
13928971
JH		 3843 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
3844
890ea898 3845 hci_req_init(&req, hdev);
3f985050
JH		 3846
3847 if (lmp_bredr_capable(hdev)) {
3848 update_name(&req);
3849 update_eir(&req);
3850 }
3851
7a5f4990
MH		 3852 /* The name is stored in the scan response data and so
3853 * no need to udpate the advertising data here.
3854 */
3f985050 3855 if (lmp_le_capable(hdev))
7a5f4990 3856 update_scan_rsp_data(&req);
3f985050 3857
13928971 3858 err = hci_req_run(&req, set_name_complete);
b312b161
JH		 3859 if (err < 0)
3860 mgmt_pending_remove(cmd);
3861
3862failed:
09fd0de5 3863 hci_dev_unlock(hdev);
b312b161
JH		 3864 return err;
3865}
3866
1b9441f8
JH		 3867static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
3868 u16 opcode, struct sk_buff *skb)
3869{
3870 struct mgmt_rp_read_local_oob_data mgmt_rp;
3871 size_t rp_size = sizeof(mgmt_rp);
3872 struct mgmt_pending_cmd *cmd;
3873
3874 BT_DBG("%s status %u", hdev->name, status);
3875
3876 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
3877 if (!cmd)
3878 return;
3879
3880 if (status || !skb) {
3881 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3882 status ? mgmt_status(status) : MGMT_STATUS_FAILED);
3883 goto remove;
3884 }
3885
3886 memset(&mgmt_rp, 0, sizeof(mgmt_rp));
3887
3888 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
3889 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
3890
3891 if (skb->len < sizeof(*rp)) {
3892 mgmt_cmd_status(cmd->sk, hdev->id,
3893 MGMT_OP_READ_LOCAL_OOB_DATA,
3894 MGMT_STATUS_FAILED);
3895 goto remove;
3896 }
3897
3898 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
3899 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
3900
3901 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
3902 } else {
3903 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
3904
3905 if (skb->len < sizeof(*rp)) {
3906 mgmt_cmd_status(cmd->sk, hdev->id,
3907 MGMT_OP_READ_LOCAL_OOB_DATA,
3908 MGMT_STATUS_FAILED);
3909 goto remove;
3910 }
3911
3912 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
3913 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
3914
3915 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
3916 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
3917 }
3918
3919 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3920 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
3921
3922remove:
3923 mgmt_pending_remove(cmd);
3924}
3925
0f4e68cf 3926static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3927 void *data, u16 data_len)
c35938b2 3928{
3b0602cd 3929 struct mgmt_pending_cmd *cmd;
1b9441f8 3930 struct hci_request req;
c35938b2
SJ		 3931 int err;
3932
bdb6d971 3933 BT_DBG("%s", hdev->name);
c35938b2 3934
09fd0de5 3935 hci_dev_lock(hdev);
c35938b2 3936
4b34ee78 3937 if (!hdev_is_powered(hdev)) {
a69e8375
JH		 3938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3939 MGMT_STATUS_NOT_POWERED);
c35938b2
SJ		 3940 goto unlock;
3941 }
3942
9a1a1996 3943 if (!lmp_ssp_capable(hdev)) {
a69e8375
JH		 3944 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3945 MGMT_STATUS_NOT_SUPPORTED);
c35938b2
SJ		 3946 goto unlock;
3947 }
3948
333ae95d 3949 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
a69e8375
JH		 3950 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
3951 MGMT_STATUS_BUSY);
c35938b2
SJ		 3952 goto unlock;
3953 }
3954
2e58ef3e 3955 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0);
c35938b2
SJ		 3956 if (!cmd) {
3957 err = -ENOMEM;
3958 goto unlock;
3959 }
3960
1b9441f8
JH		 3961 hci_req_init(&req, hdev);
3962
710f11c0 3963 if (bredr_sc_enabled(hdev))
1b9441f8 3964 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
4d2d2796 3965 else
1b9441f8 3966 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
4d2d2796 3967
1b9441f8 3968 err = hci_req_run_skb(&req, read_local_oob_data_complete);
c35938b2
SJ		 3969 if (err < 0)
3970 mgmt_pending_remove(cmd);
3971
3972unlock:
09fd0de5 3973 hci_dev_unlock(hdev);
c35938b2
SJ		 3974 return err;
3975}
3976
bdb6d971 3977static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
04124681 3978 void *data, u16 len)
2763eda6 3979{
5d57e796 3980 struct mgmt_addr_info *addr = data;
2763eda6
SJ		 3981 int err;
3982
bdb6d971 3983 BT_DBG("%s ", hdev->name);
2763eda6 3984
5d57e796 3985 if (!bdaddr_type_is_valid(addr->type))
2a1afb5a
JH		 3986 return mgmt_cmd_complete(sk, hdev->id,
3987 MGMT_OP_ADD_REMOTE_OOB_DATA,
3988 MGMT_STATUS_INVALID_PARAMS,
3989 addr, sizeof(*addr));
5d57e796 3990
09fd0de5 3991 hci_dev_lock(hdev);
2763eda6 3992
ec109113
MH		 3993 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) {
3994 struct mgmt_cp_add_remote_oob_data *cp = data;
3995 u8 status;
bf1e3541 3996
c19a495c 3997 if (cp->addr.type != BDADDR_BREDR) {
2a1afb5a
JH		 3998 err = mgmt_cmd_complete(sk, hdev->id,
3999 MGMT_OP_ADD_REMOTE_OOB_DATA,
4000 MGMT_STATUS_INVALID_PARAMS,
4001 &cp->addr, sizeof(cp->addr));
c19a495c
JH		 4002 goto unlock;
4003 }
4004
ec109113 4005 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
6928a924
JH		 4006 cp->addr.type, cp->hash,
4007 cp->rand, NULL, NULL);
ec109113
MH		 4008 if (err < 0)
4009 status = MGMT_STATUS_FAILED;
4010 else
4011 status = MGMT_STATUS_SUCCESS;
4012
2a1afb5a
JH		 4013 err = mgmt_cmd_complete(sk, hdev->id,
4014 MGMT_OP_ADD_REMOTE_OOB_DATA, status,
4015 &cp->addr, sizeof(cp->addr));
ec109113
MH		 4016 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
4017 struct mgmt_cp_add_remote_oob_ext_data *cp = data;
41bcfd50 4018 u8 *rand192, *hash192, *rand256, *hash256;
ec109113
MH		 4019 u8 status;
4020
86df9200 4021 if (bdaddr_type_is_le(cp->addr.type)) {
d25b78e2
JH		 4022 /* Enforce zero-valued 192-bit parameters as
4023 * long as legacy SMP OOB isn't implemented.
4024 */
4025 if (memcmp(cp->rand192, ZERO_KEY, 16) ||
4026 memcmp(cp->hash192, ZERO_KEY, 16)) {
2a1afb5a
JH		 4027 err = mgmt_cmd_complete(sk, hdev->id,
4028 MGMT_OP_ADD_REMOTE_OOB_DATA,
4029 MGMT_STATUS_INVALID_PARAMS,
4030 addr, sizeof(*addr));
d25b78e2
JH		 4031 goto unlock;
4032 }
4033
86df9200
JH		 4034 rand192 = NULL;
4035 hash192 = NULL;
4036 } else {
41bcfd50
MH		 4037 /* In case one of the P-192 values is set to zero,
4038 * then just disable OOB data for P-192.
4039 */
4040 if (!memcmp(cp->rand192, ZERO_KEY, 16) ||
4041 !memcmp(cp->hash192, ZERO_KEY, 16)) {
4042 rand192 = NULL;
4043 hash192 = NULL;
4044 } else {
4045 rand192 = cp->rand192;
4046 hash192 = cp->hash192;
4047 }
4048 }
4049
4050 /* In case one of the P-256 values is set to zero, then just
4051 * disable OOB data for P-256.
4052 */
4053 if (!memcmp(cp->rand256, ZERO_KEY, 16) ||
4054 !memcmp(cp->hash256, ZERO_KEY, 16)) {
4055 rand256 = NULL;
4056 hash256 = NULL;
4057 } else {
4058 rand256 = cp->rand256;
4059 hash256 = cp->hash256;
86df9200
JH		 4060 }
4061
81328d5c 4062 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr,
86df9200 4063 cp->addr.type, hash192, rand192,
41bcfd50 4064 hash256, rand256);
ec109113
MH		 4065 if (err < 0)
4066 status = MGMT_STATUS_FAILED;
4067 else
4068 status = MGMT_STATUS_SUCCESS;
4069
2a1afb5a
JH		 4070 err = mgmt_cmd_complete(sk, hdev->id,
4071 MGMT_OP_ADD_REMOTE_OOB_DATA,
4072 status, &cp->addr, sizeof(cp->addr));
ec109113
MH		 4073 } else {
4074 BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
a69e8375
JH		 4075 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
4076 MGMT_STATUS_INVALID_PARAMS);
ec109113 4077 }
2763eda6 4078
c19a495c 4079unlock:
09fd0de5 4080 hci_dev_unlock(hdev);
2763eda6
SJ		 4081 return err;
4082}
4083
bdb6d971 4084static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
8ce8e2b5 4085 void *data, u16 len)
2763eda6 4086{
650f726d 4087 struct mgmt_cp_remove_remote_oob_data *cp = data;
bf1e3541 4088 u8 status;
2763eda6
SJ		 4089 int err;
4090
bdb6d971 4091 BT_DBG("%s", hdev->name);
2763eda6 4092
c19a495c 4093 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 4094 return mgmt_cmd_complete(sk, hdev->id,
4095 MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4096 MGMT_STATUS_INVALID_PARAMS,
4097 &cp->addr, sizeof(cp->addr));
c19a495c 4098
09fd0de5 4099 hci_dev_lock(hdev);
2763eda6 4100
eedbd581
JH		 4101 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
4102 hci_remote_oob_data_clear(hdev);
4103 status = MGMT_STATUS_SUCCESS;
4104 goto done;
4105 }
4106
6928a924 4107 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type);
2763eda6 4108 if (err < 0)
bf1e3541 4109 status = MGMT_STATUS_INVALID_PARAMS;
2763eda6 4110 else
a6785be2 4111 status = MGMT_STATUS_SUCCESS;
bf1e3541 4112
eedbd581 4113done:
2a1afb5a
JH		 4114 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
4115 status, &cp->addr, sizeof(cp->addr));
2763eda6 4116
09fd0de5 4117 hci_dev_unlock(hdev);
2763eda6
SJ		 4118 return err;
4119}
4120
812abb13 4121static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
41dc2bd6 4122{
8019044d 4123 struct hci_dev *hdev = req->hdev;
812abb13 4124 struct hci_cp_inquiry cp;
8019044d
MH		 4125 /* General inquiry access code (GIAC) */
4126 u8 lap[3] = { 0x33, 0x8b, 0x9e };
812abb13
JP		 4127
4128 *status = mgmt_bredr_support(hdev);
4129 if (*status)
4130 return false;
4131
4132 if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
4133 *status = MGMT_STATUS_BUSY;
4134 return false;
4135 }
4136
4137 hci_inquiry_cache_flush(hdev);
4138
4139 memset(&cp, 0, sizeof(cp));
4140 memcpy(&cp.lap, lap, sizeof(cp.lap));
4141 cp.length = DISCOV_BREDR_INQUIRY_LEN;
4142
4143 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
4144
4145 return true;
4146}
4147
4148static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
4149{
4150 struct hci_dev *hdev = req->hdev;
4151 struct hci_cp_le_set_scan_param param_cp;
4152 struct hci_cp_le_set_scan_enable enable_cp;
8019044d 4153 u8 own_addr_type;
41dc2bd6
AG		 4154 int err;
4155
812abb13
JP		 4156 *status = mgmt_le_support(hdev);
4157 if (*status)
4158 return false;
41dc2bd6 4159
812abb13
JP		 4160 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
4161 /* Don't let discovery abort an outgoing connection attempt
4162 * that's using directed advertising.
4163 */
4164 if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
4165 *status = MGMT_STATUS_REJECTED;
8019044d
MH		 4166 return false;
4167 }
41dc2bd6 4168
812abb13
JP		 4169 disable_advertising(req);
4170 }
41dc2bd6 4171
812abb13
JP		 4172 /* If controller is scanning, it means the background scanning is
4173 * running. Thus, we should temporarily stop it in order to set the
4174 * discovery scanning parameters.
4175 */
4176 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
4177 hci_req_add_le_scan_disable(req);
41dc2bd6 4178
812abb13
JP		 4179 /* All active scans will be done with either a resolvable private
4180 * address (when privacy feature has been enabled) or non-resolvable
4181 * private address.
4182 */
4183 err = hci_update_random_address(req, true, &own_addr_type);
4184 if (err < 0) {
4185 *status = MGMT_STATUS_FAILED;
4186 return false;
4187 }
8019044d 4188
812abb13
JP		 4189 memset(&param_cp, 0, sizeof(param_cp));
4190 param_cp.type = LE_SCAN_ACTIVE;
4191 param_cp.interval = cpu_to_le16(interval);
4192 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
4193 param_cp.own_address_type = own_addr_type;
8019044d 4194
812abb13
JP		 4195 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
4196 &param_cp);
8019044d 4197
812abb13
JP		 4198 memset(&enable_cp, 0, sizeof(enable_cp));
4199 enable_cp.enable = LE_SCAN_ENABLE;
4200 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8019044d 4201
812abb13
JP		 4202 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
4203 &enable_cp);
4204
4205 return true;
4206}
8019044d 4207
812abb13
JP		 4208static bool trigger_discovery(struct hci_request *req, u8 *status)
4209{
4210 struct hci_dev *hdev = req->hdev;
8019044d 4211
812abb13
JP		 4212 switch (hdev->discovery.type) {
4213 case DISCOV_TYPE_BREDR:
4214 if (!trigger_bredr_inquiry(req, status))
4215 return false;
4216 break;
4217
4218 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4219 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
4220 &hdev->quirks)) {
4221 /* During simultaneous discovery, we double LE scan
4222 * interval. We must leave some time for the controller
4223 * to do BR/EDR inquiry.
4224 */
4225 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
4226 status))
4227 return false;
4228
4229 if (!trigger_bredr_inquiry(req, status))
4230 return false;
4231
4232 return true;
4233 }
4234
812abb13
JP		 4235 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4236 *status = MGMT_STATUS_NOT_SUPPORTED;
8019044d
MH		 4237 return false;
4238 }
812abb13 4239 /* fall through */
8019044d 4240
812abb13
JP		 4241 case DISCOV_TYPE_LE:
4242 if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
4243 return false;
8019044d
MH		 4244 break;
4245
4246 default:
4247 *status = MGMT_STATUS_INVALID_PARAMS;
4248 return false;
4249 }
4250
4251 return true;
41dc2bd6
AG		 4252}
4253
1904a853
MH		 4254static void start_discovery_complete(struct hci_dev *hdev, u8 status,
4255 u16 opcode)
7c307720 4256{
3b0602cd 4257 struct mgmt_pending_cmd *cmd;
11e6e25d 4258 unsigned long timeout;
ae55f598 4259
7c307720
AG		 4260 BT_DBG("status %d", status);
4261
11e6e25d 4262 hci_dev_lock(hdev);
41dc2bd6 4263
333ae95d 4264 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
66ea9427 4265 if (!cmd)
333ae95d 4266 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
66ea9427 4267
11e6e25d 4268 if (cmd) {
2922a94f 4269 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d
MH		 4270 mgmt_pending_remove(cmd);
4271 }
7c307720
AG		 4272
4273 if (status) {
11e6e25d
MH		 4274 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4275 goto unlock;
7c307720
AG		 4276 }
4277
7c307720 4278 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
7c307720 4279
2d28cfe7
JP		 4280 /* If the scan involves LE scan, pick proper timeout to schedule
4281 * hdev->le_scan_disable that will stop it.
4282 */
7c307720
AG		 4283 switch (hdev->discovery.type) {
4284 case DISCOV_TYPE_LE:
3d5a76f0 4285 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
7c307720 4286 break;
7c307720 4287 case DISCOV_TYPE_INTERLEAVED:
07d2334a
JP		 4288 /* When running simultaneous discovery, the LE scanning time
4289 * should occupy the whole discovery time sine BR/EDR inquiry
4290 * and LE scanning are scheduled by the controller.
4291 *
4292 * For interleaving discovery in comparison, BR/EDR inquiry
4293 * and LE scanning are done sequentially with separate
4294 * timeouts.
4295 */
4296 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
4297 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
4298 else
4299 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
7c307720 4300 break;
7c307720 4301 case DISCOV_TYPE_BREDR:
11e6e25d 4302 timeout = 0;
7c307720 4303 break;
7c307720
AG		 4304 default:
4305 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
11e6e25d
MH		 4306 timeout = 0;
4307 break;
7c307720 4308 }
ae55f598 4309
2d28cfe7
JP		 4310 if (timeout) {
4311 /* When service discovery is used and the controller has
4312 * a strict duplicate filter, it is important to remember
4313 * the start and duration of the scan. This is required
4314 * for restarting scanning during the discovery phase.
4315 */
4316 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
4317 &hdev->quirks) &&
82f8b651 4318 hdev->discovery.result_filtering) {
2d28cfe7
JP		 4319 hdev->discovery.scan_start = jiffies;
4320 hdev->discovery.scan_duration = timeout;
4321 }
4322
11e6e25d
MH		 4323 queue_delayed_work(hdev->workqueue,
4324 &hdev->le_scan_disable, timeout);
2d28cfe7 4325 }
ae55f598 4326
11e6e25d
MH		 4327unlock:
4328 hci_dev_unlock(hdev);
7c307720
AG		 4329}
4330
bdb6d971 4331static int start_discovery(struct sock *sk, struct hci_dev *hdev,
04124681 4332 void *data, u16 len)
14a53664 4333{
650f726d 4334 struct mgmt_cp_start_discovery *cp = data;
3b0602cd 4335 struct mgmt_pending_cmd *cmd;
7c307720 4336 struct hci_request req;
8019044d 4337 u8 status;
14a53664
JH		 4338 int err;
4339
bdb6d971 4340 BT_DBG("%s", hdev->name);
14a53664 4341
09fd0de5 4342 hci_dev_lock(hdev);
14a53664 4343
4b34ee78 4344 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4345 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4346 MGMT_STATUS_NOT_POWERED,
4347 &cp->type, sizeof(cp->type));
bd2d1334
JH		 4348 goto failed;
4349 }
4350
f5a969f2 4351 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4352 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4353 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4354 MGMT_STATUS_BUSY, &cp->type,
4355 sizeof(cp->type));
642be6c7
AG		 4356 goto failed;
4357 }
4358
2922a94f 4359 cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, data, len);
14a53664
JH		 4360 if (!cmd) {
4361 err = -ENOMEM;
4362 goto failed;
4363 }
4364
2922a94f
JH		 4365 cmd->cmd_complete = generic_cmd_complete;
4366
22078800
MH		 4367 /* Clear the discovery filter first to free any previously
4368 * allocated memory for the UUID list.
4369 */
4370 hci_discovery_filter_clear(hdev);
4371
4aab14e5 4372 hdev->discovery.type = cp->type;
da25cf6a 4373 hdev->discovery.report_invalid_rssi = false;
4aab14e5 4374
7c307720
AG		 4375 hci_req_init(&req, hdev);
4376
8019044d 4377 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4378 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
4379 status, &cp->type, sizeof(cp->type));
04106755
JH		 4380 mgmt_pending_remove(cmd);
4381 goto failed;
f39799f5 4382 }
04106755 4383
7c307720 4384 err = hci_req_run(&req, start_discovery_complete);
f5a969f2 4385 if (err < 0) {
14a53664 4386 mgmt_pending_remove(cmd);
f5a969f2
MH		 4387 goto failed;
4388 }
7c307720 4389
f5a969f2 4390 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
7c307720 4391
14a53664 4392failed:
09fd0de5 4393 hci_dev_unlock(hdev);
14a53664
JH		 4394 return err;
4395}
f39799f5 4396
3b0602cd
JH		 4397static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
4398 u8 status)
2922a94f 4399{
2a1afb5a
JH		 4400 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
4401 cmd->param, 1);
2922a94f 4402}
04106755 4403
66ea9427
JP		 4404static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
4405 void *data, u16 len)
4406{
4407 struct mgmt_cp_start_service_discovery *cp = data;
3b0602cd 4408 struct mgmt_pending_cmd *cmd;
66ea9427
JP		 4409 struct hci_request req;
4410 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
4411 u16 uuid_count, expected_len;
4412 u8 status;
4413 int err;
04106755 4414
66ea9427 4415 BT_DBG("%s", hdev->name);
e8bb6b97 4416
66ea9427 4417 hci_dev_lock(hdev);
7c307720 4418
66ea9427 4419 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 4420 err = mgmt_cmd_complete(sk, hdev->id,
4421 MGMT_OP_START_SERVICE_DISCOVERY,
4422 MGMT_STATUS_NOT_POWERED,
4423 &cp->type, sizeof(cp->type));
66ea9427
JP		 4424 goto failed;
4425 }
7c307720 4426
66ea9427 4427 if (hdev->discovery.state != DISCOVERY_STOPPED ||
d7a5a11d 4428 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
2a1afb5a
JH		 4429 err = mgmt_cmd_complete(sk, hdev->id,
4430 MGMT_OP_START_SERVICE_DISCOVERY,
4431 MGMT_STATUS_BUSY, &cp->type,
4432 sizeof(cp->type));
66ea9427
JP		 4433 goto failed;
4434 }
d9483943 4435
66ea9427
JP		 4436 uuid_count = __le16_to_cpu(cp->uuid_count);
4437 if (uuid_count > max_uuid_count) {
4438 BT_ERR("service_discovery: too big uuid_count value %u",
4439 uuid_count);
2a1afb5a
JH		 4440 err = mgmt_cmd_complete(sk, hdev->id,
4441 MGMT_OP_START_SERVICE_DISCOVERY,
4442 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4443 sizeof(cp->type));
66ea9427
JP		 4444 goto failed;
4445 }
4446
4447 expected_len = sizeof(*cp) + uuid_count * 16;
4448 if (expected_len != len) {
4449 BT_ERR("service_discovery: expected %u bytes, got %u bytes",
4450 expected_len, len);
2a1afb5a
JH		 4451 err = mgmt_cmd_complete(sk, hdev->id,
4452 MGMT_OP_START_SERVICE_DISCOVERY,
4453 MGMT_STATUS_INVALID_PARAMS, &cp->type,
4454 sizeof(cp->type));
66ea9427
JP		 4455 goto failed;
4456 }
4457
4458 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY,
2922a94f 4459 hdev, data, len);
66ea9427
JP		 4460 if (!cmd) {
4461 err = -ENOMEM;
4462 goto failed;
4463 }
4464
2922a94f
JH		 4465 cmd->cmd_complete = service_discovery_cmd_complete;
4466
22078800
MH		 4467 /* Clear the discovery filter first to free any previously
4468 * allocated memory for the UUID list.
4469 */
4470 hci_discovery_filter_clear(hdev);
4471
82f8b651 4472 hdev->discovery.result_filtering = true;
66ea9427
JP		 4473 hdev->discovery.type = cp->type;
4474 hdev->discovery.rssi = cp->rssi;
4475 hdev->discovery.uuid_count = uuid_count;
4476
4477 if (uuid_count > 0) {
4478 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
4479 GFP_KERNEL);
4480 if (!hdev->discovery.uuids) {
2a1afb5a
JH		 4481 err = mgmt_cmd_complete(sk, hdev->id,
4482 MGMT_OP_START_SERVICE_DISCOVERY,
4483 MGMT_STATUS_FAILED,
4484 &cp->type, sizeof(cp->type));
d9483943
JH		 4485 mgmt_pending_remove(cmd);
4486 goto failed;
4487 }
66ea9427 4488 }
d9483943 4489
66ea9427 4490 hci_req_init(&req, hdev);
5e0452c0 4491
66ea9427 4492 if (!trigger_discovery(&req, &status)) {
2a1afb5a
JH		 4493 err = mgmt_cmd_complete(sk, hdev->id,
4494 MGMT_OP_START_SERVICE_DISCOVERY,
4495 status, &cp->type, sizeof(cp->type));
04106755
JH		 4496 mgmt_pending_remove(cmd);
4497 goto failed;
f39799f5 4498 }
3fd24153 4499
7c307720 4500 err = hci_req_run(&req, start_discovery_complete);
66ea9427 4501 if (err < 0) {
14a53664 4502 mgmt_pending_remove(cmd);
66ea9427
JP		 4503 goto failed;
4504 }
4505
4506 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
14a53664
JH		 4507
4508failed:
09fd0de5 4509 hci_dev_unlock(hdev);
14a53664
JH		 4510 return err;
4511}
4512
1904a853 4513static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1183fdca 4514{
3b0602cd 4515 struct mgmt_pending_cmd *cmd;
1183fdca 4516
0e05bba6
AG		 4517 BT_DBG("status %d", status);
4518
4519 hci_dev_lock(hdev);
4520
333ae95d 4521 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
11e6e25d 4522 if (cmd) {
2922a94f 4523 cmd->cmd_complete(cmd, mgmt_status(status));
11e6e25d 4524 mgmt_pending_remove(cmd);
0e05bba6
AG		 4525 }
4526
11e6e25d
MH		 4527 if (!status)
4528 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
0e05bba6 4529
0e05bba6
AG		 4530 hci_dev_unlock(hdev);
4531}
4532
bdb6d971 4533static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4534 u16 len)
14a53664 4535{
d930650b 4536 struct mgmt_cp_stop_discovery *mgmt_cp = data;
3b0602cd 4537 struct mgmt_pending_cmd *cmd;
0e05bba6 4538 struct hci_request req;
14a53664
JH		 4539 int err;
4540
bdb6d971 4541 BT_DBG("%s", hdev->name);
14a53664 4542
09fd0de5 4543 hci_dev_lock(hdev);
14a53664 4544
30dc78e1 4545 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4546 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4547 MGMT_STATUS_REJECTED, &mgmt_cp->type,
4548 sizeof(mgmt_cp->type));
d930650b
JH		 4549 goto unlock;
4550 }
4551
4552 if (hdev->discovery.type != mgmt_cp->type) {
2a1afb5a
JH		 4553 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
4554 MGMT_STATUS_INVALID_PARAMS,
4555 &mgmt_cp->type, sizeof(mgmt_cp->type));
30dc78e1 4556 goto unlock;
ff9ef578
JH		 4557 }
4558
2922a94f 4559 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len);
14a53664
JH		 4560 if (!cmd) {
4561 err = -ENOMEM;
30dc78e1
JH		 4562 goto unlock;
4563 }
4564
2922a94f
JH		 4565 cmd->cmd_complete = generic_cmd_complete;
4566
0e05bba6
AG		 4567 hci_req_init(&req, hdev);
4568
21a60d30 4569 hci_stop_discovery(&req);
e0d9727e 4570
21a60d30
JH		 4571 err = hci_req_run(&req, stop_discovery_complete);
4572 if (!err) {
4573 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
0e05bba6 4574 goto unlock;
14a53664
JH		 4575 }
4576
21a60d30
JH		 4577 mgmt_pending_remove(cmd);
4578
4579 /* If no HCI commands were sent we're done */
4580 if (err == -ENODATA) {
2a1afb5a
JH		 4581 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
4582 &mgmt_cp->type, sizeof(mgmt_cp->type));
21a60d30
JH		 4583 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
4584 }
14a53664 4585
30dc78e1 4586unlock:
09fd0de5 4587 hci_dev_unlock(hdev);
14a53664
JH		 4588 return err;
4589}
4590
bdb6d971 4591static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4592 u16 len)
561aafbc 4593{
650f726d 4594 struct mgmt_cp_confirm_name *cp = data;
561aafbc 4595 struct inquiry_entry *e;
561aafbc
JH		 4596 int err;
4597
bdb6d971 4598 BT_DBG("%s", hdev->name);
561aafbc 4599
561aafbc
JH		 4600 hci_dev_lock(hdev);
4601
30dc78e1 4602 if (!hci_discovery_active(hdev)) {
2a1afb5a
JH		 4603 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4604 MGMT_STATUS_FAILED, &cp->addr,
4605 sizeof(cp->addr));
30dc78e1
JH		 4606 goto failed;
4607 }
4608
a198e7b1 4609 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
561aafbc 4610 if (!e) {
2a1afb5a
JH		 4611 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
4612 MGMT_STATUS_INVALID_PARAMS, &cp->addr,
4613 sizeof(cp->addr));
561aafbc
JH		 4614 goto failed;
4615 }
4616
4617 if (cp->name_known) {
4618 e->name_state = NAME_KNOWN;
4619 list_del(&e->list);
4620 } else {
4621 e->name_state = NAME_NEEDED;
a3d4e20a 4622 hci_inquiry_cache_update_resolve(hdev, e);
561aafbc
JH		 4623 }
4624
2a1afb5a
JH		 4625 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
4626 &cp->addr, sizeof(cp->addr));
561aafbc
JH		 4627
4628failed:
4629 hci_dev_unlock(hdev);
561aafbc
JH		 4630 return err;
4631}
4632
bdb6d971 4633static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4634 u16 len)
7fbec224 4635{
650f726d 4636 struct mgmt_cp_block_device *cp = data;
f0eeea8b 4637 u8 status;
7fbec224
AJ		 4638 int err;
4639
bdb6d971 4640 BT_DBG("%s", hdev->name);
7fbec224 4641
4ee71b20 4642 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4643 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
4644 MGMT_STATUS_INVALID_PARAMS,
4645 &cp->addr, sizeof(cp->addr));
4ee71b20 4646
09fd0de5 4647 hci_dev_lock(hdev);
5e762444 4648
dcc36c16
JH		 4649 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr,
4650 cp->addr.type);
2a8357f2 4651 if (err < 0) {
f0eeea8b 4652 status = MGMT_STATUS_FAILED;
2a8357f2
JH		 4653 goto done;
4654 }
4655
4656 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4657 sk);
4658 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4659
2a8357f2 4660done:
2a1afb5a
JH		 4661 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
4662 &cp->addr, sizeof(cp->addr));
5e762444 4663
09fd0de5 4664 hci_dev_unlock(hdev);
7fbec224
AJ		 4665
4666 return err;
4667}
4668
bdb6d971 4669static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
04124681 4670 u16 len)
7fbec224 4671{
650f726d 4672 struct mgmt_cp_unblock_device *cp = data;
f0eeea8b 4673 u8 status;
7fbec224
AJ		 4674 int err;
4675
bdb6d971 4676 BT_DBG("%s", hdev->name);
7fbec224 4677
4ee71b20 4678 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 4679 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
4680 MGMT_STATUS_INVALID_PARAMS,
4681 &cp->addr, sizeof(cp->addr));
4ee71b20 4682
09fd0de5 4683 hci_dev_lock(hdev);
5e762444 4684
dcc36c16
JH		 4685 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr,
4686 cp->addr.type);
2a8357f2 4687 if (err < 0) {
f0eeea8b 4688 status = MGMT_STATUS_INVALID_PARAMS;
2a8357f2
JH		 4689 goto done;
4690 }
4691
4692 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr),
4693 sk);
4694 status = MGMT_STATUS_SUCCESS;
f0eeea8b 4695
2a8357f2 4696done:
2a1afb5a
JH		 4697 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
4698 &cp->addr, sizeof(cp->addr));
5e762444 4699
09fd0de5 4700 hci_dev_unlock(hdev);
7fbec224
AJ		 4701
4702 return err;
4703}
4704
cdbaccca
MH		 4705static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
4706 u16 len)
4707{
4708 struct mgmt_cp_set_device_id *cp = data;
890ea898 4709 struct hci_request req;
cdbaccca 4710 int err;
c72d4b8a 4711 __u16 source;
cdbaccca
MH		 4712
4713 BT_DBG("%s", hdev->name);
4714
c72d4b8a
SJ		 4715 source = __le16_to_cpu(cp->source);
4716
4717 if (source > 0x0002)
a69e8375
JH		 4718 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
4719 MGMT_STATUS_INVALID_PARAMS);
c72d4b8a 4720
cdbaccca
MH		 4721 hci_dev_lock(hdev);
4722
c72d4b8a 4723 hdev->devid_source = source;
cdbaccca
MH		 4724 hdev->devid_vendor = __le16_to_cpu(cp->vendor);
4725 hdev->devid_product = __le16_to_cpu(cp->product);
4726 hdev->devid_version = __le16_to_cpu(cp->version);
4727
2a1afb5a
JH		 4728 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
4729 NULL, 0);
cdbaccca 4730
890ea898
JH		 4731 hci_req_init(&req, hdev);
4732 update_eir(&req);
4733 hci_req_run(&req, NULL);
cdbaccca
MH		 4734
4735 hci_dev_unlock(hdev);
4736
4737 return err;
4738}
4739
24b4f38f
AU		 4740static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
4741 u16 opcode)
4742{
4743 BT_DBG("status %d", status);
4744}
4745
1904a853
MH		 4746static void set_advertising_complete(struct hci_dev *hdev, u8 status,
4747 u16 opcode)
4375f103
JH		 4748{
4749 struct cmd_lookup match = { NULL, hdev };
24b4f38f 4750 struct hci_request req;
7816b820
FG		 4751 u8 instance;
4752 struct adv_info *adv_instance;
4753 int err;
4375f103 4754
3ad67582
JK		 4755 hci_dev_lock(hdev);
4756
4375f103
JH		 4757 if (status) {
4758 u8 mgmt_err = mgmt_status(status);
4759
4760 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
4761 cmd_status_rsp, &mgmt_err);
3ad67582 4762 goto unlock;
4375f103
JH		 4763 }
4764
d7a5a11d 4765 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
a1536da2 4766 hci_dev_set_flag(hdev, HCI_ADVERTISING);
c93bd150 4767 else
a358dc11 4768 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
c93bd150 4769
4375f103
JH		 4770 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
4771 &match);
4772
4773 new_settings(hdev, match.sk);
4774
4775 if (match.sk)
4776 sock_put(match.sk);
3ad67582 4777
24b4f38f 4778 /* If "Set Advertising" was just disabled and instance advertising was
7816b820 4779 * set up earlier, then re-enable multi-instance advertising.
24b4f38f
AU		 4780 */
4781 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7816b820
FG		 4782 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) ||
4783 list_empty(&hdev->adv_instances))
24b4f38f
AU		 4784 goto unlock;
4785
7816b820
FG		 4786 instance = hdev->cur_adv_instance;
4787 if (!instance) {
4788 adv_instance = list_first_entry_or_null(&hdev->adv_instances,
4789 struct adv_info, list);
4790 if (!adv_instance)
4791 goto unlock;
4792
4793 instance = adv_instance->instance;
4794 }
4795
24b4f38f
AU		 4796 hci_req_init(&req, hdev);
4797
7816b820
FG		 4798 err = schedule_adv_instance(&req, instance, true);
4799
4800 if (!err)
4801 err = hci_req_run(&req, enable_advertising_instance);
24b4f38f 4802
7816b820 4803 if (err)
24b4f38f
AU		 4804 BT_ERR("Failed to re-configure advertising");
4805
3ad67582
JK		 4806unlock:
4807 hci_dev_unlock(hdev);
4375f103
JH		 4808}
4809
21b5187f
MH		 4810static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
4811 u16 len)
4375f103
JH		 4812{
4813 struct mgmt_mode *cp = data;
3b0602cd 4814 struct mgmt_pending_cmd *cmd;
4375f103 4815 struct hci_request req;
cc91cb04 4816 u8 val, status;
4375f103
JH		 4817 int err;
4818
4819 BT_DBG("request for %s", hdev->name);
4820
e6fe7986
JH		 4821 status = mgmt_le_support(hdev);
4822 if (status)
a69e8375
JH		 4823 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4824 status);
4375f103 4825
cc91cb04 4826 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 4827 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4828 MGMT_STATUS_INVALID_PARAMS);
4375f103
JH		 4829
4830 hci_dev_lock(hdev);
4831
4832 val = !!cp->val;
4375f103 4833
f74ca9b8
JH		 4834 /* The following conditions are ones which mean that we should
4835 * not do any HCI communication but directly send a mgmt
4836 * response to user space (after toggling the flag if
4837 * necessary).
4838 */
cc91cb04 4839 if (!hdev_is_powered(hdev) ||
d7a5a11d
MH		 4840 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
4841 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
e8bb6b97 4842 hci_conn_num(hdev, LE_LINK) > 0 ||
d7a5a11d 4843 (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
e8bb6b97 4844 hdev->le_scan_type == LE_SCAN_ACTIVE)) {
cc91cb04 4845 bool changed;
4375f103 4846
cc91cb04 4847 if (cp->val) {
238be788 4848 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
cc91cb04 4849 if (cp->val == 0x02)
a1536da2 4850 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4851 else
a358dc11 4852 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4853 } else {
a69d8927 4854 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
a358dc11 4855 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
4375f103
JH		 4856 }
4857
4858 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
4859 if (err < 0)
4860 goto unlock;
4861
4862 if (changed)
4863 err = new_settings(hdev, sk);
4864
4865 goto unlock;
4866 }
4867
333ae95d
JH		 4868 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
4869 pending_find(MGMT_OP_SET_LE, hdev)) {
a69e8375
JH		 4870 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
4871 MGMT_STATUS_BUSY);
4375f103
JH		 4872 goto unlock;
4873 }
4874
4875 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len);
4876 if (!cmd) {
4877 err = -ENOMEM;
4878 goto unlock;
4879 }
4880
4881 hci_req_init(&req, hdev);
4882
cc91cb04 4883 if (cp->val == 0x02)
a1536da2 4884 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4885 else
a358dc11 4886 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
cc91cb04 4887
7816b820
FG		 4888 cancel_adv_timeout(hdev);
4889
24b4f38f 4890 if (val) {
7816b820
FG		 4891 /* Switch to instance "0" for the Set Advertising setting.
4892 * We cannot use update_[adv|scan_rsp]_data() here as the
4893 * HCI_ADVERTISING flag is not yet set.
4894 */
efae002c
FG		 4895 update_inst_adv_data(&req, 0x00);
4896 update_inst_scan_rsp_data(&req, 0x00);
bba3aa55 4897 enable_advertising(&req);
24b4f38f 4898 } else {
bba3aa55 4899 disable_advertising(&req);
24b4f38f 4900 }
4375f103
JH		 4901
4902 err = hci_req_run(&req, set_advertising_complete);
4903 if (err < 0)
4904 mgmt_pending_remove(cmd);
4905
4906unlock:
4907 hci_dev_unlock(hdev);
4908 return err;
4909}
4910
d13eafce
MH		 4911static int set_static_address(struct sock *sk, struct hci_dev *hdev,
4912 void *data, u16 len)
4913{
4914 struct mgmt_cp_set_static_address *cp = data;
4915 int err;
4916
4917 BT_DBG("%s", hdev->name);
4918
62af4443 4919 if (!lmp_le_capable(hdev))
a69e8375
JH		 4920 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4921 MGMT_STATUS_NOT_SUPPORTED);
d13eafce
MH		 4922
4923 if (hdev_is_powered(hdev))
a69e8375
JH		 4924 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
4925 MGMT_STATUS_REJECTED);
d13eafce
MH		 4926
4927 if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
4928 if (!bacmp(&cp->bdaddr, BDADDR_NONE))
a69e8375
JH		 4929 return mgmt_cmd_status(sk, hdev->id,
4930 MGMT_OP_SET_STATIC_ADDRESS,
4931 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4932
4933 /* Two most significant bits shall be set */
4934 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
a69e8375
JH		 4935 return mgmt_cmd_status(sk, hdev->id,
4936 MGMT_OP_SET_STATIC_ADDRESS,
4937 MGMT_STATUS_INVALID_PARAMS);
d13eafce
MH		 4938 }
4939
4940 hci_dev_lock(hdev);
4941
4942 bacpy(&hdev->static_addr, &cp->bdaddr);
4943
93690c22
MH		 4944 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
4945 if (err < 0)
4946 goto unlock;
4947
4948 err = new_settings(hdev, sk);
d13eafce 4949
93690c22 4950unlock:
d13eafce 4951 hci_dev_unlock(hdev);
d13eafce
MH		 4952 return err;
4953}
4954
14b49b9a
MH		 4955static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
4956 void *data, u16 len)
4957{
4958 struct mgmt_cp_set_scan_params *cp = data;
4959 __u16 interval, window;
4960 int err;
4961
4962 BT_DBG("%s", hdev->name);
4963
4964 if (!lmp_le_capable(hdev))
a69e8375
JH		 4965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4966 MGMT_STATUS_NOT_SUPPORTED);
14b49b9a
MH		 4967
4968 interval = __le16_to_cpu(cp->interval);
4969
4970 if (interval < 0x0004 || interval > 0x4000)
a69e8375
JH		 4971 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4972 MGMT_STATUS_INVALID_PARAMS);
14b49b9a
MH		 4973
4974 window = __le16_to_cpu(cp->window);
4975
4976 if (window < 0x0004 || window > 0x4000)
a69e8375
JH		 4977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4978 MGMT_STATUS_INVALID_PARAMS);
14b49b9a 4979
899e1075 4980 if (window > interval)
a69e8375
JH		 4981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
4982 MGMT_STATUS_INVALID_PARAMS);
899e1075 4983
14b49b9a
MH		 4984 hci_dev_lock(hdev);
4985
4986 hdev->le_scan_interval = interval;
4987 hdev->le_scan_window = window;
4988
2a1afb5a
JH		 4989 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
4990 NULL, 0);
14b49b9a 4991
dd2ef8e2
AG		 4992 /* If background scan is running, restart it so new parameters are
4993 * loaded.
4994 */
d7a5a11d 4995 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
dd2ef8e2
AG		 4996 hdev->discovery.state == DISCOVERY_STOPPED) {
4997 struct hci_request req;
4998
4999 hci_req_init(&req, hdev);
5000
5001 hci_req_add_le_scan_disable(&req);
5002 hci_req_add_le_passive_scan(&req);
5003
5004 hci_req_run(&req, NULL);
5005 }
5006
14b49b9a
MH		 5007 hci_dev_unlock(hdev);
5008
5009 return err;
5010}
5011
1904a853
MH		 5012static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
5013 u16 opcode)
33e38b3e 5014{
3b0602cd 5015 struct mgmt_pending_cmd *cmd;
33e38b3e
JH		 5016
5017 BT_DBG("status 0x%02x", status);
5018
5019 hci_dev_lock(hdev);
5020
333ae95d 5021 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
33e38b3e
JH		 5022 if (!cmd)
5023 goto unlock;
5024
5025 if (status) {
a69e8375
JH		 5026 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5027 mgmt_status(status));
33e38b3e 5028 } else {
1a4d3c4b
JH		 5029 struct mgmt_mode *cp = cmd->param;
5030
5031 if (cp->val)
a1536da2 5032 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5033 else
a358dc11 5034 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
1a4d3c4b 5035
33e38b3e
JH		 5036 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
5037 new_settings(hdev, cmd->sk);
5038 }
5039
5040 mgmt_pending_remove(cmd);
5041
5042unlock:
5043 hci_dev_unlock(hdev);
5044}
5045
bdb6d971 5046static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
04124681 5047 void *data, u16 len)
f6422ec6 5048{
650f726d 5049 struct mgmt_mode *cp = data;
3b0602cd 5050 struct mgmt_pending_cmd *cmd;
33e38b3e 5051 struct hci_request req;
f6422ec6
AJ		 5052 int err;
5053
bdb6d971 5054 BT_DBG("%s", hdev->name);
f6422ec6 5055
d7a5a11d 5056 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
56f87901 5057 hdev->hci_ver < BLUETOOTH_VER_1_2)
a69e8375
JH		 5058 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5059 MGMT_STATUS_NOT_SUPPORTED);
33c525c0 5060
a7e80f25 5061 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5062 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5063 MGMT_STATUS_INVALID_PARAMS);
a7e80f25 5064
f6422ec6
AJ		 5065 hci_dev_lock(hdev);
5066
333ae95d 5067 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
a69e8375
JH		 5068 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5069 MGMT_STATUS_BUSY);
05cbf29f
JH		 5070 goto unlock;
5071 }
5072
d7a5a11d 5073 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
1a4d3c4b
JH		 5074 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5075 hdev);
5076 goto unlock;
5077 }
5078
406ef2a6 5079 if (!hdev_is_powered(hdev)) {
ce05d603 5080 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
406ef2a6
JH		 5081 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
5082 hdev);
5083 new_settings(hdev, sk);
5084 goto unlock;
5085 }
5086
33e38b3e
JH		 5087 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev,
5088 data, len);
5089 if (!cmd) {
5090 err = -ENOMEM;
5091 goto unlock;
f6422ec6
AJ		 5092 }
5093
33e38b3e
JH		 5094 hci_req_init(&req, hdev);
5095
406d7804 5096 write_fast_connectable(&req, cp->val);
33e38b3e
JH		 5097
5098 err = hci_req_run(&req, fast_connectable_complete);
f6422ec6 5099 if (err < 0) {
a69e8375
JH		 5100 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
5101 MGMT_STATUS_FAILED);
33e38b3e 5102 mgmt_pending_remove(cmd);
f6422ec6
AJ		 5103 }
5104
33e38b3e 5105unlock:
f6422ec6 5106 hci_dev_unlock(hdev);
33e38b3e 5107
f6422ec6
AJ		 5108 return err;
5109}
5110
1904a853 5111static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
0663ca2a 5112{
3b0602cd 5113 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5114
5115 BT_DBG("status 0x%02x", status);
5116
5117 hci_dev_lock(hdev);
5118
333ae95d 5119 cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
0663ca2a
JH		 5120 if (!cmd)
5121 goto unlock;
5122
5123 if (status) {
5124 u8 mgmt_err = mgmt_status(status);
5125
5126 /* We need to restore the flag if related HCI commands
5127 * failed.
5128 */
a358dc11 5129 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a 5130
a69e8375 5131 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
0663ca2a
JH		 5132 } else {
5133 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
5134 new_settings(hdev, cmd->sk);
5135 }
5136
5137 mgmt_pending_remove(cmd);
5138
5139unlock:
5140 hci_dev_unlock(hdev);
5141}
5142
5143static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
5144{
5145 struct mgmt_mode *cp = data;
3b0602cd 5146 struct mgmt_pending_cmd *cmd;
0663ca2a
JH		 5147 struct hci_request req;
5148 int err;
5149
5150 BT_DBG("request for %s", hdev->name);
5151
5152 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
a69e8375
JH		 5153 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5154 MGMT_STATUS_NOT_SUPPORTED);
0663ca2a 5155
d7a5a11d 5156 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5157 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5158 MGMT_STATUS_REJECTED);
0663ca2a
JH		 5159
5160 if (cp->val != 0x00 && cp->val != 0x01)
a69e8375
JH		 5161 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5162 MGMT_STATUS_INVALID_PARAMS);
0663ca2a
JH		 5163
5164 hci_dev_lock(hdev);
5165
d7a5a11d 5166 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
0663ca2a
JH		 5167 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5168 goto unlock;
5169 }
5170
5171 if (!hdev_is_powered(hdev)) {
5172 if (!cp->val) {
a358dc11
MH		 5173 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5174 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
5175 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
5176 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
5177 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
0663ca2a
JH		 5178 }
5179
ce05d603 5180 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5181
5182 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
5183 if (err < 0)
5184 goto unlock;
5185
5186 err = new_settings(hdev, sk);
5187 goto unlock;
5188 }
5189
5190 /* Reject disabling when powered on */
5191 if (!cp->val) {
a69e8375
JH		 5192 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5193 MGMT_STATUS_REJECTED);
0663ca2a 5194 goto unlock;
111e4bcc
MH		 5195 } else {
5196 /* When configuring a dual-mode controller to operate
5197 * with LE only and using a static address, then switching
5198 * BR/EDR back on is not allowed.
5199 *
5200 * Dual-mode controllers shall operate with the public
5201 * address as its identity address for BR/EDR and LE. So
5202 * reject the attempt to create an invalid configuration.
3a5486e1
MH		 5203 *
5204 * The same restrictions applies when secure connections
5205 * has been enabled. For BR/EDR this is a controller feature
5206 * while for LE it is a host stack feature. This means that
5207 * switching BR/EDR back on when secure connections has been
5208 * enabled is not a supported transaction.
111e4bcc 5209 */
d7a5a11d 5210 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3a5486e1 5211 (bacmp(&hdev->static_addr, BDADDR_ANY) ||
d7a5a11d 5212 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
a69e8375
JH		 5213 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5214 MGMT_STATUS_REJECTED);
111e4bcc
MH		 5215 goto unlock;
5216 }
0663ca2a
JH		 5217 }
5218
333ae95d 5219 if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
a69e8375
JH		 5220 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
5221 MGMT_STATUS_BUSY);
0663ca2a
JH		 5222 goto unlock;
5223 }
5224
5225 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len);
5226 if (!cmd) {
5227 err = -ENOMEM;
5228 goto unlock;
5229 }
5230
5947f4bc 5231 /* We need to flip the bit already here so that update_adv_data
0663ca2a
JH		 5232 * generates the correct flags.
5233 */
a1536da2 5234 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
0663ca2a
JH		 5235
5236 hci_req_init(&req, hdev);
aa8af46e 5237
432df05e 5238 write_fast_connectable(&req, false);
1d2dc5b7 5239 __hci_update_page_scan(&req);
aa8af46e 5240
f14d8f64
MH		 5241 /* Since only the advertising data flags will change, there
5242 * is no need to update the scan response data.
5243 */
5947f4bc 5244 update_adv_data(&req);
aa8af46e 5245
0663ca2a
JH		 5246 err = hci_req_run(&req, set_bredr_complete);
5247 if (err < 0)
5248 mgmt_pending_remove(cmd);
5249
5250unlock:
5251 hci_dev_unlock(hdev);
5252 return err;
5253}
5254
a1443f5a
JH		 5255static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5256{
3b0602cd 5257 struct mgmt_pending_cmd *cmd;
a1443f5a
JH		 5258 struct mgmt_mode *cp;
5259
5260 BT_DBG("%s status %u", hdev->name, status);
5261
5262 hci_dev_lock(hdev);
5263
333ae95d 5264 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
a1443f5a
JH		 5265 if (!cmd)
5266 goto unlock;
5267
5268 if (status) {
a69e8375
JH		 5269 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
5270 mgmt_status(status));
a1443f5a
JH		 5271 goto remove;
5272 }
5273
5274 cp = cmd->param;
5275
5276 switch (cp->val) {
5277 case 0x00:
a358dc11
MH		 5278 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
5279 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5280 break;
5281 case 0x01:
a1536da2 5282 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
a358dc11 5283 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5284 break;
5285 case 0x02:
a1536da2
MH		 5286 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
5287 hci_dev_set_flag(hdev, HCI_SC_ONLY);
a1443f5a
JH		 5288 break;
5289 }
5290
5291 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev);
5292 new_settings(hdev, cmd->sk);
5293
5294remove:
5295 mgmt_pending_remove(cmd);
5296unlock:
5297 hci_dev_unlock(hdev);
5298}
5299
eac83dc6
MH		 5300static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
5301 void *data, u16 len)
5302{
5303 struct mgmt_mode *cp = data;
3b0602cd 5304 struct mgmt_pending_cmd *cmd;
a1443f5a 5305 struct hci_request req;
a3209694 5306 u8 val;
eac83dc6
MH		 5307 int err;
5308
5309 BT_DBG("request for %s", hdev->name);
5310
05b3c3e7 5311 if (!lmp_sc_capable(hdev) &&
d7a5a11d 5312 !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
a69e8375
JH		 5313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5314 MGMT_STATUS_NOT_SUPPORTED);
eac83dc6 5315
d7a5a11d 5316 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
59200286 5317 lmp_sc_capable(hdev) &&
d7a5a11d 5318 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
a69e8375
JH		 5319 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5320 MGMT_STATUS_REJECTED);
ed93ec69 5321
0ab04a9c 5322 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375 5323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
eac83dc6
MH		 5324 MGMT_STATUS_INVALID_PARAMS);
5325
5326 hci_dev_lock(hdev);
5327
05b3c3e7 5328 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
d7a5a11d 5329 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
eac83dc6
MH		 5330 bool changed;
5331
0ab04a9c 5332 if (cp->val) {
238be788
MH		 5333 changed = !hci_dev_test_and_set_flag(hdev,
5334 HCI_SC_ENABLED);
0ab04a9c 5335 if (cp->val == 0x02)
a1536da2 5336 hci_dev_set_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5337 else
a358dc11 5338 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5339 } else {
a69d8927
MH		 5340 changed = hci_dev_test_and_clear_flag(hdev,
5341 HCI_SC_ENABLED);
a358dc11 5342 hci_dev_clear_flag(hdev, HCI_SC_ONLY);
0ab04a9c 5343 }
eac83dc6
MH		 5344
5345 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5346 if (err < 0)
5347 goto failed;
5348
5349 if (changed)
5350 err = new_settings(hdev, sk);
5351
5352 goto failed;
5353 }
5354
333ae95d 5355 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
a69e8375
JH		 5356 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
5357 MGMT_STATUS_BUSY);
eac83dc6
MH		 5358 goto failed;
5359 }
5360
0ab04a9c
MH		 5361 val = !!cp->val;
5362
d7a5a11d
MH		 5363 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
5364 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
eac83dc6
MH		 5365 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
5366 goto failed;
5367 }
5368
5369 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len);
5370 if (!cmd) {
5371 err = -ENOMEM;
5372 goto failed;
5373 }
5374
a1443f5a
JH		 5375 hci_req_init(&req, hdev);
5376 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val);
5377 err = hci_req_run(&req, sc_enable_complete);
eac83dc6
MH		 5378 if (err < 0) {
5379 mgmt_pending_remove(cmd);
5380 goto failed;
5381 }
5382
5383failed:
5384 hci_dev_unlock(hdev);
5385 return err;
5386}
5387
4e39ac81
MH		 5388static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
5389 void *data, u16 len)
5390{
5391 struct mgmt_mode *cp = data;
b9710979 5392 bool changed, use_changed;
4e39ac81
MH		 5393 int err;
5394
5395 BT_DBG("request for %s", hdev->name);
5396
b9710979 5397 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
a69e8375
JH		 5398 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
5399 MGMT_STATUS_INVALID_PARAMS);
4e39ac81
MH		 5400
5401 hci_dev_lock(hdev);
5402
5403 if (cp->val)
238be788 5404 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
4e39ac81 5405 else
a69d8927
MH		 5406 changed = hci_dev_test_and_clear_flag(hdev,
5407 HCI_KEEP_DEBUG_KEYS);
4e39ac81 5408
b9710979 5409 if (cp->val == 0x02)
238be788
MH		 5410 use_changed = !hci_dev_test_and_set_flag(hdev,
5411 HCI_USE_DEBUG_KEYS);
b9710979 5412 else
a69d8927
MH		 5413 use_changed = hci_dev_test_and_clear_flag(hdev,
5414 HCI_USE_DEBUG_KEYS);
b9710979
JH		 5415
5416 if (hdev_is_powered(hdev) && use_changed &&
d7a5a11d 5417 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
b9710979
JH		 5418 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
5419 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
5420 sizeof(mode), &mode);
5421 }
5422
4e39ac81
MH		 5423 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev);
5424 if (err < 0)
5425 goto unlock;
5426
5427 if (changed)
5428 err = new_settings(hdev, sk);
5429
5430unlock:
5431 hci_dev_unlock(hdev);
5432 return err;
5433}
5434
62b04cd1
JH		 5435static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5436 u16 len)
5437{
5438 struct mgmt_cp_set_privacy *cp = cp_data;
5439 bool changed;
5440 int err;
5441
5442 BT_DBG("request for %s", hdev->name);
5443
5444 if (!lmp_le_capable(hdev))
a69e8375
JH		 5445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5446 MGMT_STATUS_NOT_SUPPORTED);
62b04cd1
JH		 5447
5448 if (cp->privacy != 0x00 && cp->privacy != 0x01)
a69e8375
JH		 5449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5450 MGMT_STATUS_INVALID_PARAMS);
62b04cd1
JH		 5451
5452 if (hdev_is_powered(hdev))
a69e8375
JH		 5453 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
5454 MGMT_STATUS_REJECTED);
62b04cd1
JH		 5455
5456 hci_dev_lock(hdev);
5457
c21c0ea0
JH		 5458 /* If user space supports this command it is also expected to
5459 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
5460 */
a1536da2 5461 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
c21c0ea0 5462
62b04cd1 5463 if (cp->privacy) {
238be788 5464 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
62b04cd1 5465 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
a1536da2 5466 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1 5467 } else {
a69d8927 5468 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
62b04cd1 5469 memset(hdev->irk, 0, sizeof(hdev->irk));
a358dc11 5470 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
62b04cd1
JH		 5471 }
5472
5473 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
5474 if (err < 0)
5475 goto unlock;
5476
5477 if (changed)
5478 err = new_settings(hdev, sk);
5479
5480unlock:
5481 hci_dev_unlock(hdev);
5482 return err;
5483}
5484
41edf160
JH		 5485static bool irk_is_valid(struct mgmt_irk_info *irk)
5486{
5487 switch (irk->addr.type) {
5488 case BDADDR_LE_PUBLIC:
5489 return true;
5490
5491 case BDADDR_LE_RANDOM:
5492 /* Two most significant bits shall be set */
5493 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5494 return false;
5495 return true;
5496 }
5497
5498 return false;
5499}
5500
5501static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
5502 u16 len)
5503{
5504 struct mgmt_cp_load_irks *cp = cp_data;
ba1d6936
JH		 5505 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) /
5506 sizeof(struct mgmt_irk_info));
41edf160
JH		 5507 u16 irk_count, expected_len;
5508 int i, err;
5509
5510 BT_DBG("request for %s", hdev->name);
5511
5512 if (!lmp_le_capable(hdev))
a69e8375
JH		 5513 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5514 MGMT_STATUS_NOT_SUPPORTED);
41edf160
JH		 5515
5516 irk_count = __le16_to_cpu(cp->irk_count);
ba1d6936
JH		 5517 if (irk_count > max_irk_count) {
5518 BT_ERR("load_irks: too big irk_count value %u", irk_count);
a69e8375
JH		 5519 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5520 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5521 }
41edf160
JH		 5522
5523 expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
5524 if (expected_len != len) {
5525 BT_ERR("load_irks: expected %u bytes, got %u bytes",
2606ecbc 5526 expected_len, len);
a69e8375
JH		 5527 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
5528 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5529 }
5530
5531 BT_DBG("%s irk_count %u", hdev->name, irk_count);
5532
5533 for (i = 0; i < irk_count; i++) {
5534 struct mgmt_irk_info *key = &cp->irks[i];
5535
5536 if (!irk_is_valid(key))
a69e8375
JH		 5537 return mgmt_cmd_status(sk, hdev->id,
5538 MGMT_OP_LOAD_IRKS,
5539 MGMT_STATUS_INVALID_PARAMS);
41edf160
JH		 5540 }
5541
5542 hci_dev_lock(hdev);
5543
5544 hci_smp_irks_clear(hdev);
5545
5546 for (i = 0; i < irk_count; i++) {
5547 struct mgmt_irk_info *irk = &cp->irks[i];
5548 u8 addr_type;
5549
5550 if (irk->addr.type == BDADDR_LE_PUBLIC)
5551 addr_type = ADDR_LE_DEV_PUBLIC;
5552 else
5553 addr_type = ADDR_LE_DEV_RANDOM;
5554
5555 hci_add_irk(hdev, &irk->addr.bdaddr, addr_type, irk->val,
5556 BDADDR_ANY);
5557 }
5558
a1536da2 5559 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
41edf160 5560
2a1afb5a 5561 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
41edf160
JH		 5562
5563 hci_dev_unlock(hdev);
5564
5565 return err;
5566}
5567
3f706b72
JH		 5568static bool ltk_is_valid(struct mgmt_ltk_info *key)
5569{
5570 if (key->master != 0x00 && key->master != 0x01)
5571 return false;
490cb0b3
MH		 5572
5573 switch (key->addr.type) {
5574 case BDADDR_LE_PUBLIC:
5575 return true;
5576
5577 case BDADDR_LE_RANDOM:
5578 /* Two most significant bits shall be set */
5579 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0)
5580 return false;
5581 return true;
5582 }
5583
5584 return false;
3f706b72
JH		 5585}
5586
bdb6d971 5587static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
04124681 5588 void *cp_data, u16 len)
346af67b 5589{
346af67b 5590 struct mgmt_cp_load_long_term_keys *cp = cp_data;
ba1d6936
JH		 5591 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) /
5592 sizeof(struct mgmt_ltk_info));
346af67b 5593 u16 key_count, expected_len;
715a5bf2 5594 int i, err;
346af67b 5595
cf99ba13
MH		 5596 BT_DBG("request for %s", hdev->name);
5597
5598 if (!lmp_le_capable(hdev))
a69e8375
JH		 5599 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5600 MGMT_STATUS_NOT_SUPPORTED);
cf99ba13 5601
1f350c87 5602 key_count = __le16_to_cpu(cp->key_count);
ba1d6936
JH		 5603 if (key_count > max_key_count) {
5604 BT_ERR("load_ltks: too big key_count value %u", key_count);
a69e8375
JH		 5605 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5606 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 5607 }
346af67b
VCG		 5608
5609 expected_len = sizeof(*cp) + key_count *
5610 sizeof(struct mgmt_ltk_info);
5611 if (expected_len != len) {
5612 BT_ERR("load_keys: expected %u bytes, got %u bytes",
2606ecbc 5613 expected_len, len);
a69e8375
JH		 5614 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
5615 MGMT_STATUS_INVALID_PARAMS);
346af67b
VCG		 5616 }
5617
bdb6d971 5618 BT_DBG("%s key_count %u", hdev->name, key_count);
346af67b 5619
54ad6d8a
JH		 5620 for (i = 0; i < key_count; i++) {
5621 struct mgmt_ltk_info *key = &cp->keys[i];
5622
3f706b72 5623 if (!ltk_is_valid(key))
a69e8375
JH		 5624 return mgmt_cmd_status(sk, hdev->id,
5625 MGMT_OP_LOAD_LONG_TERM_KEYS,
5626 MGMT_STATUS_INVALID_PARAMS);
54ad6d8a
JH		 5627 }
5628
346af67b
VCG		 5629 hci_dev_lock(hdev);
5630
5631 hci_smp_ltks_clear(hdev);
5632
5633 for (i = 0; i < key_count; i++) {
5634 struct mgmt_ltk_info *key = &cp->keys[i];
d7b25450 5635 u8 type, addr_type, authenticated;
79d95a19
MH		 5636
5637 if (key->addr.type == BDADDR_LE_PUBLIC)
5638 addr_type = ADDR_LE_DEV_PUBLIC;
5639 else
5640 addr_type = ADDR_LE_DEV_RANDOM;
346af67b 5641
61b43357
JH		 5642 switch (key->type) {
5643 case MGMT_LTK_UNAUTHENTICATED:
d7b25450 5644 authenticated = 0x00;
23fb8de3 5645 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
61b43357
JH		 5646 break;
5647 case MGMT_LTK_AUTHENTICATED:
d7b25450 5648 authenticated = 0x01;
23fb8de3
JH		 5649 type = key->master ? SMP_LTK : SMP_LTK_SLAVE;
5650 break;
5651 case MGMT_LTK_P256_UNAUTH:
5652 authenticated = 0x00;
5653 type = SMP_LTK_P256;
61b43357 5654 break;
23fb8de3
JH		 5655 case MGMT_LTK_P256_AUTH:
5656 authenticated = 0x01;
5657 type = SMP_LTK_P256;
61b43357 5658 break;
23fb8de3
JH		 5659 case MGMT_LTK_P256_DEBUG:
5660 authenticated = 0x00;
5661 type = SMP_LTK_P256_DEBUG;
61b43357
JH		 5662 default:
5663 continue;
5664 }
d7b25450 5665
35d70271 5666 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
d7b25450 5667 authenticated, key->val, key->enc_size, key->ediv,
35d70271 5668 key->rand);
346af67b
VCG		 5669 }
5670
2a1afb5a 5671 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
715a5bf2
JH		 5672 NULL, 0);
5673
346af67b 5674 hci_dev_unlock(hdev);
346af67b 5675
715a5bf2 5676 return err;
346af67b
VCG		 5677}
5678
3b0602cd 5679static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
dd983808 5680{
dd983808 5681 struct hci_conn *conn = cmd->user_data;
9981bdb0 5682 struct mgmt_rp_get_conn_info rp;
9df74653 5683 int err;
dd983808 5684
9981bdb0 5685 memcpy(&rp.addr, cmd->param, sizeof(rp.addr));
dd983808 5686
9981bdb0 5687 if (status == MGMT_STATUS_SUCCESS) {
dd983808 5688 rp.rssi = conn->rssi;
9981bdb0
JH		 5689 rp.tx_power = conn->tx_power;
5690 rp.max_tx_power = conn->max_tx_power;
5691 } else {
5692 rp.rssi = HCI_RSSI_INVALID;
5693 rp.tx_power = HCI_TX_POWER_INVALID;
5694 rp.max_tx_power = HCI_TX_POWER_INVALID;
dd983808
AK		 5695 }
5696
2a1afb5a
JH		 5697 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
5698 status, &rp, sizeof(rp));
dd983808
AK		 5699
5700 hci_conn_drop(conn);
f8aaf9b6 5701 hci_conn_put(conn);
9df74653
JH		 5702
5703 return err;
dd983808
AK		 5704}
5705
1904a853
MH		 5706static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
5707 u16 opcode)
dd983808
AK		 5708{
5709 struct hci_cp_read_rssi *cp;
3b0602cd 5710 struct mgmt_pending_cmd *cmd;
dd983808 5711 struct hci_conn *conn;
dd983808 5712 u16 handle;
9981bdb0 5713 u8 status;
dd983808 5714
9981bdb0 5715 BT_DBG("status 0x%02x", hci_status);
dd983808
AK		 5716
5717 hci_dev_lock(hdev);
5718
dd983808
AK		 5719 /* Commands sent in request are either Read RSSI or Read Transmit Power
5720 * Level so we check which one was last sent to retrieve connection
5721 * handle. Both commands have handle as first parameter so it's safe to
5722 * cast data on the same command struct.
5723 *
5724 * First command sent is always Read RSSI and we fail only if it fails.
5725 * In other case we simply override error to indicate success as we
5726 * already remembered if TX power value is actually valid.
5727 */
5728 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
5729 if (!cp) {
5730 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
9981bdb0
JH		 5731 status = MGMT_STATUS_SUCCESS;
5732 } else {
5733 status = mgmt_status(hci_status);
dd983808
AK		 5734 }
5735
5736 if (!cp) {
9981bdb0 5737 BT_ERR("invalid sent_cmd in conn_info response");
dd983808
AK		 5738 goto unlock;
5739 }
5740
5741 handle = __le16_to_cpu(cp->handle);
5742 conn = hci_conn_hash_lookup_handle(hdev, handle);
5743 if (!conn) {
9981bdb0 5744 BT_ERR("unknown handle (%d) in conn_info response", handle);
dd983808
AK		 5745 goto unlock;
5746 }
5747
333ae95d 5748 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
9981bdb0
JH		 5749 if (!cmd)
5750 goto unlock;
dd983808 5751
9981bdb0
JH		 5752 cmd->cmd_complete(cmd, status);
5753 mgmt_pending_remove(cmd);
dd983808
AK		 5754
5755unlock:
5756 hci_dev_unlock(hdev);
5757}
5758
5759static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
5760 u16 len)
5761{
5762 struct mgmt_cp_get_conn_info *cp = data;
5763 struct mgmt_rp_get_conn_info rp;
5764 struct hci_conn *conn;
5765 unsigned long conn_info_age;
5766 int err = 0;
5767
5768 BT_DBG("%s", hdev->name);
5769
5770 memset(&rp, 0, sizeof(rp));
5771 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5772 rp.addr.type = cp->addr.type;
5773
5774 if (!bdaddr_type_is_valid(cp->addr.type))
2a1afb5a
JH		 5775 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5776 MGMT_STATUS_INVALID_PARAMS,
5777 &rp, sizeof(rp));
dd983808
AK		 5778
5779 hci_dev_lock(hdev);
5780
5781 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5782 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5783 MGMT_STATUS_NOT_POWERED, &rp,
5784 sizeof(rp));
dd983808
AK		 5785 goto unlock;
5786 }
5787
5788 if (cp->addr.type == BDADDR_BREDR)
5789 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5790 &cp->addr.bdaddr);
5791 else
5792 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
5793
5794 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5795 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5796 MGMT_STATUS_NOT_CONNECTED, &rp,
5797 sizeof(rp));
dd983808
AK		 5798 goto unlock;
5799 }
5800
333ae95d 5801 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
2a1afb5a
JH		 5802 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5803 MGMT_STATUS_BUSY, &rp, sizeof(rp));
9981bdb0
JH		 5804 goto unlock;
5805 }
5806
dd983808
AK		 5807 /* To avoid client trying to guess when to poll again for information we
5808 * calculate conn info age as random value between min/max set in hdev.
5809 */
5810 conn_info_age = hdev->conn_info_min_age +
5811 prandom_u32_max(hdev->conn_info_max_age -
5812 hdev->conn_info_min_age);
5813
5814 /* Query controller to refresh cached values if they are too old or were
5815 * never read.
5816 */
f4e2dd53
AK		 5817 if (time_after(jiffies, conn->conn_info_timestamp +
5818 msecs_to_jiffies(conn_info_age)) ||
dd983808
AK		 5819 !conn->conn_info_timestamp) {
5820 struct hci_request req;
5821 struct hci_cp_read_tx_power req_txp_cp;
5822 struct hci_cp_read_rssi req_rssi_cp;
3b0602cd 5823 struct mgmt_pending_cmd *cmd;
dd983808
AK		 5824
5825 hci_req_init(&req, hdev);
5826 req_rssi_cp.handle = cpu_to_le16(conn->handle);
5827 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
5828 &req_rssi_cp);
5829
f7faab0c
AK		 5830 /* For LE links TX power does not change thus we don't need to
5831 * query for it once value is known.
5832 */
5833 if (!bdaddr_type_is_le(cp->addr.type) ||
5834 conn->tx_power == HCI_TX_POWER_INVALID) {
5835 req_txp_cp.handle = cpu_to_le16(conn->handle);
5836 req_txp_cp.type = 0x00;
5837 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5838 sizeof(req_txp_cp), &req_txp_cp);
5839 }
dd983808 5840
eed5daf3
AK		 5841 /* Max TX power needs to be read only once per connection */
5842 if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
5843 req_txp_cp.handle = cpu_to_le16(conn->handle);
5844 req_txp_cp.type = 0x01;
5845 hci_req_add(&req, HCI_OP_READ_TX_POWER,
5846 sizeof(req_txp_cp), &req_txp_cp);
5847 }
5848
dd983808
AK		 5849 err = hci_req_run(&req, conn_info_refresh_complete);
5850 if (err < 0)
5851 goto unlock;
5852
5853 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
5854 data, len);
5855 if (!cmd) {
5856 err = -ENOMEM;
5857 goto unlock;
5858 }
5859
5860 hci_conn_hold(conn);
f8aaf9b6 5861 cmd->user_data = hci_conn_get(conn);
9981bdb0 5862 cmd->cmd_complete = conn_info_cmd_complete;
dd983808
AK		 5863
5864 conn->conn_info_timestamp = jiffies;
5865 } else {
5866 /* Cache is valid, just reply with values cached in hci_conn */
5867 rp.rssi = conn->rssi;
5868 rp.tx_power = conn->tx_power;
eed5daf3 5869 rp.max_tx_power = conn->max_tx_power;
dd983808 5870
2a1afb5a
JH		 5871 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
5872 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
dd983808
AK		 5873 }
5874
5875unlock:
5876 hci_dev_unlock(hdev);
5877 return err;
5878}
5879
3b0602cd 5880static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
95868426 5881{
69487371 5882 struct hci_conn *conn = cmd->user_data;
95868426 5883 struct mgmt_rp_get_clock_info rp;
69487371 5884 struct hci_dev *hdev;
9df74653 5885 int err;
69487371
JH		 5886
5887 memset(&rp, 0, sizeof(rp));
5888 memcpy(&rp.addr, &cmd->param, sizeof(rp.addr));
5889
5890 if (status)
5891 goto complete;
5892
5893 hdev = hci_dev_get(cmd->index);
5894 if (hdev) {
5895 rp.local_clock = cpu_to_le32(hdev->clock);
5896 hci_dev_put(hdev);
5897 }
5898
5899 if (conn) {
5900 rp.piconet_clock = cpu_to_le32(conn->clock);
5901 rp.accuracy = cpu_to_le16(conn->clock_accuracy);
5902 }
5903
5904complete:
2a1afb5a
JH		 5905 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
5906 sizeof(rp));
69487371
JH		 5907
5908 if (conn) {
5909 hci_conn_drop(conn);
5910 hci_conn_put(conn);
5911 }
9df74653
JH		 5912
5913 return err;
69487371
JH		 5914}
5915
1904a853 5916static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
69487371 5917{
95868426 5918 struct hci_cp_read_clock *hci_cp;
3b0602cd 5919 struct mgmt_pending_cmd *cmd;
95868426
JH		 5920 struct hci_conn *conn;
5921
5922 BT_DBG("%s status %u", hdev->name, status);
5923
5924 hci_dev_lock(hdev);
5925
5926 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
5927 if (!hci_cp)
5928 goto unlock;
5929
5930 if (hci_cp->which) {
5931 u16 handle = __le16_to_cpu(hci_cp->handle);
5932 conn = hci_conn_hash_lookup_handle(hdev, handle);
5933 } else {
5934 conn = NULL;
5935 }
5936
333ae95d 5937 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
95868426
JH		 5938 if (!cmd)
5939 goto unlock;
5940
69487371 5941 cmd->cmd_complete(cmd, mgmt_status(status));
95868426 5942 mgmt_pending_remove(cmd);
95868426
JH		 5943
5944unlock:
5945 hci_dev_unlock(hdev);
5946}
5947
5948static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
5949 u16 len)
5950{
5951 struct mgmt_cp_get_clock_info *cp = data;
5952 struct mgmt_rp_get_clock_info rp;
5953 struct hci_cp_read_clock hci_cp;
3b0602cd 5954 struct mgmt_pending_cmd *cmd;
95868426
JH		 5955 struct hci_request req;
5956 struct hci_conn *conn;
5957 int err;
5958
5959 BT_DBG("%s", hdev->name);
5960
5961 memset(&rp, 0, sizeof(rp));
5962 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
5963 rp.addr.type = cp->addr.type;
5964
5965 if (cp->addr.type != BDADDR_BREDR)
2a1afb5a
JH		 5966 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5967 MGMT_STATUS_INVALID_PARAMS,
5968 &rp, sizeof(rp));
95868426
JH		 5969
5970 hci_dev_lock(hdev);
5971
5972 if (!hdev_is_powered(hdev)) {
2a1afb5a
JH		 5973 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
5974 MGMT_STATUS_NOT_POWERED, &rp,
5975 sizeof(rp));
95868426
JH		 5976 goto unlock;
5977 }
5978
5979 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
5980 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
5981 &cp->addr.bdaddr);
5982 if (!conn || conn->state != BT_CONNECTED) {
2a1afb5a
JH		 5983 err = mgmt_cmd_complete(sk, hdev->id,
5984 MGMT_OP_GET_CLOCK_INFO,
5985 MGMT_STATUS_NOT_CONNECTED,
5986 &rp, sizeof(rp));
95868426
JH		 5987 goto unlock;
5988 }
5989 } else {
5990 conn = NULL;
5991 }
5992
5993 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len);
5994 if (!cmd) {
5995 err = -ENOMEM;
5996 goto unlock;
5997 }
5998
69487371
JH		 5999 cmd->cmd_complete = clock_info_cmd_complete;
6000
95868426
JH		 6001 hci_req_init(&req, hdev);
6002
6003 memset(&hci_cp, 0, sizeof(hci_cp));
6004 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6005
6006 if (conn) {
6007 hci_conn_hold(conn);
f8aaf9b6 6008 cmd->user_data = hci_conn_get(conn);
95868426
JH		 6009
6010 hci_cp.handle = cpu_to_le16(conn->handle);
6011 hci_cp.which = 0x01; /* Piconet clock */
6012 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp);
6013 }
6014
6015 err = hci_req_run(&req, get_clock_info_complete);
6016 if (err < 0)
6017 mgmt_pending_remove(cmd);
6018
6019unlock:
6020 hci_dev_unlock(hdev);
6021 return err;
6022}
6023
5a154e6f
JH		 6024static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
6025{
6026 struct hci_conn *conn;
6027
6028 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
6029 if (!conn)
6030 return false;
6031
6032 if (conn->dst_type != type)
6033 return false;
6034
6035 if (conn->state != BT_CONNECTED)
6036 return false;
6037
6038 return true;
6039}
6040
6041/* This function requires the caller holds hdev->lock */
6042static int hci_conn_params_set(struct hci_request *req, bdaddr_t *addr,
6043 u8 addr_type, u8 auto_connect)
6044{
6045 struct hci_dev *hdev = req->hdev;
6046 struct hci_conn_params *params;
6047
6048 params = hci_conn_params_add(hdev, addr, addr_type);
6049 if (!params)
6050 return -EIO;
6051
6052 if (params->auto_connect == auto_connect)
6053 return 0;
6054
6055 list_del_init(&params->action);
6056
6057 switch (auto_connect) {
6058 case HCI_AUTO_CONN_DISABLED:
6059 case HCI_AUTO_CONN_LINK_LOSS:
6060 __hci_update_background_scan(req);
6061 break;
6062 case HCI_AUTO_CONN_REPORT:
6063 list_add(&params->action, &hdev->pend_le_reports);
6064 __hci_update_background_scan(req);
6065 break;
6066 case HCI_AUTO_CONN_DIRECT:
6067 case HCI_AUTO_CONN_ALWAYS:
6068 if (!is_connected(hdev, addr, addr_type)) {
6069 list_add(&params->action, &hdev->pend_le_conns);
6070 __hci_update_background_scan(req);
6071 }
6072 break;
6073 }
6074
6075 params->auto_connect = auto_connect;
6076
6077 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
6078 auto_connect);
6079
6080 return 0;
6081}
6082
8afef092
MH		 6083static void device_added(struct sock *sk, struct hci_dev *hdev,
6084 bdaddr_t *bdaddr, u8 type, u8 action)
6085{
6086 struct mgmt_ev_device_added ev;
6087
6088 bacpy(&ev.addr.bdaddr, bdaddr);
6089 ev.addr.type = type;
6090 ev.action = action;
6091
6092 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk);
6093}
6094
1904a853 6095static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5a154e6f 6096{
3b0602cd 6097 struct mgmt_pending_cmd *cmd;
5a154e6f
JH		 6098
6099 BT_DBG("status 0x%02x", status);
6100
6101 hci_dev_lock(hdev);
6102
333ae95d 6103 cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
5a154e6f
JH		 6104 if (!cmd)
6105 goto unlock;
6106
6107 cmd->cmd_complete(cmd, mgmt_status(status));
6108 mgmt_pending_remove(cmd);
6109
6110unlock:
6111 hci_dev_unlock(hdev);
6112}
6113
2faade53
MH		 6114static int add_device(struct sock *sk, struct hci_dev *hdev,
6115 void *data, u16 len)
6116{
6117 struct mgmt_cp_add_device *cp = data;
3b0602cd 6118 struct mgmt_pending_cmd *cmd;
5a154e6f 6119 struct hci_request req;
2faade53
MH		 6120 u8 auto_conn, addr_type;
6121 int err;
6122
6123 BT_DBG("%s", hdev->name);
6124
6659358e 6125 if (!bdaddr_type_is_valid(cp->addr.type) ||
2faade53 6126 !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
2a1afb5a
JH		 6127 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6128 MGMT_STATUS_INVALID_PARAMS,
6129 &cp->addr, sizeof(cp->addr));
2faade53 6130
4b9e7e75 6131 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
2a1afb5a
JH		 6132 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
6133 MGMT_STATUS_INVALID_PARAMS,
6134 &cp->addr, sizeof(cp->addr));
2faade53 6135
5a154e6f
JH		 6136 hci_req_init(&req, hdev);
6137
2faade53
MH		 6138 hci_dev_lock(hdev);
6139
5a154e6f
JH		 6140 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_DEVICE, hdev, data, len);
6141 if (!cmd) {
6142 err = -ENOMEM;
6143 goto unlock;
6144 }
6145
6146 cmd->cmd_complete = addr_cmd_complete;
6147
6659358e 6148 if (cp->addr.type == BDADDR_BREDR) {
4b9e7e75 6149 /* Only incoming connections action is supported for now */
6659358e 6150 if (cp->action != 0x01) {
9df74653
JH		 6151 err = cmd->cmd_complete(cmd,
6152 MGMT_STATUS_INVALID_PARAMS);
5a154e6f 6153 mgmt_pending_remove(cmd);
6659358e
JH		 6154 goto unlock;
6155 }
6156
6157 err = hci_bdaddr_list_add(&hdev->whitelist, &cp->addr.bdaddr,
6158 cp->addr.type);
6159 if (err)
6160 goto unlock;
a397407f 6161
5a154e6f 6162 __hci_update_page_scan(&req);
a397407f 6163
6659358e
JH		 6164 goto added;
6165 }
6166
2faade53
MH		 6167 if (cp->addr.type == BDADDR_LE_PUBLIC)
6168 addr_type = ADDR_LE_DEV_PUBLIC;
6169 else
6170 addr_type = ADDR_LE_DEV_RANDOM;
6171
4b9e7e75 6172 if (cp->action == 0x02)
2faade53 6173 auto_conn = HCI_AUTO_CONN_ALWAYS;
4b9e7e75
MH		 6174 else if (cp->action == 0x01)
6175 auto_conn = HCI_AUTO_CONN_DIRECT;
2faade53 6176 else
a3451d27 6177 auto_conn = HCI_AUTO_CONN_REPORT;
2faade53 6178
bf5b3c8b
MH		 6179 /* If the connection parameters don't exist for this device,
6180 * they will be created and configured with defaults.
6181 */
5a154e6f 6182 if (hci_conn_params_set(&req, &cp->addr.bdaddr, addr_type,
d06b50ce 6183 auto_conn) < 0) {
9df74653 6184 err = cmd->cmd_complete(cmd, MGMT_STATUS_FAILED);
5a154e6f 6185 mgmt_pending_remove(cmd);
2faade53
MH		 6186 goto unlock;
6187 }
6188
6659358e 6189added:
8afef092
MH		 6190 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action);
6191
5a154e6f
JH		 6192 err = hci_req_run(&req, add_device_complete);
6193 if (err < 0) {
6194 /* ENODATA means no HCI commands were needed (e.g. if
6195 * the adapter is powered off).
6196 */
9df74653
JH		 6197 if (err == -ENODATA)
6198 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
5a154e6f
JH		 6199 mgmt_pending_remove(cmd);
6200 }
2faade53
MH		 6201
6202unlock:
6203 hci_dev_unlock(hdev);
6204 return err;
6205}
6206
8afef092
MH		 6207static void device_removed(struct sock *sk, struct hci_dev *hdev,
6208 bdaddr_t *bdaddr, u8 type)
6209{
6210 struct mgmt_ev_device_removed ev;
6211
6212 bacpy(&ev.addr.bdaddr, bdaddr);
6213 ev.addr.type = type;
6214
6215 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk);
6216}
6217
1904a853 6218static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
51ef3ebe 6219{
3b0602cd 6220 struct mgmt_pending_cmd *cmd;
51ef3ebe
JH		 6221
6222 BT_DBG("status 0x%02x", status);
6223
6224 hci_dev_lock(hdev);
6225
333ae95d 6226 cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
51ef3ebe
JH		 6227 if (!cmd)
6228 goto unlock;
6229
6230 cmd->cmd_complete(cmd, mgmt_status(status));
6231 mgmt_pending_remove(cmd);
6232
6233unlock:
6234 hci_dev_unlock(hdev);
6235}
6236
2faade53
MH		 6237static int remove_device(struct sock *sk, struct hci_dev *hdev,
6238 void *data, u16 len)
6239{
6240 struct mgmt_cp_remove_device *cp = data;
3b0602cd 6241 struct mgmt_pending_cmd *cmd;
51ef3ebe 6242 struct hci_request req;
2faade53
MH		 6243 int err;
6244
6245 BT_DBG("%s", hdev->name);
6246
51ef3ebe
JH		 6247 hci_req_init(&req, hdev);
6248
2faade53
MH		 6249 hci_dev_lock(hdev);
6250
51ef3ebe
JH		 6251 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_DEVICE, hdev, data, len);
6252 if (!cmd) {
6253 err = -ENOMEM;
6254 goto unlock;
6255 }
6256
6257 cmd->cmd_complete = addr_cmd_complete;
6258
2faade53 6259 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) {
c71593dd 6260 struct hci_conn_params *params;
2faade53
MH		 6261 u8 addr_type;
6262
6659358e 6263 if (!bdaddr_type_is_valid(cp->addr.type)) {
9df74653
JH		 6264 err = cmd->cmd_complete(cmd,
6265 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6266 mgmt_pending_remove(cmd);
2faade53
MH		 6267 goto unlock;
6268 }
6269
6659358e
JH		 6270 if (cp->addr.type == BDADDR_BREDR) {
6271 err = hci_bdaddr_list_del(&hdev->whitelist,
6272 &cp->addr.bdaddr,
6273 cp->addr.type);
6274 if (err) {
9df74653
JH		 6275 err = cmd->cmd_complete(cmd,
6276 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6277 mgmt_pending_remove(cmd);
6659358e
JH		 6278 goto unlock;
6279 }
6280
51ef3ebe 6281 __hci_update_page_scan(&req);
a397407f 6282
6659358e
JH		 6283 device_removed(sk, hdev, &cp->addr.bdaddr,
6284 cp->addr.type);
6285 goto complete;
6286 }
6287
2faade53
MH		 6288 if (cp->addr.type == BDADDR_LE_PUBLIC)
6289 addr_type = ADDR_LE_DEV_PUBLIC;
6290 else
6291 addr_type = ADDR_LE_DEV_RANDOM;
6292
c71593dd
JH		 6293 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
6294 addr_type);
6295 if (!params) {
9df74653
JH		 6296 err = cmd->cmd_complete(cmd,
6297 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6298 mgmt_pending_remove(cmd);
c71593dd
JH		 6299 goto unlock;
6300 }
6301
6302 if (params->auto_connect == HCI_AUTO_CONN_DISABLED) {
9df74653
JH		 6303 err = cmd->cmd_complete(cmd,
6304 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6305 mgmt_pending_remove(cmd);
c71593dd
JH		 6306 goto unlock;
6307 }
6308
d1dbf12e 6309 list_del(&params->action);
c71593dd
JH		 6310 list_del(&params->list);
6311 kfree(params);
51ef3ebe 6312 __hci_update_background_scan(&req);
8afef092
MH		 6313
6314 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type);
2faade53 6315 } else {
19de0825 6316 struct hci_conn_params *p, *tmp;
6659358e 6317 struct bdaddr_list *b, *btmp;
19de0825 6318
2faade53 6319 if (cp->addr.type) {
9df74653
JH		 6320 err = cmd->cmd_complete(cmd,
6321 MGMT_STATUS_INVALID_PARAMS);
51ef3ebe 6322 mgmt_pending_remove(cmd);
2faade53
MH		 6323 goto unlock;
6324 }
6325
6659358e
JH		 6326 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) {
6327 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type);
6328 list_del(&b->list);
6329 kfree(b);
6330 }
6331
51ef3ebe 6332 __hci_update_page_scan(&req);
a397407f 6333
19de0825
JH		 6334 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) {
6335 if (p->auto_connect == HCI_AUTO_CONN_DISABLED)
6336 continue;
6337 device_removed(sk, hdev, &p->addr, p->addr_type);
6338 list_del(&p->action);
6339 list_del(&p->list);
6340 kfree(p);
6341 }
6342
6343 BT_DBG("All LE connection parameters were removed");
6344
51ef3ebe 6345 __hci_update_background_scan(&req);
2faade53
MH		 6346 }
6347
6659358e 6348complete:
51ef3ebe
JH		 6349 err = hci_req_run(&req, remove_device_complete);
6350 if (err < 0) {
6351 /* ENODATA means no HCI commands were needed (e.g. if
6352 * the adapter is powered off).
6353 */
9df74653
JH		 6354 if (err == -ENODATA)
6355 err = cmd->cmd_complete(cmd, MGMT_STATUS_SUCCESS);
51ef3ebe
JH		 6356 mgmt_pending_remove(cmd);
6357 }
2faade53
MH		 6358
6359unlock:
6360 hci_dev_unlock(hdev);
6361 return err;
6362}
6363
a26f3dcf
JH		 6364static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
6365 u16 len)
6366{
6367 struct mgmt_cp_load_conn_param *cp = data;
ba1d6936
JH		 6368 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) /
6369 sizeof(struct mgmt_conn_param));
a26f3dcf
JH		 6370 u16 param_count, expected_len;
6371 int i;
6372
6373 if (!lmp_le_capable(hdev))
a69e8375
JH		 6374 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6375 MGMT_STATUS_NOT_SUPPORTED);
a26f3dcf
JH		 6376
6377 param_count = __le16_to_cpu(cp->param_count);
ba1d6936
JH		 6378 if (param_count > max_param_count) {
6379 BT_ERR("load_conn_param: too big param_count value %u",
6380 param_count);
a69e8375
JH		 6381 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6382 MGMT_STATUS_INVALID_PARAMS);
ba1d6936 6383 }
a26f3dcf
JH		 6384
6385 expected_len = sizeof(*cp) + param_count *
6386 sizeof(struct mgmt_conn_param);
6387 if (expected_len != len) {
6388 BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
6389 expected_len, len);
a69e8375
JH		 6390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
6391 MGMT_STATUS_INVALID_PARAMS);
a26f3dcf
JH		 6392 }
6393
6394 BT_DBG("%s param_count %u", hdev->name, param_count);
6395
6396 hci_dev_lock(hdev);
6397
6398 hci_conn_params_clear_disabled(hdev);
6399
6400 for (i = 0; i < param_count; i++) {
6401 struct mgmt_conn_param *param = &cp->params[i];
6402 struct hci_conn_params *hci_param;
6403 u16 min, max, latency, timeout;
6404 u8 addr_type;
6405
6406 BT_DBG("Adding %pMR (type %u)", &param->addr.bdaddr,
6407 param->addr.type);
6408
6409 if (param->addr.type == BDADDR_LE_PUBLIC) {
6410 addr_type = ADDR_LE_DEV_PUBLIC;
6411 } else if (param->addr.type == BDADDR_LE_RANDOM) {
6412 addr_type = ADDR_LE_DEV_RANDOM;
6413 } else {
6414 BT_ERR("Ignoring invalid connection parameters");
6415 continue;
6416 }
6417
6418 min = le16_to_cpu(param->min_interval);
6419 max = le16_to_cpu(param->max_interval);
6420 latency = le16_to_cpu(param->latency);
6421 timeout = le16_to_cpu(param->timeout);
6422
6423 BT_DBG("min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x",
6424 min, max, latency, timeout);
6425
6426 if (hci_check_conn_params(min, max, latency, timeout) < 0) {
6427 BT_ERR("Ignoring invalid connection parameters");
6428 continue;
6429 }
6430
6431 hci_param = hci_conn_params_add(hdev, &param->addr.bdaddr,
6432 addr_type);
6433 if (!hci_param) {
6434 BT_ERR("Failed to add connection parameters");
6435 continue;
6436 }
6437
6438 hci_param->conn_min_interval = min;
6439 hci_param->conn_max_interval = max;
6440 hci_param->conn_latency = latency;
6441 hci_param->supervision_timeout = timeout;
6442 }
6443
6444 hci_dev_unlock(hdev);
6445
2a1afb5a
JH		 6446 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
6447 NULL, 0);
a26f3dcf
JH		 6448}
6449
dbece37a
MH		 6450static int set_external_config(struct sock *sk, struct hci_dev *hdev,
6451 void *data, u16 len)
6452{
6453 struct mgmt_cp_set_external_config *cp = data;
6454 bool changed;
6455 int err;
6456
6457 BT_DBG("%s", hdev->name);
6458
6459 if (hdev_is_powered(hdev))
a69e8375
JH		 6460 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6461 MGMT_STATUS_REJECTED);
dbece37a
MH		 6462
6463 if (cp->config != 0x00 && cp->config != 0x01)
a69e8375
JH		 6464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6465 MGMT_STATUS_INVALID_PARAMS);
dbece37a
MH		 6466
6467 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
a69e8375
JH		 6468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
6469 MGMT_STATUS_NOT_SUPPORTED);
dbece37a
MH		 6470
6471 hci_dev_lock(hdev);
6472
6473 if (cp->config)
238be788 6474 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a 6475 else
a69d8927 6476 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
dbece37a
MH		 6477
6478 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
6479 if (err < 0)
6480 goto unlock;
6481
6482 if (!changed)
6483 goto unlock;
6484
f4537c04
MH		 6485 err = new_options(hdev, sk);
6486
d7a5a11d 6487 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
dbece37a 6488 mgmt_index_removed(hdev);
d603b76b 6489
516018a9 6490 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
a1536da2
MH		 6491 hci_dev_set_flag(hdev, HCI_CONFIG);
6492 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
d603b76b
MH		 6493
6494 queue_work(hdev->req_workqueue, &hdev->power_on);
6495 } else {
5ea234d3 6496 set_bit(HCI_RAW, &hdev->flags);
d603b76b
MH		 6497 mgmt_index_added(hdev);
6498 }
dbece37a
MH		 6499 }
6500
6501unlock:
6502 hci_dev_unlock(hdev);
6503 return err;
6504}
6505
9713c17b
MH		 6506static int set_public_address(struct sock *sk, struct hci_dev *hdev,
6507 void *data, u16 len)
6508{
6509 struct mgmt_cp_set_public_address *cp = data;
6510 bool changed;
6511 int err;
6512
6513 BT_DBG("%s", hdev->name);
6514
6515 if (hdev_is_powered(hdev))
a69e8375
JH		 6516 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6517 MGMT_STATUS_REJECTED);
9713c17b
MH		 6518
6519 if (!bacmp(&cp->bdaddr, BDADDR_ANY))
a69e8375
JH		 6520 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6521 MGMT_STATUS_INVALID_PARAMS);
9713c17b
MH		 6522
6523 if (!hdev->set_bdaddr)
a69e8375
JH		 6524 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
6525 MGMT_STATUS_NOT_SUPPORTED);
9713c17b
MH		 6526
6527 hci_dev_lock(hdev);
6528
6529 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
6530 bacpy(&hdev->public_addr, &cp->bdaddr);
6531
6532 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
6533 if (err < 0)
6534 goto unlock;
6535
6536 if (!changed)
6537 goto unlock;
6538
d7a5a11d 6539 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
9713c17b
MH		 6540 err = new_options(hdev, sk);
6541
6542 if (is_configured(hdev)) {
6543 mgmt_index_removed(hdev);
6544
a358dc11 6545 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
9713c17b 6546
a1536da2
MH		 6547 hci_dev_set_flag(hdev, HCI_CONFIG);
6548 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
9713c17b
MH		 6549
6550 queue_work(hdev->req_workqueue, &hdev->power_on);
6551 }
6552
6553unlock:
6554 hci_dev_unlock(hdev);
6555 return err;
6556}
6557
bea41609
MH		 6558static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
6559 u8 data_len)
6560{
6561 eir[eir_len++] = sizeof(type) + data_len;
6562 eir[eir_len++] = type;
6563 memcpy(&eir[eir_len], data, data_len);
6564 eir_len += data_len;
6565
6566 return eir_len;
6567}
6568
40f66c05
JH		 6569static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
6570 u16 opcode, struct sk_buff *skb)
6571{
6572 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
6573 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
6574 u8 *h192, *r192, *h256, *r256;
6575 struct mgmt_pending_cmd *cmd;
6576 u16 eir_len;
6577 int err;
6578
6579 BT_DBG("%s status %u", hdev->name, status);
6580
6581 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
6582 if (!cmd)
6583 return;
6584
6585 mgmt_cp = cmd->param;
6586
6587 if (status) {
6588 status = mgmt_status(status);
6589 eir_len = 0;
6590
6591 h192 = NULL;
6592 r192 = NULL;
6593 h256 = NULL;
6594 r256 = NULL;
6595 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
6596 struct hci_rp_read_local_oob_data *rp;
6597
6598 if (skb->len != sizeof(*rp)) {
6599 status = MGMT_STATUS_FAILED;
6600 eir_len = 0;
6601 } else {
6602 status = MGMT_STATUS_SUCCESS;
6603 rp = (void *)skb->data;
6604
6605 eir_len = 5 + 18 + 18;
6606 h192 = rp->hash;
6607 r192 = rp->rand;
6608 h256 = NULL;
6609 r256 = NULL;
6610 }
6611 } else {
6612 struct hci_rp_read_local_oob_ext_data *rp;
6613
6614 if (skb->len != sizeof(*rp)) {
6615 status = MGMT_STATUS_FAILED;
6616 eir_len = 0;
6617 } else {
6618 status = MGMT_STATUS_SUCCESS;
6619 rp = (void *)skb->data;
6620
6621 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6622 eir_len = 5 + 18 + 18;
6623 h192 = NULL;
6624 r192 = NULL;
6625 } else {
6626 eir_len = 5 + 18 + 18 + 18 + 18;
6627 h192 = rp->hash192;
6628 r192 = rp->rand192;
6629 }
6630
6631 h256 = rp->hash256;
6632 r256 = rp->rand256;
6633 }
6634 }
6635
6636 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
6637 if (!mgmt_rp)
6638 goto done;
6639
6640 if (status)
6641 goto send_rsp;
6642
6643 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
6644 hdev->dev_class, 3);
6645
6646 if (h192 && r192) {
6647 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6648 EIR_SSP_HASH_C192, h192, 16);
6649 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6650 EIR_SSP_RAND_R192, r192, 16);
6651 }
6652
6653 if (h256 && r256) {
6654 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6655 EIR_SSP_HASH_C256, h256, 16);
6656 eir_len = eir_append_data(mgmt_rp->eir, eir_len,
6657 EIR_SSP_RAND_R256, r256, 16);
6658 }
6659
6660send_rsp:
6661 mgmt_rp->type = mgmt_cp->type;
6662 mgmt_rp->eir_len = cpu_to_le16(eir_len);
6663
6664 err = mgmt_cmd_complete(cmd->sk, hdev->id,
6665 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
6666 mgmt_rp, sizeof(*mgmt_rp) + eir_len);
6667 if (err < 0 || status)
6668 goto done;
6669
6670 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
6671
6672 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6673 mgmt_rp, sizeof(*mgmt_rp) + eir_len,
6674 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
6675done:
6676 kfree(mgmt_rp);
6677 mgmt_pending_remove(cmd);
6678}
6679
6680static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
6681 struct mgmt_cp_read_local_oob_ext_data *cp)
6682{
6683 struct mgmt_pending_cmd *cmd;
6684 struct hci_request req;
6685 int err;
6686
6687 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
6688 cp, sizeof(*cp));
6689 if (!cmd)
6690 return -ENOMEM;
6691
6692 hci_req_init(&req, hdev);
6693
6694 if (bredr_sc_enabled(hdev))
6695 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
6696 else
6697 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
6698
6699 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
6700 if (err < 0) {
6701 mgmt_pending_remove(cmd);
6702 return err;
6703 }
6704
6705 return 0;
6706}
6707
4f0f155c
MH		 6708static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
6709 void *data, u16 data_len)
6710{
6711 struct mgmt_cp_read_local_oob_ext_data *cp = data;
6712 struct mgmt_rp_read_local_oob_ext_data *rp;
6713 size_t rp_len;
6714 u16 eir_len;
0821a2c5 6715 u8 status, flags, role, addr[7], hash[16], rand[16];
4f0f155c
MH		 6716 int err;
6717
6718 BT_DBG("%s", hdev->name);
6719
57b0d3e8
MH		 6720 if (hdev_is_powered(hdev)) {
6721 switch (cp->type) {
6722 case BIT(BDADDR_BREDR):
6723 status = mgmt_bredr_support(hdev);
6724 if (status)
6725 eir_len = 0;
6726 else
6727 eir_len = 5;
6728 break;
6729 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
6730 status = mgmt_le_support(hdev);
6731 if (status)
6732 eir_len = 0;
6733 else
6734 eir_len = 9 + 3 + 18 + 18 + 3;
6735 break;
6736 default:
6737 status = MGMT_STATUS_INVALID_PARAMS;
6738 eir_len = 0;
6739 break;
6740 }
6741 } else {
6742 status = MGMT_STATUS_NOT_POWERED;
6743 eir_len = 0;
4f0f155c
MH		 6744 }
6745
4f0f155c
MH		 6746 rp_len = sizeof(*rp) + eir_len;
6747 rp = kmalloc(rp_len, GFP_ATOMIC);
efcd8c98 6748 if (!rp)
4f0f155c 6749 return -ENOMEM;
efcd8c98 6750
57b0d3e8
MH		 6751 if (status)
6752 goto complete;
6753
efcd8c98 6754 hci_dev_lock(hdev);
4f0f155c
MH		 6755
6756 eir_len = 0;
6757 switch (cp->type) {
6758 case BIT(BDADDR_BREDR):
40f66c05
JH		 6759 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
6760 err = read_local_ssp_oob_req(hdev, sk, cp);
6761 hci_dev_unlock(hdev);
6762 if (!err)
6763 goto done;
6764
6765 status = MGMT_STATUS_FAILED;
6766 goto complete;
6767 } else {
6768 eir_len = eir_append_data(rp->eir, eir_len,
6769 EIR_CLASS_OF_DEV,
6770 hdev->dev_class, 3);
6771 }
4f0f155c
MH		 6772 break;
6773 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
5082a599
MH		 6774 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
6775 smp_generate_oob(hdev, hash, rand) < 0) {
0821a2c5 6776 hci_dev_unlock(hdev);
57b0d3e8
MH		 6777 status = MGMT_STATUS_FAILED;
6778 goto complete;
0821a2c5
MH		 6779 }
6780
e213568a
MH		 6781 /* This should return the active RPA, but since the RPA
6782 * is only programmed on demand, it is really hard to fill
6783 * this in at the moment. For now disallow retrieving
6784 * local out-of-band data when privacy is in use.
6785 *
6786 * Returning the identity address will not help here since
6787 * pairing happens before the identity resolving key is
6788 * known and thus the connection establishment happens
6789 * based on the RPA and not the identity address.
6790 */
4f0f155c 6791 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
e213568a
MH		 6792 hci_dev_unlock(hdev);
6793 status = MGMT_STATUS_REJECTED;
6794 goto complete;
6795 }
6796
6797 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
6798 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
6799 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
6800 bacmp(&hdev->static_addr, BDADDR_ANY))) {
4f0f155c
MH		 6801 memcpy(addr, &hdev->static_addr, 6);
6802 addr[6] = 0x01;
6803 } else {
6804 memcpy(addr, &hdev->bdaddr, 6);
6805 addr[6] = 0x00;
6806 }
6807
6808 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
6809 addr, sizeof(addr));
6810
6811 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
6812 role = 0x02;
6813 else
6814 role = 0x01;
6815
6816 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
6817 &role, sizeof(role));
6818
5082a599
MH		 6819 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
6820 eir_len = eir_append_data(rp->eir, eir_len,
6821 EIR_LE_SC_CONFIRM,
6822 hash, sizeof(hash));
0821a2c5 6823
5082a599
MH		 6824 eir_len = eir_append_data(rp->eir, eir_len,
6825 EIR_LE_SC_RANDOM,
6826 rand, sizeof(rand));
6827 }
0821a2c5 6828
4f0f155c
MH		 6829 flags = get_adv_discov_flags(hdev);
6830
6831 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6832 flags |= LE_AD_NO_BREDR;
6833
6834 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
6835 &flags, sizeof(flags));
6836 break;
6837 }
6838
4f0f155c
MH		 6839 hci_dev_unlock(hdev);
6840
72000df2
MH		 6841 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
6842
57b0d3e8
MH		 6843 status = MGMT_STATUS_SUCCESS;
6844
6845complete:
efcd8c98
MH		 6846 rp->type = cp->type;
6847 rp->eir_len = cpu_to_le16(eir_len);
6848
4f0f155c 6849 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
57b0d3e8
MH		 6850 status, rp, sizeof(*rp) + eir_len);
6851 if (err < 0 || status)
72000df2
MH		 6852 goto done;
6853
6854 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
6855 rp, sizeof(*rp) + eir_len,
6856 HCI_MGMT_OOB_DATA_EVENTS, sk);
4f0f155c 6857
0821a2c5 6858done:
4f0f155c
MH		 6859 kfree(rp);
6860
6861 return err;
6862}
6863
089fa8c0
AU		 6864static u32 get_supported_adv_flags(struct hci_dev *hdev)
6865{
6866 u32 flags = 0;
6867
6868 flags |= MGMT_ADV_FLAG_CONNECTABLE;
6869 flags |= MGMT_ADV_FLAG_DISCOV;
6870 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
6871 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
6872
6873 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
6874 flags |= MGMT_ADV_FLAG_TX_POWER;
6875
6876 return flags;
6877}
6878
d3d5305b
MH		 6879static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
6880 void *data, u16 data_len)
6881{
6882 struct mgmt_rp_read_adv_features *rp;
6883 size_t rp_len;
286e0c83 6884 int err, i;
24b4f38f 6885 bool instance;
286e0c83 6886 struct adv_info *adv_instance;
089fa8c0 6887 u32 supported_flags;
d3d5305b
MH		 6888
6889 BT_DBG("%s", hdev->name);
6890
089fa8c0
AU		 6891 if (!lmp_le_capable(hdev))
6892 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6893 MGMT_STATUS_REJECTED);
6894
d3d5305b
MH		 6895 hci_dev_lock(hdev);
6896
6897 rp_len = sizeof(*rp);
24b4f38f 6898
24b4f38f
AU		 6899 instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
6900 if (instance)
286e0c83 6901 rp_len += hdev->adv_instance_cnt;
24b4f38f 6902
d3d5305b
MH		 6903 rp = kmalloc(rp_len, GFP_ATOMIC);
6904 if (!rp) {
6905 hci_dev_unlock(hdev);
6906 return -ENOMEM;
6907 }
6908
089fa8c0
AU		 6909 supported_flags = get_supported_adv_flags(hdev);
6910
6911 rp->supported_flags = cpu_to_le32(supported_flags);
dc5d82a9
MH		 6912 rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
6913 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
d2609b34 6914 rp->max_instances = HCI_MAX_ADV_INSTANCES;
24b4f38f 6915
24b4f38f 6916 if (instance) {
286e0c83
FG		 6917 i = 0;
6918 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
6919 if (i >= hdev->adv_instance_cnt)
6920 break;
6921
6922 rp->instance[i] = adv_instance->instance;
6923 i++;
6924 }
6925 rp->num_instances = hdev->adv_instance_cnt;
24b4f38f
AU		 6926 } else {
6927 rp->num_instances = 0;
6928 }
d3d5305b
MH		 6929
6930 hci_dev_unlock(hdev);
6931
6932 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
6933 MGMT_STATUS_SUCCESS, rp, rp_len);
6934
6935 kfree(rp);
6936
6937 return err;
6938}
6939
4117ed70 6940static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
b44133ff 6941 u8 len, bool is_adv_data)
24b4f38f 6942{
4117ed70 6943 u8 max_len = HCI_MAX_AD_LENGTH;
24b4f38f 6944 int i, cur_len;
b44133ff 6945 bool flags_managed = false;
5507e358 6946 bool tx_power_managed = false;
67e0c0cd
AU		 6947 u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
6948 MGMT_ADV_FLAG_MANAGED_FLAGS;
24b4f38f 6949
807ec772 6950 if (is_adv_data && (adv_flags & flags_params)) {
b44133ff
AU		 6951 flags_managed = true;
6952 max_len -= 3;
6953 }
24b4f38f 6954
5507e358
AU		 6955 if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
6956 tx_power_managed = true;
6957 max_len -= 3;
6958 }
6959
4117ed70 6960 if (len > max_len)
24b4f38f
AU		 6961 return false;
6962
4117ed70
AU		 6963 /* Make sure that the data is correctly formatted. */
6964 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
6965 cur_len = data[i];
24b4f38f 6966
b44133ff
AU		 6967 if (flags_managed && data[i + 1] == EIR_FLAGS)
6968 return false;
6969
5507e358
AU		 6970 if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
6971 return false;
6972
24b4f38f
AU		 6973 /* If the current field length would exceed the total data
6974 * length, then it's invalid.
6975 */
4117ed70 6976 if (i + cur_len >= len)
24b4f38f
AU		 6977 return false;
6978 }
6979
6980 return true;
6981}
6982
24b4f38f
AU		 6983static void add_advertising_complete(struct hci_dev *hdev, u8 status,
6984 u16 opcode)
6985{
6986 struct mgmt_pending_cmd *cmd;
6987 struct mgmt_rp_add_advertising rp;
6988
6989 BT_DBG("status %d", status);
6990
6991 hci_dev_lock(hdev);
6992
6993 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
6994
6995 if (status) {
6996 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
6997 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
6998 advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
6999 }
7000
7001 if (!cmd)
7002 goto unlock;
7003
7004 rp.instance = 0x01;
7005
7006 if (status)
7007 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
7008 mgmt_status(status));
7009 else
7010 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
7011 mgmt_status(status), &rp, sizeof(rp));
7012
7013 mgmt_pending_remove(cmd);
7014
7015unlock:
7016 hci_dev_unlock(hdev);
7017}
7018
5d900e46 7019void mgmt_adv_timeout_expired(struct hci_dev *hdev)
912098a6 7020{
5d900e46 7021 hdev->adv_instance_timeout = 0;
912098a6
AU		 7022
7023 hci_dev_lock(hdev);
7024 clear_adv_instance(hdev);
7025 hci_dev_unlock(hdev);
7026}
7027
24b4f38f
AU		 7028static int add_advertising(struct sock *sk, struct hci_dev *hdev,
7029 void *data, u16 data_len)
7030{
7031 struct mgmt_cp_add_advertising *cp = data;
7032 struct mgmt_rp_add_advertising rp;
7033 u32 flags;
089fa8c0 7034 u32 supported_flags;
24b4f38f 7035 u8 status;
912098a6 7036 u16 timeout;
24b4f38f
AU		 7037 int err;
7038 struct mgmt_pending_cmd *cmd;
7039 struct hci_request req;
7040
7041 BT_DBG("%s", hdev->name);
7042
7043 status = mgmt_le_support(hdev);
7044 if (status)
7045 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7046 status);
7047
7048 flags = __le32_to_cpu(cp->flags);
912098a6 7049 timeout = __le16_to_cpu(cp->timeout);
24b4f38f 7050
089fa8c0
AU		 7051 /* The current implementation only supports adding one instance and only
7052 * a subset of the specified flags.
7053 */
7054 supported_flags = get_supported_adv_flags(hdev);
7055 if (cp->instance != 0x01 || (flags & ~supported_flags))
24b4f38f
AU		 7056 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7057 MGMT_STATUS_INVALID_PARAMS);
7058
7059 hci_dev_lock(hdev);
7060
912098a6
AU		 7061 if (timeout && !hdev_is_powered(hdev)) {
7062 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7063 MGMT_STATUS_REJECTED);
7064 goto unlock;
7065 }
7066
24b4f38f 7067 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
da929335 7068 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
24b4f38f
AU		 7069 pending_find(MGMT_OP_SET_LE, hdev)) {
7070 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7071 MGMT_STATUS_BUSY);
7072 goto unlock;
7073 }
7074
b44133ff 7075 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
4117ed70 7076 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
b44133ff 7077 cp->scan_rsp_len, false)) {
24b4f38f
AU		 7078 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7079 MGMT_STATUS_INVALID_PARAMS);
7080 goto unlock;
7081 }
7082
7083 hdev->adv_instance.flags = flags;
7084 hdev->adv_instance.adv_data_len = cp->adv_data_len;
7085 hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
7086
7087 if (cp->adv_data_len)
7088 memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
7089
7090 if (cp->scan_rsp_len)
7091 memcpy(hdev->adv_instance.scan_rsp_data,
7092 cp->data + cp->adv_data_len, cp->scan_rsp_len);
7093
5d900e46
FG		 7094 if (hdev->adv_instance_timeout)
7095 cancel_delayed_work(&hdev->adv_instance_expire);
912098a6 7096
5d900e46 7097 hdev->adv_instance_timeout = timeout;
912098a6
AU		 7098
7099 if (timeout)
7100 queue_delayed_work(hdev->workqueue,
5d900e46 7101 &hdev->adv_instance_expire,
912098a6
AU		 7102 msecs_to_jiffies(timeout * 1000));
7103
24b4f38f
AU		 7104 if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
7105 advertising_added(sk, hdev, 1);
7106
7107 /* If the HCI_ADVERTISING flag is set or the device isn't powered then
7108 * we have no HCI communication to make. Simply return.
7109 */
7110 if (!hdev_is_powered(hdev) ||
7111 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7112 rp.instance = 0x01;
7113 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
7114 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7115 goto unlock;
7116 }
7117
7118 /* We're good to go, update advertising data, parameters, and start
7119 * advertising.
7120 */
7121 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
7122 data_len);
7123 if (!cmd) {
7124 err = -ENOMEM;
7125 goto unlock;
7126 }
7127
7128 hci_req_init(&req, hdev);
7129
7130 update_adv_data(&req);
4117ed70 7131 update_scan_rsp_data(&req);
24b4f38f
AU		 7132 enable_advertising(&req);
7133
7134 err = hci_req_run(&req, add_advertising_complete);
7135 if (err < 0)
7136 mgmt_pending_remove(cmd);
7137
7138unlock:
7139 hci_dev_unlock(hdev);
7140
7141 return err;
7142}
7143
da929335
AU		 7144static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
7145 u16 opcode)
7146{
7147 struct mgmt_pending_cmd *cmd;
7148 struct mgmt_rp_remove_advertising rp;
7149
7150 BT_DBG("status %d", status);
7151
7152 hci_dev_lock(hdev);
7153
7154 /* A failure status here only means that we failed to disable
7155 * advertising. Otherwise, the advertising instance has been removed,
7156 * so report success.
7157 */
7158 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
7159 if (!cmd)
7160 goto unlock;
7161
7162 rp.instance = 1;
7163
7164 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
7165 &rp, sizeof(rp));
7166 mgmt_pending_remove(cmd);
7167
7168unlock:
7169 hci_dev_unlock(hdev);
7170}
7171
7172static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
7173 void *data, u16 data_len)
7174{
7175 struct mgmt_cp_remove_advertising *cp = data;
7176 struct mgmt_rp_remove_advertising rp;
7177 int err;
7178 struct mgmt_pending_cmd *cmd;
7179 struct hci_request req;
7180
7181 BT_DBG("%s", hdev->name);
7182
7183 /* The current implementation only allows modifying instance no 1. A
7184 * value of 0 indicates that all instances should be cleared.
7185 */
7186 if (cp->instance > 1)
7187 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7188 MGMT_STATUS_INVALID_PARAMS);
7189
7190 hci_dev_lock(hdev);
7191
7192 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
7193 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
7194 pending_find(MGMT_OP_SET_LE, hdev)) {
7195 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7196 MGMT_STATUS_BUSY);
7197 goto unlock;
7198 }
7199
7200 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
7201 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
7202 MGMT_STATUS_INVALID_PARAMS);
7203 goto unlock;
7204 }
7205
5d900e46
FG		 7206 if (hdev->adv_instance_timeout)
7207 cancel_delayed_work(&hdev->adv_instance_expire);
912098a6 7208
da929335
AU		 7209 memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
7210
7211 advertising_removed(sk, hdev, 1);
7212
7213 hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
7214
7215 /* If the HCI_ADVERTISING flag is set or the device isn't powered then
7216 * we have no HCI communication to make. Simply return.
7217 */
7218 if (!hdev_is_powered(hdev) ||
7219 hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
7220 rp.instance = 1;
7221 err = mgmt_cmd_complete(sk, hdev->id,
7222 MGMT_OP_REMOVE_ADVERTISING,
7223 MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
7224 goto unlock;
7225 }
7226
7227 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
7228 data_len);
7229 if (!cmd) {
7230 err = -ENOMEM;
7231 goto unlock;
7232 }
7233
7234 hci_req_init(&req, hdev);
7235 disable_advertising(&req);
7236
7237 err = hci_req_run(&req, remove_advertising_complete);
7238 if (err < 0)
7239 mgmt_pending_remove(cmd);
7240
7241unlock:
7242 hci_dev_unlock(hdev);
7243
7244 return err;
7245}
7246
6d785aa3 7247static const struct hci_mgmt_handler mgmt_handlers[] = {
0f4e68cf 7248 { NULL }, /* 0x0000 (no command) */
b9a245fb 7249 { read_version, MGMT_READ_VERSION_SIZE,
c91041dc
MH		 7250 HCI_MGMT_NO_HDEV |
7251 HCI_MGMT_UNTRUSTED },
b9a245fb 7252 { read_commands, MGMT_READ_COMMANDS_SIZE,
c91041dc
MH		 7253 HCI_MGMT_NO_HDEV |
7254 HCI_MGMT_UNTRUSTED },
b9a245fb 7255 { read_index_list, MGMT_READ_INDEX_LIST_SIZE,
c91041dc
MH		 7256 HCI_MGMT_NO_HDEV |
7257 HCI_MGMT_UNTRUSTED },
7258 { read_controller_info, MGMT_READ_INFO_SIZE,
7259 HCI_MGMT_UNTRUSTED },
7aea8616
MH		 7260 { set_powered, MGMT_SETTING_SIZE },
7261 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE },
7262 { set_connectable, MGMT_SETTING_SIZE },
7263 { set_fast_connectable, MGMT_SETTING_SIZE },
7264 { set_bondable, MGMT_SETTING_SIZE },
7265 { set_link_security, MGMT_SETTING_SIZE },
7266 { set_ssp, MGMT_SETTING_SIZE },
7267 { set_hs, MGMT_SETTING_SIZE },
7268 { set_le, MGMT_SETTING_SIZE },
7269 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE },
7270 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE },
7271 { add_uuid, MGMT_ADD_UUID_SIZE },
7272 { remove_uuid, MGMT_REMOVE_UUID_SIZE },
b9a245fb
JH		 7273 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE,
7274 HCI_MGMT_VAR_LEN },
7275 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE,
7276 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7277 { disconnect, MGMT_DISCONNECT_SIZE },
7278 { get_connections, MGMT_GET_CONNECTIONS_SIZE },
7279 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE },
7280 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE },
7281 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE },
7282 { pair_device, MGMT_PAIR_DEVICE_SIZE },
7283 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE },
7284 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE },
7285 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE },
7286 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
7287 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE },
7288 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
b9a245fb
JH		 7289 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE },
7290 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE,
7291 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7292 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
7293 { start_discovery, MGMT_START_DISCOVERY_SIZE },
7294 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE },
7295 { confirm_name, MGMT_CONFIRM_NAME_SIZE },
7296 { block_device, MGMT_BLOCK_DEVICE_SIZE },
7297 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE },
7298 { set_device_id, MGMT_SET_DEVICE_ID_SIZE },
7299 { set_advertising, MGMT_SETTING_SIZE },
7300 { set_bredr, MGMT_SETTING_SIZE },
7301 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE },
7302 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE },
7303 { set_secure_conn, MGMT_SETTING_SIZE },
7304 { set_debug_keys, MGMT_SETTING_SIZE },
7305 { set_privacy, MGMT_SET_PRIVACY_SIZE },
b9a245fb
JH		 7306 { load_irks, MGMT_LOAD_IRKS_SIZE,
7307 HCI_MGMT_VAR_LEN },
7aea8616
MH		 7308 { get_conn_info, MGMT_GET_CONN_INFO_SIZE },
7309 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE },
7310 { add_device, MGMT_ADD_DEVICE_SIZE },
7311 { remove_device, MGMT_REMOVE_DEVICE_SIZE },
b9a245fb
JH		 7312 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE,
7313 HCI_MGMT_VAR_LEN },
7314 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE,
c91041dc
MH		 7315 HCI_MGMT_NO_HDEV |
7316 HCI_MGMT_UNTRUSTED },
b9a245fb 7317 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE,
c91041dc
MH		 7318 HCI_MGMT_UNCONFIGURED |
7319 HCI_MGMT_UNTRUSTED },
b9a245fb
JH		 7320 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE,
7321 HCI_MGMT_UNCONFIGURED },
7322 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE,
7323 HCI_MGMT_UNCONFIGURED },
7324 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
7325 HCI_MGMT_VAR_LEN },
4f0f155c 7326 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
96f1474a 7327 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE,
c91041dc
MH		 7328 HCI_MGMT_NO_HDEV |
7329 HCI_MGMT_UNTRUSTED },
d3d5305b 7330 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE },
24b4f38f
AU		 7331 { add_advertising, MGMT_ADD_ADVERTISING_SIZE,
7332 HCI_MGMT_VAR_LEN },
da929335 7333 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE },
0f4e68cf
JH		 7334};
7335
bf6b56db 7336void mgmt_index_added(struct hci_dev *hdev)
c71e97bf 7337{
ced85549 7338 struct mgmt_ev_ext_index ev;
bb4b2a9a 7339
0602a8ad
MH		 7340 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7341 return;
7342
f9207338
MH		 7343 switch (hdev->dev_type) {
7344 case HCI_BREDR:
7345 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7346 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
7347 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7348 ev.type = 0x01;
f9207338
MH		 7349 } else {
7350 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
7351 HCI_MGMT_INDEX_EVENTS);
ced85549 7352 ev.type = 0x00;
f9207338
MH		 7353 }
7354 break;
ced85549
MH		 7355 case HCI_AMP:
7356 ev.type = 0x02;
7357 break;
7358 default:
7359 return;
f9207338 7360 }
ced85549
MH		 7361
7362 ev.bus = hdev->bus;
7363
7364 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
7365 HCI_MGMT_EXT_INDEX_EVENTS);
c71e97bf
JH		 7366}
7367
bf6b56db 7368void mgmt_index_removed(struct hci_dev *hdev)
c71e97bf 7369{
ced85549 7370 struct mgmt_ev_ext_index ev;
5f159032 7371 u8 status = MGMT_STATUS_INVALID_INDEX;
b24752fe 7372
0602a8ad
MH		 7373 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
7374 return;
7375
f9207338
MH		 7376 switch (hdev->dev_type) {
7377 case HCI_BREDR:
7378 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
b24752fe 7379
f9207338
MH		 7380 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
7381 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
7382 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
ced85549 7383 ev.type = 0x01;
f9207338
MH		 7384 } else {
7385 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
7386 HCI_MGMT_INDEX_EVENTS);
ced85549 7387 ev.type = 0x00;
f9207338
MH		 7388 }
7389 break;
ced85549
MH		 7390 case HCI_AMP:
7391 ev.type = 0x02;
7392 break;
7393 default:
7394 return;
f9207338 7395 }
ced85549
MH		 7396
7397 ev.bus = hdev->bus;
7398
7399 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
7400 HCI_MGMT_EXT_INDEX_EVENTS);
eec8d2bc
JH		 7401}
7402
6046dc3e 7403/* This function requires the caller holds hdev->lock */
2cf22218 7404static void restart_le_actions(struct hci_request *req)
6046dc3e 7405{
2cf22218 7406 struct hci_dev *hdev = req->hdev;
6046dc3e
AG		 7407 struct hci_conn_params *p;
7408
7409 list_for_each_entry(p, &hdev->le_conn_params, list) {
d7347f3c
JH		 7410 /* Needed for AUTO_OFF case where might not "really"
7411 * have been powered off.
7412 */
7413 list_del_init(&p->action);
7414
7415 switch (p->auto_connect) {
4b9e7e75 7416 case HCI_AUTO_CONN_DIRECT:
d7347f3c
JH		 7417 case HCI_AUTO_CONN_ALWAYS:
7418 list_add(&p->action, &hdev->pend_le_conns);
7419 break;
7420 case HCI_AUTO_CONN_REPORT:
7421 list_add(&p->action, &hdev->pend_le_reports);
7422 break;
7423 default:
7424 break;
c83ed19d 7425 }
6046dc3e 7426 }
c83ed19d 7427
2cf22218 7428 __hci_update_background_scan(req);
6046dc3e
AG		 7429}
7430
1904a853 7431static void powered_complete(struct hci_dev *hdev, u8 status, u16 opcode)
229ab39c
JH		 7432{
7433 struct cmd_lookup match = { NULL, hdev };
7434
7435 BT_DBG("status 0x%02x", status);
7436
162a3bac
MH		 7437 if (!status) {
7438 /* Register the available SMP channels (BR/EDR and LE) only
7439 * when successfully powering on the controller. This late
7440 * registration is required so that LE SMP can clearly
7441 * decide if the public address or static address is used.
7442 */
7443 smp_register(hdev);
7444 }
7445
229ab39c
JH		 7446 hci_dev_lock(hdev);
7447
7448 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
7449
7450 new_settings(hdev, match.sk);
7451
7452 hci_dev_unlock(hdev);
7453
7454 if (match.sk)
7455 sock_put(match.sk);
7456}
7457
70da6243 7458static int powered_update_hci(struct hci_dev *hdev)
5add6af8 7459{
890ea898 7460 struct hci_request req;
70da6243 7461 u8 link_sec;
5add6af8 7462
890ea898
JH		 7463 hci_req_init(&req, hdev);
7464
d7a5a11d 7465 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
70da6243 7466 !lmp_host_ssp_capable(hdev)) {
574ea3c7 7467 u8 mode = 0x01;
5e5282bb 7468
574ea3c7
MH		 7469 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
7470
7471 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
7472 u8 support = 0x01;
5add6af8 7473
574ea3c7
MH		 7474 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT,
7475 sizeof(support), &support);
7476 }
ec6f99b8
JH		 7477 }
7478
d7a5a11d 7479 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
c73eee91 7480 lmp_bredr_capable(hdev)) {
70da6243 7481 struct hci_cp_write_le_host_supported cp;
f0ff92fb 7482
32226e4f
MH		 7483 cp.le = 0x01;
7484 cp.simul = 0x00;
3d1cbdd6 7485
70da6243
JH		 7486 /* Check first if we already have the right
7487 * host state (host features set)
7488 */
7489 if (cp.le != lmp_host_le_capable(hdev) ||
7490 cp.simul != lmp_host_le_br_capable(hdev))
890ea898
JH		 7491 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
7492 sizeof(cp), &cp);
70da6243 7493 }
3d1cbdd6 7494
d13eafce 7495 if (lmp_le_capable(hdev)) {
441ad2d0
MH		 7496 /* Make sure the controller has a good default for
7497 * advertising data. This also applies to the case
7498 * where BR/EDR was toggled during the AUTO_OFF phase.
7499 */
d7a5a11d 7500 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
5947f4bc 7501 update_adv_data(&req);
f14d8f64
MH		 7502 update_scan_rsp_data(&req);
7503 }
441ad2d0 7504
24b4f38f
AU		 7505 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
7506 hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
bba3aa55 7507 enable_advertising(&req);
2cf22218
JH		 7508
7509 restart_le_actions(&req);
eeca6f89
JH		 7510 }
7511
d7a5a11d 7512 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
70da6243 7513 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
890ea898
JH		 7514 hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
7515 sizeof(link_sec), &link_sec);
562fcc24 7516
70da6243 7517 if (lmp_bredr_capable(hdev)) {
d7a5a11d 7518 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
406ef2a6
JH		 7519 write_fast_connectable(&req, true);
7520 else
7521 write_fast_connectable(&req, false);
1d2dc5b7 7522 __hci_update_page_scan(&req);
890ea898 7523 update_class(&req);
13928971 7524 update_name(&req);
890ea898 7525 update_eir(&req);
70da6243 7526 }
562fcc24 7527
229ab39c 7528 return hci_req_run(&req, powered_complete);
70da6243 7529}
562fcc24 7530
70da6243
JH		 7531int mgmt_powered(struct hci_dev *hdev, u8 powered)
7532{
7533 struct cmd_lookup match = { NULL, hdev };
9845904f 7534 u8 status, zero_cod[] = { 0, 0, 0 };
70da6243 7535 int err;
f0ff92fb 7536
d7a5a11d 7537 if (!hci_dev_test_flag(hdev, HCI_MGMT))
70da6243
JH		 7538 return 0;
7539
70da6243 7540 if (powered) {
229ab39c
JH		 7541 if (powered_update_hci(hdev) == 0)
7542 return 0;
fe038884 7543
229ab39c
JH		 7544 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp,
7545 &match);
7546 goto new_settings;
b24752fe
JH		 7547 }
7548
229ab39c 7549 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
9845904f
JH		 7550
7551 /* If the power off is because of hdev unregistration let
7552 * use the appropriate INVALID_INDEX status. Otherwise use
7553 * NOT_POWERED. We cover both scenarios here since later in
7554 * mgmt_index_removed() any hci_conn callbacks will have already
7555 * been triggered, potentially causing misleading DISCONNECTED
7556 * status responses.
7557 */
d7a5a11d 7558 if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
9845904f
JH		 7559 status = MGMT_STATUS_INVALID_INDEX;
7560 else
7561 status = MGMT_STATUS_NOT_POWERED;
7562
7563 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
229ab39c
JH		 7564
7565 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
f6b7712e
MH		 7566 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
7567 zero_cod, sizeof(zero_cod), NULL);
229ab39c
JH		 7568
7569new_settings:
beadb2bd 7570 err = new_settings(hdev, match.sk);
eec8d2bc
JH		 7571
7572 if (match.sk)
7573 sock_put(match.sk);
7574
7bb895d6 7575 return err;
5add6af8 7576}
73f22f62 7577
3eec705e 7578void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
96570ffc 7579{
3b0602cd 7580 struct mgmt_pending_cmd *cmd;
96570ffc
JH		 7581 u8 status;
7582
333ae95d 7583 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
96570ffc 7584 if (!cmd)
3eec705e 7585 return;
96570ffc
JH		 7586
7587 if (err == -ERFKILL)
7588 status = MGMT_STATUS_RFKILLED;
7589 else
7590 status = MGMT_STATUS_FAILED;
7591
a69e8375 7592 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
96570ffc
JH		 7593
7594 mgmt_pending_remove(cmd);
96570ffc
JH		 7595}
7596
d1967ff8
MH		 7597void mgmt_discoverable_timeout(struct hci_dev *hdev)
7598{
7599 struct hci_request req;
d1967ff8
MH		 7600
7601 hci_dev_lock(hdev);
7602
7603 /* When discoverable timeout triggers, then just make sure
7604 * the limited discoverable flag is cleared. Even in the case
7605 * of a timeout triggered from general discoverable, it is
7606 * safe to unconditionally clear the flag.
7607 */
a358dc11
MH		 7608 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
7609 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
d1967ff8
MH		 7610
7611 hci_req_init(&req, hdev);
d7a5a11d 7612 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
4b580614
JH		 7613 u8 scan = SCAN_PAGE;
7614 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
7615 sizeof(scan), &scan);
7616 }
d1967ff8 7617 update_class(&req);
24b4f38f
AU		 7618
7619 /* Advertising instances don't use the global discoverable setting, so
7620 * only update AD if advertising was enabled using Set Advertising.
7621 */
7622 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7623 update_adv_data(&req);
7624
d1967ff8
MH		 7625 hci_req_run(&req, NULL);
7626
7627 hdev->discov_timeout = 0;
7628
9a43e25f
JH		 7629 new_settings(hdev, NULL);
7630
d1967ff8
MH		 7631 hci_dev_unlock(hdev);
7632}
7633
dc4a5ee2
MH		 7634void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
7635 bool persistent)
55ed8ca1 7636{
86742e1e 7637 struct mgmt_ev_new_link_key ev;
55ed8ca1 7638
a492cd52 7639 memset(&ev, 0, sizeof(ev));
55ed8ca1 7640
a492cd52 7641 ev.store_hint = persistent;
d753fdc4 7642 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
591f47f3 7643 ev.key.addr.type = BDADDR_BREDR;
a492cd52 7644 ev.key.type = key->type;
9b3b4460 7645 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
a492cd52 7646 ev.key.pin_len = key->pin_len;
55ed8ca1 7647
dc4a5ee2 7648 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
55ed8ca1 7649}
f7520543 7650
d7b25450
JH		 7651static u8 mgmt_ltk_type(struct smp_ltk *ltk)
7652{
23fb8de3
JH		 7653 switch (ltk->type) {
7654 case SMP_LTK:
7655 case SMP_LTK_SLAVE:
7656 if (ltk->authenticated)
7657 return MGMT_LTK_AUTHENTICATED;
7658 return MGMT_LTK_UNAUTHENTICATED;
7659 case SMP_LTK_P256:
7660 if (ltk->authenticated)
7661 return MGMT_LTK_P256_AUTH;
7662 return MGMT_LTK_P256_UNAUTH;
7663 case SMP_LTK_P256_DEBUG:
7664 return MGMT_LTK_P256_DEBUG;
7665 }
d7b25450
JH		 7666
7667 return MGMT_LTK_UNAUTHENTICATED;
7668}
7669
53ac6ab6 7670void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
346af67b
VCG		 7671{
7672 struct mgmt_ev_new_long_term_key ev;
7673
7674 memset(&ev, 0, sizeof(ev));
7675
5192d301 7676 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7677 * without providing an identity resolving key don't require
5192d301
MH		 7678 * to store long term keys. Their addresses will change the
7679 * next time around.
7680 *
7681 * Only when a remote device provides an identity address
7682 * make sure the long term key is stored. If the remote
7683 * identity is known, the long term keys are internally
7684 * mapped to the identity address. So allow static random
7685 * and public addresses here.
7686 */
ba74b666
JH		 7687 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7688 (key->bdaddr.b[5] & 0xc0) != 0xc0)
7689 ev.store_hint = 0x00;
7690 else
53ac6ab6 7691 ev.store_hint = persistent;
ba74b666 7692
346af67b 7693 bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
57c1477c 7694 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
d7b25450 7695 ev.key.type = mgmt_ltk_type(key);
346af67b
VCG		 7696 ev.key.enc_size = key->enc_size;
7697 ev.key.ediv = key->ediv;
fe39c7b2 7698 ev.key.rand = key->rand;
346af67b 7699
2ceba539 7700 if (key->type == SMP_LTK)
346af67b
VCG		 7701 ev.key.master = 1;
7702
1fc62c52
JH		 7703 /* Make sure we copy only the significant bytes based on the
7704 * encryption key size, and set the rest of the value to zeroes.
7705 */
7706 memcpy(ev.key.val, key->val, sizeof(key->enc_size));
7707 memset(ev.key.val + key->enc_size, 0,
7708 sizeof(ev.key.val) - key->enc_size);
346af67b 7709
083368f7 7710 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL);
346af67b
VCG		 7711}
7712
95fbac8a
JH		 7713void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk)
7714{
7715 struct mgmt_ev_new_irk ev;
7716
7717 memset(&ev, 0, sizeof(ev));
7718
bab6d1e5
MH		 7719 /* For identity resolving keys from devices that are already
7720 * using a public address or static random address, do not
7721 * ask for storing this key. The identity resolving key really
f72186d2 7722 * is only mandatory for devices using resolvable random
bab6d1e5
MH		 7723 * addresses.
7724 *
7725 * Storing all identity resolving keys has the downside that
7726 * they will be also loaded on next boot of they system. More
7727 * identity resolving keys, means more time during scanning is
7728 * needed to actually resolve these addresses.
7729 */
7730 if (bacmp(&irk->rpa, BDADDR_ANY))
7731 ev.store_hint = 0x01;
7732 else
7733 ev.store_hint = 0x00;
7734
95fbac8a
JH		 7735 bacpy(&ev.rpa, &irk->rpa);
7736 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
7737 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
7738 memcpy(ev.irk.val, irk->val, sizeof(irk->val));
7739
7740 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
7741}
7742
53ac6ab6
MH		 7743void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
7744 bool persistent)
7ee4ea36
MH		 7745{
7746 struct mgmt_ev_new_csrk ev;
7747
7748 memset(&ev, 0, sizeof(ev));
7749
7750 /* Devices using resolvable or non-resolvable random addresses
f72186d2 7751 * without providing an identity resolving key don't require
7ee4ea36
MH		 7752 * to store signature resolving keys. Their addresses will change
7753 * the next time around.
7754 *
7755 * Only when a remote device provides an identity address
7756 * make sure the signature resolving key is stored. So allow
7757 * static random and public addresses here.
7758 */
7759 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM &&
7760 (csrk->bdaddr.b[5] & 0xc0) != 0xc0)
7761 ev.store_hint = 0x00;
7762 else
53ac6ab6 7763 ev.store_hint = persistent;
7ee4ea36
MH		 7764
7765 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
7766 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
4cd3928a 7767 ev.key.type = csrk->type;
7ee4ea36
MH		 7768 memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
7769
7770 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
7771}
7772
ffb5a827 7773void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
f4869e2a
JH		 7774 u8 bdaddr_type, u8 store_hint, u16 min_interval,
7775 u16 max_interval, u16 latency, u16 timeout)
ffb5a827
AG		 7776{
7777 struct mgmt_ev_new_conn_param ev;
7778
c103aea6
JH		 7779 if (!hci_is_identity_address(bdaddr, bdaddr_type))
7780 return;
7781
ffb5a827
AG		 7782 memset(&ev, 0, sizeof(ev));
7783 bacpy(&ev.addr.bdaddr, bdaddr);
7784 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type);
f4869e2a 7785 ev.store_hint = store_hint;
ffb5a827
AG		 7786 ev.min_interval = cpu_to_le16(min_interval);
7787 ev.max_interval = cpu_to_le16(max_interval);
7788 ev.latency = cpu_to_le16(latency);
7789 ev.timeout = cpu_to_le16(timeout);
7790
7791 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
7792}
7793
48ec92fa
AA		 7794void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
7795 u32 flags, u8 *name, u8 name_len)
f7520543 7796{
b644ba33
JH		 7797 char buf[512];
7798 struct mgmt_ev_device_connected *ev = (void *) buf;
7799 u16 eir_len = 0;
f7520543 7800
48ec92fa
AA		 7801 bacpy(&ev->addr.bdaddr, &conn->dst);
7802 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);
f7520543 7803
c95f0ba7 7804 ev->flags = __cpu_to_le32(flags);
08c79b61 7805
fd45ada9
AA		 7806 /* We must ensure that the EIR Data fields are ordered and
7807 * unique. Keep it simple for now and avoid the problem by not
7808 * adding any BR/EDR data to the LE adv.
7809 */
7810 if (conn->le_adv_data_len > 0) {
7811 memcpy(&ev->eir[eir_len],
7812 conn->le_adv_data, conn->le_adv_data_len);
7813 eir_len = conn->le_adv_data_len;
7814 } else {
7815 if (name_len > 0)
7816 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
7817 name, name_len);
b644ba33 7818
ddbea5cf 7819 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0)
fd45ada9
AA		 7820 eir_len = eir_append_data(ev->eir, eir_len,
7821 EIR_CLASS_OF_DEV,
7822 conn->dev_class, 3);
7823 }
b644ba33 7824
eb55ef07 7825 ev->eir_len = cpu_to_le16(eir_len);
b644ba33 7826
ecd90ae7
MH		 7827 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
7828 sizeof(*ev) + eir_len, NULL);
f7520543
JH		 7829}
7830
3b0602cd 7831static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
8962ee74 7832{
8962ee74 7833 struct sock **sk = data;
8962ee74 7834
f5818c22 7835 cmd->cmd_complete(cmd, 0);
8962ee74
JH		 7836
7837 *sk = cmd->sk;
7838 sock_hold(*sk);
7839
a664b5bc 7840 mgmt_pending_remove(cmd);
8962ee74
JH		 7841}
7842
3b0602cd 7843static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
a8a1d19e 7844{
b1078ad0 7845 struct hci_dev *hdev = data;
124f6e35 7846 struct mgmt_cp_unpair_device *cp = cmd->param;
a8a1d19e 7847
b1078ad0
JH		 7848 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
7849
d8b7b1e4 7850 cmd->cmd_complete(cmd, 0);
a8a1d19e
JH		 7851 mgmt_pending_remove(cmd);
7852}
7853
84c61d92
JH		 7854bool mgmt_powering_down(struct hci_dev *hdev)
7855{
3b0602cd 7856 struct mgmt_pending_cmd *cmd;
84c61d92
JH		 7857 struct mgmt_mode *cp;
7858
333ae95d 7859 cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
84c61d92
JH		 7860 if (!cmd)
7861 return false;
7862
7863 cp = cmd->param;
7864 if (!cp->val)
7865 return true;
7866
7867 return false;
7868}
7869
9b80ec5e 7870void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
12d4a3b2
JH		 7871 u8 link_type, u8 addr_type, u8 reason,
7872 bool mgmt_connected)
f7520543 7873{
f0d6a0ea 7874 struct mgmt_ev_device_disconnected ev;
8962ee74 7875 struct sock *sk = NULL;
8962ee74 7876
84c61d92
JH		 7877 /* The connection is still in hci_conn_hash so test for 1
7878 * instead of 0 to know if this is the last one.
7879 */
7880 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7881 cancel_delayed_work(&hdev->power_off);
7882 queue_work(hdev->req_workqueue, &hdev->power_off.work);
8b064a3a
JH		 7883 }
7884
12d4a3b2
JH		 7885 if (!mgmt_connected)
7886 return;
7887
57eb776f
AG		 7888 if (link_type != ACL_LINK && link_type != LE_LINK)
7889 return;
7890
744cf19e 7891 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk);
f7520543 7892
f0d6a0ea
MA		 7893 bacpy(&ev.addr.bdaddr, bdaddr);
7894 ev.addr.type = link_to_bdaddr(link_type, addr_type);
7895 ev.reason = reason;
f7520543 7896
9b80ec5e 7897 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
8962ee74
JH		 7898
7899 if (sk)
d97dcb66 7900 sock_put(sk);
8962ee74 7901
124f6e35 7902 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
04124681 7903 hdev);
8962ee74
JH		 7904}
7905
7892924c
MH		 7906void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
7907 u8 link_type, u8 addr_type, u8 status)
8962ee74 7908{
3655bba8
AG		 7909 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
7910 struct mgmt_cp_disconnect *cp;
3b0602cd 7911 struct mgmt_pending_cmd *cmd;
8962ee74 7912
36a75f1b
JD		 7913 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
7914 hdev);
7915
333ae95d 7916 cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
8962ee74 7917 if (!cmd)
7892924c 7918 return;
8962ee74 7919
3655bba8
AG		 7920 cp = cmd->param;
7921
7922 if (bacmp(bdaddr, &cp->addr.bdaddr))
7923 return;
7924
7925 if (cp->addr.type != bdaddr_type)
7926 return;
7927
f5818c22 7928 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7929 mgmt_pending_remove(cmd);
f7520543 7930}
17d5c04c 7931
445608d0
MH		 7932void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
7933 u8 addr_type, u8 status)
17d5c04c
JH		 7934{
7935 struct mgmt_ev_connect_failed ev;
c9910d0f 7936
84c61d92
JH		 7937 /* The connection is still in hci_conn_hash so test for 1
7938 * instead of 0 to know if this is the last one.
7939 */
7940 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
7941 cancel_delayed_work(&hdev->power_off);
7942 queue_work(hdev->req_workqueue, &hdev->power_off.work);
c9910d0f 7943 }
17d5c04c 7944
4c659c39 7945 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7946 ev.addr.type = link_to_bdaddr(link_type, addr_type);
ca69b795 7947 ev.status = mgmt_status(status);
17d5c04c 7948
445608d0 7949 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL);
17d5c04c 7950}
980e1a53 7951
ce0e4a0d 7952void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
980e1a53
JH		 7953{
7954 struct mgmt_ev_pin_code_request ev;
7955
d8457698 7956 bacpy(&ev.addr.bdaddr, bdaddr);
591f47f3 7957 ev.addr.type = BDADDR_BREDR;
a770bb5a 7958 ev.secure = secure;
980e1a53 7959
ce0e4a0d 7960 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL);
980e1a53
JH		 7961}
7962
e669cf80
MH		 7963void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7964 u8 status)
980e1a53 7965{
3b0602cd 7966 struct mgmt_pending_cmd *cmd;
980e1a53 7967
333ae95d 7968 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
980e1a53 7969 if (!cmd)
e669cf80 7970 return;
980e1a53 7971
7776d1d8 7972 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7973 mgmt_pending_remove(cmd);
980e1a53
JH		 7974}
7975
3eb38528
MH		 7976void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
7977 u8 status)
980e1a53 7978{
3b0602cd 7979 struct mgmt_pending_cmd *cmd;
980e1a53 7980
333ae95d 7981 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
980e1a53 7982 if (!cmd)
3eb38528 7983 return;
980e1a53 7984
7776d1d8 7985 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 7986 mgmt_pending_remove(cmd);
980e1a53 7987}
a5c29683 7988
744cf19e 7989int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
39adbffe 7990 u8 link_type, u8 addr_type, u32 value,
04124681 7991 u8 confirm_hint)
a5c29683
JH		 7992{
7993 struct mgmt_ev_user_confirm_request ev;
7994
744cf19e 7995 BT_DBG("%s", hdev->name);
a5c29683 7996
272d90df 7997 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 7998 ev.addr.type = link_to_bdaddr(link_type, addr_type);
55bc1a37 7999 ev.confirm_hint = confirm_hint;
39adbffe 8000 ev.value = cpu_to_le32(value);
a5c29683 8001
744cf19e 8002 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev),
04124681 8003 NULL);
a5c29683
JH		 8004}
8005
272d90df 8006int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5 8007 u8 link_type, u8 addr_type)
604086b7
BG		 8008{
8009 struct mgmt_ev_user_passkey_request ev;
8010
8011 BT_DBG("%s", hdev->name);
8012
272d90df 8013 bacpy(&ev.addr.bdaddr, bdaddr);
57c1477c 8014 ev.addr.type = link_to_bdaddr(link_type, addr_type);
604086b7
BG		 8015
8016 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
04124681 8017 NULL);
604086b7
BG		 8018}
8019
0df4c185 8020static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
8ce8e2b5
GP		 8021 u8 link_type, u8 addr_type, u8 status,
8022 u8 opcode)
a5c29683 8023{
3b0602cd 8024 struct mgmt_pending_cmd *cmd;
a5c29683 8025
333ae95d 8026 cmd = pending_find(opcode, hdev);
a5c29683
JH		 8027 if (!cmd)
8028 return -ENOENT;
8029
7776d1d8 8030 cmd->cmd_complete(cmd, mgmt_status(status));
a664b5bc 8031 mgmt_pending_remove(cmd);
a5c29683 8032
7776d1d8 8033 return 0;
a5c29683
JH		 8034}
8035
744cf19e 8036int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8037 u8 link_type, u8 addr_type, u8 status)
a5c29683 8038{
272d90df 8039 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8040 status, MGMT_OP_USER_CONFIRM_REPLY);
a5c29683
JH		 8041}
8042
272d90df 8043int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8044 u8 link_type, u8 addr_type, u8 status)
a5c29683 8045{
272d90df 8046 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8047 status,
8048 MGMT_OP_USER_CONFIRM_NEG_REPLY);
a5c29683 8049}
2a611692 8050
604086b7 8051int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8052 u8 link_type, u8 addr_type, u8 status)
604086b7 8053{
272d90df 8054 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
04124681 8055 status, MGMT_OP_USER_PASSKEY_REPLY);
604086b7
BG		 8056}
8057
272d90df 8058int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 8059 u8 link_type, u8 addr_type, u8 status)
604086b7 8060{
272d90df 8061 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
8fc9ced3
GP		 8062 status,
8063 MGMT_OP_USER_PASSKEY_NEG_REPLY);
604086b7
BG		 8064}
8065
92a25256
JH		 8066int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
8067 u8 link_type, u8 addr_type, u32 passkey,
8068 u8 entered)
8069{
8070 struct mgmt_ev_passkey_notify ev;
8071
8072 BT_DBG("%s", hdev->name);
8073
8074 bacpy(&ev.addr.bdaddr, bdaddr);
8075 ev.addr.type = link_to_bdaddr(link_type, addr_type);
8076 ev.passkey = __cpu_to_le32(passkey);
8077 ev.entered = entered;
8078
8079 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL);
8080}
8081
e1e930f5 8082void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
2a611692
JH		 8083{
8084 struct mgmt_ev_auth_failed ev;
3b0602cd 8085 struct mgmt_pending_cmd *cmd;
e1e930f5 8086 u8 status = mgmt_status(hci_status);
2a611692 8087
e1e930f5
JH		 8088 bacpy(&ev.addr.bdaddr, &conn->dst);
8089 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
8090 ev.status = status;
2a611692 8091
e1e930f5
JH		 8092 cmd = find_pairing(conn);
8093
8094 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
8095 cmd ? cmd->sk : NULL);
8096
a511b35b
JH		 8097 if (cmd) {
8098 cmd->cmd_complete(cmd, status);
8099 mgmt_pending_remove(cmd);
8100 }
2a611692 8101}
b312b161 8102
464996ae 8103void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
33ef95ed
JH		 8104{
8105 struct cmd_lookup match = { NULL, hdev };
464996ae 8106 bool changed;
33ef95ed
JH		 8107
8108 if (status) {
8109 u8 mgmt_err = mgmt_status(status);
8110 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
04124681 8111 cmd_status_rsp, &mgmt_err);
464996ae 8112 return;
33ef95ed
JH		 8113 }
8114
464996ae 8115 if (test_bit(HCI_AUTH, &hdev->flags))
238be788 8116 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
464996ae 8117 else
a69d8927 8118 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
47990ea0 8119
33ef95ed 8120 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
04124681 8121 &match);
33ef95ed 8122
47990ea0 8123 if (changed)
464996ae 8124 new_settings(hdev, match.sk);
33ef95ed
JH		 8125
8126 if (match.sk)
8127 sock_put(match.sk);
33ef95ed
JH		 8128}
8129
890ea898 8130static void clear_eir(struct hci_request *req)
cacaf52f 8131{
890ea898 8132 struct hci_dev *hdev = req->hdev;
cacaf52f
JH		 8133 struct hci_cp_write_eir cp;
8134
976eb20e 8135 if (!lmp_ext_inq_capable(hdev))
890ea898 8136 return;
cacaf52f 8137
c80da27e
JH		 8138 memset(hdev->eir, 0, sizeof(hdev->eir));
8139
cacaf52f
JH		 8140 memset(&cp, 0, sizeof(cp));
8141
890ea898 8142 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
cacaf52f
JH		 8143}
8144
3e248560 8145void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
ed2c4ee3
JH		 8146{
8147 struct cmd_lookup match = { NULL, hdev };
890ea898 8148 struct hci_request req;
c0ecddc2 8149 bool changed = false;
ed2c4ee3
JH		 8150
8151 if (status) {
8152 u8 mgmt_err = mgmt_status(status);
c0ecddc2 8153
a69d8927
MH		 8154 if (enable && hci_dev_test_and_clear_flag(hdev,
8155 HCI_SSP_ENABLED)) {
a358dc11 8156 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
3e248560 8157 new_settings(hdev, NULL);
9ecb3e24 8158 }
c0ecddc2 8159
04124681
GP		 8160 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp,
8161 &mgmt_err);
3e248560 8162 return;
c0ecddc2
JH		 8163 }
8164
8165 if (enable) {
238be788 8166 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 8167 } else {
a69d8927 8168 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
9ecb3e24 8169 if (!changed)
a69d8927
MH		 8170 changed = hci_dev_test_and_clear_flag(hdev,
8171 HCI_HS_ENABLED);
9ecb3e24 8172 else
a358dc11 8173 hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
ed2c4ee3
JH		 8174 }
8175
8176 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
8177
c0ecddc2 8178 if (changed)
3e248560 8179 new_settings(hdev, match.sk);
ed2c4ee3 8180
5fc6ebb1 8181 if (match.sk)
ed2c4ee3
JH		 8182 sock_put(match.sk);
8183
890ea898
JH		 8184 hci_req_init(&req, hdev);
8185
d7a5a11d
MH		 8186 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
8187 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
3769972b
JH		 8188 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
8189 sizeof(enable), &enable);
890ea898 8190 update_eir(&req);
3769972b 8191 } else {
890ea898 8192 clear_eir(&req);
3769972b 8193 }
890ea898
JH		 8194
8195 hci_req_run(&req, NULL);
ed2c4ee3
JH		 8196}
8197
3b0602cd 8198static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
90e70454
JH		 8199{
8200 struct cmd_lookup *match = data;
8201
90e70454
JH		 8202 if (match->sk == NULL) {
8203 match->sk = cmd->sk;
8204 sock_hold(match->sk);
8205 }
90e70454
JH		 8206}
8207
4e1b0245
MH		 8208void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
8209 u8 status)
7f9a903c 8210{
90e70454 8211 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) };
7f9a903c 8212
92da6097
JH		 8213 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match);
8214 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match);
8215 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
90e70454
JH		 8216
8217 if (!status)
f6b7712e
MH		 8218 mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
8219 dev_class, 3, NULL);
90e70454
JH		 8220
8221 if (match.sk)
8222 sock_put(match.sk);
7f9a903c
MH		 8223}
8224
7667da34 8225void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
b312b161 8226{
b312b161 8227 struct mgmt_cp_set_local_name ev;
3b0602cd 8228 struct mgmt_pending_cmd *cmd;
28cc7bde 8229
13928971 8230 if (status)
7667da34 8231 return;
b312b161
JH		 8232
8233 memset(&ev, 0, sizeof(ev));
8234 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
28cc7bde 8235 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
b312b161 8236
333ae95d 8237 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
13928971
JH		 8238 if (!cmd) {
8239 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
28cc7bde 8240
13928971
JH		 8241 /* If this is a HCI command related to powering on the
8242 * HCI dev don't send any mgmt signals.
8243 */
333ae95d 8244 if (pending_find(MGMT_OP_SET_POWERED, hdev))
7667da34 8245 return;
890ea898 8246 }
b312b161 8247
f6b7712e
MH		 8248 mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
8249 cmd ? cmd->sk : NULL);
b312b161 8250}
c35938b2 8251
799ce93d
JP		 8252static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
8253{
8254 int i;
8255
8256 for (i = 0; i < uuid_count; i++) {
8257 if (!memcmp(uuid, uuids[i], 16))
8258 return true;
8259 }
8260
8261 return false;
8262}
8263
b487b9ce
MH		 8264static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
8265{
799ce93d
JP		 8266 u16 parsed = 0;
8267
8268 while (parsed < eir_len) {
8269 u8 field_len = eir[0];
8270 u8 uuid[16];
8271 int i;
8272
8273 if (field_len == 0)
8274 break;
8275
8276 if (eir_len - parsed < field_len + 1)
8277 break;
8278
8279 switch (eir[1]) {
8280 case EIR_UUID16_ALL:
8281 case EIR_UUID16_SOME:
8282 for (i = 0; i + 3 <= field_len; i += 2) {
189f6ad2 8283 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8284 uuid[13] = eir[i + 3];
8285 uuid[12] = eir[i + 2];
8286 if (has_uuid(uuid, uuid_count, uuids))
8287 return true;
8288 }
8289 break;
8290 case EIR_UUID32_ALL:
8291 case EIR_UUID32_SOME:
8292 for (i = 0; i + 5 <= field_len; i += 4) {
189f6ad2 8293 memcpy(uuid, bluetooth_base_uuid, 16);
799ce93d
JP		 8294 uuid[15] = eir[i + 5];
8295 uuid[14] = eir[i + 4];
8296 uuid[13] = eir[i + 3];
8297 uuid[12] = eir[i + 2];
8298 if (has_uuid(uuid, uuid_count, uuids))
8299 return true;
8300 }
8301 break;
8302 case EIR_UUID128_ALL:
8303 case EIR_UUID128_SOME:
8304 for (i = 0; i + 17 <= field_len; i += 16) {
8305 memcpy(uuid, eir + i + 2, 16);
8306 if (has_uuid(uuid, uuid_count, uuids))
8307 return true;
8308 }
8309 break;
8310 }
8311
8312 parsed += field_len + 1;
8313 eir += field_len + 1;
8314 }
8315
b487b9ce
MH		 8316 return false;
8317}
8318
4b0e0ced
JP		 8319static void restart_le_scan(struct hci_dev *hdev)
8320{
8321 /* If controller is not scanning we are done. */
d7a5a11d 8322 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
4b0e0ced
JP		 8323 return;
8324
8325 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
8326 hdev->discovery.scan_start +
8327 hdev->discovery.scan_duration))
8328 return;
8329
8330 queue_delayed_work(hdev->workqueue, &hdev->le_scan_restart,
8331 DISCOV_LE_RESTART_DELAY);
8332}
8333
48f86b7f
JP		 8334static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
8335 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
e17acd40 8336{
48f86b7f
JP		 8337 /* If a RSSI threshold has been specified, and
8338 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
8339 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
8340 * is set, let it through for further processing, as we might need to
8341 * restart the scan.
efb2513f
MH		 8342 *
8343 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
8344 * the results are also dropped.
bda157a4
MH		 8345 */
8346 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
4b0e0ced
JP		 8347 (rssi == HCI_RSSI_INVALID ||
8348 (rssi < hdev->discovery.rssi &&
8349 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
48f86b7f 8350 return false;
efb2513f 8351
2976cdeb
JP		 8352 if (hdev->discovery.uuid_count != 0) {
8353 /* If a list of UUIDs is provided in filter, results with no
8354 * matching UUID should be dropped.
b487b9ce 8355 */
2976cdeb
JP		 8356 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
8357 hdev->discovery.uuids) &&
8358 !eir_has_uuids(scan_rsp, scan_rsp_len,
8359 hdev->discovery.uuid_count,
8360 hdev->discovery.uuids))
8361 return false;
b487b9ce 8362 }
5d2e9fad 8363
2976cdeb
JP		 8364 /* If duplicate filtering does not report RSSI changes, then restart
8365 * scanning to ensure updated result with updated RSSI values.
4b0e0ced 8366 */
2976cdeb
JP		 8367 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
8368 restart_le_scan(hdev);
8369
8370 /* Validate RSSI value against the RSSI threshold once more. */
8371 if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
8372 rssi < hdev->discovery.rssi)
8373 return false;
8374 }
48f86b7f
JP		 8375
8376 return true;
8377}
8378
8379void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8380 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
8381 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
8382{
8383 char buf[512];
8384 struct mgmt_ev_device_found *ev = (void *)buf;
8385 size_t ev_size;
8386
8387 /* Don't send events for a non-kernel initiated discovery. With
8388 * LE one exception is if we have pend_le_reports > 0 in which
8389 * case we're doing passive scanning and want these events.
8390 */
8391 if (!hci_discovery_active(hdev)) {
8392 if (link_type == ACL_LINK)
8393 return;
8394 if (link_type == LE_LINK && list_empty(&hdev->pend_le_reports))
8395 return;
8396 }
8397
82f8b651 8398 if (hdev->discovery.result_filtering) {
48f86b7f
JP		 8399 /* We are using service discovery */
8400 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
8401 scan_rsp_len))
8402 return;
8403 }
8404
8405 /* Make sure that the buffer is big enough. The 5 extra bytes
8406 * are for the potential CoD field.
8407 */
8408 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
4b0e0ced
JP		 8409 return;
8410
48f86b7f
JP		 8411 memset(buf, 0, sizeof(buf));
8412
8413 /* In case of device discovery with BR/EDR devices (pre 1.2), the
8414 * RSSI value was reported as 0 when not available. This behavior
8415 * is kept when using device discovery. This is required for full
8416 * backwards compatibility with the API.
8417 *
8418 * However when using service discovery, the value 127 will be
8419 * returned when the RSSI is not available.
8420 */
8421 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi &&
8422 link_type == ACL_LINK)
8423 rssi = 0;
8424
8425 bacpy(&ev->addr.bdaddr, bdaddr);
8426 ev->addr.type = link_to_bdaddr(link_type, addr_type);
8427 ev->rssi = rssi;
8428 ev->flags = cpu_to_le32(flags);
8429
8430 if (eir_len > 0)
8431 /* Copy EIR or advertising data into event */
8432 memcpy(ev->eir, eir, eir_len);
8433
8434 if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
8435 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
8436 dev_class, 3);
8437
8438 if (scan_rsp_len > 0)
8439 /* Append scan response data to event */
8440 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
8441
5d2e9fad
JH		 8442 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
8443 ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
f8523598 8444
901801b9 8445 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
e17acd40 8446}
a88a9652 8447
9cf12aee
MH		 8448void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
8449 u8 addr_type, s8 rssi, u8 *name, u8 name_len)
a88a9652 8450{
b644ba33
JH		 8451 struct mgmt_ev_device_found *ev;
8452 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
8453 u16 eir_len;
a88a9652 8454
b644ba33 8455 ev = (struct mgmt_ev_device_found *) buf;
a88a9652 8456
b644ba33
JH		 8457 memset(buf, 0, sizeof(buf));
8458
8459 bacpy(&ev->addr.bdaddr, bdaddr);
57c1477c 8460 ev->addr.type = link_to_bdaddr(link_type, addr_type);
b644ba33
JH		 8461 ev->rssi = rssi;
8462
8463 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
04124681 8464 name_len);
b644ba33 8465
eb55ef07 8466 ev->eir_len = cpu_to_le16(eir_len);
a88a9652 8467
9cf12aee 8468 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL);
a88a9652 8469}
314b2381 8470
2f1e063b 8471void mgmt_discovering(struct hci_dev *hdev, u8 discovering)
314b2381 8472{
f963e8e9 8473 struct mgmt_ev_discovering ev;
164a6e78 8474
343fb145
AG		 8475 BT_DBG("%s discovering %u", hdev->name, discovering);
8476
f963e8e9
JH		 8477 memset(&ev, 0, sizeof(ev));
8478 ev.type = hdev->discovery.type;
8479 ev.discovering = discovering;
8480
2f1e063b 8481 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL);
314b2381 8482}
5e762444 8483
1904a853 8484static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
5976e608
MH		 8485{
8486 BT_DBG("%s status %u", hdev->name, status);
5976e608
MH		 8487}
8488
8489void mgmt_reenable_advertising(struct hci_dev *hdev)
8490{
8491 struct hci_request req;
8492
24b4f38f
AU		 8493 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
8494 !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
5976e608
MH		 8495 return;
8496
8497 hci_req_init(&req, hdev);
8498 enable_advertising(&req);
0ec5ae84 8499 hci_req_run(&req, adv_enable_complete);
5976e608 8500}
6d785aa3
JH		 8501
8502static struct hci_mgmt_chan chan = {
8503 .channel = HCI_CHANNEL_CONTROL,
8504 .handler_count = ARRAY_SIZE(mgmt_handlers),
8505 .handlers = mgmt_handlers,
88b94ce9 8506 .hdev_init = mgmt_init_hdev,
6d785aa3
JH		 8507};
8508
8509int mgmt_init(void)
8510{
8511 return hci_mgmt_chan_register(&chan);
8512}
8513
8514void mgmt_exit(void)
8515{
8516 hci_mgmt_chan_unregister(&chan);
8517}
Linux kernel - Deliverables
This page took 0.933339 seconds and 5 git commands to generate.